oc-pilot 0.5.1 → 0.88.1

package/dist/core/deps-why.js

@@ -0,0 +1,260 @@
+/**
+ * Dependency provenance: answers "why is this package here?" from local data only.
+ * Combines the manifest, the imports in the code and the lockfile graph, so an
+ * agent can see direct imports, every dependent package and the chains that pull
+ * a transitive dependency in. Offline and deterministic.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { packageNameOf } from "./deps-health.js";
+import { PilotError } from "./errors.js";
+import { readLockfile } from "./lockfile.js";
+import { readRepository } from "./slop/collect.js";
+const IMPORT_PATTERNS = [
+    /\bfrom\s+["']([^"']+)["']/g,
+    /\brequire\s*\(\s*["']([^"']+)["']\s*\)/g,
+    /\bimport\s*\(\s*["']([^"']+)["']\s*\)/g,
+    /\bimport\s+["']([^"']+)["']/g,
+];
+function readJsonFile(path) {
+    try {
+        return JSON.parse(readFileSync(path, "utf8").replace(/^\uFEFF/, ""));
+    }
+    catch {
+        return undefined;
+    }
+}
+function recordOf(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function manifestFields(manifest) {
+    return [
+        ["prod", recordOf(manifest.dependencies)],
+        ["dev", recordOf(manifest.devDependencies)],
+        ["optional", recordOf(manifest.optionalDependencies)],
+        ["peer", recordOf(manifest.peerDependencies)],
+    ];
+}
+function readManifest(cwd) {
+    const path = join(cwd, "package.json");
+    if (!existsSync(path)) {
+        throw new PilotError("package.json не найден", {
+            hint: "Запустите команду в корне npm-проекта или укажите --cwd.",
+            exitCode: 2,
+        });
+    }
+    const parsed = readJsonFile(path);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new PilotError("Не удалось прочитать package.json", {
+            hint: "Проверьте, что файл содержит корректный JSON.",
+            exitCode: 2,
+        });
+    }
+    return parsed;
+}
+function nameFromKey(key) {
+    const match = /(?:^|\/)node_modules\/((?:@[^/]+\/)?[^/]+)$/.exec(key);
+    return match?.[1];
+}
+function loadV1(deps, parentKey, nodes) {
+    for (const [name, raw] of Object.entries(deps ?? {})) {
+        if (!raw || typeof raw !== "object")
+            continue;
+        const entry = raw;
+        const key = parentKey ? `${parentKey}/node_modules/${name}` : `node_modules/${name}`;
+        nodes.set(key, {
+            name,
+            version: typeof entry.version === "string" ? entry.version : undefined,
+            deps: recordOf(entry.dependencies),
+        });
+        loadV1(entry.dependencies, key, nodes);
+    }
+}
+function lockNodes(lock) {
+    const nodes = new Map();
+    if (!lock || typeof lock !== "object")
+        return nodes;
+    const packages = lock.packages;
+    if (packages && typeof packages === "object" && !Array.isArray(packages)) {
+        for (const [key, raw] of Object.entries(packages)) {
+            if (!key || !raw || typeof raw !== "object")
+                continue;
+            const name = nameFromKey(key);
+            if (!name)
+                continue;
+            const entry = raw;
+            nodes.set(key, {
+                name,
+                version: typeof entry.version === "string" ? entry.version : undefined,
+                deps: { ...recordOf(entry.dependencies), ...recordOf(entry.optionalDependencies) },
+            });
+        }
+        return nodes;
+    }
+    loadV1(lock.dependencies, "", nodes);
+    return nodes;
+}
+/** pnpm and yarn lockfiles list every resolved package by name, without nesting. */
+function flatNodes(packages) {
+    const nodes = new Map();
+    for (const entry of packages) {
+        if (!nodes.has(entry.name)) {
+            nodes.set(entry.name, { name: entry.name, version: entry.version, deps: entry.deps });
+        }
+    }
+    return nodes;
+}
+/** npm resolution: nested copy first, then walk up to the root node_modules. */
+function resolveKey(nodes, fromKey, dep) {
+    // Flat lockfiles (pnpm, yarn) are keyed by package name.
