autoremediator 0.21.2 → 0.22.0

package/dist/api/autonomy/index.js

@@ -0,0 +1,166 @@
+/**
+ * Earned autonomy at the SDK surface: read the level a repository is at, gate the operations that
+ * change a project on it, mark reports with it, and record outcomes into its track record.
+ *
+ * The feature is opt-in. Without an `autonomy` key in the policy file none of this does anything:
+ * nothing is refused, nothing is recorded, and reports carry no autonomy field.
+ */
+import { evaluate, effectiveLevel, nextPromotion, signalsFor, transitionsOf, } from "../../autonomy/compute.js";
+import { appendTrackEvents, readTrackRecord, recordPathOf, TRACK_RECORD_PATH, TrackRecordError, } from "../../autonomy/record.js";
+import { LEVEL_ALLOWS, LEVEL_NAMES, minLevel, resolveAutonomyConfig, } from "../../autonomy/types.js";
+import { loadPolicy } from "../../platform/policy.js";
+export { LEVEL_NAMES, TRACK_RECORD_PATH };
+/** Thrown when the level in force does not permit the operation. Nothing was changed. */
+export class AutonomyRefusedError extends Error {
+    level;
+    constructor(message, level) {
+        super(message);
+        this.name = "AutonomyRefusedError";
+        this.level = level;
+    }
+}
+/** The autonomy settings from the policy and the record they apply to; undefined when not opted in. */
+const ceilingOf = (entry) => Number(entry.ceiling.slice(1));
+function stateOf(cwd, policy) {
+    // The repository's own policy file always counts, and its thresholds are the ones used. A `policy`
+    // passed by a caller (it can be inline YAML, over MCP or HTTP too) may only lower the ceiling: it
+    // can never lift it, remove it, or relax the evidence rules (runs, success rate, cooldown, coverage).
+    const repoAutonomy = loadPolicy(cwd).autonomy;
+    const callerAutonomy = policy === undefined ? undefined : loadPolicy(cwd, policy).autonomy;
+    const autonomy = repoAutonomy && callerAutonomy && ceilingOf(callerAutonomy) < ceilingOf(repoAutonomy)
+        ? { ...repoAutonomy, ceiling: callerAutonomy.ceiling }
+        : (repoAutonomy ?? callerAutonomy);
+    if (!autonomy)
+        return undefined;
+    const config = resolveAutonomyConfig(autonomy);
+    try {
+        return { config, events: readTrackRecord(cwd).events };
+    }
+    catch (error) {
+        if (error instanceof TrackRecordError)
+            return { config, events: [], recordError: error.message };
+        throw error;
+    }
+}
+function levelOfState(state, now) {
+    const evaluation = evaluate(state.events, state.config, now);
+    // A record that cannot be read gives no evidence, so nothing beyond observing is allowed.
+    const level = state.recordError ? "L0" : effectiveLevel(evaluation, state.config);
+    return { evaluation, level };
+}
+export function getAutonomy(options = {}, now = new Date()) {
+    const cwd = options.cwd ?? process.cwd();
+    const base = { cwd, recordPath: recordPathOf(cwd) };
+    const state = stateOf(cwd, options.policy);
+    if (!state) {
+        return {
+            configured: false,
+            message: "No `autonomy` key in the policy file, so earned autonomy is off: nothing is gated or recorded. Add `autonomy: { ceiling: L2 }` to enable it.",
+            ...base,
+        };
+    }
+    const { evaluation, level } = levelOfState(state, now);
+    const last = state.events.at(-1);
+    const promotion = nextPromotion(evaluation, state.config);
+    const reasons = state.recordError
+        ? [
+            `${state.recordError} Fix or restore the file; until then the level is L0.`,
+            ...evaluation.reasons,
+        ]
+        : evaluation.reasons;
+    const ceilingNote = !state.recordError && level !== evaluation.earned
+        ? [
+            `The policy ceiling ${state.config.ceiling} holds the level below the earned ${evaluation.earned}`,
+        ]
+        : [];
+    return {
+        configured: true,
+        message: `Autonomy ${level} (${LEVEL_NAMES[level]}); ceiling ${state.config.ceiling}, earned ${evaluation.earned}.`,
+        ...base,
