@tractorcow/beefup 0.0.0 → 1.0.0

package/dist/project/direct-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-deps.js","sourceRoot":"","sources":["../../src/project/direct-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAoB,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEvD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,WAAmB;IAIpE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAC5D,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,YAAY,CAAc,EAAE,CAAC,eAAe,CAAC,CAAC;QAChE,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,SAAS;YACX,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACtB,IAAI,KAAK,KAAK,sBAAsB,EAAE,CAAC;oBACrC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;AAChD,CAAC"}

package/dist/project/package-json.d.ts

@@ -0,0 +1,20 @@
+export interface PackageJson {
+    name?: string;
+    version?: string;
+    packageManager?: string;
+    private?: boolean;
+    workspaces?: string[] | {
+        packages?: string[];
+    };
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+    overrides?: Record<string, unknown>;
+    beefup?: unknown;
+    pnpm?: {
+        overrides?: Record<string, unknown>;
+    };
+}
+export declare const DIRECT_DEP_FIELDS: readonly ["dependencies", "devDependencies", "optionalDependencies"];
+export type DirectDepField = (typeof DIRECT_DEP_FIELDS)[number];

package/dist/project/package-json.js

@@ -0,0 +1,6 @@
+export const DIRECT_DEP_FIELDS = [
+    "dependencies",
+    "devDependencies",
+    "optionalDependencies",
+];
+//# sourceMappingURL=package-json.js.map

package/dist/project/package-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-json.js","sourceRoot":"","sources":["../../src/project/package-json.ts"],"names":[],"mappings":"AAeA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,cAAc;IACd,iBAAiB;IACjB,sBAAsB;CACd,CAAC"}

package/dist/project/paths.d.ts

@@ -0,0 +1,31 @@
+/** Relative directory name under the project root for Beefup state. */
+export declare const BEEFUP_DIR = ".beefup";
+/**
+ * Returns the absolute path to the project's `.beefup` directory.
+ */
+export declare function beefupDir(projectRoot: string): string;
+/**
+ * Returns the absolute path to the staged proposal directory.
+ */
+export declare function stagedDir(projectRoot: string): string;
+/**
+ * Returns the absolute path to the upgrade report output directory.
+ */
+export declare function reportDir(projectRoot: string): string;
+/** File names written under `.beefup/report`. */
+export declare const ReportFileNames: {
+    readonly Html: "REPORT.html";
+    readonly Json: "report.json";
+};
+/**
+ * Returns the absolute path to the git worktree working directory.
+ */
+export declare function worktreeDir(projectRoot: string): string;
+/**
+ * Returns the absolute path to the inplace-strategy backup directory.
+ */
+export declare function backupDir(projectRoot: string): string;
+/**
+ * Returns the absolute path to the in-progress marker file.
+ */
+export declare function inProgressPath(projectRoot: string): string;

package/dist/project/paths.js

@@ -0,0 +1,45 @@
+import path from "node:path";
+/** Relative directory name under the project root for Beefup state. */
+export const BEEFUP_DIR = ".beefup";
+/**
+ * Returns the absolute path to the project's `.beefup` directory.
+ */
+export function beefupDir(projectRoot) {
+    return path.join(projectRoot, BEEFUP_DIR);
+}
+/**
+ * Returns the absolute path to the staged proposal directory.
+ */
+export function stagedDir(projectRoot) {
+    return path.join(beefupDir(projectRoot), "staged");
+}
+/**
+ * Returns the absolute path to the upgrade report output directory.
+ */
+export function reportDir(projectRoot) {
+    return path.join(beefupDir(projectRoot), "report");
+}
+/** File names written under `.beefup/report`. */
+export const ReportFileNames = {
+    Html: "REPORT.html",
+    Json: "report.json",
+};
+/**
+ * Returns the absolute path to the git worktree working directory.
+ */
+export function worktreeDir(projectRoot) {
+    return path.join(beefupDir(projectRoot), "work");
+}
+/**
+ * Returns the absolute path to the inplace-strategy backup directory.
+ */
+export function backupDir(projectRoot) {
+    return path.join(beefupDir(projectRoot), "backup");
+}
+/**
+ * Returns the absolute path to the in-progress marker file.
+ */
+export function inProgressPath(projectRoot) {
+    return path.join(beefupDir(projectRoot), "IN_PROGRESS");
+}
+//# sourceMappingURL=paths.js.map

