@preventive/upstream 1.0.0-alpha.7 → 1.0.0-alpha.9

package/advisories.d.ts

@@ -39,6 +39,11 @@ export interface AdvisoryOptions {
   // the one npm's metadata, crates.io or Packagist names, looked up
   // through the cache. Needs `github`.
   repoAdvisories?: boolean
+  // Also returns each advisory's full text, as `details`. OSV's records
+  // and a repository's listing already carry it; npm's registry does not,
+  // and its rows take OSV's record of their GHSA, one more request each
+  // (no GitHub client needed).
+  details?: boolean
 }
 
 // One advisory on one package, with the versions asked about that it
@@ -62,8 +67,21 @@ export interface Advisory {
   id: string
   // The id itself, or an OSV record's one GHSA alias.
   ghsa?: string
+  // GitHub's page for the GHSA, with it: a `repository` row's on its
+  // repository (https://github.com/owner/name/security/advisories/GHSA-…),
+  // which has it before GitHub reviews it into its advisory database; any
+  // other's in that database (https://github.com/advisories/GHSA-…). An
+  // `osv` row without one has osv.dev's page for its record
+  // (https://osv.dev/vulnerability/RUSTSEC-…). Built, never fetched: only
+  // a registry row without a GHSA (npm:<id>) has none.
+  url?: string
   aliases: string[]
   title?: string
+  // With `details`, the advisory's full text, Markdown as published: an
+  // OSV record's `details`, a repository advisory's `description`, or for
+  // a registry row, OSV's record of its GHSA. Absent where there is none:
+  // a registry row without a GHSA, or with one OSV does not have yet.
+  details?: string
   // `critical`, `high`, `moderate`, `low`; GitHub's `medium` reads
   // `moderate`. RustSec has none.
   severity?: string
@@ -84,10 +102,12 @@ export interface Advisory {
 // Every package, and every one of its versions, is checked against its
 // ecosystem's rules before the first request; a name given twice is
 // merged, and must not name two repositories. npm is asked 250 names a
-// request, OSV 1000 versions, Soldeer one project; a project Soldeer does
-// not have or that names no GitHub repository, and a repository gone,
-// renamed or blocked, add nothing. Any other failure, a malformed answer,
-// or one about something not asked, throws: nothing is left out quietly.
+// request, OSV 1000 versions, Soldeer one project, and with `details`, OSV
+// one GHSA among npm's rows; a project Soldeer does not have or that names
+// no GitHub repository, and a repository gone, renamed or blocked, add
+// nothing, and a GHSA OSV does not have adds no `details`. Any other
+// failure, a malformed answer, or one about something not asked, throws:
+// nothing is left out quietly.
 // Sorted by ecosystem and name. Versions are matched by npm's semver, from
 // the npm beside node, or by the semver peer where there is no npm.
 export function advisories(packages: Iterable<Package>, options?: AdvisoryOptions): Promise<Advisory[]>

package/github.d.ts

@@ -84,14 +84,21 @@ export interface Client {
   // Its files are hashed back into git's tree and the id must be `tree`,
   // whether downloaded or read from setCacheDir's cache (npm.js), where it
   // is kept by the id alone, for good; a cached copy that does not match
-  // throws. A tarball shows a submodule as an empty directory, and leaves
-  // out a subtree with no file in it: the submodule's commit and the
-  // subtrees come from GitHub's listings of the trees, asked only then, and
-  // the id must still come out `tree`: the bytes are the tree's own, the
-  // same for every repo. So GitHub's tarball is refused for a tree with
-  // files marked `export-ignore`, which it leaves out, and from a repo set
-  // to include Git LFS objects in archives, which replace the pointers git
-  // has; that repo still gets a tree already cached, pointers and all.
+  // throws. A tarball shows a submodule as an empty directory, leaves out
+  // a subtree with no file in it, and has a file marked `eol=crlf` with
+  // CRLF where git has LF, as a checkout writes it: the submodule's commit,
+  // the subtrees and the blobs come from GitHub's listings of the trees,
+  // asked only then, cached or not, a CRLF file is taken only where the
+  // tree's .gitattributes have git write it so, and the id must still come
+  // out `tree`. The bytes are GitHub's: the tree as a checkout with no
+  // `core.autocrlf` writes it, the same for every repo. So GitHub's tarball
+  // is refused for a tree with files marked `export-ignore`, which it
+  // leaves out, or `ident`, `filter` or `working-tree-encoding` beside
+  // `eol=crlf`, or `eol=crlf` on a file git has with both CRLF and LF; for
+  // one with .gitattributes rules src/attributes.js does not read; and from
+  // a repo set to include Git LFS objects in archives, which replace the
+  // pointers git has; that repo still gets a tree already cached, pointers
+  // and all.
   getRepoTreeTarball(options: { repo: RepoName; tree: string }): Promise<Uint8Array>
   // The repository's published security advisories, as GitHub's
   // repository advisory objects: every page of 100, each found by the

package/npm.d.ts

@@ -10,8 +10,27 @@
 // Where NPM_TOKEN is set, it is sent with the requests for a scoped
 // package, so a private one can be read.
 
-// Where cached answers live, resolved when set. Unset by default, and
-// unset means no cache: every read misses and every write is skipped.
+// Where a program called `name` keeps its cache for this user, as each
+// platform has it, read from the environment when called. macOS:
+// ~/Library/Caches/<name>. Windows: %LOCALAPPDATA%\<name>\Cache, the
+// `Cache` apart from the program's other local data there. Elsewhere, the
+// XDG Base Directory spec's: $XDG_CACHE_HOME/<name>, or ~/.cache/<name>
+// where it is unset, empty or relative, which the spec has ignored.
+// Undefined where no absolute directory is found to start from: a home
+// directory that is relative, empty or unknown. Nothing is made. `name` is
+// 6 to 32 of a-z, A-Z, 0-9, `_` and `-`, so one directory name the same on
+// every platform.
+export function cacheDirFor(name: string): string | undefined
+
+// cacheDirFor('PreventiveMeasures'), read once, when this module is first
+// imported: where setCacheDir() caches.
+export const defaultCacheDir: string | undefined
+
+// Where cached answers are written and read, resolved when set: `dir`, or
+// defaultCacheDir where it is left out, which throws where there is none.
+// Unset until this is called, and unset again by `false`, which means no
+// cache: every read of it misses and every write is skipped. getTarball
+// reads ours all the same, set or not.
 //
 // The directory is trusted: a package's repo is answered from it as it
 // was written, with no request. Point it only at storage that nothing
@@ -19,7 +38,7 @@
 // restored from lower-trust jobs. Tarballs, crates (cargo.js), zips
 // (soldeer.js) and tree tarballs (github.js) don't rely on this, since
 // they are checked against their integrity on every call.
-export function setCacheDir(dir: string): void
+export function setCacheDir(dir?: string | false): void
 
