bumpcheck 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,15 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,200 @@
-# Temporary Holding Version
+# bumpcheck
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Prove whether a dependency bump breaks the code that imports it.
+
+Dependabot or Renovate opens a pull request bumping `zod` from 3 to 4. bumpcheck
+reads the type declarations of both versions and your source, then reports
+three kinds of facts, each with a file and line:
+
+- a symbol you import was removed,
+- a call you make no longer typechecks against the new declarations,
+- a symbol you import changed, and whether your uses still typecheck.
+
+Anything it cannot prove is listed as "could not be checked". It never guesses
+and it never says "safe".
+
+```
+$ bumpcheck zod 3.23.8 4.1.12 --repo ./my-app
+
+zod 3.23.8 -> 4.1.12
+You import 3 symbols from zod. 2 breaks in 2 symbols, 1 changed but still typechecks. Behavior not checked.
+
+BREAKS
+  ZodError  Property 'errors' does not exist on type 'ZodError<unknown>'.
+    src/schema.ts:15:25  (TS2339)
+  ZodTypeAny  Property 'typeName' does not exist on type '$ZodTypeDef'.
+    src/schema.ts:21:22  (TS2339)
+```
+
+In the common case the whole output is one line:
+
+```
+You import 5 symbols from axios. None changed. Behavior not checked.
+```
+
+## Install
+
+```
+npm install -g bumpcheck
+```
+
+Requires Node 20 or newer and `npm` on your PATH. bumpcheck fetches both
+versions of the bumped package into its own cache. Run it with the repo's
+other dependencies installed: types from them, such as a tRPC wrapper around
+react-query, are part of what can break. Without `node_modules` the report
+says how many imports could not be resolved.
+
+Each run analyzes one project root under that directory's `tsconfig.json`.
+`--since` picks the right directory for each bumped `package.json`. Nested
+packages that share a `package.json` but have their own `tsconfig.json` are
+not yet discovered. A `tsconfig.json` that only lists `references`, as Vite
+templates do, is followed: the referenced projects are analyzed as one program
+with the first one's options, and the report says so.
+
+## Use
+
+```
+bumpcheck <package> <from> <to> [--repo <dir>] [--format text|markdown|json]
+```
+
+Exit code is 1 when at least one break is found, 0 otherwise, 2 on error.
+Pass `--no-fail` to always exit 0.
+
+`--format markdown` produces a pull request comment. `--format json` emits the
+full report, documented in [src/types.ts](src/types.ts), for other tools.
+
+## In a pull request
+
+`bumpcheck --since <ref>` finds every direct dependency whose version changed
+between a git ref and HEAD, in any `package.json` in the repo, and checks each
+one in its own directory. That makes the CI step one line, and it works for
+repos with more than one project, such as an API at the root and a web app in
+`web/`.
+
+```yaml
+name: bumpcheck
+on:
+  pull_request:
+    paths: ['**/package.json', '**/package-lock.json']
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+      - uses: actions/setup-node@v4
+        with: { node-version: 22, cache: npm }
+      - run: npm ci --ignore-scripts
+      - name: bumpcheck
+        id: run
+        run: |
+          npx bumpcheck --since origin/${{ github.base_ref }} --format markdown --json-out report.json > comment.md \
+            || echo "failed=1" >> "$GITHUB_OUTPUT"
+          unknown=$(node -p 'const r=[].concat(require("./report.json")); r.reduce((n,x)=>n+x.summary.unknown+x.summary.unanalyzed,0)' 2>/dev/null || echo 0)
+          if [ "$unknown" != "0" ]; then
+            echo "::warning title=bumpcheck::$unknown import(s) could not be checked; see the pull request comment"
+          fi
+      - uses: marocchino/sticky-pull-request-comment@v2
+        with:
+          header: bumpcheck
+          path: comment.md
+      - name: Fail on breaks
+        if: steps.run.outputs.failed == '1'
+        run: exit 1
+```
+
+The job fails when any package reported a break, after the comment is
+posted. Imports that could not be checked keep the job green and add a
+warning annotation, so a green check means "no proven break", not "safe".
