Problem
The graph path routine depends on the single-function lodash.sample package solely to choose one child from a non-empty array.
Evidence
package.json:45 declares lodash.sample as ^4.2.1, and the lockfile resolves lodash.sample@4.2.1. Its only application import is sample in server/src/lib/graph/pathRandom.ts:5, with exactly one invocation at line 26 across one source file. The preceding guard proves person.children.length > 0, so an owned helper can retain the non-null result contract with items[Math.floor(Math.random() * items.length)]. npm ls --package-lock-only --all lodash.sample shows no kept package retains it transitively. npm registry metadata reports 4.2.1 as the latest release, published 2016-08-13, which further supports owning this narrowly used behavior.
Impact
This removes an old single-purpose package and its lockfile entry while retaining the existing random-path behavior.
Implementation plan
Add a typed internal helper with the signature randomElement<T>(items: readonly T[]): T | undefined, using Math.floor(Math.random() * items.length) and returning undefined for empty input. Replace the one Lodash call in pathRandom, retain the existing non-empty guard, remove lodash.sample from root dependencies, and regenerate the lockfile with npm install --package-lock-only --ignore-scripts.
Acceptance criteria
No source imports lodash.sample; the helper returns an element for non-empty arrays and undefined for empty arrays; pathRandom still returns a valid source-to-target path for the existing deterministic/random test cases; the package is absent from both manifest and lockfile.
Verification
Add or update focused helper/path tests, run npm install --package-lock-only --ignore-scripts, npm ls lodash.sample, npm run test:unit -- tests/unit/lib/pathRandom.spec.ts, and npm run build.
Dependencies and related work
Independent of #120 and #149–#155. Do not combine this with the fs-js-lite security/update work: fs-js-lite is a FamilySearch client with broader API behavior and is not a <50-line owned replacement.
Scope
Replacement complexity: Trivial. Likely files: server/src/lib/graph/pathRandom.ts, a nearby graph utility and focused test, package.json, package-lock.json. Non-goals: changing the randomness source, making the selector cryptographic, or refactoring other Lodash-compatible behavior.
Problem
The graph path routine depends on the single-function
lodash.samplepackage solely to choose one child from a non-empty array.Evidence
package.json:45declareslodash.sampleas^4.2.1, and the lockfile resolveslodash.sample@4.2.1. Its only application import issampleinserver/src/lib/graph/pathRandom.ts:5, with exactly one invocation at line 26 across one source file. The preceding guard provesperson.children.length > 0, so an owned helper can retain the non-null result contract withitems[Math.floor(Math.random() * items.length)].npm ls --package-lock-only --all lodash.sampleshows no kept package retains it transitively. npm registry metadata reports 4.2.1 as the latest release, published 2016-08-13, which further supports owning this narrowly used behavior.Impact
This removes an old single-purpose package and its lockfile entry while retaining the existing random-path behavior.
Implementation plan
Add a typed internal helper with the signature
randomElement<T>(items: readonly T[]): T | undefined, usingMath.floor(Math.random() * items.length)and returningundefinedfor empty input. Replace the one Lodash call inpathRandom, retain the existing non-empty guard, removelodash.samplefrom root dependencies, and regenerate the lockfile withnpm install --package-lock-only --ignore-scripts.Acceptance criteria
No source imports
lodash.sample; the helper returns an element for non-empty arrays andundefinedfor empty arrays;pathRandomstill returns a valid source-to-target path for the existing deterministic/random test cases; the package is absent from both manifest and lockfile.Verification
Add or update focused helper/path tests, run
npm install --package-lock-only --ignore-scripts,npm ls lodash.sample,npm run test:unit -- tests/unit/lib/pathRandom.spec.ts, andnpm run build.Dependencies and related work
Independent of #120 and #149–#155. Do not combine this with the fs-js-lite security/update work: fs-js-lite is a FamilySearch client with broader API behavior and is not a <50-line owned replacement.
Scope
Replacement complexity: Trivial. Likely files:
server/src/lib/graph/pathRandom.ts, a nearby graph utility and focused test,package.json,package-lock.json. Non-goals: changing the randomness source, making the selector cryptographic, or refactoring other Lodash-compatible behavior.