@mcamdali/podexit 0.0.0-stage → 0.1.2

package/data/publisher-policy.schema.json

@@ -0,0 +1,96 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string"
+    },
+    "dataVersion": {
+      "type": "string",
+      "pattern": "^\\d{4}\\.\\d{2}\\.\\d{2}$"
+    },
+    "publishers": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^[a-z0-9-]+$"
+          },
+          "name": {
+            "type": "string",
+            "minLength": 1
+          },
+          "pods": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "lastMajorOnCocoaPods": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 9007199254740991
+          },
+          "stoppedPublishing": {
+            "type": "string",
+            "pattern": "^\\d{4}-\\d{2}$"
+          },
+          "summary": {
+            "type": "string",
+            "minLength": 1
+          },
+          "includesSubdependencies": {
+            "type": "boolean"
+          },
+          "swiftPackage": {
+            "type": "object",
+            "properties": {
+              "url": {
+                "type": "string",
+                "format": "uri"
+              },
+              "note": {
+                "type": "string",
+                "minLength": 1
+              }
+            },
+            "required": [
+              "url",
+              "note"
+            ],
+            "additionalProperties": false
+          },
+          "source": {
+            "type": "string",
+            "format": "uri"
+          },
+          "checked": {
+            "type": "string",
+            "format": "date",
+            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$"
+          }
+        },
+        "required": [
+          "id",
+          "name",
+          "pods",
+          "lastMajorOnCocoaPods",
+          "stoppedPublishing",
+          "summary",
+          "source",
+          "checked"
+        ],
+        "additionalProperties": false
+      }
+    }
+  },
+  "required": [
+    "dataVersion",
+    "publishers"
+  ],
+  "additionalProperties": false
+}

package/dist/analyze.d.ts

@@ -0,0 +1,20 @@
+import type { PublisherPolicy } from './core/policy.js';
+import type { Fetcher } from './net/fetcher.js';
+import { type LockfileReport, type PodReport, type Report, SCHEMA_VERSION, type Summary, type SwiftPackageReport, type UpdatesReport } from './report-model.js';
+export { type LockfileReport, type PodReport, type Report, SCHEMA_VERSION, type Summary, type SwiftPackageReport, type UpdatesReport, };
+export interface AnalyzeOptions {
+    fetcher: Fetcher;
+    policy: PublisherPolicy;
+    /** Parallel pod lookups. Default 8. */
+    concurrency?: number;
+}
+export declare function summarize(pods: readonly PodReport[]): Summary;
+/** Analyzes the text of one Podfile.lock. `path` is only used for display and project detection. */
+export declare function analyzeLockfile(text: string, path: string, options: AnalyzeOptions): Promise<LockfileReport>;
+export interface ReportContext {
+    policy: PublisherPolicy;
+    offline: boolean;
+    now?: Date;
+}
+/** Wraps lockfile reports with the metadata every output format shows. */
+export declare function buildReport(lockfiles: LockfileReport[], context: ReportContext): Report;