+If more than one project needs `npm ci`, add a step per directory.
+
+## How it works
+
+1. Both versions are installed with `npm install --ignore-scripts` into a
+   per-version cache. When the package's own dependencies are also installed
+   in your repo at a version that satisfies its declared range, those copies
+   are used, as npm's dedupe would. Otherwise two copies of a shared type
+   such as `@nestjs/common` would disagree with each other.
+2. Two TypeScript programs are built over your repo, identical except that
+   every import of the package resolves to one version or the other.
+3. Every import of the package is collected: named, default, namespace
+   member access, `require()` destructuring, subpaths, and type-only imports.
+4. Each imported symbol's declaration is tokenized and compared between
+   versions. Comments and formatting do not count.
+5. Type errors are collected in the importing files for both programs. Errors
+   present only with the new version are the breaks. Your pre-existing errors
+   cancel out.
+6. Each break is attributed to an imported symbol by the error message, the
+   import binding in the failing expression, or a type declared under that
+   import. The report says which.
+
+If your repo has a `tsconfig.json`, its options are used, so a break is a
+break under your own settings. Without one, bumpcheck uses strict defaults with
+`checkJs` so plain JavaScript repos are analyzed too.
+
+## What it does not do
+
+- It does not check runtime behavior. A function with the same signature can
+  still behave differently. The footer of every report says so.
+- It does not analyze packages that ship no type declarations. The report says
+  so instead of reporting zero breaks.
+- It does not follow dynamic `import()`, `export * from`, or a namespace
+  passed around as a value. Those appear under "not analyzed".
+- It does not fix anything, read changelogs, or decide whether to merge.
+
+## Accuracy
+
+[corpus/](corpus/) pins real Dependabot pull requests from public repos at
+their base commit and runs bumpcheck on each bump. A `--oracle` mode then
+installs the new version into the checkout and runs the repo's own `tsc`; the
+new errors it reports are the ground truth.
+
+Results so far, from [corpus/results.md](corpus/results.md). Four of the
+pull requests needed a human to change code before merging, which tests the
+case that matters: does the tool stay quiet when it should not?
+
+| bump | bumpcheck | tsc oracle | what the human changed |
+|---|---|---|---|
+| zod 3.23.8 → 4.6.5, 36-file API merged without CI | 79 breaks | 84 new errors | nothing; the repo has not compiled since |
+| zod 3.25.76 → 4.6.7, MCP server | 6 breaks | 6 new errors | the schema the 6 test errors pointed at |
+| react-query 4 → 5, 20-hook app | 20 breaks | 28 new errors | 16 hunks, 13 of them at reported lines |
+| react-query 4 → 5, Electron app | 3 breaks | 3 new errors | 1 of the 3 sites; the other 2 landed via a separate PR |
+| msw 1 → 2, tests outside tsconfig | 0, with a note that 1 importing file is outside tsconfig | 0 | the test files tsc does not see |
+| 6 bumps that needed no code changes | 0 breaks each | 0 new errors each | nothing |
+
+Every gap between the two columns is TypeScript's "implicitly has an 'any'
+type" follow-on errors, which bumpcheck folds into the root error on the
+same statement. On root causes the lists match, file and line.
+
+Two lessons from the corpus are now part of the tool: run with the repo's
+dependencies installed, because types from other packages carry the bumped
+package's types, and say so when files that import the package sit outside
+the tsconfig.
+
+Eleven cases is a start, not a statistic. Add one with a pull request URL and
+a base commit in [corpus/cases.json](corpus/cases.json) and run
+`npx tsx corpus/run.ts --oracle`.
+
+## Status
+
+Early. npm with TypeScript declarations is the only ecosystem. The report
+schema is versioned and will stay backwards compatible within a major.
+
+## Development
+
+```
+npm install
+npm test
+npm run dev -- zod 3.23.8 4.1.12 --repo ../some-app
+```
+
+Tests run offline against fixture packages in `test/fixtures`. Add a case by
+planting a change in `demo-lib-v2` and a use in `consumer`, then asserting the
+exact file and line.
