@rainy-updates/cli 0.5.1-rc.2 → 0.5.1

package/dist/core/fix-pr-batch.js

@@ -4,11 +4,12 @@ import os from "node:os";
 import path from "node:path";
 import { readManifest, writeManifest } from "../parsers/package-json.js";
 export async function applyFixPrBatches(options, result) {
-    if (!options.fixPr || result.updates.length === 0) {
+    const autofixUpdates = result.updates.filter((update) => update.autofix !== false);
+    if (!options.fixPr || autofixUpdates.length === 0) {
         return { applied: false, branches: [], commits: [] };
     }
     const baseRef = await resolveBaseRef(options.cwd, options.fixPrNoCheckout);
-    const groups = groupUpdates(result.updates, options.groupBy);
+    const groups = groupUpdates(autofixUpdates, options.groupBy);
     const plans = planFixPrBatches(groups, options.fixBranch ?? "chore/rainy-updates", options.fixPrBatchSize ?? 1);
     if (options.fixDryRun) {
         return { applied: false, branches: plans.map((plan) => plan.branchName), commits: [] };

package/dist/core/fix-pr.js

@@ -3,7 +3,8 @@ import path from "node:path";
 export async function applyFixPr(options, result, extraFiles) {
     if (!options.fixPr)
         return { applied: false };
-    if (result.updates.length === 0) {
+    const autofixUpdates = result.updates.filter((update) => update.autofix !== false);
+    if (autofixUpdates.length === 0) {
         return {
             applied: false,
             branchName: options.fixBranch ?? "chore/rainy-updates",
@@ -35,8 +36,11 @@ export async function applyFixPr(options, result, extraFiles) {
             commitSha: "",
         };
     }
-    const manifestFiles = Array.from(new Set(result.updates.map((update) => path.resolve(update.packagePath, "package.json"))));
-    const filesToStage = Array.from(new Set([...manifestFiles, ...extraFiles]
+    const manifestFiles = Array.from(new Set(autofixUpdates.map((update) => path.resolve(update.packagePath, "package.json"))));
+    const lockfileFiles = options.lockfileMode === "update"
+        ? (await collectChangedLockfiles(options.cwd)).map((entry) => path.resolve(options.cwd, entry))
+        : [];
+    const filesToStage = Array.from(new Set([...manifestFiles, ...extraFiles, ...lockfileFiles]
         .map((entry) => path.resolve(options.cwd, entry))
         .filter((entry) => entry.startsWith(path.resolve(options.cwd) + path.sep) || entry === path.resolve(options.cwd)))).sort((a, b) => a.localeCompare(b));
     if (filesToStage.length > 0) {
@@ -50,7 +54,7 @@ export async function applyFixPr(options, result, extraFiles) {
             commitSha: "",
         };
     }
-    const message = options.fixCommitMessage ?? `chore(deps): apply rainy-updates (${result.updates.length} updates)`;
+    const message = options.fixCommitMessage ?? `chore(deps): apply rainy-updates (${autofixUpdates.length} updates)`;
     await runGit(options.cwd, ["commit", "-m", message]);
     const rev = await runGit(options.cwd, ["rev-parse", "HEAD"]);
     return {
@@ -81,3 +85,14 @@ async function runGit(cwd, args, allowNonZero = false) {
         });
     });
 }
+async function collectChangedLockfiles(cwd) {
+    const status = await runGit(cwd, ["status", "--porcelain"], true);
+    const allowed = new Set(["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock"]);
+    const changed = status.stdout
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean)
+        .map((line) => line.slice(3).trim())
+        .filter((entry) => allowed.has(path.basename(entry)));
+    return Array.from(new Set(changed)).sort((a, b) => a.localeCompare(b));
+}

