ci-sdk 0.0.1 → 0.0.3

package/dist/graph.js

@@ -0,0 +1,315 @@
+import { readFileSync, realpathSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+import { parseSync } from 'oxc-parser';
+import { ResolverFactory } from 'oxc-resolver';
+import { glob } from 'tinyglobby';
+import { isPure } from './purity.js';
+const CODE = '**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}';
+const IGNORE = ['**/node_modules/**', '**/dist/**', '**/build/**', '**/coverage/**', '**/.git/**', '**/*.d.ts'];
+const TEST = /(\.(test|spec)\.[cm]?[jt]sx?$)|(^|\/)__tests__\//;
+// CommonJS requires and test-runner mocks are not in oxc's ESM module record, so pick them up by pattern.
+const EXTRA = /\b(?:require|(?:jest|vi)\.(?:mock|requireActual|importActual))\(\s*['"]([^'"]+)['"]/g;
+// Export conditions every package uses; anything else (e.g. "@zod/source") is a repo's own way to point at source.
+const STANDARD_CONDITIONS = new Set(['import', 'require', 'default', 'node', 'types', 'typings', 'browser', 'module', 'module-sync', 'production', 'development', 'worker', 'deno', 'bun', 'react-native', 'react-server', 'edge-light', 'workerd', 'electron', 'style']);
+const PKG = 'pkg:';
+const BUILD_OUTPUT = /(^|\/)(dist|build|out)\//;
+const ALL = '*';
+/**
+ * Where names really come from. A barrel (`export * from './dates'`) re-exports dozens of files; a test that imports
+ * `formatDate` through it depends on the file defining formatDate and the barrels on the way, not on every file the
+ * barrel exposes. Files with load-time side effects stay linked to everyone who loads them.
+ */
+function exportsIndex(infos) {
+    const union = (a, b) => {
+        const out = a ?? new Set();
+        for (const x of b)
+            out.add(x);
+        return out;
+    };
+    const wholeMemo = new Map();
+    /** The module plus every file it re-exports from, transitively: what `import * as ns` can reach. */
+    const whole = (m) => {
+        const cached = wholeMemo.get(m);
+        if (cached)
+            return cached;
+        const out = new Set([m]);
+        wholeMemo.set(m, out); // seeded first so re-export cycles terminate
+        for (const r of infos.get(m)?.reexports ?? [])
+            union(out, whole(r.from));
+        return out;
+    };
+    const memo = new Map();
+    /** Files that define `name` as exported by `m`, plus the barrels it passes through; undefined if `m` lacks it. */
+    const definers = (m, name, seen = new Set()) => {
+        const key = `${m}\0${name}`;
+        if (memo.has(key))
+            return memo.get(key);
+        const info = infos.get(m);
+        // Unparsed targets (JSON, CSS) and names a module defines itself end here.
+        if (!info || m.startsWith(PKG) || info.local.has(name))
+            return new Set([m]);
+        if (seen.has(m))
+            return undefined;
+        seen.add(m);
+        let out;
+        for (const r of info.reexports) {
+            if (r.exported === name)
+                out = union(out, r.imported === ALL ? whole(r.from) : (definers(r.from, r.imported, seen) ?? whole(r.from)));
+            else if (r.exported === ALL && name !== 'default') {
+                const found = definers(r.from, name, seen);
+                if (found)
+                    out = union(out, found);
+            }
+        }
+        if (out)
+            out.add(m);
+        memo.set(key, out);
+        return out;
+    };
+    return { definers, whole };
+}
+// `fx:<file>` stands for what loading <file> does. It changes when <file> has side effects and changes, or when
+// anything <file> loads has side effects that change; a pure file's own edits never reach it.
+const FX = 'fx:';
+const bareName = (spec) => (/^[./]|:/.test(spec) ? undefined : spec.split('/').slice(0, spec.startsWith('@') ? 2 : 1).join('/'));
+export async function buildGraph(dir) {
+    // The resolver returns real paths, so a symlinked checkout (e.g. macOS /var -> /private/var) must be compared by its real path.
