toiljs 0.0.15 → 0.0.16

package/presets/tsconfig.json

@@ -1,37 +1,37 @@
-// toiljs shared client tsconfig, opinionated, strict.
-// Extend it from your project: { "extends": "toiljs/tsconfig", "include": ["client", ".toil"] }
-{
-    "compilerOptions": {
-        "strict": true,
-        "noImplicitAny": true,
-        "strictNullChecks": true,
-        "strictFunctionTypes": true,
-        "strictBindCallApply": true,
-        "strictPropertyInitialization": true,
-        "noImplicitThis": true,
-        "useUnknownInCatchVariables": true,
-        "alwaysStrict": true,
-        "noUnusedLocals": true,
-        "noUnusedParameters": true,
-        "exactOptionalPropertyTypes": false,
-        "noImplicitReturns": false,
-        "noFallthroughCasesInSwitch": true,
-        "noUncheckedIndexedAccess": false,
-        "noImplicitOverride": true,
-        "noPropertyAccessFromIndexSignature": false,
-        "module": "ES2020",
-        "target": "ES2020",
-        "moduleResolution": "Bundler",
-        "jsx": "react-jsx",
-        "lib": ["ESNext", "DOM", "DOM.Iterable", "DOM.AsyncIterable"],
-        "isolatedModules": true,
-        "verbatimModuleSyntax": false,
-        "allowImportingTsExtensions": true,
-        "esModuleInterop": true,
-        "resolveJsonModule": true,
-        "forceConsistentCasingInFileNames": true,
-        "skipLibCheck": true,
-        "moduleDetection": "force",
-        "noEmit": true
-    }
-}
+// toiljs shared client tsconfig, opinionated, strict.
+// Extend it from your project: { "extends": "toiljs/tsconfig", "include": ["client", ".toil"] }
+{
+    "compilerOptions": {
+        "strict": true,
+        "noImplicitAny": true,
+        "strictNullChecks": true,
+        "strictFunctionTypes": true,
+        "strictBindCallApply": true,
+        "strictPropertyInitialization": true,
+        "noImplicitThis": true,
+        "useUnknownInCatchVariables": true,
+        "alwaysStrict": true,
+        "noUnusedLocals": true,
+        "noUnusedParameters": true,
+        "exactOptionalPropertyTypes": false,
+        "noImplicitReturns": false,
+        "noFallthroughCasesInSwitch": true,
+        "noUncheckedIndexedAccess": false,
+        "noImplicitOverride": true,
+        "noPropertyAccessFromIndexSignature": false,
+        "module": "ES2020",
+        "target": "ES2020",
+        "moduleResolution": "Bundler",
+        "jsx": "react-jsx",
+        "lib": ["ESNext", "DOM", "DOM.Iterable", "DOM.AsyncIterable"],
+        "isolatedModules": true,
+        "verbatimModuleSyntax": false,
+        "allowImportingTsExtensions": true,
+        "esModuleInterop": true,
+        "resolveJsonModule": true,
+        "forceConsistentCasingInFileNames": true,
+        "skipLibCheck": true,
+        "moduleDetection": "force",
+        "noEmit": true
+    }
+}

package/src/backend/index.ts

@@ -1,160 +1,160 @@
-/**
- * toiljs backend, the self-host / dev server, built on @btc-vision/hyper-express (uWebSockets.js)
- * for very high throughput. It serves the built client (static assets + SPA fallback) and exposes
- * a WebSocket channel for realtime / live updates.
- *
- * This is the Node "server" that hosts the app on a local machine; it is distinct from the
- * toilscript WASM target in `src/server`.
