@tractorcow/beefup 0.0.0 → 1.0.0

package/dist/policy/overrides.js

@@ -0,0 +1,358 @@
+import semver from "semver";
+import { BannedRangeTags } from "../config/types.js";
+import { stripPnpmPeerSuffix } from "../lockfile/pnpm.js";
+import { PackageManagers } from "../project/types.js";
+const BANNED_OVERRIDE_TAGS = new Set([BannedRangeTags.Latest]);
+/**
+ * Parses an override key into a package name and optional version selector.
+ */
+function parseOverrideKey(key) {
+    if (key.startsWith("@")) {
+        const slash = key.indexOf("/");
+        if (slash === -1) {
+            return { name: key, selector: null };
+        }
+        const at = key.indexOf("@", slash);
+        if (at === -1) {
+            return { name: key, selector: null };
+        }
+        return { name: key.slice(0, at), selector: key.slice(at + 1) };
+    }
+    const at = key.indexOf("@");
+    if (at === -1) {
+        return { name: key, selector: null };
+    }
+    return { name: key.slice(0, at), selector: key.slice(at + 1) };
+}
+/**
+ * Resolves `$dep` override references against direct package.json dependencies.
+ */
+function resolveDollarRef(value, pkg) {
+    if (!value.startsWith("$")) {
+        return value;
+    }
+    const ref = value.slice(1);
+    const buckets = [
+        pkg.dependencies,
+        pkg.devDependencies,
+        pkg.optionalDependencies,
+        pkg.peerDependencies,
+    ];
+    for (const bucket of buckets) {
+        if (bucket && typeof bucket[ref] === "string") {
+            return bucket[ref];
+        }
+    }
+    throw new Error(`override value "${value}" references missing dependency "${ref}"`);
+}
+/**
+ * Returns true when an override target uses a banned floating tag such as latest.
+ */
+function isBannedOverrideTarget(raw) {
+    const value = raw.trim();
+    if (BANNED_OVERRIDE_TAGS.has(value.toLowerCase())) {
+        return true;
+    }
+    const npmAlias = value.match(/^npm:(@?[^@]+)@(.+)$/);
+    if (npmAlias && BANNED_OVERRIDE_TAGS.has(npmAlias[2].toLowerCase())) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Resolves an override target string into a concrete semver version when possible.
+ */
+function parseOverrideTarget(raw, pkg) {
+    const value = resolveDollarRef(raw, pkg);
+    const npmAlias = value.match(/^npm:(@?[^@]+)@(.+)$/);
+    if (npmAlias) {
+        const version = npmAlias[2];
+        return { version: semver.valid(version) ? version : null, raw: value };
+    }
+    if (semver.valid(value)) {
+        return { version: value, raw: value };
+    }
+    return { version: null, raw: value };
+}
+/**
+ * Flattens nested npm/pnpm override maps into individual pin records.
+ */
+function flattenOverrides(node, trail = [], scopedTo = null) {
+    const pins = [];
+    for (const [key, value] of Object.entries(node)) {
+        if (typeof value === "string") {
+            const { name, selector } = parseOverrideKey(key);
+            pins.push({
+                logicalName: name,
+                selector,
+                targetRaw: value,
+                trail: [...trail, key],
+                scopedTo,
+            });
+            continue;
+        }
+        if (!value || typeof value !== "object") {
+            continue;
+        }
+        const nested = value;
+        const { name: parentName } = parseOverrideKey(key);
+        if (typeof nested["."] === "string") {
+            const { name, selector } = parseOverrideKey(key);
+            pins.push({
+                logicalName: name,
+                selector,
+                targetRaw: nested["."],
+                trail: [...trail, key, "."],
+                scopedTo,
+            });
+        }
+        for (const [childKey, childVal] of Object.entries(nested)) {
+            if (childKey === ".") {
+                continue;
+            }
+            if (typeof childVal === "string") {
+                const { name, selector } = parseOverrideKey(childKey);
+                pins.push({
+                    logicalName: name,
+                    selector,
+                    targetRaw: childVal,
+                    trail: [...trail, key, childKey],
+                    scopedTo: parentName,
