bundle-pulse 0.0.0-stage → 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog
+
+## 1.0.0 (2026-10-14)
+
+First release, by Louis Wright.
+
+- Measures raw, gzip (level 9) and brotli (quality 11) sizes of JS and CSS in a build directory; source maps skipped.
+- Per-glob budgets on any of raw/gzip/brotli, total JS and CSS budgets, near-budget warnings.
+- Base snapshots (`--snapshot`, `--base`) with content-hash-insensitive names; growth and new-large-file checks.
+- Unminified and duplicate file detection; stale budgets that match nothing.
+- Text/JSON/SARIF/Markdown output, `--fail-on`, exit codes 0/1/2, allowlist with expiry, severity overrides.
+- Composite GitHub Action with job summary.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Louis Wright
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,189 @@
-# Temporary Holding Version
+# bundle-pulse
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> A CI gate for JavaScript and CSS bundle size: budgets on raw, gzip and brotli sizes, and a diff against your base branch.
+
+Bundles grow one innocent import at a time. `bundle-pulse` measures every JS and CSS file in your build output the way browsers receive it (gzip and brotli as well as raw), checks each file against the budget for its glob, checks total JS and CSS, and compares against a snapshot from the base branch so a pull request that adds 40 kB to the main chunk fails with a clear message. Content hashes in file names (`index-BdT9x2Qa.js`, `main.3f2a9c1b.chunk.js`) are stripped when comparing, so the diff follows the entry, not the file name.
+
+CLI, library and GitHub Action. Node.js 18+, **zero runtime dependencies**, runs offline. By Louis Wright.
+
+## Features
+
+- **Three sizes:** raw, gzip (level 9) and brotli (quality 11) for every `.js`, `.mjs`, `.cjs` and `.css` file; source maps are skipped.
+- **Budgets:** per-glob budgets on any of the three sizes, total JS and total CSS budgets, and a warning when a file passes 90% of its budget.
+- **Base diff:** `--snapshot` writes sizes to JSON; `--base` compares against it and reports files that grew more than `--max-growth` percent (default 10%, ignoring changes under 1 kB) and new large chunks.
+- **Hygiene:** unminified files, identical files shipped under two names, budgets that match nothing (renamed entries), and large files with no budget.
+- **Works with any bundler:** Vite, webpack, Rollup, esbuild, Parcel, Next.js static output, or plain files.
+
+### Scope
+
+bundle-pulse measures what is on disk after the build. It does not analyse which modules are inside a chunk (use a bundle analyser for that) or measure runtime performance (see vitals-pulse).
+
+## Rules
+
+| Rule | Default severity | What it means |
+|---|---|---|
+| `bundle-over-budget` | high | File is larger than its budget |
+| `bundle-total-over-budget` | high | Total JS or CSS is larger than its budget |
+| `bundle-growth` | medium | File grew more than the allowed percentage since the base snapshot |
+| `bundle-budget-unmatched` | medium | Budget glob matches no file (renamed entry or stale budget) |
+| `bundle-unminified` | medium | Large file looks unminified |
+| `bundle-near-budget` | low | File is within the warning margin of its budget |
+| `bundle-new-large` | low | New file since the base snapshot is large |
+| `bundle-duplicate` | low | Identical file shipped under more than one name |
+| `bundle-no-budget` | info | Large file has no budget |
+| `allowlist-expired` | medium | An allowlist entry is past its `expires` date |
+| `allowlist-unused` | info | An allowlist entry matched nothing |
+
+## Install and run
+
+```bash
+npx bundle-pulse dist
+npx bundle-pulse dist -b 'assets/index-*.js=60KB' -b 'assets/*.css=brotli:15KB' --total-js 200KB
+npx bundle-pulse dist --snapshot bundle-base.json   # on main
+npx bundle-pulse dist --base bundle-base.json --max-growth 5 --format markdown
+```
+
+### Sample output
+
+```text
+bundle-pulse — test/fixtures/bad
+5 file(s): JS 32.6 kB gzip, CSS 10.9 kB gzip
+
+HIGH     Total JS is 32.6 kB gzip, over the 30.0 kB budget [bundle-total-over-budget]
+HIGH     test/fixtures/bad/assets/app-K2m9xQ7r.css assets/app-K2m9xQ7r.css is 10.9 kB gzip, over its 6.0 kB budget by 4.9 kB (82%) [bundle-over-budget]
+HIGH     test/fixtures/bad/assets/index-Xa91bQ2k.js assets/index-Xa91bQ2k.js is 9.1 kB gzip, over its 8.0 kB budget by 1.1 kB (14%) [bundle-over-budget]
+MEDIUM   Budget "assets/admin-*.js" matches no file [bundle-budget-unmatched]
+MEDIUM   test/fixtures/bad/assets/legacy.js assets/legacy.js (40.0 kB) looks unminified [bundle-unminified]
+```
+
+## Options
+
+```text
+bundle-pulse 1.0.0 — JS/CSS bundle size budgets with raw, gzip and brotli sizes
+
+Usage: bundle-pulse [build-dir] [options]
+
+Budgets
+  -b, --budget <glob=size>  Budget for matching files, repeatable; gzip by default ("assets/index-*.js=60KB",
+                            "**/*.css=brotli:20KB", "vendor*.js=raw:400KB")
+      --total-js <size>     Budget for all JS together (gzip)
+      --total-css <size>    Budget for all CSS together (gzip)
+      --include <globs>     Files to measure (default **/*.{js,mjs,cjs,css}; source maps always skipped)
+      --exclude <globs>     Files to skip
+Base comparison
+      --base <file>         Snapshot from the base branch (written with --snapshot)
+      --base-optional       Do not fail if the base snapshot does not exist yet
+      --max-growth <pct>    Allowed growth per file vs base, in percent (default 10)
+      --snapshot <file>     Write the current sizes as a snapshot
+
+Common
+  -c, --config <file>     JSON config (default: .bundle-pulse.json or "bundlePulse" in package.json)
+  -f, --format <fmt>      text (default) | json | sarif | markdown
+      --json <file>       Also write a JSON report
+      --sarif <file>      Also write SARIF 2.1.0
+      --markdown <file>   Also write Markdown (e.g. for a job summary)
+      --fail-on <sev>     critical | high | medium | low | info | none (default: high)
+      --list-rules        Print rules and default severities
+      --no-fixes          Hide fix suggestions in text output
+      --no-color          Disable colours
+  -v, --version / -h, --help
+
+Exit codes: 0 = passed, 1 = findings at or above --fail-on, 2 = usage, config or read error.