- */
-import fs from 'node:fs';
-import path from 'node:path';
-
-import {
-    Server,
-    type MiddlewareNext,
-    type Request,
-    type Response,
-    type Websocket,
-} from '@btc-vision/hyper-express';
-
-const DEFAULT_MAX_BODY_LENGTH = 1024 * 1024 * 8;
-const MAX_BODY_BUFFER = 1024 * 32;
-const HTTP_IDLE_TIMEOUT = 60;
-const HTTP_RESPONSE_TIMEOUT = 120;
-
-const WS_MAX_PAYLOAD_LENGTH = 1024 * 1024;
-const WS_IDLE_TIMEOUT = 120;
-const WS_MAX_BACKPRESSURE = 1024 * 1024 * 2;
-
-const CORS_METHODS = 'GET, POST, OPTIONS, PUT, PATCH, DELETE';
-const CORS_HEADERS = 'X-Requested-With, content-type';
-
-/** Options for {@link startBackend}. */
-export interface BackendOptions {
-    /** Directory to serve (the built client `outDir`, e.g. `dist`). */
-    readonly root: string;
-    /** Listening port. Default `3000`. */
-    readonly port?: number;
-    /** Bind host. Default `0.0.0.0`. */
-    readonly host?: string;
-    /** WebSocket channel path. Default `/_toil`. */
-    readonly wsPath?: string;
-    /** Send permissive CORS headers + handle preflight. Default `true`. */
-    readonly cors?: boolean;
-    /** Max request body length in bytes. Default 8 MB. */
-    readonly maxBodyLength?: number;
-}
-
-/** A running backend instance. */
-export interface RunningBackend {
-    readonly port: number;
-    readonly host: string;
-    readonly wsPath: string;
-    /** Sends a message to every connected WebSocket client. */
-    broadcast(message: string): void;
-    /** Number of currently-connected WebSocket clients. */
-    clientCount(): number;
-    /** Gracefully shuts the server down. */
-    close(): Promise<void>;
-}
-
-/** Resolves a request path to a file inside `root`, guarding against path traversal. */
-function resolveStaticFile(root: string, requestPath: string): string | null {
-    const decoded = decodeURIComponent(requestPath);
-    const resolved = path.join(root, decoded);
-    if (resolved !== root && !resolved.startsWith(root + path.sep)) return null;
-    if (decoded === '/' || decoded === '') return null;
-    if (fs.existsSync(resolved) && fs.statSync(resolved).isFile()) return resolved;
-    return null;
-}
-
-/**
- * Starts the hyper-express server serving `root` with an SPA fallback to `index.html`,
- * plus a WebSocket channel at `wsPath`. Resolves once the server is listening.
- */
-export async function startBackend(options: BackendOptions): Promise<RunningBackend> {
-    const port = options.port ?? 3000;
-    const host = options.host ?? '0.0.0.0';
-    const wsPath = options.wsPath ?? '/_toil';
-    const cors = options.cors ?? true;
-    const root = path.resolve(options.root);
-    const indexHtml = path.join(root, 'index.html');
-
-    const app = new Server({
-        max_body_length: options.maxBodyLength ?? DEFAULT_MAX_BODY_LENGTH,
-        max_body_buffer: MAX_BODY_BUFFER,
-        fast_abort: true,
-        idle_timeout: HTTP_IDLE_TIMEOUT,
-        response_timeout: HTTP_RESPONSE_TIMEOUT,
-    });
-
-    const clients = new Set<Websocket>();
-
-    app.set_error_handler((_request: Request, response: Response, _error: Error) => {
-        if (response.completed) return;
-        response.atomic(() => {
-            response.status(500).json({ error: 'Internal server error.' });
-        });
-    });
-
-    if (cors) {
-        app.use((request: Request, response: Response, next: MiddlewareNext) => {
-            if (request.method !== 'OPTIONS') {
-                response.setHeader('Access-Control-Allow-Origin', '*');
-                response.setHeader('Access-Control-Allow-Methods', CORS_METHODS);
-                response.setHeader('Access-Control-Allow-Headers', CORS_HEADERS);
-            }
-            response.removeHeader('uWebSockets');
-            next();
-        });
-        app.options('/*', (_request: Request, response: Response) => {
-            response.setHeader('Access-Control-Allow-Origin', '*');
-            response.setHeader('Access-Control-Allow-Methods', CORS_METHODS);
-            response.setHeader('Access-Control-Allow-Headers', CORS_HEADERS);
-            response.setHeader('Access-Control-Max-Age', '86400');
-            response.status(204).send();
-        });
-    }
-
-    app.ws(
-        wsPath,
-        {
-            message_type: 'String',
-            max_payload_length: WS_MAX_PAYLOAD_LENGTH,
-            idle_timeout: WS_IDLE_TIMEOUT,
-            max_backpressure: WS_MAX_BACKPRESSURE,
-        },
-        (ws) => {
-            clients.add(ws);
-            ws.send(JSON.stringify({ type: 'connected', clients: clients.size }));
-            ws.on('message', (message: string) => {
-                for (const client of clients) client.send(message);
-            });
-            ws.on('drain', () => {});
-            ws.on('close', () => {
-                clients.delete(ws);
-            });
-        },
-    );
-
-    app.get('/*', (request: Request, response: Response) => {
-        if (response.completed) return;
-        const file = resolveStaticFile(root, request.path);
-        response.sendFile(file ?? indexHtml);
-    });
-
-    await app.listen(port, host);
-
-    return {
-        port,
-        host,
-        wsPath,
-        broadcast: (message: string): void => {
-            for (const client of clients) client.send(message);
-        },
-        clientCount: (): number => clients.size,
-        close: async (): Promise<void> => {
-            await app.shutdown();
-        },
-    };
-}
+/**
+ * toiljs backend, the self-host / dev server, built on @btc-vision/hyper-express (uWebSockets.js)
+ * for very high throughput. It serves the built client (static assets + SPA fallback) and exposes
+ * a WebSocket channel for realtime / live updates.
