assets-graph

Client-side analyzer for NuGet obj/project.assets.json files: dependency list, duplicates, dependency trees (dotnet nuget why style), origin classification, and an internal build order grouped into parallel waves.

Everything runs in the browser. The site is a static Next.js export with no server functions, no API routes, no database, and no analytics. File contents never leave the tab. The only network requests are optional nuget.org lookups, which send package Ids (not file contents) and run only when you click Look up N packages on nuget.org. The Content-Security-Policy in vercel.json enforces this: connect-src 'self' https://api.nuget.org.

Quick start

npm ci
npm run dev        # http://localhost:3000
npm test           # Vitest unit tests (lib/ and client/nugetLookup)
npm run typecheck
npm run build      # static export to out/

Node 20.9 or later.

Using it

Tab	What it does
Inputs	Paste (one body per box, + Add another), upload .json files, or scan a folder. Folder scans keep only **/obj/project.assets.json and skip node_modules, bin, .vs, .git; the match count is shown before anything is analyzed. Optional .nupkg.metadata sources go here too.
Collect scripts	Copyable PowerShell scripts (Copy and Download on every snippet) that gather the inputs from the usual places — obj\project.assets.json under your source folders, deps.json/runtimeconfig.json plus an assembly manifest from build outputs and from deployed apps (IIS, Windows services, install folders), and the NuGet source map — into C:\dev\results\AssetsGraphInputs_yyyyMMdd_HHmm\. Read-only on the searched folders, -WhatIf supported, CSV copy log.
Classification	Offline toggle, nuget.org lookups, system/internal prefixes, internal feeds, manual overrides.
Dependencies	Sortable, filterable list: Id, resolved version(s), type, direct/transitive, origin, reason, projects. Override any origin per Id.
Duplicates	Across target frameworks, across projects (drift), range conflicts, redundant direct references, case-only Id collisions.
Tree	Per project and target. Id (requested range → resolved), (*) jumps to the first expansion, cycles are flagged, and the search box highlights every path to an Id.
Build order	Internal nodes only, public chains collapsed, Kahn waves, cycle paths when no order exists, and a DAG colored by wave.
Version skew	Stale internal builds: per-package skew (requested vs resolved build, spread, oldest requester, severity), consumer ranking with the outlier, a wave-ordered rebuild plan (with cascade), and floating/unpinned direct references with lock-file and Central Package Management status. Settings (build-number regex, thresholds, rebuild minimum, cascade, public packages) are saved in the browser.
Binding check	Enabled once <App>.deps.json and an assembly manifest are loaded (Inputs → Runtime binding inputs). Paste a FileNotFoundException / FileLoadException to find every requester of that exact assembly version, what is deployed instead, and the NuGet packages on both sides. Also lists every reference by classification, assemblies with multiple copies, and package version ↔ AssemblyVersion correlation.
Export	Markdown, JSON, and CSV (-Dependencies, -BuildOrder, -VersionSkew) named AssetsGraph_<ProjectNameOrMerged>_yyyyMMdd_HHmm.<ext>.

The Scope selector switches every results tab between the merged graph and a single file.

On Edge and Chrome, Choose folder… uses showDirectoryPicker() and never enters ignored folders. Other browsers fall back to <input webkitdirectory>, which lists every file under the folder before the app can filter them and may show an "upload" confirmation. Nothing is uploaded in either case.

Origin classification

First match wins:

1. Manual override (saved in localStorage).
2. Source metadata for the exact Id + version:
   • https://api.nuget.org/v3/index.json → Public, or System if a system prefix also matches.
   • A configured internal feed → Private.
   • Local paths and unconfigured feeds → noted, then fall through.
3. type: project → Project.
4. System prefix (System., Microsoft., runtime., NETStandard., Microsoft.NETCore. by default) → System.
5. Internal prefix → Private.
6. nuget.org flat container (8 concurrent requests, 7-day localStorage cache):
   • Version listed → Public.
   • 404, or the Id exists but that version is not listed → Private (inferred).
   • Offline mode, or a failed lookup → Unclassified.

If every public-looking package with metadata reports the same non-nuget.org feed, the app shows a warning: the feed proxies nuget.org, so metadata cannot separate internal from public packages. Metadata from that feed is then ignored, unless you tick Trust this feed's metadata anyway.

Source metadata map

scripts/Export-NuGetSourceMap.ps1 writes results\NuGetSourceMap_yyyyMMdd_HHmm.json from your global packages folder. Load it under Inputs → Package source metadata → c. Bundled map.

.\scripts\Export-NuGetSourceMap.ps1
.\scripts\Export-NuGetSourceMap.ps1 -PackagesPath "$env:USERPROFILE\.nuget\packages" -OutputFolder ".\results" -IdFilter "*"

Deploying to Vercel

The repository root is the app, so no Root Directory setting is needed. Vercel detects Next.js and serves the static export; vercel.json adds the CSP and other security headers.

npm i -g vercel
vercel login
vercel link            # first time: create or select the project, e.g. "assets-graph"
vercel                 # preview deployment
vercel --prod          # production deployment

Leave Vercel Web Analytics and Speed Insights off for this project. They load from the same origin, so the CSP would not stop them.

以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