@fuzdev/fuz_gitops 0.78.1 → 0.79.0

package/dist/ci_reconcile.d.ts

@@ -2,14 +2,12 @@
  * Reconciles each repo's declared `ci` flag against whether it actually has
  * GitHub Actions workflow files on disk.
  *
- * The gitops config derives `ci` from visibility (on for public repos, off for
- * private) with per-repo overrides; this check catches drift between that
- * declaration and reality —
+ * The registry (`repos.toml`) derives `ci` from visibility (on for public repos,
+ * off for private) with per-repo overrides; this check catches drift between
+ * that declaration and reality —
  * a repo that claims CI but ships no workflow, or one that disclaims CI yet
- * still carries one. Repos that aren't checked out locally can't be judged, so
- * the caller marks them uncheckable and they're skipped. Archived repos are
- * frozen on their host, so their CI state is intentionally left alone and they're
- * skipped too.
+ * still carries one. Archived repos are frozen on their host, so their CI state
+ * is intentionally left alone and they're skipped.
  *
  * @module
  */
@@ -28,12 +26,10 @@ export interface CiDrift {
 }
 export interface CiReconcileInput {
     repo_url: string;
-    /** The declared/derived `ci` value from the gitops config. */
+    /** The declared/derived `ci` value from the registry. */
     ci: boolean;
     /** Whether the repo has at least one workflow file on disk. */
     has_workflows: boolean;
-    /** Whether the repo is checked out locally; uncheckable repos are skipped. */
-    checkable: boolean;
     /** Whether the repo is archived (frozen) on its host; archived repos are skipped. */
     archived: boolean;
 }

package/dist/ci_reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci_reconcile.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/ci_reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,2EAA2E;AAC3E,MAAM,MAAM,WAAW;AACtB,yDAAyD;AACvD,YAAY;AACd,uDAAuD;GACrD,UAAU,CAAC;AAEd,MAAM,WAAW,OAAO;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,EAAE,EAAE,OAAO,CAAC;IACZ,+DAA+D;IAC/D,aAAa,EAAE,OAAO,CAAC;IACvB,8EAA8E;IAC9E,SAAS,EAAE,OAAO,CAAC;IACnB,qFAAqF;IACrF,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,KAAK,CAAC,gBAAgB,CAAC,KAAG,KAAK,CAAC,OAAO,CAY1E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,KAAG,OAIrD,CAAC"}
+{"version":3,"file":"ci_reconcile.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/ci_reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,2EAA2E;AAC3E,MAAM,MAAM,WAAW;AACtB,yDAAyD;AACvD,YAAY;AACd,uDAAuD;GACrD,UAAU,CAAC;AAEd,MAAM,WAAW,OAAO;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,EAAE,EAAE,OAAO,CAAC;IACZ,+DAA+D;IAC/D,aAAa,EAAE,OAAO,CAAC;IACvB,qFAAqF;IACrF,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,KAAK,CAAC,gBAAgB,CAAC,KAAG,KAAK,CAAC,OAAO,CAY1E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,KAAG,OAIrD,CAAC"}

package/dist/ci_reconcile.js

@@ -2,14 +2,12 @@
  * Reconciles each repo's declared `ci` flag against whether it actually has
  * GitHub Actions workflow files on disk.
  *
- * The gitops config derives `ci` from visibility (on for public repos, off for
- * private) with per-repo overrides; this check catches drift between that
- * declaration and reality —
+ * The registry (`repos.toml`) derives `ci` from visibility (on for public repos,
+ * off for private) with per-repo overrides; this check catches drift between
+ * that declaration and reality —
  * a repo that claims CI but ships no workflow, or one that disclaims CI yet
- * still carries one. Repos that aren't checked out locally can't be judged, so
- * the caller marks them uncheckable and they're skipped. Archived repos are
- * frozen on their host, so their CI state is intentionally left alone and they're
- * skipped too.
+ * still carries one. Archived repos are frozen on their host, so their CI state
+ * is intentionally left alone and they're skipped.
  *
  * @module
  */
@@ -22,7 +20,7 @@ import { join } from 'node:path';
 export const reconcile_ci = (repos) => {
     const drift = [];
     for (const repo of repos) {
-        if (!repo.checkable || repo.archived)
+        if (repo.archived)
             continue;
         const { repo_url, ci, has_workflows } = repo;
         if (ci && !has_workflows) {