+
+## License
+
+Apache-2.0

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+import { parseArgs } from 'node:util';
+import { writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { analyzeNpm } from './npm/analyze.js';
+import { detectChanges } from './git.js';
+import { NpmProvider } from './registry/provider.js';
+import { renderMarkdown, renderText } from './report/render.js';
+const HELP = `bumpcheck — prove whether a dependency bump breaks the code that imports it
+
+Usage
+  bumpcheck <package> <from> <to> [options]
+  bumpcheck --since <git-ref> [options]
+
+  The second form finds every direct dependency whose version changed in any
+  package.json between <git-ref> and HEAD, and checks each in its own
+  directory. This is the form for CI on a dependency pull request.
+
+Options
+  --repo <dir>        Repository to analyze (default: current directory)
+  --since <ref>       Detect bumps from git instead of naming one
+  --format <fmt>      text | markdown | json (default: text)
+  --json-out <file>   Also write the full JSON report to a file
+  --cache-dir <dir>   Where package versions are cached
+  --registry <url>    npm registry (default: npm config / BUMPCHECK_REGISTRY)
+  --no-fail           Exit 0 even when breaks are found
+  -h, --help          Show this help
+
+Exit codes
+  0  no breaks found
+  1  at least one break found
+  2  usage or analysis error
+
+Example
+  bumpcheck axios 1.6.8 1.7.2 --repo ./my-app --format markdown
+`;
+async function main(argv) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        allowPositionals: true,
+        options: {
+            repo: { type: 'string' },
+            since: { type: 'string' },
+            format: { type: 'string', default: 'text' },
+            'json-out': { type: 'string' },
+            'cache-dir': { type: 'string' },
+            registry: { type: 'string' },
+            'no-fail': { type: 'boolean', default: false },
+            help: { type: 'boolean', short: 'h', default: false },
+        },
+    });
+    if (values.help || (values.since ? positionals.length !== 0 : positionals.length !== 3)) {
+        process.stdout.write(HELP);
+        return values.help ? 0 : 2;
+    }
+    const format = values.format;
+    if (format !== 'text' && format !== 'markdown' && format !== 'json') {
+        process.stderr.write(`Unknown format "${format}". Use text, markdown, or json.\n`);
+        return 2;
+    }
+    const providerOpts = {};
+    if (values['cache-dir'])
+        providerOpts.cacheDir = values['cache-dir'];
+    if (values.registry)
+        providerOpts.registry = values.registry;
+    const repoRoot = path.resolve(values.repo ?? process.cwd());
+    const provider = new NpmProvider(providerOpts);
+    const detection = values.since
+        ? detectChanges(repoRoot, values.since)
+        : { bumps: [{ dir: '', pkg: positionals[0], from: positionals[1], to: positionals[2] }], transitive: [] };
+    const targets = detection.bumps;
+    if (targets.length === 0) {
+        process.stdout.write(renderNoBumps(values.since, detection, format) + '\n');
+        if (values['json-out'])
+            await writeFile(values['json-out'], JSON.stringify([], null, 2) + '\n');
+        return 0;
+    }
+    const reports = [];
+    for (const t of targets) {
+        reports.push(await analyzeNpm({ repoRoot: path.join(repoRoot, t.dir), pkg: t.pkg, from: t.from, to: t.to, provider }));
+    }
+    const render = (r, i) => {
+        const dir = targets[i].dir;
+        const prefix = dir && format !== 'json' ? (format === 'markdown' ? `_in \`${dir}/\`_\n\n` : `in ${dir}/\n`) : '';
+        return prefix + (format === 'markdown' ? renderMarkdown(r) : renderText(r));
+    };
+    const body = format === 'json' ? JSON.stringify(reports.length === 1 ? reports[0] : reports, null, 2) : reports.map(render).join('\n\n');
+    process.stdout.write(body + '\n');
+    if (values['json-out']) {
+        await writeFile(values['json-out'], JSON.stringify(reports.length === 1 ? reports[0] : reports, null, 2) + '\n');
+    }
+    return reports.some((r) => r.breaks.length > 0) && !values['no-fail'] ? 1 : 0;
+}
+/**
+ * A lockfile-only pull request has nothing bumpcheck can check, since it
+ * only analyzes packages the repo imports directly. Say what moved anyway,
+ * so the comment explains itself.