+    if (nodes.has(dep))
+        return dep;
+    let current = fromKey;
+    while (current) {
+        const candidate = `${current}/node_modules/${dep}`;
+        if (nodes.has(candidate))
+            return candidate;
+        const index = current.lastIndexOf("/node_modules/");
+        if (index <= 0)
+            break;
+        current = current.slice(0, index);
+    }
+    const root = `node_modules/${dep}`;
+    return nodes.has(root) ? root : undefined;
+}
+function rootDependencies(manifest) {
+    const names = new Set();
+    for (const [, record] of manifestFields(manifest)) {
+        for (const name of Object.keys(record))
+            names.add(name);
+    }
+    return [...names];
+}
+function collectChains(nodes, roots, target, maxChains, maxDepth) {
+    const chains = [];
+    const queue = [];
+    for (const dep of roots) {
+        const key = resolveKey(nodes, "", dep);
+        if (!key)
+            continue;
+        const node = nodes.get(key);
+        queue.push({ key, path: [node.name] });
+    }
+    while (queue.length > 0 && chains.length < maxChains) {
+        const item = queue.shift();
+        const node = nodes.get(item.key);
+        if (node.name === target) {
+            chains.push(item.path);
+            continue;
+        }
+        if (item.path.length >= maxDepth)
+            continue;
+        for (const dep of Object.keys(node.deps)) {
+            const childKey = resolveKey(nodes, item.key, dep);
+            if (!childKey)
+                continue;
+            const child = nodes.get(childKey);
+            if (item.path.includes(child.name))
+                continue;
+            queue.push({ key: childKey, path: [...item.path, child.name] });
+        }
+    }
+    return chains;
+}
+function importedBy(cwd, name) {
+    const files = readRepository(cwd).files;
+    const paths = new Set();
+    for (const file of files) {
+        for (const pattern of IMPORT_PATTERNS) {
+            pattern.lastIndex = 0;
+            let match;
+            while ((match = pattern.exec(file.text)) !== null) {
+                if (packageNameOf(match[1] ?? "") === name) {
+                    paths.add(file.path);
+                    break;
+                }
+            }
+            if (paths.has(file.path))
+                break;
+        }
+    }
+    return [...paths].sort();
+}
+/**
+ * Explains where a package comes from. Returns undefined when the name appears
+ * nowhere: not declared, not imported and not installed per the lockfile.
+ */
+export function explainDependency(cwd, name, options = {}) {
+    const packageName = name.trim();
+    if (!packageName)
+        throw new PilotError("Не указано имя пакета для --why", { exitCode: 2 });
+    const manifest = readManifest(cwd);
+    const declaredEntry = manifestFields(manifest)
+        .map(([field, record]) => ({ field, spec: record[packageName] }))
+        .find((entry) => entry.spec !== undefined);
+    const lock = readLockfile(cwd);
+    const npmNodes = lock?.kind === "npm" ? lockNodes(readJsonFile(join(cwd, lock.file))) : undefined;
+    const nodes = npmNodes ?? flatNodes(lock?.packages ?? []);
+    const installed = npmNodes
+        ? [...npmNodes.values()].filter((node) => node.name === packageName)
+        : (lock?.packages ?? [])
+            .filter((entry) => entry.name === packageName)
+            .map((entry) => ({ name: entry.name, version: entry.version, deps: entry.deps }));
+    const imports = importedBy(cwd, packageName);
+    if (!declaredEntry && installed.length === 0 && imports.length === 0)
+        return undefined;
+    const versions = [...new Set(installed.map((node) => node.version).filter((value) => Boolean(value)))].sort();
+    const dependents = new Set();
+    for (const [, node] of nodes) {
+        if (node.name === packageName)
+            continue;
+        if (Object.keys(node.deps).includes(packageName))
+            dependents.add(node.name);
+    }
+    const roots = rootDependencies(manifest);
+    const chains = installed.length > 0
+        ? collectChains(nodes, roots, packageName, options.maxChains ?? 5, options.maxDepth ?? 10)
+        : [];
+    const declared = declaredEntry ? { field: declaredEntry.field, spec: declaredEntry.spec } : null;
+    return {
+        name: packageName,
+        versions,
+        copies: installed.length,
+        declared,
+        importedBy: imports,
+        dependents: [...dependents].sort(),
+        chains,
+    };
+}
+/** Human-readable report for the terminal. */
+export function renderDependencyWhy(result) {
+    const fields = {
+        prod: "dependencies",
+        dev: "devDependencies",