+    const root = realpathSync(dir);
+    const files = await glob(CODE, { cwd: root, ignore: IGNORE });
+    // Workspace packages by name, so `import 'zod/v4'` resolves to repo source even without node_modules installed.
+    const packages = new Map();
+    const packageDirs = [];
+    const custom = new Set();
+    const collect = (o) => {
+        if (o && typeof o === 'object')
+            for (const [k, v] of Object.entries(o)) {
+                if (!k.startsWith('.') && !STANDARD_CONDITIONS.has(k))
+                    custom.add(k);
+                collect(v);
+            }
+    };
+    for (const m of await glob('**/package.json', { cwd: root, ignore: IGNORE })) {
+        if (m !== 'package.json')
+            packageDirs.push(m.slice(0, -'package.json'.length));
+        try {
+            const pkg = JSON.parse(readFileSync(join(root, m), 'utf8'));
+            if (pkg.name)
+                packages.set(pkg.name, m.slice(0, -'package.json'.length));
+            collect(pkg.exports);
+        }
+        catch {
+            // unreadable manifest: its package just resolves through node_modules
+        }
+    }
+    const resolver = new ResolverFactory({
+        extensions: ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs', '.json'],
+        extensionAlias: { '.js': ['.ts', '.tsx', '.js'], '.mjs': ['.mts', '.mjs'], '.cjs': ['.cts', '.cjs'] },
+        conditionNames: [...custom, 'source', 'node', 'import', 'require', 'default'],
+    });
+    const inRepo = (abs) => {
+        const rel = abs && relative(root, abs).split(sep).join('/');
+        return rel && !rel.startsWith('..') && !rel.includes('node_modules/') ? rel : undefined;
+    };
+    // Built output (dist/index.js) is what package exports point at once a build has run; an edit to src/ never reaches it.
+    // Map it back to the source file it was compiled from: dist/x.js -> src/x.ts, or x.ts when outDir mirrors the root.
+    const toSource = (rel) => {
+        for (const swap of ['$1src/', '$1']) {
+            const guess = rel.replace(BUILD_OUTPUT, swap).replace(/\.(d\.)?[cm]?js$/, '');
+            const hit = inRepo(resolver.sync(root, `./${guess}`).path);
+            if (hit && !BUILD_OUTPUT.test(hit))
+                return hit;
+        }
+    };
+    const sourceOf = (rel) => (rel && BUILD_OUTPUT.test(rel) ? toSource(rel) : rel);
+    const resolve = (abs, spec) => {
+        let rel = sourceOf(inRepo(resolver.resolveFileSync(abs, spec).path));
+        const pkgDir = rel ? undefined : packages.get(bareName(spec) ?? '');
+        if (pkgDir !== undefined) {
+            // Resolve as a self-reference from inside the package, which applies its exports with our conditions.
+            // Exports that point only at build output fall back to the same path under src/ or the package root,
+            // and failing that to the whole package.
+            const manifest = join(root, pkgDir, 'package.json');
+            const sub = spec.slice(bareName(spec).length);
+            rel =
+                sourceOf(inRepo(resolver.resolveFileSync(manifest, spec).path)) ??
+                    inRepo(resolver.resolveFileSync(manifest, `./src${sub}`).path) ??
+                    inRepo(resolver.resolveFileSync(manifest, `.${sub || '/index'}`).path) ??
+                    PKG + pkgDir;
+        }
+        return rel;
+    };
+    const infos = new Map();
+    for (const file of files) {
+        const abs = join(root, file);
+        let src;
+        try {
+            src = readFileSync(abs, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        const parsed = parseSync(file, src);
+        const info = { uses: new Map(), loads: new Set(), local: new Set(), reexports: [], pure: isPure(parsed.program) };
+        const resolved = new Map();
+        const target = (spec) => {
+            if (!resolved.has(spec))
+                resolved.set(spec, resolve(abs, spec));
+            const t = resolved.get(spec);
+            if (t)
+                info.loads.add(t);
+            return t;
+        };
+        // name: one export it asks for; ALL: the whole module (namespace import, require, dynamic import, mock).