+                });
+            }
+            else if (childVal && typeof childVal === "object") {
+                pins.push(...flattenOverrides({ [childKey]: childVal }, [...trail, key], parentName));
+            }
+        }
+    }
+    return pins;
+}
+/**
+ * Collects dependency request ranges for a package from a normalized lockfile.
+ */
+function collectRequestedRanges(packageName, lock) {
+    const requests = [];
+    const packages = (lock.packages ?? {});
+    for (const [lockKey, meta] of Object.entries(packages)) {
+        if (!meta || typeof meta !== "object") {
+            continue;
+        }
+        const entry = meta;
+        const depBuckets = [
+            entry.dependencies,
+            entry.optionalDependencies,
+            entry.peerDependencies,
+            entry.devDependencies,
+        ];
+        for (const bucket of depBuckets) {
+            if (!bucket || typeof bucket !== "object") {
+                continue;
+            }
+            const deps = bucket;
+            if (typeof deps[packageName] !== "string") {
+                continue;
+            }
+            const from = lockKey === "" ? "(root package.json)" : lockKey.replace(/^node_modules\//, "");
+            requests.push({ from, range: stripPnpmPeerSuffix(deps[packageName]) });
+        }
+    }
+    return requests;
+}
+/**
+ * Converts a pnpm lockfile into an npm-like packages map for override checks.
+ */
+function normalizePnpmLock(lock) {
+    const packages = {};
+    const importers = lock.importers ?? {};
+    for (const [importerPath, meta] of Object.entries(importers)) {
+        const key = importerPath === "." ? "" : importerPath;
+        /**
+         * Extracts specifier strings from a pnpm importer dependency bucket.
+         */
+        const take = (bucket) => {
+            const out = {};
+            if (!bucket) {
+                return out;
+            }
+            for (const [name, info] of Object.entries(bucket)) {
+                if (typeof info === "string") {
+                    out[name] = info;
+                    continue;
+                }
+                if (info && typeof info.specifier === "string") {
+                    out[name] = info.specifier;
+                }
+            }
+            return out;
+        };
+        packages[key] = {
+            dependencies: take(meta.dependencies),
+            optionalDependencies: take(meta.optionalDependencies),
+            peerDependencies: take(meta.peerDependencies),
+            devDependencies: take(meta.devDependencies),
+        };
+    }
+    /**
+     * Merges resolved dependency maps from packages/snapshots into `packages`.
+     */
+    const takeResolved = (section) => {
+        if (!section) {
+            return;
+        }
+        for (const [lockKey, meta] of Object.entries(section)) {
+            if (!meta || typeof meta !== "object") {
+                continue;
+            }
+            const entry = meta;
+            if (!packages[lockKey]) {
+                packages[lockKey] = {};
+            }
+            for (const field of ["dependencies", "optionalDependencies", "peerDependencies"]) {
+                const bucket = entry[field];
+                if (!bucket || typeof bucket !== "object") {
+                    continue;
+                }
+                const out = {
+                    ...(packages[lockKey][field] ?? {}),
+                };
+                for (const [name, value] of Object.entries(bucket)) {
+                    if (typeof value === "string") {
+                        out[name] = value;
+                    }
+                }
+                packages[lockKey][field] = out;
+            }
+        }
+    };
+    takeResolved(lock.packages);
+    takeResolved(lock.snapshots);
+    return { packages };
+}
+/**
+ * Returns true when a dependency request falls within an override selector scope.
+ */
+function requestInOverrideScope(requestRange, selector) {
+    if (!selector) {
+        return true;
+    }
+    if (!semver.validRange(selector) || !semver.validRange(requestRange)) {
+        return false;
+    }
+    return semver.intersects(requestRange, selector, true);