+ *
+ * This is the Node "server" that hosts the app on a local machine; it is distinct from the
+ * toilscript WASM target in `src/server`.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+
+import {
+    Server,
+    type MiddlewareNext,
+    type Request,
+    type Response,
+    type Websocket,
+} from '@btc-vision/hyper-express';
+
+const DEFAULT_MAX_BODY_LENGTH = 1024 * 1024 * 8;
+const MAX_BODY_BUFFER = 1024 * 32;
+const HTTP_IDLE_TIMEOUT = 60;
+const HTTP_RESPONSE_TIMEOUT = 120;
+
+const WS_MAX_PAYLOAD_LENGTH = 1024 * 1024;
+const WS_IDLE_TIMEOUT = 120;
+const WS_MAX_BACKPRESSURE = 1024 * 1024 * 2;
+
+const CORS_METHODS = 'GET, POST, OPTIONS, PUT, PATCH, DELETE';
+const CORS_HEADERS = 'X-Requested-With, content-type';
+
+/** Options for {@link startBackend}. */
+export interface BackendOptions {
+    /** Directory to serve (the built client `outDir`, e.g. `dist`). */
+    readonly root: string;
+    /** Listening port. Default `3000`. */
+    readonly port?: number;
+    /** Bind host. Default `0.0.0.0`. */
+    readonly host?: string;
+    /** WebSocket channel path. Default `/_toil`. */
+    readonly wsPath?: string;
+    /** Send permissive CORS headers + handle preflight. Default `true`. */
+    readonly cors?: boolean;
+    /** Max request body length in bytes. Default 8 MB. */
+    readonly maxBodyLength?: number;
+}
+
+/** A running backend instance. */
+export interface RunningBackend {
+    readonly port: number;
+    readonly host: string;
+    readonly wsPath: string;
+    /** Sends a message to every connected WebSocket client. */
+    broadcast(message: string): void;
+    /** Number of currently-connected WebSocket clients. */
+    clientCount(): number;
+    /** Gracefully shuts the server down. */
+    close(): Promise<void>;
+}
+
+/** Resolves a request path to a file inside `root`, guarding against path traversal. */
+function resolveStaticFile(root: string, requestPath: string): string | null {
+    const decoded = decodeURIComponent(requestPath);
+    const resolved = path.join(root, decoded);
+    if (resolved !== root && !resolved.startsWith(root + path.sep)) return null;
+    if (decoded === '/' || decoded === '') return null;
+    if (fs.existsSync(resolved) && fs.statSync(resolved).isFile()) return resolved;
+    return null;
+}
+
+/**
+ * Starts the hyper-express server serving `root` with an SPA fallback to `index.html`,
+ * plus a WebSocket channel at `wsPath`. Resolves once the server is listening.