package/dist/analyze.js

@@ -0,0 +1,195 @@
+import { classifyLockfile, describeUpdates } from './core/classify.js';
+import { parseLockfile } from './core/lockfile.js';
+import { detectProjectKind, GUIDES } from './core/project.js';
+import { BUILDS_KEEP_WORKING, TIMELINE } from './core/timeline.js';
+import { compareVersions, latestVersion } from './core/versions.js';
+import { fetchPodspec, releaseDates, trunkVersions } from './net/cocoapods.js';
+import { hasPackageManifest, parseGitHubUrl, repositoryUrl, } from './net/github.js';
+import { SCHEMA_VERSION, } from './report-model.js';
+import { VERSION } from './version.js';
+export { SCHEMA_VERSION, };
+async function trunkFacts(fetcher, pod) {
+    const [versions, dates, podspec] = await Promise.all([
+        trunkVersions(fetcher, pod.name),
+        releaseDates(fetcher, pod.name),
+        fetchPodspec(fetcher, pod.name, pod.version),
+    ]);
+    const repository = parseGitHubUrl(podspec?.source?.git) ?? parseGitHubUrl(podspec?.homepage) ?? null;
+    return {
+        latest: versions ? latestVersion(versions) : null,
+        dates,
+        tag: podspec?.source?.git ? (podspec.source.tag ?? null) : null,
+        repository,
+        otherSource: podspec?.source?.http ?? podspec?.source?.git ?? podspec?.homepage ?? null,
+    };
+}
+function updatesReport(pod, { status, publisher, via }, facts) {
+    const latest = facts?.latest ?? null;
+    const report = {
+        status,
+        summary: describeUpdates(status, pod, publisher, via),
+        latestOnTrunk: latest,
+        latestReleasedAt: latest ? (facts?.dates?.get(latest) ?? null) : null,
+        lockedReleasedAt: facts?.dates?.get(pod.version) ?? null,
+        behindTrunk: latest ? compareVersions(pod.version, latest) < 0 : null,
+    };
+    if (via)
+        report.via = via;
+    if (publisher) {
+        const { id, name, lastMajorOnCocoaPods, source } = publisher;
+        report.publisher = { id, name, lastMajorOnCocoaPods, source };
+    }
+    return report;
+}
+function hostOf(url) {
+    try {
+        return new URL(url).hostname;
+    }
+    catch {
+        return url;
+    }
+}
+async function upstreamPackage(fetcher, repository, ref) {
+    const url = repositoryUrl(repository);
+    const head = await hasPackageManifest(fetcher, repository);
+    if (head === null) {
+        return {
+            status: 'unknown',
+            summary: `No answer from GitHub for ${url}.`,
+            repository: url,
+            atLockedVersion: null,
+            via: null,
+        };
+    }
+    if (!head) {
+        return {
+            status: 'no-spm',
+            summary: `${url} has no Package.swift on its default branch.`,
+            repository: url,
+            atLockedVersion: null,
+            via: 'upstream',
+        };
+    }
+    const atLocked = ref ? await hasPackageManifest(fetcher, repository, ref) : null;
+    const detail = atLocked === true
+        ? ` It is also there at ${ref}, the version you use.`
+        : atLocked === false
+            ? ` It is not there at ${ref}, the version you use: the switch needs a newer version.`
+            : '';
+    return {
+        status: 'spm-available',
+        summary: `${url} has a Package.swift on its default branch.${detail}`,
+        repository: url,
+        atLockedVersion: atLocked,
+        via: 'upstream',
+    };
+}
+async function swiftPackageReport(fetcher, pod, { publisher, via }, facts) {
+    // Subdependencies are separate projects (GoogleUtilities, nanopb), so they are looked up upstream.
+    if (publisher?.swiftPackage && !via) {
+        return {
+            status: 'spm-available',
+            summary: `${publisher.swiftPackage.note} (${publisher.source})`,
+            repository: publisher.swiftPackage.url,
+            atLockedVersion: null,
+            via: 'publisher',
+        };
+    }
+    const { source } = pod;
+    if (source.kind === 'git') {