+        optional: "optionalDependencies",
+        peer: "peerDependencies",
+    };
+    const lines = [`Пакет: ${result.name}`];
+    if (result.copies > 0) {
+        const copies = result.copies === 1 ? "1 копия" : `${result.copies} копии`;
+        lines.push(`Версии в lockfile: ${result.versions.join(", ") || "без версии"} (${copies})`);
+    }
+    else {
+        lines.push("В lockfile не найден");
+    }
+    lines.push(result.declared
+        ? `Объявлен: ${fields[result.declared.field]} ${result.declared.spec}`
+        : "В package.json не объявлен");
+    lines.push(result.importedBy.length > 0 ? `Импортируется: ${result.importedBy.join(", ")}` : "Прямых импортов нет");
+    lines.push(result.dependents.length > 0 ? `Зависит от него: ${result.dependents.join(", ")}` : "Никто не зависит");
+    if (result.chains.length > 0) {
+        lines.push("Цепочки от корня:");
+        for (const chain of result.chains)
+            lines.push(`  ${chain.join(" → ")}`);
+    }
+    else {
+        lines.push("Цепочки от корня: нет — из package.json пакет недостижим");
+    }
+    return `${lines.join("\n")}\n`;
+}
+//# sourceMappingURL=deps-why.js.map

package/dist/core/deps-why.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps-why.js","sourceRoot":"","sources":["../../src/core/deps-why.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAiB,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAkCnD,MAAM,eAAe,GAAG;IACtB,4BAA4B;IAC5B,yCAAyC;IACzC,wCAAwC;IACxC,8BAA8B;CAC/B,CAAC;AAEF,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9G,CAAC;AAED,SAAS,cAAc,CAAC,QAAyB;IAC/C,OAAO;QACL,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC3C,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QACrD,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAAC,wBAAwB,EAAE;YAC7C,IAAI,EAAE,0DAA0D;YAChE,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,UAAU,CAAC,mCAAmC,EAAE;YACxD,IAAI,EAAE,+CAA+C;YACrD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAyB,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,KAAK,GAAG,6CAA6C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,MAAM,CAAC,IAAyC,EAAE,SAAiB,EAAE,KAA4B;IACxG,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QAC9C,MAAM,KAAK,GAAG,GAAoE,CAAC;QACnF,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACrF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YACb,IAAI;YACJ,OAAO,EAAE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACtE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,QAAQ,GAAI,IAA+B,CAAC,QAAQ,CAAC;IAC3D,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAmC,CAAC,EAAE,CAAC;YAC7E,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,SAAS;YACtD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,KAAK,GAAG,GAAoH,CAAC;YACnI,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;gBACb,IAAI;gBACJ,OAAO,EAAE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACtE,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE;aACnF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAE,IAAmD,CAAC,YAAY,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oFAAoF;AACpF,SAAS,SAAS,CAAC,QAAiF;IAClG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAC,KAA4B,EAAE,OAAe,EAAE,GAAW;IAC5E,yDAAyD;IACzD,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC/B,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,OAAO,OAAO,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,GAAG,OAAO,iBAAiB,GAAG,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;QACpD,IAAI,KAAK,IAAI,CAAC;YAAE,MAAM;QACtB,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,GAAG,EAAE,CAAC;IACnC,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAyB;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CACpB,KAA4B,EAC5B,KAAe,EACf,MAAc,EACd,SAAiB,EACjB,QAAgB;IAEhB,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,KAAK,GAA2C,EAAE,CAAC;IACzD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAE,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ;YAAE,SAAS;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;YACnC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAY;IAC3C,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClD,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC3C,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACrB,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM;QAClC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,IAAY,EACZ,UAAgC,EAAE;IAElC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,UAAU,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IAE3F,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,aAAa,GAAG,cAAc,CAAC,QAAQ,CAAC;SAC3C,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;SAChE