@loomhelix/deptrail 0.1.0

package/dist/query/dependents.js

@@ -0,0 +1,135 @@
+import { IMPORTER_PREFIX } from "../model.js";
+import { findNode, requireNode, UnknownNodeError, viewOf } from "./lookup.js";
+const DEFAULT_NODE_LIMIT = 5000;
+const upwardIndexes = new WeakMap();
+function kindsKey(kinds) {
+    return [...kinds].sort().join(',');
+}
+function buildUpwardIndex(root, kinds) {
+    const nodes = [...root.importers, ...root.packages.values()];
+    const positionOf = new Map(nodes.map((node, position) => [node.id, position]));
+    const passingTargets = nodes.map((node) => new Set(node.deps.filter((edge) => kinds.has(edge.kind)).map((edge) => edge.to)));
+    const parentStarts = new Int32Array(nodes.length + 1);
+    const parentPositions = [];
+    nodes.forEach((node, position) => {
+        parentStarts[position] = parentPositions.length;
+        for (const parentId of node.dependents) {
+            const parent = positionOf.get(parentId);
+            if (parent !== undefined && passingTargets[parent].has(node.id))
+                parentPositions.push(parent);
+        }
+    });
+    parentStarts[nodes.length] = parentPositions.length;
+    return {
+        ids: nodes.map((node) => node.id),
+        positionOf,
+        isImporter: Uint8Array.from(nodes, (node) => (node.id.startsWith(IMPORTER_PREFIX) ? 1 : 0)),
+        parentStarts,
+        parentPositions: Int32Array.from(parentPositions),
+    };
+}
+export function upwardIndex(root, kinds) {
+    const key = kindsKey(kinds);
+    let byKinds = upwardIndexes.get(root);
+    if (byKinds === undefined) {
+        byKinds = new Map();
+        upwardIndexes.set(root, byKinds);
+    }
+    const known = byKinds.get(key);
+    if (known)
+        return known;
+    const built = buildUpwardIndex(root, kinds);
+    byKinds.set(key, built);
+    return built;
+}
+export class ParentLinkResolver {
+    root;
+    kinds;
+    firstPassingEdges = new Map();
+    constructor(root, kinds) {
+        this.root = root;
+        this.kinds = kinds;
+    }
+    of(node) {
+        const links = [];
+        for (const parentId of node.dependents) {
+            const edge = this.edgesOf(parentId).get(node.id);
+            if (edge)
+                links.push({ id: parentId, kind: edge.kind, range: edge.range });
+        }
+        return links;
+    }
+    edgesOf(parentId) {
+        const cached = this.firstPassingEdges.get(parentId);
+        if (cached)
+            return cached;
+        const byTarget = new Map();
+        for (const edge of findNode(this.root, parentId)?.deps ?? []) {
+            if (this.kinds.has(edge.kind) && !byTarget.has(edge.to))
+                byTarget.set(edge.to, edge);
+        }
+        this.firstPassingEdges.set(parentId, byTarget);
+        return byTarget;
+    }
+}
+export function dependentsSummary(root, id, kinds) {
+    const { ids, positionOf, isImporter, parentStarts, parentPositions } = upwardIndex(root, kinds);
+    const focus = positionOf.get(id);
+    if (focus === undefined)
+        throw new UnknownNodeError(id);
+    const visited = new Uint8Array(ids.length);
+    const importers = new Set();
+    const importersByDirect = new Map();
+    const queue = [focus];
+    visited[focus] = 1;
+    for (let cursor = 0; cursor < queue.length; cursor++) {
+        const position = queue[cursor];
+        const importerParents = [];
+        for (let link = parentStarts[position]; link < parentStarts[position + 1]; link++) {
+            const parent = parentPositions[link];
+            if (isImporter[parent] === 1) {
+                importers.add(ids[parent]);
+                importerParents.push(ids[parent]);
+            }
+            if (visited[parent] === 1)
+                continue;
+            visited[parent] = 1;
+            queue.push(parent);
+        }
+        if (importerParents.length > 0 && isImporter[position] === 0)
+            importersByDirect.set(ids[position], importerParents.sort());
+    }
+    importers.delete(id);
+    const via = [...importersByDirect].map(([direct, directImporters]) => ({ direct, importers: directImporters }));
+    via.sort((left, right) => (left.direct < right.direct ? -1 : left.direct > right.direct ? 1 : 0));
+    return { importers: [...importers].sort(), via };
+}
+export function dependents(root, id, maxDepth, kinds, nodeLimit = DEFAULT_NODE_LIMIT) {
+    const focus = requireNode(root, id);
+    const links = new ParentLinkResolver(root, kinds);
+    const nodes = [];
+    const seen = new Set([id]);
+    let truncated = false;
+    let frontier = [focus];
+    for (let depth = 1; depth <= maxDepth && frontier.length > 0 && !truncated; depth++) {
+        const nextFrontier = [];
+        for (const node of frontier) {
+            for (const link of links.of(node)) {
+                if (seen.has(link.id))
+                    continue;
+                if (nodes.length >= nodeLimit) {
+                    truncated = true;
+                    break;
+                }
+                seen.add(link.id);
+                const parent = requireNode(root, link.id);
+                nodes.push({ node: viewOf(parent), parents: links.of(parent), depth });
+                nextFrontier.push(parent);
+            }
+            if (truncated)
+                break;
+        }
+        frontier = nextFrontier;
+    }
+    return { focus: viewOf(focus), focusParents: links.of(focus), nodes, summary: dependentsSummary(root, id, kinds), truncated };
+}

