@mcamdali/podexit 0.0.0-stage → 0.1.2

package/dist/net/cache.js

@@ -0,0 +1,89 @@
+import { createHash } from 'node:crypto';
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { z } from 'zod';
+const DAY_MS = 24 * 60 * 60 * 1000;
+const CacheEntry = z.object({
+    url: z.string(),
+    method: z.enum(['GET', 'HEAD']),
+    status: z.number().int(),
+    fetchedAt: z.string(),
+    body: z.string(),
+});
+/** `$XDG_CACHE_HOME/podexit`, or `~/.cache/podexit`. */
+export function defaultCacheDirectory(env = process.env) {
+    const base = env.XDG_CACHE_HOME || join(homedir(), '.cache');
+    return join(base, 'podexit');
+}
+/** Where a URL is stored: one JSON file per request, grouped by host so recordings are readable. */
+export function cachePath(directory, url, method = 'GET') {
+    const host = new URL(url).hostname;
+    const key = createHash('sha256').update(`${method} ${url}`).digest('hex').slice(0, 24);
+    return join(directory, host, `${key}.json`);
+}
+// 404 is a real answer ("this repository has no Package.swift"); 5xx and 429 are not.
+function isDefinitive(status) {
+    return (status >= 200 && status < 300) || status === 404 || status === 410;
+}
+/**
+ * Disk cache in front of another fetcher. The same files serve as the recorded responses that
+ * make `--offline` and the tests work without a network: with an {@link OfflineFetcher} behind
+ * it, every answer comes from disk regardless of age.
+ */
+export class CachedFetcher {
+    inner;
+    options;
+    ttlMs;
+    now;
+    constructor(inner, options) {
+        this.inner = inner;
+        this.options = options;
+        this.ttlMs = options.ttlMs ?? DAY_MS;
+        this.now = options.now ?? (() => new Date());
+    }
+    async get(url, { method = 'GET' } = {}) {
+        const path = cachePath(this.options.directory, url, method);
+        const cached = await this.read(path);
+        const age = cached
+            ? this.now().getTime() - Date.parse(cached.fetchedAt)
+            : Number.POSITIVE_INFINITY;
+        if (cached && !this.options.refresh && age < this.ttlMs)
+            return cached;
+        const fresh = await this.inner.get(url, { method });
+        if (fresh && isDefinitive(fresh.status)) {
+            await this.write(path, {
+                url,
+                method,
+                status: fresh.status,
+                fetchedAt: this.now().toISOString(),
+                body: fresh.body,
+            });
+            return fresh;
+        }
+        // Offline, or the server had a bad moment: an old answer is better than none.
+        return cached ?? fresh;
+    }
+    async read(path) {
+        try {
+            const parsed = CacheEntry.safeParse(JSON.parse(await readFile(path, 'utf8')));
+            return parsed.success ? parsed.data : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async write(path, entry) {
+        try {
+            await mkdir(join(path, '..'), { recursive: true });
+            // Write then rename, so a parallel run never reads half a file.
+            const temporary = `${path}.${process.pid}.tmp`;
+            await writeFile(temporary, `${JSON.stringify(entry, null, 2)}\n`);
+            await rename(temporary, path);
+        }
+        catch {
+            // A read-only or full disk only costs the cache, not the run.
+        }
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/net/cocoapods.d.ts

@@ -0,0 +1,34 @@
+import { z } from 'zod';
+import type { Fetcher } from './fetcher.js';
+export declare const CDN = "https://cdn.cocoapods.org";
+export declare const TRUNK_API = "https://trunk.cocoapods.org/api/v1";
+/** The CDN shards pods by the first three hex digits of the MD5 of the pod name. */
+export declare function shard(name: string): [string, string, string];
+/** URL of the CDN index file that lists every published version of `name`. */
+export declare function versionsIndexUrl(name: string): string;
+export declare function podspecUrl(name: string, version: string): string;
+export declare function trunkPodUrl(name: string): string;
+/**
+ * Published versions of a pod on trunk, in CDN order (not sorted). Empty when trunk has never
+ * heard of the pod; null when the CDN could not be reached.
+ */
+export declare function trunkVersions(fetcher: Fetcher, name: string): Promise<string[] | null>;
+declare const Podspec: z.ZodObject<{
+    name: z.ZodString;
+    version: z.ZodString;
+    homepage: z.ZodOptional<z.ZodString>;
+    source: z.ZodOptional<z.ZodObject<{
+        git: z.ZodOptional<z.ZodString>;
+        tag: z.ZodOptional<z.ZodString>;
+        http: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+export type Podspec = z.infer<typeof Podspec>;
+/** The published podspec of one version, or null when it is not available. */
+export declare function fetchPodspec(fetcher: Fetcher, name: string, version: string): Promise<Podspec | null>;
+/**
+ * Publication date of each version, from the trunk API (the CDN has no dates). Keys are versions,
+ * values ISO dates. Null when the API could not be reached.
+ */
+export declare function releaseDates(fetcher: Fetcher, name: string): Promise<Map<string, string> | null>;
+export {};