package/dist/core/init-ci.js

@@ -46,14 +46,14 @@ function installStep(packageManager) {
     return `      - name: Install dependencies\n        run: npm ci`;
 }
 function minimalWorkflowTemplate(scheduleBlock, packageManager) {
-    return `name: Rainy Updates\n\non:\n${scheduleBlock}\n\njobs:\n  dependency-check:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Checkout\n        uses: actions/checkout@v4\n\n      - name: Setup Node\n        uses: actions/setup-node@v4\n        with:\n          node-version: '20'\n\n${installStep(packageManager)}\n\n      - name: Run dependency check\n        run: |\n          npx @rainy-updates/cli ci \\\n            --workspace \\\n            --mode minimal \\\n            --ci \\\n            --format table\n`;
+    return `name: Rainy Updates\n\non:\n${scheduleBlock}\n\njobs:\n  dependency-check:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Checkout\n        uses: actions/checkout@v4\n\n      - name: Setup Node\n        uses: actions/setup-node@v4\n        with:\n          node-version: '20'\n\n${installStep(packageManager)}\n\n      - name: Run dependency check\n        run: |\n          npx @rainy-updates/cli ci \\\n            --workspace \\\n            --mode minimal \\\n            --ci \\\n            --stream \\\n            --registry-timeout-ms 12000 \\\n            --registry-retries 4 \\\n            --format table\n`;
 }
 function strictWorkflowTemplate(scheduleBlock, packageManager) {
-    return `name: Rainy Updates\n\non:\n${scheduleBlock}\n\npermissions:\n  contents: read\n  security-events: write\n\njobs:\n  dependency-check:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Checkout\n        uses: actions/checkout@v4\n\n      - name: Setup Node\n        uses: actions/setup-node@v4\n        with:\n          node-version: '20'\n\n${installStep(packageManager)}\n\n      - name: Warm cache\n        run: npx @rainy-updates/cli warm-cache --workspace --concurrency 32\n\n      - name: Run strict dependency check\n        run: |\n          npx @rainy-updates/cli ci \\\n            --workspace \\\n            --mode strict \\\n            --ci \\\n            --concurrency 32 \\\n            --format github \\\n            --json-file .artifacts/deps-report.json \\\n            --pr-report-file .artifacts/deps-report.md \\\n            --sarif-file .artifacts/deps-report.sarif \\\n            --github-output $GITHUB_OUTPUT\n\n      - name: Upload report artifacts\n        uses: actions/upload-artifact@v4\n        with:\n          name: rainy-updates-report\n          path: .artifacts/\n\n      - name: Upload SARIF\n        uses: github/codeql-action/upload-sarif@v3\n        with:\n          sarif_file: .artifacts/deps-report.sarif\n`;
+    return `name: Rainy Updates\n\non:\n${scheduleBlock}\n\npermissions:\n  contents: read\n  security-events: write\n\njobs:\n  dependency-check:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Checkout\n        uses: actions/checkout@v4\n\n      - name: Setup Node\n        uses: actions/setup-node@v4\n        with:\n          node-version: '20'\n\n${installStep(packageManager)}\n\n      - name: Warm cache\n        run: npx @rainy-updates/cli warm-cache --workspace --concurrency 32 --registry-timeout-ms 12000 --registry-retries 4\n\n      - name: Run strict dependency check\n        run: |\n          npx @rainy-updates/cli ci \\\n            --workspace \\\n            --mode strict \\\n            --ci \\\n            --concurrency 32 \\\n            --stream \\\n            --registry-timeout-ms 12000 \\\n            --registry-retries 4 \\\n            --format github \\\n            --json-file .artifacts/deps-report.json \\\n            --pr-report-file .artifacts/deps-report.md \\\n            --sarif-file .artifacts/deps-report.sarif \\\n            --github-output $GITHUB_OUTPUT\n\n      - name: Upload report artifacts\n        uses: actions/upload-artifact@v4\n        with:\n          name: rainy-updates-report\n          path: .artifacts/\n\n      - name: Upload SARIF\n        uses: github/codeql-action/upload-sarif@v3\n        with:\n          sarif_file: .artifacts/deps-report.sarif\n`;