package/dist/query/duplicates.js

@@ -0,0 +1,23 @@
+import semver from 'semver';
+export function duplicates(index, rootId) {
+    const found = [];
+    for (const [name, entries] of index) {
+        const rootsByVersion = new Map();
+        for (const entry of entries) {
+            if (rootId !== undefined && entry.rootId !== rootId)
+                continue;
+            if (semver.valid(entry.version) === null)
+                continue;
+            const roots = rootsByVersion.get(entry.version) ?? new Set();
+            roots.add(entry.rootId);
+            rootsByVersion.set(entry.version, roots);
+        }
+        if (rootsByVersion.size < 2)
+            continue;
+        const versions = [...rootsByVersion]
+            .sort(([left], [right]) => semver.rcompare(left, right))
+            .map(([version, roots]) => ({ version, roots: [...roots].sort() }));
+        found.push({ name, versions });
+    }
+    return found.sort((left, right) => right.versions.length - left.versions.length || (left.name < right.name ? -1 : 1));
+}

package/dist/query/enrichment-lookup.js

@@ -0,0 +1,78 @@
+import { SEVERITY_ORDER } from "../enrich/types.js";
+import { IMPORTER_PREFIX } from "../model.js";
+function severityRank(severity) {
+    return SEVERITY_ORDER.indexOf(severity);
+}
+export function worstSeverity(severities) {
+    let worst;
+    for (const severity of severities) {
+        if (worst === undefined || severityRank(severity) < severityRank(worst))
+            worst = severity;
+    }
+    return worst;
+}
+export function nodeMeta(view, root, node) {
+    const registry = view.registryOf(root, node);
+    return registry.state === 'ok' || registry.state === 'stale' ? registry.meta : undefined;
+}
+function standInAdvisory(id) {
+    return {
+        id,
+        aliases: [],
+        summary: '',
+        severity: 'unknown',
+        malicious: false,
+        url: `https://osv.dev/vulnerability/${id}`,
+        fixedIn: [],
+        modified: '',
+        affected: [],
+    };
+}
+function compareAdvisories(left, right) {
+    const bySeverity = severityRank(left.severity) - severityRank(right.severity);
+    if (bySeverity !== 0)
+        return bySeverity;
+    return left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
+}
+function findAdvisory(advisories, id) {
+    return advisories.find((advisory) => advisory.id === id || advisory.aliases.includes(id));
+}
+function loadedAdvisoriesOf(view, name) {
+    const loaded = view.advisoriesOf(name);
+    return loaded.state === 'ok' || loaded.state === 'stale' ? loaded.advisories : undefined;
+}
+export function nodeAdvisories(view, root, node) {
+    return advisoriesOfMatch(view, node.name, view.matchOf(root, node));
+}
+export function completePackageAdvisories(view, root, node) {
+    const match = view.matchOf(root, node);
+    if (match.state !== 'ok' && match.state !== 'stale')
+        return undefined;
+    const known = loadedAdvisoriesOf(view, node.name);
+    if (known === undefined)
+        return undefined;
+    for (const { id } of match.vulns) {
+        if (findAdvisory(known, id) === undefined)
+            return undefined;
+    }
+    return known;
+}
+export function advisoriesOfMatch(view, name, match) {
+    if (match.state !== 'ok' && match.state !== 'stale')