+        const repository = parseGitHubUrl(source.url);
+        if (repository)
+            return upstreamPackage(fetcher, repository, source.tag ?? source.commit ?? null);
+        return {
+            status: 'unknown',
+            summary: `Git source is not on GitHub (${source.url}).`,
+            repository: null,
+            atLockedVersion: null,
+            via: null,
+        };
+    }
+    if (source.kind !== 'trunk') {
+        return {
+            status: 'not-checked',
+            summary: 'Local or private source; podexit does not look it up.',
+            repository: null,
+            atLockedVersion: null,
+            via: null,
+        };
+    }
+    if (facts?.repository)
+        return upstreamPackage(fetcher, facts.repository, facts.tag);
+    const summary = facts?.otherSource
+        ? `The podspec points to ${hostOf(facts.otherSource)}, not a GitHub repository.`
+        : 'No podspec answer from the CocoaPods CDN (offline, or nothing recorded).';
+    return { status: 'unknown', summary, repository: null, atLockedVersion: null, via: null };
+}
+async function analyzePod(pod, classification, fetcher) {
+    const facts = pod.source.kind === 'trunk' ? await trunkFacts(fetcher, pod) : null;
+    return {
+        name: pod.name,
+        version: pod.version,
+        subspecs: pod.subspecs,
+        direct: pod.direct,
+        requiredBy: pod.requiredBy,
+        source: pod.source,
+        updates: updatesReport(pod, classification, facts),
+        swiftPackage: await swiftPackageReport(fetcher, pod, classification, facts),
+    };
+}
+async function mapLimit(items, limit, task) {
+    const results = new Array(items.length);
+    let next = 0;
+    const worker = async () => {
+        while (next < items.length) {
+            const index = next;
+            next += 1;
+            results[index] = await task(items[index]);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+    return results;
+}
+export function summarize(pods) {
+    const count = (predicate) => pods.filter(predicate).length;
+    return {
+        pods: pods.length,
+        direct: count((pod) => pod.direct),
+        frozenOnTrunk: count((pod) => pod.updates.status === 'frozen-on-trunk'),
+        capped: count((pod) => pod.updates.status === 'capped'),
+        notAffected: count((pod) => pod.updates.status === 'not-affected'),
+        unknown: count((pod) => pod.updates.status === 'unknown'),
+        spmAvailable: count((pod) => pod.swiftPackage.status === 'spm-available'),
+        noSpm: count((pod) => pod.swiftPackage.status === 'no-spm'),
+        spmUnknown: count((pod) => pod.swiftPackage.status === 'unknown'),
+    };
+}
+/** Analyzes the text of one Podfile.lock. `path` is only used for display and project detection. */
+export async function analyzeLockfile(text, path, options) {
+    const lockfile = parseLockfile(text);
+    const classifications = classifyLockfile(lockfile.pods, options.policy);
+    const pods = await mapLimit(lockfile.pods, options.concurrency ?? 8, (pod) => analyzePod(pod, classifications.get(pod.name) ?? { status: 'unknown' }, options.fetcher));
+    const project = detectProjectKind(lockfile.pods, path);
+    return {
+        path,
+        project,
+        guide: GUIDES[project],
+        cocoapodsVersion: lockfile.cocoapodsVersion,
+        summary: summarize(pods),
+        pods,
+    };
+}
+/** Wraps lockfile reports with the metadata every output format shows. */
+export function buildReport(lockfiles, context) {
+    return {
+        schemaVersion: SCHEMA_VERSION,
+        tool: { name: 'podexit', version: VERSION },
+        generatedAt: (context.now ?? new Date()).toISOString(),
+        offline: context.offline,
+        timeline: TIMELINE,
+        policyDataVersion: context.policy.dataVersion,
+        notes: [BUILDS_KEEP_WORKING],
+        lockfiles,
+    };
+}
+//# sourceMappingURL=analyze.js.map