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAE7C,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,MAAM,KAAK,GAAG,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAe,QAAQ;QACpC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC;QACpE,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;aACnB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC;aAC7C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAE7C,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvF,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE/H,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACxC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,MAAM,GACV,SAAS,CAAC,MAAM,GAAG,CAAC;QAClB,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC1F,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjG,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,QAAQ;QACR,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,QAAQ;QACR,UAAU,EAAE,OAAO;QACnB,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE;QAClC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACvD,MAAM,MAAM,GAA6B;QACvC,IAAI,EAAE,cAAc;QACpB,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,sBAAsB;QAChC,IAAI,EAAE,kBAAkB;KACzB,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,UAAU,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,QAAQ,CAAC;QAC1E,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,KAAK,MAAM,GAAG,CAAC,CAAC;IAC7F,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACrC,CAAC;IACD,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,QAAQ;QACb,CAAC,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE;QACtE,CAAC,CAAC,4BAA4B,CACjC,CAAC;IACF,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CACxG,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;IACnH,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/core/deps-why.test.js

@@ -0,0 +1,175 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import test from "node:test";
+import { explainDependency, renderDependencyWhy } from "./deps-why.js";
+function makeRepo(files) {
+    const dir = mkdtempSync(join(tmpdir(), "oc-pilot-deps-why-"));
+    spawnSync("git", ["init", "-q"], { cwd: dir });
+    for (const [path, text] of Object.entries(files)) {
+        const target = join(dir, path);
+        mkdirSync(dirname(target), { recursive: true });
+        writeFileSync(target, text, "utf8");
+    }
+    return dir;
+}
+function manifest(value) {
+    return JSON.stringify({ name: "demo", private: true, ...value }, null, 2);
+}
+function lockfile(packages) {
+    return JSON.stringify({ name: "demo", lockfileVersion: 3, packages: { "": { name: "demo" }, ...packages } }, null, 2);
+}
+test("explainDependency follows a transitive chain from package.json", () => {
+    const dir = makeRepo({
+        "package.json": manifest({ dependencies: { express: "^4.18.0" } }),
+        "package-lock.json": lockfile({
+            "node_modules/express": { version: "4.18.2", dependencies: { "body-parser": "1.20.1" } },
+            "node_modules/body-parser": { version: "1.20.1", dependencies: { qs: "6.11.0" } },
+            "node_modules/qs": { version: "6.11.0" },
+        }),
+        "src/app.ts": 'import express from "express";\n',
+    });
+    try {
+        const why = explainDependency(dir, "qs");
+        assert.ok(why);
+        assert.deepEqual(why.versions, ["6.11.0"]);
+        assert.equal(why.copies, 1);
+        assert.equal(why.declared, null);
+        assert.deepEqual(why.importedBy, []);
+        assert.deepEqual(why.dependents, ["body-parser"]);
+        assert.deepEqual(why.chains, [["express", "body-parser", "qs"]]);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+test("explainDependency reports a declared dev dependency and its import", () => {
+    const dir = makeRepo({
+        "package.json": manifest({ devDependencies: { vitest: "^1.6.0" } }),
+        "package-lock.json": lockfile({ "node_modules/vitest": { version: "1.6.0" } }),
+        "src/a.test.ts": 'import { test } from "vitest";\n',
+    });
+    try {
+        const why = explainDependency(dir, "vitest");
+        assert.ok(why);
+        assert.deepEqual(why.declared, { field: "dev", spec: "^1.6.0" });
+        assert.deepEqual(why.importedBy, ["src/a.test.ts"]);
+        assert.deepEqual(why.chains, [["vitest"]]);
+        assert.deepEqual(why.dependents, []);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+test("explainDependency counts nested copies and resolves each chain", () => {
+    const dir = makeRepo({
+        "package.json": manifest({ dependencies: { a: "^1.0.0", b: "^1.0.0" } }),
+        "package-lock.json": lockfile({
+            "node_modules/a": { version: "1.0.0", dependencies: { shared: "^2.0.0" } },