+```
+
+## Configuration and allowlist
+
+Options can live in `.bundle-pulse.json` (or a `"bundlePulse"` key in `package.json`, or `--config <file>`):
+
+```json
+{
+  "failOn": "medium",
+  "severity": {
+    "bundle-over-budget": "low"
+  },
+  "allowlist": [
+    {
+      "rule": "bundle-unminified",
+      "subject": "assets/legacy.js",
+      "reason": "Vendored legacy widget, replaced in Q1",
+      "expires": "2027-03-31"
+    }
+  ],
+  "budgets": [
+    {
+      "path": "assets/index-*.js",
+      "gzip": "60 KB",
+      "brotli": "50 KB"
+    },
+    {
+      "path": "assets/*.css",
+      "gzip": "15 KB"
+    }
+  ],
+  "totalJs": "200 KB",
+  "maxGrowth": 5,
+  "base": "bundle-base.json"
+}
+```
+
+- **`severity`** changes a rule's severity, or turns it `"off"`.
+- **`allowlist`** entries suppress matching findings. Each needs a `reason` and matches on any combination of `rule`, `file`, `subject` (globs with `*`) and `match` (a substring of the message). Add `expires` (`YYYY-MM-DD`) so the exception is time-boxed: once it lapses the finding comes back along with an `allowlist-expired` finding (medium). Entries that no longer match anything are reported as `allowlist-unused` (info).
+
+The config file is looked up in the target directory first, then in the current directory, so `.bundle-pulse.json` can live at your repository root. Other keys: `budgets` (array of `{ path, raw, gzip, brotli }` or a map of glob to gzip size), `totalJs`, `totalCss`, `maxGrowth`, `warnAt` (percent, default 90), `minDelta`, `largeFile`, `newLarge`, `base`, `include` and `exclude`. The config file is read from the build directory or from `--config`.
+
+## Output and exit codes
+
+- `--format text` (default), `json`, `sarif` (SARIF 2.1.0 for GitHub code scanning) or `markdown` (for job summaries and PR comments). `--json`, `--sarif` and `--markdown` write extra report files in the same run.
+- `--fail-on <severity>` sets the threshold (`critical`, `high`, `medium`, `low`, `info`, `none`; default `high`).
+- Exit codes: **0** passed, **1** findings at or above `--fail-on`, **2** usage, config or read error.
+
+## GitHub Action
+
+```yaml
+permissions:
+  contents: read
+  security-events: write   # only needed for the SARIF upload
+jobs:
+  bundle-pulse:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with: { persist-credentials: false }
+      - uses: MrLouisWright/bundle-pulse@v1
+        with:
+          path: dist
+          fail-on: high
+          sarif: bundle-pulse.sarif
+      - uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with: { sarif_file: bundle-pulse.sarif }
+```
+
+| Input | Description | Default |
+|---|---|---|
+| `path` | Build output directory | `.` |
+| `fail-on` | Failure threshold | `high` |
+| `config` | Config file path | |
+| `sarif` / `json` | Write SARIF / JSON report to this path | |
+| `job-summary` | Add the Markdown report to the job summary | `true` |
+| `args` | Extra CLI arguments | |
+
+The action runs the bundled CLI with Node 20; it has no dependencies to install. Pin it to a commit SHA if your policy requires it.
+
+## Library
+
+```js
+import { scan, analyze, normaliseBudgets } from "bundle-pulse";
+const files = scan("dist");
+const findings = analyze(files, { budgets: normaliseBudgets({ "assets/index-*.js": "60 KB" }) });
+```
+
+Types are included.
+
+## Requirements
+
+Node.js 18 or newer. Zero runtime dependencies.
+
+## Licence
+
+MIT © Louis Wright. See [LICENSE](LICENSE).

package/action.yml

@@ -0,0 +1,44 @@
+name: 'bundle-pulse'
+description: 'JS/CSS bundle size budgets (raw, gzip, brotli)'
+author: 'Louis Wright'
+branding: { icon: 'package', color: 'blue' }
+inputs:
+  path: { description: 'Build output directory', default: '.' }
+  fail-on: { description: 'critical | high | medium | low | info | none', default: 'high' }
+  config: { description: 'Path to JSON config file', default: '' }
+  sarif: { description: 'Write SARIF to this path', default: '' }
+  json: { description: 'Write JSON report to this path', default: '' }
+  job-summary: { description: 'Write the Markdown report to the job summary (true/false)', default: 'true' }
+  args: { description: 'Extra CLI arguments', default: '' }
+outputs:
+  markdown-file: { description: 'Path of the Markdown report', value: '${{ steps.run.outputs.markdown-file }}' }
+runs:
+  using: 'composite'
+  steps:
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      with: { node-version: '20' }
+    - id: run
+      shell: bash
+      env:
+        XB_PATH: ${{ inputs.path }}
+        XB_FAIL_ON: ${{ inputs.fail-on }}
+        XB_CONFIG: ${{ inputs.config }}
+        XB_SARIF: ${{ inputs.sarif }}
+        XB_JSON: ${{ inputs.json }}
+        XB_SUMMARY: ${{ inputs.job-summary }}
+        XB_ARGS: ${{ inputs.args }}
+        XB_BIN: ${{ github.action_path }}/bin/bundle-pulse.js
+      run: |
+        md="$RUNNER_TEMP/bundle-pulse.md"
+        args=("$XB_PATH" --fail-on "$XB_FAIL_ON" --markdown "$md")
+        [ -n "$XB_CONFIG" ] && args+=(--config "$XB_CONFIG")
+        [ -n "$XB_SARIF" ] && args+=(--sarif "$XB_SARIF")
+        [ -n "$XB_JSON" ] && args+=(--json "$XB_JSON")
+        set +e
+        # shellcheck disable=SC2086
+        node "$XB_BIN" "${args[@]}" $XB_ARGS
+        code=$?
