@crbroughton/recul 0.1.0

package/dist/src/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/resolve.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,QAAQ,GAAG,4BAA4B,CAAA;AAC7C,MAAM,MAAM,GAAG,UAAU,CAAA;AAQzB,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;WACtB,KAAK,KAAK,IAAI;WACd,UAAU,IAAI,KAAK;WACnB,OAAQ,KAAiC,CAAC,QAAQ,KAAK,QAAQ,CACnE,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,iBAA0B,EAAE,mBAA6B,EAAE;IACjH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAClE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,MAAM,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IACtC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,GAAG,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACrG,IAAI,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,IAAI,CAAC;QAC3D,OAAO,MAAM,CAAA;IACf,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,GAAG,MAAM,CAAA;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAChC,IAAI,SAAS,KAAK,SAAS;YACzB,OAAO,IAAI,CAAA;QACb,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,MAAM,CAAA;IAChD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAuC;IAClF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QACvB,OAAO,IAAI,CAAA;IACb,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,CAAA;IACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC1C,OAAO,OAAO,IAAI,IAAI,CAAA;AACxB,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE,gBAAgB,GAAG,EAAE,EAA0F;IAClL,MAAM,cAAc,GAAG,CAAC,MAAM,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;IACjK,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAA;IAC/D,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AACjD,CAAC"}

package/dist/src/semver.d.ts

@@ -0,0 +1,29 @@
+import type { DeclaredSpecifier, RangeSpecifier } from './types.js';
+/** Strip leading range characters (^, ~, >=, etc.) to get a bare version. */
+export declare function bareVersion(version: string): string;
+/**
+ * Compare two bare semver strings.
+ * Returns negative if a < b, 0 if equal, positive if a > b.
+ */
+interface SemverCompareOptions {
+    versionA: string;
+    versionB: string;
+}
+export declare function semverCompare({ versionA, versionB }: SemverCompareOptions): number;
+/**
+ * Compare two bare semver strings with awareness of the configured specifier.
+ *
+ * - exact  → compare all three components (major.minor.patch)
+ * - tilde  → compare major.minor only   (patch drift is acceptable)
+ * - caret  → compare major only         (minor + patch drift is acceptable)
+ */
+interface SemverCompareForSpecifierOptions {
+    versionA: string;
+    versionB: string;
+    specifier: RangeSpecifier;
+}
+export declare function semverCompareForSpecifier({ versionA, versionB, specifier }: SemverCompareForSpecifierOptions): number;
+/** Detect the range specifier prefix declared in a raw version string. */
+export declare function detectSpecifier(raw: string): DeclaredSpecifier;
+export {};
+//# sourceMappingURL=semver.d.ts.map

package/dist/src/semver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.d.ts","sourceRoot":"","sources":["../../src/semver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAKnE,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;GAGG;AACH,UAAU,oBAAoB;IAAG,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAErE,wBAAgB,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,oBAAoB,GAAG,MAAM,CASlF;AAED;;;;;;GAMG;AACH,UAAU,gCAAgC;IAAG,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,cAAc,CAAA;CAAE;AAE5G,wBAAgB,yBAAyB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,gCAAgC,GAAG,MAAM,CAWrH;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAQ9D"}

package/dist/src/semver.js

@@ -0,0 +1,39 @@
+const LEADING_NON_DIGIT = /^\D*/;
+const STARTS_WITH_DIGIT = /^\d/;
+/** Strip leading range characters (^, ~, >=, etc.) to get a bare version. */
+export function bareVersion(version) {
+    return version.replace(LEADING_NON_DIGIT, '');
+}
+export function semverCompare({ versionA, versionB }) {
+    const partsA = versionA.split('.').map(Number);
+    const partsB = versionB.split('.').map(Number);
+    for (let i = 0; i < 3; i++) {
+        const diff = (partsA[i] ?? 0) - (partsB[i] ?? 0);
+        if (diff !== 0)
+            return diff;
+    }
+    return 0;
+}
+export function semverCompareForSpecifier({ versionA, versionB, specifier }) {
+    const partsA = versionA.split('.').map(Number);
+    const partsB = versionB.split('.').map(Number);
+    const depthBySpecifier = { exact: 3, tilde: 2, caret: 1 };
+    const depth = depthBySpecifier[specifier];
+    for (let i = 0; i < depth; i++) {
+        const diff = (partsA[i] ?? 0) - (partsB[i] ?? 0);
+        if (diff !== 0)
+            return diff;
+    }
+    return 0;
+}
+/** Detect the range specifier prefix declared in a raw version string. */
+export function detectSpecifier(raw) {
+    if (raw.startsWith('^'))
+        return 'caret';
+    if (raw.startsWith('~'))
+        return 'tilde';
+    if (STARTS_WITH_DIGIT.test(raw))
+        return 'exact';
+    return 'other';
+}
+//# sourceMappingURL=semver.js.map

package/dist/src/semver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.js","sourceRoot":"","sources":["../../src/semver.ts"],"names":[],"mappings":"AAEA,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAChC,MAAM,iBAAiB,GAAG,KAAK,CAAA;AAE/B,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAA;AAC/C,CAAC;AAQD,MAAM,UAAU,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAwB;IACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QAChD,IAAI,IAAI,KAAK,CAAC;YACZ,OAAO,IAAI,CAAA;IACf,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAWD,MAAM,UAAU,yBAAyB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAoC;IAC3G,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9C,MAAM,gBAAgB,GAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IACzF,MAAM,KAAK,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QAChD,IAAI,IAAI,KAAK,CAAC;YACZ,OAAO,IAAI,CAAA;IACf,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,OAAO,OAAO,CAAA;IAChB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,OAAO,OAAO,CAAA;IAChB,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7B,OAAO,OAAO,CAAA;IAChB,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/src/types.d.ts