package/dist/project/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/project/paths.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,uEAAuE;AACvE,MAAM,CAAC,MAAM,UAAU,GAAG,SAAS,CAAC;AAEpC;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,WAAmB;IAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,WAAmB;IAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,WAAmB;IAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED,iDAAiD;AACjD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,aAAa;CACX,CAAC;AAEX;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,WAAmB;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,WAAmB;IAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB;IAChD,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,CAAC;AAC1D,CAAC"}

package/dist/project/types.d.ts

@@ -0,0 +1,13 @@
+/** Supported Node package managers for lockfile detection and updates. */
+export declare const PackageManagers: {
+    readonly Npm: "npm";
+    readonly Pnpm: "pnpm";
+};
+/** Detected or configured package manager for a project. */
+export type PackageManager = (typeof PackageManagers)[keyof typeof PackageManagers];
+export interface DetectedProject {
+    root: string;
+    packageManager: PackageManager;
+    lockfileName: string;
+    lockfilePath: string;
+}

package/dist/project/types.js

@@ -0,0 +1,6 @@
+/** Supported Node package managers for lockfile detection and updates. */
+export const PackageManagers = {
+    Npm: "npm",
+    Pnpm: "pnpm",
+};
+//# sourceMappingURL=types.js.map

package/dist/project/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/project/types.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;CACJ,CAAC"}

package/dist/project/workspace.d.ts

@@ -0,0 +1,14 @@
+export interface WorkspacePackage {
+    /** POSIX-style relative path from project root; "." for root */
+    relativeDir: string;
+    packageJsonPath: string;
+}
+/**
+ * Lists the root package plus every workspace package under npm/pnpm workspace globs.
+ */
+export declare function listWorkspacePackages(root: string): Promise<WorkspacePackage[]>;
+/**
+ * Lists relative paths Beefup may rewrite: workspace package.json files, lockfile,
+ * and optional pnpm-workspace.yaml / .npmrc when present.
+ */
+export declare function listWritableRelativePaths(root: string, lockfileName: string): Promise<string[]>;

package/dist/project/workspace.js

@@ -0,0 +1,80 @@
+import { glob, readFile } from "node:fs/promises";
+import path from "node:path";
+import { parse as parseYaml } from "yaml";
+import { pathExists, readJsonFile } from "../fsutil.js";
+/**
+ * Reads workspace glob patterns from package.json `workspaces` (array or object form).
+ */
+function workspacePatterns(pkg) {
+    if (!pkg.workspaces) {
+        return [];
+    }
+    if (Array.isArray(pkg.workspaces)) {
+        return pkg.workspaces;
+    }
+    return pkg.workspaces.packages ?? [];
+}
+/**
+ * Lists the root package plus every workspace package under npm/pnpm workspace globs.
+ */
+export async function listWorkspacePackages(root) {
+    const packages = [
+        {
+            relativeDir: ".",
+            packageJsonPath: path.join(root, "package.json"),
+        },
+    ];
+    const seen = new Set(["."]);
+    const pkg = await readJsonFile(path.join(root, "package.json"));
+    let patterns = workspacePatterns(pkg);
+    const workspaceYaml = path.join(root, "pnpm-workspace.yaml");
+    if (await pathExists(workspaceYaml)) {
+        const parsed = parseYaml(await readFile(workspaceYaml, "utf8"));
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            const listed = parsed.packages;
+            if (Array.isArray(listed)) {
+                patterns = listed.filter((item) => typeof item === "string");
+            }
+        }
+    }
+    for (const pattern of patterns) {
+        if (pattern.startsWith("!")) {
+            continue;
+        }
+        const globPattern = path.posix.join(pattern.replace(/\/$/, ""), "package.json");
+        for await (const match of glob(globPattern, { cwd: root })) {
+            const relDir = path.posix.dirname(match.replaceAll("\\", "/"));
+            if (seen.has(relDir)) {
+                continue;
+            }
+            seen.add(relDir);
+            packages.push({
+                relativeDir: relDir,
+                packageJsonPath: path.join(root, match),
+            });
+        }
+    }
+    return packages;
+}
+/**
+ * Lists relative paths Beefup may rewrite: workspace package.json files, lockfile,
+ * and optional pnpm-workspace.yaml / .npmrc when present.
+ */
+export async function listWritableRelativePaths(root, lockfileName) {
+    const rels = [];
+    const workspaces = await listWorkspacePackages(root);
+    for (const ws of workspaces) {
+        rels.push(ws.relativeDir === "."
+            ? "package.json"
+            : path.posix.join(ws.relativeDir, "package.json"));
+    }
+    rels.push(lockfileName);
+    if (await pathExists(path.join(root, "pnpm-workspace.yaml"))) {
+        rels.push("pnpm-workspace.yaml");
+    }
+    if (await pathExists(path.join(root, ".npmrc"))) {
+        rels.push(".npmrc");
+    }
+    return rels;
+}
+//# sourceMappingURL=workspace.js.map