+        set -e
+        echo "markdown-file=$md" >> "$GITHUB_OUTPUT"
+        if [ "$XB_SUMMARY" = "true" ] && [ -f "$md" ]; then cat "$md" >> "$GITHUB_STEP_SUMMARY"; fi
+        exit $code

package/bin/bundle-pulse.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { mainCli, check, RULES, splitList } from '../src/index.js';
+
+const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+mainCli({
+  name: 'bundle-pulse', version: pkg.version, configKey: 'bundlePulse', rules: RULES,
+  tagline: 'JS/CSS bundle size budgets with raw, gzip and brotli sizes',
+  usage: 'Usage: bundle-pulse [build-dir] [options]',
+  help: `Budgets
+  -b, --budget <glob=size>  Budget for matching files, repeatable; gzip by default ("assets/index-*.js=60KB",
+                            "**/*.css=brotli:20KB", "vendor*.js=raw:400KB")
+      --total-js <size>     Budget for all JS together (gzip)
+      --total-css <size>    Budget for all CSS together (gzip)
+      --include <globs>     Files to measure (default **/*.{js,mjs,cjs,css}; source maps always skipped)
+      --exclude <globs>     Files to skip
+Base comparison
+      --base <file>         Snapshot from the base branch (written with --snapshot)
+      --base-optional       Do not fail if the base snapshot does not exist yet
+      --max-growth <pct>    Allowed growth per file vs base, in percent (default 10)
+      --snapshot <file>     Write the current sizes as a snapshot
+`,
+  options: { budget: { type: 'string', short: 'b', multiple: true }, 'total-js': { type: 'string' }, 'total-css': { type: 'string' }, include: { type: 'string', multiple: true }, exclude: { type: 'string', multiple: true }, base: { type: 'string' }, 'base-optional': { type: 'boolean' }, 'max-growth': { type: 'string' }, snapshot: { type: 'string' } },
+  run: async ({ dir, values: o, config, configFile }) => check(dir, { budget: o.budget || [], totalJs: o['total-js'], totalCss: o['total-css'], include: splitList(o.include), exclude: splitList(o.exclude), base: o.base, baseOptional: o['base-optional'], maxGrowth: o['max-growth'] != null ? Number(o['max-growth']) : undefined, snapshot: o.snapshot, toolVersion: pkg.version }, config, configFile),
+});

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "bundle-pulse",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "CI gate for JS/CSS bundle size: per-entry budgets on raw, gzip and brotli sizes, total JS/CSS budgets, growth vs a base-branch snapshot with content-hash-insensitive names, unminified and duplicate files. SARIF, Markdown, GitHub Action. Zero deps.",
+  "type": "module",
+  "main": "./src/index.js",
+  "types": "./src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./src/index.d.ts",
+      "default": "./src/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "bundle-pulse": "bin/bundle-pulse.js"
+  },
+  "files": [
+    "src",
+    "bin",
+    "action.yml",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.js"
+  },
+  "keywords": [
+    "bundle-size",
+    "performance",
+    "budget",
+    "gzip",
+    "brotli",
+    "webpack",
+    "vite",
+    "ci",
+    "sarif",
+    "github-action"
+  ],
+  "author": "Louis Wright <hello@louiswright.co.uk> (https://github.com/MrLouisWright)",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MrLouisWright/bundle-pulse.git"
+  },
+  "bugs": {
+    "url": "https://github.com/MrLouisWright/bundle-pulse/issues"
+  },
+  "homepage": "https://github.com/MrLouisWright/bundle-pulse#readme"
+}

package/src/core.d.ts

@@ -0,0 +1,16 @@
+export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';
+export interface Finding { rule: string; severity: Severity; message: string; fix?: string; file?: string; line?: number; subject?: string; [k: string]: unknown }
+export interface AllowlistEntry { rule?: string; file?: string; subject?: string; match?: string; reason: string; expires?: string }
+export interface Config { failOn?: Severity | 'none'; allowlist?: AllowlistEntry[]; severity?: Record<string, Severity | 'off'>; [k: string]: unknown }
+export interface Rule { severity: Severity; title: string }
+export interface Report { tool: { name: string; version: string; rules: Record<string, Rule> }; target: string; summaryLine?: string; counts: Record<Severity, number>; findings: Finding[]; suppressed: (Finding & { reason: string; expires: string | null })[]; [k: string]: unknown }
+export const SEVERITIES: Severity[];
+export const POLICY_RULES: Record<string, Rule>;
+export class UsageError extends Error {}
+export function applyPolicy(raw: Finding[], config?: Config, opts?: { now?: Date; configFile?: string }): { findings: Finding[]; suppressed: Report['suppressed'] };
+export function validateConfig(config: unknown): Config;
+export function exceeds(report: Report, failOn: Severity | 'none'): boolean;
+export function formatText(report: Report, opts?: { color?: boolean; failOn?: string; fixes?: boolean }): string;
+export function formatJson(report: Report): string;
+export function formatSarif(report: Report): string;
+export function formatMarkdown(report: Report, opts?: { failOn?: string }): string;

package/src/core.js

@@ -0,0 +1,176 @@
+// Shared reporting / policy / CLI core. Zero dependencies. Louis Wright, MIT.