+            "node_modules/a/node_modules/shared": { version: "2.0.0" },
+            "node_modules/b": { version: "1.0.0", dependencies: { shared: "^1.0.0" } },
+            "node_modules/shared": { version: "1.0.0" },
+        }),
+        "src/app.ts": 'import a from "a";\nimport b from "b";\n',
+    });
+    try {
+        const why = explainDependency(dir, "shared");
+        assert.ok(why);
+        assert.equal(why.copies, 2);
+        assert.deepEqual(why.versions, ["1.0.0", "2.0.0"]);
+        assert.deepEqual(why.dependents, ["a", "b"]);
+        assert.deepEqual(why.chains, [
+            ["a", "shared"],
+            ["b", "shared"],
+        ]);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+test("explainDependency reads a v1 lockfile tree", () => {
+    const dir = makeRepo({
+        "package.json": manifest({ dependencies: { express: "^4.18.0" } }),
+        "package-lock.json": JSON.stringify({
+            name: "demo",
+            lockfileVersion: 1,
+            dependencies: {
+                express: { version: "4.18.2", dependencies: { qs: { version: "6.11.0" } } },
+            },
+        }),
+        "src/app.ts": 'const express = require("express");\n',
+    });
+    try {
+        const why = explainDependency(dir, "qs");
+        assert.ok(why);
+        assert.deepEqual(why.versions, ["6.11.0"]);
+        assert.deepEqual(why.chains, [["express", "qs"]]);
+        assert.deepEqual(why.importedBy, []);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+test("explainDependency returns undefined for a package that is nowhere", () => {
+    const dir = makeRepo({
+        "package.json": manifest({ dependencies: { react: "^18.0.0" } }),
+        "src/app.ts": 'import react from "react";\n',
+    });
+    try {
+        assert.equal(explainDependency(dir, "left-pad"), undefined);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+test("explainDependency handles a declared package without a lockfile", () => {
+    const dir = makeRepo({
+        "package.json": manifest({ dependencies: { react: "^18.0.0" } }),
+        "src/app.ts": 'import react from "react";\n',
+    });
+    try {
+        const why = explainDependency(dir, "react");
+        assert.ok(why);
+        assert.deepEqual(why.declared, { field: "prod", spec: "^18.0.0" });
+        assert.equal(why.copies, 0);
+        assert.deepEqual(why.versions, []);
+        assert.deepEqual(why.chains, []);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+test("explainDependency rejects an empty package name", () => {
+    const dir = makeRepo({ "package.json": manifest({}) });
+    try {
+        assert.throws(() => explainDependency(dir, "  "), /Не указано имя пакета/);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+test("renderDependencyWhy prints chains and declaration", () => {
+    const dir = makeRepo({
+        "package.json": manifest({ dependencies: { express: "^4.18.0" } }),
+        "package-lock.json": lockfile({
+            "node_modules/express": { version: "4.18.2", dependencies: { qs: "6.11.0" } },
+            "node_modules/qs": { version: "6.11.0" },
+        }),
+    });
+    try {
+        const why = explainDependency(dir, "qs");
+        assert.ok(why);
+        const text = renderDependencyWhy(why);
+        assert.match(text, /Пакет: qs/);
+        assert.match(text, /Версии в lockfile: 6\.11\.0 \(1 копия\)/);
+        assert.match(text, /В package\.json не объявлен/);
+        assert.match(text, /Зависит от него: express/);
+        assert.match(text, /express → qs/);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=deps-why.test.js.map

package/dist/core/deps-why.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps-why.test.js","sourceRoot":"","sources":["../../src/core/deps-why.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAMvE,SAAS,QAAQ,CAAC,KAAgB;IAChC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC9D,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,KAA8B;IAC9C,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,QAAQ,CAAC,QAAiC;IACjD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACxH,CAAC;AAED,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC;QACnB,cAAc,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC;QAClE,mBAAmB,EAAE,QAAQ,CAAC;YAC5B,sBAAsB,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE;YACxF,0BAA0B,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE;YACjF,iBAAiB,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;SACzC,CAAC;QACF,YAAY,EAAE,kCAAkC;KACjD,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,GAAG,EAAE;IAC9E,MAAM,GAAG,GAAG,QAAQ,CAAC;QACnB,cAAc,EAAE,QAAQ,CAAC