ci-sdk 0.0.1 → 0.0.3

package/dist/run.js

@@ -0,0 +1,257 @@
+import { execFileSync, spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { cpSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, readlinkSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { availableParallelism } from 'node:os';
+import { delimiter, dirname, join } from 'node:path';
+import { glob } from 'tinyglobby';
+import { pnpmLockKeys } from './lockfile.js';
+import { packageManager, readJson, repoRoot, runScript } from './test.js';
+// Bump when the key recipe changes, so old entries can never hit.
+const VERSION = '2';
+const gitZ = (root, args) => execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1 << 28 }).split('\0').filter(Boolean);
+/** Workspace packages from pnpm-workspace.yaml or package.json `workspaces`; a repo without either is one package. */
+export async function workspace(root, scriptName) {
+    const rootPkg = readJson(join(root, 'package.json')) ?? {};
+    let patterns = Array.isArray(rootPkg.workspaces) ? rootPkg.workspaces : (rootPkg.workspaces?.packages ?? []);
+    const yaml = existsSync(join(root, 'pnpm-workspace.yaml')) ? readFileSync(join(root, 'pnpm-workspace.yaml'), 'utf8') : '';
+    // shortcut: reads only the `packages:` list of pnpm-workspace.yaml; use a YAML parser if repos put it in flow style.
+    const block = yaml.match(/^packages:\s*\n((?:\s+-.*\n?|\s*#.*\n?|\s*\n)*)/m)?.[1] ?? '';
+    patterns = [...patterns, ...[...block.matchAll(/^\s+-\s*['"]?([^'"#\n]+?)['"]?\s*$/gm)].map((m) => m[1])];
+    const manifests = patterns.length
+        ? await glob(patterns.filter((p) => !p.startsWith('!')).map((p) => `${p.replace(/\/$/, '')}/package.json`), { cwd: root, ignore: ['**/node_modules/**', ...patterns.filter((p) => p.startsWith('!')).map((p) => p.slice(1))] })
+        : [];
+    const dirs = manifests.length ? manifests.map((m) => m.slice(0, -'package.json'.length)) : [''];
+    const pkgs = dirs.map((dir) => ({ dir, json: readJson(join(root, dir, 'package.json')) ?? {} }));
+    const names = new Set(pkgs.map((p) => p.json.name).filter(Boolean));
+    return pkgs.map(({ dir, json }) => ({
+        dir,
+        name: json.name ?? (dir || '(root)'),
+        script: json.scripts?.[scriptName],
+        deps: Object.keys({ ...json.dependencies, ...json.devDependencies, ...json.peerDependencies, ...json.optionalDependencies }).filter((d) => names.has(d)),
+    }));
+}
+const sha = (...parts) => {
+    const h = createHash('sha256');
+    for (const p of parts)
+        h.update(p).update('\0');
+    return h.digest('hex');
+};
+// Files outside every package that no package script reads: docs, changelogs, licenses, CI and editor config.
+// Without this, a CHANGELOG or docs edit reruns everything. A package's own README or LICENSE still counts, since it is
+// inside the package. shortcut: a build that copies a root README/LICENSE into its output will not rerun when that file changes.
+const READ_BY_NO_SCRIPT = /(^|\/)(LICEN[CS]E[^/]*|[^/]+\.mdx?)$|^\.(github|changeset|vscode|idea)\//i;
+// Release notes no build reads, even inside a package (other markdown there counts: docs packages build from it).
+const RELEASE_NOTES = /(^|\/)(CHANGELOG[^/]*\.mdx?|\.changeset\/.+|\.changes\/.+)$/i;
+/**
+ * One key per package: its own files, every file outside all packages (root configs, scripts), its dependency tree from
+ * the lockfile, and the keys of the workspace packages it depends on. Conservative on purpose: a root config change reruns everything.
+ */
+export function inputKeys(root, pkgs, salt) {
+    const files = gitZ(root, ['ls-files', '-z', '--cached', '--others', '--exclude-standard']);
+    const deleted = new Set(gitZ(root, ['ls-files', '-z', '--deleted']));
+    const present = files.filter((f) => !deleted.has(f));
+    // git hash-object fails on symlinks to folders and on submodule folders, so hash those by their link target or kind.