 // A failed request: `status` is the HTTP status the registry answered
 // with (404 for a package or version it does not have).
@@ -85,10 +104,11 @@ export function verifyDist(name: string, version: string, dist: Dist): Promise<v
 // for. Either way the bytes are checked against `dist.integrity`, whether
 // they were downloaded (before they are cached) or read from a cache.
 //
-// Other tools' caches are read first, and never written: npm's (cacache
-// under npm_config_cache, else npm's default, `~/.npm` outside Windows;
-// and npm 4's `<name>/<version>/package.tgz` there), then
-// `~/.audit/cache/tgz/<org>:<name>-<version>.tgz`. A file there that does
-// not match is passed over. One in setCacheDir's cache that does not
-// match throws.
+// Other caches are read first, and never written: npm's (cacache under
+// npm_config_cache, else npm's default, `~/.npm` outside Windows; and npm
+// 4's `<name>/<version>/package.tgz` there), then
+// `~/.audit/cache/tgz/<org>:<name>-<version>.tgz`, then defaultCacheDir
+// and cacheDirFor('stasis'), as setCacheDir files a tarball in either,
+// whether set or not. A file there that does not match is passed over.
+// Then setCacheDir's cache, where one that does not match throws.
 export function getTarball(name: string, version: string, dist?: Dist): Promise<Uint8Array>

package/npm.js

@@ -1,4 +1,4 @@
-export { setCacheDir } from './src/cache.js'
+export { cacheDirFor, defaultCacheDir, setCacheDir } from './src/cache.js'
 export { HttpError } from './src/http.js'
 export { getGitHub, readPackageRepoCache, resolvePackageRepos, writePackageRepoCache } from './src/npm/repos.js'
 export { getMeta, getTarball, verifyDist } from './src/npm/tarball.js'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/upstream",
-  "version": "1.0.0-alpha.7",
+  "version": "1.0.0-alpha.9",
   "description": "Minimal npm, crates.io and Soldeer registry clients, a GitHub client, and a git checkout reader: the calls we use, nothing more",
   "type": "module",
   "exports": {
@@ -39,6 +39,10 @@
     "./soldeer.js": {
       "types": "./soldeer.d.ts",
       "default": "./soldeer.js"
+    },
+    "./weak-edges.js": {
+      "types": "./weak-edges.d.ts",
+      "default": "./weak-edges.js"
     }
   },
   "files": [
@@ -62,6 +66,8 @@
     "semver.js",
     "soldeer.d.ts",
     "soldeer.js",
+    "weak-edges.d.ts",
+    "weak-edges.js",
     "src/advisories/common.js",
     "src/advisories/github.js",
     "src/advisories/index.js",
@@ -69,6 +75,7 @@
     "src/advisories/osv.js",
     "src/advisories/repos.js",
     "src/args.js",
+    "src/attributes.js",
     "src/cache.js",
     "src/cargo/crate.js",
     "src/cargo/repos.js",
@@ -87,7 +94,8 @@
     "src/semver-peer.cjs",
     "src/semver.js",
     "src/tree.js",
-    "src/soldeer.js"
+    "src/soldeer.js",
+    "src/weak-edges.js"
   ],
   "engines": {
     "node": ">=24.14.0"

package/src/advisories/common.js

@@ -1,8 +1,18 @@
-import { isStrings, matches } from '../args.js'
+import assert from 'node:assert/strict'
+
+import { isGhsa, isRepo, isStrings, matches, show } from '../args.js'
 import { satisfies, valid, validRange } from '../semver.js'
 
 export const order = (a, b) => (a > b) - (a < b)
 
+// GitHub's page for a GHSA: the advisory database's, which has every one
+// the registry and OSV answer with, or the page of the `repo` that
+// published it, which has it before GitHub reviews it into the database.
+export function advisoryUrl(ghsa, repo) {
+  assert.ok(isGhsa(ghsa) && (repo === undefined || isRepo(repo)), `advisories: no GitHub advisory page for ${show(ghsa)} on ${show(repo)}`)
+  return repo === undefined ? `https://github.com/advisories/${ghsa}` : `https://github.com/${repo}/security/advisories/${ghsa}`
+}
+
 // As `npm audit` matches: a prerelease is in a range around it.
 const SEMVER = { includePrerelease: true, loose: true }
 
@@ -20,6 +30,14 @@ export const covered = (asked, range, covers = mayBeInRange) => (validRange(rang
 // malformed by whoever reads it.
 export const isText = (value) => typeof value === 'string' && value.isWellFormed()
 
+// An advisory's full text, for `details`: none where its source has none,
+// and refused where it is not well-formed.
+export function detailsOf(text, id) {
+  if (text == null || text === '') return {}
+  assert.ok(isText(text), `advisories: malformed details in ${id}`)
+  return { details: text }
+}
+
 const SEVERITIES = new Set(['critical', 'high', 'moderate', 'low', 'info'])
 const isCvssVector = matches(/^CVSS:[34]\.\d(?:\/[A-Z]{1,4}:[A-Z]{1,2})+$/u)
 const isCwe = matches(/^CWE-\d{1,6}$/u)

package/src/advisories/github.js

@@ -4,7 +4,7 @@ import { assertRepo, assertSoldeerName, assertSoldeerVersion, assertion, isGhsa,
 import { isGone } from '../github/client.js'
 import { recover } from '../http.js'
 import { pool } from '../pool.js'
-import { covered, isText, mayBeInRange, metrics } from './common.js'
+import { advisoryUrl, covered, detailsOf, isText, mayBeInRange, metrics } from './common.js'
 import { soldeerRepos } from './repos.js'
 
 const REPOS_AT_ONCE = 4
@@ -19,16 +19,20 @@ const listAdvisories = (github, repo) => github.listRepoAdvisories({ repo }).cat
 