+}
+/**
+ * Returns true when a pin version is strictly below a requested range's minimum.
+ */
+function pinBelowRequest(pinVersion, requestRange) {
+    if (semver.satisfies(pinVersion, requestRange, { includePrerelease: true })) {
+        return false;
+    }
+    const minimum = semver.minVersion(requestRange);
+    if (!minimum) {
+        return false;
+    }
+    return semver.lt(pinVersion, minimum);
+}
+/**
+ * Finds override pins that are banned floating tags or below requested ranges.
+ */
+export function findStaleOverridePins(pkg, lock) {
+    const overrides = pkg.overrides;
+    if (!overrides || typeof overrides !== "object") {
+        return [];
+    }
+    const errors = [];
+    const pins = flattenOverrides(overrides);
+    for (const pin of pins) {
+        const label = pin.trail.join(" → ");
+        let target;
+        try {
+            target = parseOverrideTarget(pin.targetRaw, pkg);
+        }
+        catch (err) {
+            errors.push({
+                override: label,
+                message: err instanceof Error ? err.message : String(err),
+            });
+            continue;
+        }
+        if (isBannedOverrideTarget(target.raw)) {
+            errors.push({
+                override: label,
+                message: `pin must not use floating tag "${BannedRangeTags.Latest}" (got ${target.raw}); pin a concrete semver version instead`,
+            });
+            continue;
+        }
+        if (!target.version || !semver.valid(target.version)) {
+            continue;
+        }
+        const requests = collectRequestedRanges(pin.logicalName, lock);
+        const seen = new Set();
+        for (const req of requests) {
+            if (req.range.startsWith("npm:") || req.range.startsWith("file:")) {
+                continue;
+            }
+            if (!semver.validRange(req.range)) {
+                continue;
+            }
+            if (!requestInOverrideScope(req.range, pin.selector)) {
+                continue;
+            }
+            if (pin.scopedTo) {
+                const fromName = req.from.split("/node_modules/").pop();
+                if (fromName !== pin.scopedTo) {
+                    continue;
+                }
+            }
+            const key = `${req.from}::${req.range}`;
+            if (seen.has(key)) {
+                continue;
+            }
+            seen.add(key);
+            if (pinBelowRequest(target.version, req.range)) {
+                const minimum = semver.minVersion(req.range);
+                errors.push({
+                    override: label,
+                    message: `pin ${pin.logicalName}@${target.version} is below ` +
+                        `${req.from} → ${pin.logicalName}@${req.range}` +
+                        (minimum ? ` (minimum ${minimum.version})` : ""),
+                });
+            }
+        }
+    }
+    return errors;
+}
+/**
+ * Finds keys where package.json and pnpm-workspace.yaml overrides disagree.
+ */
+export function findWorkspaceOverrideDrift(pkg, workspaceOverrides) {
+    if (!workspaceOverrides) {
+        return [];
+    }
+    const pkgOverrides = pkg.overrides && typeof pkg.overrides === "object" ? pkg.overrides : {};
+    const errors = [];
+    const keys = new Set([...Object.keys(pkgOverrides), ...Object.keys(workspaceOverrides)]);
+    for (const key of keys) {
+        const left = JSON.stringify(pkgOverrides[key] ?? null);
+        const right = JSON.stringify(workspaceOverrides[key] ?? null);
+        if (left !== right) {
+            errors.push({
+                override: key,
+                message: `package.json#overrides and pnpm-workspace.yaml#overrides disagree ` +
+                    `(package.json=${left}, workspace=${right})`,
+            });
+        }
+    }
+    return errors;
+}
+/**
+ * Normalizes a lockfile into the packages shape used by override pin checks.
+ */
+export function normalizeLockForOverrides(packageManager, lock) {
+    if (packageManager === PackageManagers.Pnpm) {
+        return normalizePnpmLock(lock);
+    }
+    return lock;
+}
+export { parseOverrideKey, flattenOverrides };
+//# sourceMappingURL=overrides.js.map