+    const hashes = new Map();
+    const regular = [];
+    for (const f of present) {
+        const s = lstatSync(join(root, f), { throwIfNoEntry: false });
+        if (s?.isFile())
+            regular.push(f);
+        else
+            hashes.set(f, s?.isSymbolicLink() ? `link:${readlinkSync(join(root, f))}` : s ? 'dir' : 'missing');
+    }
+    if (regular.length) {
+        const out = execFileSync('git', ['hash-object', '--stdin-paths'], { cwd: root, input: regular.join('\n'), encoding: 'utf8', maxBuffer: 1 << 28 }).trim().split('\n');
+        regular.forEach((f, i) => hashes.set(f, out[i]));
+    }
+    // Deepest folder first, so a nested package owns its files.
+    const owners = pkgs.filter((p) => p.dir).sort((a, b) => b.dir.length - a.dir.length);
+    const own = new Map(pkgs.map((p) => [p.dir, []]));
+    const outside = [];
+    // pnpm: key each package on its own dependency tree instead of the whole lockfile, so a lockfile change reruns only
+    // packages whose dependencies changed. Root dependencies count for every package, since package scripts use them.
+    const lock = present.includes('pnpm-lock.yaml') ? pnpmLockKeys(readFileSync(join(root, 'pnpm-lock.yaml'), 'utf8')) : undefined;
+    const treeOf = (dir) => [lock?.byImporter.get('.') ?? '', lock?.byImporter.get(dir.replace(/\/$/, '') || '.') ?? ''];
+    present.forEach((f) => {
+        if (RELEASE_NOTES.test(f) || (lock && f === 'pnpm-lock.yaml'))
+            return;
+        const entry = `${f}:${hashes.get(f)}`;
+        const owner = owners.find((p) => f.startsWith(p.dir));
+        if (owner)
+            own.get(owner.dir).push(entry);
+        else if (!READ_BY_NO_SCRIPT.test(f))
+            outside.push(entry);
+    });
+    if (own.has(''))
+        own.get('').push(...outside);
+    const shared = sha(...outside, lock?.shared ?? '');
+    const byName = new Map(pkgs.map((p) => [p.name, p]));
+    const keys = new Map();
+    const keyOf = (p, seen) => {
+        if (keys.has(p.dir))
+            return keys.get(p.dir);
+        if (seen.has(p.dir))
+            return 'cycle'; // dependency cycles: each member still hashes its own files
+        seen.add(p.dir);
+        const key = sha(VERSION, salt, shared, ...treeOf(p.dir), ...own.get(p.dir), ...p.deps.sort().map((d) => keyOf(byName.get(d), seen)));
+        keys.set(p.dir, key);
+        return key;
+    };
+    for (const p of pkgs)
+        keyOf(p, new Set());
+    return keys;
+}
+/** Files under `dir` that git does not track (outputs live there), with size and mtime; node_modules excluded. */
+function untracked(root, dir) {
+    const files = gitZ(root, ['ls-files', '-z', '--others', '--', dir || '.', ':(exclude,glob)**/node_modules/**']);
+    const stamp = new Map();
+    for (const f of files) {
+        try {
+            const s = statSync(join(root, f));
+            stamp.set(f, `${s.size}:${s.mtimeMs}`);
+        }
+        catch {
+            // vanished while listing
+        }
+    }
+    return stamp;
+}
+/**
+ * Runs the script with sh the way npm and pnpm do, skipping a package-manager launch (~0.35s per package, which adds up
+ * along a dependency chain). Falls back to `<pm> run` where that isn't equivalent: yarn (PnP), bun, Windows, pre/post scripts.