@@ -0,0 +1,70 @@
+export type PackageManager = 'npm' | 'pnpm';
+export type BehindBehavior = 'ignore' | 'report';
+export type RangeSpecifier = 'exact' | 'caret' | 'tilde';
+/**
+ * Either a single specifier applied to all packages, or a per-package map.
+ * The "default" key in the map acts as the fallback for unlisted packages.
+ *
+ * @example
+ * "exact"
+ * { "default": "exact", "react": "tilde", "lodash": "caret" }
+ */
+export type RangeSpecifierConfig = RangeSpecifier | Record<string, RangeSpecifier>;
+export interface Config {
+    lag: number;
+    file: string;
+    pm: PackageManager;
+    ignore: string[];
+    behindBehavior: BehindBehavior;
+    rangeSpecifier: RangeSpecifierConfig;
+    minimumReleaseAge?: number;
+    preReleaseFilter: string[];
+}
+/** Shape of recul.config.json(c) */
+export interface ConfigFile {
+    lag?: number;
+    packageManager?: PackageManager;
+    packageFile?: string;
+    behindBehavior?: BehindBehavior;
+    rangeSpecifier?: RangeSpecifierConfig;
+    ignore?: string[];
+    minimumReleaseAge?: number;
+    preReleaseFilter?: string[];
+}
+export interface ResolvedPackage {
+    name: string;
+    stableVersions: string[];
+    latest: string | null;
+    target: string | null;
+}
+/** name → installed version, resolved from a lockfile. */
+export type InstalledVersionMap = Record<string, string>;
+export type AuditStatus = 'ok' | 'pin' | 'behind' | 'unresolved';
+/** The range prefix declared in package.json. */
+export type DeclaredSpecifier = 'exact' | 'caret' | 'tilde' | 'other';
+export interface AuditResult {
+    name: string;
+    /** Raw version string as declared in package.json, e.g. "^1.3.4". */
+    declared: string;
+    /** Bare version with range prefix stripped, e.g. "1.3.4". */
+    current: string;
+    /** Actually installed version from lockfile, or null if no lockfile. */
+    installed: string | null;
+    target: string | null;
+    latest: string | null;
+    status: AuditStatus;
+    /** The resolved rangeSpecifier for this specific package. */
+    rangeSpecifier: RangeSpecifier;
+    declaredSpecifier: DeclaredSpecifier;
+    /** True when declaredSpecifier doesn't match the configured rangeSpecifier. */
+    specifierMismatch: boolean;
+    /** True when the version was declared as a pnpm catalog reference. */
+    fromCatalog: boolean;
+    error?: string;
+}
+/** Shape of what we read from package.json. */
+export interface PackageJson {
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,CAAA;AAE3C,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAChD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAA;AAExD;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;AAElF,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,EAAE,EAAE,cAAc,CAAA;IAClB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,cAAc,EAAE,cAAc,CAAA;IAC9B,cAAc,EAAE,oBAAoB,CAAA;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,cAAc,CAAC,EAAE,oBAAoB,CAAA;IACrC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,0DAA0D;AAC1D,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAExD,MAAM,MAAM,WAAW,GAAG,IAAI,GAAG,KAAK,GAAG,QAAQ,GAAG,YAAY,CAAA;AAEhE,iDAAiD;AACjD,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAA;AAErE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAA;IAChB,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAA;IACf,wEAAwE;IACxE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,MAAM,EAAE,WAAW,CAAA;IACnB,6DAA6D;IAC7D,cAAc,EAAE,cAAc,CAAA;IAC9B,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,+EAA+E;IAC/E,iBAAiB,EAAE,OAAO,CAAA;IAC1B,sEAAsE;IACtE,WAAW,EAAE,OAAO,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,+CAA+C;AAC/C,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACzC"}

package/dist/src/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@crbroughton/recul",
+  "type": "module",
+  "version": "0.1.0",
+  "description": "Stay N versions behind the latest published release of your npm dependencies to avoid supply chain attacks.",
+  "author": {
+    "name": "Craig R Broughton",
+    "email": "CRBroughton@posteo.uk",
+    "url": "https://CRBroughton.me"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/CRBroughton/recul"
+  },
+  "keywords": [
+    "npm",
+    "security",
+    "dependencies",
+    "supply-chain",
+    "audit",
+    "version-pinning"
+  ],
+  "exports": {
+    ".": "./dist/src/index.js"
+  },
+  "bin": {
+    "recul": "./dist/bin/recul.js"
+  },
+  "files": [
+    "dist/bin/",
+    "dist/src/"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "citty": "0.2.0",
+    "confbox": "0.2.2",
+    "defu": "6.1.4",
+    "destr": "2.0.3"
+  },
+  "devDependencies": {
+    "@antfu/eslint-config": "8.0.0",
+    "@changesets/cli": "2.30.0",
+    "@types/node": "25.3.5",
+    "@vitest/coverage-v8": "4.1.0",
+    "eslint": "10.2.0",
+    "jiti": "2.6.1",
+    "typescript": "5.9.2",
+    "vite": "8.0.1",
+    "vitest": "4.1.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "start": "node dist/bin/recul.js",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "lint": "eslint",
+    "lint:fix": "eslint --fix",
+    "changeset": "changeset",
+    "changeset:status": "changeset status --verbose",
+    "changeset:version": "changeset version"
+  }
+}