 }
 function enterpriseWorkflowTemplate(scheduleBlock, packageManager) {
     const detectedPmInstall = packageManager === "pnpm"
         ? "corepack enable && corepack prepare pnpm@9 --activate && pnpm install --frozen-lockfile"
         : "npm ci";
-    return `name: Rainy Updates Enterprise\n\non:\n${scheduleBlock}\n\npermissions:\n  contents: read\n  security-events: write\n  actions: read\n\nconcurrency:\n  group: rainy-updates-\${{ github.ref }}\n  cancel-in-progress: false\n\njobs:\n  dependency-check:\n    runs-on: ubuntu-latest\n    strategy:\n      fail-fast: false\n      matrix:\n        node: [20, 22]\n    steps:\n      - name: Checkout\n        uses: actions/checkout@v4\n\n      - name: Setup Node\n        uses: actions/setup-node@v4\n        with:\n          node-version: \${{ matrix.node }}\n\n      - name: Install dependencies\n        run: ${detectedPmInstall}\n\n      - name: Warm cache\n        run: npx @rainy-updates/cli warm-cache --workspace --concurrency 32\n\n      - name: Check updates with rollout controls\n        run: |\n          npx @rainy-updates/cli ci \\\n            --workspace \\\n            --mode enterprise \\\n            --concurrency 32 \\\n            --format github \\\n            --fail-on minor \\\n            --max-updates 50 \\\n            --json-file .artifacts/deps-report-node-\${{ matrix.node }}.json \\\n            --pr-report-file .artifacts/deps-report-node-\${{ matrix.node }}.md \\\n            --sarif-file .artifacts/deps-report-node-\${{ matrix.node }}.sarif \\\n            --github-output $GITHUB_OUTPUT\n\n      - name: Upload report artifacts\n        uses: actions/upload-artifact@v4\n        with:\n          name: rainy-updates-report-node-\${{ matrix.node }}\n          path: .artifacts/\n          retention-days: 14\n\n      - name: Upload SARIF\n        uses: github/codeql-action/upload-sarif@v3\n        with:\n          sarif_file: .artifacts/deps-report-node-\${{ matrix.node }}.sarif\n`;
+    return `name: Rainy Updates Enterprise\n\non:\n${scheduleBlock}\n\npermissions:\n  contents: read\n  security-events: write\n  actions: read\n\nconcurrency:\n  group: rainy-updates-\${{ github.ref }}\n  cancel-in-progress: false\n\njobs:\n  dependency-check:\n    runs-on: ubuntu-latest\n    strategy:\n      fail-fast: false\n      matrix:\n        node: [20, 22]\n    steps:\n      - name: Checkout\n        uses: actions/checkout@v4\n\n      - name: Setup Node\n        uses: actions/setup-node@v4\n        with:\n          node-version: \${{ matrix.node }}\n\n      - name: Install dependencies\n        run: ${detectedPmInstall}\n\n      - name: Warm cache\n        run: npx @rainy-updates/cli warm-cache --workspace --concurrency 32 --registry-timeout-ms 12000 --registry-retries 4\n\n      - name: Check updates with rollout controls\n        run: |\n          npx @rainy-updates/cli ci \\\n            --workspace \\\n            --mode enterprise \\\n            --concurrency 32 \\\n            --stream \\\n            --registry-timeout-ms 12000 \\\n            --registry-retries 4 \\\n            --lockfile-mode preserve \\\n            --format github \\\n            --fail-on minor \\\n            --max-updates 50 \\\n            --json-file .artifacts/deps-report-node-\${{ matrix.node }}.json \\\n            --pr-report-file .artifacts/deps-report-node-\${{ matrix.node }}.md \\\n            --sarif-file .artifacts/deps-report-node-\${{ matrix.node }}.sarif \\\n            --github-output $GITHUB_OUTPUT\n\n      - name: Upload report artifacts\n        uses: actions/upload-artifact@v4\n        with:\n          name: rainy-updates-report-node-\${{ matrix.node }}\n          path: .artifacts/\n          retention-days: 14\n\n      - name: Upload SARIF\n        uses: github/codeql-action/upload-sarif@v3\n        with:\n          sarif_file: .artifacts/deps-report-node-\${{ matrix.node }}.sarif\n`;
 }