+ */
+function renderNoBumps(since, detection, format) {
+    const md = format === 'markdown';
+    const lines = [];
+    lines.push(md ? `### bumpcheck` : 'bumpcheck');
+    lines.push('');
+    lines.push(`No direct dependency changed since ${since}, so there is nothing to typecheck against.`);
+    if (detection.transitive.length > 0) {
+        const n = detection.transitive.length;
+        lines.push('');
+        lines.push(`${n} transitive package${n === 1 ? '' : 's'} moved in the lockfile:`);
+        lines.push('');
+        for (const t of detection.transitive.slice(0, 20)) {
+            const where = t.dir ? ` (in ${t.dir}/)` : '';
+            lines.push(md ? `- \`${t.pkg}\` ${t.from} → ${t.to}${where}` : `  ${t.pkg} ${t.from} -> ${t.to}${where}`);
+        }
+        if (n > 20)
+            lines.push(md ? `- … ${n - 20} more` : `  … ${n - 20} more`);
+        lines.push('');
+        lines.push(md
+            ? '<sub>bumpcheck checks packages this repo imports directly. Transitive changes are listed for the record and are not analyzed.</sub>'
+            : 'bumpcheck checks packages this repo imports directly. Transitive changes are listed for the record and are not analyzed.');
+    }
+    return lines.join('\n');
+}
+main(process.argv.slice(2)).then((code) => process.exit(code), (err) => {
+    process.stderr.write(`bumpcheck: ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(2);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAkB,MAAM,UAAU,CAAC;AAEzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhE,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAEF,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,EAAE,IAAI;QACV,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;YAC3C,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC/B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YAC9C,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;SACtD;KACF,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACxF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,MAAM,mCAAmC,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,YAAY,GAA6C,EAAE,CAAC;IAClE,IAAI,MAAM,CAAC,WAAW,CAAC;QAAE,YAAY,CAAC,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,QAAQ;QAAE,YAAY,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAE7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,YAAY,CAAC,CAAC;IAE/C,MAAM,SAAS,GAAc,MAAM,CAAC,KAAK;QACvC,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC;QACvC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAE,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC,CAAE,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC/G,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC;IAEhC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,KAAM,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,UAAU,CAAC;YAAE,MAAM,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAChG,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACzH,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE;QAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC;QAC5B,MAAM,MAAM,GAAG,GAAG,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,OAAO,MAAM,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACvB,MAAM,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACnH,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,SAAoB,EAAE,MAAc;IACxE,MAAM,EAAE,GAAG,MAAM,KAAK,UAAU,CAAC;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,sCAAsC,KAAK,6CAA6C,CAAC,CAAC;IACrG,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,yBAAyB,CAAC,CAAC;QAClF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,GAAG,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACzE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CACR,EAAE;YACA,CAAC,CAAC,qIAAqI;YACvI,CAAC,CAAC,0HAA0H,CAC/H,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,CAAC,GAAY,EAAE,EAAE;IACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CACF,CAAC"}

package/dist/git.d.ts

@@ -0,0 +1,33 @@
+/** A direct dependency whose pinned version changed between two git refs. */
+export interface DetectedBump {
+    /** Directory of the package.json, relative to the repo root, '' for the root. */
+    dir: string;
+    pkg: string;
+    from: string;
+    to: string;
+}
+/** A lockfile entry that moved without being a direct dependency. */
+export interface TransitiveChange {
+    dir: string;
+    pkg: string;
+    from: string;
+    to: string;
+}
+export interface Detection {
+    bumps: DetectedBump[];
+    transitive: TransitiveChange[];
+}
+/** `^1.2.3`, `~1.2.3`, `1.2.3` -> `1.2.3`; ranges and tags -> undefined. */
+export declare function exactVersion(spec: string | undefined): string | undefined;
+/**
+ * Finds direct dependencies whose version changed between `base` and `head`
+ * in any package.json, using the lockfile beside it when present so range
+ * specs like `^1.2.0` resolve to the versions actually installed.
