@tractorcow/beefup 0.0.0 → 1.0.0

package/dist/security/scan.d.ts

@@ -0,0 +1,13 @@
+import type { ProcessRunner } from "../pm/runner.js";
+import { type PackageManager } from "../project/types.js";
+import type { SecurityFinding } from "./classify.js";
+/**
+ * Runs npm/pnpm audit and cve-lite against a project root and merges findings.
+ */
+export declare function scanProject(options: {
+    root: string;
+    packageManager: PackageManager;
+    pmBin: string;
+    prefixArgs: string[];
+    runner: ProcessRunner;
+}): Promise<SecurityFinding[]>;

package/dist/security/scan.js

@@ -0,0 +1,32 @@
+import { BeefupError } from "../errors.js";
+import { resolveCveLiteBin } from "../pm/cve-lite-bin.js";
+import { PackageManagers } from "../project/types.js";
+import { parseCveLiteJson } from "./cve-lite.js";
+import { parseNpmAuditJson } from "./npm-audit.js";
+/**
+ * Runs npm/pnpm audit and cve-lite against a project root and merges findings.
+ */
+export async function scanProject(options) {
+    const auditArgs = [
+        ...options.prefixArgs,
+        ...(options.packageManager === PackageManagers.Npm
+            ? ["audit", "--json", "--package-lock-only"]
+            : ["audit", "--json"]),
+    ];
+    const audit = await options.runner.run(options.pmBin, auditArgs, options.root);
+    const auditFindings = parseNpmAuditJson(audit.stdout || audit.stderr);
+    let cveFindings = [];
+    try {
+        const cveBin = await resolveCveLiteBin();
+        const cve = await options.runner.run(cveBin, [options.root, "--json"], options.root);
+        cveFindings = parseCveLiteJson(cve.stdout || cve.stderr);
+    }
+    catch (error) {
+        if (error instanceof BeefupError) {
+            throw error;
+        }
+        throw new BeefupError(`cve-lite scan failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return [...auditFindings, ...cveFindings];
+}
+//# sourceMappingURL=scan.js.map

package/dist/security/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/security/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAuB,MAAM,qBAAqB,CAAC;AAE3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAMjC;IACC,MAAM,SAAS,GAAG;QAChB,GAAG,OAAO,CAAC,UAAU;QACrB,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,eAAe,CAAC,GAAG;YAChD,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,qBAAqB,CAAC;YAC5C,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;KACzB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAEtE,IAAI,WAAW,GAAsB,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAClC,MAAM,EACN,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,EACxB,OAAO,CAAC,IAAI,CACb,CAAC;QACF,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,WAAW,CACnB,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,aAAa,EAAE,GAAG,WAAW,CAAC,CAAC;AAC5C,CAAC"}

package/dist/strategy/git.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Runs a git command in cwd and returns trimmed stdout/stderr.
+ */
+export declare function runGit(args: string[], cwd: string): Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+/**
+ * Returns whether cwd is inside a git working tree.
+ */
+export declare function isGitRepo(cwd: string): Promise<boolean>;
+/**
+ * Returns true when `git status --porcelain` lists any path outside `.beefup`.
+ * Beefup's own staged/report artefacts must not block a worktree re-stage.
+ */
+export declare function hasNonBeefupWorkingTreeChanges(porcelain: string): boolean;

