@tractorcow/beefup 0.0.0 → 1.0.0

package/dist/report/markdown.js

@@ -0,0 +1,234 @@
+import { AlignmentActions } from "../config/types.js";
+import { formatUniqueVersions } from "../diff/diff.js";
+import { groupByChangeType } from "../diff/group.js";
+import { META_VULN_TITLE } from "../security/npm-audit.js";
+import { formatRefsMarkdown } from "../security/refs.js";
+import { packageChangeCounts, policyIssueCount, SecuritySectionIntros, SecuritySectionTitles, } from "./shared.js";
+/**
+ * Builds a markdown table for changed packages (from/to version columns).
+ */
+function formatChangedTable(changes) {
+    const rows = [
+        "| Package | From Version | To Version |",
+        "|---------|--------------|------------|",
+    ];
+    for (const change of changes) {
+        rows.push(`| ${formatPackageName(change)} | \`${formatUniqueVersions(change.from)}\` | \`${formatUniqueVersions(change.to)}\` |`);
+    }
+    return rows.join("\n");
+}
+/**
+ * Builds a single-column version table for added or removed packages.
+ */
+function formatSingleVersionTable(changes, side) {
+    const rows = ["| Package | Version |", "|---------|---------|"];
+    for (const change of changes) {
+        const versions = side === "to"
+            ? formatUniqueVersions(change.to)
+            : formatUniqueVersions(change.from);
+        rows.push(`| ${formatPackageName(change)} | \`${versions}\` |`);
+    }
+    return rows.join("\n");
+}
+/**
+ * Renders a package name as bold (direct) or italic (transitive).
+ */
+function formatPackageName(change) {
+    if (change.direct) {
+        return `**${change.name}**`;
+    }
+    return `*${change.name}*`;
+}
+/**
+ * Wraps content in a collapsed HTML details/summary block for GitHub-compatible markdown.
+ */
+function detailsBlock(summary, body) {
+    return `<details>\n<summary>${summary}</summary>\n\n${body}\n\n</details>`;
+}
+/**
+ * Formats one list of changes into collapsible changed/added/removed blocks.
+ */
+function formatChangeGroups(changes) {
+    const byType = groupByChangeType(changes);
+    const parts = [];
+    if (byType.changed.length > 0) {
+        parts.push(detailsBlock(`Changed Packages (${byType.changed.length})`, formatChangedTable(byType.changed)));
+    }
+    if (byType.added.length > 0) {
+        parts.push(detailsBlock(`Added Packages (${byType.added.length})`, formatSingleVersionTable(byType.added, "to")));
+    }
+    if (byType.removed.length > 0) {
+        parts.push(detailsBlock(`Removed Packages (${byType.removed.length})`, formatSingleVersionTable(byType.removed, "from")));
+    }
+    return parts.join("\n\n");
+}
+/**
+ * Splits changes into required vs optional/platform and renders both sections.
+ */
+function formatDependencyBucket(title, changes) {
+    if (changes.length === 0) {
+        return "";
+    }
+    const required = changes.filter((change) => !change.optional);
+    const optional = changes.filter((change) => change.optional);
+    const parts = [`## ${title}`, ""];
+    if (required.length > 0) {
+        parts.push(formatChangeGroups(required));
+    }
+    if (optional.length > 0) {
+        parts.push("");
+        parts.push(`### Optional / platform (${optional.length})`);
+        parts.push("");
+        parts.push(formatChangeGroups(optional));
+    }
+    if (required.length === 0 && optional.length === 0) {
+        return "";
+    }
+    return parts.join("\n");
+}
+/**
+ * Formats References cell: advisory links, or a meta-vuln via label.
+ */
+function formatFindingReferences(finding) {
+    if (finding.refs.length > 0) {
+        return formatRefsMarkdown(finding.refs);
+    }
+    if (finding.viaPackages && finding.viaPackages.length > 0) {
+        const via = finding.viaPackages.map((name) => `\`${name}\``).join(", ");
+        return `transitive (via ${via})`;
+    }
+    return "—";
+}
+/**
+ * Formats a markdown section listing security findings.
+ * Returns an empty string when there are no findings (section omitted).
+ */
+function formatFindings(title, intro, findings) {
+    if (findings.length === 0) {
+        return "";
+    }
+    const rows = [
+        `### ${title} (${findings.length})`,
+        "",
+        intro,
+        "",
+        "| Severity | Title | References | Package |",
+        "|----------|-------|------------|---------|",
+        ...findings.map((item) => {
+            const titleText = item.title?.trim() || "—";
