@crbroughton/recul 0.1.0

package/dist/src/config.js

@@ -0,0 +1,67 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { parseJSONC } from 'confbox';
+const VALID_RANGE = new Set(['exact', 'caret', 'tilde']);
+function isRangeSpecifier(value) {
+    return VALID_RANGE.has(value);
+}
+const CONFIG_FILE = 'recul.config.jsonc';
+/**
+ * Load the config file from `dir`.
+ * Returns the parsed config, or null if no config file was found.
+ */
+export function loadConfigFile(dir) {
+    const path = resolve(dir, CONFIG_FILE);
+    if (existsSync(path)) {
+        try {
+            const src = readFileSync(path, 'utf8');
+            const raw = parseJSONC(src);
+            if (raw === null || typeof raw !== 'object')
+                return null;
+            return raw;
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`error: could not parse ${path}: ${message}`);
+            return null;
+        }
+    }
+    return null;
+}
+/** Resolve the directory to search for the config file, based on --file if provided. */
+export function resolveConfigDir({ file, cwd }) {
+    return file !== undefined ? resolve(cwd, dirname(file)) : cwd;
+}
+export const DEFAULTS = {
+    lag: 2,
+    file: 'package.json',
+    pm: 'npm',
+    ignore: [],
+    behindBehavior: 'ignore',
+    rangeSpecifier: 'exact',
+    preReleaseFilter: ['-alpha', '-beta', '-rc', '-next', '-canary'],
+};
+/**
+ * Resolve the effective RangeSpecifier for a specific package.
+ * When config is a string it applies to all packages.
+ * When config is a record, looks up by name, then "default", then falls back to "exact".
+ */
+export function resolveRangeSpecifier({ config, name }) {
+    if (typeof config === 'string')
+        return config;
+    const specific = config[name];
+    if (specific !== undefined && isRangeSpecifier(specific))
+        return specific;
+    const fallback = config.default;
+    if (fallback !== undefined && isRangeSpecifier(fallback))
+        return fallback;
+    return 'exact';
+}
+export function rangePrefix(specifier) {
+    switch (specifier) {
+        case 'caret': return '^';
+        case 'tilde': return '~';
+        case 'exact': return '';
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/src/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEpC,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;AAE7E,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,WAAW,GAAG,oBAAoB,CAAA;AAExC;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IACtC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YACtC,MAAM,GAAG,GAAG,UAAU,CAAoB,GAAG,CAAC,CAAA;YAC9C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;gBACzC,OAAO,IAAI,CAAA;YACb,OAAO,GAAG,CAAA;QACZ,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAChE,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,KAAK,OAAO,EAAE,CAAC,CAAA;YAC3D,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAkC;IAC5E,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AAC/D,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAW;IAC9B,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,cAAc;IACpB,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,EAAE;IACV,cAAc,EAAE,QAAQ;IACxB,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC;CACjE,CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAkD;IACpG,IAAI,OAAO,MAAM,KAAK,QAAQ;QAC5B,OAAO,MAAM,CAAA;IACf,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,QAAQ,KAAK,SAAS,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QACtD,OAAO,QAAQ,CAAA;IACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAA;IAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QACtD,OAAO,QAAQ,CAAA;IACjB,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAyB;IACnD,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,OAAO,CAAC,CAAC,OAAO,GAAG,CAAA;QACxB,KAAK,OAAO,CAAC,CAAC,OAAO,GAAG,CAAA;QACxB,KAAK,OAAO,CAAC,CAAC,OAAO,EAAE,CAAA;IACzB,CAAC;AACH,CAAC"}

package/dist/src/index.d.ts

@@ -0,0 +1,6 @@
+export { auditDeps } from './audit.js';
+export { DEFAULTS, loadConfigFile, rangePrefix, resolveConfigDir, resolveRangeSpecifier } from './config.js';
+export { printResults } from './output.js';
+export { computeTarget, fetchStableVersions, resolvePackage } from './resolve.js';
+export type { AuditResult, AuditStatus, BehindBehavior, Config, ConfigFile, InstalledVersionMap, PackageJson, PackageManager, RangeSpecifier, RangeSpecifierConfig, ResolvedPackage, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAC5G,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AACjF,YAAY,EACV,WAAW,EACX,WAAW,EACX,cAAc,EACd,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,eAAe,GAChB,MAAM,YAAY,CAAA"}

package/dist/src/index.js

@@ -0,0 +1,5 @@
+export { auditDeps } from './audit.js';
+export { DEFAULTS, loadConfigFile, rangePrefix, resolveConfigDir, resolveRangeSpecifier } from './config.js';
+export { printResults } from './output.js';
+export { computeTarget, fetchStableVersions, resolvePackage } from './resolve.js';
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAC5G,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA"}