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { parseArgs } from 'node:util';
+
+export const SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
+export const sevRank = (s) => { const i = SEVERITIES.indexOf(s); return i === -1 ? 99 : i; };
+export class UsageError extends Error {}
+
+export const POLICY_RULES = {
+  'allowlist-expired': { severity: 'medium', title: 'Allowlist entry has expired' },
+  'allowlist-unused': { severity: 'info', title: 'Allowlist entry matched nothing' },
+};
+
+function globRe(p) { return new RegExp('^' + String(p).replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.') + '$', 'i'); }
+
+/** Does an allowlist entry ({rule, file, match, subject}) cover a finding? */
+export function entryMatches(e, f) {
+  if (e.rule && !globRe(e.rule).test(f.rule)) return false;
+  if (e.file && !globRe(e.file).test(f.file || '')) return false;
+  if (e.subject && !globRe(e.subject).test(f.subject || '')) return false;
+  if (e.match && !String(f.message).toLowerCase().includes(String(e.match).toLowerCase())) return false;
+  return !!(e.rule || e.file || e.subject || e.match);
+}
+
+export function validateConfig(config) {
+  if (config == null || typeof config !== 'object' || Array.isArray(config)) throw new UsageError('config must be a JSON object');
+  if (config.allowlist != null && !Array.isArray(config.allowlist)) throw new UsageError('"allowlist" must be an array');
+  for (const [i, e] of (config.allowlist || []).entries()) {
+    if (!e || typeof e !== 'object') throw new UsageError(`allowlist[${i}] must be an object`);
+    if (!e.rule && !e.file && !e.subject && !e.match) throw new UsageError(`allowlist[${i}] needs at least one of rule, file, subject, match`);
+    if (!e.reason) throw new UsageError(`allowlist[${i}] needs a "reason"`);
+    if (e.expires != null && (!/^\d{4}-\d{2}-\d{2}$/.test(e.expires) || Number.isNaN(Date.parse(e.expires)))) throw new UsageError(`allowlist[${i}].expires must be YYYY-MM-DD`);
+  }
+  for (const [k, v] of Object.entries(config.severity || {})) if (v !== 'off' && !SEVERITIES.includes(v)) throw new UsageError(`severity.${k} must be one of ${SEVERITIES.join(', ')}, off`);
+  return config;
+}
+
+/** Apply severity overrides and the allowlist. Returns { findings, suppressed }. */
+export function applyPolicy(raw, config = {}, { now = new Date(), configFile = 'config' } = {}) {
+  const today = now.toISOString().slice(0, 10);
+  const sev = config.severity || {};
+  const list = (config.allowlist || []).map((e, i) => ({ ...e, index: i, used: 0, expired: !!(e.expires && e.expires < today) }));
+  const findings = []; const suppressed = [];
+  for (const f0 of raw) {
+    const o = sev[f0.rule];
+    if (o === 'off') continue;
+    const f = o ? { ...f0, severity: o } : f0;
+    const hit = list.find((e) => entryMatches(e, f));
+    if (hit) { hit.used++; if (!hit.expired) { suppressed.push({ ...f, reason: hit.reason, expires: hit.expires || null }); continue; } }
+    findings.push(f);
+  }
+  for (const e of list) {
+    const label = [e.rule, e.file, e.subject, e.match].filter(Boolean).join(' / ');
+    if (e.expired && sev['allowlist-expired'] !== 'off') findings.push({ rule: 'allowlist-expired', severity: sev['allowlist-expired'] || 'medium', file: configFile, message: `Allowlist entry #${e.index + 1} (${label}) expired on ${e.expires}`, fix: 'Fix the underlying finding, or renew the entry with a new "expires" date and reason.' });
+    else if (!e.used && sev['allowlist-unused'] !== 'off') findings.push({ rule: 'allowlist-unused', severity: sev['allowlist-unused'] || 'info', file: configFile, message: `Allowlist entry #${e.index + 1} (${label}) matched no finding`, fix: 'Remove the stale entry.' });
+  }
+  findings.sort((a, b) => sevRank(a.severity) - sevRank(b.severity) || String(a.file || '').localeCompare(String(b.file || '')) || (a.line || 0) - (b.line || 0));
+  return { findings, suppressed };
+}
+
+export function countBy(findings) { const c = {}; for (const s of SEVERITIES) c[s] = 0; for (const f of findings) c[f.severity] = (c[f.severity] || 0) + 1; return c; }
+export const exceeds = (r, failOn) => !!failOn && failOn !== 'none' && r.findings.some((f) => sevRank(f.severity) <= sevRank(failOn));
+
+const C = { critical: '\x1b[35;1m', high: '\x1b[31;1m', medium: '\x1b[33m', low: '\x1b[36m', info: '\x1b[2m', dim: '\x1b[2m', bold: '\x1b[1m', reset: '\x1b[0m', red: '\x1b[31m', green: '\x1b[32m' };
+const sumText = (counts) => SEVERITIES.filter((k) => counts[k]).map((k) => `${counts[k]} ${k}`).join(', ') || 'no findings';
+const loc = (f) => (f.file ? `${f.file}${f.line ? ':' + f.line : ''}` : '');
+
+export function formatText(r, { color = false, failOn, fixes = true } = {}) {
+  const c = (k, s) => (color ? `${C[k]}${s}${C.reset}` : s);
+  const l = [c('bold', `${r.tool.name} — ${r.target}`)];
+  if (r.summaryLine) l.push(c('dim', r.summaryLine));
+  l.push('');
+  for (const f of r.findings) {