+            return `| ${item.severity} | ${titleText} | ${formatFindingReferences(item)} | \`${item.packageName}\` |`;
+        }),
+    ];
+    return rows.join("\n");
+}
+/**
+ * Joins non-empty security finding sections with blank lines between them.
+ */
+function formatSecuritySections(sections) {
+    return sections.filter((section) => section.length > 0).join("\n\n");
+}
+/**
+ * Renders the top-of-report summary with package and security counts.
+ */
+function formatSummary(report) {
+    const packages = packageChangeCounts(report);
+    const { fixed, introduced, unresolved } = report.security;
+    const policy = policyIssueCount(report);
+    const lines = [
+        "## Summary",
+        "",
+        `- Mode: \`${report.mode}\``,
+        `- Strategy: \`${report.strategy}\``,
+        `- Package manager: \`${report.packageManager}\``,
+    ];
+    if (report.beefupVersion) {
+        lines.push(`- Beefup: \`${report.beefupVersion}\``);
+    }
+    if (report.generatedAt) {
+        lines.push(`- Generated: \`${report.generatedAt}\``);
+    }
+    lines.push(`- Packages: **${packages.changed}** changed, **${packages.added}** added, **${packages.removed}** removed`, `- Security: **${introduced.length}** introduced, **${unresolved.length}** unresolved, **${fixed.length}** fixed`, `- Policy: ${policy === 0 ? "**no issues**" : `**${policy}** issue(s)`}`);
+    if (introduced.length === 0) {
+        lines.push("- No CVEs introduced by this staged upgrade");
+    }
+    else {
+        lines.push(`- **Warning:** ${introduced.length} CVE(s) introduced — review before accept`);
+    }
+    return lines.join("\n");
+}
+/**
+ * Renders the policy section.
+ */
+function formatPolicy(report) {
+    const parts = ["## Policy", ""];
+    if (policyIssueCount(report) === 0) {
+        parts.push("No policy issues.");
+        return parts.join("\n");
+    }
+    for (const item of report.ranges) {
+        parts.push(`- **${item.severity}** ${item.message}`);
+    }
+    for (const item of report.overrides) {
+        parts.push(`- **${AlignmentActions.Error}** [${item.override}] ${item.message}`);
+    }
+    for (const item of report.alignment) {
+        parts.push(`- **${item.severity}** [${item.group}] ${item.message}`);
+    }
+    return parts.join("\n");
+}
+/**
+ * Renders footer legend and path hints.
+ */
+function formatFooter() {
+    return [
+        "## Legend",
+        "",
+        "- **Bold** package names are direct dependencies (declared in a workspace `package.json`).",
+        "- *Italic* package names are transitive.",
+        "- **Optional / platform** sections list packages marked optional in the lockfile or `optionalDependencies` (still security-scanned).",
+        `- Security rows titled “${META_VULN_TITLE}” are npm meta-vulns: the package has no advisory of its own but depends on a vulnerable package.`,
+        "",
+        "## Paths",
+        "",
+        "- Staged proposal: `.beefup/staged`",
+        "- This report: `.beefup/report`",
+    ].join("\n");
+}
+/**
+ * Renders a stage report as markdown for files or stdout.
+ * Order: Summary → Security (Introduced → Unresolved → Fixed) → Policy → package diffs → Warnings → Legend.
+ */
+export function renderMarkdown(report) {
+    const parts = [
+        "# Beefup upgrade report",
+        "",
+        formatSummary(report),
+        "",
+        "## Security",
+        "",
+        formatSecuritySections([
+            formatFindings(SecuritySectionTitles.Introduced, SecuritySectionIntros.Introduced, report.security.introduced),
+            formatFindings(SecuritySectionTitles.Unresolved, SecuritySectionIntros.Unresolved, report.security.unresolved),
+            formatFindings(SecuritySectionTitles.Fixed, SecuritySectionIntros.Fixed, report.security.fixed),
+        ]) || "No security findings.",
+        "",
+        formatPolicy(report),
+    ];
+    const deps = formatDependencyBucket("Dependencies", report.diff.dependencies);
+    if (deps) {
+        parts.push("", deps);
+    }
+    const devDeps = formatDependencyBucket("Dev Dependencies", report.diff.devDependencies);
+    if (devDeps) {
+        parts.push("", devDeps);
+    }
+    if (report.warnings.length > 0) {
+        parts.push("", "## Warnings");
+        for (const warning of report.warnings) {
+            parts.push(`- ${warning}`);
+        }
+    }
+    parts.push("", formatFooter());
+    return `${parts.join("\n")}\n`;
+}
+//# sourceMappingURL=markdown.js.map