+        const use = (spec, name) => {
+            const t = target(spec);
+            if (!t)
+                return;
+            const u = info.uses.get(t) ?? info.uses.set(t, { names: new Set(), all: false }).get(t);
+            if (name === ALL)
+                u.all = true;
+            else if (name)
+                u.names.add(name);
+        };
+        const mod = parsed.module;
+        for (const i of mod.staticImports) {
+            const live = i.entries.filter((e) => !e.isType);
+            if (i.entries.length && !live.length)
+                continue; // type-only imports are erased before tests run
+            if (!live.length)
+                use(i.moduleRequest.value); // import './setup': loads it for its effects
+            for (const e of live)
+                use(i.moduleRequest.value, e.importName.kind === 'Name' ? e.importName.name : e.importName.kind === 'Default' ? 'default' : ALL);
+        }
+        for (const e of mod.staticExports)
+            for (const entry of e.entries) {
+                if (entry.isType)
+                    continue;
+                const exported = entry.exportName.kind === 'Name' ? entry.exportName.name : entry.exportName.kind === 'Default' ? 'default' : ALL;
+                if (!entry.moduleRequest)
+                    info.local.add(exported);
+                else {
+                    const from = target(entry.moduleRequest.value);
+                    // export * as ns / export * : the whole module (all but default for the latter, which `definers` respects)
+                    if (from)
+                        info.reexports.push({ from, imported: entry.importName.kind === 'Name' ? entry.importName.name : ALL, exported });
+                }
+            }
+        for (const d of mod.dynamicImports) {
+            const text = src.slice(d.moduleRequest.start, d.moduleRequest.end);
+            if (/^['"`][^'"`$]*['"`]$/.test(text))
+                use(text.slice(1, -1), ALL);
+        }
+        for (const m of src.matchAll(EXTRA))
+            use(m[1], ALL);
+        infos.set(file, info);
+    }
+    const importers = new Map();
+    const nodes = new Set(files);
+    const edge = (target, from) => {
+        if (!target.startsWith(PKG) && !target.startsWith(FX))
+            nodes.add(target);
+        (importers.get(target) ?? importers.set(target, new Set()).get(target)).add(from);
+    };
+    const { definers, whole } = exportsIndex(infos);
+    for (const [file, info] of infos) {
+        if (!info.pure)
+            edge(file, FX + file);
+        for (const t of info.loads) {
+            if (t.startsWith(PKG)) {
+                edge(t, file);
+                continue;
+            }
+            // Loading t runs whatever t's loading does, so this file and its own load effects depend on it.
+            edge(FX + t, file);
+            edge(FX + t, FX + file);
+        }
+        for (const [t, u] of info.uses) {
+            edge(t, file);
+            if (t.startsWith(PKG))
+                continue;
+            const deps = u.all ? whole(t) : new Set([...u.names].flatMap((n) => [...(definers(t, n) ?? whole(t))]));
+            for (const d of deps)
+                edge(d, file);
+        }
+    }
+    for (const [key, from] of importers) {
+        if (!key.startsWith(PKG))
+            continue;
+        const pkgDir = key.slice(PKG.length);
+        // No package entry imports its tests, so a test change never flows through the package.
+        for (const n of nodes)
+            if (n.startsWith(pkgDir) && !TEST.test(n))
+                for (const f of from)
+                    (importers.get(n) ?? importers.set(n, new Set()).get(n)).add(f);
+        importers.delete(key);
+    }
+    return { tests: new Set(files.filter((f) => TEST.test(f))), importers, nodes, packages: packageDirs.sort((a, b) => b.length - a.length) };
+}
+const CODE_FILE = /\.[cm]?[jt]sx?$/;
+// Changes to these never affect test results. CI workflows change which commands run, not what tests read.
+// Lint, format and editor configs change how code is checked or shown, not what tests do.