 // GitHub's `>= 1.0.0, < 1.2.6` is npm's with the commas dropped.
 // Maintainers write these unreviewed: one without a range, or with one
-// semver cannot read, covers every version.
-function fromRepository(name, advisory, range, asked, covers) {
+// semver cannot read, covers every version. Its page is on `repo`, which
+// may publish it long before the advisory database has one, and its
+// `description` is the text `details` asks for: the listing has it all.
+function fromRepository(repo, name, advisory, range, asked, { covers, details }) {
   const cvss = [advisory.cvss_severities?.cvss_v3, advisory.cvss_severities?.cvss_v4, advisory.cvss].find((entry) => typeof entry?.vector_string === 'string')
   return {
     name,
     source: 'repository',
     id: advisory.ghsa_id,
     ghsa: advisory.ghsa_id,
+    url: advisoryUrl(advisory.ghsa_id, repo),
     aliases: [],
     title: advisory.summary,
+    ...(details && detailsOf(advisory.description, advisory.ghsa_id)),
     ...metrics({ severity: advisory.severity, score: cvss?.score, vector: cvss?.vector_string, cwe: advisory.cwe_ids }),
     range,
     versions: covered(asked, range.replaceAll(',', ' '), covers),
@@ -38,8 +42,8 @@ function fromRepository(name, advisory, range, asked, covers) {
 // Each asked name's repository, `repoOf` it, is asked once, and its
 // advisories' vulnerable ranges become rows for the names that `takes` a
 // vulnerability, one per name, advisory and range, holding the asked
-// versions it `covers`.
-async function repositoryAdvisories(github, asked, { repoOf, takes = () => true, covers }) {
+// versions it `covers`, and with `details`, its text.
+async function repositoryAdvisories(github, asked, { repoOf, takes = () => true, covers, details }) {
   // GitHub's names are case-insensitive: one spelling asks for all.
   const namesOf = Map.groupBy([...asked.keys()].filter(repoOf), (name) => repoOf(name).toLowerCase())
   const listed = await pool([...namesOf.values()], REPOS_AT_ONCE, async (names) => ({ repo: repoOf(names[0]), names, list: await listAdvisories(github, repoOf(names[0])) }))
@@ -51,7 +55,7 @@ async function repositoryAdvisories(github, asked, { repoOf, takes = () => true,
         const range = vulnerability?.vulnerable_version_range ?? ''
         assert.ok(typeof range === 'string', `advisories: malformed range in ${advisory.ghsa_id}`)
         for (const name of names.filter((candidate) => takes(candidate, vulnerability?.package))) {
-          rows.set(`${name} ${advisory.ghsa_id} ${range}`, fromRepository(name, advisory, range, asked.get(name), covers))
+          rows.set(`${name} ${advisory.ghsa_id} ${range}`, fromRepository(repo, name, advisory, range, asked.get(name), { covers, details }))
         }
       }
     }
@@ -70,12 +74,12 @@ async function reposOf(asked, known, lookUp) {
 // each package's repository, `known` or else looked up, adds what it
 // publishes for GitHub's `ecosystem` entries naming the package, for the
 // versions `rows` do not already report under that GHSA.
-export async function withRepositories(rows, asked, { github, repoAdvisories, known }, { ecosystem, lookUp, covers }) {
+export async function withRepositories(rows, asked, { github, repoAdvisories, known, details }, { ecosystem, lookUp, covers }) {
   if (!repoAdvisories) return rows
   const reported = new Set(rows.flatMap((row) => [row.id, row.ghsa, ...row.aliases].filter(isGhsa).flatMap((id) => row.versions.map((version) => `${row.name} ${id} ${version}`))))
   const repoOf = await reposOf(asked, known, lookUp)
   const takes = (name, pkg) => pkg?.ecosystem === ecosystem && pkg.name === name
-  const added = await repositoryAdvisories(github, asked, { repoOf, takes, covers })
+  const added = await repositoryAdvisories(github, asked, { repoOf, takes, covers, details })
   return [...rows, ...added.map((row) => ({ ...row, versions: row.versions.filter((version) => !reported.has(`${row.name} ${row.id} ${version}`)) }))]
 }
 
@@ -89,7 +93,7 @@ export const GITHUB = {
   repositoryOnly: true,
   assertName: assertRepo,
   assertVersion: assertion('a version or a branch name', isRefName),
-  advisories: (asked, { github }) => repositoryAdvisories(github, asked, { repoOf: (repo) => repo, covers: coversPlaceholder }),
+  advisories: (asked, { github, details }) => repositoryAdvisories(github, asked, { repoOf: (repo) => repo, covers: coversPlaceholder, details }),
 }
 
 // Soldeer packages, which no advisory database has: the repository each
@@ -100,5 +104,5 @@ export const SOLDEER = {
   repositoryOnly: true,
   assertName: assertSoldeerName,
   assertVersion: assertSoldeerVersion,
-  advisories: async (asked, { github, known }) => await repositoryAdvisories(github, asked, { repoOf: await reposOf(asked, known, soldeerRepos) }),
+  advisories: async (asked, { github, known, details }) => await repositoryAdvisories(github, asked, { repoOf: await reposOf(asked, known, soldeerRepos), details }),
 }

package/src/advisories/index.js

@@ -34,7 +34,7 @@ function collect(packages) {
 }
 
 export async function advisories(packages, options = {}) {
-  assertArgs('advisories', options, { github: optional(assertClient), repoAdvisories: optional(assertBoolean) })
+  assertArgs('advisories', options, { github: optional(assertClient), repoAdvisories: optional(assertBoolean), details: optional(assertBoolean) })
   assert.ok(!options.repoAdvisories || options.github, 'advisories: repoAdvisories needs a github client')
   const byEcosystem = collect(packages)
   for (const ecosystem of byEcosystem.keys()) assert.ok(!ECOSYSTEMS[ecosystem].repositoryOnly || options.github, `advisories: ${ecosystem} packages need a github client`)
@@ -43,7 +43,7 @@ export async function advisories(packages, options = {}) {
     const names = [...named.keys()].toSorted()
     const asked = new Map(names.map((name) => [name, [...named.get(name).versions].toSorted(compare)]))
     const known = new Map(names.filter((name) => named.get(name).github).map((name) => [name, named.get(name).github]))
-    const rows = await find(asked, { github: options.github, repoAdvisories: options.repoAdvisories === true, known })
+    const rows = await find(asked, { github: options.github, repoAdvisories: options.repoAdvisories === true, details: options.details === true, known })
     return rows.map((row) => ({ ecosystem, ...row }))
   }))
   return found.flat().filter((row) => row.versions.length > 0).toSorted((a, b) => order(a.ecosystem, b.ecosystem) || order(a.name, b.name))