package/dist/dependency_graph.d.ts

@@ -1,9 +1,10 @@
 /**
  * Dependency graph data structure and algorithms for multi-repo publishing.
  *
- * Provides `DependencyGraph` class with topological sort (via `@fuzdev/fuz_util/sort.ts`)
- * and cycle detection by dependency type.
- * For validation workflow and publishing order computation, see `graph_validation.ts`.
+ * Provides the `DependencyGraph` class, built from local repos, with topological sort
+ * (via `@fuzdev/fuz_util/sort.ts`), cycle detection by dependency type, and
+ * wildcard-range analysis.
+ * For the publishing order and the analysis workflow, see `graph_validation.ts`.
  *
  * @module
  */
@@ -17,7 +18,6 @@ export type DependencyType = (typeof DEPENDENCY_TYPE)[keyof typeof DEPENDENCY_TY
 export interface DependencySpec {
     type: DependencyType;
     version: string;
-    resolved?: string;
 }
 export interface DependencyGraphJson {
     nodes: Array<{
@@ -28,7 +28,6 @@ export interface DependencyGraphJson {
             spec: DependencySpec;
         }>;
         dependents: Array<string>;
-        publishable: boolean;
     }>;
     edges: Array<{
         from: string;
@@ -38,20 +37,32 @@ export interface DependencyGraphJson {
 export interface DependencyNode {
     name: string;
     version: string;
-    repo?: LocalRepo;
     dependencies: Map<string, DependencySpec>;
     dependents: Set<string>;
-    publishable: boolean;
+}
+/** Cycles and wildcard dependencies found by `DependencyGraph.analyze`. */
+export interface DependencyAnalysis {
+    production_cycles: Array<Array<string>>;
+    dev_cycles: Array<Array<string>>;
+    wildcard_deps: Array<{
+        pkg: string;
+        dep: string;
+        version: string;
+    }>;
 }
 export declare class DependencyGraph {
     #private;
     nodes: Map<string, DependencyNode>;
     edges: Map<string, Set<string>>;
-    constructor();
-    init_from_repos(repos: Array<LocalRepo>): void;
+    /**
+     * Builds the graph from local repos.
+     *
+     * Two passes: first creates nodes, then builds edges (dependents).
+     * Prioritizes prod/peer deps over dev deps when the same package appears in
+     * multiple dependency types (the stronger constraint wins).
+     */
+    constructor(repos: Array<LocalRepo>);
     get_node(name: string): DependencyNode | undefined;
-    get_dependents(name: string): Set<string>;
-    get_dependencies(name: string): Map<string, DependencySpec>;
     /**
      * Computes topological sort order for dependency graph.
      *
@@ -79,45 +90,11 @@ export declare class DependencyGraph {
         production_cycles: Array<Array<string>>;
         dev_cycles: Array<Array<string>>;
     };
-    toJSON(): DependencyGraphJson;
-}
-/**
- * Builder for creating and analyzing dependency graphs.
- */
-export declare class DependencyGraphBuilder {
-    /**
-     * Constructs dependency graph from local repos.
-     *
-     * Two-pass algorithm: first creates nodes, then builds edges (dependents).
-     * Prioritizes prod/peer deps over dev deps when same package appears in
-     * multiple dependency types (stronger constraint wins).
-     *
-     * @returns fully initialized dependency graph with all nodes and edges
-     */
-    build_from_repos(repos: Array<LocalRepo>): DependencyGraph;
     /**
-     * Computes publishing order using topological sort with dev deps excluded.
-     *
-     * Excludes dev dependencies to break circular dev dependency cycles while
-     * preserving production/peer dependency ordering. This allows patterns like
-     * shared test utilities that depend on each other for development.
-     *
-     * @returns package names in safe publishing order (dependencies before dependents)
-     * @throws {Error} if production/peer cycles detected (cannot be resolved by exclusion)
+     * Reports cycles by type and wildcard (`*`) dependency ranges.
+     * Tolerates cycles: it reports them rather than throwing.
      */
-    compute_publishing_order(graph: DependencyGraph): Array<string>;
-    analyze(graph: DependencyGraph): {
-        production_cycles: Array<Array<string>>;
-        dev_cycles: Array<Array<string>>;
-        wildcard_deps: Array<{
-            pkg: string;
-            dep: string;
-            version: string;
-        }>;
-        missing_peers: Array<{
-            pkg: string;
-            dep: string;
-        }>;
-    };
+    analyze(): DependencyAnalysis;
+    toJSON(): DependencyGraphJson;
 }
 //# sourceMappingURL=dependency_graph.d.ts.map