package/dist/project/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../src/project/workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AASxD;;GAEG;AACH,SAAS,iBAAiB,CAAC,GAAgB;IACzC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QACpB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,OAAO,GAAG,CAAC,UAAU,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY;IAEZ,MAAM,QAAQ,GAAuB;QACnC;YACE,WAAW,EAAE,GAAG;YAChB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;SACjD;KACF,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5B,MAAM,GAAG,GAAG,MAAM,YAAY,CAAc,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7E,IAAI,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAEtC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IAC7D,IAAI,MAAM,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,MAAM,GAAI,MAAkC,CAAC,QAAQ,CAAC;YAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;QAChF,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAC/D,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC;gBACZ,WAAW,EAAE,MAAM;gBACnB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAY,EACZ,YAAoB;IAEpB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CACP,EAAE,CAAC,WAAW,KAAK,GAAG;YACpB,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxB,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/report/ansi.d.ts

@@ -0,0 +1,31 @@
+import { type FindingSeverity } from "../security/classify.js";
+/** Environment variables that enable or disable ANSI colour. */
+export declare const ColorEnv: {
+    readonly NoColor: "NO_COLOR";
+    readonly ForceColor: "FORCE_COLOR";
+};
+/** ANSI SGR codes used by the colour console report. */
+export declare const Ansi: {
+    readonly Reset: "\u001B[0m";
+    readonly Bold: "\u001B[1m";
+    readonly Dim: "\u001B[2m";
+    readonly Red: "\u001B[31m";
+    readonly Green: "\u001B[32m";
+    readonly Yellow: "\u001B[33m";
+    readonly Blue: "\u001B[34m";
+    readonly Magenta: "\u001B[35m";
+    readonly Cyan: "\u001B[36m";
+};
+/**
+ * Returns whether ANSI colour should be emitted for console reports.
+ * `NO_COLOR` wins; `FORCE_COLOR` enables colour when stdout is not a TTY.
+ */
+export declare function ansiColorEnabled(stdoutTty?: boolean): boolean;
+/**
+ * Wraps `text` in ANSI codes when colour is enabled.
+ */
+export declare function paint(codes: string | readonly string[], text: string, enabled: boolean): string;
+/**
+ * Returns ANSI codes for a vulnerability severity (critical/high stand out).
+ */
+export declare function ansiForSeverity(severity: FindingSeverity): readonly string[];

package/dist/report/ansi.js

@@ -0,0 +1,59 @@
+import { FindingSeverities } from "../security/classify.js";
+/** Environment variables that enable or disable ANSI colour. */
+export const ColorEnv = {
+    NoColor: "NO_COLOR",
+    ForceColor: "FORCE_COLOR",
+};
+/** ANSI SGR codes used by the colour console report. */
+export const Ansi = {
+    Reset: "\x1b[0m",
+    Bold: "\x1b[1m",
+    Dim: "\x1b[2m",
+    Red: "\x1b[31m",
+    Green: "\x1b[32m",
+    Yellow: "\x1b[33m",
+    Blue: "\x1b[34m",
+    Magenta: "\x1b[35m",
+    Cyan: "\x1b[36m",
+};
+/**
+ * Returns whether ANSI colour should be emitted for console reports.
+ * `NO_COLOR` wins; `FORCE_COLOR` enables colour when stdout is not a TTY.
+ */
+export function ansiColorEnabled(stdoutTty = process.stdout.isTTY) {
+    if (process.env[ColorEnv.NoColor]) {
+        return false;
+    }
+    if (process.env[ColorEnv.ForceColor]) {
+        return true;
+    }
+    return Boolean(stdoutTty);
+}
+/**
+ * Wraps `text` in ANSI codes when colour is enabled.
+ */
+export function paint(codes, text, enabled) {
+    if (!enabled || text.length === 0) {
+        return text;
+    }
+    const prefix = typeof codes === "string" ? codes : codes.join("");
+    return `${prefix}${text}${Ansi.Reset}`;
+}
+/**
+ * Returns ANSI codes for a vulnerability severity (critical/high stand out).
+ */
+export function ansiForSeverity(severity) {
+    switch (severity) {
+        case FindingSeverities.Critical:
+            return [Ansi.Bold, Ansi.Magenta];
+        case FindingSeverities.High:
+            return [Ansi.Bold, Ansi.Red];
+        case FindingSeverities.Moderate:
+            return [Ansi.Yellow];
+        case FindingSeverities.Low:
+            return [Ansi.Blue];
+        case FindingSeverities.Info:
+            return [Ansi.Dim];
+    }
+}
+//# sourceMappingURL=ansi.js.map