+const INERT = new RegExp([
+    /\.(md|mdx|txt|png|jpe?g|gif|svg|ico|webp)$/,
+    /^(docs?|\.changeset|\.github)\//,
+    /(^|\/)(LICENSE|CHANGELOG)[^/]*$/,
+    /(^|\/)(\.vscode|\.idea)\//,
+    /(^|\/)(\.gitignore|\.editorconfig|\.?oxlintrc[^/]*|\.oxfmtrc[^/]*|biome\.jsonc?|\.eslintrc[^/]*|eslint\.config\.[^/]+|\.prettierrc[^/]*|prettier\.config\.[^/]+|\.prettierignore|knip\.jsonc?|\.lintstagedrc[^/]*|commitlint\.config\.[^/]+)$/,
+]
+    .map((r) => r.source)
+    .join('|'), 'i');
+const LOCKFILE = /(^|\/)(pnpm-lock\.yaml|package-lock\.json|yarn\.lock|bun\.lockb?)$/;
+/**
+ * Test files a change can reach, or 'all' when we cannot tell (root config, root lockfile alone, unknown root files).
+ * A non-code file inside a workspace package (its manifest, tsconfig, fixtures, nested lockfile) affects that package only.
+ */
+export function affectedTests(graph, changed) {
+    const packageOf = (f) => graph.packages.find((p) => f.startsWith(p));
+    const changesManifests = changed.some((f) => f.endsWith('/package.json') && packageOf(f));
+    // Packages this change creates: nothing existing imports them, so only their own (changed, seeded) files matter.
+    const newPackages = changed
+        .filter((f) => /(^|\/)(package|deno|jsr)\.json$/.test(f) && f.includes('/'))
+        .map((f) => f.slice(0, f.lastIndexOf('/') + 1))
+        .filter((dir) => !graph.packages.includes(dir) && ![...graph.nodes].some((n) => n.startsWith(dir)));
+    const seen = new Set();
+    const queue = [];
+    const seed = (f) => {
+        if (!seen.has(f)) {
+            seen.add(f);
+            queue.push(f);
+        }
+    };
+    for (const f of changed) {
+        if (INERT.test(f))
+            continue;
+        if (graph.nodes.has(f))
+            seed(f);
+        else if (newPackages.some((dir) => f.startsWith(dir))) {
+            if (CODE_FILE.test(f))
+                seed(f);
+        }
+        // A code file the graph lacks is new in this change; only changed files can import it, and they are seeded too.
+        else if (CODE_FILE.test(f))
+            seed(f);
+        else if (packageOf(f)) {
+            const dir = packageOf(f);
+            for (const n of graph.nodes)
+                if (n.startsWith(dir))
+                    seed(n);
+        }
+        // estimate-only: a root lockfile changed alongside package manifests is those packages' dependency bump.
+        // A real cache must not rely on this; a bump can shift shared transitive dependencies.
+        else if (LOCKFILE.test(f) && changesManifests)
+            continue;
+        else
+            return 'all';
+    }
+    while (queue.length) {
+        for (const importer of graph.importers.get(queue.pop()) ?? []) {
+            if (!seen.has(importer)) {
+                seen.add(importer);
+                queue.push(importer);
+            }
+        }
+    }
+    return new Set([...seen].filter((f) => graph.tests.has(f) || (TEST.test(f) && !f.startsWith(FX))));
+}

package/dist/lockfile.js

@@ -0,0 +1,83 @@
+import { createHash } from 'node:crypto';
+const sha = (parts) => {
+    const h = createHash('sha256');
+    for (const p of parts)
+        h.update(p).update('\0');
+    return h.digest('hex');
+};
+const ENTRY = /^(\s*)('[^']*'|[^\s:'][^:]*):(?:\s+(.*))?$/;
+const DEP_GROUPS = new Set(['dependencies', 'devDependencies', 'optionalDependencies']);
+/**
+ * Per-package fingerprints from a pnpm v9 lockfile, so a lockfile change reruns only packages whose dependency tree changed.
+ * Reads just the block layout pnpm writes; returns undefined for anything else, and callers then hash the whole file.