+ */
+export declare function detectBumps(repoRoot: string, base: string, head?: string): DetectedBump[];
+/**
+ * Direct bumps plus transitive lockfile moves. bumpcheck can only analyze
+ * what the repo imports directly, so the transitive list exists to explain
+ * a lockfile-only pull request rather than to be checked.
+ */
+export declare function detectChanges(repoRoot: string, base: string, head?: string): Detection;

package/dist/git.js

@@ -0,0 +1,94 @@
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+const DEP_FIELDS = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'];
+function git(repo, args) {
+    const r = spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
+    return r.status === 0 ? r.stdout : undefined;
+}
+function readJson(text) {
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** `^1.2.3`, `~1.2.3`, `1.2.3` -> `1.2.3`; ranges and tags -> undefined. */
+export function exactVersion(spec) {
+    if (!spec)
+        return undefined;
+    const m = /^[\^~]?v?(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)$/.exec(spec.trim());
+    return m ? m[1] : undefined;
+}
+/**
+ * Finds direct dependencies whose version changed between `base` and `head`
+ * in any package.json, using the lockfile beside it when present so range
+ * specs like `^1.2.0` resolve to the versions actually installed.
+ */
+export function detectBumps(repoRoot, base, head = 'HEAD') {
+    return detectChanges(repoRoot, base, head).bumps;
+}
+/**
+ * Direct bumps plus transitive lockfile moves. bumpcheck can only analyze
+ * what the repo imports directly, so the transitive list exists to explain
+ * a lockfile-only pull request rather than to be checked.
+ */
+export function detectChanges(repoRoot, base, head = 'HEAD') {
+    const changed = git(repoRoot, ['diff', '--name-only', base, head, '--', '*package.json', '*package-lock.json'])
+        ?.split('\n')
+        .map((l) => l.trim())
+        .filter((l) => l && !l.includes('node_modules/'));
+    if (!changed)
+        throw new Error(`git diff ${base} ${head} failed; is ${base} fetched?`);
+    const dirs = new Set(changed.map((f) => path.posix.dirname(f)).map((d) => (d === '.' ? '' : d)));
+    const bumps = [];
+    const transitive = [];
+    for (const dir of [...dirs].sort()) {
+        const manifestPath = dir ? `${dir}/package.json` : 'package.json';
+        const lockPath = dir ? `${dir}/package-lock.json` : 'package-lock.json';
+        const before = readJson(git(repoRoot, ['show', `${base}:${manifestPath}`]));
+        const after = readJson(git(repoRoot, ['show', `${head}:${manifestPath}`]));
+        if (!before || !after)
+            continue;
+        const lockBefore = readJson(git(repoRoot, ['show', `${base}:${lockPath}`]));
+        const lockAfter = readJson(git(repoRoot, ['show', `${head}:${lockPath}`]));
+        const resolve = (name, spec, lock) => lock?.packages?.[`node_modules/${name}`]?.version ?? exactVersion(spec);
+        const names = new Set();
+        for (const field of DEP_FIELDS) {
+            for (const n of Object.keys(before[field] ?? {}))
+                names.add(n);
+            for (const n of Object.keys(after[field] ?? {}))
+                names.add(n);
+        }
+        for (const name of [...names].sort()) {
+            const specBefore = DEP_FIELDS.map((f) => before[f]?.[name]).find(Boolean);
+            const specAfter = DEP_FIELDS.map((f) => after[f]?.[name]).find(Boolean);
+            if (!specBefore || !specAfter)
+                continue; // added or removed, not bumped
+            const from = resolve(name, specBefore, lockBefore);
+            const to = resolve(name, specAfter, lockAfter);
+            if (!from || !to || from === to)
+                continue;
+            bumps.push({ dir, pkg: name, from, to });
+        }
+        // Top-level lockfile entries that moved but are not direct dependencies.