package/dist/core/options.d.ts

@@ -1,4 +1,4 @@
-import type { BaselineOptions, CheckOptions, UpgradeOptions } from "../types/index.js";
+import type { BaselineOptions, CheckOptions, UpgradeOptions, AuditOptions, BisectOptions, HealthOptions } from "../types/index.js";
 import type { InitCiMode, InitCiSchedule } from "./init-ci.js";
 export type ParsedCliArgs = {
     command: "check";
@@ -25,5 +25,14 @@ export type ParsedCliArgs = {
     options: BaselineOptions & {
         action: "save" | "check";
     };
+} | {
+    command: "bisect";
+    options: BisectOptions;
+} | {
+    command: "audit";
+    options: AuditOptions;
+} | {
+    command: "health";
+    options: HealthOptions;
 };
 export declare function parseCliArgs(argv: string[]): Promise<ParsedCliArgs>;

package/dist/core/options.js

@@ -7,7 +7,17 @@ const DEFAULT_INCLUDE_KINDS = [
     "optionalDependencies",
     "peerDependencies",
 ];
-const KNOWN_COMMANDS = ["check", "upgrade", "warm-cache", "init-ci", "baseline", "ci"];
+const KNOWN_COMMANDS = [
+    "check",
+    "upgrade",
+    "warm-cache",
+    "init-ci",
+    "baseline",
+    "ci",
+    "bisect",
+    "audit",
+    "health",
+];
 export async function parseCliArgs(argv) {
     const firstArg = argv[0];
     const isKnownCommand = KNOWN_COMMANDS.includes(firstArg);
@@ -31,7 +41,10 @@ export async function parseCliArgs(argv) {
         githubOutputFile: undefined,
         sarifFile: undefined,
         concurrency: 16,
+        registryTimeoutMs: 8000,
+        registryRetries: 3,
         offline: false,
+        stream: false,
         policyFile: undefined,
         prReportFile: undefined,
         failOn: "none",
@@ -50,6 +63,7 @@ export async function parseCliArgs(argv) {
         prLimit: undefined,
         onlyChanged: false,
         ciProfile: "minimal",
+        lockfileMode: "preserve",
     };
     let force = false;
     let initCiMode = "enterprise";
@@ -165,10 +179,38 @@ export async function parseCliArgs(argv) {
         if (current === "--concurrency") {
             throw new Error("Missing value for --concurrency");
         }
+        if (current === "--registry-timeout-ms" && next) {
+            const parsed = Number(next);
+            if (!Number.isInteger(parsed) || parsed <= 0) {
+                throw new Error("--registry-timeout-ms must be a positive integer");
+            }
+            base.registryTimeoutMs = parsed;
+            index += 1;
+            continue;
+        }
+        if (current === "--registry-timeout-ms") {
+            throw new Error("Missing value for --registry-timeout-ms");
+        }
+        if (current === "--registry-retries" && next) {
+            const parsed = Number(next);
+            if (!Number.isInteger(parsed) || parsed < 1) {
+                throw new Error("--registry-retries must be a positive integer");
+            }
+            base.registryRetries = parsed;
+            index += 1;
+            continue;
+        }
+        if (current === "--registry-retries") {
+            throw new Error("Missing value for --registry-retries");
+        }
         if (current === "--offline") {
             base.offline = true;
             continue;
         }
+        if (current === "--stream") {
+            base.stream = true;
+            continue;
+        }
         if (current === "--policy-file" && next) {
             policyFileRaw = next;
             index += 1;
@@ -352,6 +394,14 @@ export async function parseCliArgs(argv) {
             base.onlyChanged = true;
             continue;
         }
+        if (current === "--lockfile-mode" && next) {
+            base.lockfileMode = ensureLockfileMode(next);
+            index += 1;
+            continue;
+        }
+        if (current === "--lockfile-mode") {
+            throw new Error("Missing value for --lockfile-mode");
+        }
         if (current === "--save") {
             baselineAction = "save";
             continue;
@@ -435,6 +485,19 @@ export async function parseCliArgs(argv) {
             },
         };
     }
+    // ─── New v0.5.1 commands: lazy-parsed by isolated sub-parsers ────────────
+    if (command === "bisect") {
+        const { parseBisectArgs } = await import("../commands/bisect/parser.js");
+        return { command, options: parseBisectArgs(args) };
+    }
+    if (command === "audit") {
+        const { parseAuditArgs } = await import("../commands/audit/parser.js");
+        return { command, options: parseAuditArgs(args) };
+    }
+    if (command === "health") {
+        const { parseHealthArgs } = await import("../commands/health/parser.js");
+        return { command, options: parseHealthArgs(args) };
+    }
     return {
         command: "check",
         options: base,
@@ -465,12 +528,27 @@ function applyConfig(base, config) {
     if (typeof config.sarifFile === "string") {
         base.sarifFile = path.resolve(base.cwd, config.sarifFile);
     }
-    if (typeof config.concurrency === "number" && Number.isInteger(config.concurrency) && config.concurrency > 0) {
+    if (typeof config.concurrency === "number" &&
+        Number.isInteger(config.concurrency) &&
+        config.concurrency > 0) {
         base.concurrency = config.concurrency;
     }
+    if (typeof config.registryTimeoutMs === "number" &&
+        Number.isInteger(config.registryTimeoutMs) &&
+        config.registryTimeoutMs > 0) {
+        base.registryTimeoutMs = config.registryTimeoutMs;
+    }
+    if (typeof config.registryRetries === "number" &&
+        Number.isInteger(config.registryRetries) &&
+        config.registryRetries > 0) {
+        base.registryRetries = config.registryRetries;
+    }
     if (typeof config.offline === "boolean") {
         base.offline = config.offline;
     }