package/dist/report/markdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.js","sourceRoot":"","sources":["../../src/report/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAKrD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAGrB;;GAEG;AACH,SAAS,kBAAkB,CAAC,OAAwB;IAClD,MAAM,IAAI,GAAG;QACX,yCAAyC;QACzC,yCAAyC;KAC1C,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CACP,KAAK,iBAAiB,CAAC,MAAM,CAAC,QAAQ,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CACvH,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAC/B,OAAwB,EACxB,IAAmB;IAEnB,MAAM,IAAI,GAAG,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC;IAChE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,GACZ,IAAI,KAAK,IAAI;YACX,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,KAAK,iBAAiB,CAAC,MAAM,CAAC,QAAQ,QAAQ,MAAM,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAqB;IAC9C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,IAAY;IACjD,OAAO,uBAAuB,OAAO,iBAAiB,IAAI,gBAAgB,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,OAAwB;IAClD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,YAAY,CACV,qBAAqB,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,EAC7C,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CACnC,CACF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CACR,YAAY,CACV,mBAAmB,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,EACzC,wBAAwB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAC7C,CACF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,YAAY,CACV,qBAAqB,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,EAC7C,wBAAwB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CACjD,CACF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,KAAa,EAAE,OAAwB;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,4BAA4B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,OAAwB;IACvD,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,OAAO,mBAAmB,GAAG,GAAG,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,KAAa,EACb,KAAa,EACb,QAA2B;IAE3B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG;QACX,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM,GAAG;QACnC,EAAE;QACF,KAAK;QACL,EAAE;QACF,6CAA6C;QAC7C,6CAA6C;QAC7C,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACvB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC;YAC5C,OAAO,KAAK,IAAI,CAAC,QAAQ,MAAM,SAAS,MAAM,uBAAuB,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,MAAM,CAAC;QAC5G,CAAC,CAAC;KACH,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,QAAkB;IAChD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvE,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,MAAmB;IACxC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC1D,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG;QACZ,YAAY;QACZ,EAAE;QACF,aAAa,MAAM,CAAC,IAAI,IAAI;QAC5B,iBAAiB,MAAM,CAAC,QAAQ,IAAI;QACpC,wBAAwB,MAAM,CAAC,cAAc,IAAI;KAClD,CAAC;IACF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,CAAC,IAAI,CACR,iBAAiB,QAAQ,CAAC,OAAO,iBAAiB,QAAQ,CAAC,KAAK,eAAe,QAAQ,CAAC,OAAO,YAAY,EAC3G,iBAAiB,UAAU,CAAC,MAAM,oBAAoB,UAAU,CAAC,MAAM,oBAAoB,KAAK,CAAC,MAAM,UAAU,EACjH,aAAa,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,MAAM,aAAa,EAAE,CACzE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC5D,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,kBAAkB,UAAU,CAAC,MAAM,2CAA2C,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,MAAmB;IACvC,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAChC,IAAI,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,OAAO,gBAAgB,CAAC,KAAK,OAAO,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,SAAS,YAAY;IACnB,OAAO;QACL,WAAW;QACX,EAAE;QACF,4FAA4F;QAC5F,0CAA0C;QAC1C,sIAAsI;QACtI,2BAA2B,eAAe,mGAAmG;QAC7I,EAAE;QACF,UAAU;QACV,EAAE;QACF,qCAAqC;QACrC,iCAAiC;KAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAmB;IAChD,MAAM,KAAK,GAAa;QACtB,yBAAyB;QACzB,EAAE;QACF,aAAa,CAAC,MAAM,CAAC;QACrB,EAAE;QACF,aAAa;QACb,EAAE;QACF,sBAAsB,CAAC;YACrB,cAAc,CACZ,qBAAqB,CAAC,UAAU,EAChC,qBAAqB,CAAC,UAAU,EAChC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAC3B;YACD,cAAc,CACZ,qBAAqB,CAAC,UAAU,EAChC,qBAAqB,CAAC,UAAU,EAChC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAC3B;YACD,cAAc,CACZ,qBAAqB,CAAC,KAAK,EAC3B,qBAAqB,CAAC,KAAK,EAC3B,MAAM,CAAC,QAAQ,CAAC,KAAK,CACtB;SACF,CAAC,IAAI,uBAAuB;QAC7B,EAAE;QACF,YAAY,CAAC,MAAM,CAAC;KACrB,CAAC;IAEF,MAAM,IAAI,GAAG,sBAAsB,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9E,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,OAAO,GAAG,sBAAsB,CACpC,kBAAkB,EAClB,MAAM,CAAC,IAAI,CAAC,eAAe,CAC5B,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QAC9B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAE/B,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/report/shared.d.ts