+ */
+export async function startBackend(options: BackendOptions): Promise<RunningBackend> {
+    const port = options.port ?? 3000;
+    const host = options.host ?? '0.0.0.0';
+    const wsPath = options.wsPath ?? '/_toil';
+    const cors = options.cors ?? true;
+    const root = path.resolve(options.root);
+    const indexHtml = path.join(root, 'index.html');
+
+    const app = new Server({
+        max_body_length: options.maxBodyLength ?? DEFAULT_MAX_BODY_LENGTH,
+        max_body_buffer: MAX_BODY_BUFFER,
+        fast_abort: true,
+        idle_timeout: HTTP_IDLE_TIMEOUT,
+        response_timeout: HTTP_RESPONSE_TIMEOUT,
+    });
+
+    const clients = new Set<Websocket>();
+
+    app.set_error_handler((_request: Request, response: Response, _error: Error) => {
+        if (response.completed) return;
+        response.atomic(() => {
+            response.status(500).json({ error: 'Internal server error.' });
+        });
+    });
+
+    if (cors) {
+        app.use((request: Request, response: Response, next: MiddlewareNext) => {
+            if (request.method !== 'OPTIONS') {
+                response.setHeader('Access-Control-Allow-Origin', '*');
+                response.setHeader('Access-Control-Allow-Methods', CORS_METHODS);
+                response.setHeader('Access-Control-Allow-Headers', CORS_HEADERS);
+            }
+            response.removeHeader('uWebSockets');
+            next();
+        });
+        app.options('/*', (_request: Request, response: Response) => {
+            response.setHeader('Access-Control-Allow-Origin', '*');
+            response.setHeader('Access-Control-Allow-Methods', CORS_METHODS);
+            response.setHeader('Access-Control-Allow-Headers', CORS_HEADERS);
+            response.setHeader('Access-Control-Max-Age', '86400');
+            response.status(204).send();
+        });
+    }
+
+    app.ws(
+        wsPath,
+        {
+            message_type: 'String',
+            max_payload_length: WS_MAX_PAYLOAD_LENGTH,
+            idle_timeout: WS_IDLE_TIMEOUT,
+            max_backpressure: WS_MAX_BACKPRESSURE,
+        },
+        (ws) => {
+            clients.add(ws);
+            ws.send(JSON.stringify({ type: 'connected', clients: clients.size }));
+            ws.on('message', (message: string) => {
+                for (const client of clients) client.send(message);
+            });
+            ws.on('drain', () => {});
+            ws.on('close', () => {
+                clients.delete(ws);
+            });
+        },
+    );
+
+    app.get('/*', (request: Request, response: Response) => {
+        if (response.completed) return;
+        const file = resolveStaticFile(root, request.path);
+        response.sendFile(file ?? indexHtml);
+    });
+
+    await app.listen(port, host);
+
+    return {
+        port,
+        host,
+        wsPath,
+        broadcast: (message: string): void => {
+            for (const client of clients) client.send(message);
+        },
+        clientCount: (): number => clients.size,
+        close: async (): Promise<void> => {
+            await app.shutdown();
+        },
+    };
+}

package/src/cli/proc.ts

@@ -1,50 +1,50 @@
-import { spawn } from 'node:child_process';
-
-/**
- * Spawns `cmd args` in `cwd`, resolving on a 0 exit code and rejecting otherwise. On Windows the
- * `npm`/`pnpm`/`yarn` shims are `.cmd` files that need a shell; passing an args array with
- * `shell: true` is deprecated (DEP0190), so the whole command is passed as one string there
- * (args are fixed/allowlisted, never raw user input). POSIX spawns directly.
- */
-export function run(cmd: string, args: string[], cwd: string): Promise<void> {
-    return new Promise((resolve, reject) => {
-        const onWindows = process.platform === 'win32';
-        const child = onWindows
-            ? spawn([cmd, ...args].join(' '), { cwd, stdio: 'ignore', shell: true })
-            : spawn(cmd, args, { cwd, stdio: 'ignore' });
-        child.on('error', reject);
-        child.on('close', (code) =>
-            code === 0 ? resolve() : reject(new Error(`${cmd} exited with code ${String(code)}`)),
-        );
-    });
-}
-
-/**
- * Like {@link run}, but captures stdout/stderr and resolves with them plus the exit code (it never
- * rejects on a non-zero exit, the caller decides). Used to read JSON from tools like
- * `npm-check-updates`. Same Windows shell handling as {@link run}; args are fixed/allowlisted.