+        return [];
+    const known = loadedAdvisoriesOf(view, name) ?? [];
+    const result = match.vulns.map(({ id }) => findAdvisory(known, id) ?? standInAdvisory(id));
+    const distinct = [...new Map(result.map((advisory) => [advisory.id, advisory])).values()];
+    return distinct.sort(compareAdvisories);
+}
+function isPackageNode(node) {
+    return !node.id.startsWith(IMPORTER_PREFIX);
+}
+export function requestedRange(view, root, parent, lockfileRange, child) {
+    if (isPackageNode(parent)) {
+        const published = nodeMeta(view, root, parent)?.manifests[parent.version]?.[child.name];
+        if (published !== undefined)
+            return { range: published, source: 'published-manifest' };
+    }
+    return { range: lockfileRange, source: 'lockfile' };
+}

package/dist/query/fixes.js

@@ -0,0 +1,60 @@
+import semver from 'semver';
+export const BUMP_LIST_CAP = 20;
+function highestSafeWithinRange(safe, range) {
+    if (range === undefined || semver.validRange(range) === null)
+        return undefined;
+    return semver.maxSatisfying(safe, range) ?? undefined;
+}
+function lowestSafeAbove(safe, current) {
+    if (semver.valid(current) === null)
+        return undefined;
+    return safe.find((version) => semver.gt(version, current));
+}
+export function edgeFix({ current, range, parentIsImporter, safe }) {
+    if (safe === undefined)
+        return { kind: 'unknown' };
+    if (safe.length === 0)
+        return { kind: 'no-fix' };
+    const withinRange = highestSafeWithinRange(safe, range);
+    if (withinRange !== undefined)
+        return { kind: 'within-range', version: withinRange };
+    if (!parentIsImporter)
+        return { kind: 'bump-parent' };
+    const raised = lowestSafeAbove(safe, current);
+    return raised === undefined ? { kind: 'no-fix' } : { kind: 'bump-manifest', version: raised };
+}
+function sharedVersion(edges) {
+    const versions = new Set(edges.map((edge) => edge.fix.version));
+    return versions.size === 1 ? [...versions][0] : undefined;
+}
+function bumpTargets(edges) {
+    return edges
+        .filter((edge) => edge.fix.kind === 'bump-manifest' || edge.fix.kind === 'bump-parent')
+        .map((edge) => ({ nodeId: edge.parent, isImporter: edge.parentIsImporter }));
+}
+function hasBumpTarget(edges) {
+    return edges.some((edge) => edge.fix.kind === 'bump-manifest' || edge.fix.kind === 'bump-parent');
+}
+function nodeFixKind(edges) {
+    const withinRangeCount = edges.filter((edge) => edge.fix.kind === 'within-range').length;
+    if (withinRangeCount === edges.length)
+        return 'relock';
+    if (withinRangeCount > 0)
+        return 'partial';
+    if (edges.every((edge) => edge.fix.kind === 'no-fix'))
+        return 'no-fix';
+    return hasBumpTarget(edges) ? 'bump' : 'unknown';
+}
+export function combineFixes(edges) {
+    if (edges.length === 0)
+        return { kind: 'unknown', bump: [], bumpTruncated: 0 };
+    const kind = nodeFixKind(edges);
+    const targets = bumpTargets(edges);
+    const version = kind === 'relock' ? sharedVersion(edges) : undefined;
+    return {
+        kind,
+        ...(version === undefined ? {} : { version }),
+        bump: targets.slice(0, BUMP_LIST_CAP),
+        bumpTruncated: Math.max(0, targets.length - BUMP_LIST_CAP)
+    };
+}