package/dist/cli/discover.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Where a Podfile.lock lives in each kind of project, relative to the folder podexit runs in:
+ * a native app keeps it next to the Podfile, Flutter and React Native apps under `ios/` (and
+ * `macos/` for Flutter desktop), and a Flutter plugin under its example app.
+ */
+export declare const LOCKFILE_LOCATIONS: readonly ['Podfile.lock', 'ios/Podfile.lock', 'macos/Podfile.lock', 'example/ios/Podfile.lock', 'example/macos/Podfile.lock'];
+export declare class DiscoveryError extends Error {
+    name: string;
+}
+/**
+ * Turns the paths given on the command line (files or folders; the current folder when none)
+ * into absolute lockfile paths, without duplicates. Throws {@link DiscoveryError} for a path that
+ * does not exist or a folder without a lockfile in any of the {@link LOCKFILE_LOCATIONS}.
+ */
+export declare function findLockfiles(paths: readonly string[], cwd: string): Promise<string[]>;

package/dist/cli/discover.js

@@ -0,0 +1,65 @@
+import { stat } from 'node:fs/promises';
+import { join, relative, resolve } from 'node:path';
+/**
+ * Where a Podfile.lock lives in each kind of project, relative to the folder podexit runs in:
+ * a native app keeps it next to the Podfile, Flutter and React Native apps under `ios/` (and
+ * `macos/` for Flutter desktop), and a Flutter plugin under its example app.
+ */
+export const LOCKFILE_LOCATIONS = [
+    'Podfile.lock',
+    'ios/Podfile.lock',
+    'macos/Podfile.lock',
+    'example/ios/Podfile.lock',
+    'example/macos/Podfile.lock',
+];
+export class DiscoveryError extends Error {
+    name = 'DiscoveryError';
+}
+async function kind(path) {
+    try {
+        const info = await stat(path);
+        if (info.isFile())
+            return 'file';
+        return info.isDirectory() ? 'directory' : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function lockfilesIn(directory) {
+    const found = [];
+    for (const location of LOCKFILE_LOCATIONS) {
+        const candidate = join(directory, location);
+        if ((await kind(candidate)) === 'file')
+            found.push(candidate);
+    }
+    return found;
+}
+/**
+ * Turns the paths given on the command line (files or folders; the current folder when none)
+ * into absolute lockfile paths, without duplicates. Throws {@link DiscoveryError} for a path that
+ * does not exist or a folder without a lockfile in any of the {@link LOCKFILE_LOCATIONS}.
+ */
+export async function findLockfiles(paths, cwd) {
+    const inputs = paths.length > 0 ? paths : ['.'];
+    const found = new Set();
+    for (const input of inputs) {
+        const absolute = resolve(cwd, input);
+        const type = await kind(absolute);
+        if (type === 'file') {
+            found.add(absolute);
+            continue;
+        }
+        if (type === null)
+            throw new DiscoveryError(`${input}: no such file or folder.`);
+        const lockfiles = await lockfilesIn(absolute);
+        if (lockfiles.length === 0) {
+            const where = relative(cwd, absolute) || 'this folder';
+            throw new DiscoveryError(`No Podfile.lock in ${where} (looked for ${LOCKFILE_LOCATIONS.join(', ')}). Run \`pod install\` first, or pass the path to a Podfile.lock.`);
+        }
+        for (const lockfile of lockfiles)
+            found.add(lockfile);
+    }
+    return [...found];
+}
+//# sourceMappingURL=discover.js.map

package/dist/cli/main.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli/main.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { run } from './run.js';
+process.exitCode = await run(process.argv.slice(2), {
+    cwd: process.cwd(),
+    env: process.env,
+    stdout: (text) => process.stdout.write(text),
+    stderr: (text) => process.stderr.write(text),
+    stdoutIsTty: process.stdout.isTTY === true,
+    stderrIsTty: process.stderr.isTTY === true,
+});
+//# sourceMappingURL=main.js.map

package/dist/cli/run.d.ts

@@ -0,0 +1,19 @@
+/** Exit codes; documented in the README and `--help`. */
+export declare const EXIT: {
+    readonly ok: 0;
+    readonly failure: 1;
+    readonly usage: 2;
+};
+/** Everything the CLI touches outside its arguments, so tests can run it in-process. */
+export interface CliEnvironment {
+    cwd: string;
+    env: Record<string, string | undefined>;
+    stdout: (text: string) => void;
+    stderr: (text: string) => void;
+    /** Whether stdout is a terminal; turns colour on for the tty format. */
+    stdoutIsTty: boolean;
+    /** Whether stderr is a terminal; progress lines go there only when it is. */
+    stderrIsTty: boolean;
+}
+/** Runs the CLI with the given arguments (without `node` and the script) and returns the exit code. */
+export declare function run(argv: readonly string[], environment: CliEnvironment): Promise<number>;