package/dist/src/init.d.ts

@@ -0,0 +1,2 @@
+export declare function runInit(cwd: string): void;
+//# sourceMappingURL=init.d.ts.map

package/dist/src/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/init.ts"],"names":[],"mappings":"AA2EA,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,QA2ClC"}

package/dist/src/init.js

@@ -0,0 +1,113 @@
+import { existsSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+const CONFIG_FILENAME = 'recul.config.jsonc';
+const TEMPLATE = `{
+  // How many versions to stay behind the latest published release.
+  // Counted in releases, not semver increments; a major bump counts as one.
+  //
+  //   1  →  days to weeks   (fast-moving projects, minimal buffer)
+  //   2  →  weeks           (balanced default, recommended)
+  //   3  →  weeks to months (cautious teams, slower release cadences)
+  //   5+ →  months          (regulated environments, high-security contexts)
+  "lag": 2,
+
+  // Package manager used in this project.
+  // Controls the phrasing of generated install commands and lockfile detection.
+  //   "npm" | "pnpm"
+  "packageManager": "npm",
+
+  // Path to the package.json file to audit, relative to this config file.
+  "packageFile": "package.json",
+
+  // How to handle packages that are already older than the lag target
+  // (e.g. you pinned something much older than the window).
+  //
+  //   "ignore"  →  treat as ok, no output (default)
+  //   "report"  →  surface them with a safe upgrade-to-target command
+  "behindBehavior": "ignore",
+
+  // Version prefix used in generated install commands.
+  // Also controls two things simultaneously:
+  //
+  //   1. Mismatch detection; flags packages declared with a different prefix
+  //      than configured (e.g. "^1.2.3" declared but "exact" configured).
+  //
+  //   2. Lag comparison depth; how strictly the installed version must match
+  //      the lag target before a pin-back is triggered:
+  //        exact  →  all three parts compared  (1.2.3 must equal 1.2.3)
+  //        tilde  →  major + minor compared    (1.2.x is ok if target is 1.2.0)
+  //        caret  →  major only compared       (1.x.x is ok if target is 1.0.0)
+  //
+  //   Setting "react": "tilde" relaxes both checks for that package; patch
+  //   differences will not trigger a pin-back and will not be flagged as mismatches.
+  //
+  // Can be a single value applied to all packages:
+  //   "exact"  →  1.3.4    (recommended; audits are reliable)
+  //   "caret"  →  ^1.3.4   (allows minor/patch drift; audit may be imprecise)
+  //   "tilde"  →  ~1.3.4   (allows patch drift only; audit may be imprecise)
+  //
+  // Or a per-package map (use "default" as the fallback):
+  //   { "default": "exact", "react": "tilde", "some-pkg": "caret" }
+  "rangeSpecifier": "exact",
+
+  // Packages to skip entirely during the audit.
+  // Useful for tools where you intentionally stay on an older version
+  // for reasons unrelated to the lag policy (e.g. peer dep constraints).
+  "ignore": [],
+
+  // Minimum number of days a version must have been published before it
+  // is considered eligible as a lag target. Versions newer than this
+  // threshold are excluded from the candidate list entirely.
+  //
+  // Combine with "lag" for defence-in-depth:
+  //   lag: 2 + minimumReleaseAge: 3  →  at least 2 versions old AND published 3+ days ago
+  //
+  // Omit or set to 0 to disable (default).
+  "minimumReleaseAge": 3,
+
+  // Version strings containing any of these substrings are excluded from
+  // the candidate list and treated as pre-releases.
+  "preReleaseFilter": ["-alpha", "-beta", "-rc", "-next", "-canary"]
+}
+`;
+export function runInit(cwd) {
+    const dest = resolve(cwd, CONFIG_FILENAME);
+    if (existsSync(dest)) {
+        console.log(`\nrecul init\n`);
+        console.log(`config file already exists: ${dest}`);
+        console.log(`delete it first if you want to regenerate.\n`);
+        process.exit(1);
+    }
+    writeFileSync(dest, TEMPLATE, 'utf8');
+    console.log(`\nrecul init\n`);
+    console.log(`created: ${dest}\n`);
+    console.log(`configuration options:\n`);
+    console.log(`  lag              How many versions behind latest to stay.`);
+    console.log(`                   Default 2 (weeks of vetting window).`);
+    console.log(``);
+    console.log(`  packageManager   Controls generated install command phrasing.`);
+    console.log(`                   npm | pnpm`);
+    console.log(``);
+    console.log(`  packageFile      Path to the package.json to audit.`);
+    console.log(`                   Relative to this config file.`);
+    console.log(``);
+    console.log(`  behindBehavior   What to do with packages older than the lag target.`);
+    console.log(`                   ignore (default); silent. report; show upgrade command.`);
+    console.log(``);
+    console.log(`  rangeSpecifier   Controls mismatch detection and lag comparison depth.`);
+    console.log(`                   exact (recommended); pin-back if any part differs`);
+    console.log(`                   tilde              ; pin-back only if major or minor differs`);
+    console.log(`                   caret              ; pin-back only if major differs`);
+    console.log(`                   Per-package map: { "default": "exact", "react": "tilde" }`);
+    console.log(``);
+    console.log(`  ignore           Array of package names to skip entirely.`);
+    console.log(``);
+    console.log(`  minimumReleaseAge  Minimum days a version must be published before it is eligible.`);
+    console.log(`                     Omit or set to 0 to disable.`);
+    console.log(``);
+    console.log(`  preReleaseFilter   Substrings that mark a version as a pre-release.`);
+    console.log(`                     Any version containing one of these strings is excluded.`);
+    console.log(``);
+    console.log(`CLI flags always override config file values.\n`);
+}
+//# sourceMappingURL=init.js.map