- */
-export function capture(
-    cmd: string,
-    args: string[],
-    cwd: string,
-): Promise<{ stdout: string; stderr: string; code: number }> {
-    return new Promise((resolve, reject) => {
-        const onWindows = process.platform === 'win32';
-        const child = onWindows
-            ? spawn([cmd, ...args].join(' '), { cwd, shell: true })
-            : spawn(cmd, args, { cwd });
-        let stdout = '';
-        let stderr = '';
-        child.stdout?.on('data', (d: Buffer) => {
-            stdout += d.toString();
-        });
-        child.stderr?.on('data', (d: Buffer) => {
-            stderr += d.toString();
-        });
-        child.on('error', reject);
-        child.on('close', (code) => {
-            resolve({ stdout, stderr, code: code ?? 1 });
-        });
-    });
-}
+import { spawn } from 'node:child_process';
+
+/**
+ * Spawns `cmd args` in `cwd`, resolving on a 0 exit code and rejecting otherwise. On Windows the
+ * `npm`/`pnpm`/`yarn` shims are `.cmd` files that need a shell; passing an args array with
+ * `shell: true` is deprecated (DEP0190), so the whole command is passed as one string there
+ * (args are fixed/allowlisted, never raw user input). POSIX spawns directly.
+ */
+export function run(cmd: string, args: string[], cwd: string): Promise<void> {
+    return new Promise((resolve, reject) => {
+        const onWindows = process.platform === 'win32';
+        const child = onWindows
+            ? spawn([cmd, ...args].join(' '), { cwd, stdio: 'ignore', shell: true })
+            : spawn(cmd, args, { cwd, stdio: 'ignore' });
+        child.on('error', reject);
+        child.on('close', (code) =>
+            code === 0 ? resolve() : reject(new Error(`${cmd} exited with code ${String(code)}`)),
+        );
+    });
+}
+
+/**
+ * Like {@link run}, but captures stdout/stderr and resolves with them plus the exit code (it never
+ * rejects on a non-zero exit, the caller decides). Used to read JSON from tools like
+ * `npm-check-updates`. Same Windows shell handling as {@link run}; args are fixed/allowlisted.
+ */
+export function capture(
+    cmd: string,
+    args: string[],
+    cwd: string,
+): Promise<{ stdout: string; stderr: string; code: number }> {
+    return new Promise((resolve, reject) => {
+        const onWindows = process.platform === 'win32';
+        const child = onWindows
+            ? spawn([cmd, ...args].join(' '), { cwd, shell: true })
+            : spawn(cmd, args, { cwd });
+        let stdout = '';
+        let stderr = '';
+        child.stdout?.on('data', (d: Buffer) => {
+            stdout += d.toString();
+        });
+        child.stderr?.on('data', (d: Buffer) => {
+            stderr += d.toString();
+        });
+        child.on('error', reject);
+        child.on('close', (code) => {
+            resolve({ stdout, stderr, code: code ?? 1 });
+        });
+    });
+}

package/src/cli/updates.ts

@@ -1,69 +1,69 @@
-/**
- * Pure helpers for `toiljs update`: parse `npm-check-updates --jsonUpgraded` output and classify the
- * semver bump of each upgrade. IO-free so it can be unit-tested; the spawn/UI live in `update.ts`.
- */
-
-/** The kind of version jump an upgrade represents. */
-export type Bump = 'major' | 'minor' | 'patch' | 'other';
-
-/** One available upgrade: package, current range, target range, and bump kind. */
-export interface UpdateRow {
-    readonly name: string;
-    readonly from: string;
-    readonly to: string;
-    readonly bump: Bump;
-}
-
-/** Extracts a version's leading `x.y.z` (ignoring `^`, `~`, `>=`, etc.); missing parts become 0. */
-function parseVersion(v: string): [number, number, number] {
-    const m = /(\d+)(?:\.(\d+))?(?:\.(\d+))?/.exec(v);
-    if (!m) return [0, 0, 0];
-    return [Number(m[1]), Number(m[2] ?? 0), Number(m[3] ?? 0)];
-}
-
-/** Classifies the bump from `from` to `to` (both may be ranges like `^1.2.3`). */
-export function classifyBump(from: string, to: string): Bump {
-    const [fa, fb, fc] = parseVersion(from);
-    const [ta, tb, tc] = parseVersion(to);
-    if (ta !== fa) return 'major';
-    if (tb !== fb) return 'minor';
-    if (tc !== fc) return 'patch';
-    return 'other';
-}
-
-/**
- * Parses the JSON object `npm-check-updates --jsonUpgraded` prints (a `{ name: range }` map). Tolerant
- * of leading/trailing noise (npx banners) by slicing to the outermost braces. Returns `{}` on failure.