package/dist/net/cocoapods.js

@@ -0,0 +1,83 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+export const CDN = 'https://cdn.cocoapods.org';
+export const TRUNK_API = 'https://trunk.cocoapods.org/api/v1';
+/** The CDN shards pods by the first three hex digits of the MD5 of the pod name. */
+export function shard(name) {
+    const hash = createHash('md5').update(name).digest('hex');
+    return [hash.charAt(0), hash.charAt(1), hash.charAt(2)];
+}
+/** URL of the CDN index file that lists every published version of `name`. */
+export function versionsIndexUrl(name) {
+    return `${CDN}/all_pods_versions_${shard(name).join('_')}.txt`;
+}
+export function podspecUrl(name, version) {
+    const path = [...shard(name), name, version, `${name}.podspec.json`].map(encodeURIComponent);
+    return `${CDN}/Specs/${path.join('/')}`;
+}
+export function trunkPodUrl(name) {
+    return `${TRUNK_API}/pods/${encodeURIComponent(name)}`;
+}
+/**
+ * Published versions of a pod on trunk, in CDN order (not sorted). Empty when trunk has never
+ * heard of the pod; null when the CDN could not be reached.
+ */
+export async function trunkVersions(fetcher, name) {
+    const response = await fetcher.get(versionsIndexUrl(name));
+    if (response?.status !== 200)
+        return null;
+    // Each line is "Name/1.0.0/1.0.1/...".
+    const line = response.body.split('\n').find((candidate) => candidate.startsWith(`${name}/`));
+    return line ? line.trim().split('/').slice(1).filter(Boolean) : [];
+}
+const Podspec = z.looseObject({
+    name: z.string(),
+    version: z.string(),
+    homepage: z.string().optional(),
+    source: z
+        .looseObject({
+        git: z.string().optional(),
+        tag: z.string().optional(),
+        http: z.string().optional(),
+    })
+        .optional(),
+});
+/** The published podspec of one version, or null when it is not available. */
+export async function fetchPodspec(fetcher, name, version) {
+    const response = await fetcher.get(podspecUrl(name, version));
+    if (response?.status !== 200)
+        return null;
+    try {
+        const parsed = Podspec.safeParse(JSON.parse(response.body));
+        return parsed.success ? parsed.data : null;
+    }
+    catch {
+        return null;
+    }
+}
+const TrunkPod = z.object({
+    versions: z.array(z.object({ name: z.string(), created_at: z.string() })),
+});
+/**
+ * Publication date of each version, from the trunk API (the CDN has no dates). Keys are versions,
+ * values ISO dates. Null when the API could not be reached.
+ */
+export async function releaseDates(fetcher, name) {
+    const response = await fetcher.get(trunkPodUrl(name));
+    if (response?.status !== 200)
+        return null;
+    try {
+        const parsed = TrunkPod.safeParse(JSON.parse(response.body));
+        if (!parsed.success)
+            return null;
+        // "2024-11-25 15:15:33 UTC" -> "2024-11-25T15:15:33Z"
+        return new Map(parsed.data.versions.map(({ name: version, created_at }) => [
+            version,
+            new Date(created_at.replace(' UTC', 'Z').replace(' ', 'T')).toISOString(),
+        ]));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=cocoapods.js.map