+        ...(state.recordError ? { recordError: state.recordError } : {}),
+        level,
+        levelName: LEVEL_NAMES[level],
+        ceiling: state.config.ceiling,
+        earned: state.recordError ? "L0" : evaluation.earned,
+        allows: LEVEL_ALLOWS[level],
+        settings: state.config,
+        evidence: {
+            ...evaluation.stats,
+            events: state.events.length,
+            ...(last
+                ? { lastEvent: { seq: last.seq, at: last.at, type: last.type, runId: last.runId } }
+                : {}),
+        },
+        reasons: [...ceilingNote, ...reasons],
+        ...(evaluation.cap ? { cap: evaluation.cap } : {}),
+        history: transitionsOf(state.events, state.config, now),
+        ...(promotion ? { nextPromotion: promotion } : {}),
+    };
+}
+/**
+ * Refuse an operation the level in force does not permit. A no-op when autonomy is not configured.
+ * Call before anything is changed.
+ */
+export function assertAutonomyAllows(cwd, policy, action, what, now = new Date()) {
+    const state = stateOf(cwd, policy);
+    if (!state)
+        return;
+    const { evaluation, level } = levelOfState(state, now);
+    if (LEVEL_ALLOWS[level][action])
+        return;
+    const why = state.recordError
+        ? state.recordError
+        : level === state.config.ceiling && level !== evaluation.earned
+            ? `the policy ceiling is ${state.config.ceiling}`
+            : (evaluation.reasons[0] ?? "see the track record");
+    throw new AutonomyRefusedError(`${what} refused: autonomy is ${level} (${LEVEL_NAMES[level]}), which does not allow ${action === "apply" ? "changing the project" : "recording plans"}. ` +
+        `Ceiling ${state.config.ceiling}, earned ${evaluation.earned}: ${why}. ` +
+        `Nothing was changed. Run \`autoremediator autonomy explain\` for the evidence.`, level);
+}
+/** The level and its signals for a report; undefined when autonomy is not configured. */
+export function summarizeAutonomy(cwd, policy, facts, now = new Date(), 
+/** The level the result was produced under, when it differs from the level now (a run can promote itself). */
+producedAt) {
+    const state = stateOf(cwd, policy);
+    if (!state)
+        return undefined;
+    const { evaluation, level } = levelOfState(state, now);
+    const signalLevel = producedAt ? minLevel(producedAt, level) : level;
+    const base = facts
+        ? signalsFor(signalLevel, facts)
+        : { autoMergeEligible: false, escalate: false, note: `${level} (${LEVEL_NAMES[level]})` };
+    const signals = signalLevel === level
+        ? base
+        : {
+            ...base,
+            note: `${base.note}; this run raised the level to ${level}, which applies from the next run`,
+        };
+    return {
+        level,
+        ceiling: state.config.ceiling,
+        earned: state.recordError ? "L0" : evaluation.earned,
+        name: LEVEL_NAMES[level],
+        autoMergeEligible: signals.autoMergeEligible,
+        escalate: signals.escalate,
+        note: signals.note,
+    };
+}
+/**
+ * Add outcomes to the track record, when autonomy is configured. Best effort by design: a record
+ * that cannot be written must never fail or undo the run that produced the outcome, so the problem
+ * is returned for the caller to log and nothing is thrown.
+ */
+export async function recordAutonomyEvents(cwd, policy, events) {
+    if (events.length === 0)
+        return { recorded: 0 };
+    try {
+        if (!loadPolicy(cwd, policy).autonomy)
+            return { recorded: 0 };
+        const added = await appendTrackEvents(cwd, events);
+        return { recorded: added.length };
+    }
+    catch (error) {