package/dist/src/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,MAAM,eAAe,GAAG,oBAAoB,CAAA;AAE5C,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoEhB,CAAA;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;IAE1C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;QAC7B,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAA;QAClD,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAA;QAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAErC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAC7B,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,CAAA;IACjC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAA;IACvC,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAA;IAC1E,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAA;IACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACf,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAA;IAC9E,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAA;IAE5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACf,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAA;IACpE,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAA;IAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACf,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAA;IACrF,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAA;IACzF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACf,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAA;IACvF,OAAO,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAA;IACnF,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAA;IAC9F,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAA;IACrF,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAA;IAC3F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACf,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAA;IAC1E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACf,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAA;IACnG,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAA;IAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACf,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAA;IACpF,OAAO,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAA;IAC5F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACf,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAA;AAChE,CAAC"}

package/dist/src/lockfile.d.ts

@@ -0,0 +1,24 @@
+import type { InstalledVersionMap, PackageManager } from './types.js';
+export { npmAdapter, parseNpmLock } from './adapters/npm.js';
+export { loadPnpmCatalog, parsePnpmLock, pnpmAdapter, resolveCatalogRefs, updatePnpmCatalog } from './adapters/pnpm.js';
+export interface LockfileAdapter {
+    /** Filename to look for relative to the package.json directory. */
+    filename: string;
+    /** Parse lockfile content into a name → version map. */
+    parse: (content: string) => InstalledVersionMap;
+}
+/**
+ * Try each adapter in order, returning the first successfully parsed map.
+ * Returns null if no matching lockfile is found.
+ */
+export declare function loadLockfile({ dir, adapters, }: {
+    dir: string;
+    adapters: LockfileAdapter[];
+}): InstalledVersionMap | null;
+/**
+ * Detect the package manager used in `dir` by checking for known lockfiles,
+ * then falling back to the `packageManager` field in `package.json`.
+ * Returns null if detection fails.
+ */
+export declare function detectPackageManager(dir: string): PackageManager | null;
+//# sourceMappingURL=lockfile.d.ts.map

package/dist/src/lockfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../src/lockfile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAKrE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvH,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAA;IAChB,wDAAwD;IACxD,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,mBAAmB,CAAA;CAChD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,EAC3B,GAAG,EACH,QAAQ,GACT,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,eAAe,EAAE,CAAA;CAC5B,GAAG,mBAAmB,GAAG,IAAI,CAe7B;AAOD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAkBvE"}