@@ -0,0 +1,25 @@
+import type { StageReport } from "./types.js";
+/** Display titles for security finding buckets. */
+export declare const SecuritySectionTitles: {
+    readonly Introduced: "Introduced";
+    readonly Unresolved: "Unresolved";
+    readonly Fixed: "Fixed";
+};
+/** Short blurbs explaining each security section under its heading. */
+export declare const SecuritySectionIntros: {
+    readonly Introduced: "New findings that appear only after this staged upgrade. Review before accept — these are regressions.";
+    readonly Unresolved: "Findings still present after the upgrade. They were not fixed by this proposal and remain open risk.";
+    readonly Fixed: "Findings present before the upgrade that no longer appear afterward. Cleared by this staged proposal.";
+};
+/**
+ * Counts package changes across dependencies and devDependencies.
+ */
+export declare function packageChangeCounts(report: StageReport): {
+    changed: number;
+    added: number;
+    removed: number;
+};
+/**
+ * Counts policy findings for the summary section.
+ */
+export declare function policyIssueCount(report: StageReport): number;

package/dist/report/shared.js

@@ -0,0 +1,32 @@
+import { groupByChangeType } from "../diff/group.js";
+/** Display titles for security finding buckets. */
+export const SecuritySectionTitles = {
+    Introduced: "Introduced",
+    Unresolved: "Unresolved",
+    Fixed: "Fixed",
+};
+/** Short blurbs explaining each security section under its heading. */
+export const SecuritySectionIntros = {
+    Introduced: "New findings that appear only after this staged upgrade. Review before accept — these are regressions.",
+    Unresolved: "Findings still present after the upgrade. They were not fixed by this proposal and remain open risk.",
+    Fixed: "Findings present before the upgrade that no longer appear afterward. Cleared by this staged proposal.",
+};
+/**
+ * Counts package changes across dependencies and devDependencies.
+ */
+export function packageChangeCounts(report) {
+    const deps = groupByChangeType(report.diff.dependencies);
+    const dev = groupByChangeType(report.diff.devDependencies);
+    return {
+        changed: deps.changed.length + dev.changed.length,
+        added: deps.added.length + dev.added.length,
+        removed: deps.removed.length + dev.removed.length,
+    };
+}
+/**
+ * Counts policy findings for the summary section.
+ */
+export function policyIssueCount(report) {
+    return report.ranges.length + report.overrides.length + report.alignment.length;
+}
+//# sourceMappingURL=shared.js.map

package/dist/report/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/report/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,mDAAmD;AACnD,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,UAAU,EAAE,YAAY;IACxB,UAAU,EAAE,YAAY;IACxB,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,uEAAuE;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,UAAU,EACR,wGAAwG;IAC1G,UAAU,EACR,sGAAsG;IACxG,KAAK,EACH,uGAAuG;CACjG,CAAC;AAEX;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IAKrD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3D,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM;QACjD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM;QAC3C,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM;KAClD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAmB;IAClD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;AAClF,CAAC"}