+ */
+export function scriptCommand(pm, root, dir, script) {
+    const json = readJson(join(root, dir, 'package.json')) ?? {};
+    const body = json.scripts?.[script];
+    if (!body || (pm !== 'npm' && pm !== 'pnpm') || process.platform === 'win32' || json.scripts?.[`pre${script}`] || json.scripts?.[`post${script}`])
+        return [...runScript(pm, script, []), process.env];
+    const bins = [];
+    for (let d = join(root, dir);; d = dirname(d)) {
+        bins.push(join(d, 'node_modules/.bin'));
+        if (d === root || d === dirname(d))
+            break;
+    }
+    const env = {
+        ...process.env,
+        PATH: [...bins, process.env.PATH].join(delimiter),
+        npm_lifecycle_event: script,
+        npm_lifecycle_script: body,
+        npm_package_name: json.name,
+        npm_package_version: json.version,
+        npm_package_json: join(root, dir, 'package.json'),
+        // Tools such as wireit pick the package manager to spawn from this prefix.
+        npm_config_user_agent: process.env.npm_config_user_agent?.startsWith(`${pm}/`) ? process.env.npm_config_user_agent : `${pm}/unknown node/${process.version} ${process.platform} ${process.arch}`,
+        INIT_CWD: process.env.INIT_CWD ?? process.cwd(),
+    };
+    return ['sh', ['-c', body], env];
+}
+/** Runs a package script in every workspace package (dependencies first), skipping packages whose inputs already passed. */
+export async function runCached(o) {
+    const root = repoRoot(o.cwd);
+    const pm = packageManager(root);
+    const all = await workspace(root, o.script);
+    const allowed = o.filter?.length ? new Set((await glob(o.filter.map((f) => `${f.replace(/\/$/, '')}/package.json`), { cwd: root, ignore: ['**/node_modules/**'] })).map((m) => m.slice(0, -'package.json'.length))) : undefined;
+    const todo = all.filter((p) => p.script && (!allowed || allowed.has(p.dir)));
+    if (!todo.length) {
+        o.log(`No package has a "${o.script}" script.`);
+        return 0;
+    }
+    const node = process.version;
+    const keys = inputKeys(root, all, [o.script, node, process.platform, process.arch].join('|'));
+    // One folder per script, so pruning after `run build` never touches the entries of `run test`.
+    const cache = join(o.cacheDir ?? join(root, 'node_modules/.cache/ci-sdk'), encodeURIComponent(o.script));
+    const used = new Set();
+    const byName = new Map(all.map((p) => [p.name, p]));
+    const waitingOn = new Map(todo.map((p) => [p.dir, new Set(p.deps.map((d) => byName.get(d).dir).filter((d) => todo.some((t) => t.dir === d && d !== p.dir)))]));
+    const done = new Set();
+    const failed = [];
+    const failedDirs = new Set();
+    let hits = 0;
+    const started = Date.now();
+    const runOne = async (p) => {
+        const key = sha(keys.get(p.dir), p.script);
+        const dir = join(cache, key.slice(0, 2), key);
+        const meta = join(dir, 'meta.json');
+        used.add(join(key.slice(0, 2), key));
+        if (!o.noCache && existsSync(meta)) {
+            const entry = JSON.parse(readFileSync(meta, 'utf8'));
+            for (const f of entry.outputs) {
+                mkdirSync(dirname(join(root, f)), { recursive: true });
+                cpSync(join(dir, 'out', f), join(root, f));
+            }
+            hits++;
+            o.log(`${p.name}: cache hit, ${entry.outputs.length} outputs restored (saved ${(entry.ms / 1000).toFixed(1)}s)`);
+            process.stdout.write(entry.log);
+            return;
+        }
+        const before = untracked(root, p.dir);
+        const t = Date.now();
+        const [cmd, args, env] = scriptCommand(pm, root, p.dir, o.script);
+        let log = '';
+        const code = await new Promise((resolve) => {
+            const child = spawn(cmd, args, { cwd: join(root, p.dir), env, stdio: ['ignore', 'pipe', 'pipe'] });
+            child.stdout.on('data', (d) => (log += d));
+            child.stderr.on('data', (d) => (log += d));
+            child.on('close', (c) => resolve(c ?? 1));
+        });
+        const ms = Date.now() - t;
+        o.log(`${p.name}: ran in ${(ms / 1000).toFixed(1)}s${code ? `, failed with exit code ${code}` : ''}`);
+        process.stdout.write(log);
+        if (code) {
+            failed.push(p.name);
+            failedDirs.add(p.dir);
+            return;
+        }
+        // Outputs are whatever the script created or changed outside git, inferred with no config.