package/dist/report/ansi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ansi.js","sourceRoot":"","sources":["../../src/report/ansi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAwB,MAAM,yBAAyB,CAAC;AAElF,gEAAgE;AAChE,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,OAAO,EAAE,UAAU;IACnB,UAAU,EAAE,aAAa;CACjB,CAAC;AAEX,wDAAwD;AACxD,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,UAAU;IACf,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,UAAU;IACnB,IAAI,EAAE,UAAU;CACR,CAAC;AAEX;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK;IAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,KAAK,CACnB,KAAiC,EACjC,IAAY,EACZ,OAAgB;IAEhB,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAyB;IACvD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,iBAAiB,CAAC,QAAQ;YAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,KAAK,iBAAiB,CAAC,IAAI;YACzB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,KAAK,iBAAiB,CAAC,QAAQ;YAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,KAAK,iBAAiB,CAAC,GAAG;YACxB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,KAAK,iBAAiB,CAAC,IAAI;YACzB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/report/html.d.ts

@@ -0,0 +1,6 @@
+import type { StageReport } from "./types.js";
+/**
+ * Renders a stage report as a self-contained HTML document.
+ * Uses colour for severity badges and from/to version comparisons.
+ */
+export declare function renderHtml(report: StageReport): string;

package/dist/report/html.js

@@ -0,0 +1,260 @@
+import { AlignmentActions } from "../config/types.js";
+import { formatUniqueVersions } from "../diff/diff.js";
+import { groupByChangeType } from "../diff/group.js";
+import { META_VULN_TITLE } from "../security/npm-audit.js";
+import { packageChangeCounts, policyIssueCount, SecuritySectionIntros, SecuritySectionTitles, } from "./shared.js";
+/**
+ * Escapes text for HTML element content and quoted attributes.
+ */
+function escapeHtml(value) {
+    return value
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;");
+}
+/**
+ * CSS class suffix for a finding or policy severity (`sev-high`, `sev-error`, …).
+ */
+function severityClass(severity) {
+    return `sev-${severity}`;
+}
+/**
+ * Renders a package name as strong (direct) or em (transitive).
+ */
+function formatPackageName(change) {
+    const name = escapeHtml(change.name);
+    if (change.direct) {
+        return `<strong>${name}</strong>`;
+    }
+    return `<em>${name}</em>`;
+}
+/**
+ * Wraps unique version tags in a from or to colour span, leaving empty marks plain.
+ */
+function formatVersionHtml(versions, side) {
+    const escaped = escapeHtml(versions);
+    if (versions.length === 0 || versions === "—") {
+        return escaped;
+    }
+    return `<span class="ver-${side}">${escaped}</span>`;
+}
+/**
+ * Renders advisory links, or a meta-vuln via label.
+ */
+function formatFindingReferences(finding) {
+    if (finding.refs.length > 0) {
+        return finding.refs
+            .map((ref) => `<a href="${escapeHtml(ref.url)}">${escapeHtml(ref.id)}</a>`)
+            .join(", ");
+    }
+    if (finding.viaPackages && finding.viaPackages.length > 0) {
+        const via = finding.viaPackages
+            .map((name) => `<code>${escapeHtml(name)}</code>`)
+            .join(", ");
+        return `transitive (via ${via})`;
+    }
+    return "—";
+}
+/**
+ * Builds an HTML table for changed packages (from/to version columns).
+ */
+function formatChangedTable(changes) {