package/dist/strategy/git.js

@@ -0,0 +1,92 @@
+import { execFile as execFileCallback } from "node:child_process";
+import { promisify } from "node:util";
+import { BEEFUP_DIR } from "../project/paths.js";
+const execFile = promisify(execFileCallback);
+/** Git porcelain v1 separator between rename/copy source and destination. */
+const PorcelainRenameSeparator = " -> ";
+/**
+ * Runs a git command in cwd and returns trimmed stdout/stderr.
+ */
+export async function runGit(args, cwd) {
+    const { stdout, stderr } = await execFile("git", args, {
+        cwd,
+        encoding: "utf8",
+    });
+    return { stdout: stdout.trim(), stderr: stderr.trim() };
+}
+/**
+ * Returns whether cwd is inside a git working tree.
+ */
+export async function isGitRepo(cwd) {
+    try {
+        await runGit(["rev-parse", "--is-inside-work-tree"], cwd);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Returns true when `git status --porcelain` lists any path outside `.beefup`.
+ * Beefup's own staged/report artefacts must not block a worktree re-stage.
+ */
+export function hasNonBeefupWorkingTreeChanges(porcelain) {
+    for (const line of porcelain.split("\n")) {
+        if (line.length < 4) {
+            continue;
+        }
+        for (const raw of splitPorcelainPaths(line.slice(3))) {
+            const normalized = normalizePorcelainPath(raw);
+            if (normalized.length > 0 && !isBeefupStatusPath(normalized)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Splits a porcelain path field into one path, or source and destination for renames.
+ */
+function splitPorcelainPaths(pathPart) {
+    let inQuotes = false;
+    let escaped = false;
+    for (let i = 0; i < pathPart.length; i += 1) {
+        const ch = pathPart[i];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (inQuotes && ch === "\\") {
+            escaped = true;
+            continue;
+        }
+        if (ch === '"') {
+            inQuotes = !inQuotes;
+            continue;
+        }
+        if (!inQuotes && pathPart.startsWith(PorcelainRenameSeparator, i)) {
+            return [
+                pathPart.slice(0, i),
+                pathPart.slice(i + PorcelainRenameSeparator.length),
+            ];
+        }
+    }
+    return [pathPart];
+}
+/**
+ * Unquotes a git C-style porcelain path and normalizes slashes and trailing slashes.
+ */
+function normalizePorcelainPath(raw) {
+    let value = raw.trim();
+    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+        value = value.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+    }
+    return value.replaceAll("\\", "/").replace(/\/+$/, "");
+}
+/**
+ * Returns true when a normalized porcelain path is `.beefup` or a file under it.
+ */
+function isBeefupStatusPath(normalized) {
+    return (normalized === BEEFUP_DIR || normalized.startsWith(`${BEEFUP_DIR}/`));
+}
+//# sourceMappingURL=git.js.map

package/dist/strategy/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/strategy/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,MAAM,QAAQ,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;AAE7C,6EAA6E;AAC7E,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,IAAc,EACd,GAAW;IAEX,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE;QACrD,GAAG;QACH,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,SAAiB;IAC9D,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO;gBACL,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACpB,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC;aACpD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,QAAQ,CAAC,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,GAAW;IACzC,IAAI,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACtE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,OAAO,CACL,UAAU,KAAK,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CACrE,CAAC;AACJ,CAAC"}

package/dist/strategy/index.d.ts

@@ -0,0 +1,7 @@
+import { type StageStrategyName } from "../config/types.js";
+import type { StageStrategy } from "./types.js";
+export type { StageStrategy, StageWorkspace } from "./types.js";
+/**
+ * Creates the isolation strategy used while staging an upgrade.
+ */
+export declare function createStageStrategy(name: StageStrategyName, projectRoot: string, lockfileName: string): StageStrategy;

package/dist/strategy/index.js

@@ -0,0 +1,13 @@
+import { StageStrategies } from "../config/types.js";
+import { InPlaceStrategy } from "./inplace.js";
+import { WorktreeStrategy } from "./worktree.js";
+/**
+ * Creates the isolation strategy used while staging an upgrade.
+ */
+export function createStageStrategy(name, projectRoot, lockfileName) {
+    if (name === StageStrategies.Inplace) {
+        return new InPlaceStrategy(projectRoot, lockfileName);
+    }
+    return new WorktreeStrategy(projectRoot);
+}
+//# sourceMappingURL=index.js.map

package/dist/strategy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/strategy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA0B,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIjD;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAuB,EACvB,WAAmB,EACnB,YAAoB;IAEpB,IAAI,IAAI,KAAK,eAAe,CAAC,OAAO,EAAE,CAAC;QACrC,OAAO,IAAI,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAC3C,CAAC"}

