@taiga-ai/mcp-server 0.26.0-dev.482 → 0.26.0-dev.483

package/dist/index.js

@@ -1827,6 +1827,21 @@ function combineScopes(scopes) {
 	if (scopes.includes("unknown") || scopes.length === 0) return "unknown";
 	return "dev";
 }
+/**
+* Whether the repository declares the package itself. Per lockfile the sweep
+* says direct or transitive; across lockfiles one direct declaration makes the
+* finding direct (that copy is the repository's to bump), transitive only when
+* every readable lockfile says so, unknown when the sweep could read none of
+* them or did not record it (older images, code kinds). Presentation only; the
+* remediation step already finds every resolved copy and its parent itself.
+*/
+function dependencyRelation(finding) {
+	if (finding.kind !== "vulnerable_dependency" && finding.kind !== "outdated_dependency") return "unknown";
+	const values = Object.values(finding.dependencyRelation ?? {});
+	if (values.includes("direct")) return "direct";
+	if (values.length > 0 && values.every((v) => v === "transitive")) return "transitive";
+	return "unknown";
+}
 new Set(CODE_REMEDIATION_KINDS);
 /** A non-empty string, or null. */
 const locationText = z.string().min(1).nullable().catch(null);
@@ -4961,15 +4976,24 @@ function withFixability(row) {
 * the API carries: the groups need the lockfile name to read, which `dependencyScope` does once here.
 */
 function withDependencyScope(row, { keepGroups = false } = {}) {
-	const { dependencyGroups: _groups, ...lean } = row;
-	const rest = keepGroups ? row : lean;
+	const { dependencyGroups: _groups, dependencyRelation: _relation, ...lean } = row;
+	const rest = keepGroups ? {
+		...row,
+		dependencyRelation: void 0
+	} : lean;
 	if (!(row["kind"] === "vulnerable_dependency" || row["kind"] === "outdated_dependency")) return rest;
+	const kind = row["kind"];
 	return {
 		...rest,
 		dependencyScope: dependencyScope({
-			kind: row["kind"],
+			kind,
 			dependencyGroups: row["dependencyGroups"]
-		})
+		}),
+		dependencyRelation: dependencyRelation({
+			kind,
+			dependencyRelation: row["dependencyRelation"]
+		}),
+		...keepGroups ? { dependencyRelationByLockfile: row["dependencyRelation"] ?? null } : {}
 	};
 }
 /** A finding as a tool answers it: the row fields, the scope, and whether Fix would take it. */
@@ -4977,6 +5001,7 @@ function findingRows(findings, extra = []) {
 	return pickFields(findings, [
 		...FINDING_ROW_FIELDS,
 		"dependencyGroups",
+		"dependencyRelation",
 		...extra
 	]).map((row) => withDependencyScope(row)).map(withFixability);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.26.0-dev.482",
+  "version": "0.26.0-dev.483",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "type": "module",