+    const rows = changes.map((change) => {
+        return `<tr><td>${formatPackageName(change)}</td><td>${formatVersionHtml(formatUniqueVersions(change.from), "from")}</td><td>${formatVersionHtml(formatUniqueVersions(change.to), "to")}</td></tr>`;
+    });
+    return `<table><thead><tr><th>Package</th><th>From</th><th>To</th></tr></thead><tbody>${rows.join("")}</tbody></table>`;
+}
+/**
+ * Builds a single-column version table for added or removed packages.
+ */
+function formatSingleVersionTable(changes, side) {
+    const rows = changes.map((change) => {
+        const versions = side === "to"
+            ? formatUniqueVersions(change.to)
+            : formatUniqueVersions(change.from);
+        return `<tr><td>${formatPackageName(change)}</td><td>${formatVersionHtml(versions, side)}</td></tr>`;
+    });
+    return `<table><thead><tr><th>Package</th><th>Version</th></tr></thead><tbody>${rows.join("")}</tbody></table>`;
+}
+/**
+ * Formats one list of changes into collapsible changed/added/removed blocks.
+ */
+function formatChangeGroups(changes) {
+    const byType = groupByChangeType(changes);
+    const parts = [];
+    if (byType.changed.length > 0) {
+        parts.push(`<details open><summary>Changed Packages (${byType.changed.length})</summary>${formatChangedTable(byType.changed)}</details>`);
+    }
+    if (byType.added.length > 0) {
+        parts.push(`<details open><summary>Added Packages (${byType.added.length})</summary>${formatSingleVersionTable(byType.added, "to")}</details>`);
+    }
+    if (byType.removed.length > 0) {
+        parts.push(`<details open><summary>Removed Packages (${byType.removed.length})</summary>${formatSingleVersionTable(byType.removed, "from")}</details>`);
+    }
+    return parts.join("");
+}
+/**
+ * Splits changes into required vs optional/platform and renders both sections.
+ */
+function formatDependencyBucket(title, changes) {
+    if (changes.length === 0) {
+        return "";
+    }
+    const required = changes.filter((change) => !change.optional);
+    const optional = changes.filter((change) => change.optional);
+    const parts = [`<h2>${escapeHtml(title)}</h2>`];
+    if (required.length > 0) {
+        parts.push(formatChangeGroups(required));
+    }
+    if (optional.length > 0) {
+        parts.push(`<h3>Optional / platform (${optional.length})</h3>`, formatChangeGroups(optional));
+    }
+    return parts.join("");
+}
+/**
+ * Formats an HTML section listing security findings.
+ */
+function formatFindings(title, intro, findings, kind) {
+    if (findings.length === 0) {
+        return "";
+    }
+    const rows = findings.map((item) => {
+        const titleText = item.title?.trim() || "—";
+        return `<tr><td><span class="badge ${severityClass(item.severity)}">${escapeHtml(item.severity)}</span></td><td>${escapeHtml(titleText)}</td><td>${formatFindingReferences(item)}</td><td><code>${escapeHtml(item.packageName)}</code></td></tr>`;
+    });
+    return `<section class="findings ${kind}"><h3>${escapeHtml(title)} (${findings.length})</h3><p>${escapeHtml(intro)}</p><table><thead><tr><th>Severity</th><th>Title</th><th>References</th><th>Package</th></tr></thead><tbody>${rows.join("")}</tbody></table></section>`;
+}
+/**
+ * Renders the top-of-report summary with package and security counts.
+ */
+function formatSummary(report) {
+    const packages = packageChangeCounts(report);
+    const { fixed, introduced, unresolved } = report.security;