package/dist/policy/overrides.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"overrides.js","sourceRoot":"","sources":["../../src/policy/overrides.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG1D,OAAO,EAAE,eAAe,EAAuB,MAAM,qBAAqB,CAAC;AAO3E,MAAM,oBAAoB,GAAgB,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5E;;GAEG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACd,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACd,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,KAAa,EAAE,GAAgB;IACvD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,YAAY;QAChB,GAAG,CAAC,eAAe;QACnB,GAAG,CAAC,oBAAoB;QACxB,GAAG,CAAC,gBAAgB;KACrB,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,oCAAoC,GAAG,GAAG,CAAC,CAAC;AACtF,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,GAAW;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACrD,IAAI,QAAQ,IAAI,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,GAAW,EACX,GAAgB;IAEhB,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACrD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC;AAUD;;GAEG;AACH,SAAS,gBAAgB,CACvB,IAA6B,EAC7B,QAAkB,EAAE,EACpB,WAA0B,IAAI;IAE9B,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC;gBACR,WAAW,EAAE,IAAI;gBACjB,QAAQ;gBACR,SAAS,EAAE,KAAK;gBAChB,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC;gBACtB,QAAQ;aACT,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC;gBACR,WAAW,EAAE,IAAI;gBACjB,QAAQ;gBACR,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;gBACtB,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC;gBAC3B,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACrB,SAAS;YACX,CAAC;YACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBACtD,IAAI,CAAC,IAAI,CAAC;oBACR,WAAW,EAAE,IAAI;oBACjB,QAAQ;oBACR,SAAS,EAAE,QAAQ;oBACnB,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC;oBAChC,QAAQ,EAAE,UAAU;iBACrB,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACpD,IAAI,CAAC,IAAI,CACP,GAAG,gBAAgB,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,CAC3E,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAC7B,WAAmB,EACnB,IAA4C;IAE5C,MAAM,QAAQ,GAA2C,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IAClE,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAA+B,CAAC;QAC9C,MAAM,UAAU,GAAG;YACjB,KAAK,CAAC,YAAY;YAClB,KAAK,CAAC,oBAAoB;YAC1B,KAAK,CAAC,gBAAgB;YACtB,KAAK,CAAC,eAAe;SACtB,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAiC,CAAC;YAC/C,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GACR,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;YAClF,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAW,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,IAAkB;IAC3C,MAAM,QAAQ,GAA4C,EAAE,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;QACrD;;WAEG;QACH,MAAM,IAAI,GAAG,CACX,MAAqF,EAC7D,EAAE;YAC1B,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,GAAG,CAAC;YACb,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC7B,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;oBACjB,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC/C,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC7B,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC,CAAC;QACF,QAAQ,CAAC,GAAG,CAAC,GAAG;YACd,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;YACrC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC;YACrD,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAC7C,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;SAC5C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,YAAY,GAAG,CAAC,OAA4C,EAAE,EAAE;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,IAA+B,CAAC;YAC9C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACzB,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,sBAAsB,EAAE,kBAAkB,CAAC,EAAE,CAAC;gBACjF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC5B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC1C,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,GAAG;oBACV,GAAG,CAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAwC,IAAI,EAAE,CAAC;iBAC5E,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;oBAC9E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBAC9B,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;oBACpB,CAAC;gBACH,CAAC;gBACD,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,YAAY,CAAC,IAAI,CAAC,QAA+C,CAAC,CAAC;IACnE,YAAY,CAAC,IAAI,CAAC,SAAgD,CAAC,CAAC;IACpE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAC7B,YAAoB,EACpB,QAAuB;IAEvB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,UAAkB,EAAE,YAAoB;IAC/D,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,YAAY,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAgB,EAChB,IAA0D;IAE1D,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAChC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAoC,CAAC,CAAC;IAEpE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,MAA+C,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,kCAAkC,eAAe,CAAC,MAAM,UAAU,MAAM,CAAC,GAAG,0CAA0C;aAChI,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClE,SAAS;YACX,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrD,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC;gBACxD,IAAI,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;oBAC9B,SAAS;gBACX,CAAC;YACH,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC7C,MAAM,CAAC,IAAI,CAAC;oBACV,QAAQ,EAAE,KAAK;oBACf,OAAO,EACL,OAAO,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC,OAAO,YAAY;wBACpD,GAAG,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,KAAK,EAAE;wBAC/C,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAgB,EAChB,kBAAuD;IAEvD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,YAAY,GAChB,GAAG,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACzF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,GAAG;gBACb,OAAO,EACL,oEAAoE;oBACpE,iBAAiB,IAAI,eAAe,KAAK,GAAG;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,cAA8B,EAC9B,IAAgC;IAEhC,IAAI,cAAc,KAAK,eAAe,CAAC,IAAI,EAAE,CAAC;QAC5C,OAAO,iBAAiB,CAAC,IAAoB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAmB,CAAC;AAC7B,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/policy/ranges.d.ts