package/dist/query/graph-diff.js

@@ -0,0 +1,42 @@
+import semver from 'semver';
+import { PLACEHOLDER_PREFIX } from "../model.js";
+export function packageVersions(graph) {
+    const versions = new Map();
+    for (const node of graph.packages.values()) {
+        if (node.id.startsWith(PLACEHOLDER_PREFIX))
+            continue;
+        const known = versions.get(node.name);
+        if (known)
+            known.add(node.version);
+        else
+            versions.set(node.name, new Set([node.version]));
+    }
+    return versions;
+}
+export function compareVersions(left, right) {
+    const leftValid = semver.valid(left) !== null;
+    const rightValid = semver.valid(right) !== null;
+    if (leftValid && rightValid)
+        return semver.compare(left, right);
+    if (leftValid)
+        return -1;
+    if (rightValid)
+        return 1;
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function onlyIn(source, other) {
+    return [...(source ?? [])].filter((version) => !other?.has(version)).sort(compareVersions);
+}
+export function graphDiff(before, after) {
+    const beforeVersions = packageVersions(before);
+    const afterVersions = packageVersions(after);
+    const names = [...new Set([...beforeVersions.keys(), ...afterVersions.keys()])].sort();
+    const changes = [];
+    for (const name of names) {
+        const removed = onlyIn(beforeVersions.get(name), afterVersions.get(name));
+        const added = onlyIn(afterVersions.get(name), beforeVersions.get(name));
+        if (removed.length > 0 || added.length > 0)
+            changes.push({ name, removed, added });
+    }
+    return changes;
+}