package/dist/net/fetcher.d.ts

@@ -0,0 +1,33 @@
+/** The answer to one request; only the status and text body are kept. */
+export interface Response {
+    status: number;
+    body: string;
+}
+export interface RequestOptions {
+    /** `HEAD` for existence checks, where only the status matters. */
+    method?: 'GET' | 'HEAD';
+}
+/**
+ * Everything podexit reads from the network goes through a Fetcher, so tests and `--offline`
+ * runs can answer from recorded responses. `null` means the answer is not available (no
+ * network, a timeout, or nothing recorded); callers report that as "unknown" instead of failing.
+ */
+export interface Fetcher {
+    get(url: string, options?: RequestOptions): Promise<Response | null>;
+}
+export interface HttpFetcherOptions {
+    userAgent: string;
+    /** Sent to github.com hosts only; raises the GitHub rate limit and allows private repositories. */
+    githubToken?: string | undefined;
+    timeoutMs?: number;
+}
+/** Fetcher backed by the platform `fetch`. Redirects are followed (the CDN redirects to jsDelivr). */
+export declare class HttpFetcher implements Fetcher {
+    private readonly options;
+    constructor(options: HttpFetcherOptions);
+    get(url: string, { method }?: RequestOptions): Promise<Response | null>;
+}
+/** Fetcher that never touches the network; used with `--offline` behind the cache. */
+export declare class OfflineFetcher implements Fetcher {
+    get(): Promise<Response | null>;
+}

package/dist/net/fetcher.js

@@ -0,0 +1,35 @@
+const GITHUB_HOSTS = new Set(['api.github.com', 'raw.githubusercontent.com']);
+const DEFAULT_TIMEOUT_MS = 15_000;
+/** Fetcher backed by the platform `fetch`. Redirects are followed (the CDN redirects to jsDelivr). */
+export class HttpFetcher {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async get(url, { method = 'GET' } = {}) {
+        const headers = { 'user-agent': this.options.userAgent };
+        if (this.options.githubToken && GITHUB_HOSTS.has(new URL(url).hostname)) {
+            headers.authorization = `Bearer ${this.options.githubToken}`;
+        }
+        try {
+            const response = await fetch(url, {
+                method,
+                headers,
+                redirect: 'follow',
+                signal: AbortSignal.timeout(this.options.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+            });
+            const body = method === 'HEAD' ? '' : await response.text();
+            return { status: response.status, body };
+        }
+        catch {
+            return null;
+        }
+    }
+}
+/** Fetcher that never touches the network; used with `--offline` behind the cache. */
+export class OfflineFetcher {
+    async get() {
+        return null;
+    }
+}
+//# sourceMappingURL=fetcher.js.map

package/dist/net/github.d.ts

@@ -0,0 +1,14 @@
+import type { Fetcher } from './fetcher.js';
+export interface GitHubRepository {
+    owner: string;
+    name: string;
+}
+/** Owner and name from a GitHub URL in any of the forms podspecs use; null for other hosts. */
+export declare function parseGitHubUrl(url: string | undefined): GitHubRepository | null;
+export declare function repositoryUrl({ owner, name }: GitHubRepository): string;
+/**
+ * Whether `Package.swift` exists at `ref` (a branch, tag or `HEAD` for the default branch).
+ * Uses raw.githubusercontent.com, which does not count against the REST API's 60 requests per
+ * hour. Null when the answer is not available.
+ */
+export declare function hasPackageManifest(fetcher: Fetcher, repository: GitHubRepository, ref?: string): Promise<boolean | null>;