package/dist/cli/run.js

@@ -0,0 +1,146 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { relative, resolve } from 'node:path';
+import { Command, CommanderError, InvalidArgumentError, Option } from 'commander';
+import { analyzeLockfile, buildReport } from '../analyze.js';
+import { LockfileError } from '../core/lockfile.js';
+import { loadPublisherPolicy } from '../data.js';
+import { CachedFetcher, defaultCacheDirectory } from '../net/cache.js';
+import { HttpFetcher, OfflineFetcher } from '../net/fetcher.js';
+import { replaceControlCharactersExceptNewlines } from '../report/escape.js';
+import { FORMATS, render } from '../report/index.js';
+import { REPOSITORY_URL } from '../report/labels.js';
+import { VERSION } from '../version.js';
+import { DiscoveryError, findLockfiles } from './discover.js';
+/** Exit codes; documented in the README and `--help`. */
+export const EXIT = { ok: 0, failure: 1, usage: 2 };
+const HELP_AFTER = `
+Exit codes:
+  0  report written
+  1  unexpected error
+  2  bad arguments, no Podfile.lock found, or a file that is not a Podfile.lock
+
+Environment:
+  GITHUB_TOKEN, GH_TOKEN  sent to GitHub only; needed for private upstream repositories
+  PODEXIT_CACHE_DIR       cache folder (default: $XDG_CACHE_HOME/podexit or ~/.cache/podexit)
+  NO_COLOR, FORCE_COLOR   turn terminal colours off or on
+
+Examples:
+  npx @mcamdali/podexit               looks for Podfile.lock, ios/Podfile.lock, example/ios/Podfile.lock
+  npx @mcamdali/podexit ios/Podfile.lock --format markdown --output podexit.md
+  npx @mcamdali/podexit --format json > podexit.json
+  npx @mcamdali/podexit --offline     answers only from the cache
+
+Docs: ${REPOSITORY_URL}#readme`;
+function positiveInteger(value) {
+    const number = Number(value);
+    if (!Number.isInteger(number) || number < 1 || number > 64) {
+        throw new InvalidArgumentError('Use a whole number from 1 to 64.');
+    }
+    return number;
+}
+function program(io) {
+    return new Command('podexit')
+        .description('Shows which CocoaPods dependencies stop getting updates when trunk goes read-only on December 2, 2026, and which already ship a Swift package.')
+        .version(VERSION, '-v, --version')
+        .argument('[paths...]', 'Podfile.lock files or project folders (default: current folder)')
+        .addOption(new Option('-f, --format <format>', 'output format').choices(FORMATS).default('tty'))
+        .option('-o, --output <file>', 'write the report to a file instead of stdout')
+        .option('-a, --all', 'tty format: also list pods from local paths, git and private specs', false)
+        .option('--offline', 'use cached answers only; never touch the network', false)
+        .option('--refresh', 'ignore cached answers and ask the network again', false)
+        .option('--cache-dir <dir>', 'cache folder', io.env.PODEXIT_CACHE_DIR || undefined)
+        .option('--no-color', 'plain text even in a terminal')
+        .option('--concurrency <n>', 'parallel pod lookups', positiveInteger, 8)
+        .addHelpText('after', HELP_AFTER)
+        .showHelpAfterError('(add --help for usage)')
+        .exitOverride()
+        .configureOutput({
+        writeOut: io.stdout,
+        writeErr: io.stderr,
+        outputError: (text, write) => write(text),
+    });
+}
+function useColor(options, io) {
+    if (options.format !== 'tty' || options.output || !options.color)
+        return false;
+    if (io.env.NO_COLOR)
+        return false;
+    if (io.env.FORCE_COLOR && io.env.FORCE_COLOR !== '0')
+        return true;
+    return io.stdoutIsTty;
+}
+function fetcherFor(options, io) {
+    const inner = options.offline
+        ? new OfflineFetcher()
+        : new HttpFetcher({
+            userAgent: `@mcamdali/podexit/${VERSION} (+${REPOSITORY_URL})`,
+            githubToken: io.env.GITHUB_TOKEN || io.env.GH_TOKEN || undefined,
+        });
+    const directory = resolve(io.cwd, options.cacheDir ?? defaultCacheDirectory(io.env));
+    return new CachedFetcher(inner, { directory, refresh: options.refresh });
+}
+async function analyzeAll(paths, options, io) {
+    const lockfiles = await findLockfiles(paths, io.cwd);
+    const policy = loadPublisherPolicy();
+    const fetcher = fetcherFor(options, io);
+    const reports = [];
+    for (const path of lockfiles) {
+        const display = relative(io.cwd, path) || path;
+        if (io.stderrIsTty && !options.offline)
+            io.stderr(`Checking ${display}…\n`);
+        const text = await readFile(path, 'utf8');
+        try {
+            reports.push(await analyzeLockfile(text, display, {
+                fetcher,
+                policy,
+                concurrency: options.concurrency,
+            }));
+        }
+        catch (error) {
+            if (error instanceof LockfileError)
+                throw new LockfileError(`${display}: ${error.message}`);
+            throw error;
+        }
+    }
+    const report = buildReport(reports, { policy, offline: options.offline });
+    return render(report, options.format, { color: useColor(options, io), all: options.all });
+}
+/** Runs the CLI with the given arguments (without `node` and the script) and returns the exit code. */
+export async function run(argv, environment) {
+    // Messages quote paths, arguments and lockfile entries ("Unexpected PODS entry: ..."); an escape
+    // sequence in one of them must not reach the terminal, so every write to stderr is cleaned here.
+    const io = {
+        ...environment,
+        stderr: (text) => environment.stderr(replaceControlCharactersExceptNewlines(text)),
+    };
+    const command = program(io);
+    try {
+        await command.parseAsync([...argv], { from: 'user' });
+    }
+    catch (error) {
+        if (error instanceof CommanderError)
+            return error.exitCode === 0 ? EXIT.ok : EXIT.usage;
+        throw error;
+    }
+    const options = command.opts();
+    try {
+        const output = await analyzeAll(command.processedArgs[0], options, io);
+        if (options.output) {
+            await writeFile(resolve(io.cwd, options.output), output);
+            io.stderr(`Wrote ${options.output}\n`);
+        }
+        else {
+            io.stdout(output);
+        }
+        return EXIT.ok;
+    }
+    catch (error) {
+        if (error instanceof DiscoveryError || error instanceof LockfileError) {
+            io.stderr(`podexit: ${error.message}\n`);
+            return EXIT.usage;
+        }
+        io.stderr(`podexit: ${error instanceof Error ? error.message : String(error)}\n`);
+        return EXIT.failure;
+    }
+}
+//# sourceMappingURL=run.js.map