+        const outputs = [...untracked(root, p.dir)].filter(([f, s]) => before.get(f) !== s).map(([f]) => f);
+        const tmp = `${dir}.tmp-${process.pid}`;
+        rmSync(tmp, { recursive: true, force: true });
+        for (const f of outputs) {
+            mkdirSync(dirname(join(tmp, 'out', f)), { recursive: true });
+            cpSync(join(root, f), join(tmp, 'out', f));
+        }
+        mkdirSync(tmp, { recursive: true });
+        writeFileSync(join(tmp, 'meta.json'), JSON.stringify({ log, outputs, ms }));
+        rmSync(dir, { recursive: true, force: true });
+        mkdirSync(dirname(dir), { recursive: true });
+        renameSync(tmp, dir); // atomic: a half-written entry is never read
+    };
+    // Dependencies first, up to `concurrency` packages at a time, like `pnpm -r`.
+    const limit = o.concurrency ?? Math.max(1, Math.min(4, availableParallelism()));
+    const running = new Map();
+    while (done.size < todo.length) {
+        const blocked = (p) => [...waitingOn.get(p.dir)].some((d) => !done.has(d));
+        for (const p of todo) {
+            if (running.size >= limit)
+                break;
+            if (done.has(p.dir) || running.has(p.dir) || blocked(p))
+                continue;
+            if ([...waitingOn.get(p.dir)].some((d) => failedDirs.has(d))) {
+                o.log(`${p.name}: skipped, a dependency failed`);
+                failed.push(p.name);
+                failedDirs.add(p.dir);
+                done.add(p.dir);
+                continue;
+            }
+            running.set(p.dir, runOne(p).then(() => void done.add(p.dir), () => void (failed.push(p.name), failedDirs.add(p.dir), done.add(p.dir))));
+        }
+        if (!running.size) {
+            // A dependency cycle: run the rest in order rather than hang.
+            for (const p of todo.filter((p) => !done.has(p.dir)))
+                waitingOn.set(p.dir, new Set());
+            continue;
+        }
+        await Promise.race(running.values());
+        for (const d of [...running.keys()])
+            if (done.has(d))
+                running.delete(d);
+    }
+    if (o.prune ?? Boolean(process.env.CI)) {
+        for (const shard of existsSync(cache) ? readdirSync(cache) : [])
+            for (const entry of readdirSync(join(cache, shard)))
+                if (!used.has(join(shard, entry)))
+                    rmSync(join(cache, shard, entry), { recursive: true, force: true });
+    }
+    o.log(`${o.script}: ${todo.length} packages, ${hits} from cache, ${failed.length} failed, ${((Date.now() - started) / 1000).toFixed(1)}s`);
+    return failed.length ? 1 : 0;
+}

package/dist/scan.js

@@ -0,0 +1,157 @@
+import { execFileSync } from 'node:child_process';
+import { categorize, ratePerMinute } from './classify.js';
+import { getRepo, listJobs, listRuns, pool } from './github.js';
+import { affectedTests, buildGraph } from './graph.js';
+const ms = (a, b) => (a && b ? Math.max(0, Date.parse(b) - Date.parse(a)) : 0);
+const add = (x, minutes, rate) => {
+    x.minutes += minutes;
+    x.dollars += minutes * (rate ?? 0);
+};
+/** Pure estimate over fetched runs; `scan` handles I/O. */
+export function estimate(data, graph) {
+    const e = {
+        billable: { minutes: 0, dollars: 0 },
+        selfHostedMinutes: 0,
+        queueMinutes: 0,
+        categories: { setup: 0, install: 0, build: 0, lint: 0, test: 0, other: 0 },
+        repeated: { minutes: 0, dollars: 0 },
+        affected: { minutes: 0, dollars: 0, replayed: 0, codeRuns: 0 },
+        install: { minutes: 0, dollars: 0 },
+    };
+    const installs = data.flatMap((d) => d.jobs.flatMap((j) => (j.steps ?? []).map((s) => ms(s.started_at, s.completed_at)).filter((d, i) => categorize(j.steps[i].name, d) === 'install')));
+    const fastInstall = installs.sort((a, b) => a - b)[Math.floor(installs.length * 0.1)] ?? 0;
+    const seenRuns = new Set();
+    const ordered = [...data].sort((a, b) => Date.parse(a.run.created_at) - Date.parse(b.run.created_at));
+    for (const { run, jobs, changed, weight = 1 } of ordered) {
+        // Only code runs repeat cacheable work; comment, schedule and bot runs all sit on the default branch's head.