+    l.push(`${c(f.severity, f.severity.toUpperCase().padEnd(8))} ${loc(f) ? c('dim', loc(f) + ' ') : ''}${f.message} [${f.rule}]`);
+    if (fixes && f.fix) l.push(c('dim', `         ↳ fix: ${f.fix}`));
+  }
+  if (r.findings.length) l.push('');
+  if (r.suppressed.length) l.push(c('dim', `${r.suppressed.length} finding(s) covered by the allowlist`));
+  l.push(sumText(r.counts));
+  if (failOn) l.push(exceeds(r, failOn) ? c('red', `✖ Failing (fail-on: ${failOn}).`) : c('green', `✔ Passing (fail-on: ${failOn}).`));
+  return l.join('\n') + '\n';
+}
+
+export const formatJson = (r) => JSON.stringify(r, null, 2) + '\n';
+
+const LEVEL = { critical: 'error', high: 'error', medium: 'warning', low: 'note', info: 'note' };
+const SCORE = { critical: '9.0', high: '7.5', medium: '5.0', low: '3.0', info: '1.0' };
+export function formatSarif(r) {
+  const rules = { ...r.tool.rules, ...POLICY_RULES };
+  const ids = Object.keys(rules);
+  const repo = `https://github.com/MrLouisWright/${r.tool.name}`;
+  return JSON.stringify({
+    $schema: 'https://json.schemastore.org/sarif-2.1.0.json', version: '2.1.0',
+    runs: [{
+      tool: { driver: { name: r.tool.name, version: r.tool.version, informationUri: repo, rules: ids.map((id) => ({ id, name: id.replace(/(^|-)(\w)/g, (_, __, ch) => ch.toUpperCase()), shortDescription: { text: rules[id].title }, helpUri: `${repo}#rules`, defaultConfiguration: { level: LEVEL[rules[id].severity] }, properties: { 'security-severity': SCORE[rules[id].severity] } })) } },
+      results: r.findings.map((f) => ({ ruleId: f.rule, ruleIndex: ids.indexOf(f.rule), level: LEVEL[f.severity], message: { text: f.fix ? `${f.message}. Fix: ${f.fix}` : f.message }, locations: [{ physicalLocation: { artifactLocation: { uri: f.file || r.tool.defaultFile || '.' }, region: { startLine: f.line || 1 } } }], partialFingerprints: { ruleSubject: `${f.rule}:${f.file || ''}:${f.subject || f.message}` }, properties: { severity: f.severity } })),
+    }],
+  }, null, 2) + '\n';
+}
+
+const esc = (s) => String(s ?? '').replace(/\|/g, '\\|').replace(/\n/g, ' ');
+export function formatMarkdown(r, { failOn } = {}) {
+  const l = [`## ${r.tool.emoji || '📏'} ${r.tool.name}`, '', `**${esc(r.target)}**: ${r.summaryLine ? esc(r.summaryLine) + '; ' : ''}${sumText(r.counts)}.`];
+  if (failOn) l.push('', exceeds(r, failOn) ? `❌ Failing at \`--fail-on ${failOn}\`.` : `✅ Passing at \`--fail-on ${failOn}\`.`);
+  if (r.findings.length) {
+    l.push('', '| Severity | Location | Rule | Finding | Fix |', '|---|---|---|---|---|');
+    for (const f of r.findings) l.push(`| ${f.severity} | ${loc(f) ? '`' + esc(loc(f)) + '`' : ''} | \`${f.rule}\` | ${esc(f.message)} | ${esc(f.fix)} |`);
+  }
+  if (r.suppressed.length) l.push('', `_${r.suppressed.length} finding(s) covered by the allowlist._`);
+  return l.join('\n') + '\n';
+}
+
+/** Build a report object from raw findings. */
+export function buildReport(tool, target, raw, config, extra = {}) {
+  const { findings, suppressed } = applyPolicy(raw, config, { now: extra.now, configFile: extra.configFile });
+  const { now, configFile, ...rest } = extra;
+  return { tool: { name: tool.name, version: tool.version, rules: tool.rules, emoji: tool.emoji, defaultFile: tool.defaultFile }, target, ...rest, counts: countBy(findings), findings, suppressed };
+}
+
+export function loadConfig(dir, name, key, explicit) {
+  const file = explicit ? resolve(explicit) : join(dir, `.${name}.json`);
+  if (explicit || existsSync(file)) {
+    let c; try { c = JSON.parse(readFileSync(file, 'utf8')); } catch (e) { throw new UsageError(`Cannot read config ${file}: ${e.message}`); }
+    return { config: validateConfig(c), configFile: explicit || `.${name}.json` };
+  }
+  for (const d of [dir, process.cwd()]) {
+    if (d !== dir && existsSync(join(d, `.${name}.json`))) return loadConfig(d, name, key, join(d, `.${name}.json`));
+    try { const pj = JSON.parse(readFileSync(join(d, 'package.json'), 'utf8')); if (pj[key]) return { config: validateConfig(pj[key]), configFile: 'package.json' }; } catch (e) { if (e instanceof UsageError) throw e; }
+  }
+  return { config: {}, configFile: null };
+}
+
+const list = (v) => (v || []).flatMap((x) => String(x).split(',')).map((x) => x.trim()).filter(Boolean);
+export { list as splitList };
+
+/**
+ * Generic CLI. spec = { name, version, configKey, rules, help (tool-specific options text), options (parseArgs), defaultFailOn,
+ *   run: async ({ dir, positionals, values, config, configFile, stdin }) => report }
+ */
+export async function runCli(spec, argv = process.argv.slice(2), io = { stdout: process.stdout, stderr: process.stderr }) {
+  const usage = (m) => { io.stderr.write(`${spec.name}: ${m}\nRun with --help for usage.\n`); return 2; };
+  let a;
+  try {