package/dist/net/github.js

@@ -0,0 +1,42 @@
+const PATTERNS = [
+    // https://github.com/Alamofire/Alamofire.git, http://www.github.com/x/y/, git://github.com/x/y
+    /^(?:git\+)?(?:https?|git|ssh):\/\/(?:[^@/]+@)?(?:www\.)?github\.com\/([^/\s]+)\/([^/\s#?]+?)(?:\.git)?\/?(?:[#?].*)?$/i,
+    // git@github.com:Alamofire/Alamofire.git
+    /^[^@\s]+@github\.com:([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/i,
+];
+/** Owner and name from a GitHub URL in any of the forms podspecs use; null for other hosts. */
+export function parseGitHubUrl(url) {
+    if (!url)
+        return null;
+    for (const pattern of PATTERNS) {
+        const match = pattern.exec(url.trim());
+        if (match?.[1] && match[2])
+            return { owner: match[1], name: match[2] };
+    }
+    return null;
+}
+export function repositoryUrl({ owner, name }) {
+    return `https://github.com/${owner}/${name}`;
+}
+/**
+ * Whether `Package.swift` exists at `ref` (a branch, tag or `HEAD` for the default branch).
+ * Uses raw.githubusercontent.com, which does not count against the REST API's 60 requests per
+ * hour. Null when the answer is not available.
+ */
+export async function hasPackageManifest(fetcher, repository, ref = 'HEAD') {
+    // Tags such as `CocoaPods-12.4.0` pass through; a branch name may contain slashes.
+    const owner = encodeURIComponent(repository.owner);
+    const name = encodeURIComponent(repository.name);
+    const path = `${owner}/${name}/${encodeURI(ref)}`;
+    const response = await fetcher.get(`https://raw.githubusercontent.com/${path}/Package.swift`, {
+        method: 'HEAD',
+    });
+    if (!response)
+        return null;
+    if (response.status === 200)
+        return true;
+    if (response.status === 404)
+        return false;
+    return null;
+}
+//# sourceMappingURL=github.js.map

package/dist/report/escape.d.ts

@@ -0,0 +1,17 @@
+/** Replaces control characters with U+FFFD, so they show up instead of acting on the terminal. */
+export declare const replaceControlCharacters: (text: string) => string;
+/** For messages on stderr: replaces control characters with U+FFFD and keeps line breaks. */
+export declare const replaceControlCharactersExceptNewlines: (text: string) => string;
+/** A copy of a report (or any part of one) with every string passed through replaceControlCharacters. */
+export declare function withoutControlCharacters<T>(value: T): T;
+/**
+ * Markdown code span for text from the lockfile or the registries. Nothing inside a code span is
+ * markup (no HTML, links, autolinks or @mentions), so the text only has to keep the span closed:
+ * the fence is one backtick longer than the longest run of backticks in the text, and a space pads
+ * text that starts or ends with a backtick or a space (Markdown strips one from each side).
+ */
+export declare function markdownCode(text: string): string;
+/** GitHub splits table rows on `|` before anything else, code spans included. */
+export declare const escapeTableCell: (text: string) => string;
+/** An http(s) URL that is safe as a Markdown link destination, or null for anything else. */
+export declare function markdownUrl(text: string): string | null;

package/dist/report/escape.js

@@ -0,0 +1,54 @@
+// Pod names, versions and paths come from the lockfile, the file system and the registries. The
+// helpers here make sure none of them can act on the terminal or on rendered Markdown.
+// C0 controls (tab and newline included), DEL and C1 controls. An escape sequence in a pod name
+// would otherwise reach the terminal as is and could recolour or rewrite what is on screen.
+// biome-ignore lint/suspicious/noControlCharactersInRegex: matching control characters is the point.
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f]/g;
+/** Replaces control characters with U+FFFD, so they show up instead of acting on the terminal. */
+export const replaceControlCharacters = (text) => text.replace(CONTROL_CHARACTERS, '\ufffd');
+// The same characters except the newline, for messages that may span lines.
+// biome-ignore lint/suspicious/noControlCharactersInRegex: matching control characters is the point.
+const CONTROL_CHARACTERS_EXCEPT_NEWLINE = /[\u0000-\u0009\u000b-\u001f\u007f-\u009f]/g;
+/** For messages on stderr: replaces control characters with U+FFFD and keeps line breaks. */
+export const replaceControlCharactersExceptNewlines = (text) => text.replace(CONTROL_CHARACTERS_EXCEPT_NEWLINE, '\ufffd');
+/** A copy of a report (or any part of one) with every string passed through replaceControlCharacters. */
+export function withoutControlCharacters(value) {
+    if (typeof value === 'string')
+        return replaceControlCharacters(value);
+    if (Array.isArray(value))
+        return value.map(withoutControlCharacters);
+    if (value === null || typeof value !== 'object')
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, withoutControlCharacters(item)]));
+}
+const BACKTICK_RUNS = /`+/g;
+/**
+ * Markdown code span for text from the lockfile or the registries. Nothing inside a code span is
+ * markup (no HTML, links, autolinks or @mentions), so the text only has to keep the span closed:
+ * the fence is one backtick longer than the longest run of backticks in the text, and a space pads
+ * text that starts or ends with a backtick or a space (Markdown strips one from each side).
+ */
+export function markdownCode(text) {
+    if (!text)
+        return '';
+    const longestRun = Math.max(0, ...(text.match(BACKTICK_RUNS) ?? []).map((run) => run.length));
+    const fence = '`'.repeat(longestRun + 1);
+    const padding = /^[ `]|[ `]$/.test(text) && text.trim() !== '' ? ' ' : '';
+    return `${fence}${padding}${text}${padding}${fence}`;
+}
+/** GitHub splits table rows on `|` before anything else, code spans included. */
+export const escapeTableCell = (text) => text.replace(/\|/g, '\\|');
+// Characters a link destination may keep. The rest is percent-encoded, so a URL cannot close the
+// link with `)`, open a new one, start an HTML tag or bring an entity such as `/`.
+const URL_UNSAFE = /[^A-Za-z0-9\-._~:/?#@!$+,;=%]/g;
+const percentEncode = (character) => [...new TextEncoder().encode(character)]
+    .map((byte) => `%${byte.toString(16).toUpperCase().padStart(2, '0')}`)
+    .join('');
+/** An http(s) URL that is safe as a Markdown link destination, or null for anything else. */
+export function markdownUrl(text) {
+    const url = URL.parse(text);
+    if (url?.protocol !== 'https:' && url?.protocol !== 'http:')
+        return null;
+    return url.href.replace(URL_UNSAFE, percentEncode);
+}
+//# sourceMappingURL=escape.js.map