+        const isCode = run.event === 'push' || run.event === 'pull_request';
+        const key = `${run.workflow_id}:${run.event}:${run.head_sha}`;
+        // A sampled run stands for many, and spotting a repeat needs both runs in the sample: one lucky pair would swing
+        // the estimate by thousands of minutes. Only count repeats when every run is present (weight 1).
+        const repeatRun = isCode && weight === 1 && seenRuns.has(key);
+        seenRuns.add(key);
+        const affected = !repeatRun && changed && graph && graph.tests.size ? affectedTests(graph, changed) : undefined;
+        const skipShare = affected === undefined || affected === 'all' ? 0 : Math.max(0, 1 - affected.size / graph.tests.size);
+        if (affected !== undefined)
+            e.affected.replayed++;
+        if (isCode)
+            e.affected.codeRuns++;
+        const passedBefore = new Set();
+        for (const job of [...jobs].sort((a, b) => a.run_attempt - b.run_attempt)) {
+            const rate = ratePerMinute(job.labels);
+            const minutes = (weight * ms(job.started_at, job.completed_at)) / 60000;
+            const billable = weight * Math.ceil(minutes / weight);
+            add(e.billable, billable, rate);
+            if (rate === null)
+                e.selfHostedMinutes += billable;
+            e.queueMinutes += (weight * ms(job.created_at, job.started_at)) / 60000;
+            let testMs = 0;
+            let extraInstallMs = 0;
+            for (const step of job.steps ?? []) {
+                const d = ms(step.started_at, step.completed_at);
+                const cat = categorize(step.name, d);
+                e.categories[cat] += (weight * d) / 60000;
+                if (cat === 'test')
+                    testMs += d;
+                if (cat === 'install')
+                    extraInstallMs += Math.max(0, d - fastInstall);
+            }
+            // A repeated run, or a re-run of a job that already passed on the same commit, is a full cache hit.
+            if (repeatRun || passedBefore.has(job.name)) {
+                add(e.repeated, minutes, rate);
+                continue;
+            }
+            if (job.conclusion === 'success')
+                passedBefore.add(job.name);
+            add(e.affected, (weight * testMs * skipShare) / 60000, rate);
+            add(e.install, (weight * extraInstallMs) / 60000, rate);
+        }
+    }
+    return e;
+}
+const git = (root, args, input) => execFileSync('git', args, { cwd: root, encoding: 'utf8', input, stdio: [input === undefined ? 'ignore' : 'pipe', 'pipe', 'ignore'], maxBuffer: 1 << 26 });
+const isShallow = (root) => {
+    try {
+        return git(root, ['rev-parse', '--is-shallow-repository']).trim() === 'true';
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Commits the replay needs but this clone lacks (fork PRs, deleted branches), fetched by SHA: objects only, no refs.
+ * Returns how many are still missing.
+ */
+function fetchMissing(root, shas, log) {
+    const wanted = [...new Set(shas)];
+    const missing = () => git(root, ['cat-file', '--batch-check'], wanted.map((s) => `${s}^{commit}`).join('\n') + '\n')
+        .split('\n')
+        .filter((l) => l.endsWith(' missing'))
+        .map((l) => l.slice(0, 40));
+    const fetch = (list) => {
+        try {
+            git(root, ['fetch', '--quiet', '--no-tags', '--no-write-fetch-head', 'origin', ...list]);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    let todo = missing();
+    if (!todo.length)
+        return 0;
+    log(`Fetching ${todo.length} commits this clone lacks…`);
+    for (let i = 0; i < todo.length; i += 200) {
+        const chunk = todo.slice(i, i + 200);
+        // One unknown SHA fails the whole batch, so retry those one by one.