+    if (typeof config.stream === "boolean") {
+        base.stream = config.stream;
+    }
     if (typeof config.policyFile === "string") {
         base.policyFile = path.resolve(base.cwd, config.policyFile);
     }
@@ -480,7 +558,9 @@ function applyConfig(base, config) {
     if (typeof config.failOn === "string") {
         base.failOn = ensureFailOn(config.failOn);
     }
-    if (typeof config.maxUpdates === "number" && Number.isInteger(config.maxUpdates) && config.maxUpdates >= 0) {
+    if (typeof config.maxUpdates === "number" &&
+        Number.isInteger(config.maxUpdates) &&
+        config.maxUpdates >= 0) {
         base.maxUpdates = config.maxUpdates;
     }
     if (typeof config.fixPr === "boolean") {
@@ -489,7 +569,8 @@ function applyConfig(base, config) {
     if (typeof config.fixBranch === "string" && config.fixBranch.length > 0) {
         base.fixBranch = config.fixBranch;
     }
-    if (typeof config.fixCommitMessage === "string" && config.fixCommitMessage.length > 0) {
+    if (typeof config.fixCommitMessage === "string" &&
+        config.fixCommitMessage.length > 0) {
         base.fixCommitMessage = config.fixCommitMessage;
     }
     if (typeof config.fixDryRun === "boolean") {
@@ -498,7 +579,9 @@ function applyConfig(base, config) {
     if (typeof config.fixPrNoCheckout === "boolean") {
         base.fixPrNoCheckout = config.fixPrNoCheckout;
     }
-    if (typeof config.fixPrBatchSize === "number" && Number.isInteger(config.fixPrBatchSize) && config.fixPrBatchSize > 0) {
+    if (typeof config.fixPrBatchSize === "number" &&
+        Number.isInteger(config.fixPrBatchSize) &&
+        config.fixPrBatchSize > 0) {
         base.fixPrBatchSize = config.fixPrBatchSize;
     }
     if (typeof config.noPrReport === "boolean") {
@@ -510,13 +593,19 @@ function applyConfig(base, config) {
     if (typeof config.groupBy === "string") {
         base.groupBy = ensureGroupBy(config.groupBy);
     }
-    if (typeof config.groupMax === "number" && Number.isInteger(config.groupMax) && config.groupMax > 0) {
+    if (typeof config.groupMax === "number" &&
+        Number.isInteger(config.groupMax) &&
+        config.groupMax > 0) {
         base.groupMax = config.groupMax;
     }
-    if (typeof config.cooldownDays === "number" && Number.isInteger(config.cooldownDays) && config.cooldownDays >= 0) {
+    if (typeof config.cooldownDays === "number" &&
+        Number.isInteger(config.cooldownDays) &&
+        config.cooldownDays >= 0) {
         base.cooldownDays = config.cooldownDays;
     }
-    if (typeof config.prLimit === "number" && Number.isInteger(config.prLimit) && config.prLimit > 0) {
+    if (typeof config.prLimit === "number" &&
+        Number.isInteger(config.prLimit) &&
+        config.prLimit > 0) {
         base.prLimit = config.prLimit;
     }
     if (typeof config.onlyChanged === "boolean") {
@@ -525,6 +614,9 @@ function applyConfig(base, config) {
     if (typeof config.ciProfile === "string") {
         base.ciProfile = ensureCiProfile(config.ciProfile);
     }
+    if (typeof config.lockfileMode === "string") {
+        base.lockfileMode = ensureLockfileMode(config.lockfileMode);
+    }
 }
 function parsePackageManager(args) {
     const index = args.indexOf("--pm");
@@ -537,19 +629,29 @@ function parsePackageManager(args) {
     throw new Error("--pm must be auto, npm or pnpm");
 }
 function ensureTarget(value) {
-    if (value === "patch" || value === "minor" || value === "major" || value === "latest") {
+    if (value === "patch" ||
+        value === "minor" ||
+        value === "major" ||
+        value === "latest") {
         return value;
     }
     throw new Error("--target must be patch, minor, major, latest");
 }
 function ensureFormat(value) {
-    if (value === "table" || value === "json" || value === "minimal" || value === "github" || value === "metrics") {
+    if (value === "table" ||
+        value === "json" ||
+        value === "minimal" ||
+        value === "github" ||
+        value === "metrics") {
         return value;
     }
     throw new Error("--format must be table, json, minimal, github or metrics");
 }
 function ensureLogLevel(value) {
-    if (value === "error" || value === "warn" || value === "info" || value === "debug") {
+    if (value === "error" ||
+        value === "warn" ||
+        value === "info" ||
+        value === "debug") {
         return value;
     }
     throw new Error("--log-level must be error, warn, info or debug");
@@ -588,13 +690,21 @@ function ensureInitCiSchedule(value) {
     throw new Error("--schedule must be weekly, daily or off");
 }
 function ensureFailOn(value) {
-    if (value === "none" || value === "patch" || value === "minor" || value === "major" || value === "any") {
+    if (value === "none" ||
+        value === "patch" ||
+        value === "minor" ||
+        value === "major" ||
+        value === "any") {
         return value;
     }
     throw new Error("--fail-on must be none, patch, minor, major or any");
 }
 function ensureGroupBy(value) {
-    if (value === "none" || value === "name" || value === "scope" || value === "kind" || value === "risk") {
+    if (value === "none" ||
+        value === "name" ||
+        value === "scope" ||
+        value === "kind" ||
+        value === "risk") {
         return value;
     }
     throw new Error("--group-by must be none, name, scope, kind or risk");
@@ -605,3 +715,9 @@ function ensureCiProfile(value) {
     }
     throw new Error("--mode must be minimal, strict or enterprise");
 }
+function ensureLockfileMode(value) {
+    if (value === "preserve" || value === "update" || value === "error") {
+        return value;
+    }
+    throw new Error("--lockfile-mode must be preserve, update or error");
+}