package/src/advisories/npm.js

@@ -1,11 +1,12 @@
 import assert from 'node:assert/strict'
 
 import { assertPackageName, assertPackageVersion, isGhsa, isStrings, show } from '../args.js'
-import { NPM_REGISTRY, buildUrl, request } from '../http.js'
-import { chunks } from '../pool.js'
+import { NPM_REGISTRY, buildUrl, isNotFound, recover, request } from '../http.js'
+import { chunks, pool } from '../pool.js'
 import { compareVersions } from '../semver.js'
-import { covered, isText, metrics } from './common.js'
+import { advisoryUrl, covered, detailsOf, isText, metrics } from './common.js'
 import { withRepositories } from './github.js'
+import { RECORDS_AT_ONCE, getVuln } from './osv.js'
 import { npmRepos } from './repos.js'
 
 const BULK_URL = buildUrl(NPM_REGISTRY, ['-', 'npm', 'v1', 'security', 'advisories', 'bulk'])
@@ -23,7 +24,7 @@ function fromRegistry(name, row, asked) {
     name,
     source: 'registry',
     id: ghsa ?? `npm:${row.id}`,
-    ...(ghsa && { ghsa }),
+    ...(ghsa && { ghsa, url: advisoryUrl(ghsa) }),
     aliases: [],
     title: row.title,
     ...metrics({ severity: row.severity, score: row.cvss?.score, vector: row.cvss?.vectorString, cwe: row.cwe }),
@@ -49,10 +50,23 @@ async function registryAdvisories(asked) {
   return advisories
 }
 
+// The registry's rows carry no text: each GHSA's is OSV's record of it,
+// GitHub's advisory database as published, asked once for the rows that
+// cover an asked version. One OSV does not have yet has none.
+async function withDetails(rows) {
+  const ghsas = [...new Set(rows.filter((row) => row.ghsa && row.versions.length > 0).map((row) => row.ghsa))]
+  const records = await pool(ghsas, RECORDS_AT_ONCE, (ghsa) => getVuln(ghsa).catch(recover(isNotFound, undefined)))
+  const text = new Map(ghsas.map((ghsa, i) => [ghsa, records[i]?.details]))
+  return rows.map((row) => ({ ...row, ...detailsOf(text.get(row.ghsa), row.ghsa) }))
+}
+
 // What `npm audit` asks the registry, one row per vulnerable range.
 export const NPM = {
   assertName: assertPackageName,
   assertVersion: assertPackageVersion,
   compare: compareVersions,
-  advisories: async (asked, options) => await withRepositories(await registryAdvisories(asked), asked, options, { ecosystem: 'npm', lookUp: npmRepos }),
+  advisories: async (asked, options) => {
+    const rows = await registryAdvisories(asked)
+    return await withRepositories(options.details ? await withDetails(rows) : rows, asked, options, { ecosystem: 'npm', lookUp: npmRepos })
+  },
 }

package/src/advisories/osv.js

@@ -4,14 +4,17 @@ import { assertCrateName, assertCrateVersion, assertion, isGhsa, isStrings, matc
 import { OSV_API, buildUrl, request } from '../http.js'
 import { chunks, pool } from '../pool.js'
 import { isExactVersion } from '../semver.js'
-import { inRange, isText, metrics, order } from './common.js'
+import { advisoryUrl, detailsOf, inRange, isText, metrics, order } from './common.js'
 import { withRepositories } from './github.js'
 import { composerRepos, crateRepos } from './repos.js'
 
 const QUERY_URL = buildUrl(OSV_API, ['v1', 'querybatch'])
 const QUERIES_PER_REQUEST = 1000
-const RECORDS_AT_ONCE = 8
+export const RECORDS_AT_ONCE = 8
 const isOsvId = matches(/^(?=.{1,128}$)[A-Z][\dA-Z]*(?:-[\dA-Za-z]+)+$/u)
+// osv.dev's page for one of its records. An id that is only another's
+// alias (PKSA-…) has none, and redirects to a search.
+const osvPage = (id) => `https://osv.dev/vulnerability/${id}`
 const INFORMATIONAL = new Set(['unmaintained', 'unsound', 'notice'])
 // Of the records that publish one advisory, the first answered for a
 // version stands for the rest on it: RustSec's, what `cargo audit` reads
@@ -46,7 +49,7 @@ export const COMPOSER = {
   advisories: (asked, options) => osvAdvisories(COMPOSER, asked, options),
 }
 
-async function getVuln(id) {
+export async function getVuln(id) {
   const record = await request(buildUrl(OSV_API, ['v1', 'vulns', id]), { as: 'json' })
   assert.ok(record?.id === id, `advisories: OSV answered for ${show(record?.id)}, not ${id}`)
   assert.ok((record.aliases === undefined || isStrings(record.aliases)) && (record.summary === undefined || isText(record.summary))
@@ -54,7 +57,7 @@ async function getVuln(id) {
   return { ...record, aliases: (record.aliases ?? []).filter(isOsvId) }
 }
 
-function toAdvisory(ecosystem, name, versions, record) {
+function toAdvisory(ecosystem, name, versions, record, details) {
   const { aliases } = record
   const ghsas = aliases.filter(isGhsa)
   const ghsa = isGhsa(record.id) ? record.id : (ghsas.length === 1 ? ghsas[0] : undefined)
@@ -66,8 +69,10 @@ function toAdvisory(ecosystem, name, versions, record) {
     source: 'osv',
     id: record.id,
     ...(ghsa && { ghsa }),
+    url: ghsa ? advisoryUrl(ghsa) : osvPage(record.id),
     aliases,
     ...(record.summary && { title: record.summary }),
+    ...(details && detailsOf(record.details, record.id)),
     ...metrics({ severity: record.database_specific?.severity, vector, cwe: record.database_specific?.cwe_ids }),
     ...(INFORMATIONAL.has(informational) && { informational }),
     versions,
@@ -113,7 +118,7 @@ async function osvAdvisories(ecosystem, asked, options) {
     const aliases = [...new Set([...record.aliases, ...group.map((other) => other.id)])].filter((id) => id !== record.id)
     for (const [name, versions] of hits.get(record.id)) {
       const rest = [...versions].filter((version) => !above.some((other) => hits.get(other.id).get(name)?.has(version)))
-      if (rest.length > 0) rows.push(toAdvisory(osv, name, rest, { ...record, aliases }))
+      if (rest.length > 0) rows.push(toAdvisory(osv, name, rest, { ...record, aliases }, options.details))
     }
   }
   rows.sort((a, b) => order(a.name, b.name) || order(a.id, b.id))

