@taiga-ai/mcp-server 0.26.0-dev.482 → 0.26.0-dev.484

package/dist/index.js

@@ -1774,6 +1774,11 @@ const MAINTENANCE_IGNORE_REASONS = [
 *   alone is shipped, and `dev` + `optional` (devOptional) is left undecided.
 * - pnpm-lock.yaml: `dev` comes from a per-package `dev: true` that lockfile
 *   v9 no longer writes, so an empty list says nothing; `dev` still means dev.
+*   For a package a workspace declares under `dependencies` or
+*   `optionalDependencies`, the sweep adds Taiga's own `prod`, so that copy
+*   reads runtime. A `devDependencies` declaration is not turned into `dev`:
+*   a runtime dependency's snapshot may pull the same copy in, which only the
+*   `snapshots` graph could rule out, so it stays unknown.
 * - poetry.lock: group names with `main` dropped; a non-main, non-optional
 *   group is not in the runtime install. Poetry 1.x lockfiles carry no groups
 *   at all, so an empty list says nothing.
@@ -1801,6 +1806,8 @@ function lockfileScope(path, groups) {
 			return "unknown";
 		}
 		case "pnpm-lock.yaml":
+			if (set.has("prod")) return "runtime";
+			return set.size === 1 && set.has("dev") ? "dev" : "unknown";
 		case "uv.lock": return set.size === 1 && set.has("dev") ? "dev" : "unknown";
 		case "poetry.lock": return set.size > 0 && !set.has("optional") && !set.has("main") ? "dev" : "unknown";
 		default: return "unknown";
@@ -1827,6 +1834,21 @@ function combineScopes(scopes) {
 	if (scopes.includes("unknown") || scopes.length === 0) return "unknown";
 	return "dev";
 }
+/**
+* Whether the repository declares the package itself. Per lockfile the sweep
+* says direct or transitive; across lockfiles one direct declaration makes the
+* finding direct (that copy is the repository's to bump), transitive only when
+* every readable lockfile says so, unknown when the sweep could read none of
+* them or did not record it (older images, code kinds). Presentation only; the
+* remediation step already finds every resolved copy and its parent itself.
+*/
+function dependencyRelation(finding) {
+	if (finding.kind !== "vulnerable_dependency" && finding.kind !== "outdated_dependency") return "unknown";
+	const values = Object.values(finding.dependencyRelation ?? {});
+	if (values.includes("direct")) return "direct";
+	if (values.length > 0 && values.every((v) => v === "transitive")) return "transitive";
+	return "unknown";
+}
 new Set(CODE_REMEDIATION_KINDS);
 /** A non-empty string, or null. */
 const locationText = z.string().min(1).nullable().catch(null);
@@ -4961,15 +4983,24 @@ function withFixability(row) {
 * the API carries: the groups need the lockfile name to read, which `dependencyScope` does once here.
 */
 function withDependencyScope(row, { keepGroups = false } = {}) {
-	const { dependencyGroups: _groups, ...lean } = row;
-	const rest = keepGroups ? row : lean;
+	const { dependencyGroups: _groups, dependencyRelation: _relation, ...lean } = row;
+	const rest = keepGroups ? {
+		...row,
+		dependencyRelation: void 0
+	} : lean;
 	if (!(row["kind"] === "vulnerable_dependency" || row["kind"] === "outdated_dependency")) return rest;
+	const kind = row["kind"];
 	return {
 		...rest,
 		dependencyScope: dependencyScope({
-			kind: row["kind"],
+			kind,
 			dependencyGroups: row["dependencyGroups"]
-		})
+		}),
+		dependencyRelation: dependencyRelation({
+			kind,
+			dependencyRelation: row["dependencyRelation"]
+		}),
+		...keepGroups ? { dependencyRelationByLockfile: row["dependencyRelation"] ?? null } : {}
 	};
 }
 /** A finding as a tool answers it: the row fields, the scope, and whether Fix would take it. */
@@ -4977,6 +5008,7 @@ function findingRows(findings, extra = []) {
 	return pickFields(findings, [
 		...FINDING_ROW_FIELDS,
 		"dependencyGroups",
+		"dependencyRelation",
 		...extra
 	]).map((row) => withDependencyScope(row)).map(withFixability);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.26.0-dev.482",
+  "version": "0.26.0-dev.484",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "type": "module",