package/dist/report/text.d.ts

@@ -0,0 +1,10 @@
+import type { StageReport } from "./types.js";
+export interface TextRenderOptions {
+    /** When true, wrap severities and version comparisons in ANSI colour. */
+    color?: boolean;
+}
+/**
+ * Renders a stage report as plain text for stdout.
+ * When `color` is true, severities and from/to versions use ANSI colour.
+ */
+export declare function renderText(report: StageReport, options?: TextRenderOptions): string;

package/dist/report/text.js

@@ -0,0 +1,156 @@
+import { AlignmentActions } from "../config/types.js";
+import { formatUniqueVersions } from "../diff/diff.js";
+import { groupByChangeType } from "../diff/group.js";
+import { PackageChangeTypes } from "../diff/types.js";
+import { formatRefsText } from "../security/refs.js";
+import { Ansi, ansiForSeverity, paint } from "./ansi.js";
+import { packageChangeCounts, policyIssueCount } from "./shared.js";
+/**
+ * Formats a version string for display, optionally painting from/to sides.
+ */
+function formatVersion(versions, color, side) {
+    if (versions.length === 0 || versions === "—") {
+        return versions;
+    }
+    return side === "from"
+        ? paint(Ansi.Red, versions, color)
+        : paint(Ansi.Green, versions, color);
+}
+/**
+ * Formats a single package change as a plain-text report line.
+ */
+function formatChange(change, color) {
+    const from = formatVersion(formatUniqueVersions(change.from), color, "from");
+    const to = formatVersion(formatUniqueVersions(change.to), color, "to");
+    const marker = change.direct ? "D" : "T";
+    const optional = change.optional ? " [optional]" : "";
+    switch (change.type) {
+        case PackageChangeTypes.Added:
+            return `  + [${marker}]${optional} ${change.name}@${to}`;
+        case PackageChangeTypes.Removed:
+            return `  - [${marker}]${optional} ${change.name}@${from}`;
+        case PackageChangeTypes.Changed:
+            return `  ~ [${marker}]${optional} ${change.name}: ${from} → ${to}`;
+    }
+}
+/**
+ * Formats a titled section of dependency changes grouped by change kind.
+ */
+function formatChanges(title, changes, color) {
+    if (changes.length === 0) {
+        return [];
+    }
+    const required = changes.filter((change) => !change.optional);
+    const optional = changes.filter((change) => change.optional);
+    const parts = [title];
+    parts.push(...formatChangeGroups(required, color));
+    if (optional.length > 0) {
+        parts.push(`Optional / platform (${optional.length}):`);
+        parts.push(...formatChangeGroups(optional, color));
+    }
+    return parts;
+}
+/**
+ * Formats changed/added/removed groups for one package list.
+ */
+function formatChangeGroups(changes, color) {
+    if (changes.length === 0) {
+        return [];
+    }
+    const byType = groupByChangeType(changes);
+    const parts = [];
+    const sections = [
+        ["Changed Packages", byType.changed],
+        ["Added Packages", byType.added],
+        ["Removed Packages", byType.removed],
+    ];
+    for (const [label, list] of sections) {
+        if (list.length === 0) {
+            continue;
+        }
+        parts.push(`${label} (${list.length}):`);
+        parts.push(...list.map((item) => formatChange(item, color)));
+    }
+    return parts;
+}
+/**
+ * Formats a finding's refs or meta-vuln via label for plain text.
+ */
+function formatFindingRefs(finding) {
+    if (finding.refs.length > 0) {
+        return formatRefsText(finding.refs);
+    }
+    if (finding.viaPackages && finding.viaPackages.length > 0) {
+        return `transitive (via ${finding.viaPackages.join(", ")})`;
+    }
+    return "—";
+}
+/**
+ * Paints a severity label when colour is enabled.
+ */
+function formatSeverity(severity, color) {
+    return paint(ansiForSeverity(severity), severity, color);
+}
+/**
+ * Paints a count when it is non-zero so zeros stay unstyled.
+ */
+function paintCount(count, codes, color) {
+    const text = String(count);
+    if (count === 0) {
+        return text;
+    }
+    return paint(codes, text, color);
+}
+/**
+ * Renders a stage report as plain text for stdout.
+ * When `color` is true, severities and from/to versions use ANSI colour.
+ */
+export function renderText(report, options = {}) {
+    const color = options.color === true;
+    const packages = packageChangeCounts(report);
+    const { fixed, introduced, unresolved } = report.security;
+    const policyCount = policyIssueCount(report);
+    const parts = [
+        `Beefup stage (${report.packageManager}, mode=${report.mode}, strategy=${report.strategy})`,
+    ];
+    if (report.beefupVersion) {
+        parts.push(`Beefup ${report.beefupVersion}`);
+    }
+    if (report.generatedAt) {
+        parts.push(`Generated ${report.generatedAt}`);
+    }
+    parts.push(`Summary: ${packages.changed} changed, ${packages.added} added, ${packages.removed} removed packages`, `Security: ${paintCount(introduced.length, Ansi.Red, color)} introduced, ${paintCount(unresolved.length, Ansi.Yellow, color)} unresolved, ${paintCount(fixed.length, Ansi.Green, color)} fixed`, `Policy: ${policyCount === 0 ? "no issues" : `${policyCount} issue(s)`}`);
+    if (introduced.length === 0) {
+        parts.push("No CVEs introduced by this staged upgrade");
+    }
+    else {
+        parts.push(paint([Ansi.Bold, Ansi.Red], `Warning: ${introduced.length} CVE(s) introduced — review before accept`, color));
+        parts.push("Introduced:");
+        for (const item of introduced) {
+            parts.push(`  ! ${formatSeverity(item.severity, color)} ${formatFindingRefs(item)} ${item.packageName}`);
+        }
+    }
+    if (unresolved.length > 0) {
+        parts.push(`Unresolved (${unresolved.length}):`);
+        for (const item of unresolved) {
+            parts.push(`  * ${formatSeverity(item.severity, color)} ${formatFindingRefs(item)} ${item.packageName}`);
+        }
+    }
+    parts.push(...formatChanges("DEPENDENCIES", report.diff.dependencies, color));
+    parts.push(...formatChanges("DEV DEPENDENCIES", report.diff.devDependencies, color));
+    for (const item of report.ranges.filter((finding) => finding.severity === AlignmentActions.Error)) {
+        parts.push(paint(Ansi.Red, `error: ${item.message}`, color));
+    }
+    for (const item of report.overrides) {
+        parts.push(paint(Ansi.Red, `error: [${item.override}] ${item.message}`, color));
+    }
+    for (const item of report.alignment.filter((finding) => finding.severity === AlignmentActions.Error)) {
+        parts.push(paint(Ansi.Red, `error: [${item.group}] ${item.message}`, color));
+    }
+    for (const warning of report.warnings) {
+        parts.push(paint(Ansi.Yellow, `warning: ${warning}`, color));
+    }
+    parts.push("Legend: [D]=direct, [T]=transitive");
+    return `${parts.filter((line) => line !== "").join("\n")}\n`;
+}
+//# sourceMappingURL=text.js.map