package/src/args.js

@@ -72,6 +72,9 @@ export const assertLine = assertion('a non-empty single line', (value) => isStri
 // 65,536 is GitHub's own limit on a body.
 export const assertText = assertion('text with no control characters', (value) => isString(value, 65_536, '\t\n\r'))
 export const assertDirectoryPath = assertion('a directory path', (value) => isString(value, 4096) && value !== '')
+// A short ASCII name, which no filesystem refuses, reads as another or takes
+// for a device: none of those is six characters of these alone.
+export const assertCacheName = assertion('6 to 32 of a-z, A-Z, 0-9, _ and -', matches(/^[a-zA-Z0-9_-]{6,32}$/u))
 export const assertLogin = assertion('a GitHub login', isLogin)
 export const assertRepoName = assertion('a repository name', isRepoName)
 export const assertRepo = assertion('"owner/name"', isRepo)

package/src/attributes.js

@@ -0,0 +1,81 @@
+import { Buffer } from 'node:buffer'
+
+// Whether git writes a file out with CRLF, from the .gitattributes in its
+// tree alone, as `git archive` and a checkout with no config read them. Only
+// `*`, `*.ext`, name and path rules are read: any other rule that sets an
+// attribute line endings depend on refuses its file, and all below it.
+
+const RELEVANT = new Set(['text', 'crlf', 'eol', 'binary', 'ident', 'filter', 'working-tree-encoding'])
+const BINARY = [['diff', false], ['merge', false], ['text', false]]
+const GLOB = /[*?[\\]/u
+const PRINTING = new Set([0x08, 0x09, 0x0c, 0x1b]) // BS, HT, FF, ESC
+
+function matcher(pattern) {
+  const name = (path) => path.slice(path.lastIndexOf('/') + 1)
+  if (pattern.endsWith('/')) return () => false // a directory
+  if (!GLOB.test(pattern)) return pattern.includes('/') ? (path) => path === pattern.replace(/^\//u, '') : (path) => name(path) === pattern
+  const end = pattern.slice(1)
+  return pattern[0] === '*' && !GLOB.test(end) && !end.includes('/') ? (path) => name(path).endsWith(end) : null
+}
+
+// Read to the first NUL, as git reads one from a tree. A line with a name
+// git takes for none, or a negative pattern, git leaves out.
+function parseAttributes(bytes) {
+  const nul = bytes.indexOf(0)
+  const rules = []
+  for (const line of Buffer.from(bytes.buffer, bytes.byteOffset, nul === -1 ? bytes.length : nul).toString('latin1').split('\n')) {
+    const [pattern, ...tokens] = line.split(/[ \t\r]+/u).filter(Boolean)
+    if (pattern?.startsWith('"')) return null
+    if (pattern === undefined || pattern.startsWith('#') || pattern.startsWith('!')) continue
+    const states = tokens.map((token) => /^([-!]?)([\w.][\w.-]*)(?:=(.*))?$/u.exec(token))
+    if (states.includes(null) || !states.some(([, , name]) => RELEVANT.has(name))) continue
+    const match = matcher(pattern)
+    if (!match) return null
+    rules.push({ match, states: states.map(([, sign, name, value = true]) => [name, sign === '-' ? false : sign === '!' ? null : value]) })
+  }
+  return rules
+}
+
+// `base` is the directory's path and a `/`; `bytes` is undefined where it
+// has no .gitattributes, null where that is no file.
+export function withAttributes(above, base, bytes) {
+  if (above === null || bytes === null) return null
+  const rules = bytes === undefined ? [] : parseAttributes(bytes)
+  return rules && [...above, { base, rules }]
+}
+
+// convert.c's text test for `text=auto`, on the blob these bytes are written from.
+function isAutoText(written) {
+  let printable = 0
+  let other = written.at(-1) === 0x1a ? -1 : 0
+  for (let i = 0; i < written.length; i++) {
+    const c = written[i]
+    if (c === 0x0d && written[i + 1] !== 0x0a) return false
+    if (c === 0x0d || c === 0x0a) continue
+    if (c === 0) return false
+    if (c >= 0x20 ? c !== 0x7f : PRINTING.has(c)) printable++
+    else other++
+  }
+  return printable >> 7 >= other
+}
+
+// attr.c's order: the deepest file and its last line first. Anything else
+// rewriting the file (ident, filter, working-tree-encoding) refuses it.
+export function writtenWithCrlf(files, path, written) {
+  if (files === null) return false
+  const states = new Map()
+  const fill = (list) => {
+    for (const [name, value] of list.toReversed()) {
+      if (states.has(name)) continue
+      states.set(name, value)
+      if (name === 'binary' && value === true) fill(BINARY)
+    }
+  }
+  for (const { base, rules } of files.toReversed()) {
+    for (const { match, states: list } of rules.toReversed()) if (match(path.slice(base.length))) fill(list)
+  }
+  if (states.get('ident') === true || typeof states.get('filter') === 'string' || states.get('working-tree-encoding')) return false
+  const action = [states.get('text'), states.get('crlf')].find((value) => typeof value === 'boolean' || value === 'input' || value === 'auto')
+  if (action === false || states.get('eol') !== 'crlf') return false
+  return action !== 'auto' || isAutoText(written)
+}

package/src/cache.js

@@ -1,18 +1,50 @@
 import assert from 'node:assert/strict'
 import { constants } from 'node:fs'
 import { mkdir, open, rename, rm, writeFile } from 'node:fs/promises'
-import { dirname, join, resolve } from 'node:path'
+import { homedir } from 'node:os'
+import { dirname, isAbsolute, join, resolve } from 'node:path'
 
-import { assertDirectoryPath, isRepo } from './args.js'
+import { assertCacheName, assertDirectoryPath, isRepo } from './args.js'
 import { MAX_BYTES, decode } from './http.js'
 
 const DIRS = new Set(['npm/repos', 'npm/tarballs', 'cargo/repos', 'cargo/crates', 'composer/repos', 'soldeer/repos', 'soldeer/zips', 'github/trees'])
 const RECORD_TTL_MS = 30 * 24 * 60 * 60 * 1000 // A link only moves on a transfer or rename, and GitHub redirects those.
 