+    const policy = policyIssueCount(report);
+    const items = [
+        `<li>Mode: <code>${escapeHtml(report.mode)}</code></li>`,
+        `<li>Strategy: <code>${escapeHtml(report.strategy)}</code></li>`,
+        `<li>Package manager: <code>${escapeHtml(report.packageManager)}</code></li>`,
+    ];
+    if (report.beefupVersion) {
+        items.push(`<li>Beefup: <code>${escapeHtml(report.beefupVersion)}</code></li>`);
+    }
+    if (report.generatedAt) {
+        items.push(`<li>Generated: <code>${escapeHtml(report.generatedAt)}</code></li>`);
+    }
+    items.push(`<li>Packages: <strong>${packages.changed}</strong> changed, <strong>${packages.added}</strong> added, <strong>${packages.removed}</strong> removed</li>`, `<li>Security: <strong class="ver-from">${introduced.length}</strong> introduced, <strong class="unresolved-count">${unresolved.length}</strong> unresolved, <strong class="ver-to">${fixed.length}</strong> fixed</li>`, `<li>Policy: ${policy === 0 ? "<strong>no issues</strong>" : `<strong>${policy}</strong> issue(s)`}</li>`);
+    if (introduced.length === 0) {
+        items.push("<li>No CVEs introduced by this staged upgrade</li>");
+    }
+    else {
+        items.push(`<li class="warn">Warning: ${introduced.length} CVE(s) introduced — review before accept</li>`);
+    }
+    return `<section><h2>Summary</h2><ul>${items.join("")}</ul></section>`;
+}
+/**
+ * Renders the policy section.
+ */
+function formatPolicy(report) {
+    if (policyIssueCount(report) === 0) {
+        return `<section><h2>Policy</h2><p>No policy issues.</p></section>`;
+    }
+    const items = [];
+    for (const item of report.ranges) {
+        items.push(`<li><span class="badge ${severityClass(item.severity)}">${escapeHtml(item.severity)}</span> ${escapeHtml(item.message)}</li>`);
+    }
+    for (const item of report.overrides) {
+        items.push(`<li><span class="badge ${severityClass(AlignmentActions.Error)}">${escapeHtml(AlignmentActions.Error)}</span> [${escapeHtml(item.override)}] ${escapeHtml(item.message)}</li>`);
+    }
+    for (const item of report.alignment) {
+        items.push(`<li><span class="badge ${severityClass(item.severity)}">${escapeHtml(item.severity)}</span> [${escapeHtml(item.group)}] ${escapeHtml(item.message)}</li>`);
+    }
+    return `<section><h2>Policy</h2><ul>${items.join("")}</ul></section>`;
+}
+/**
+ * Embedded stylesheet for the HTML report (severity colours and version diffs).
+ */
+function reportStyles() {
+    return `
+:root { color-scheme: light dark; --bg: #f6f7f9; --fg: #1b1f24; --card: #fff; --muted: #5c6570; --line: #d8dee6; --from: #c62828; --to: #2e7d32; --warn: #c62828; --unresolved: #f9a825; }
+@media (prefers-color-scheme: dark) { :root { --bg: #12151a; --fg: #e8eaed; --card: #1c2128; --muted: #9aa3ad; --line: #30363d; --from: #ff8a80; --to: #81c784; --warn: #ff8a80; --unresolved: #ffd54f; } }
+html { font-family: ui-sans-serif, system-ui, sans-serif; background: var(--bg); color: var(--fg); }
+body { margin: 0; }
+main { max-width: 960px; margin: 0 auto; padding: 1.5rem; }
+h1, h2, h3 { line-height: 1.25; }
+h1 { font-size: 1.6rem; }
+section, details { background: var(--card); border: 1px solid var(--line); border-radius: 8px; padding: 1rem 1.1rem; margin: 1rem 0; }
+.findings.introduced { border-left: 4px solid var(--from); }
+.findings.unresolved { border-left: 4px solid var(--unresolved); }
+.findings.fixed { border-left: 4px solid var(--to); }