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC;QACnE,mBAAmB,EAAE,QAAQ,CAAC,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;QAC9E,eAAe,EAAE,kCAAkC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC;QACnB,cAAc,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC;QACxE,mBAAmB,EAAE,QAAQ,CAAC;YAC5B,gBAAgB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YAC1E,oCAAoC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;YAC1D,gBAAgB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YAC1E,qBAAqB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;SAC5C,CAAC;QACF,YAAY,EAAE,0CAA0C;KACzD,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE;YAC3B,CAAC,GAAG,EAAE,QAAQ,CAAC;YACf,CAAC,GAAG,EAAE,QAAQ,CAAC;SAChB,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;IACtD,MAAM,GAAG,GAAG,QAAQ,CAAC;QACnB,cAAc,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC;QAClE,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC;YAClC,IAAI,EAAE,MAAM;YACZ,eAAe,EAAE,CAAC;YAClB,YAAY,EAAE;gBACZ,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;aAC5E;SACF,CAAC;QACF,YAAY,EAAE,uCAAuC;KACtD,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;IAC7E,MAAM,GAAG,GAAG,QAAQ,CAAC;QACnB,cAAc,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;QAChE,YAAY,EAAE,8BAA8B;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,MAAM,GAAG,GAAG,QAAQ,CAAC;QACnB,cAAc,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;QAChE,YAAY,EAAE,8BAA8B;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,uBAAuB,CAAC,CAAC;IAC7E,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mDAAmD,EAAE,GAAG,EAAE;IAC7D,MAAM,GAAG,GAAG,QAAQ,CAAC;QACnB,cAAc,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC;QAClE,mBAAmB,EAAE,QAAQ,CAAC;YAC5B,sBAAsB,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE;YAC7E,iBAAiB,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;SACzC,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/core/deps.js

@@ -0,0 +1,179 @@
+const POPULAR_PACKAGES = {
+    npm: [
+        "react", "react-dom", "vue", "express", "axios", "lodash", "underscore",
+        "chalk", "commander", "typescript", "webpack", "vite", "jest", "mocha",
+        "eslint", "prettier", "dotenv", "mongoose", "sequelize", "prisma",
+        "next", "svelte", "zod", "uuid", "glob", "minimist", "qs", "cross-env",
+        "nanoid", "fs-extra", "dayjs", "moment", "ramda", "jquery", "core-js",
+        "tslib", "got", "node-fetch", "yaml", "joi", "winston", "pino",
+    ],
+    pypi: [
+        "requests", "flask", "django", "numpy", "pandas", "pytest", "urllib3",
+        "cryptography", "pyyaml", "sqlalchemy", "pillow", "click", "fastapi",
+        "httpx", "aiohttp", "boto3", "botocore", "redis", "celery", "marshmallow",
+    ],
+};
+function levenshtein(a, b) {
+    if (a === b)
+        return 0;
+    if (a.length === 0)
+        return b.length;
+    if (b.length === 0)
+        return a.length;
+    let previous = Array.from({ length: b.length + 1 }, (_, index) => index);
+    for (let i = 1; i <= a.length; i += 1) {
+        const current = [i];
+        for (let j = 1; j <= b.length; j += 1) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            current[j] = Math.min(current[j - 1] + 1, previous[j] + 1, previous[j - 1] + cost);
+        }
+        previous = current;
+    }
+    return previous[b.length];
+}
+/** Near-match against well-known package names (edit distance 1-2, length >= 4). */
+function typosquatOf(name, ecosystem) {
+    const popular = POPULAR_PACKAGES[ecosystem];
+    if (!popular || name.length < 4)
+        return undefined;
+    for (const candidate of popular) {
+        if (candidate === name)
+            return undefined;
+        const distance = levenshtein(name, candidate);
+        if (distance > 0 && distance <= 2 && Math.abs(name.length - candidate.length) <= 2) {
+            return candidate;
+        }
+    }
+    return undefined;
+}
+function specRisks(spec) {
+    const risks = [];
+    const value = spec.trim();
+    if (value === "" || value === "*" || value === "latest")
+        risks.push("unpinned");
+    if (/^(git\+|github:|git@|https?:\/\/|file:)/i.test(value))
+        risks.push("vcs-or-url reference");
+    return risks;
+}
+const JSON_DEPENDENCY_LINE = /^\+\s*"([^"@][^"]*)"\s*:\s*"([^"]*)"/;
+const MANIFESTS = [
+    {
+        ecosystem: "npm",
+        match: (file) => file.endsWith("package.json") || file.endsWith("package-lock.json") === false && file.endsWith("npm-shrinkwrap.json") === false && /(^|\/)package\.json$/.test(file),
+        parse: (line) => {
+            const match = JSON_DEPENDENCY_LINE.exec(line);
+            if (!match)
+                return undefined;