package/dist/core/summary.d.ts

@@ -20,6 +20,7 @@ export declare function createSummary(input: {
     cooldownSkipped?: number;
     ciProfile?: Summary["ciProfile"];
     prLimitHit?: boolean;
+    policyOverridesApplied?: number;
 }): Summary;
 export declare function finalizeSummary(summary: Summary): Summary;
 export declare function resolveFailReason(updates: PackageUpdate[], errors: string[], failOn: FailOnLevel | undefined, maxUpdates: number | undefined, ciMode: boolean): FailReason;

package/dist/core/summary.js

@@ -1,6 +1,7 @@
 export function createSummary(input) {
     const offlineCacheMiss = input.errors.filter((error) => isOfflineCacheMissError(error)).length;
     const registryFailure = input.errors.filter((error) => isRegistryFailureError(error)).length;
+    const registryAuthFailure = input.errors.filter((error) => isRegistryAuthError(error)).length;
     const staleCache = input.warnings.filter((warning) => warning.includes("Using stale cache")).length;
     return {
         contractVersion: "2",
@@ -16,6 +17,7 @@ export function createSummary(input) {
             total: input.errors.length,
             offlineCacheMiss,
             registryFailure,
+            registryAuthFailure,
             other: 0,
         },
         warningCounts: {
@@ -38,10 +40,15 @@ export function createSummary(input) {
         cooldownSkipped: Math.max(0, Math.round(input.cooldownSkipped ?? 0)),
         ciProfile: input.ciProfile ?? "minimal",
         prLimitHit: input.prLimitHit === true,
+        streamedEvents: 0,
+        policyOverridesApplied: Math.max(0, Math.round(input.policyOverridesApplied ?? 0)),
     };
 }
 export function finalizeSummary(summary) {
-    const errorOther = summary.errorCounts.total - summary.errorCounts.offlineCacheMiss - summary.errorCounts.registryFailure;
+    const errorOther = summary.errorCounts.total -
+        summary.errorCounts.offlineCacheMiss -
+        summary.errorCounts.registryFailure -
+        summary.errorCounts.registryAuthFailure;
     const warningOther = summary.warningCounts.total - summary.warningCounts.staleCache;
     summary.errorCounts.other = Math.max(0, errorOther);
     summary.warningCounts.other = Math.max(0, warningOther);
@@ -81,3 +88,6 @@ function isRegistryFailureError(value) {
         value.includes("Registry request failed") ||
         value.includes("Registry temporary error"));
 }
+function isRegistryAuthError(value) {
+    return value.includes("Registry authentication failed") || value.includes("401");
+}