+.warn { color: var(--warn); font-weight: 600; }
+.ver-from { color: var(--from); text-decoration: line-through; }
+.ver-to { color: var(--to); font-weight: 600; }
+.unresolved-count { color: var(--unresolved); }
+table { width: 100%; border-collapse: collapse; margin-top: 0.6rem; }
+th, td { text-align: left; padding: 0.4rem 0.5rem; border-bottom: 1px solid var(--line); vertical-align: top; }
+th { color: var(--muted); font-weight: 600; }
+.badge { display: inline-block; padding: 0.1rem 0.45rem; border-radius: 999px; font-size: 0.75rem; font-weight: 700; text-transform: uppercase; }
+.sev-critical { background: #6a1b9a; color: #fff; }
+.sev-high { background: #c62828; color: #fff; }
+.sev-moderate { background: #f9a825; color: #111; }
+.sev-low { background: #1565c0; color: #fff; }
+.sev-info { background: #546e7a; color: #fff; }
+.sev-error { background: #c62828; color: #fff; }
+.sev-warn { background: #f9a825; color: #111; }
+code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 0.9em; }
+a { color: inherit; }
+footer { color: var(--muted); font-size: 0.9rem; }
+`.trim();
+}
+/**
+ * Renders footer legend and path hints.
+ */
+function formatFooter() {
+    return `<footer><h2>Legend</h2><ul><li><strong>Bold</strong> package names are direct dependencies (declared in a workspace <code>package.json</code>).</li><li><em>Italic</em> package names are transitive.</li><li><strong>Optional / platform</strong> sections list packages marked optional in the lockfile or <code>optionalDependencies</code> (still security-scanned).</li><li>Security rows titled “${escapeHtml(META_VULN_TITLE)}” are npm meta-vulns: the package has no advisory of its own but depends on a vulnerable package.</li></ul><h2>Paths</h2><ul><li>Staged proposal: <code>.beefup/staged</code></li><li>This report: <code>.beefup/report</code></li></ul></footer>`;
+}
+/**
+ * Renders a stage report as a self-contained HTML document.
+ * Uses colour for severity badges and from/to version comparisons.
+ */
+export function renderHtml(report) {
+    const security = [
+        formatFindings(SecuritySectionTitles.Introduced, SecuritySectionIntros.Introduced, report.security.introduced, "introduced"),
+        formatFindings(SecuritySectionTitles.Unresolved, SecuritySectionIntros.Unresolved, report.security.unresolved, "unresolved"),
+        formatFindings(SecuritySectionTitles.Fixed, SecuritySectionIntros.Fixed, report.security.fixed, "fixed"),
+    ]
+        .filter((section) => section.length > 0)
+        .join("") || "<p>No security findings.</p>";
+    const deps = formatDependencyBucket("Dependencies", report.diff.dependencies);
+    const devDeps = formatDependencyBucket("Dev Dependencies", report.diff.devDependencies);
+    let warnings = "";
+    if (report.warnings.length > 0) {
+        const items = report.warnings
+            .map((warning) => `<li>${escapeHtml(warning)}</li>`)
+            .join("");
+        warnings = `<section><h2>Warnings</h2><ul>${items}</ul></section>`;
+    }
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta name="viewport" content="width=device-width, initial-scale=1"/>
+<title>Beefup upgrade report</title>
+<style>${reportStyles()}</style>
+</head>
+<body>
+<main>
+<h1>Beefup upgrade report</h1>
+${formatSummary(report)}
+<section><h2>Security</h2>${security}</section>
+${formatPolicy(report)}
+${deps}
+${devDeps}
+${warnings}
+${formatFooter()}
+</main>
+</body>
+</html>
+`;
+}
+//# sourceMappingURL=html.js.map