+// An environment variable may hold anything: only an absolute path is one.
+const absolute = (path) => (typeof path === 'string' && isAbsolute(path) ? path : undefined)
+const within = (base, ...names) => (base === undefined ? undefined : join(base, ...names))
+
+// os.homedir() takes $HOME as it is, relative or empty, and throws where
+// neither it nor the user's passwd entry has one.
+function home() {
+  try {
+    return absolute(homedir())
+  } catch {
+    return undefined
+  }
+}
+
+// Only Linux and the BSDs follow the XDG Base Directory spec, so macOS and
+// Windows take no XDG_CACHE_HOME, as Go's os.UserCacheDir and Rust's dirs
+// take none.
+export function cacheDirFor(name) {
+  assertCacheName('cacheDirFor', 'name', name)
+  if (process.platform === 'darwin') return within(home(), 'Library', 'Caches', name)
+  if (process.platform === 'win32') return within(absolute(process.env.LOCALAPPDATA) ?? within(home(), 'AppData', 'Local'), name, 'Cache')
+  return within(absolute(process.env.XDG_CACHE_HOME) ?? within(home(), '.cache'), name)
+}
+
+export const defaultCacheDir = cacheDirFor('PreventiveMeasures')
+
 let root
 let tmpSeq = 0
 
-export function setCacheDir(dir) {
+export function setCacheDir(dir = defaultCacheDir) {
+  if (dir === false) {
+    root = undefined
+    return
+  }
+  assert.ok(dir !== undefined, 'setCacheDir: there is no default cache directory, as no absolute home directory is known: give one')
   assertDirectoryPath('setCacheDir', 'dir', dir)
   root = resolve(dir)
 }
@@ -24,12 +56,18 @@ export function setCacheDir(dir) {
 // would still meet, so a capital is written `!` and the letter, and a `!`
 // as `!!`. A Windows device name (`con.json` is the console) has its first
 // letter escaped, which encodeURIComponent never does.
-function cachePath(dir, key) {
+function cachePath(dir, key, base = root) {
   assert.ok(DIRS.has(dir) && key && typeof key === 'string', `Unexpected cache entry: ${dir}`)
   const name = encodeURIComponent(key.replace(/[!A-Z]/gu, (char) => `!${char.toLowerCase()}`)).replaceAll('%40', '@').replaceAll('%2F', '+')
-  return root === undefined ? null : join(root, dir, name.replace(/^(?=(?:con|prn|aux|nul|com\d|lpt\d)(?:\.|$))./u, (char) => `%${char.codePointAt(0).toString(16).toUpperCase()}`))
+  return base === undefined ? null : join(base, dir, name.replace(/^(?=(?:con|prn|aux|nul|com\d|lpt\d)(?:\.|$))./u, (char) => `%${char.codePointAt(0).toString(16).toUpperCase()}`))
 }
 
+// Caches of ours, read whether set or not for what is checked whatever its
+// source: the default one, and stasis's, which it sets with setCacheDir.
+const OURS = [defaultCacheDir, cacheDirFor('stasis')].filter((base) => base !== undefined)
+
+export const ourCachePaths = (dir, key) => OURS.map((base) => cachePath(dir, key, base))
+
 // Only a regular file, checked on the file as opened, so one swapped in
 // after a check can't pass: a FIFO or a device would block or never end.
 // Read to the size it had when opened, and no further.

package/src/download.js

@@ -1,7 +1,7 @@
 import assert from 'node:assert/strict'
 import { createHash } from 'node:crypto'
 
-import { readCache, readRegularFile, writeCache } from './cache.js'
+import { ourCachePaths, readCache, readRegularFile, writeCache } from './cache.js'
 import { request } from './http.js'
 import { gitTreeOfTarball } from './tree.js'
 
@@ -16,13 +16,15 @@ const DIGESTS = {
 
 // Bytes whose `algorithm` hash is `expected`, which the registry or the
 // caller gives, never a disk; without it nothing is read. From `local`,
-// other tools' caches (read, never written; a mismatch is passed over),
-// else ours (a mismatch throws), else what `locate` answers, checked and
-// then cached.
-export async function verifiedDownload({ method, dir, what, ext, algorithm, expected, local = [], locate, options = {}, list }) {
+// other tools' caches, and with `ours` our default cache and stasis's,
+// whether set or not (read, never written; a mismatch is passed over),
+// else the cache set (a mismatch throws), else what `locate` answers,
+// checked and then cached.
+export async function verifiedDownload({ method, dir, what, ext, algorithm, expected, local = [], ours = false, locate, options = {}, list }) {
   assert.ok(Object.hasOwn(DIGESTS, algorithm) && typeof expected === 'string' && expected !== '', `${method}: nothing to check ${what} against`)
   const digest = (bytes) => DIGESTS[algorithm](bytes, { expected, list })
-  for (const path of local) {
+  const key = `${what}.${ext}`
+  for (const path of ours ? [...local, ...ourCachePaths(dir, key)] : local) {
     const bytes = await readRegularFile(path)
     if (bytes && await digest(bytes) === expected) return bytes
   }
@@ -31,7 +33,6 @@ export async function verifiedDownload({ method, dir, what, ext, algorithm, expe
     assert.ok(actual === expected, `${method}: integrity mismatch for ${what} from ${from}: expected ${expected}, got ${actual}`)
     return bytes
   }
-  const key = `${what}.${ext}`
   const cached = await readCache(dir, key)
   if (cached) return await check(cached, 'the cache')
   const url = await locate()

package/src/github/read.js

@@ -113,10 +113,10 @@ async function getRepoFile(headers, options) {
 
 // Follows the redirect to codeload.github.com. A tree id names its content,
 // so the bytes are held to it, downloaded or cached, and cached by it alone,
-// for good. What a tarball cannot show, a submodule's commit or a subtree
-// with nothing in it, comes from GitHub's listings of the trees, which the
-// id checks as well: a directory at a time, as a recursive listing of a
-// large tree is cut short.
+// for good. What a tarball cannot show, a submodule's commit, a subtree
+// with nothing in it or the LF blob of a file marked `eol=crlf`, comes
+// from GitHub's listings of the trees, which the id checks as well: a
+// directory at a time, as a recursive listing of a large tree is cut short.
 async function treeTarball(method, headers, repo, tree) {
   const listings = new Map()
   const list = (sha) => {