package/dist/report/text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.js","sourceRoot":"","sources":["../../src/report/text.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAsB,MAAM,kBAAkB,CAAC;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAQpE;;GAEG;AACH,SAAS,aAAa,CACpB,QAAgB,EAChB,KAAc,EACd,IAAmB;IAEnB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,KAAK,MAAM;QACpB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC;QAClC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,MAAqB,EAAE,KAAc;IACzD,MAAM,IAAI,GAAG,aAAa,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7E,MAAM,EAAE,GAAG,aAAa,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,kBAAkB,CAAC,KAAK;YAC3B,OAAO,QAAQ,MAAM,IAAI,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QAC3D,KAAK,kBAAkB,CAAC,OAAO;YAC7B,OAAO,QAAQ,MAAM,IAAI,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QAC7D,KAAK,kBAAkB,CAAC,OAAO;YAC7B,OAAO,QAAQ,MAAM,IAAI,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,MAAM,EAAE,EAAE,CAAC;IACxE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CACpB,KAAa,EACb,OAAwB,EACxB,KAAc;IAEd,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,wBAAwB,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,OAAwB,EAAE,KAAc;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAqC;QACjD,CAAC,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;QACpC,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC;QAChC,CAAC,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;KACrC,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,OAAwB;IACjD,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,mBAAmB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,QAAyB,EAAE,KAAc;IAC/D,OAAO,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CACjB,KAAa,EACb,KAAiC,EACjC,KAAc;IAEd,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,MAAmB,EACnB,UAA6B,EAAE;IAE/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;IACrC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC1D,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAE7C,MAAM,KAAK,GAAG;QACZ,iBAAiB,MAAM,CAAC,cAAc,UAAU,MAAM,CAAC,IAAI,cAAc,MAAM,CAAC,QAAQ,GAAG;KAC5F,CAAC;IACF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,KAAK,CAAC,IAAI,CACR,YAAY,QAAQ,CAAC,OAAO,aAAa,QAAQ,CAAC,KAAK,WAAW,QAAQ,CAAC,OAAO,mBAAmB,EACrG,aAAa,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,gBAAgB,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,gBAAgB,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAC/L,WAAW,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,WAAW,EAAE,CACzE,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IAC1D,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,KAAK,CACH,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EACrB,YAAY,UAAU,CAAC,MAAM,2CAA2C,EACxE,KAAK,CACN,CACF,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CACR,OAAO,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,eAAe,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC;QACjD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CACR,OAAO,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;IAErF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CACrC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,gBAAgB,CAAC,KAAK,CACzD,EAAE,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CACxC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,gBAAgB,CAAC,KAAK,CACzD,EAAE,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IAEjD,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAC/D,CAAC"}