package/dist/src/lockfile.js

@@ -0,0 +1,54 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { destr } from 'destr';
+export { npmAdapter, parseNpmLock } from './adapters/npm.js';
+export { loadPnpmCatalog, parsePnpmLock, pnpmAdapter, resolveCatalogRefs, updatePnpmCatalog } from './adapters/pnpm.js';
+/**
+ * Try each adapter in order, returning the first successfully parsed map.
+ * Returns null if no matching lockfile is found.
+ */
+export function loadLockfile({ dir, adapters, }) {
+    for (const adapter of adapters) {
+        const path = resolve(dir, adapter.filename);
+        if (!existsSync(path))
+            continue;
+        try {
+            return adapter.parse(readFileSync(path, 'utf8'));
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`error: could not parse ${path}: ${message}`);
+            return null;
+        }
+    }
+    return null;
+}
+const PM_LOCKFILES = [
+    ['pnpm-lock.yaml', 'pnpm'],
+    ['package-lock.json', 'npm'],
+];
+/**
+ * Detect the package manager used in `dir` by checking for known lockfiles,
+ * then falling back to the `packageManager` field in `package.json`.
+ * Returns null if detection fails.
+ */
+export function detectPackageManager(dir) {
+    for (const [filename, pm] of PM_LOCKFILES) {
+        if (existsSync(resolve(dir, filename)))
+            return pm;
+    }
+    const pkgPath = resolve(dir, 'package.json');
+    if (existsSync(pkgPath)) {
+        const pkg = destr(readFileSync(pkgPath, 'utf8'));
+        if (typeof pkg === 'object' && pkg !== null && 'packageManager' in pkg) {
+            const field = pkg.packageManager;
+            if (typeof field === 'string') {
+                const name = field.split('@')[0];
+                if (name === 'npm' || name === 'pnpm')
+                    return name;
+            }
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=lockfile.js.map

package/dist/src/lockfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.js","sourceRoot":"","sources":["../../src/lockfile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAA;AAE7B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AASvH;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,GAAG,EACH,QAAQ,GAIT;IACC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACnB,SAAQ;QACV,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;QAClD,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAChE,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,KAAK,OAAO,EAAE,CAAC,CAAA;YAC3D,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,YAAY,GAAoC;IACpD,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAC1B,CAAC,mBAAmB,EAAE,KAAK,CAAC;CAC7B,CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,KAAK,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,YAAY,EAAE,CAAC;QAC1C,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACpC,OAAO,EAAE,CAAA;IACb,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAC5C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;QAChD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,gBAAgB,IAAI,GAAG,EAAE,CAAC;YACvE,MAAM,KAAK,GAAI,GAA+B,CAAC,cAAc,CAAA;YAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;gBAChC,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM;oBACnC,OAAO,IAAI,CAAA;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/src/output.d.ts

@@ -0,0 +1,13 @@
+import type { AuditResult, BehindBehavior, PackageManager, RangeSpecifierConfig } from './types.js';
+export interface PrintResultsOptions {
+    results: AuditResult[];
+    lag: number;
+    pm: PackageManager;
+    behindBehavior: BehindBehavior;
+    rangeSpecifier: RangeSpecifierConfig;
+    minimumReleaseAge?: number;
+    workspaceFile?: string;
+    fixed?: string[];
+}
+export declare function printResults({ results, lag, pm, behindBehavior, rangeSpecifier, minimumReleaseAge, workspaceFile, fixed }: PrintResultsOptions): void;
+//# sourceMappingURL=output.d.ts.map

package/dist/src/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAkB,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAkInH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,GAAG,EAAE,MAAM,CAAA;IACX,EAAE,EAAE,cAAc,CAAA;IAClB,cAAc,EAAE,cAAc,CAAA;IAC9B,cAAc,EAAE,oBAAoB,CAAA;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,wBAAgB,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,mBAAmB,GAAG,IAAI,CAqIrJ"}