package/dist/report/index.d.ts

@@ -0,0 +1,11 @@
+import type { Report } from '../analyze.js';
+import { type TtyOptions } from './tty.js';
+export declare const FORMATS: readonly ['tty', 'json', 'markdown'];
+export type Format = (typeof FORMATS)[number];
+/**
+ * Renders a report in one of the supported formats. This is the one way out for a report: every
+ * string in it has its control characters replaced here, whatever the format, before anything
+ * reaches a terminal, a file or a pull request comment.
+ */
+export declare function render(input: Report, format: Format, tty?: TtyOptions): string;
+export type { TtyOptions };

package/dist/report/index.js

@@ -0,0 +1,21 @@
+import { withoutControlCharacters } from './escape.js';
+import { renderMarkdown } from './markdown.js';
+import { renderTty } from './tty.js';
+export const FORMATS = ['tty', 'json', 'markdown'];
+/**
+ * Renders a report in one of the supported formats. This is the one way out for a report: every
+ * string in it has its control characters replaced here, whatever the format, before anything
+ * reaches a terminal, a file or a pull request comment.
+ */
+export function render(input, format, tty = { color: false, all: false }) {
+    const report = withoutControlCharacters(input);
+    switch (format) {
+        case 'json':
+            return `${JSON.stringify(report, null, 2)}\n`;
+        case 'markdown':
+            return renderMarkdown(report);
+        case 'tty':
+            return renderTty(report, tty);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/report/labels.d.ts

@@ -0,0 +1,22 @@
+import type { PodReport, Summary } from '../analyze.js';
+export declare const REPOSITORY_URL = "https://github.com/muhittincamdali/podexit";
+/** Short label for the UPDATES column. */
+export declare function updatesLabel(pod: PodReport): string;
+/** Short label for the SWIFT PACKAGE column. */
+export declare function swiftPackageLabel(pod: PodReport): string;
+/** Display order: capped, frozen, unknown, not affected; Podfile pods before transitive ones. */
+export declare function orderPods(pods: readonly PodReport[]): PodReport[];
+/** "FirebaseAnalytics" or "FirebaseAnalytics +2" for pods pulled in by others. */
+export declare function requiredByLabel(pod: PodReport): string;
+export declare function guideUrl(path: string): string;
+export declare const plural: (count: number, word: string) => string;
+/** Two summary lines shared by the terminal and Markdown reports. */
+export declare function summaryLines(summary: Summary): [string, string];
+export declare function podsHeadline(summary: Summary): string;
+export declare const PROJECT_LABELS: {
+    readonly native: 'native iOS app';
+    readonly 'flutter-app': 'Flutter app';
+    readonly 'flutter-plugin': 'Flutter plugin example app';
+    readonly 'react-native': 'React Native app';
+    readonly expo: 'Expo app';
+};