+        return { recorded: 0, problem: error instanceof Error ? error.message : String(error) };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/api/autonomy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/autonomy/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,QAAQ,EACR,cAAc,EACd,aAAa,EACb,UAAU,EACV,aAAa,GACd,MAAM,2BAA2B,CAAC;AAQnC,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,YAAY,EACZ,WAAW,EACX,QAAQ,EAER,qBAAqB,GAEtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAYtD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;AAmC1C,yFAAyF;AACzF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,KAAK,CAAgB;IAC9B,YAAY,OAAe,EAAE,KAAoB;QAC/C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAQD,uGAAuG;AACvG,MAAM,SAAS,GAAG,CAAC,KAA0B,EAAU,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzF,SAAS,OAAO,CAAC,GAAW,EAAE,MAA0B;IACtD,mGAAmG;IACnG,kGAAkG;IAClG,sGAAsG;IACtG,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC9C,MAAM,cAAc,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC;IAC3F,MAAM,QAAQ,GACZ,YAAY,IAAI,cAAc,IAAI,SAAS,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC;QACnF,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE;QACtD,CAAC,CAAC,CAAC,YAAY,IAAI,cAAc,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB;YACnC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAY,EAAE,GAAS;IAC3C,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7D,0FAA0F;IAC1F,MAAM,KAAK,GAAkB,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,OAAO,GAAuB,EAAE,EAChC,GAAG,GAAS,IAAI,IAAI,EAAE;IAEtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,OAAO,EACL,8IAA8I;YAChJ,GAAG,IAAI;SACR,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW;QAC/B,CAAC,CAAC;YACE,GAAG,KAAK,CAAC,WAAW,uDAAuD;YAC3E,GAAG,UAAU,CAAC,OAAO;SACtB;QACH,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;IACvB,MAAM,WAAW,GACf,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,KAAK,UAAU,CAAC,MAAM;QAC/C,CAAC,CAAC;YACE,sBAAsB,KAAK,CAAC,MAAM,CAAC,OAAO,qCAAqC,UAAU,CAAC,MAAM,EAAE;SACnG;QACH,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,YAAY,KAAK,KAAK,WAAW,CAAC,KAAK,CAAC,cAAc,KAAK,CAAC,MAAM,CAAC,OAAO,YAAY,UAAU,CAAC,MAAM,GAAG;QACnH,GAAG,IAAI;QACP,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,KAAK;QACL,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;QAC7B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;QAC7B,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM;QACpD,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC;QAC3B,QAAQ,EAAE,KAAK,CAAC,MAAM;QACtB,QAAQ,EAAE;YACR,GAAG,UAAU,CAAC,KAAK;YACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;YAC3B,GAAG,CAAC,IAAI;gBACN,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE;gBACnF,CAAC,CAAC,EAAE,CAAC;SACR;QACD,OAAO,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC;QACrC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC;QACvD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,MAA0B,EAC1B,MAAwB,EACxB,IAAY,EACZ,GAAG,GAAS,IAAI,IAAI,EAAE;IAEtB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO;IAExC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW;QAC3B,CAAC,CAAC,KAAK,CAAC,WAAW;QACnB,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,KAAK,UAAU,CAAC,MAAM;YAC7D,CAAC,CAAC,yBAAyB,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE;YACjD,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC;IACxD,MAAM,IAAI,oBAAoB,CAC5B,GAAG,IAAI,yBAAyB,KAAK,KAAK,WAAW,CAAC,KAAK,CAAC,2BAA2B,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,iBAAiB,IAAI;QACxJ,WAAW,KAAK,CAAC,MAAM,CAAC,OAAO,YAAY,UAAU,CAAC,MAAM,KAAK,GAAG,IAAI;QACxE,gFAAgF,EAClF,KAAK,CACN,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,MAA0B,EAC1B,KAAoB,EACpB,GAAG,GAAS,IAAI,IAAI,EAAE;AACtB,8GAA8G;AAC9G,UAA0B;IAE1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrE,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC;QAChC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,KAAK,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC5F,MAAM,OAAO,GACX,WAAW,KAAK,KAAK;QACnB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC;YACE,GAAG,IAAI;YACP,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,kCAAkC,KAAK,mCAAmC;SAC7F,CAAC;IACR,OAAO;QACL,KAAK;QACL,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;QAC7B,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM;QACpD,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC;QACxB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAW,EACX,MAA0B,EAC1B,MAAgC;IAEhC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1F,CAAC;AACH,CAAC"}