package/src/npm/tarball.js

@@ -71,5 +71,5 @@ export async function verifyDist(name, version, dist) {
 export async function getTarball(name, version, dist) {
   assertPackage('getTarball', name, version)
   const { tarball, integrity } = dist === undefined ? await getDist('getTarball', name, version) : checkedDist('getTarball', name, version, dist)
-  return await verifiedDownload({ method: 'getTarball', dir: DIR, what: `${name}@${version}`, ext: 'tgz', algorithm: 'sha512', expected: integrity, local: localPaths(name, version, integrity), locate: () => tarball, options: withNpmToken(name, tarball) })
+  return await verifiedDownload({ method: 'getTarball', dir: DIR, what: `${name}@${version}`, ext: 'tgz', algorithm: 'sha512', expected: integrity, local: localPaths(name, version, integrity), ours: true, locate: () => tarball, options: withNpmToken(name, tarball) })
 }

package/src/tree.js

@@ -3,6 +3,7 @@ import { createHash } from 'node:crypto'
 import { gunzipSync } from 'node:zlib'
 
 import { isSha1, matches } from './args.js'
+import { withAttributes, writtenWithCrlf } from './attributes.js'
 
 const BLOCK = 512
 const MAX_UNPACKED_BYTES = 2 ** 30
@@ -85,16 +86,56 @@ async function holdsNothing(sha, listed) {
   return true
 }
 
-// `git archive` leaves out a subtree with no file in it, which only
-// plumbing makes. Where a directory's id is not the one listed, its listing
-// names any, and one is put back only once its own listings show it holds
-// nothing.
-async function putBackEmptyTrees(dir, sha, listed) {
+const CHUNK = 64 * 1024
+
+// The id of the blob that `eol=crlf`, a CR written before each LF with
+// none, writes out as these bytes: theirs with each LF's CR taken out,
+// hashed a chunk at a time, the bytes only read. Null where no blob writes
+// them so: an LF with no CR before it, a CR before that CR, or no LF at
+// all. Most files are passed over at their first LF, a binary one with
+// none at once.
+function crlfBlobId(written) {
+  const first = written.indexOf(0x0a)
+  if (first < 1 || written[first - 1] !== 0x0d) return null
+  let lfs = 0
+  for (let i = first; i < written.length; i++) {
+    if (written[i] !== 0x0a) continue
+    if (written[i - 1] !== 0x0d || written[i - 2] === 0x0d) return null
+    lfs++
+  }
+  const hash = createHash('sha1').update(`blob ${written.length - lfs}\0`)
+  const chunk = Buffer.allocUnsafe(CHUNK)
+  let at = 0
+  for (let i = 0; i < written.length; i++) {
+    if (written[i] === 0x0d && written[i + 1] === 0x0a) continue
+    chunk[at++] = written[i]
+    if (at === CHUNK) {
+      hash.update(chunk)
+      at = 0
+    }
+  }
+  return hash.update(chunk.subarray(0, at)).digest()
+}
+
+// Where a directory's id is not the one listed, its listing names what
+// `git archive` wrote otherwise, as a checkout writes it. A subtree with no
+// file in it, which only plumbing makes, it leaves out: one is put back
+// only once its own listings show it holds nothing. A file marked
+// `eol=crlf` it writes with CRLF where git has LF: one is hashed as the
+// blob listed, its bytes left as written, where that blob writes them and
+// the tree's .gitattributes have git write it so.
+async function mend(dir, sha, listed, base = '', above = []) {
+  const own = dir.get('.gitattributes')
+  const attributes = withAttributes(above, base, own && (own.body ?? null))
   for (const entry of await listed(sha)) {
-    if (entry.type !== 'tree') continue
     const here = dir.get(entry.name)
-    if (here instanceof Map && treeId(here).toString('hex') !== entry.sha) await putBackEmptyTrees(here, entry.sha, listed)
-    else if (here === undefined && await holdsNothing(entry.sha, listed)) dir.set(entry.name, subtree(entry.sha))
+    if (entry.type === 'tree') {
+      if (here instanceof Map && treeId(here).toString('hex') !== entry.sha) await mend(here, entry.sha, listed, `${base}${entry.name}/`, attributes)
+      else if (here === undefined && await holdsNothing(entry.sha, listed)) dir.set(entry.name, subtree(entry.sha))
+    } else if (entry.type === 'blob' && here?.body && here.id.toString('hex') !== entry.sha
+      && crlfBlobId(here.body)?.toString('hex') === entry.sha && writtenWithCrlf(attributes, `${base}${entry.name}`, here.body)) {
+      dir.set(entry.name, { ...here, id: Buffer.from(entry.sha, 'hex') })
+    }
   }
 }
 
@@ -104,8 +145,9 @@ async function putBackEmptyTrees(dir, sha, listed) {
 // which answers a listing of a tree by its id, as GitHub's trees API does
 // ({ type, path, sha } entries), walked from `expected`: a submodule's
 // commit for an empty directory, and, where the id comes out otherwise, the
-// subtrees with nothing in them it leaves out. The id is `expected` only if
-// those are right. Where there is no such tree, a reason, never an id.
+// subtrees with nothing in them it leaves out and the blobs of the files it
+// wrote with CRLF for `eol=crlf`. The id is `expected` only if those are
+// right. Where there is no such tree, a reason, never an id.
 export async function gitTreeOfTarball(gzipped, { expected, list } = {}) {
   let bytes
   try {
@@ -160,7 +202,7 @@ export async function gitTreeOfTarball(gzipped, { expected, list } = {}) {
     }
     if (name === null) continue
     if (dir.has(name)) return `no tree: ${JSON.stringify(path)} twice`
-    dir.set(name, type === '0' ? { mode: mode & 0o100 ? '100755' : '100644', id: objectId('blob', body) } : { mode: '120000', id: objectId('blob', Buffer.from(target, 'latin1')) })
+    dir.set(name, type === '0' ? { mode: mode & 0o100 ? '100755' : '100644', id: objectId('blob', body), body } : { mode: '120000', id: objectId('blob', Buffer.from(target, 'latin1')) })
   }
   if (top === undefined) return 'no tree: an empty tarball'
   const listed = async (sha) => (list && isSha1(sha) ? await list(sha) : [])
@@ -178,7 +220,7 @@ export async function gitTreeOfTarball(gzipped, { expected, list } = {}) {
   }
   const id = treeId(root).toString('hex')
   if (id === expected) return id
-  await putBackEmptyTrees(root, expected, listed)
+  await mend(root, expected, listed)
   return treeId(root).toString('hex')
 }
 