package/dist/src/output.js

@@ -0,0 +1,198 @@
+import { rangePrefix } from './config.js';
+const COL = { name: 20, version: 16, status: 22 };
+function pad(str, len) {
+    return str.padEnd(len);
+}
+function installCmd({ pm, packages, versionFn, exact = false, }) {
+    const pkgs = packages.map(r => `${r.name}@${versionFn(r)}`).join(' ');
+    const e = exact ? ' -E' : '';
+    switch (pm) {
+        case 'pnpm': return `pnpm add${e} ${pkgs}`;
+        case 'npm': return `npm install${e} ${pkgs}`;
+    }
+}
+/**
+ * Generate install command(s) for a set of packages, grouping exact and
+ * non-exact packages separately so the -E flag applies only where needed.
+ */
+function installCmds({ pm, packages, versionTarget, }) {
+    const ver = (r, specifier) => `${rangePrefix(specifier)}${versionTarget === 'current' ? r.current : r.target ?? ''}`;
+    const exact = packages.filter(r => r.rangeSpecifier === 'exact');
+    const nonExact = packages.filter(r => r.rangeSpecifier !== 'exact');
+    const cmds = [];
+    if (exact.length > 0) {
+        cmds.push(installCmd({ pm, packages: exact, versionFn: r => ver(r, 'exact'), exact: true }));
+    }
+    if (nonExact.length > 0) {
+        cmds.push(installCmd({ pm, packages: nonExact, versionFn: r => ver(r, r.rangeSpecifier) }));
+    }
+    return cmds;
+}
+function formatRangeConfig(config) {
+    if (typeof config === 'string')
+        return config;
+    const def = config.default ?? 'exact';
+    const overrides = Object.entries(config)
+        .filter(([k]) => k !== 'default')
+        .map(([k, v]) => `${k} → ${v}`)
+        .join(', ');
+    return overrides ? `${def} (default), ${overrides}` : def;
+}
+function printSettings({ lag, pm, behindBehavior, rangeSpecifier, minimumReleaseAge, }) {
+    const behindDesc = behindBehavior === 'report'
+        ? 'report packages behind target'
+        : 'ignore packages behind target';
+    const rangeDesc = {
+        exact: 'pin exact versions',
+        caret: 'allow minor/patch drift (^)',
+        tilde: 'allow patch drift (~)',
+    };
+    const rangeVal = formatRangeConfig(rangeSpecifier);
+    const hasOverrides = typeof rangeSpecifier !== 'string'
+        && Object.keys(rangeSpecifier).some(k => k !== 'default');
+    const effectiveDefault = typeof rangeSpecifier === 'string'
+        ? rangeSpecifier
+        : (rangeSpecifier.default ?? 'exact');
+    const rangeNote = hasOverrides ? 'per-package specifiers configured' : rangeDesc[effectiveDefault];
+    const col = (s) => s.padEnd(10);
+    console.log('settings');
+    console.log(`  ${col('lag')}${col(String(lag))};  stay ${lag} version${lag === 1 ? '' : 's'} behind latest`);
+    console.log(`  ${col('pm')}${col(pm)};  the chosen package manager`);
+    console.log(`  ${col('behind')}${col(behindBehavior)};  ${behindDesc}`);
+    console.log(`  ${col('range')}${rangeVal};  ${rangeNote}`);
+    if (minimumReleaseAge !== undefined) {
+        console.log(`  ${col('minAge')}${col(String(minimumReleaseAge))};  skip versions published within the last ${minimumReleaseAge} day${minimumReleaseAge === 1 ? '' : 's'}`);
+    }
+}
+function printCatalogEdits({ packages, versionTarget, workspaceFile = 'pnpm-workspace.yaml', label, }) {
+    const heading = label
+        ?? (versionTarget === 'target' ? 'to pin back (update catalog in' : 'to re-pin (update catalog in');
+    console.log(`\n${heading} ${workspaceFile}):`);
+    for (const r of packages) {
+        const ver = versionTarget === 'target' ? r.target : r.current;
+        if (ver)
+            console.log(`  ${r.name}: ${ver}`);
+    }
+    console.log(`\n  or run with --fix to apply automatically`);
+}
+export function printResults({ results, lag, pm, behindBehavior, rangeSpecifier, minimumReleaseAge, workspaceFile, fixed }) {
+    const violations = results.filter(r => r.status === 'pin');
+    const behind = results.filter(r => r.status === 'behind');
+    const unresolved = results.filter(r => r.status === 'unresolved');
+    const mismatches = results.filter(r => r.specifierMismatch);
+    // Exclude violations from re-pin — the pin-back command already covers them.
+    const mismatchesOnly = mismatches.filter(r => r.status !== 'pin');
+    const catalogViolations = violations.filter(r => r.fromCatalog);
+    const standardViolations = violations.filter(r => !r.fromCatalog);
+    const catalogMismatches = mismatchesOnly.filter(r => r.fromCatalog);
+    const standardMismatches = mismatchesOnly.filter(r => !r.fromCatalog);
+    const hasActions = violations.length > 0 || (behindBehavior === 'report' && behind.length > 0);
+    const hasInstalled = results.some(r => r.installed !== null);
+    console.log(`\nrecul  staying ${lag} version${lag === 1 ? '' : 's'} behind latest\n`);