package/dist/api/bisect/changes.d.ts

@@ -0,0 +1,20 @@
+import type { BisectedPackage, BisectSkippedChange } from "./types.js";
+export interface LockfileChanges {
+    /** Packages with exactly one locked version on each side, and the two differ. */
+    updates: BisectedPackage[];
+    skipped: BisectSkippedChange[];
+}
+export interface ManifestLike {
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+}
+/** Names the project itself depends on (not peers: they are not installed from the root). */
+export declare function directDependencyNames(manifest: ManifestLike | undefined): Set<string>;
+/**
+ * Which locked packages changed between two lockfiles, as the pairs that can be tried one at a
+ * time. A package that is added, removed, or present in several versions cannot be pinned back
+ * and forth by name, so it is listed under `skipped` with the reason instead of being guessed at.
+ */
+export declare function lockfileChanges(lockfileName: string, goodContent: string, badContent: string, direct: ReadonlySet<string>): LockfileChanges;
+//# sourceMappingURL=changes.d.ts.map

package/dist/api/bisect/changes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes.d.ts","sourceRoot":"","sources":["../../../src/api/bisect/changes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEvE,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,OAAO,EAAE,mBAAmB,EAAE,CAAC;CAChC;AAID,MAAM,WAAW,YAAY;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/C;AAED,6FAA6F;AAC7F,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,YAAY,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAMrF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,GAC1B,eAAe,CAiCjB"}

package/dist/api/bisect/changes.js

@@ -0,0 +1,47 @@
+import { parseLockfileDependencies } from "../../scanner/lockfile-diff.js";
+const SECTIONS = ["dependencies", "devDependencies", "optionalDependencies"];
+/** Names the project itself depends on (not peers: they are not installed from the root). */
+export function directDependencyNames(manifest) {
+    const names = new Set();
+    for (const section of SECTIONS) {
+        for (const name of Object.keys(manifest?.[section] ?? {}))
+            names.add(name);
+    }
+    return names;
+}
+/**
+ * Which locked packages changed between two lockfiles, as the pairs that can be tried one at a
+ * time. A package that is added, removed, or present in several versions cannot be pinned back
+ * and forth by name, so it is listed under `skipped` with the reason instead of being guessed at.
+ */
+export function lockfileChanges(lockfileName, goodContent, badContent, direct) {
+    const before = parseLockfileDependencies(lockfileName, goodContent);
+    const after = parseLockfileDependencies(lockfileName, badContent);
+    const updates = [];
+    const skipped = [];
+    for (const name of [...new Set([...before.keys(), ...after.keys()])].toSorted()) {
+        const was = [...(before.get(name) ?? [])].toSorted();
+        const now = [...(after.get(name) ?? [])].toSorted();
+        if (was.length === now.length && was.every((version, index) => version === now[index]))
+            continue;
+        const [from] = was;
+        const [to] = now;
+        if (was.length === 1 && now.length === 1 && from !== undefined && to !== undefined) {
+            updates.push({
+                packageName: name,
+                fromVersion: from,
+                toVersion: to,
+                dependencyScope: direct.has(name) ? "direct" : "transitive",
+            });
+            continue;
+        }
+        const reason = was.length === 0
+            ? "added at the bad ref"
+            : now.length === 0
+                ? "removed at the bad ref"
+                : "several versions are locked, so a single pin cannot stand for it";
+        skipped.push({ packageName: name, fromVersions: was, toVersions: now, reason });
+    }
+    return { updates, skipped };
+}
+//# sourceMappingURL=changes.js.map

package/dist/api/bisect/changes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes.js","sourceRoot":"","sources":["../../../src/api/bisect/changes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAS3E,MAAM,QAAQ,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAU,CAAC;AAQtF,6FAA6F;AAC7F,MAAM,UAAU,qBAAqB,CAAC,QAAkC;IACtE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,YAAoB,EACpB,WAAmB,EACnB,UAAkB,EAClB,MAA2B;IAE3B,MAAM,MAAM,GAAG,yBAAyB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,yBAAyB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAClE,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,OAAO,GAA0B,EAAE,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAChF,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACpD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;YACpF,SAAS;QAEX,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACnB,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC;QACjB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC;gBACX,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,IAAI;gBACjB,SAAS,EAAE,EAAE;gBACb,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;aAC5D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GACV,GAAG,CAAC,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;gBAChB,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,kEAAkE,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC"}

