🔥 blastradius

Change Impact Predictor — quantifies the risk of deploying code changes using static call graph analysis and PageRank-style risk propagation.

The Problem

Before deploying a code change, you need to know: what could break?

A one-line change to a utility function might affect 47 transitive callers across 12 API endpoints handling 2M daily requests. Or it might affect nothing. blastradius tells you which.

How It Works

1. Static Call Graph — Parses JS/TS/Python source to build a function-level call graph
2. Runtime Traces (optional) — Ingests OpenTelemetry trace JSON for real call frequencies
3. Transitive Impact — BFS from changed functions through the reverse call graph
4. PageRank Risk Propagation — Changed functions start with base risk, propagated to callers weighted by edge frequency
5. Risk Scoring — 0-100 scale: traffic volume × depth of impact × affected entry points
6. Entry Point Classification — Detects API endpoints, event handlers, cron jobs, CLI commands

Install

npm install -g @phoenixaihub/blastradius

CLI Usage

# Analyze specific changed files
blastradius analyze ./src --changed src/payments.ts src/auth.ts

# Analyze from git diff
git diff HEAD~1 | blastradius analyze ./src --diff -

# With OpenTelemetry runtime traces
blastradius analyze ./src --changed src/api.ts --trace traces.json

# JSON output
blastradius analyze ./src --changed src/payments.ts --json

Programmatic API

import { analyze } from '@phoenixaihub/blastradius';

const result = analyze('./src', {
  changedFiles: ['src/payments.ts'],
  tracePath: './traces.json', // optional
});

console.log(result);
// {
//   changed_functions: 4,
//   risk_score: 87,
//   risk_level: "high",
//   impacts: [{ function: "processPayment", risk: 92, ... }],
//   safe_changes: ["src/utils.ts:formatDate — no callers affected"]
// }

Output Format

{
  "changed_functions": 4,
  "risk_score": 87,
  "risk_level": "high",
  "impacts": [
    {
      "function": "processPayment",
      "file": "src/payments.ts",
      "direct_callers": 3,
      "transitive_callers": 47,
      "affected_endpoints": ["/api/checkout", "/api/subscription"],
      "estimated_daily_calls": 2100000,
      "risk": 92,
      "recommendation": "staging + canary deployment recommended"
    }
  ],
  "safe_changes": ["src/utils/format.ts:formatDate — no callers affected"]
}

Risk Levels

| Score | Level | Action | |-------|-------|--------| | 0-29 | Low | Standard deployment | | 30-59 | Medium | Standard testing, monitor after deploy | | 60-79 | High | Thorough testing + staged rollout | | 80-100 | Critical | Staging + canary deployment |

Algorithm Details

PageRank-Style Risk Propagation

Each changed function starts with a base risk of 1.0. Risk propagates through the call graph:

risk(node) = base_risk + damping × Σ(callee_risk × edge_frequency / total_frequency)

After convergence (10 iterations, damping factor 0.85), high-traffic paths through changed code accumulate the highest risk scores.

Risk Score Components

• Depth score (30%): min(transitive_callers / 50, 1)
• Endpoint score (25%): min(affected_endpoints / 5, 1)
• Traffic score (25%): min(daily_calls / 1M, 1)
• PageRank score (20%): Normalized propagated risk

OpenTelemetry Integration

Export traces as JSON and feed them in for frequency-weighted analysis:

# Export traces from your collector
otel-cli export --format json > traces.json

# Analyze with real traffic data
blastradius analyze ./src --changed src/api.ts --trace traces.json

Supported trace format: OpenTelemetry JSON with resourceSpans or flat spans array.

Supported Languages

• JavaScript (.js, .mjs, .cjs)
• TypeScript (.ts, .tsx)
• Python (.py)

License

MIT