+    printSettings({ lag, pm, behindBehavior, rangeSpecifier, ...(minimumReleaseAge !== undefined ? { minimumReleaseAge } : {}) });
+    console.log();
+    // Column order: package · declared · → target · installed · latest · status
+    const versionCols = hasInstalled ? 4 : 3;
+    const divider = '─'.repeat(COL.name + COL.version * versionCols + COL.status + 4);
+    const header = `${pad('package', COL.name)
+        + pad('declared', COL.version)
+        + pad('→ target', COL.version)
+        + (hasInstalled ? pad('installed', COL.version) : '')
+        + pad('latest', COL.version)}status`;
+    console.log(header);
+    console.log(divider);
+    const sorted = [...results].sort((a, b) => a.name.localeCompare(b.name));
+    for (const r of sorted) {
+        let statusLabel;
+        if (r.status === 'pin')
+            statusLabel = '↓ will pin back';
+        else if (r.status === 'ok')
+            statusLabel = '✓ ok';
+        else if (r.status === 'behind' && behindBehavior === 'report')
+            statusLabel = '↑ safe to upgrade';
+        else if (r.status === 'behind')
+            statusLabel = '✓ ok';
+        else
+            statusLabel = '✗ unresolved';
+        if (r.specifierMismatch) {
+            statusLabel += `  ⚠ declared ${r.declaredSpecifier}`;
+        }
+        console.log(pad(r.name, COL.name)
+            + pad(r.declared, COL.version)
+            + pad(r.target ?? '—', COL.version)
+            + (hasInstalled ? pad(r.installed ?? '—', COL.version) : '')
+            + pad(r.latest ?? '—', COL.version)
+            + statusLabel);
+    }
+    if (unresolved.length > 0) {
+        console.log('\nunresolved:');
+        for (const r of unresolved) {
+            console.log(`  ${r.name}: ${r.error}`);
+        }
+    }
+    if (mismatches.length > 0) {
+        console.log();
+        const names = mismatches.map(r => r.name).join(', ');
+        console.log(`⚠  specifier mismatch on: ${names}`);
+        console.log(`   These packages are declared with a different range than configured.`);
+        if (mismatchesOnly.length > 0)
+            console.log(`   Re-pin command included below.`);
+    }
+    if (!hasActions && mismatches.length === 0) {
+        console.log('\nall audited packages are within the lag policy ✓\n');
+        return;
+    }
+    if (!hasActions && mismatchesOnly.length > 0) {
+        if (standardMismatches.length > 0) {
+            for (const cmd of installCmds({ pm, packages: standardMismatches, versionTarget: 'current' })) {
+                console.log(`\nto re-pin:\n  ${cmd}`);
+            }
+        }
+        if (catalogMismatches.length > 0) {
+            printCatalogEdits({ packages: catalogMismatches, versionTarget: 'current', ...(workspaceFile !== undefined ? { workspaceFile } : {}) });
+        }
+        console.log();
+        return;
+    }
+    if (standardViolations.length > 0) {
+        const cmds = installCmds({ pm, packages: standardViolations, versionTarget: 'target' });
+        console.log(`\nto pin back:`);
+        for (const cmd of cmds)
+            console.log(`  ${cmd}`);
+    }
+    if (catalogViolations.length > 0) {
+        if (fixed !== undefined && fixed.length > 0) {
+            const file = workspaceFile ?? 'pnpm-workspace.yaml';
+            console.log(`\ncatalog updated in ${file}:`);
+            for (const name of fixed)
+                console.log(`  ${name}`);
+        }
+        else {
+            printCatalogEdits({ packages: catalogViolations, versionTarget: 'target', ...(workspaceFile !== undefined ? { workspaceFile } : {}) });
+        }
+    }
+    if (behindBehavior === 'report' && behind.length > 0) {
+        const catalogBehind = behind.filter(r => r.fromCatalog);
+        const standardBehind = behind.filter(r => !r.fromCatalog);
+        if (standardBehind.length > 0) {
+            const cmds = installCmds({ pm, packages: standardBehind, versionTarget: 'target' });
+            console.log(`\nsafe to upgrade (currently behind lag target):`);
+            for (const cmd of cmds)
+                console.log(`  ${cmd}`);
+        }
+        if (catalogBehind.length > 0) {
+            printCatalogEdits({ packages: catalogBehind, versionTarget: 'target', label: 'safe to upgrade (update catalog in', ...(workspaceFile !== undefined ? { workspaceFile } : {}) });
+        }
+    }
+    if (standardMismatches.length > 0) {
+        const cmds = installCmds({ pm, packages: standardMismatches, versionTarget: 'current' });
+        console.log(`\nto re-pin:`);
+        for (const cmd of cmds)
+            console.log(`  ${cmd}`);
+    }
+    if (catalogMismatches.length > 0) {
+        printCatalogEdits({ packages: catalogMismatches, versionTarget: 'current', ...(workspaceFile !== undefined ? { workspaceFile } : {}) });
+    }
+    console.log();
+}
+//# sourceMappingURL=output.js.map