package/dist/api/bisect/ddmin.d.ts

@@ -0,0 +1,33 @@
+/** What running the command against one candidate state told us. */
+export type Verdict = "pass" | "fail" | "unresolved";
+export interface DdminResult<T> {
+    /** The smallest failing subset found; every item of it is needed to keep the failure. */
+    minimal: T[];
+    /** Candidate states actually evaluated (cache hits are free). */
+    evaluations: number;
+    /**
+     * False when the search stopped early (budget, abort) or a candidate could not be evaluated, so
+     * `minimal` still fails but may not be minimal.
+     */
+    complete: boolean;
+    /** Why the search stopped early, when it did. */
+    stoppedBecause?: "budget" | "stopped";
+}
+export interface DdminOptions {
+    /** Evaluate at most this many distinct candidates; the search then returns what it has. */
+    maxEvaluations?: number;
+    /** Asked before every evaluation; return true to stop (Ctrl-C). */
+    shouldStop?: () => boolean;
+}
+/**
+ * Zeller's delta debugging (ddmin): find a 1-minimal subset of `items` that still makes `test` fail.
+ * With a single culprit this is a binary search (the subset halves each round); when two or more
+ * items are needed together, no half fails on its own, so it tries the complements and finer
+ * partitions until no single item can be dropped.
+ *
+ * The caller must know that the full set fails and the empty set passes. An `unresolved` verdict
+ * (the candidate could not be built or installed) is treated as "not failing" for the reduction, and
+ * is reported through `complete: false`, because the result then may not be minimal.
+ */
+export declare function ddmin<T>(items: readonly T[], key: (item: T) => string, test: (subset: readonly T[]) => Promise<Verdict>, options?: DdminOptions): Promise<DdminResult<T>>;
+//# sourceMappingURL=ddmin.d.ts.map

package/dist/api/bisect/ddmin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ddmin.d.ts","sourceRoot":"","sources":["../../../src/api/bisect/ddmin.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,YAAY,CAAC;AAErD,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,yFAAyF;IACzF,OAAO,EAAE,CAAC,EAAE,CAAC;IACb,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,iDAAiD;IACjD,cAAc,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,2FAA2F;IAC3F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,wBAAsB,KAAK,CAAC,CAAC,EAC3B,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,EACxB,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,EAChD,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAwEzB"}

package/dist/api/bisect/ddmin.js

@@ -0,0 +1,91 @@
+/**
+ * Zeller's delta debugging (ddmin): find a 1-minimal subset of `items` that still makes `test` fail.
+ * With a single culprit this is a binary search (the subset halves each round); when two or more
+ * items are needed together, no half fails on its own, so it tries the complements and finer
+ * partitions until no single item can be dropped.
+ *
+ * The caller must know that the full set fails and the empty set passes. An `unresolved` verdict
+ * (the candidate could not be built or installed) is treated as "not failing" for the reduction, and
+ * is reported through `complete: false`, because the result then may not be minimal.
+ */
+export async function ddmin(items, key, test, options = {}) {
+    const cache = new Map();
+    let evaluations = 0;
+    let unresolved = false;
+    let stoppedBecause;
+    const cacheKey = (subset) => subset
+        .map((item) => key(item))
+        .toSorted()
+        .join("\n");
+    /** `undefined` means the search must stop. */
+    const evaluate = async (subset) => {
+        const id = cacheKey(subset);
+        const known = cache.get(id);
+        if (known)
+            return known;
+        if (options.shouldStop?.()) {
+            stoppedBecause = "stopped";
+            return undefined;
+        }
+        if (options.maxEvaluations !== undefined && evaluations >= options.maxEvaluations) {
+            stoppedBecause = "budget";
+            return undefined;
+        }
+        evaluations++;
+        const verdict = await test(subset);
+        if (verdict === "unresolved")
+            unresolved = true;
+        cache.set(id, verdict);
+        return verdict;
+    };
+    let current = [...items];
+    let granularity = 2;
+    search: while (current.length >= 2) {
+        const subsets = partition(current, granularity);
+        for (const subset of subsets) {
+            const verdict = await evaluate(subset);
+            if (verdict === undefined)
+                break search;
+            if (verdict === "fail") {
+                current = subset;
+                granularity = 2;
+                continue search;
+            }
+        }
+        // With two parts a complement is the other part, which was just tried.
+        if (granularity > 2) {
+            for (const subset of subsets) {
+                const complement = current.filter((item) => !subset.includes(item));
+                const verdict = await evaluate(complement);
+                if (verdict === undefined)
+                    break search;
+                if (verdict === "fail") {
+                    current = complement;
+                    granularity = Math.max(granularity - 1, 2);
+                    continue search;
+                }
+            }
+        }
+        if (granularity >= current.length)
+            break;
+        granularity = Math.min(granularity * 2, current.length);
+    }
+    return {
+        minimal: current,
+        evaluations,
+        complete: stoppedBecause === undefined && !unresolved,
+        ...(stoppedBecause ? { stoppedBecause } : {}),
+    };
+}
+/** Split into `parts` contiguous chunks whose sizes differ by at most one. */
+function partition(items, parts) {
+    const result = [];
+    let start = 0;
+    for (let index = 0; index < parts; index++) {
+        const end = start + Math.ceil((items.length - start) / (parts - index));
+        result.push(items.slice(start, end));
+        start = end;
+    }
+    return result.filter((chunk) => chunk.length > 0);
+}
+//# sourceMappingURL=ddmin.js.map