package/dist/dependency_graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency_graph.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/dependency_graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAEpF,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,KAAK,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,cAAc,CAAA;SAAE,CAAC,CAAC;QAC5D,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1B,WAAW,EAAE,OAAO,CAAC;KACrB,CAAC,CAAC;IACH,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,WAAW,EAAE,OAAO,CAAC;CACrB;AAED,qBAAa,eAAe;;IAC3B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;;IAOzB,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI;IAkDrD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIlD,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAIzC,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC;IAK3D;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,WAAW,UAAQ,GAAG,KAAK,CAAC,MAAM,CAAC;IAiBpD;;;;;;;;;;OAUG;IACH,qBAAqB,IAAI;QACxB,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACxC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;KACjC;IAkDD,MAAM,IAAI,mBAAmB;CAqB7B;AAED;;GAEG;AACH,qBAAa,sBAAsB;IAClC;;;;;;;;OAQG;IACH,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,eAAe;IAM1D;;;;;;;;;OASG;IACH,wBAAwB,CAAC,KAAK,EAAE,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC;IAI/D,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG;QAChC,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACxC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACjC,aAAa,EAAE,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACpE,aAAa,EAAE,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACnD;CAmBD"}
+{"version":3,"file":"dependency_graph.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/dependency_graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAEpF,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IACnC,KAAK,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,cAAc,CAAA;SAAE,CAAC,CAAC;QAC5D,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KAC1B,CAAC,CAAC;IACH,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IAClC,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACxC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpE;AAED,qBAAa,eAAe;;IAC3B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAa;IAC/C,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAa;IAE5C;;;;;;OAMG;gBACS,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC;IA4CnC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIlD;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,WAAW,UAAQ,GAAG,KAAK,CAAC,MAAM,CAAC;IAiBpD;;;;;;;;;;OAUG;IACH,qBAAqB,IAAI;QACxB,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACxC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;KACjC;IAMD;;;OAGG;IACH,OAAO,IAAI,kBAAkB;IAyD7B,MAAM,IAAI,mBAAmB;CAoB7B"}