package/dist/query/issues.js

@@ -0,0 +1,235 @@
+import { IMPORTER_PREFIX } from "../model.js";
+import { SEVERITY_ORDER } from "../enrich/types.js";
+import { decorations, isDirectDependency } from "./decorations.js";
+import { dependentsSummary, ParentLinkResolver } from "./dependents.js";
+import { nodeAdvisories, nodeMeta, requestedRange, worstSeverity } from "./enrichment-lookup.js";
+import { findNode } from "./lookup.js";
+import { normalizedRequestedRange, nodeFix } from "./node-fix.js";
+import { wantedVersion } from "./versions.js";
+export const VIA_CAP = 20;
+export const IMPORTERS_CAP = 20;
+export const GROUP_ISSUES_CAP = 50;
+const OUTDATED_ORDER = ['major', 'minor', 'patch', undefined];
+function compareText(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function severityPosition(severity) {
+    return severity === undefined ? SEVERITY_ORDER.length : SEVERITY_ORDER.indexOf(severity);
+}
+function compareSortKeys(left, right) {
+    return (severityPosition(left.severity) - severityPosition(right.severity) ||
+        Number(right.deprecated) - Number(left.deprecated) ||
+        OUTDATED_ORDER.indexOf(left.outdatedLevel) - OUTDATED_ORDER.indexOf(right.outdatedLevel) ||
+        compareText(left.name, right.name) ||
+        compareText(left.version, right.version));
+}
+function sortKeyOf(flagged) {
+    return {
+        name: flagged.node.name,
+        version: flagged.node.version,
+        severity: flagged.decoration.vuln?.severity,
+        deprecated: flagged.kinds.includes('deprecated'),
+        outdatedLevel: flagged.kinds.includes('outdated') ? flagged.decoration.outdated?.level : undefined,
+    };
+}
+function compareFlagged(left, right) {
+    return compareSortKeys(sortKeyOf(left), sortKeyOf(right));
+}
+function issueKindsOf(decoration, isDirect) {
+    const kinds = [];
+    if (decoration.vuln)
+        kinds.push('vulnerability');
+    if (decoration.deprecated)
+        kinds.push('deprecated');
+    if (decoration.outdated && isDirect)
+        kinds.push('outdated');
+    return kinds;
+}
+function sharedWantedVersion(view, root, node, kinds) {
+    const meta = nodeMeta(view, root, node);
+    if (!meta)
+        return undefined;
+    const wanted = new Set();
+    for (const link of new ParentLinkResolver(root, kinds).of(node)) {
+        if (!link.id.startsWith(IMPORTER_PREFIX))
+            continue;
+        const range = normalizedRequestedRange(root, node, meta, requestedRange(view, root, findNode(root, link.id) ?? node, link.range, node));
+        wanted.add(wantedVersion(meta.versions, range));
+    }
+    return wanted.size === 1 ? [...wanted][0] : undefined;
+}
+function lazily(compute) {
+    let computed = false;
+    let value;
+    return () => {
+        if (!computed) {
+            value = compute();
+            computed = true;
+        }
+        return value;
+    };
+}
+function flaggedNodesOf(view, root, kinds) {
+    const decorated = decorations(view, root, kinds);
+    const result = [];
+    for (const node of root.packages.values()) {
+        const decoration = decorated[node.id];
+        if (!decoration)
+            continue;
+        const isDirect = isDirectDependency(root, node, kinds);
+        const flaggedKinds = issueKindsOf(decoration, isDirect);
+        if (flaggedKinds.length === 0)
+            continue;
+        const summary = dependentsSummary(root, node.id, kinds);
+        if (summary.importers.length === 0 && !isDirect)
+            continue;
+        const deprecatedMessage = decoration.deprecated ? nodeMeta(view, root, node)?.deprecated[node.version] : undefined;
+        result.push({
+            root,
+            node,
+            decoration,
+            isDirect,
+            summary,
+            kinds: flaggedKinds,
+            vulnIds: decoration.vuln ? nodeAdvisories(view, root, node).map((advisory) => advisory.id) : [],
+            ...(deprecatedMessage === undefined ? {} : { deprecatedMessage }),
+            fix: lazily(() => nodeFix(view, root, node, kinds)),
+        });
+    }
+    return result;
+}
+function locationOf(flagged) {
+    const location = {
+        rootId: flagged.root.id,
+        nodeId: flagged.node.id,
+        via: flagged.summary.via.slice(0, VIA_CAP),
+        viaTruncated: Math.max(0, flagged.summary.via.length - VIA_CAP),
+    };
+    const fix = flagged.fix();
+    if (fix)
+        location.fix = fix;
+    return location;
+}
+function mergedRow(group, wanted) {
+    const first = group[0];
+    const kinds = ['vulnerability', 'deprecated', 'outdated'].filter((kind) => group.some((flagged) => flagged.kinds.includes(kind)));
+    const row = {
+        name: first.node.name,
+        version: first.node.version,
+        kinds,
+        vulnIds: [...new Set(group.flatMap((flagged) => flagged.vulnIds))],