+ */
+export function pnpmLockKeys(text) {
+    const docs = text.split(/^---$/m);
+    const mainAt = docs.findLastIndex((d) => /^importers:/m.test(d));
+    if (mainAt < 0 || !/^lockfileVersion: '9\.\d+'/m.test(docs[mainAt]))
+        return undefined;
+    const other = docs.filter((_, i) => i !== mainAt);
+    // Top-level sections of the main document.
+    const sections = new Map();
+    let cur = '';
+    for (const line of docs[mainAt].split('\n')) {
+        const m = /^([^\s#][^:]*):/.exec(line);
+        if (m)
+            sections.set((cur = m[1]), []);
+        else
+            sections.get(cur)?.push(line);
+    }
+    for (const [name, lines] of sections)
+        if (!['importers', 'packages', 'snapshots'].includes(name))
+            other.push(`${name}\n${lines.join('\n')}`);
+    // importers: 2 spaces importer, 4 group, 6 dependency name, 8 specifier/version.
+    const direct = new Map();
+    let imp = '';
+    let group = '';
+    let dep = '';
+    for (const line of sections.get('importers') ?? []) {
+        const m = ENTRY.exec(line);
+        if (!m)
+            continue;
+        const [indent, key, value] = [m[1].length, m[2].replace(/^'(.*)'$/, '$1'), m[3]?.trim()];
+        if (indent === 2)
+            direct.set((imp = key), []);
+        else if (indent === 4)
+            group = key;
+        else if (indent === 6)
+            dep = key;
+        else if (indent === 8 && key === 'version' && DEP_GROUPS.has(group) && value)
+            direct.get(imp).push(node(dep, value));
+    }
+    // snapshots: 2 spaces id, 4 group, 6 `name: version`.
+    const children = new Map();
+    let id = '';
+    for (const line of sections.get('snapshots') ?? []) {
+        const m = ENTRY.exec(line);
+        if (!m)
+            continue;
+        const [indent, key, value] = [m[1].length, m[2].replace(/^'(.*)'$/, '$1'), m[3]?.trim()];
+        if (indent === 2)
+            children.set((id = key), []);
+        else if (indent === 4)
+            group = key;
+        else if (indent === 6 && DEP_GROUPS.has(group) && value)
+            children.get(id).push(node(key, value));
+    }
+    const byImporter = new Map();
+    for (const [importer, roots] of direct) {
+        const seen = new Set();
+        const stack = roots.filter((r) => !r.includes('@link:'));
+        while (stack.length) {
+            const n = stack.pop();
+            if (seen.has(n))
+                continue;
+            seen.add(n);
+            stack.push(...(children.get(n) ?? []));
+        }
+        byImporter.set(importer, sha([...seen].sort()));
+    }
+    return { shared: sha(other), byImporter };
+}
+// A dependency's snapshot id: `name@version`, or the version itself for an alias (`string-width: string-width@4.2.3`).
+const node = (name, version) => (/^(@[^/]+\/)?[^@/(]+@/.test(version) ? version : `${name}@${version}`);

package/dist/purity.js

@@ -0,0 +1,140 @@
+// Does loading a module do anything besides defining bindings? A barrel loads every file it re-exports, so a file
+// with load-time effects (registering handlers, patching globals, starting clients) can change a test that never
+// names it. Anything we cannot prove harmless counts as a side effect: a wrong "pure" means a wrongly skipped test.
+// Calls on these build values without touching anything else: Object.freeze({...}), new Map(), z.object({...}).
+const PURE_GLOBALS = ['Symbol', 'Object', 'Array', 'Number', 'String', 'Boolean', 'BigInt', 'Math', 'JSON', 'Map', 'Set', 'WeakMap', 'WeakSet', 'RegExp', 'Date', 'URL', 'Error', 'z'];
+// Libraries whose top-level calls define schemas, tables and styles: z.object(), pgTable(), cva().
+const PURE_LIBRARIES = /^(zod(\/.*)?|drizzle-orm(\/.*)?|valibot|@sinclair\/typebox(\/.*)?|yup|superstruct|arktype|io-ts|class-variance-authority)$/;
+// Methods that derive a new schema or column from an existing one: Base.extend({...}), uuid('id').notNull().