package/dist/dependency_graph.js

@@ -1,9 +1,10 @@
 /**
  * Dependency graph data structure and algorithms for multi-repo publishing.
  *
- * Provides `DependencyGraph` class with topological sort (via `@fuzdev/fuz_util/sort.ts`)
- * and cycle detection by dependency type.
- * For validation workflow and publishing order computation, see `graph_validation.ts`.
+ * Provides the `DependencyGraph` class, built from local repos, with topological sort
+ * (via `@fuzdev/fuz_util/sort.ts`), cycle detection by dependency type, and
+ * wildcard-range analysis.
+ * For the publishing order and the analysis workflow, see `graph_validation.ts`.
  *
  * @module
  */
@@ -15,30 +16,28 @@ export const DEPENDENCY_TYPE = {
     DEV: 'dev'
 };
 export class DependencyGraph {
-    nodes;
-    edges; // pkg -> dependents
-    constructor() {
-        this.nodes = new Map();
-        this.edges = new Map();
-    }
-    init_from_repos(repos) {
-        // First pass: create nodes
+    nodes = new Map();
+    edges = new Map(); // pkg -> dependents
+    /**
+     * Builds the graph from local repos.
+     *
+     * Two passes: first creates nodes, then builds edges (dependents).
+     * Prioritizes prod/peer deps over dev deps when the same package appears in
+     * multiple dependency types (the stronger constraint wins).
+     */
+    constructor(repos) {
+        // first pass: create nodes
         for (const repo of repos) {
             const { library, package_json } = repo;
             const node = {
                 name: library.name,
                 version: package_json.version || '0.0.0',
-                repo,
                 dependencies: new Map(),
-                dependents: new Set(),
-                publishable: !package_json.private
+                dependents: new Set()
             };
-            // Extract dependencies
             const deps = package_json.dependencies || EMPTY_OBJECT;
             const dev_deps = package_json.devDependencies || EMPTY_OBJECT;
             const peer_deps = package_json.peerDependencies || EMPTY_OBJECT;
-            // Add dependencies, prioritizing prod/peer over dev
-            // (if a package appears in multiple dep types, use the stronger constraint)
             for (const [name, version] of Object.entries(deps)) {
                 node.dependencies.set(name, { type: DEPENDENCY_TYPE.PROD, version });
             }
@@ -46,7 +45,7 @@ export class DependencyGraph {
                 node.dependencies.set(name, { type: DEPENDENCY_TYPE.PEER, version });
             }
             for (const [name, version] of Object.entries(dev_deps)) {
-                // Only add dev deps if not already present as prod/peer
+                // only add dev deps if not already present as prod/peer
                 if (!node.dependencies.has(name)) {
                     node.dependencies.set(name, { type: DEPENDENCY_TYPE.DEV, version });
                 }
@@ -54,12 +53,11 @@ export class DependencyGraph {
             this.nodes.set(library.name, node);
             this.edges.set(library.name, new Set());
         }
-        // Second pass: build edges (dependents)
+        // second pass: build edges (dependents) for internal dependencies
         for (const node of this.nodes.values()) {
             for (const [dep_name] of node.dependencies) {
-                if (this.nodes.has(dep_name)) {
-                    // Internal dependency
-                    const dep_node = this.nodes.get(dep_name);
+                const dep_node = this.nodes.get(dep_name);
+                if (dep_node) {
                     dep_node.dependents.add(node.name);
                     this.edges.get(dep_name).add(node.name);
                 }
@@ -69,13 +67,6 @@ export class DependencyGraph {
     get_node(name) {
         return this.nodes.get(name);
     }
-    get_dependents(name) {
-        return this.edges.get(name) || new Set();
-    }
-    get_dependencies(name) {
-        const node = this.nodes.get(name);
-        return node ? node.dependencies : new Map();
-    }
     /**
      * Computes topological sort order for dependency graph.
      *
@@ -120,6 +111,22 @@ export class DependencyGraph {
         const dev_cycles = this.#find_cycles((spec) => spec.type === DEPENDENCY_TYPE.DEV);
         return { production_cycles, dev_cycles };
     }
+    /**
+     * Reports cycles by type and wildcard (`*`) dependency ranges.
+     * Tolerates cycles: it reports them rather than throwing.
+     */
+    analyze() {
+        const { production_cycles, dev_cycles } = this.detect_cycles_by_type();
+        const wildcard_deps = [];
+        for (const node of this.nodes.values()) {
+            for (const [dep_name, spec] of node.dependencies) {
+                if (spec.version === '*') {
+                    wildcard_deps.push({ pkg: node.name, dep: dep_name, version: spec.version });
+                }
+            }
+        }
+        return { production_cycles, dev_cycles, wildcard_deps };
+    }
     /** DFS cycle detection following only edges that match the filter. */
     #find_cycles(include) {
         const cycles = [];
@@ -167,8 +174,7 @@ export class DependencyGraph {
                 name,
                 spec
             })),
-            dependents: Array.from(node.dependents),
-            publishable: node.publishable
+            dependents: Array.from(node.dependents)
         }));
         const edges = [];
         for (const [from, tos] of this.edges) {
@@ -179,52 +185,3 @@ export class DependencyGraph {
         return { nodes, edges };
     }
 }
-/**
- * Builder for creating and analyzing dependency graphs.
- */
-export class DependencyGraphBuilder {
-    /**
-     * Constructs dependency graph from local repos.
-     *
-     * Two-pass algorithm: first creates nodes, then builds edges (dependents).
-     * Prioritizes prod/peer deps over dev deps when same package appears in
-     * multiple dependency types (stronger constraint wins).
-     *
-     * @returns fully initialized dependency graph with all nodes and edges
-     */
-    build_from_repos(repos) {
-        const graph = new DependencyGraph();
-        graph.init_from_repos(repos);
-        return graph;
-    }
-    /**
-     * Computes publishing order using topological sort with dev deps excluded.
-     *
-     * Excludes dev dependencies to break circular dev dependency cycles while
-     * preserving production/peer dependency ordering. This allows patterns like
-     * shared test utilities that depend on each other for development.
-     *
-     * @returns package names in safe publishing order (dependencies before dependents)
-     * @throws {Error} if production/peer cycles detected (cannot be resolved by exclusion)
-     */
-    compute_publishing_order(graph) {
-        return graph.topological_sort(true); // Exclude dev dependencies
-    }
-    analyze(graph) {
-        const { production_cycles, dev_cycles } = graph.detect_cycles_by_type();
-        const wildcard_deps = [];
-        const missing_peers = [];
-        for (const node of graph.nodes.values()) {
-            for (const [dep_name, spec] of node.dependencies) {
-                if (spec.version === '*') {
-                    wildcard_deps.push({ pkg: node.name, dep: dep_name, version: spec.version });
-                }
-                if (spec.type === DEPENDENCY_TYPE.PEER && !graph.nodes.has(dep_name)) {
-                    // External peer dependency
-                    missing_peers.push({ pkg: node.name, dep: dep_name });
-                }
-            }
-        }
-        return { production_cycles, dev_cycles, wildcard_deps, missing_peers };
-    }
-}