+        locations: group.map(locationOf),
+    };
+    const severity = worstSeverity(group.flatMap((flagged) => (flagged.decoration.vuln ? [flagged.decoration.vuln.severity] : [])));
+    if (severity)
+        row.severity = severity;
+    if (group.some((flagged) => flagged.decoration.vuln?.malicious))
+        row.malicious = true;
+    const deprecatedMessage = group.find((flagged) => flagged.deprecatedMessage !== undefined)?.deprecatedMessage;
+    if (deprecatedMessage !== undefined)
+        row.deprecatedMessage = deprecatedMessage;
+    const outdated = group.find((flagged) => flagged.kinds.includes('outdated'))?.decoration.outdated;
+    if (outdated) {
+        row.latest = outdated.latest;
+        row.outdatedLevel = outdated.level;
+    }
+    if (wanted !== undefined)
+        row.wanted = wanted;
+    return row;
+}
+export function issuesByPackage(view, roots, kinds) {
+    const groups = new Map();
+    for (const root of roots) {
+        for (const flagged of flaggedNodesOf(view, root, kinds)) {
+            const key = `${flagged.node.name}@${flagged.node.version}`;
+            const group = groups.get(key);
+            if (group)
+                group.push(flagged);
+            else
+                groups.set(key, [flagged]);
+        }
+    }
+    const rows = [];
+    for (const group of groups.values()) {
+        const wantedVersions = group.map((flagged) => sharedWantedVersion(view, flagged.root, flagged.node, kinds));
+        const wanted = new Set(wantedVersions).size === 1 ? wantedVersions[0] : undefined;
+        const row = mergedRow(group, wanted);
+        rows.push({ row, key: { name: row.name, version: row.version, severity: row.severity, deprecated: row.kinds.includes('deprecated'), outdatedLevel: row.outdatedLevel } });
+    }
+    return rows.sort((left, right) => compareSortKeys(left.key, right.key)).map((entry) => entry.row);
+}
+function groupFor(builders, root, direct, importers, decoration) {
+    const key = `${root.id}|${direct.id}`;
+    const existing = builders.get(key);
+    if (existing)
+        return existing;
+    const created = {
+        worstSeen: [],
+        group: {
+            rootId: root.id,
+            direct: direct.id,
+            name: direct.name,
+            version: direct.version,
+            importers: importers.slice(0, IMPORTERS_CAP),
+            importersTruncated: Math.max(0, importers.length - IMPORTERS_CAP),
+            decoration,
+            issues: [],
+            issuesTruncated: 0,
+        },
+    };
+    builders.set(key, created);
+    return created;
+}
+function issueOf(flagged) {
+    const issue = {
+        nodeId: flagged.node.id,
+        name: flagged.node.name,
+        version: flagged.node.version,
+        kinds: flagged.kinds,
+        vulnIds: flagged.vulnIds,
+    };
+    if (flagged.decoration.vuln)
+        issue.severity = flagged.decoration.vuln.severity;
+    const fix = flagged.fix();
+    if (fix)
+        issue.fix = fix;
+    return issue;
+}
+function compareGroups(left, right) {
+    return severityPosition(left.worst) - severityPosition(right.worst) || compareText(left.name, right.name) || compareText(left.rootId, right.rootId);
+}
+export function issuesByDirect(view, roots, kinds) {
+    const builders = new Map();
+    for (const root of roots) {
+        const decorated = decorations(view, root, kinds);
+        const flaggedNodes = flaggedNodesOf(view, root, kinds).sort(compareFlagged);
+        for (const flagged of flaggedNodes) {
+            if (flagged.isDirect) {
+                const own = flagged.summary.via.find((entry) => entry.direct === flagged.node.id);
+                groupFor(builders, root, flagged.node, own?.importers ?? [], decorated[flagged.node.id] ?? {});
+            }
+            for (const entry of flagged.summary.via) {
+                const direct = root.packages.get(entry.direct);
+                if (!direct)
+                    continue;
+                const builder = groupFor(builders, root, direct, entry.importers, decorated[direct.id] ?? {});
+                if (direct.id === flagged.node.id)
+                    continue;
+                if (flagged.decoration.vuln)
+                    builder.worstSeen.push(flagged.decoration.vuln.severity);
+                if (builder.group.issues.length < GROUP_ISSUES_CAP)
+                    builder.group.issues.push(issueOf(flagged));
+                else
+                    builder.group.issuesTruncated++;
+            }
+        }
+    }
+    const groups = [];
+    for (const { group, worstSeen } of builders.values()) {
+        const worst = worstSeverity(worstSeen);
+        if (worst)
+            group.worst = worst;
+        groups.push(group);
+    }
+    return groups.sort(compareGroups);
+}