package/dist/core/classify.d.ts

@@ -0,0 +1,39 @@
+import type { LockedPod } from './lockfile.js';
+import { type Publisher, type PublisherPolicy } from './policy.js';
+/**
+ * What happens to updates for a pod.
+ *
+ * - `frozen-on-trunk`: published on CocoaPods trunk; after trunk goes read-only no new version
+ *   can be published there, including security fixes.
+ * - `capped`: the publisher already stopped releasing to CocoaPods (for example Firebase after
+ *   version 12), so the last version is reached before trunk closes.
+ * - `not-affected`: comes from a local path, a git repository, a podspec file or a private
+ *   specs repository; trunk going read-only does not change how it is updated.
+ * - `unknown`: the lockfile does not say where the pod comes from.
+ */
+export type UpdateStatus = 'frozen-on-trunk' | 'capped' | 'not-affected' | 'unknown';
+/**
+ * Whether the pod's project ships a Swift package.
+ *
+ * - `spm-available`: the upstream repository has a Package.swift (or the publisher documents one).
+ * - `no-spm`: the upstream GitHub repository has no Package.swift on its default branch.
+ * - `unknown`: no answer: the source is not on GitHub, or the network was not available.
+ * - `not-checked`: local and private sources, which podexit does not look up.
+ */
+export type SwiftPackageStatus = 'spm-available' | 'no-spm' | 'unknown' | 'not-checked';
+export interface UpdateClassification {
+    status: UpdateStatus;
+    publisher?: Publisher;
+    /** For a pod capped as a subdependency: the listed pod that pulls it in. */
+    via?: string;
+}
+/** Update status from the lockfile and the publisher policy alone; needs no network. */
+export declare function classifyUpdates(pod: LockedPod, policy: PublisherPolicy): UpdateClassification;
+/**
+ * Update status of every pod in a lockfile. Pods are classified one by one, then trunk pods that a
+ * capped pod depends on (directly or not) are capped too when the publisher's source says its
+ * stop covers subdependencies. Breadth-first from the listed pods, so `via` names the nearest one.
+ */
+export declare function classifyLockfile(pods: readonly LockedPod[], policy: PublisherPolicy): Map<string, UpdateClassification>;
+/** One sentence for each update status, used by every report format. */
+export declare function describeUpdates(status: UpdateStatus, pod: LockedPod, publisher?: Publisher, via?: string): string;