@@ -0,0 +1,13 @@
+import { type AlignmentAction, type BeefupConfig } from "../config/types.js";
+import { type PackageJson } from "../project/package-json.js";
+export interface RangeFinding {
+    packageName: string;
+    field: string;
+    spec: string;
+    severity: AlignmentAction;
+    message: string;
+}
+/**
+ * Finds banned and non-exact dependency range issues in a package.json.
+ */
+export declare function findRangeIssues(pkg: PackageJson, config: BeefupConfig, fromLabel: string): RangeFinding[];

package/dist/policy/ranges.js

@@ -0,0 +1,58 @@
+import semver from "semver";
+import { AlignmentActions, } from "../config/types.js";
+import { DIRECT_DEP_FIELDS, } from "../project/package-json.js";
+import { shouldSkipSpec } from "../rewrite/constraints.js";
+/**
+ * Returns true when `spec` matches a banned floating range (case-insensitive).
+ */
+function isBanned(spec, banned) {
+    const trimmed = spec.trim().toLowerCase();
+    return banned.some((item) => item.toLowerCase() === trimmed);
+}
+/**
+ * Returns true when `spec` is a semver range rather than an exact version.
+ */
+function isLooseRange(spec) {
+    if (semver.valid(spec)) {
+        return false;
+    }
+    return Boolean(semver.validRange(spec));
+}
+/**
+ * Finds banned and non-exact dependency range issues in a package.json.
+ */
+export function findRangeIssues(pkg, config, fromLabel) {
+    const findings = [];
+    for (const field of DIRECT_DEP_FIELDS) {
+        const bucket = pkg[field];
+        if (!bucket) {
+            continue;
+        }
+        for (const [name, spec] of Object.entries(bucket)) {
+            if (shouldSkipSpec(spec)) {
+                continue;
+            }
+            if (isBanned(spec, config.bannedRanges)) {
+                findings.push({
+                    packageName: name,
+                    field: `${fromLabel}#${field}`,
+                    spec,
+                    severity: AlignmentActions.Error,
+                    message: `${name} uses banned range "${spec}"`,
+                });
+                continue;
+            }
+            if (config.preferExact && isLooseRange(spec)) {
+                findings.push({
+                    packageName: name,
+                    field: `${fromLabel}#${field}`,
+                    spec,
+                    severity: AlignmentActions.Warn,
+                    message: `${name} is not exact-pinned ("${spec}")`,
+                });
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=ranges.js.map

package/dist/policy/ranges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ranges.js","sourceRoot":"","sources":["../../src/policy/ranges.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EACL,gBAAgB,GAGjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D;;GAEG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAgB;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAgB,EAChB,MAAoB,EACpB,SAAiB;IAEjB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC;oBACZ,WAAW,EAAE,IAAI;oBACjB,KAAK,EAAE,GAAG,SAAS,IAAI,KAAK,EAAE;oBAC9B,IAAI;oBACJ,QAAQ,EAAE,gBAAgB,CAAC,KAAK;oBAChC,OAAO,EAAE,GAAG,IAAI,uBAAuB,IAAI,GAAG;iBAC/C,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7C,QAAQ,CAAC,IAAI,CAAC;oBACZ,WAAW,EAAE,IAAI;oBACjB,KAAK,EAAE,GAAG,SAAS,IAAI,KAAK,EAAE;oBAC9B,IAAI;oBACJ,QAAQ,EAAE,gBAAgB,CAAC,IAAI;oBAC/B,OAAO,EAAE,GAAG,IAAI,0BAA0B,IAAI,IAAI;iBACnD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/project/collect.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Copies writable project files from a staging source into `.beefup/staged`.
+ * Uses a temporary directory and renames atomically into place.
+ */
+export declare function collectStagedOutputs(sourceRoot: string, projectRoot: string, lockfileName: string): Promise<string>;
+/**
+ * Ensures `.beefup/staged` contains a proposal lockfile for the project.
+ * Returns the staged directory path.
+ */
+export declare function requireStagedUpgrade(projectRoot: string, lockfileName: string): Promise<string>;
+/**
+ * Copies staged proposal files from `.beefup/staged` into the live project tree.
+ * Returns the relative paths that were written.
+ */
+export declare function applyStagedOutputs(projectRoot: string, lockfileName: string): Promise<string[]>;