+const BUILDER_METHODS = new Set('extend merge pick omit partial deepPartial required optional nullable nullish array and or default describe brand catch readonly refine superRefine transform pipe strict passthrough strip min max length regex email url uuid int positive negative nonnegative nonpositive keyof element unwrap meta notNull primaryKey defaultRandom defaultNow references unique $type $defaultFn $onUpdate $onUpdateFn'.split(' '));
+// Set per file by isPure: globals plus names imported from PURE_LIBRARIES.
+let pureRoots = new Set(PURE_GLOBALS);
+const pureArgs = (e) => e.arguments.every((a) => pureExpr(a.type === 'SpreadElement' ? a.argument : a));
+// A call chain like z.object({...}).extend({...}).optional() is pure when it starts at a pure root and every call's
+// arguments are pure.
+function pureChain(e) {
+    switch (e.type) {
+        case 'Identifier':
+            return pureRoots.has(e.name);
+        case 'MemberExpression':
+            return pureChain(e.object) && (!e.computed || pureExpr(e.property));
+        case 'ChainExpression':
+            return pureChain(e.expression);
+        case 'CallExpression':
+        case 'NewExpression':
+            return pureArgs(e) && (pureChain(e.callee) || builderCall(e.callee));
+        default:
+            return false;
+    }
+}
+// OtherSchema.extend({...}).optional(): builder methods on any existing value, ending at a plain identifier.
+function builderCall(callee) {
+    if (callee.type !== 'MemberExpression' || callee.computed || !BUILDER_METHODS.has(callee.property.name))
+        return false;
+    const base = callee.object;
+    if (base.type === 'Identifier')
+        return true;
+    if (base.type === 'MemberExpression')
+        return !base.computed && (base.object.type === 'Identifier' || builderCall(base) || pureChain(base));
+    return (base.type === 'CallExpression' || base.type === 'NewExpression') && pureChain(base);
+}
+function pureClass(c) {
+    if (c.decorators?.length || (c.superClass && !pureExpr(c.superClass)))
+        return false;
+    return c.body.body.every((m) => {
+        if (m.type === 'StaticBlock' || m.decorators?.length)
+            return false;
+        if (m.computed && !pureExpr(m.key))
+            return false;
+        // Static field initializers run at load; instance ones only on `new`.
+        return !(m.static && m.value && m.type !== 'MethodDefinition' && !pureExpr(m.value));
+    });
+}
+export function pureExpr(e) {
+    if (!e)
+        return true;
+    switch (e.type) {
+        case 'Literal':
+        case 'Identifier':
+        case 'ThisExpression':
+        case 'MetaProperty':
+        case 'ArrowFunctionExpression':
+        case 'FunctionExpression':
+        case 'Super':
+            return true;
+        case 'TemplateLiteral':
+            return e.expressions.every(pureExpr);
+        case 'ClassExpression':
+            return pureClass(e);
+        case 'ObjectExpression':
+            return e.properties.every((p) => (p.type === 'SpreadElement' ? pureExpr(p.argument) : (!p.computed || pureExpr(p.key)) && pureExpr(p.value)));
+        case 'ArrayExpression':
+            return e.elements.every((x) => !x || pureExpr(x.type === 'SpreadElement' ? x.argument : x));
+        case 'UnaryExpression':
+            return e.operator !== 'delete' && pureExpr(e.argument);
+        case 'BinaryExpression':
+        case 'LogicalExpression':
+            return pureExpr(e.left) && pureExpr(e.right);
+        case 'ConditionalExpression':
+            return pureExpr(e.test) && pureExpr(e.consequent) && pureExpr(e.alternate);
+        case 'MemberExpression':
+            return pureExpr(e.object) && (!e.computed || pureExpr(e.property));
+        case 'ChainExpression':
+        case 'ParenthesizedExpression':
+        case 'TSAsExpression':
+        case 'TSSatisfiesExpression':
+        case 'TSNonNullExpression':
+        case 'TSTypeAssertion':
+        case 'TSInstantiationExpression':
+            return pureExpr(e.expression);
+        case 'CallExpression':
+        case 'NewExpression':
+            return pureChain(e);
+        case 'TaggedTemplateExpression':
+            // sql`now()` from drizzle-orm
+            return pureChain(e.tag) && e.quasi.expressions.every(pureExpr);
+        default:
+            return false;