- */
-export function parseNcuJson(stdout: string): Record<string, string> {
-    const start = stdout.indexOf('{');
-    const end = stdout.lastIndexOf('}');
-    if (start === -1 || end <= start) return {};
-    try {
-        const parsed: unknown = JSON.parse(stdout.slice(start, end + 1));
-        if (typeof parsed !== 'object' || parsed === null) return {};
-        const out: Record<string, string> = {};
-        for (const [k, v] of Object.entries(parsed)) if (typeof v === 'string') out[k] = v;
-        return out;
-    } catch {
-        return {};
-    }
-}
-
-const SEVERITY: Record<Bump, number> = { major: 0, minor: 1, patch: 2, other: 3 };
-
-/**
- * Builds the upgrade rows from the ncu map and the project's current dependency ranges, sorted by
- * bump severity (major first) then name.
- */
-export function buildRows(
-    upgraded: Record<string, string>,
-    currentDeps: Record<string, string>,
-): UpdateRow[] {
-    return Object.entries(upgraded)
-        .map(([name, to]) => {
-            const from = currentDeps[name] ?? '?';
-            return { name, from, to, bump: classifyBump(from, to) };
-        })
-        .sort((a, b) => SEVERITY[a.bump] - SEVERITY[b.bump] || a.name.localeCompare(b.name));
-}
+/**
+ * Pure helpers for `toiljs update`: parse `npm-check-updates --jsonUpgraded` output and classify the
+ * semver bump of each upgrade. IO-free so it can be unit-tested; the spawn/UI live in `update.ts`.
+ */
+
+/** The kind of version jump an upgrade represents. */
+export type Bump = 'major' | 'minor' | 'patch' | 'other';
+
+/** One available upgrade: package, current range, target range, and bump kind. */
+export interface UpdateRow {
+    readonly name: string;
+    readonly from: string;
+    readonly to: string;
+    readonly bump: Bump;
+}
+
+/** Extracts a version's leading `x.y.z` (ignoring `^`, `~`, `>=`, etc.); missing parts become 0. */
+function parseVersion(v: string): [number, number, number] {
+    const m = /(\d+)(?:\.(\d+))?(?:\.(\d+))?/.exec(v);
+    if (!m) return [0, 0, 0];
+    return [Number(m[1]), Number(m[2] ?? 0), Number(m[3] ?? 0)];
+}
+
+/** Classifies the bump from `from` to `to` (both may be ranges like `^1.2.3`). */
+export function classifyBump(from: string, to: string): Bump {
+    const [fa, fb, fc] = parseVersion(from);
+    const [ta, tb, tc] = parseVersion(to);
+    if (ta !== fa) return 'major';
+    if (tb !== fb) return 'minor';
+    if (tc !== fc) return 'patch';
+    return 'other';
+}
+
+/**
+ * Parses the JSON object `npm-check-updates --jsonUpgraded` prints (a `{ name: range }` map). Tolerant
+ * of leading/trailing noise (npx banners) by slicing to the outermost braces. Returns `{}` on failure.
+ */
+export function parseNcuJson(stdout: string): Record<string, string> {
+    const start = stdout.indexOf('{');
+    const end = stdout.lastIndexOf('}');
+    if (start === -1 || end <= start) return {};
+    try {
+        const parsed: unknown = JSON.parse(stdout.slice(start, end + 1));
+        if (typeof parsed !== 'object' || parsed === null) return {};
+        const out: Record<string, string> = {};
+        for (const [k, v] of Object.entries(parsed)) if (typeof v === 'string') out[k] = v;
+        return out;
+    } catch {
+        return {};
+    }
+}
+
+const SEVERITY: Record<Bump, number> = { major: 0, minor: 1, patch: 2, other: 3 };
+
+/**
+ * Builds the upgrade rows from the ncu map and the project's current dependency ranges, sorted by
+ * bump severity (major first) then name.
+ */
+export function buildRows(
+    upgraded: Record<string, string>,
+    currentDeps: Record<string, string>,
+): UpdateRow[] {
+    return Object.entries(upgraded)
+        .map(([name, to]) => {
+            const from = currentDeps[name] ?? '?';
+            return { name, from, to, bump: classifyBump(from, to) };
+        })
+        .sort((a, b) => SEVERITY[a.bump] - SEVERITY[b.bump] || a.name.localeCompare(b.name));
+}