package/dist/api/bisect/ddmin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ddmin.js","sourceRoot":"","sources":["../../../src/api/bisect/ddmin.ts"],"names":[],"mappings":"AAwBA;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,KAAmB,EACnB,GAAwB,EACxB,IAAgD,EAChD,OAAO,GAAiB,EAAE;IAE1B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,cAAgD,CAAC;IAErD,MAAM,QAAQ,GAAG,CAAC,MAAoB,EAAE,EAAE,CACxC,MAAM;SACH,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACxB,QAAQ,EAAE;SACV,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhB,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAoB,EAAgC,EAAE;QAC5E,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,OAAO,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC;YAC3B,cAAc,GAAG,SAAS,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,WAAW,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAClF,cAAc,GAAG,QAAQ,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,WAAW,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,YAAY;YAAE,UAAU,GAAG,IAAI,CAAC;QAChD,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACvB,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACzB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,MAAM,EAAE,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAEhD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,MAAM,CAAC;YACxC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBACvB,OAAO,GAAG,MAAM,CAAC;gBACjB,WAAW,GAAG,CAAC,CAAC;gBAChB,SAAS,MAAM,CAAC;YAClB,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBACpE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;gBAC3C,IAAI,OAAO,KAAK,SAAS;oBAAE,MAAM,MAAM,CAAC;gBACxC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;oBACvB,OAAO,GAAG,UAAU,CAAC;oBACrB,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC3C,SAAS,MAAM,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,WAAW,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM;QACzC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,WAAW;QACX,QAAQ,EAAE,cAAc,KAAK,SAAS,IAAI,CAAC,UAAU;QACrD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAAI,KAAmB,EAAE,KAAa;IACtD,MAAM,MAAM,GAAU,EAAE,CAAC;IACzB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACrC,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/api/bisect/index.d.ts

@@ -0,0 +1,20 @@
+import type { applyPlan } from "../runs/index.js";
+import type { BisectOptions, BisectReport } from "./types.js";
+export type { BisectCommandRecord, BisectedPackage, BisectOptions, BisectRemedy, BisectReport, BisectSkippedChange, BisectStatus, BisectStep, BisectStepKind, } from "./types.js";
+export declare const DEFAULT_COMMAND_TIMEOUT_SECONDS = 600;
+export declare const DEFAULT_MAX_STEPS = 30;
+/** Replaceable pieces, for tests. */
+export interface BisectDeps {
+    /** Environment for the package manager and the command (default: `process.env`). */
+    env?: NodeJS.ProcessEnv;
+    applyPlanFn?: typeof applyPlan;
+}
+/**
+ * Find which package update in the lockfile diff between a good and a bad git ref makes a command
+ * fail. Runs entirely in isolated git worktrees: install the good ref and check the command passes,
+ * install the bad ref and check it fails, then hold subsets of the changed packages at their bad-ref
+ * versions (everything else at its good-ref version) and narrow down with delta debugging. The
+ * result names the package, or the smallest set that only fails together, and a plan that pins it back.
+ */
+export declare function bisectLockfile(options: BisectOptions, deps?: BisectDeps): Promise<BisectReport>;
+//# sourceMappingURL=index.d.ts.map

package/dist/api/bisect/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/bisect/index.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAMlD,OAAO,KAAK,EAGV,aAAa,EACb,YAAY,EAIb,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,+BAA+B,MAAM,CAAC;AACnD,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,qCAAqC;AACrC,MAAM,WAAW,UAAU;IACzB,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,SAAS,CAAC;CAChC;AA8ED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,YAAY,CAAC,CAqdvB"}