+    }
+}
+function pureStatement(s) {
+    switch (s.type) {
+        case 'ImportDeclaration':
+        case 'ExportAllDeclaration':
+        case 'FunctionDeclaration':
+        case 'TSDeclareFunction':
+        case 'TSTypeAliasDeclaration':
+        case 'TSInterfaceDeclaration':
+        case 'TSEnumDeclaration':
+        case 'EmptyStatement':
+            return true;
+        case 'TSModuleDeclaration':
+            return Boolean(s.declare);
+        case 'ClassDeclaration':
+            return pureClass(s);
+        case 'VariableDeclaration':
+            return s.declarations.every((d) => pureExpr(d.init));
+        case 'ExportNamedDeclaration':
+            return !s.declaration || pureStatement(s.declaration);
+        case 'ExportDefaultDeclaration': {
+            const d = s.declaration;
+            return d.type === 'FunctionDeclaration' || d.type === 'TSInterfaceDeclaration' ? true : d.type === 'ClassDeclaration' ? pureClass(d) : pureExpr(d);
+        }
+        case 'TSExportAssignment':
+            return pureExpr(s.expression);
+        case 'ExpressionStatement':
+            // "use strict" and other directives
+            return Boolean(s.directive);
+        default:
+            return false;
+    }
+}
+/** True when the module's top level only defines bindings. */
+export function isPure(program) {
+    pureRoots = new Set(PURE_GLOBALS);
+    for (const s of program.body)
+        if (s.type === 'ImportDeclaration' && PURE_LIBRARIES.test(s.source.value))
+            for (const spec of s.specifiers)
+                pureRoots.add(spec.local.name);
+    return program.body.every(pureStatement);
+}

package/dist/report.js

@@ -0,0 +1,104 @@
+const LABELS = {
+    test: 'test',
+    install: 'install',
+    build: 'build',
+    lint: 'lint & typecheck',
+    setup: 'setup',
+    other: 'other',
+};
+export function summarize(r) {
+    const low = { minutes: r.repeated.minutes + r.affected.minutes, dollars: r.repeated.dollars + r.affected.dollars };
+    const high = { minutes: low.minutes + r.install.minutes, dollars: low.dollars + r.install.dollars };
+    const billable = r.billable;
+    const pct = (a) => (billable.minutes ? (100 * a.minutes) / billable.minutes : 0);
+    const notes = [];
+    if (r.analyzedRuns < r.totalRuns)
+        notes.push(`Sampled ${r.analyzedRuns} of ${r.totalRuns} runs per workflow across the ${r.days} days; each stands in for its workflow's runs around it.`);
+    if (r.analyzedRuns < r.totalRuns)
+        notes.push('Repeated runs of the same commit are only counted when every run is analyzed; re-runs of jobs that already passed still count.');
+    if (r.estimated)
+        notes.push("Some periods passed GitHub's 2,500-run count limit; their run counts are estimated from how closely runs are spaced.");
+    if (!r.isPrivate)
+        notes.push('Public repo: standard runners are free, so dollars are list-price value.');
+    if (r.selfHostedMinutes)
+        notes.push(`${Math.round(r.selfHostedMinutes)} self-hosted minutes are counted in minutes only.`);
+    if (r.shallow)
+        notes.push('This clone is shallow, so past changes cannot be replayed and affected-only savings show as 0. Run `git fetch --unshallow` and scan again.');
+    else if (r.missingCommits)
+        notes.push(`${r.missingCommits} commits could not be fetched (deleted forks or branches), so those runs count as no saving.`);
+    notes.push(`Affected-only tests replayed ${r.affected.replayed} of ${r.affected.codeRuns} push and PR runs against the current import graph (${r.testFiles} test files); runs we could not replay count as no saving.`);
+    notes.push('Dollars use GitHub list prices; larger runners are priced as 2-core.');
+    return {
+        billable,
+        queueMinutes: r.queueMinutes,
+        low,
+        high,
+        lowPct: pct(low),
+        highPct: pct(high),
+        parts: { repeated: r.repeated, affected: r.affected, install: r.install },
+        notes,
+    };
+}
+const min = (n) => `${Math.round(n).toLocaleString('en-US')} min`;
+const usd = (n) => `$${n.toLocaleString('en-US', { minimumFractionDigits: 2, maximumFractionDigits: 2 })}`;
+const both = (a) => `${min(a.minutes)} · ${usd(a.dollars)}`;
+// A range only when the ends differ once rounded; "7–7%" reads like a bug.