package/dist/core/upgrade.js

@@ -3,7 +3,10 @@ import { readManifest, writeManifest } from "../parsers/package-json.js";
 import { installDependencies } from "../pm/install.js";
 import { applyRangeStyle, parseVersion, compareVersions } from "../utils/semver.js";
 import { buildWorkspaceGraph } from "../workspace/graph.js";
+import { captureLockfileSnapshot, changedLockfiles, validateLockfileMode } from "../utils/lockfile.js";
 export async function upgrade(options) {
+    validateLockfileMode(options.lockfileMode, options.install);
+    const lockfilesBefore = await captureLockfileSnapshot(options.cwd);
     const checkResult = await check(options);
     if (checkResult.updates.length === 0) {
         return {
@@ -34,6 +37,13 @@ export async function upgrade(options) {
     if (options.install) {
         await installDependencies(options.cwd, options.packageManager, checkResult.packageManager);
     }
+    const lockfileChanges = await changedLockfiles(options.cwd, lockfilesBefore);
+    if (lockfileChanges.length > 0 && (options.lockfileMode === "preserve" || options.lockfileMode === "error")) {
+        throw new Error(`Lockfile changes detected in ${options.lockfileMode} mode: ${lockfileChanges.join(", ")}`);
+    }
+    if (lockfileChanges.length > 0 && options.lockfileMode === "update") {
+        checkResult.warnings.push(`Lockfiles changed: ${lockfileChanges.map((item) => item.split("/").pop()).join(", ")}`);
+    }
     return {
         ...checkResult,
         changed: true,

package/dist/core/warm-cache.js

@@ -1,3 +1,4 @@
+import process from "node:process";
 import { collectDependencies, readManifest } from "../parsers/package-json.js";
 import { matchesPattern } from "../utils/pattern.js";
 import { VersionCache } from "../cache/cache.js";
@@ -15,7 +16,10 @@ export async function warmCache(options) {
     const packageDirs = await discoverPackageDirs(options.cwd, options.workspace);
     discoveryMs += Date.now() - discoveryStartedAt;
     const cache = await VersionCache.create();
-    const registryClient = new NpmRegistryClient(options.cwd);
+    const registryClient = new NpmRegistryClient(options.cwd, {
+        timeoutMs: options.registryTimeoutMs,
+        retries: options.registryRetries,
+    });
     const errors = [];
     const warnings = [];
     if (cache.degraded) {
@@ -23,6 +27,13 @@ export async function warmCache(options) {
     }
     let totalDependencies = 0;
     const packageNames = new Set();
+    let streamedEvents = 0;
+    const emitStream = (message) => {
+        if (!options.stream)
+            return;
+        streamedEvents += 1;
+        process.stdout.write(`${message}\n`);
+    };
     for (const packageDir of packageDirs) {
         try {
             const manifest = await readManifest(packageDir);
@@ -57,10 +68,12 @@ export async function warmCache(options) {
                 const stale = await cache.getAny(pkg, options.target);
                 if (stale) {
                     warnings.push(`Using stale cache for ${pkg} in offline warm-cache mode.`);
+                    emitStream(`[warm-cache-stale] ${pkg}`);
                     warmed += 1;
                 }
                 else {
                     errors.push(`Offline cache miss for ${pkg}. Cannot warm cache in --offline mode.`);
+                    emitStream(`[error] Offline cache miss for ${pkg}`);
                 }
             }
             cacheMs += Date.now() - cacheFallbackStartedAt;
@@ -69,6 +82,8 @@ export async function warmCache(options) {
             const registryStartedAt = Date.now();
             const fetched = await registryClient.resolveManyPackageMetadata(needsFetch, {
                 concurrency: options.concurrency,
+                retries: options.registryRetries,
+                timeoutMs: options.registryTimeoutMs,
             });
             registryMs += Date.now() - registryStartedAt;
             const cacheWriteStartedAt = Date.now();
@@ -76,11 +91,13 @@ export async function warmCache(options) {
                 if (metadata.latestVersion) {
                     await cache.set(pkg, options.target, metadata.latestVersion, metadata.versions, options.cacheTtlSeconds);
                     warmed += 1;
+                    emitStream(`[warmed] ${pkg}@${metadata.latestVersion}`);
                 }
             }
             cacheMs += Date.now() - cacheWriteStartedAt;
             for (const [pkg, error] of fetched.errors) {
                 errors.push(`Unable to warm ${pkg}: ${error}`);
+                emitStream(`[error] Unable to warm ${pkg}: ${error}`);
             }
         }
     }
@@ -104,6 +121,7 @@ export async function warmCache(options) {
         },
         ciProfile: options.ciProfile,
     }));
+    summary.streamedEvents = streamedEvents;
     return {
         projectPath: options.cwd,
         packagePaths: packageDirs,