package/dist/dependency_updater.d.ts

@@ -19,7 +19,7 @@ export interface UpdatePackageJsonOptions {
  * 3. Creates auto-changeset if `published_versions` provided (for transitive updates)
  * 4. Commits both `package.json` and changeset with standard message
  *
- * Uses version strategy to determine prefix (exact, caret, tilde) while preserving
+ * Uses version strategy to determine prefix (exact, caret, tilde, gte) while preserving
  * existing prefixes when possible.
  *
  * @throws {Error} if file operations or git operations fail

package/dist/dependency_updater.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency_updater.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/dependency_updater.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAMlE,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAGnE,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;AAElE,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,kBAAkB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACnD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,MAAM,CAAC,EAAE,YAAY,CAAC;CACtB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,SAAS,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAS,wBAA6B,KACpC,OAAO,CAAC,IAAI,CAkId,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,MAAM,CAAC,EAAE,YAAY,CAAC;CACtB;AAED,eAAO,MAAM,gBAAgB,GAC5B,OAAO,KAAK,CAAC,SAAS,CAAC,EACvB,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,UAAS,qBAA0B,KACjC,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAA;KAAE,CAAC,CAAA;CAAE,CAuD5E,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,KAC5B,GAAG,CACL,MAAM,EACN;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,cAAc,GAAG,iBAAiB,GAAG,kBAAkB,CAAA;CAAE,CAkD/F,CAAC"}
+{"version":3,"file":"dependency_updater.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/dependency_updater.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAMlE,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAGnE,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;AAElE,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,kBAAkB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACnD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,MAAM,CAAC,EAAE,YAAY,CAAC;CACtB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,SAAS,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAS,wBAA6B,KACpC,OAAO,CAAC,IAAI,CAwId,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,MAAM,CAAC,EAAE,YAAY,CAAC;CACtB;AAED,eAAO,MAAM,gBAAgB,GAC5B,OAAO,KAAK,CAAC,SAAS,CAAC,EACvB,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,UAAS,qBAA0B,KACjC,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAA;KAAE,CAAC,CAAA;CAAE,CAuD5E,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,KAC5B,GAAG,CACL,MAAM,EACN;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,cAAc,GAAG,iBAAiB,GAAG,kBAAkB,CAAA;CAAE,CAkD/F,CAAC"}

package/dist/dependency_updater.js

@@ -11,7 +11,7 @@ import { default_git_operations, default_fs_operations } from './operations_defa
  * 3. Creates auto-changeset if `published_versions` provided (for transitive updates)
  * 4. Commits both `package.json` and changeset with standard message
  *
- * Uses version strategy to determine prefix (exact, caret, tilde) while preserving
+ * Uses version strategy to determine prefix (exact, caret, tilde, gte) while preserving
  * existing prefixes when possible.
  *
  * @throws {Error} if file operations or git operations fail
@@ -73,6 +73,7 @@ export const update_package_json = async (repo, updates, options = {}) => {
     if (!write_result.ok) {
         throw new Error(`Failed to write package.json: ${write_result.message}`);
     }
+    const staged = [];
     // Create changeset if we have published version info
     if (published_versions && published_versions.size > 0) {
         // Build dependency updates info for changeset
@@ -107,6 +108,7 @@ export const update_package_json = async (repo, updates, options = {}) => {
             if (!add_result.ok) {
                 throw new Error(`Failed to stage changeset: ${add_result.message}`);
             }
+            staged.push(changeset_path);
         }
     }
     // Commit the changes (including both package.json and changeset)
@@ -114,8 +116,11 @@ export const update_package_json = async (repo, updates, options = {}) => {
     if (!add_pkg_result.ok) {
         throw new Error(`Failed to stage package.json: ${add_pkg_result.message}`);
     }
+    staged.push('package.json');
+    // commit only what this staged, so nothing else in the index rides along
     const commit_result = await git_ops.commit({
         message: `update dependencies after publishing`,
+        files: staged,
         cwd: repo.repo_dir
     });
     if (!commit_result.ok) {