+const range = (lo, hi) => (lo === hi ? lo : `${lo}–${hi}`);
+const noRuns = (r) => `${r.repo} had no completed workflow runs in the last ${r.days} days. Try --days 90.`;
+function breakdown(r) {
+    const total = Object.values(r.categories).reduce((a, b) => a + b, 0) || 1;
+    return Object.entries(r.categories)
+        .sort((a, b) => b[1] - a[1])
+        .filter(([, v]) => v > 0)
+        .map(([k, v]) => ({ label: LABELS[k], share: (100 * v) / total }));
+}
+export function text(r) {
+    if (!r.analyzedRuns)
+        return noRuns(r);
+    const s = summarize(r);
+    const rows = breakdown(r).map(({ label, share }) => `  ${label.padEnd(17)}${share.toFixed(0).padStart(3)}%  ${'█'.repeat(Math.round(share / 4))}`);
+    return [
+        '',
+        `${r.repo} · last ${r.days} days · ${r.totalRuns} runs`,
+        `CI time: ${both(s.billable)}   (plus ${min(s.queueMinutes)} waiting in queue)`,
+        '',
+        'Where the time goes',
+        ...rows,
+        '',
+        `Estimated savings with ci-sdk: ${range(s.lowPct.toFixed(0), s.highPct.toFixed(0))}%  (${range(min(s.low.minutes), min(s.high.minutes))}, ${range(usd(s.low.dollars), usd(s.high.dollars))} per ${r.days} days)`,
+        `  repeated work        ${both(s.parts.repeated)}   same commit run again`,
+        `  affected-only tests  ${both(s.parts.affected)}   tests the change could not reach`,
+        `  install cache        ${both(s.parts.install)}   installs slower than your fastest 10%`,
+        '',
+        ...s.notes.map((n) => `  · ${n}`),
+        '',
+    ].join('\n');
+}
+export function markdown(r) {
+    if (!r.analyzedRuns)
+        return noRuns(r);
+    const s = summarize(r);
+    return [
+        `### CI scan: ${r.repo} (last ${r.days} days)`,
+        '',
+        `**${r.totalRuns} runs · ${both(s.billable)}** · estimated savings with ci-sdk: **${range(s.lowPct.toFixed(0), s.highPct.toFixed(0))}%** (${range(usd(s.low.dollars), usd(s.high.dollars))})`,
+        '',
+        '| Where the time goes | Share |',
+        '| --- | --- |',
+        ...breakdown(r).map(({ label, share }) => `| ${label} | ${share.toFixed(0)}% |`),
+        '',
+        '| Saving | Minutes · dollars |',
+        '| --- | --- |',
+        `| Repeated work | ${both(s.parts.repeated)} |`,
+        `| Affected-only tests | ${both(s.parts.affected)} |`,
+        `| Install cache | ${both(s.parts.install)} |`,
+        '',
+        ...s.notes.map((n) => `- ${n}`),
+        '',
+        '_Generated by `npx ci-sdk scan`. Runs locally; no data leaves your machine._',
+        '',
+    ].join('\n');
+}
+export function json(r) {
+    return JSON.stringify({ ...r, summary: summarize(r) }, null, 2);
+}