package/dist/project/collect.js

@@ -0,0 +1,60 @@
+import { mkdir, rename } from "node:fs/promises";
+import path from "node:path";
+import { CliCommands } from "../config/types.js";
+import { BeefupError } from "../errors.js";
+import { copyFileTo, pathExists, removePath } from "../fsutil.js";
+import { beefupDir, stagedDir } from "./paths.js";
+import { listWritableRelativePaths } from "./workspace.js";
+/**
+ * Copies writable project files from a staging source into `.beefup/staged`.
+ * Uses a temporary directory and renames atomically into place.
+ */
+export async function collectStagedOutputs(sourceRoot, projectRoot, lockfileName) {
+    const dest = stagedDir(projectRoot);
+    const tmp = path.join(beefupDir(projectRoot), "staged.tmp");
+    await removePath(tmp);
+    await mkdir(tmp, { recursive: true });
+    const rels = await listWritableRelativePaths(sourceRoot, lockfileName);
+    for (const rel of rels) {
+        const from = path.join(sourceRoot, rel);
+        if (!(await pathExists(from))) {
+            continue;
+        }
+        await copyFileTo(from, path.join(tmp, rel));
+    }
+    await removePath(dest);
+    await mkdir(path.dirname(dest), { recursive: true });
+    await rename(tmp, dest);
+    return dest;
+}
+/**
+ * Ensures `.beefup/staged` contains a proposal lockfile for the project.
+ * Returns the staged directory path.
+ */
+export async function requireStagedUpgrade(projectRoot, lockfileName) {
+    const staged = stagedDir(projectRoot);
+    const stagedLock = path.join(staged, lockfileName);
+    if (!(await pathExists(stagedLock))) {
+        throw new BeefupError(`no staged lockfile at ${path.relative(projectRoot, stagedLock) || stagedLock}; run beefup ${CliCommands.Stage} first`);
+    }
+    return staged;
+}
+/**
+ * Copies staged proposal files from `.beefup/staged` into the live project tree.
+ * Returns the relative paths that were written.
+ */
+export async function applyStagedOutputs(projectRoot, lockfileName) {
+    const staged = stagedDir(projectRoot);
+    const rels = await listWritableRelativePaths(staged, lockfileName);
+    const copied = [];
+    for (const rel of rels) {
+        const from = path.join(staged, rel);
+        if (!(await pathExists(from))) {
+            continue;
+        }
+        await copyFileTo(from, path.join(projectRoot, rel));
+        copied.push(rel);
+    }
+    return copied;
+}
+//# sourceMappingURL=collect.js.map

package/dist/project/collect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collect.js","sourceRoot":"","sources":["../../src/project/collect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB,EAClB,WAAmB,EACnB,YAAoB;IAEpB,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC,CAAC;IAC5D,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtC,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACvE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,YAAoB;IAEpB,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,WAAW,CACnB,yBAAyB,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,UAAU,gBAAgB,WAAW,CAAC,KAAK,QAAQ,CACvH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,YAAoB;IAEpB,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/project/detect.d.ts

@@ -0,0 +1,5 @@
+import { type DetectedProject } from "./types.js";
+/**
+ * Detects the project root's package manager and lockfile from disk and hints.
+ */
+export declare function detectProject(root: string): Promise<DetectedProject>;

package/dist/project/detect.js

@@ -0,0 +1,76 @@
+import path from "node:path";
+import { BeefupError } from "../errors.js";
+import { pathExists, readJsonFile } from "../fsutil.js";
+import { PackageManagers } from "./types.js";
+/**
+ * Maps a package.json `packageManager` field to a supported package manager.
+ */
+function managerFromPackageManagerField(field) {
+    if (!field) {
+        return undefined;
+    }
+    if (field.startsWith(`${PackageManagers.Pnpm}@`)) {
+        return PackageManagers.Pnpm;
+    }
+    if (field.startsWith(`${PackageManagers.Npm}@`)) {
+        return PackageManagers.Npm;
+    }
+    return undefined;
+}
+/**
+ * Detects the project root's package manager and lockfile from disk and hints.
+ */
+export async function detectProject(root) {
+    const pkgPath = path.join(root, "package.json");
+    if (!(await pathExists(pkgPath))) {
+        throw new BeefupError(`no package.json at ${root}`);
+    }
+    const pkg = await readJsonFile(pkgPath);
+    const pnpmLock = path.join(root, "pnpm-lock.yaml");
+    const npmLock = path.join(root, "package-lock.json");
+    const hasPnpm = await pathExists(pnpmLock);
+    const hasNpm = await pathExists(npmLock);
+    const hinted = managerFromPackageManagerField(pkg.packageManager);
+    if (hasPnpm && hasNpm) {
+        if (!hinted) {
+            throw new BeefupError("both pnpm-lock.yaml and package-lock.json exist; set packageManager in package.json");
+        }
+        return hinted === PackageManagers.Pnpm
+            ? {
+                root,
+                packageManager: PackageManagers.Pnpm,
+                lockfileName: "pnpm-lock.yaml",
+                lockfilePath: pnpmLock,
+            }
+            : {
+                root,
+                packageManager: PackageManagers.Npm,
+                lockfileName: "package-lock.json",
+                lockfilePath: npmLock,
+            };
+    }
+    if (hasPnpm || hinted === PackageManagers.Pnpm) {
+        if (!hasPnpm) {
+            throw new BeefupError(`no pnpm-lock.yaml at ${root}`);
+        }
+        return {
+            root,
+            packageManager: PackageManagers.Pnpm,
+            lockfileName: "pnpm-lock.yaml",
+            lockfilePath: pnpmLock,
+        };
+    }
+    if (hasNpm || hinted === PackageManagers.Npm) {
+        if (!hasNpm) {
+            throw new BeefupError(`no package-lock.json at ${root}`);
+        }
+        return {
+            root,
+            packageManager: PackageManagers.Npm,
+            lockfileName: "package-lock.json",
+            lockfilePath: npmLock,
+        };
+    }
+    throw new BeefupError(`no pnpm-lock.yaml or package-lock.json at ${root}`);
+}
+//# sourceMappingURL=detect.js.map