package/dist/src/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/output.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAW,CAAA;AAE1D,SAAS,GAAG,CAAC,GAAW,EAAE,GAAW;IACnC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,EAClB,EAAE,EACF,QAAQ,EACR,SAAS,EACT,KAAK,GAAG,KAAK,GAMd;IACC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5B,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,CAAC,OAAO,WAAW,CAAC,IAAI,IAAI,EAAE,CAAA;QAC1C,KAAK,KAAK,CAAC,CAAC,OAAO,cAAc,CAAC,IAAI,IAAI,EAAE,CAAA;IAC9C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,EACnB,EAAE,EACF,QAAQ,EACR,aAAa,GAKd;IACC,MAAM,GAAG,GAAG,CAAC,CAAc,EAAE,SAAyB,EAAE,EAAE,CACxD,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAA;IAExF,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,CAAA;IAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,CAAA;IACnE,MAAM,IAAI,GAAa,EAAE,CAAA;IAEzB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7F,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,MAA4B;IACrD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAC5B,OAAO,MAAM,CAAA;IACf,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,IAAI,OAAO,CAAA;IACrC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;SAC9B,IAAI,CAAC,IAAI,CAAC,CAAA;IACb,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,eAAe,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;AAC3D,CAAC;AAED,SAAS,aAAa,CAAC,EACrB,GAAG,EACH,EAAE,EACF,cAAc,EACd,cAAc,EACd,iBAAiB,GAOlB;IACC,MAAM,UAAU,GAAG,cAAc,KAAK,QAAQ;QAC5C,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,+BAA+B,CAAA;IACnC,MAAM,SAAS,GAAmC;QAChD,KAAK,EAAE,oBAAoB;QAC3B,KAAK,EAAE,6BAA6B;QACpC,KAAK,EAAE,uBAAuB;KAC/B,CAAA;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAA;IAClD,MAAM,YAAY,GAAG,OAAO,cAAc,KAAK,QAAQ;WAClD,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;IAC3D,MAAM,gBAAgB,GAAmB,OAAO,cAAc,KAAK,QAAQ;QACzE,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,IAAI,OAAO,CAAC,CAAA;IACvC,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;IAElG,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACvC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACvB,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,GAAG,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAA;IAC5G,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAA;IACpE,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC,MAAM,UAAU,EAAE,CAAC,CAAA;IACvE,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,QAAQ,MAAM,SAAS,EAAE,CAAC,CAAA;IAC1D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,8CAA8C,iBAAiB,OAAO,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IAC5K,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,EACzB,QAAQ,EACR,aAAa,EACb,aAAa,GAAG,qBAAqB,EACrC,KAAK,GAMN;IACC,MAAM,OAAO,GAAG,KAAK;WAChB,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAA;IACrG,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,IAAI,aAAa,IAAI,CAAC,CAAA;IAC9C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;QAC7D,IAAI,GAAG;YACL,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC,CAAA;IACtC,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAA;AAC7D,CAAC;AAaD,MAAM,UAAU,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,KAAK,EAAuB;IAC7I,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAA;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,CAAA;IACjE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAA;IAC3D,6EAA6E;IAC7E,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAA;IAEjE,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;IAC/D,MAAM,kBAAkB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;IACjE,MAAM,iBAAiB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;IACnE,MAAM,kBAAkB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;IACrE,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC9F,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAA;IAE5D,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAA;IACrF,aAAa,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC7H,OAAO,CAAC,GAAG,EAAE,CAAA;IAEb,4EAA4E;IAC5E,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,OAAO,GAAG,WAAW,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACjF,MAAM,MAAM,GACR,GAAG,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC;UAC3B,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC;UAC5B,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC;UAC5B,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;UACnD,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAC3B,QAAQ,CAAA;IAEV,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACnB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAEpB,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACxE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,WAAmB,CAAA;QACvB,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK;YACpB,WAAW,GAAG,iBAAiB,CAAA;aAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;YACxB,WAAW,GAAG,MAAM,CAAA;aACjB,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,cAAc,KAAK,QAAQ;YAC3D,WAAW,GAAG,mBAAmB,CAAA;aAC9B,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAC5B,WAAW,GAAG,MAAM,CAAA;;YACjB,WAAW,GAAG,cAAc,CAAA;QAEjC,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC;YACxB,WAAW,IAAI,gBAAgB,CAAC,CAAC,iBAAiB,EAAE,CAAA;QACtD,CAAC;QAED,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;cACnB,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC;cAC5B,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;cACjC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;cAC1D,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;cACjC,WAAW,CACd,CAAA;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAC5B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,EAAE,CAAA;QACb,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpD,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAA;QACjD,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAA;QACrF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAA;IACpD,CAAC;IAED,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAA;QACnE,OAAM;IACR,CAAC;IAED,IAAI,CAAC,UAAU,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;gBAC9F,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAA;YACvC,CAAC;QACH,CAAC;QACD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QACzI,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAA;QACb,OAAM;IACR,CAAC;IAED,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAA;QACvF,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;QAC7B,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAA;IACjD,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,aAAa,IAAI,qBAAqB,CAAA;YACnD,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,GAAG,CAAC,CAAA;YAC5C,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QACpD,CAAC;aACI,CAAC;YACJ,iBAAiB,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QACxI,CAAC;IACH,CAAC;IAED,IAAI,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;QACvD,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;QACzD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAA;YACnF,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAA;YAC/D,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,iBAAiB,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,oCAAoC,EAAE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QACjL,CAAC;IACH,CAAC;IAED,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAA;QACxF,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QAC3B,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAA;IACjD,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IACzI,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAA;AACf,CAAC"}