package/dist/report/labels.js

@@ -0,0 +1,82 @@
+export const REPOSITORY_URL = 'https://github.com/muhittincamdali/podexit';
+/** Short label for the UPDATES column. */
+export function updatesLabel(pod) {
+    switch (pod.updates.status) {
+        case 'frozen-on-trunk':
+            return 'frozen after Dec 2';
+        case 'capped':
+            if (pod.updates.via)
+                return `capped with ${pod.updates.publisher?.name ?? '?'}`;
+            return `capped at ${pod.updates.publisher?.lastMajorOnCocoaPods ?? '?'}.x`;
+        case 'not-affected':
+            return 'not affected';
+        case 'unknown':
+            return 'unknown source';
+    }
+}
+/** Short label for the SWIFT PACKAGE column. */
+export function swiftPackageLabel(pod) {
+    const { status, via, atLockedVersion } = pod.swiftPackage;
+    switch (status) {
+        case 'spm-available':
+            if (via === 'publisher')
+                return `yes (${pod.updates.publisher?.name ?? 'publisher'})`;
+            return atLockedVersion === false ? 'yes, newer versions' : 'yes';
+        case 'no-spm':
+            return 'no';
+        case 'unknown':
+            return 'unknown';
+        case 'not-checked':
+            return '-';
+    }
+}
+const STATUS_ORDER = {
+    capped: 0,
+    'frozen-on-trunk': 1,
+    unknown: 2,
+    'not-affected': 3,
+};
+/** Display order: capped, frozen, unknown, not affected; Podfile pods before transitive ones. */
+export function orderPods(pods) {
+    return [...pods].sort((a, b) => STATUS_ORDER[a.updates.status] - STATUS_ORDER[b.updates.status] ||
+        Number(b.direct) - Number(a.direct) ||
+        a.name.localeCompare(b.name, 'en'));
+}
+/** "FirebaseAnalytics" or "FirebaseAnalytics +2" for pods pulled in by others. */
+export function requiredByLabel(pod) {
+    if (pod.direct || pod.requiredBy.length === 0)
+        return '';
+    const [first, ...rest] = pod.requiredBy;
+    return rest.length > 0 ? `${first} +${rest.length}` : (first ?? '');
+}
+export function guideUrl(path) {
+    return `${REPOSITORY_URL}/blob/main/${path}`;
+}
+export const plural = (count, word) => `${count} ${word}${count === 1 ? '' : 's'}`;
+/** Two summary lines shared by the terminal and Markdown reports. */
+export function summaryLines(summary) {
+    return [
+        [
+            `${summary.frozenOnTrunk} frozen on trunk`,
+            `${summary.capped} capped by the publisher`,
+            `${summary.notAffected} not affected`,
+            ...(summary.unknown ? [`${summary.unknown} without a source`] : []),
+        ].join(' · '),
+        [
+            `${plural(summary.spmAvailable, 'pod')} with a Swift package`,
+            `${summary.noSpm} without`,
+            `${summary.spmUnknown} unknown`,
+        ].join(' · '),
+    ];
+}
+export function podsHeadline(summary) {
+    return `${plural(summary.pods, 'pod')}, ${summary.direct} in the Podfile`;
+}
+export const PROJECT_LABELS = {
+    native: 'native iOS app',
+    'flutter-app': 'Flutter app',
+    'flutter-plugin': 'Flutter plugin example app',
+    'react-native': 'React Native app',
+    expo: 'Expo app',
+};
+//# sourceMappingURL=labels.js.map

package/dist/report/markdown.d.ts

@@ -0,0 +1,6 @@
+import type { Report } from '../analyze.js';
+/**
+ * GitHub-flavoured Markdown, for pull request comments, issues and MIGRATION notes. Called through
+ * `render`, which has already replaced control characters in the report.
+ */
+export declare function renderMarkdown(report: Report): string;