package/dist/report/types.d.ts

@@ -0,0 +1,20 @@
+import type { ResolutionDiff } from "../diff/types.js";
+import type { AlignmentFinding } from "../policy/alignment.js";
+import type { OverrideFinding } from "../policy/overrides.js";
+import type { RangeFinding } from "../policy/ranges.js";
+import type { ClassifiedFindings } from "../security/classify.js";
+export interface StageReport {
+    mode: string;
+    strategy: string;
+    packageManager: string;
+    /** ISO timestamp when the report was generated. */
+    generatedAt?: string;
+    /** Beefup CLI version that produced the report. */
+    beefupVersion?: string;
+    diff: ResolutionDiff;
+    ranges: RangeFinding[];
+    overrides: OverrideFinding[];
+    alignment: AlignmentFinding[];
+    security: ClassifiedFindings;
+    warnings: string[];
+}

package/dist/report/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/report/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/report/types.ts"],"names":[],"mappings":""}

package/dist/rewrite/constraints.d.ts

@@ -0,0 +1,20 @@
+import { type UpgradeMode } from "../config/types.js";
+import { type PackageJson } from "../project/package-json.js";
+/**
+ * Returns true when a dependency spec should not be rewritten (protocols, paths).
+ */
+export declare function shouldSkipSpec(spec: string): boolean;
+/**
+ * Extracts a concrete semver version from an exact pin or range minimum.
+ */
+export declare function declaredVersion(spec: string): string | null;
+/**
+ * Rewrites a dependency constraint for same-major (^) or latest (>=) upgrade mode.
+ * Returns null when the spec cannot or should not be rewritten.
+ */
+export declare function rewriteConstraint(spec: string, mode: UpgradeMode): string | null;
+/**
+ * Rewrites direct dependency constraints in a package.json for the given mode.
+ * Leaves peerDependencies and non-rewritable specs unchanged.
+ */
+export declare function rewritePackageJson(pkg: PackageJson, mode: UpgradeMode): PackageJson;