package/dist/fetch_repo_data.d.ts

@@ -2,18 +2,44 @@ import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { FetchValueCache } from '@fuzdev/fuz_util/fetch.ts';
 import type { RepoJson } from './repo.svelte.js';
 import type { LocalRepo } from './local_repo.js';
+/**
+ * Options for `fetch_repo_data`.
+ */
+export interface FetchRepoDataOptions {
+    /** The repos to fetch GitHub metadata for, in order. */
+    local_repos: Array<LocalRepo>;
+    /** GitHub API token, sent with each request. */
+    token?: string;
+    /** Response memoization, from `fuz_util`'s `fetch.ts`. */
+    cache?: FetchValueCache;
+    log?: Logger;
+    /** Milliseconds to wait before each API request. Defaults to `33`. */
+    delay?: number;
+    /** Sent as the `x-github-api-version` header when set. */
+    github_api_version?: string;
+    /** The `fetch` the API requests go through. Defaults to `globalThis.fetch`. */
+    fetch?: typeof globalThis.fetch;
+}
 /**
  * Fetches GitHub metadata (CI status, PRs) for all repos.
  *
- * Fetches sequentially with delay between requests to respect GitHub API rate limits.
- * Uses `await_in_loop` intentionally to avoid parallel requests overwhelming the API.
+ * Fetches sequentially with a delay before each request to respect GitHub API
+ * rate limits. Uses `await_in_loop` intentionally to avoid parallel requests
+ * overwhelming the API. CI status is read for the branch each repo's registry
+ * entry follows (`main` when it names none), and that branch is written to
+ * `RepoJson.branch`.
  *
- * Error handling: Logs fetch failures but continues processing remaining repos.
- * Repos with failed fetches will have `null` for `check_runs` or `pull_requests`.
+ * A repo whose registry entry declares no CI (`ci: false`) isn't asked for
+ * check runs, and one with none on its branch isn't a failure: both leave
+ * `check_runs` `null` without logging. A failed fetch is logged as an error
+ * and leaves `null` for that repo's `check_runs` or `pull_requests`, and the
+ * remaining repos still fetch — except a 401 response or a repo URL without a
+ * GitHub owner, which throw.
  *
- * @param delay - milliseconds between API requests (default: 33ms)
- * @param cache - optional cache from `fuz_util`'s `fetch.js` for response memoization
- * @returns array of `Repo` objects with GitHub metadata attached
+ * @param options - the repos, credentials, cache, and pacing
+ * @returns a `RepoJson` for each repo, in the order given
+ * @throws {Error} on a 401 response (check `SECRET_GITHUB_API_TOKEN`) or a
+ *   repo whose URL has no GitHub owner
  */
-export declare const fetch_repo_data: (resolved_repos: Array<LocalRepo>, token?: string, cache?: FetchValueCache, log?: Logger, delay?: number, github_api_version?: string) => Promise<Array<RepoJson>>;
+export declare const fetch_repo_data: (options: FetchRepoDataOptions) => Promise<Array<RepoJson>>;
 //# sourceMappingURL=fetch_repo_data.d.ts.map

package/dist/fetch_repo_data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch_repo_data.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/fetch_repo_data.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAGjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAC3B,gBAAgB,KAAK,CAAC,SAAS,CAAC,EAChC,QAAQ,MAAM,EACd,QAAQ,eAAe,EACvB,MAAM,MAAM,EACZ,cAAU,EACV,qBAAqB,MAAM,KACzB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAkCzB,CAAC"}
+{"version":3,"file":"fetch_repo_data.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/fetch_repo_data.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAOjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,wDAAwD;IACxD,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CA+C5F,CAAC"}