package/dist/query/lookup.js

@@ -0,0 +1,49 @@
+import { IMPORTER_PREFIX, PLACEHOLDER_PREFIX } from "../model.js";
+export const ALL_KINDS = new Set(['prod', 'dev', 'optional', 'peer']);
+export class UnknownNodeError extends Error {
+    nodeId;
+    constructor(nodeId) {
+        super(`Unknown node ${nodeId}`);
+        this.name = 'UnknownNodeError';
+        this.nodeId = nodeId;
+    }
+}
+const importerIndexes = new WeakMap();
+function importerIndex(root) {
+    const cached = importerIndexes.get(root);
+    if (cached)
+        return cached;
+    const index = new Map(root.importers.map((importer) => [importer.id, importer]));
+    importerIndexes.set(root, index);
+    return index;
+}
+export function findNode(root, id) {
+    return root.packages.get(id) ?? importerIndex(root).get(id);
+}
+export function requireNode(root, id) {
+    const node = findNode(root, id);
+    if (!node)
+        throw new UnknownNodeError(id);
+    return node;
+}
+export function viewOf(node) {
+    const isImporter = node.id.startsWith(IMPORTER_PREFIX);
+    const view = {
+        id: node.id,
+        name: node.name,
+        version: isImporter ? '' : node.version,
+        isImporter,
+        isPlaceholder: node.id.startsWith(PLACEHOLDER_PREFIX),
+    };
+    const peerSuffix = node.peerSuffix;
+    if (peerSuffix !== undefined)
+        view.peerSuffix = peerSuffix;
+    return view;
+}
+export function lookup(root, id) {
+    const node = findNode(root, id);
+    return node ? viewOf(node) : undefined;
+}
+export function passingEdges(node, kinds) {
+    return node.deps.filter((edge) => kinds.has(edge.kind));
+}

package/dist/query/node-fix.js

@@ -0,0 +1,46 @@
+import { IMPORTER_PREFIX } from "../model.js";
+import { ParentLinkResolver } from "./dependents.js";
+import { completePackageAdvisories, nodeAdvisories, nodeMeta, requestedRange } from "./enrichment-lookup.js";
+import { combineFixes, edgeFix } from "./fixes.js";
+import { findNode } from "./lookup.js";
+import { normalizeRange, safeVersions } from "./versions.js";
+export function normalizedRequestedRange(root, node, meta, requested) {
+    return normalizeRange(requested.range, {
+        name: node.name,
+        catalogs: root.config?.catalogs ?? {},
+        distTags: meta?.distTags,
+    });
+}
+export function safeCandidates(view, root, node, meta) {
+    if (meta === undefined)
+        return undefined;
+    const advisories = completePackageAdvisories(view, root, node);
+    if (advisories === undefined)
+        return undefined;
+    return safeVersions(meta, advisories).filter((version) => version !== node.version);
+}
+export function edgeFixes(view, root, node, kinds) {
+    const meta = nodeMeta(view, root, node);
+    const safe = safeCandidates(view, root, node, meta);
+    const result = [];
+    for (const link of new ParentLinkResolver(root, kinds).of(node)) {
+        const parent = findNode(root, link.id);
+        if (!parent)
+            continue;
+        const parentIsImporter = link.id.startsWith(IMPORTER_PREFIX);
+        const range = requestedRange(view, root, parent, link.range, node);
+        const fix = edgeFix({
+            current: node.version,
+            range: normalizedRequestedRange(root, node, meta, range),
+            parentIsImporter,
+            safe,
+        });
+        result.push({ parent: link.id, parentIsImporter, range, fix });
+    }
+    return result;
+}
+export function nodeFix(view, root, node, kinds) {
+    if (nodeAdvisories(view, root, node).length === 0)
+        return undefined;
+    return combineFixes(edgeFixes(view, root, node, kinds));
+}