package/dist/strategy/inplace.d.ts

@@ -0,0 +1,30 @@
+import type { StageStrategy, StageWorkspace } from "./types.js";
+/**
+ * Stages upgrades in the live project tree using a backup for rollback.
+ */
+export declare class InPlaceStrategy implements StageStrategy {
+    private readonly projectRoot;
+    private readonly lockfileName;
+    readonly name: "inplace";
+    private backedUp;
+    /**
+     * Creates an in-place strategy for the given project root and lockfile name.
+     */
+    constructor(projectRoot: string, lockfileName: string);
+    /**
+     * Backs up writable project files and marks staging as in progress.
+     */
+    prepare(): Promise<StageWorkspace>;
+    /**
+     * Restores the live tree from backup when an in-place stage was started.
+     */
+    cleanup(): Promise<void>;
+    /**
+     * Copies writable project files into the backup directory before mutation.
+     */
+    private backup;
+    /**
+     * Restores writable files from backup and clears the in-progress marker.
+     */
+    private restoreFromBackup;
+}

package/dist/strategy/inplace.js

@@ -0,0 +1,77 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { StageStrategies } from "../config/types.js";
+import { copyFileTo, pathExists, removePath } from "../fsutil.js";
+import { backupDir, inProgressPath } from "../project/paths.js";
+import { listWritableRelativePaths } from "../project/workspace.js";
+/**
+ * Stages upgrades in the live project tree using a backup for rollback.
+ */
+export class InPlaceStrategy {
+    projectRoot;
+    lockfileName;
+    name = StageStrategies.Inplace;
+    backedUp = false;
+    /**
+     * Creates an in-place strategy for the given project root and lockfile name.
+     */
+    constructor(projectRoot, lockfileName) {
+        this.projectRoot = projectRoot;
+        this.lockfileName = lockfileName;
+    }
+    /**
+     * Backs up writable project files and marks staging as in progress.
+     */
+    async prepare() {
+        if (await pathExists(inProgressPath(this.projectRoot))) {
+            await this.restoreFromBackup();
+        }
+        await this.backup();
+        await writeFile(inProgressPath(this.projectRoot), `${StageStrategies.Inplace}\n`, "utf8");
+        this.backedUp = true;
+        return { root: this.projectRoot };
+    }
+    /**
+     * Restores the live tree from backup when an in-place stage was started.
+     */
+    async cleanup() {
+        if (this.backedUp || (await pathExists(inProgressPath(this.projectRoot)))) {
+            await this.restoreFromBackup();
+        }
+        this.backedUp = false;
+    }
+    /**
+     * Copies writable project files into the backup directory before mutation.
+     */
+    async backup() {
+        const dest = backupDir(this.projectRoot);
+        await removePath(dest);
+        await mkdir(dest, { recursive: true });
+        const rels = await listWritableRelativePaths(this.projectRoot, this.lockfileName);
+        for (const rel of rels) {
+            const from = path.join(this.projectRoot, rel);
+            if (await pathExists(from)) {
+                await copyFileTo(from, path.join(dest, rel));
+            }
+        }
+    }
+    /**
+     * Restores writable files from backup and clears the in-progress marker.
+     */
+    async restoreFromBackup() {
+        const dest = backupDir(this.projectRoot);
+        if (!(await pathExists(dest))) {
+            await removePath(inProgressPath(this.projectRoot));
+            return;
+        }
+        const rels = await listWritableRelativePaths(this.projectRoot, this.lockfileName);
+        for (const rel of rels) {
+            const from = path.join(dest, rel);
+            if (await pathExists(from)) {
+                await copyFileTo(from, path.join(this.projectRoot, rel));
+            }
+        }
+        await removePath(inProgressPath(this.projectRoot));
+    }
+}
+//# sourceMappingURL=inplace.js.map

package/dist/strategy/inplace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inplace.js","sourceRoot":"","sources":["../../src/strategy/inplace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAGpE;;GAEG;AACH,MAAM,OAAO,eAAe;IAQP;IACA;IARV,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;IAChC,QAAQ,GAAG,KAAK,CAAC;IAEzB;;OAEG;IACH,YACmB,WAAmB,EACnB,YAAoB;QADpB,gBAAW,GAAX,WAAW,CAAQ;QACnB,iBAAY,GAAZ,YAAY,CAAQ;IACpC,CAAC;IAEJ;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,MAAM,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,SAAS,CACb,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAChC,GAAG,eAAe,CAAC,OAAO,IAAI,EAC9B,MAAM,CACP,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;IACxB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,MAAM;QAClB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAC1C,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC9C,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB;QAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9B,MAAM,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAC1C,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAClC,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,MAAM,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACrD,CAAC;CACF"}