+    a = parseArgs({ args: argv, allowPositionals: true, options: { ...spec.options, config: { type: 'string', short: 'c' }, format: { type: 'string', short: 'f' }, json: { type: 'string' }, sarif: { type: 'string' }, markdown: { type: 'string' }, 'fail-on': { type: 'string' }, 'no-color': { type: 'boolean' }, 'no-fixes': { type: 'boolean' }, 'list-rules': { type: 'boolean' }, version: { type: 'boolean', short: 'v' }, help: { type: 'boolean', short: 'h' } } });
+  } catch (e) { return usage(e.message); }
+  const { values: o, positionals } = a;
+  const all = { ...spec.rules, ...POLICY_RULES };
+  if (o.help) { io.stdout.write(`${spec.name} ${spec.version} — ${spec.tagline}\n\n${spec.usage}\n\n${spec.help}\nCommon\n  -c, --config <file>     JSON config (default: .${spec.name}.json or "${spec.configKey}" in package.json)\n  -f, --format <fmt>      text (default) | json | sarif | markdown\n      --json <file>       Also write a JSON report\n      --sarif <file>      Also write SARIF 2.1.0\n      --markdown <file>   Also write Markdown (e.g. for a job summary)\n      --fail-on <sev>     critical | high | medium | low | info | none (default: ${spec.defaultFailOn || 'high'})\n      --list-rules        Print rules and default severities\n      --no-fixes          Hide fix suggestions in text output\n      --no-color          Disable colours\n  -v, --version / -h, --help\n\nExit codes: 0 = passed, 1 = findings at or above --fail-on, 2 = usage, config or read error.\n`); return 0; }
+  if (o.version) { io.stdout.write(spec.version + '\n'); return 0; }
+  if (o['list-rules']) { for (const [id, r] of Object.entries(all)) io.stdout.write(`${id.padEnd(28)} ${r.severity.padEnd(9)} ${r.title}\n`); return 0; }
+  const format = o.format || 'text';
+  if (!['text', 'json', 'sarif', 'markdown'].includes(format)) return usage(`Invalid --format: ${format}`);
+  let report; let failOn;
+  try {
+    const dir = resolve(spec.dirFrom ? spec.dirFrom(o, positionals) : (positionals[0] || '.'));
+    if (!existsSync(dir)) return usage(`No such directory: ${dir}`);
+    const { config, configFile } = loadConfig(dir, spec.name, spec.configKey, o.config);
+    failOn = o['fail-on'] || config.failOn || spec.defaultFailOn || 'high';
+    if (failOn !== 'none' && !SEVERITIES.includes(failOn)) return usage(`Invalid --fail-on: ${failOn}`);
+    report = await spec.run({ dir, positionals, values: o, config, configFile: configFile || `.${spec.name}.json` });
+  } catch (e) { if (e instanceof UsageError || e.code === 'ENOENT' || e.code === 'EACCES') return usage(e.message); throw e; }
+  const color = !o['no-color'] && io.stdout.isTTY && !process.env.NO_COLOR;
+  const out = { text: () => formatText(report, { color, failOn, fixes: !o['no-fixes'] }), json: () => formatJson(report), sarif: () => formatSarif(report), markdown: () => formatMarkdown(report, { failOn }) };
+  io.stdout.write(out[format]());
+  try {
+    if (o.json) writeFileSync(o.json, formatJson(report));
+    if (o.sarif) writeFileSync(o.sarif, formatSarif(report));
+    if (o.markdown) writeFileSync(o.markdown, formatMarkdown(report, { failOn }));
+  } catch (e) { return usage(`Cannot write output: ${e.message}`); }
+  return exceeds(report, failOn) ? 1 : 0;
+}
+
+export function mainCli(spec) {
+  runCli(spec).then((c) => { process.exitCode = c; }, (e) => { process.stderr.write(`${spec.name}: ${e.stack || e}\n`); process.exitCode = 2; });
+}

package/src/index.d.ts

@@ -0,0 +1,14 @@
+export * from './core.js';
+import type { Report, Finding } from './core.js';
+export declare const RULES: Record<string, { severity: string; title: string }>;
+export interface FileSize { file: string; name: string; kind: 'js' | 'css'; raw: number; gzip: number; brotli?: number; sha: string; unminified?: boolean }
+export interface Budget { path: string; raw?: number; gzip?: number; brotli?: number; src?: string }
+export declare function parseSize(v: string | number): number | null;
+export declare function fmtSize(n: number): string;
+export declare function stableName(file: string): string;
+export declare function measure(buf: Buffer, opts?: { brotli?: boolean }): { raw: number; gzip: number; brotli?: number };
+export declare function scan(dir: string, opts?: { include?: string[]; exclude?: string[] }): FileSize[];
+export declare function normaliseBudgets(config?: unknown, cli?: string[]): Budget[];
+export declare function analyze(files: FileSize[], opts?: Record<string, unknown>): Finding[];
+export declare function snapshot(files: FileSize[], meta?: Record<string, unknown>): { schema: string; generatedAt: string; files: FileSize[] };
+export declare function check(dir: string, opts?: { budget?: string[]; totalJs?: string; totalCss?: string; include?: string[]; exclude?: string[]; base?: string; baseOptional?: boolean; maxGrowth?: number; snapshot?: string; toolVersion?: string }, config?: Record<string, unknown>, configFile?: string): Report;

package/src/index.js

@@ -0,0 +1,122 @@
+// bundle-pulse: JS/CSS bundle size budgets (raw/gzip/brotli) per entry, with diff against a base snapshot.
+// Zero dependencies. Louis Wright, MIT.