package/dist/rewrite/constraints.js

@@ -0,0 +1,64 @@
+import semver from "semver";
+import { UpgradeModes } from "../config/types.js";
+import { DIRECT_DEP_FIELDS, } from "../project/package-json.js";
+const SKIP_SPEC = /^(workspace:|file:|link:|catalog:|npm:|http:|https:|git\+|git:|github:|gitlab:|bitbucket:|portal:|pkg:)/;
+/**
+ * Returns true when a dependency spec should not be rewritten (protocols, paths).
+ */
+export function shouldSkipSpec(spec) {
+    const trimmed = spec.trim();
+    if (SKIP_SPEC.test(trimmed)) {
+        return true;
+    }
+    if (trimmed.startsWith(".") || trimmed.startsWith("/")) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Extracts a concrete semver version from an exact pin or range minimum.
+ */
+export function declaredVersion(spec) {
+    if (semver.valid(spec)) {
+        return spec;
+    }
+    const min = semver.minVersion(spec);
+    return min ? min.version : null;
+}
+/**
+ * Rewrites a dependency constraint for same-major (^) or latest (>=) upgrade mode.
+ * Returns null when the spec cannot or should not be rewritten.
+ */
+export function rewriteConstraint(spec, mode) {
+    if (shouldSkipSpec(spec)) {
+        return null;
+    }
+    const version = declaredVersion(spec);
+    if (!version) {
+        return null;
+    }
+    return mode === UpgradeModes.Latest ? `>=${version}` : `^${version}`;
+}
+/**
+ * Rewrites direct dependency constraints in a package.json for the given mode.
+ * Leaves peerDependencies and non-rewritable specs unchanged.
+ */
+export function rewritePackageJson(pkg, mode) {
+    const next = { ...pkg };
+    for (const field of DIRECT_DEP_FIELDS) {
+        const bucket = pkg[field];
+        if (!bucket) {
+            continue;
+        }
+        const rewritten = { ...bucket };
+        for (const [name, spec] of Object.entries(bucket)) {
+            const updated = rewriteConstraint(spec, mode);
+            if (updated) {
+                rewritten[name] = updated;
+            }
+        }
+        next[field] = rewritten;
+    }
+    return next;
+}
+//# sourceMappingURL=constraints.js.map

package/dist/rewrite/constraints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constraints.js","sourceRoot":"","sources":["../../src/rewrite/constraints.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAoB,MAAM,oBAAoB,CAAC;AACpE,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,SAAS,GACb,yGAAyG,CAAC;AAE5G;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,IAAiB;IAC/D,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,KAAK,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAgB,EAChB,IAAiB;IAEjB,MAAM,IAAI,GAAgB,EAAE,GAAG,GAAG,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAA2B,EAAE,GAAG,MAAM,EAAE,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9C,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/rewrite/repin.d.ts

@@ -0,0 +1,8 @@
+import { type PackageJson } from "../project/package-json.js";
+/** Map of package name → locked version used when re-pinning ranges. */
+export type LockedVersions = Map<string, string>;
+/**
+ * Replaces direct dependency specs with exact locked versions where available.
+ * Skips specs that should not be rewritten (e.g. workspace/link protocols).
+ */
+export declare function rePinPackageJson(pkg: PackageJson, locked: LockedVersions): PackageJson;

package/dist/rewrite/repin.js

@@ -0,0 +1,28 @@
+import { DIRECT_DEP_FIELDS, } from "../project/package-json.js";
+import { shouldSkipSpec } from "./constraints.js";
+/**
+ * Replaces direct dependency specs with exact locked versions where available.
+ * Skips specs that should not be rewritten (e.g. workspace/link protocols).
+ */
+export function rePinPackageJson(pkg, locked) {
+    const next = { ...pkg };
+    for (const field of DIRECT_DEP_FIELDS) {
+        const bucket = pkg[field];
+        if (!bucket) {
+            continue;
+        }
+        const rewritten = { ...bucket };
+        for (const [name, spec] of Object.entries(bucket)) {
+            if (shouldSkipSpec(spec)) {
+                continue;
+            }
+            const version = locked.get(name);
+            if (version) {
+                rewritten[name] = version;
+            }
+        }
+        next[field] = rewritten;
+    }
+    return next;
+}
+//# sourceMappingURL=repin.js.map

package/dist/rewrite/repin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repin.js","sourceRoot":"","sources":["../../src/rewrite/repin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAKlD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAgB,EAChB,MAAsB;IAEtB,MAAM,IAAI,GAAgB,EAAE,GAAG,GAAG,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAA2B,EAAE,GAAG,MAAM,EAAE,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}