package/dist/src/resolve.d.ts

@@ -0,0 +1,25 @@
+import type { ResolvedPackage } from './types.js';
+/**
+ * Fetch all published versions for a package from the npm registry.
+ * Returns them in publish order (oldest → newest), stable only.
+ * When minimumReleaseAge is set (days), versions published more recently are excluded.
+ */
+export declare function fetchStableVersions(name: string, minimumReleaseAge?: number, preReleaseFilter?: string[]): Promise<string[]>;
+/**
+ * Given a list of stable versions (oldest → newest) and a lag value,
+ * return the target version to pin to.
+ *
+ * If the package has fewer releases than the lag, pins to the oldest.
+ */
+export declare function computeTarget({ versions, lag }: {
+    versions: string[];
+    lag: number;
+}): string | null;
+/** Resolve lag target for a single package. */
+export declare function resolvePackage({ name, lag, minimumReleaseAge, preReleaseFilter }: {
+    name: string;
+    lag: number;
+    minimumReleaseAge?: number;
+    preReleaseFilter?: string[];
+}): Promise<ResolvedPackage>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/src/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAqBjD;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,gBAAgB,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBtI;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAMnG;AAED,+CAA+C;AAC/C,wBAAsB,cAAc,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE,gBAAqB,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAK9M"}

package/dist/src/resolve.js

@@ -0,0 +1,55 @@
+import { semverCompare } from './semver.js';
+const REGISTRY = 'https://registry.npmjs.org';
+const DAY_MS = 86_400_000;
+function isPackument(value) {
+    return (typeof value === 'object'
+        && value !== null
+        && 'versions' in value
+        && typeof value.versions === 'object');
+}
+/**
+ * Fetch all published versions for a package from the npm registry.
+ * Returns them in publish order (oldest → newest), stable only.
+ * When minimumReleaseAge is set (days), versions published more recently are excluded.
+ */
+export async function fetchStableVersions(name, minimumReleaseAge, preReleaseFilter = []) {
+    const res = await fetch(`${REGISTRY}/${encodeURIComponent(name)}`);
+    if (!res.ok) {
+        throw new Error(`registry fetch failed for "${name}": ${res.status} ${res.statusText}`);
+    }
+    const data = await res.json();
+    if (!isPackument(data)) {
+        throw new Error(`unexpected registry response shape for "${name}"`);
+    }
+    const stable = Object.keys(data.versions).filter(v => !preReleaseFilter.some(tag => v.includes(tag)));
+    if (minimumReleaseAge === undefined || minimumReleaseAge <= 0)
+        return stable;
+    const cutoff = Date.now() - minimumReleaseAge * DAY_MS;
+    return stable.filter((v) => {
+        const published = data.time?.[v];
+        if (published === undefined)
+            return true;
+        return new Date(published).getTime() <= cutoff;
+    });
+}
+/**
+ * Given a list of stable versions (oldest → newest) and a lag value,
+ * return the target version to pin to.
+ *
+ * If the package has fewer releases than the lag, pins to the oldest.
+ */
+export function computeTarget({ versions, lag }) {
+    if (versions.length === 0)
+        return null;
+    const idx = versions.length - 1 - lag;
+    const version = versions[Math.max(0, idx)];
+    return version ?? null;
+}
+/** Resolve lag target for a single package. */
+export async function resolvePackage({ name, lag, minimumReleaseAge, preReleaseFilter = [] }) {
+    const stableVersions = (await fetchStableVersions(name, minimumReleaseAge, preReleaseFilter)).sort((versionA, versionB) => semverCompare({ versionA, versionB }));
+    const latest = stableVersions.at(-1) ?? null;
+    const target = computeTarget({ versions: stableVersions, lag });
+    return { name, stableVersions, latest, target };
+}
+//# sourceMappingURL=resolve.js.map