package/dist/project/detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.js","sourceRoot":"","sources":["../../src/project/detect.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAExD,OAAO,EAAE,eAAe,EAA6C,MAAM,YAAY,CAAC;AAExF;;GAEG;AACH,SAAS,8BAA8B,CACrC,KAAyB;IAEzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,eAAe,CAAC,IAAI,CAAC;IAC9B,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,eAAe,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,eAAe,CAAC,GAAG,CAAC;IAC7B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,WAAW,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAc,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,8BAA8B,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAElE,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CACnB,qFAAqF,CACtF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,KAAK,eAAe,CAAC,IAAI;YACpC,CAAC,CAAC;gBACE,IAAI;gBACJ,cAAc,EAAE,eAAe,CAAC,IAAI;gBACpC,YAAY,EAAE,gBAAgB;gBAC9B,YAAY,EAAE,QAAQ;aACvB;YACH,CAAC,CAAC;gBACE,IAAI;gBACJ,cAAc,EAAE,eAAe,CAAC,GAAG;gBACnC,YAAY,EAAE,mBAAmB;gBACjC,YAAY,EAAE,OAAO;aACtB,CAAC;IACR,CAAC;IAED,IAAI,OAAO,IAAI,MAAM,KAAK,eAAe,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO;YACL,IAAI;YACJ,cAAc,EAAE,eAAe,CAAC,IAAI;YACpC,YAAY,EAAE,gBAAgB;YAC9B,YAAY,EAAE,QAAQ;SACvB,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,IAAI,MAAM,KAAK,eAAe,CAAC,GAAG,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO;YACL,IAAI;YACJ,cAAc,EAAE,eAAe,CAAC,GAAG;YACnC,YAAY,EAAE,mBAAmB;YACjC,YAAY,EAAE,OAAO;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,WAAW,CACnB,6CAA6C,IAAI,EAAE,CACpD,CAAC;AACJ,CAAC"}

package/dist/project/direct-deps.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Collects direct and optionalDependency package names across the workspace.
+ */
+export declare function collectDirectDependencyNames(projectRoot: string): Promise<{
+    directNames: Set<string>;
+    optionalDeclaredNames: Set<string>;
+}>;

package/dist/project/direct-deps.js

@@ -0,0 +1,28 @@
+import { readJsonFile } from "../fsutil.js";
+import { DIRECT_DEP_FIELDS } from "./package-json.js";
+import { listWorkspacePackages } from "./workspace.js";
+/**
+ * Collects direct and optionalDependency package names across the workspace.
+ */
+export async function collectDirectDependencyNames(projectRoot) {
+    const directNames = new Set();
+    const optionalDeclaredNames = new Set();
+    const workspaces = await listWorkspacePackages(projectRoot);
+    for (const ws of workspaces) {
+        const pkg = await readJsonFile(ws.packageJsonPath);
+        for (const field of DIRECT_DEP_FIELDS) {
+            const bucket = pkg[field];
+            if (!bucket) {
+                continue;
+            }
+            for (const name of Object.keys(bucket)) {
+                directNames.add(name);
+                if (field === "optionalDependencies") {
+                    optionalDeclaredNames.add(name);
+                }
+            }
+        }
+    }
+    return { directNames, optionalDeclaredNames };
+}
+//# sourceMappingURL=direct-deps.js.map