package/dist/report/markdown.js

@@ -0,0 +1,75 @@
+import { guideUrl, orderPods, PROJECT_LABELS, plural, podsHeadline, requiredByLabel, summaryLines, swiftPackageLabel, updatesLabel, } from './labels.js';
+import { escapeTableCell, markdownCode, markdownUrl } from './escape.js';
+// Names, versions and paths come from the lockfile and the registries, so they go into code spans,
+// where Markdown and HTML have no effect. Labels and links are podexit's own text.
+const code = (text) => escapeTableCell(markdownCode(text));
+const DATE = /^\d{4}-\d{2}-\d{2}$/;
+function latestCell(pod) {
+    const { latestOnTrunk, latestReleasedAt } = pod.updates;
+    if (!latestOnTrunk)
+        return '';
+    const date = latestReleasedAt?.slice(0, 10) ?? '';
+    return DATE.test(date) ? `${code(latestOnTrunk)} (${date})` : code(latestOnTrunk);
+}
+function swiftPackageCell(pod) {
+    const label = swiftPackageLabel(pod);
+    const url = pod.swiftPackage.repository ? markdownUrl(pod.swiftPackage.repository) : null;
+    return url && pod.swiftPackage.status !== 'not-checked' ? `[${label}](${url})` : label;
+}
+function podTable(pods) {
+    return [
+        '| Pod | Locked | Latest on trunk | Updates | Swift package | Pulled in by |',
+        '| --- | --- | --- | --- | --- | --- |',
+        ...pods.map((pod) => [
+            code(pod.name),
+            code(pod.version),
+            latestCell(pod),
+            updatesLabel(pod),
+            swiftPackageCell(pod),
+            code(requiredByLabel(pod)),
+        ]
+            .join(' | ')
+            .replace(/^/, '| ')
+            .replace(/$/, ' |')),
+    ];
+}
+function lockfileSection(lockfile) {
+    const ordered = orderPods(lockfile.pods);
+    const trunk = ordered.filter((pod) => pod.updates.status !== 'not-affected');
+    const other = ordered.filter((pod) => pod.updates.status === 'not-affected');
+    const [updates, packages] = summaryLines(lockfile.summary);
+    const lines = [
+        `## ${markdownCode(lockfile.path)}`,
+        '',
+        `${PROJECT_LABELS[lockfile.project]}, ${podsHeadline(lockfile.summary)}.`,
+        '',
+        `- ${updates}`,
+        `- ${packages}`,
+        `- Guide: [${lockfile.guide.title}](${guideUrl(lockfile.guide.path)})`,
+        '',
+    ];
+    lines.push(...(trunk.length > 0 ? podTable(trunk) : ['No pods from CocoaPods trunk.']), '');
+    if (other.length > 0) {
+        lines.push('<details>', `<summary>${plural(other.length, 'pod')} from local paths, git or private specs (not affected)</summary>`, '', ...podTable(other), '', '</details>', '');
+    }
+    return lines;
+}
+/**
+ * GitHub-flavoured Markdown, for pull request comments, issues and MIGRATION notes. Called through
+ * `render`, which has already replaced control characters in the report.
+ */
+export function renderMarkdown(report) {
+    const { timeline } = report;
+    const lines = [
+        '# podexit report',
+        '',
+        `CocoaPods trunk goes read-only on **${timeline.readOnly}**, after a trial run from ${timeline.trialRun.from} to ${timeline.trialRun.to} ([announcement](${timeline.source})). ${report.notes.join(' ')}`,
+        '',
+    ];
+    for (const lockfile of report.lockfiles)
+        lines.push(...lockfileSection(lockfile));
+    const offline = report.offline ? ', offline' : '';
+    lines.push(`<sub>podexit ${report.tool.version}, ${report.generatedAt.slice(0, 10)}${offline}, publisher data ${report.policyDataVersion}</sub>`);
+    return `${lines.join('\n')}\n`;
+}
+//# sourceMappingURL=markdown.js.map

package/dist/report/tty.d.ts

@@ -0,0 +1,12 @@
+import type { Report } from '../analyze.js';
+export interface TtyOptions {
+    /** ANSI colours; the CLI turns them on for terminals unless NO_COLOR is set. */
+    color: boolean;
+    /** Also list pods that come from local paths, git or private specs. */
+    all: boolean;
+}
+/**
+ * Plain-text table for terminals. Colours are optional; the text is the same either way. Called
+ * through `render`, which has already replaced control characters in the report.
+ */
+export declare function renderTty(report: Report, options: TtyOptions): string;