+        const direct = new Set(names);
+        const pkgsBefore = lockBefore?.packages ?? {};
+        const pkgsAfter = lockAfter?.packages ?? {};
+        for (const key of Object.keys(pkgsAfter).sort()) {
+            if (!key.startsWith('node_modules/') || key.indexOf('node_modules/', 'node_modules/'.length) !== -1)
+                continue;
+            const name = key.slice('node_modules/'.length);
+            if (direct.has(name))
+                continue;
+            const from = pkgsBefore[key]?.version;
+            const to = pkgsAfter[key]?.version;
+            if (from && to && from !== to)
+                transitive.push({ dir, pkg: name, from, to });
+        }
+    }
+    return { bumps, transitive };
+}
+//# sourceMappingURL=git.js.map

package/dist/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,IAAI,MAAM,WAAW,CAAC;AAwB7B,MAAM,UAAU,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,kBAAkB,CAAU,CAAC;AAO5G,SAAS,GAAG,CAAC,IAAY,EAAE,IAAc;IACvC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAI,IAAwB;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,IAAwB;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,CAAC,GAAG,kDAAkD,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,IAAY,EAAE,IAAI,GAAG,MAAM;IACvE,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,IAAY,EAAE,IAAI,GAAG,MAAM;IACzE,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;QAC7G,EAAE,KAAK,CAAC,IAAI,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,IAAI,eAAe,IAAI,WAAW,CAAC,CAAC;IAEtF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,UAAU,GAAuB,EAAE,CAAC;IAE1C,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;QAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,CAAC;QACxE,MAAM,MAAM,GAAG,QAAQ,CAAW,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,QAAQ,CAAW,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;YAAE,SAAS;QAChC,MAAM,UAAU,GAAG,QAAQ,CAAW,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;QACtF,MAAM,SAAS,GAAG,QAAQ,CAAW,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;QAErF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,IAAwB,EAAE,IAA0B,EAAsB,EAAE,CACzG,IAAI,EAAE,QAAQ,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC,EAAE,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QAE1E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxE,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;gBAAE,SAAS,CAAC,+BAA+B;YACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YACnD,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,KAAK,EAAE;gBAAE,SAAS;YAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,yEAAyE;QACzE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAChD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAE,SAAS;YAC9G,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;YACtC,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;YACnC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,KAAK,EAAE;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { analyzeNpm, type AnalyzeOptions } from './npm/analyze.js';
+export { NpmProvider, LocalProvider, type PackageProvider, type NpmProviderOptions } from './registry/provider.js';
+export { renderText, renderMarkdown } from './report/render.js';
+export * from './types.js';

package/dist/index.js

@@ -0,0 +1,5 @@
+export { analyzeNpm } from './npm/analyze.js';
+export { NpmProvider, LocalProvider } from './registry/provider.js';
+export { renderText, renderMarkdown } from './report/render.js';
+export * from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAuB,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAiD,MAAM,wBAAwB,CAAC;AACnH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAChE,cAAc,YAAY,CAAC"}

package/dist/npm/analyze.d.ts

@@ -0,0 +1,18 @@
+import type { Report } from '../types.js';
+import type { PackageProvider } from '../registry/provider.js';
+export interface AnalyzeOptions {
+    repoRoot: string;
+    pkg: string;
+    from: string;
+    to: string;
+    provider: PackageProvider;
+}
+/**
+ * The whole pipeline:
+ *   1. materialize both versions,
+ *   2. build one program per version with imports redirected,
+ *   3. collect what the repo imports,
+ *   4. compare each imported symbol's declaration,
+ *   5. diff the type errors; new-only errors are the breaks.
+ */
+export declare function analyzeNpm(opts: AnalyzeOptions): Promise<Report>;