+import { readdirSync, readFileSync, statSync, existsSync, writeFileSync } from 'node:fs';
+import { join, relative, sep, resolve } from 'node:path';
+import { gzipSync, brotliCompressSync, constants as Z } from 'node:zlib';
+import { createHash } from 'node:crypto';
+import { buildReport, UsageError } from './core.js';
+
+export * from './core.js';
+
+export const RULES = {
+  'bundle-over-budget': { severity: 'high', title: 'File is larger than its budget' },
+  'bundle-total-over-budget': { severity: 'high', title: 'Total JS or CSS is larger than its budget' },
+  'bundle-growth': { severity: 'medium', title: 'File grew more than the allowed percentage since the base snapshot' },
+  'bundle-budget-unmatched': { severity: 'medium', title: 'Budget glob matches no file (renamed entry or stale budget)' },
+  'bundle-unminified': { severity: 'medium', title: 'Large file looks unminified' },
+  'bundle-near-budget': { severity: 'low', title: 'File is within the warning margin of its budget' },
+  'bundle-new-large': { severity: 'low', title: 'New file since the base snapshot is large' },
+  'bundle-duplicate': { severity: 'low', title: 'Identical file shipped under more than one name' },
+  'bundle-no-budget': { severity: 'info', title: 'Large file has no budget' },
+};
+
+const UNITS = { b: 1, kb: 1000, k: 1000, kib: 1024, mb: 1e6, m: 1e6, mib: 1048576 };
+/** "50 KB" | "50kb" | "1.2MB" | 51200 -> bytes. */
+export function parseSize(v) {
+  if (typeof v === 'number') return v;
+  const m = /^\s*(\d+(?:\.\d+)?)\s*([a-z]*)\s*$/i.exec(String(v ?? ''));
+  if (!m) return null; const u = (m[2] || 'b').toLowerCase(); if (!(u in UNITS)) return null;
+  return Math.round(+m[1] * UNITS[u]);
+}
+export const fmtSize = (n) => (Math.abs(n) >= 1e6 ? `${(n / 1e6).toFixed(2)} MB` : Math.abs(n) >= 1000 ? `${(n / 1000).toFixed(1)} kB` : `${n} B`);
+
+function globToRe(g) {
+  let s = ''; g = String(g).replace(/^\.?\//, '');
+  for (let k = 0; k < g.length; k++) { const c = g[k]; if (c === '*') { if (g[k + 1] === '*') { s += '.*'; k++; if (g[k + 1] === '/') k++; } else s += '[^/]*'; } else if (c === '?') s += '[^/]'; else if (c === '{') { const e = g.indexOf('}', k); s += `(?:${g.slice(k + 1, e).split(',').map((x) => x.replace(/[.+^$()|[\]\\]/g, '\\$&')).join('|')})`; k = e; } else s += c.replace(/[.+^${}()|[\]\\]/g, '\\$&'); }
+  return new RegExp(`^${s}$`);
+}
+const matchAny = (globs, f) => globs.some((g) => globToRe(g).test(f) || (!String(g).includes('/') && globToRe(g).test(f.split('/').pop())));
+function walk(dir, base = dir, out = []) {
+  for (const e of readdirSync(dir, { withFileTypes: true })) { if (e.name === 'node_modules' || e.name === '.git') continue; const p = join(dir, e.name); if (e.isDirectory()) walk(p, base, out); else if (e.isFile()) out.push(relative(base, p).split(sep).join('/')); }
+  return out;
+}
+/** Strip content hashes so main.3f2a9c1b.js / main-BdT9x2Qa.js compare to main.js across builds. */
+export function stableName(f) {
+  return f.replace(/([.-])(?=[A-Za-z0-9_]*\d)(?=[A-Za-z0-9_]*[a-zA-Z])[A-Za-z0-9_]{8,}(?=\.(?:m?js|cjs|css)$)/, '').replace(/([.-])[a-f0-9]{6,}(?=\.)/i, '').replace(/[.-](?=\.)/, '');
+}
+export function measure(buf, { brotli = true } = {}) {
+  return { raw: buf.length, gzip: gzipSync(buf, { level: 9 }).length, brotli: brotli ? brotliCompressSync(buf, { params: { [Z.BROTLI_PARAM_QUALITY]: 11, [Z.BROTLI_PARAM_SIZE_HINT]: buf.length } }).length : undefined };
+}
+function looksUnminified(text) {
+  if (text.length < 20000) return false;
+  const lines = text.split('\n'); const avg = text.length / lines.length; const indented = lines.filter((l) => /^\s{2,}\S/.test(l)).length / lines.length;
+  const comments = (text.match(/\/\*[\s\S]*?\*\/|^\s*\/\/.*$/gm) || []).reduce((a, c) => a + c.length, 0) / text.length;
+  return (avg < 60 && indented > 0.3) || comments > 0.15;
+}
+
+export function scan(dir, { include = ['**/*.{js,mjs,cjs,css}'], exclude = [] } = {}) {
+  if (!existsSync(dir) || !statSync(dir).isDirectory()) throw new UsageError(`No such directory: ${dir}`);
+  return walk(dir).filter((f) => matchAny(include, f) && !/\.map$/.test(f) && !matchAny(exclude, f)).sort().map((file) => {
+    const buf = readFileSync(join(dir, file)); const kind = /\.css$/.test(file) ? 'css' : 'js';
+    return { file, name: stableName(file), kind, ...measure(buf), sha: createHash('sha256').update(buf).digest('hex').slice(0, 16), unminified: looksUnminified(buf.toString('utf8')) };
+  });
+}
+/** Budgets: [{ path, raw?, gzip?, brotli? }] | { "glob": "50 KB" (gzip) | { gzip, brotli, raw } }; CLI "glob=50KB" or "glob=brotli:40KB". */
+export function normaliseBudgets(b = [], cli = []) {
+  const out = [];
+  const push = (path, spec, src) => { const s = typeof spec === 'object' && spec ? spec : { gzip: spec }; const e = { path, src }; for (const k of ['raw', 'gzip', 'brotli']) if (s[k] != null) { const v = parseSize(s[k]); if (v == null) throw new UsageError(`Invalid ${k} size "${s[k]}" for budget ${path}`); e[k] = v; } if (!e.raw && !e.gzip && !e.brotli) throw new UsageError(`Budget ${path} has no size`); out.push(e); };
+  if (Array.isArray(b)) b.forEach((x, i) => { if (!x?.path) throw new UsageError(`budgets[${i}] needs "path"`); push(x.path, x, 'config'); }); else for (const [k, v] of Object.entries(b || {})) push(k, v, 'config');
+  for (const c of cli) { const m = /^(.+?)=(?:(raw|gzip|brotli):)?(.+)$/.exec(c); if (!m) throw new UsageError(`--budget must be glob=size, got "${c}"`); push(m[1], { [m[2] || 'gzip']: m[3] }, 'cli'); }
+  return out;
+}
+