package/src/weak-edges.js

@@ -0,0 +1,87 @@
+// Package-relative coordinates keep this inventory independent of installation
+// roots, pnpm layouts, display-prefix stripping, and graph package grouping.
+const babelConfig = { package: '@babel/core', path: /^lib\/config\//u }
+const babelPlugins = { package: '@babel/core', path: /^lib\/config\/files\/(?:module-types|plugins)\.js$/u }
+
+export const weakEdges = Object.freeze([
+  {
+    id: 'react-native-codegen-discovery',
+    reason: 'Codegen discovers package metadata and React Native configuration.',
+    from: { package: 'react-native', path: /^scripts\/codegen\/generate-artifacts-executor\.js$/u },
+    to: { path: /(?:^|\/)(?:package\.json|react-native\.config\.js)$/u },
+  },
+  {
+    id: 'react-native-release-version',
+    reason: 'The CLI release checker reads the installed React Native version.',
+    from: { package: '@react-native-community/cli-tools', path: /^build\/releaseChecker\/index\.js$/u },
+    to: { package: 'react-native', path: /^package\.json$/u },
+  },
+  {
+    id: 'react-native-platform-config',
+    reason: 'React Native configuration loads platform CLIs supplied by the host project.',
+    from: { package: 'react-native', path: /^react-native\.config\.js$/u },
+    to: { package: /^@react-native-community\/cli-platform-(?:android|ios)$/u, path: /^build\/index\.js$/u },
+  },
+  {
+    id: 'babel-project-config',
+    reason: 'Babel discovers project configuration.',
+    from: babelConfig,
+    to: { path: /(?:^|\/)babel\.config\.js$/u },
+  },
+  {
+    id: 'babel-typescript-preset',
+    reason: 'Babel configuration loads the TypeScript preset.',
+    from: babelConfig,
+    to: { package: '@babel/preset-typescript', path: /./u },
+  },
+  {
+    id: 'babel-react-native-preset',
+    reason: 'Babel config loaders load the configured React Native preset.',
+    from: babelPlugins,
+    to: { package: '@react-native/babel-preset', path: /^(?:src\/)?index\.js$/u },
+  },
+  {
+    id: 'babel-reanimated-plugin',
+    reason: 'Babel config loaders load the configured Reanimated plugin, including scoped copies.',
+    from: babelPlugins,
+    to: { package: /^(?:@[^/]+\/)?react-native-reanimated$/u, path: /^plugin\/index\.js$/u },
+  },
+  {
+    id: 'babel-transform-plugin',
+    reason: 'Babel config loaders load configured transform plugins.',
+    from: babelPlugins,
+    to: { package: /^@babel\/plugin-transform-[^/]+$/u, path: /^lib\/index\.js$/u },
+  },
+  {
+    id: 'cosmiconfig-config',
+    reason: 'Cosmiconfig loads discovered configuration, including dependency configuration.',
+    from: { package: 'cosmiconfig', path: /^dist\/loaders\.js$/u },
+    to: { path: /\.config\.js$/u },
+  },
+  {
+    id: 'import-fresh-own-config',
+    reason: 'import-fresh loads host-project configuration.',
+    from: { package: 'import-fresh', path: /./u },
+    to: { path: /\.config\.js$/u },
+    ownSourceOnly: true,
+  },
+].map(rule => Object.freeze({ ...rule, from: Object.freeze(rule.from), to: Object.freeze(rule.to) })))
+
+// Do not guess ownership from a partial or shortened path. A nested dependency
+// must be passed as its own package, not as node_modules/... inside its parent.
+function normalizedPath(path) {
+  return typeof path === 'string' && !path.includes('\\') && !path.includes(':')
+    && path.split('/').every(part => part !== '' && part !== '.' && part !== '..' && part !== 'node_modules')
+}
+
+function matches(selector, file) {
+  const pkg = selector.package
+  if (pkg !== undefined && file.ownSource === true) return false
+  return (pkg === undefined || (typeof pkg === 'string' ? pkg === file.package : pkg.test(file.package ?? '')))
+    && selector.path.test(file.path)
+}
+
+export function getWeakEdge(from, to) {
+  if (from?.ownSource === true || !normalizedPath(from?.path) || !normalizedPath(to?.path)) return undefined
+  return weakEdges.find(rule => (!rule.ownSourceOnly || to.ownSource === true) && matches(rule.from, from) && matches(rule.to, to))
+}

package/weak-edges.d.ts

@@ -0,0 +1,36 @@
+/** A resolved file, identified by its owning package rather than a display path. */
+export interface WeakEdgeFile {
+  /** Exact npm package name, including scope. May be absent for own source. */
+  package?: string
+  /** Normalized /-separated path relative to the owning package or own-source root. */
+  path: string
+  /** Authoritative project ownership, not inferred from a package name or path. */
+  ownSource?: boolean
+}
+
+export interface WeakEdgeSelector {
+  /** Absent means any package or own source. Regular expressions match package names. */
+  readonly package?: string | RegExp
+  readonly path: RegExp
+}
+
+export interface WeakEdgeRule {
+  readonly id: string
+  readonly reason: string
+  readonly from: WeakEdgeSelector
+  readonly to: WeakEdgeSelector
+  readonly ownSourceOnly?: boolean
+}
+
+/** Curated weak loads: omit these file edges from cycles and default inclusion explanations. */
+export const weakEdges: readonly WeakEdgeRule[]
+
+/**
+ * Returns the matching inventory rule, or undefined for an unrecognized edge.
+ * Own-source importers never match. import-fresh requires to.ownSource === true.
+ * Own-source targets only match selectors without a package constraint.
+ * Resolve nested installations to their actual owning package before calling;
+ * absolute, non-normalized, or nested node_modules paths do not match.
+ * Does not remove files, alter raw load records, or change runtime resolution.
+ */
+export function getWeakEdge(from: WeakEdgeFile, to: WeakEdgeFile): WeakEdgeRule | undefined

package/weak-edges.js

@@ -0,0 +1 @@
+export { getWeakEdge, weakEdges } from './src/weak-edges.js'