package/dist/output/format.js

@@ -36,6 +36,9 @@ export function renderResult(result, format) {
             `cooldown_skipped=${result.summary.cooldownSkipped}`,
             `ci_profile=${result.summary.ciProfile}`,
             `pr_limit_hit=${result.summary.prLimitHit ? "1" : "0"}`,
+            `streamed_events=${result.summary.streamedEvents}`,
+            `policy_overrides_applied=${result.summary.policyOverridesApplied}`,
+            `registry_auth_failures=${result.summary.errorCounts.registryAuthFailure}`,
             `fix_pr_branches_created=${result.summary.fixPrBranchesCreated}`,
         ].join("\n");
     }
@@ -76,6 +79,7 @@ export function renderResult(result, format) {
     lines.push("");
     lines.push(`Summary: ${result.summary.updatesFound} updates, ${result.summary.checkedDependencies}/${result.summary.totalDependencies} checked, ${result.summary.warmedPackages} warmed`);
     lines.push(`Groups=${result.summary.groupedUpdates}, cooldownSkipped=${result.summary.cooldownSkipped}, ciProfile=${result.summary.ciProfile}, prLimitHit=${result.summary.prLimitHit ? "yes" : "no"}`);
+    lines.push(`StreamedEvents=${result.summary.streamedEvents}, policyOverrides=${result.summary.policyOverridesApplied}, registryAuthFailures=${result.summary.errorCounts.registryAuthFailure}`);
     lines.push(`Contract v${result.summary.contractVersion}, failReason=${result.summary.failReason}, duration=${result.summary.durationMs.total}ms`);
     if (result.summary.fixPrApplied) {
         lines.push(`Fix PR: applied on branch ${result.summary.fixBranchName ?? "unknown"} (${result.summary.fixCommitSha ?? "no-commit"})`);

package/dist/output/github.js

@@ -18,6 +18,9 @@ export async function writeGitHubOutput(filePath, result) {
         `cooldown_skipped=${result.summary.cooldownSkipped}`,
         `ci_profile=${result.summary.ciProfile}`,
         `pr_limit_hit=${result.summary.prLimitHit === true ? "1" : "0"}`,
+        `streamed_events=${result.summary.streamedEvents}`,
+        `policy_overrides_applied=${result.summary.policyOverridesApplied}`,
+        `registry_auth_failures=${result.summary.errorCounts.registryAuthFailure}`,
         `fix_pr_applied=${result.summary.fixPrApplied === true ? "1" : "0"}`,
         `fix_pr_branches_created=${result.summary.fixPrBranchesCreated}`,
         `fix_pr_branch=${result.summary.fixBranchName ?? ""}`,

package/dist/registry/npm.d.ts

@@ -1,6 +1,11 @@
 export interface ResolveManyOptions {
     concurrency: number;
     timeoutMs?: number;
+    retries?: number;
+}
+export interface RegistryClientOptions {
+    timeoutMs?: number;
+    retries?: number;
 }
 export interface ResolveManyResult {
     metadata: Map<string, {
@@ -12,8 +17,10 @@ export interface ResolveManyResult {
 }
 export declare class NpmRegistryClient {
     private readonly requesterPromise;
-    constructor(cwd?: string);
-    resolvePackageMetadata(packageName: string, timeoutMs?: number): Promise<{
+    private readonly defaultTimeoutMs;
+    private readonly defaultRetries;
+    constructor(cwd?: string, options?: RegistryClientOptions);
+    resolvePackageMetadata(packageName: string, timeoutMs?: number, retries?: number): Promise<{
         latestVersion: string | null;
         versions: string[];
         publishedAtByVersion: Record<string, number>;