+            const name = match[1].trim();
+            if (!name || name.startsWith("@types/") === false && !/^[@a-zA-Z]/.test(name))
+                return undefined;
+            return { name, spec: match[2] };
+        },
+    },
+    {
+        ecosystem: "pypi",
+        match: (file) => file === "requirements.txt" || file.endsWith("/requirements.txt") || file.endsWith("pyproject.toml"),
+        parse: (line) => {
+            const requirement = /^\+\s*([A-Za-z0-9_.\-]+)\s*(?:[=<>~!]=?|\[)[^\s]*/.exec(line);
+            if (requirement)
+                return { name: requirement[1], spec: line.slice(1).trim() };
+            const pyproject = /^\+\s*([A-Za-z0-9_.\-]+)\s*=\s*"[^"]*"/.exec(line);
+            if (pyproject)
+                return { name: pyproject[1], spec: line.slice(1).trim() };
+            return undefined;
+        },
+    },
+    {
+        ecosystem: "go",
+        match: (file) => file === "go.mod" || file.endsWith("/go.mod"),
+        parse: (line) => {
+            const require = /^\+\s*([\w./~-]+)\s+(v[\w.\-+]+)/.exec(line);
+            return require ? { name: require[1], spec: require[2] } : undefined;
+        },
+    },
+    {
+        ecosystem: "cargo",
+        match: (file) => file === "Cargo.toml" || file.endsWith("/Cargo.toml"),
+        parse: (line) => {
+            const crate = /^\+\s*([\w-]+)\s*=\s*(".*|\{.*)/.exec(line);
+            return crate ? { name: crate[1], spec: line.slice(1).trim() } : undefined;
+        },
+    },
+    {
+        ecosystem: "rubygems",
+        match: (file) => file === "Gemfile" || file.endsWith("/Gemfile"),
+        parse: (line) => {
+            const gem = /^\+\s*gem\s+"([^"]+)"(.*)/.exec(line);
+            return gem ? { name: gem[1], spec: gem[2].trim().replace(/[",]/g, "") } : undefined;
+        },
+    },
+    {
+        ecosystem: "packagist",
+        match: (file) => file.endsWith("composer.json"),
+        parse: (line) => {
+            const match = JSON_DEPENDENCY_LINE.exec(line);
+            return match ? { name: match[1].trim(), spec: match[2] } : undefined;
+        },
+    },
+    {
+        ecosystem: "maven",
+        match: (file) => file.endsWith("pom.xml") || file.endsWith(".gradle") || file.endsWith(".gradle.kts"),
+        parse: (line) => {
+            const artifact = /^\+\s*(?:<artifactId>|["'])([\w.-]+)(?:<\/artifactId>|["'])/.exec(line);
+            return artifact ? { name: artifact[1], spec: "" } : undefined;
+        },
+    },
+    {
+        ecosystem: "nuget",
+        match: (file) => file.endsWith(".csproj") || file.endsWith("packages.config"),
+        parse: (line) => {
+            const reference = /^\+\s*<PackageReference\s+Include="([^"]+)"/.exec(line);
+            if (reference)
+                return { name: reference[1], spec: "" };
+            const legacy = /^\+\s*<package\s+id="([^"]+)"/.exec(line);
+            return legacy ? { name: legacy[1], spec: "" } : undefined;
+        },
+    },
+];
+const MAX_DEPENDENCY_FINDINGS = 50;
+/** Scans a unified diff for added dependency declarations and risk signals. */
+export function analyzeDependencyChanges(diff) {
+    const findings = [];
+    const seen = new Set();
+    let file = "";
+    for (const rawLine of diff.split(/\r?\n/)) {
+        if (rawLine.startsWith("+++ ")) {
+            file = rawLine.slice(4).replace(/^b\//, "").trim();
+            continue;
+        }
+        if (!rawLine.startsWith("+") || rawLine.startsWith("+++"))
+            continue;
+        if (file === "/dev/null")
+            continue;
+        const manifest = MANIFESTS.find((rule) => rule.match(file));
+        if (!manifest)
+            continue;
+        const parsed = manifest.parse(rawLine);
+        if (!parsed)
+            continue;
+        const risks = ["new dependency", ...specRisks(parsed.spec)];
+        const typosquat = typosquatOf(parsed.name, manifest.ecosystem);
+        if (typosquat)
+            risks.push(`possible typosquat of ${typosquat}`);
+        const key = `${manifest.ecosystem}:${parsed.name}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        findings.push({ ecosystem: manifest.ecosystem, name: parsed.name, spec: parsed.spec, risks, file });
+        if (findings.length >= MAX_DEPENDENCY_FINDINGS)
+            break;
+    }
+    return findings;
+}
+/** Renders findings for the prompt context block. */
+export function describeDependencyFindings(findings) {
+    return findings
+        .map((finding) => `- ${finding.ecosystem}: ${finding.name}${finding.spec ? ` (${finding.spec})` : ""} — ${finding.risks.join(", ")}`)
+        .join("\n");
+}
+//# sourceMappingURL=deps.js.map