+export function analyze(files, opts = {}) {
+  const raw = []; const add = (rule, subject, message, fix, file) => raw.push({ rule, severity: RULES[rule].severity, subject, message, fix, file });
+  const warn = (opts.warnAt ?? 90) / 100; const maxGrowth = opts.maxGrowth ?? 10; const minDelta = parseSize(opts.minDelta ?? '1 KB'); const large = parseSize(opts.largeFile ?? '100 KB');
+  const budgets = opts.budgets || [];
+  const budgeted = new Set();
+  for (const b of budgets) {
+    const hits = files.filter((f) => matchAny([b.path], f.file));
+    if (!hits.length) { add('bundle-budget-unmatched', b.path, `Budget "${b.path}" matches no file`, 'Update the glob to the current output name, or remove the budget.'); continue; }
+    for (const f of hits) {
+      budgeted.add(f.file);
+      for (const k of ['brotli', 'gzip', 'raw']) { if (b[k] == null || f[k] == null) continue;
+        if (f[k] > b[k]) add('bundle-over-budget', f.file, `${f.file} is ${fmtSize(f[k])} ${k}, over its ${fmtSize(b[k])} budget by ${fmtSize(f[k] - b[k])} (${Math.round((f[k] / b[k] - 1) * 100)}%)`, 'Split the entry (dynamic import), drop heavy dependencies, or raise the budget deliberately.', f.file);
+        else if (f[k] > b[k] * warn) add('bundle-near-budget', f.file, `${f.file} is ${fmtSize(f[k])} ${k}, ${Math.round((f[k] / b[k]) * 100)}% of its ${fmtSize(b[k])} budget`, 'Keep an eye on this entry.', f.file); }
+    }
+  }
+  for (const [kind, key] of [['js', 'totalJs'], ['css', 'totalCss']]) { const lim = opts[key]; if (!lim) continue; const t = files.filter((f) => f.kind === kind).reduce((a, f) => a + f.gzip, 0); if (t > lim) add('bundle-total-over-budget', `total-${kind}`, `Total ${kind.toUpperCase()} is ${fmtSize(t)} gzip, over the ${fmtSize(lim)} budget`, 'Remove unused code or split by route.'); }
+  if (opts.base) {
+    const base = new Map((opts.base.files || []).map((f) => [f.name || stableName(f.file), f]));
+    for (const f of files) { const b = base.get(f.name);
+      if (!b) { if (f.gzip >= parseSize(opts.newLarge ?? '50 KB')) add('bundle-new-large', f.file, `New file ${f.file} is ${fmtSize(f.gzip)} gzip`, 'Check this new chunk is intended.', f.file); continue; }
+      const d = f.gzip - b.gzip; const pct = b.gzip ? (d / b.gzip) * 100 : 0;
+      if (d >= minDelta && pct > maxGrowth) add('bundle-growth', f.file, `${f.file} grew ${fmtSize(d)} gzip (+${pct.toFixed(1)}%, ${fmtSize(b.gzip)} → ${fmtSize(f.gzip)})`, 'Find the new dependency or code (e.g. source-map-explorer) or accept the growth by updating the base snapshot.', f.file); }
+  }
+  for (const f of files) {
+    if (f.unminified) add('bundle-unminified', f.file, `${f.file} (${fmtSize(f.raw)}) looks unminified`, 'Enable minification for production builds.', f.file);
+    if (!budgeted.has(f.file) && f.gzip >= large && budgets.length) add('bundle-no-budget', f.file, `${f.file} is ${fmtSize(f.gzip)} gzip with no budget`, 'Add a budget for it.', f.file);
+  }
+  const bySha = new Map(); for (const f of files) (bySha.get(f.sha) || bySha.set(f.sha, []).get(f.sha)).push(f);
+  for (const g of bySha.values()) if (g.length > 1 && g[0].raw > 1000) add('bundle-duplicate', g[0].sha, `Same content shipped as ${g.map((f) => f.file).join(', ')} (${fmtSize(g[0].gzip)} gzip each)`, 'Deduplicate the asset or the build entry.', g[1].file);
+  return raw;
+}
+
+export function snapshot(files, meta = {}) { return { schema: 'bundle-pulse/1', generatedAt: new Date().toISOString(), ...meta, files: files.map(({ unminified, ...f }) => f) }; }
+
+export function check(dir, opts = {}, config = {}, configFile) {
+  const tool = { name: 'bundle-pulse', version: opts.toolVersion || '1.0.0', rules: RULES, emoji: '📦', defaultFile: '.' };
+  const files = scan(dir, { include: opts.include?.length ? opts.include : config.include || undefined, exclude: [...(config.exclude || []), ...(opts.exclude || [])] });
+  let base = null;
+  const bf = opts.base ?? config.base;
+  if (bf) { const p = resolve(bf); if (!existsSync(p)) { if (!opts.baseOptional) throw new UsageError(`Base snapshot not found: ${bf}`); } else { try { base = JSON.parse(readFileSync(p, 'utf8')); } catch (e) { throw new UsageError(`Invalid base snapshot ${bf}: ${e.message}`); } } }
+  const o = { budgets: normaliseBudgets(config.budgets, opts.budget), totalJs: parseSize(opts.totalJs ?? config.totalJs ?? 0) || 0, totalCss: parseSize(opts.totalCss ?? config.totalCss ?? 0) || 0, maxGrowth: opts.maxGrowth ?? config.maxGrowth, warnAt: config.warnAt, minDelta: config.minDelta, largeFile: config.largeFile, newLarge: config.newLarge, base };
+  const raw = analyze(files, o);
+  if (opts.snapshot) writeFileSync(opts.snapshot, JSON.stringify(snapshot(files), null, 2) + '\n');
+  const sum = (k, kind) => files.filter((f) => !kind || f.kind === kind).reduce((a, f) => a + (f[k] || 0), 0);
+  const rel = relative(process.cwd(), dir) || '.';
+  const delta = base ? sum('gzip') - (base.files || []).reduce((a, f) => a + f.gzip, 0) : null;
+  return buildReport(tool, rel, raw.map((f) => ({ ...f, file: f.file ? join(rel, f.file).split(sep).join('/') : undefined })), config, { now: opts.now, configFile,
+    summaryLine: `${files.length} file(s): JS ${fmtSize(sum('gzip', 'js'))} gzip, CSS ${fmtSize(sum('gzip', 'css'))} gzip${delta != null ? `; ${delta >= 0 ? '+' : ''}${fmtSize(delta)} vs base` : ''}`,
+    info: { files: files.map(({ file, kind, raw: r, gzip, brotli }) => ({ file, kind, raw: r, gzip, brotli })), totals: { raw: sum('raw'), gzip: sum('gzip'), brotli: sum('brotli') }, deltaGzip: delta } });
+}