package/dist/strategy/types.d.ts

@@ -0,0 +1,13 @@
+import type { StageStrategyName } from "../config/types.js";
+/** Workspace root used while a staging strategy is active. */
+export interface StageWorkspace {
+    root: string;
+}
+/** Isolation strategy that prepares and cleans up a staging workspace. */
+export interface StageStrategy {
+    readonly name: StageStrategyName;
+    /** Creates an isolated workspace ready for rewrite and lockfile regeneration. */
+    prepare(): Promise<StageWorkspace>;
+    /** Discards or restores the isolated workspace after staging finishes. */
+    cleanup(): Promise<void>;
+}

package/dist/strategy/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/strategy/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/strategy/types.ts"],"names":[],"mappings":""}

package/dist/strategy/worktree.d.ts

@@ -0,0 +1,26 @@
+import type { StageStrategy, StageWorkspace } from "./types.js";
+/**
+ * Stages upgrades in a detached git worktree so the live tree stays untouched.
+ */
+export declare class WorktreeStrategy implements StageStrategy {
+    private readonly projectRoot;
+    readonly name: "worktree";
+    private workRoot;
+    /**
+     * Creates a worktree strategy for the given project root.
+     */
+    constructor(projectRoot: string);
+    /**
+     * Requires a git repo whose working tree is clean except for `.beefup/`,
+     * then creates a detached worktree for staging.
+     */
+    prepare(): Promise<StageWorkspace>;
+    /**
+     * Removes the staging worktree created by prepare, including leftovers.
+     */
+    cleanup(): Promise<void>;
+    /**
+     * Force-removes a worktree path via git, falling back to deleting the directory.
+     */
+    private removeLeftoverWorktree;
+}

package/dist/strategy/worktree.js

@@ -0,0 +1,74 @@
+import { mkdir } from "node:fs/promises";
+import { StageStrategies } from "../config/types.js";
+import { BeefupError } from "../errors.js";
+import { pathExists, removePath } from "../fsutil.js";
+import { beefupDir, worktreeDir } from "../project/paths.js";
+import { hasNonBeefupWorkingTreeChanges, isGitRepo, runGit } from "./git.js";
+/**
+ * Stages upgrades in a detached git worktree so the live tree stays untouched.
+ */
+export class WorktreeStrategy {
+    projectRoot;
+    name = StageStrategies.Worktree;
+    workRoot;
+    /**
+     * Creates a worktree strategy for the given project root.
+     */
+    constructor(projectRoot) {
+        this.projectRoot = projectRoot;
+    }
+    /**
+     * Requires a git repo whose working tree is clean except for `.beefup/`,
+     * then creates a detached worktree for staging.
+     */
+    async prepare() {
+        if (!(await isGitRepo(this.projectRoot))) {
+            throw new BeefupError(`strategy ${StageStrategies.Worktree} requires a git repository; commit the project or use --strategy ${StageStrategies.Inplace}`);
+        }
+        const { stdout: status } = await runGit(["status", "--porcelain"], this.projectRoot);
+        if (hasNonBeefupWorkingTreeChanges(status)) {
+            throw new BeefupError(`strategy ${StageStrategies.Worktree} requires a clean working tree (no staged, unstaged, or untracked files); commit or stash changes, or use --strategy ${StageStrategies.Inplace}`);
+        }
+        const workRoot = worktreeDir(this.projectRoot);
+        await this.removeLeftoverWorktree(workRoot);
+        await mkdir(beefupDir(this.projectRoot), { recursive: true });
+        await runGit(["worktree", "add", "--detach", workRoot, "HEAD"], this.projectRoot);
+        this.workRoot = workRoot;
+        return { root: workRoot };
+    }
+    /**
+     * Removes the staging worktree created by prepare, including leftovers.
+     */
+    async cleanup() {
+        if (!this.workRoot) {
+            const leftover = worktreeDir(this.projectRoot);
+            if (await pathExists(leftover)) {
+                await this.removeLeftoverWorktree(leftover);
+            }
+            return;
+        }
+        await this.removeLeftoverWorktree(this.workRoot);
+        this.workRoot = undefined;
+    }
+    /**
+     * Force-removes a worktree path via git, falling back to deleting the directory.
+     */
+    async removeLeftoverWorktree(workRoot) {
+        if (!(await pathExists(workRoot))) {
+            return;
+        }
+        try {
+            await runGit(["worktree", "remove", "--force", workRoot], this.projectRoot);
+        }
+        catch {
+            await removePath(workRoot);
+            try {
+                await runGit(["worktree", "prune"], this.projectRoot);
+            }
+            catch {
+                // Ignore prune failures after a forced directory removal.
+            }
+        }
+    }
+}
+//# sourceMappingURL=worktree.js.map