package/dist/report/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/report/html.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAGrB;;GAEG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,OAAO,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAqB;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,WAAW,IAAI,WAAW,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,IAAI,OAAO,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,QAAgB,EAAE,IAAmB;IAC9D,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,oBAAoB,IAAI,KAAK,OAAO,SAAS,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,OAAwB;IACvD,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,OAAO,CAAC,IAAI;aAChB,GAAG,CACF,CAAC,GAAG,EAAE,EAAE,CACN,YAAY,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAC/D;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW;aAC5B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;aACjD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,mBAAmB,GAAG,GAAG,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,OAAwB;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAClC,OAAO,WAAW,iBAAiB,CAAC,MAAM,CAAC,YAAY,iBAAiB,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,YAAY,iBAAiB,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC;IACtM,CAAC,CAAC,CAAC;IACH,OAAO,iFAAiF,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC;AAC1H,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAC/B,OAAwB,EACxB,IAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAClC,MAAM,QAAQ,GACZ,IAAI,KAAK,IAAI;YACX,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,WAAW,iBAAiB,CAAC,MAAM,CAAC,YAAY,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC;IACvG,CAAC,CAAC,CAAC;IACH,OAAO,yEAAyE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC;AAClH,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,OAAwB;IAClD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,4CAA4C,MAAM,CAAC,OAAO,CAAC,MAAM,cAAc,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAC9H,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CACR,0CAA0C,MAAM,CAAC,KAAK,CAAC,MAAM,cAAc,wBAAwB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CACpI,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,4CAA4C,MAAM,CAAC,OAAO,CAAC,MAAM,cAAc,wBAAwB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAC5I,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,KAAa,EAAE,OAAwB;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,CAAC,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CACR,4BAA4B,QAAQ,CAAC,MAAM,QAAQ,EACnD,kBAAkB,CAAC,QAAQ,CAAC,CAC7B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CACrB,KAAa,EACb,KAAa,EACb,QAA2B,EAC3B,IAA2C;IAE3C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC;QAC5C,OAAO,8BAA8B,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,UAAU,CAAC,SAAS,CAAC,YAAY,uBAAuB,CAAC,IAAI,CAAC,kBAAkB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC;IACpP,CAAC,CAAC,CAAC;IACH,OAAO,4BAA4B,IAAI,SAAS,UAAU,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,YAAY,UAAU,CAAC,KAAK,CAAC,+GAA+G,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,4BAA4B,CAAC;AAC7Q,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,MAAmB;IACxC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC1D,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG;QACZ,mBAAmB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc;QACxD,uBAAuB,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc;QAChE,8BAA8B,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,cAAc;KAC9E,CAAC;IACF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,qBAAqB,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,wBAAwB,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,CAAC,IAAI,CACR,yBAAyB,QAAQ,CAAC,OAAO,8BAA8B,QAAQ,CAAC,KAAK,4BAA4B,QAAQ,CAAC,OAAO,wBAAwB,EACzJ,0CAA0C,UAAU,CAAC,MAAM,0DAA0D,UAAU,CAAC,MAAM,gDAAgD,KAAK,CAAC,MAAM,sBAAsB,EACxN,eAAe,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,WAAW,MAAM,oBAAoB,OAAO,CAC1G,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,6BAA6B,UAAU,CAAC,MAAM,gDAAgD,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,gCAAgC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,MAAmB;IACvC,IAAI,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,4DAA4D,CAAC;IACtE,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CACR,0BAA0B,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAC/H,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CACR,0BAA0B,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAChL,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CACR,0BAA0B,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAC3J,CAAC;IACJ,CAAC;IACD,OAAO,+BAA+B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,SAAS,YAAY;IACnB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BR,CAAC,IAAI,EAAE,CAAC;AACT,CAAC;AAED;;GAEG;AACH,SAAS,YAAY;IACnB,OAAO,0YAA0Y,UAAU,CAAC,eAAe,CAAC,mPAAmP,CAAC;AAClqB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAmB;IAC5C,MAAM,QAAQ,GAAG;QACf,cAAc,CACZ,qBAAqB,CAAC,UAAU,EAChC,qBAAqB,CAAC,UAAU,EAChC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAC1B,YAAY,CACb;QACD,cAAc,CACZ,qBAAqB,CAAC,UAAU,EAChC,qBAAqB,CAAC,UAAU,EAChC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAC1B,YAAY,CACb;QACD,cAAc,CACZ,qBAAqB,CAAC,KAAK,EAC3B,qBAAqB,CAAC,KAAK,EAC3B,MAAM,CAAC,QAAQ,CAAC,KAAK,EACrB,OAAO,CACR;KACF;SACE,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;SACvC,IAAI,CAAC,EAAE,CAAC,IAAI,8BAA8B,CAAC;IAE9C,MAAM,IAAI,GAAG,sBAAsB,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,sBAAsB,CACpC,kBAAkB,EAClB,MAAM,CAAC,IAAI,CAAC,eAAe,CAC5B,CAAC;IAEF,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ;aAC1B,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC;aACnD,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,QAAQ,GAAG,iCAAiC,KAAK,iBAAiB,CAAC;IACrE,CAAC;IAED,OAAO;;;;;;SAMA,YAAY,EAAE;;;;;EAKrB,aAAa,CAAC,MAAM,CAAC;4BACK,QAAQ;EAClC,YAAY,CAAC,MAAM,CAAC;EACpB,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,YAAY,EAAE;;;;CAIf,CAAC;AACF,CAAC"}

package/dist/report/markdown.d.ts

@@ -0,0 +1,6 @@
+import type { StageReport } from "./types.js";
+/**
+ * Renders a stage report as markdown for files or stdout.
+ * Order: Summary → Security (Introduced → Unresolved → Fixed) → Policy → package diffs → Warnings → Legend.
+ */
+export declare function renderMarkdown(report: StageReport): string;