package/dist/fetch_repo_data.js

@@ -3,44 +3,66 @@ import { fetch_github_check_runs, fetch_github_pull_requests } from './github.js
 /**
  * Fetches GitHub metadata (CI status, PRs) for all repos.
  *
- * Fetches sequentially with delay between requests to respect GitHub API rate limits.
- * Uses `await_in_loop` intentionally to avoid parallel requests overwhelming the API.
+ * Fetches sequentially with a delay before each request to respect GitHub API
+ * rate limits. Uses `await_in_loop` intentionally to avoid parallel requests
+ * overwhelming the API. CI status is read for the branch each repo's registry
+ * entry follows (`main` when it names none), and that branch is written to
+ * `RepoJson.branch`.
  *
- * Error handling: Logs fetch failures but continues processing remaining repos.
- * Repos with failed fetches will have `null` for `check_runs` or `pull_requests`.
+ * A repo whose registry entry declares no CI (`ci: false`) isn't asked for
+ * check runs, and one with none on its branch isn't a failure: both leave
+ * `check_runs` `null` without logging. A failed fetch is logged as an error
+ * and leaves `null` for that repo's `check_runs` or `pull_requests`, and the
+ * remaining repos still fetch — except a 401 response or a repo URL without a
+ * GitHub owner, which throw.
  *
- * @param delay - milliseconds between API requests (default: 33ms)
- * @param cache - optional cache from `fuz_util`'s `fetch.js` for response memoization
- * @returns array of `Repo` objects with GitHub metadata attached
+ * @param options - the repos, credentials, cache, and pacing
+ * @returns a `RepoJson` for each repo, in the order given
+ * @throws {Error} on a 401 response (check `SECRET_GITHUB_API_TOKEN`) or a
+ *   repo whose URL has no GitHub owner
  */
-export const fetch_repo_data = async (resolved_repos, token, cache, log, delay = 33, github_api_version) => {
+export const fetch_repo_data = async (options) => {
+    const { local_repos, token, cache, log, delay = 33, github_api_version, fetch } = options;
     const repos = [];
-    for (const { library, package_json, repo_config } of resolved_repos) {
+    for (const { library, package_json, entry } of local_repos) {
         const repo_url = library.repo_url;
-        // CI status
-        await wait(delay);
-        const check_runs = await fetch_github_check_runs(library, {
-            cache,
-            log,
-            token,
-            api_version: github_api_version,
-            ref: repo_config.branch
-        });
-        if (!check_runs)
-            log?.error('failed to fetch CI status: ' + repo_url);
+        const branch = entry.branch ?? 'main';
+        // CI status, for repos the registry says run CI
+        let check_runs = null;
+        if (entry.ci) {
+            await wait(delay);
+            const fetched = await fetch_github_check_runs(library, {
+                cache,
+                log,
+                token,
+                api_version: github_api_version,
+                ref: branch,
+                fetch
+            });
+            if (fetched.ok) {
+                check_runs = fetched.value;
+                if (!check_runs)
+                    log?.debug(`no check runs on \`${branch}\`: ${repo_url}`);
+            }
+            else {
+                log?.error(`failed to fetch CI status (${fetched.status}): ${repo_url}`);
+            }
+        }
         // pull requests
         await wait(delay);
         const pull_requests = await fetch_github_pull_requests(library, {
             cache,
             log,
             token,
-            api_version: github_api_version
+            api_version: github_api_version,
+            fetch
         });
         if (!pull_requests)
-            log?.error('failed to fetch issues: ' + repo_url);
+            log?.error('failed to fetch pull requests: ' + repo_url);
         repos.push({
             library_json: library.library_json,
             package_json,
+            branch,
             check_runs,
             pull_requests
         });

package/dist/fs_fetch_value_cache.d.ts

@@ -14,7 +14,7 @@ export interface FetchCache {
  * cache is cleared (delete file) and starts fresh. This handles format changes.
  *
  * Uses `structuredClone` to track changes - only writes to disk if data modified.
- * Formatted with Prettier before writing for version control friendliness.
+ * Formatted with gro's `format_file` before writing for version control friendliness.
  *
  * @param name - cache filename (without .json extension)
  * @param dir - cache directory (defaults to `.gro/build/fetch/`)

package/dist/fs_fetch_value_cache.js

@@ -11,7 +11,7 @@ import { existsSync } from 'node:fs';
  * cache is cleared (delete file) and starts fresh. This handles format changes.
  *
  * Uses `structuredClone` to track changes - only writes to disk if data modified.
- * Formatted with Prettier before writing for version control friendliness.
+ * Formatted with gro's `format_file` before writing for version control friendliness.
  *
  * @param name - cache filename (without .json extension)
  * @param dir - cache directory (defaults to `.gro/build/fetch/`)