package/dist/strategy/worktree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree.js","sourceRoot":"","sources":["../../src/strategy/worktree.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,8BAA8B,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAG7E;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAOE;IANpB,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC;IACjC,QAAQ,CAAqB;IAErC;;OAEG;IACH,YAA6B,WAAmB;QAAnB,gBAAW,GAAX,WAAW,CAAQ;IAAG,CAAC;IAEpD;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,WAAW,CACnB,YAAY,eAAe,CAAC,QAAQ,oEAAoE,eAAe,CAAC,OAAO,EAAE,CAClI,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CACrC,CAAC,QAAQ,EAAE,aAAa,CAAC,EACzB,IAAI,CAAC,WAAW,CACjB,CAAC;QACF,IAAI,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,WAAW,CACnB,YAAY,eAAe,CAAC,QAAQ,wHAAwH,eAAe,CAAC,OAAO,EAAE,CACtL,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,CACV,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,EACjD,IAAI,CAAC,WAAW,CACjB,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/C,IAAI,MAAM,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;IAC5B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAAC,QAAgB;QACnD,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,CACV,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAC3C,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/package.json

@@ -1,8 +1,64 @@
 {
   "name": "@tractorcow/beefup",
-  "version": "0.0.0",
-  "description": "stub for trusted publishing bootstrap",
+  "version": "1.0.0",
+  "type": "module",
+  "description": "Staged, pinned, audited dependency upgrades for npm and pnpm.",
+  "packageManager": "pnpm@11.22.0",
+  "bin": {
+    "beefup": "./dist/bin.js"
+  },
+  "files": [
+    "dist",
+    "package.json"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsc",
+    "postbuild": "chmod +x dist/bin.js",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "pnpm run clean && pnpm run build",
+    "lint:commits": "commitlint --from HEAD~1 --to HEAD --verbose",
+    "test": "tsx --test --test-reporter spec $(find src -name '*.test.ts')"
+  },
+  "keywords": [
+    "dependencies",
+    "upgrade",
+    "npm",
+    "pnpm",
+    "lockfile",
+    "security",
+    "cve",
+    "semver"
+  ],
+  "author": "Damian Mooyman",
   "license": "ISC",
-  "publishConfig": { "access": "public" },
-  "repository": { "type": "git", "url": "https://github.com/tractorcow/beefup.git" }
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/tractorcow/beefup.git"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "dependencies": {
+    "cve-lite-cli": "1.29.0",
+    "semver": "7.8.5",
+    "yaml": "2.9.0"
+  },
+  "devDependencies": {
+    "@commitlint/cli": "^20.1.0",
+    "@commitlint/config-conventional": "^20.0.0",
+    "@semantic-release/commit-analyzer": "^13.0.1",
+    "@semantic-release/git": "^10.0.1",
+    "@semantic-release/github": "^12.0.2",
+    "@semantic-release/npm": "^13.1.2",
+    "@semantic-release/release-notes-generator": "^14.1.0",
+    "@types/node": "24.10.1",
+    "@types/semver": "7.7.1",
+    "semantic-release": "^25.0.2",
+    "tsx": "4.23.12",
+    "typescript": "5.9.3"
+  }
 }