+        if (!fetch(chunk))
+            for (const sha of chunk.slice(0, 100))
+                fetch([sha]);
+    }
+    todo = missing();
+    return todo.length;
+}
+function changedFiles(root, base, head) {
+    try {
+        const out = execFileSync('git', ['diff', '--name-only', `${base}...${head}`], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+        return out.split('\n').filter(Boolean);
+    }
+    catch {
+        return undefined; // commit not in the local clone
+    }
+}
+/** What each run tested: the PR diff against its base, or a push diffed against the previous push run on that branch. */
+function attachChanges(root, data, defaultBranch) {
+    const ordered = [...data].sort((a, b) => Date.parse(a.run.created_at) - Date.parse(b.run.created_at));
+    const lastPush = new Map();
+    for (const d of ordered) {
+        const { run } = d;
+        if (run.event === 'pull_request') {
+            // Fork PRs come without pull_requests; their merge-base with the default branch gives the same diff.
+            d.changed = changedFiles(root, run.pull_requests[0]?.base.sha ?? `origin/${defaultBranch}`, run.head_sha);
+        }
+        else if (run.event === 'push') {
+            const branch = `${run.workflow_id}:${run.head_branch}`;
+            const prev = lastPush.get(branch);
+            if (prev && prev !== run.head_sha)
+                d.changed = changedFiles(root, prev, run.head_sha);
+            lastPush.set(branch, run.head_sha);
+        }
+    }
+}
+export async function scan(o) {
+    const since = new Date(Date.now() - o.days * 864e5);
+    const info = await getRepo(o.repo, o.token);
+    o.log(`Fetching workflow runs for ${info.full_name} since ${since.toISOString().slice(0, 10)}…`);
+    const { runs, total, estimated } = await listRuns(o.repo, o.token, since, o.maxRuns);
+    o.log(`Fetching jobs for ${runs.length} runs sampled from ${total}…`);
+    const data = await pool(runs, 8, async ({ run, weight }) => ({ run, weight, jobs: await listJobs(o.repo, run.id, o.token) }));
+    o.log('Building import graph with oxc…');
+    const graph = await buildGraph(o.root);
+    const shallow = isShallow(o.root);
+    const code = data.filter((d) => d.run.event === 'push' || d.run.event === 'pull_request');
+    const missingCommits = shallow ? 0 : fetchMissing(o.root, code.flatMap((d) => [d.run.head_sha, ...d.run.pull_requests.map((p) => p.base.sha)]), o.log);
+    attachChanges(o.root, data, info.default_branch);
+    const e = estimate(data, graph);
+    return { repo: info.full_name, isPrivate: info.private, days: o.days, totalRuns: total, estimated, analyzedRuns: runs.length, testFiles: graph.tests.size, shallow, missingCommits, ...e };
+}

package/dist/test.js

@@ -0,0 +1,112 @@
+import { execFileSync, spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { affectedTests, buildGraph } from './graph.js';
+const git = (root, args) => execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1 << 26 });
+const lines = (s) => s.split('\n').filter(Boolean);
+export const repoRoot = (cwd) => git(cwd, ['rev-parse', '--show-toplevel']).trim();
+/** Files changed since `since` (committed on this branch), plus uncommitted and untracked changes. */
+export function changedFiles(root, since = 'HEAD') {
+    const committed = since === 'HEAD' ? [] : lines(git(root, ['diff', '--name-only', `${since}...HEAD`]));
+    return [...new Set([...committed, ...lines(git(root, ['diff', '--name-only', 'HEAD'])), ...lines(git(root, ['ls-files', '--others', '--exclude-standard']))])];
+}
+export const packageManager = (root) => existsSync(join(root, 'pnpm-lock.yaml')) ? 'pnpm' : existsSync(join(root, 'yarn.lock')) ? 'yarn' : existsSync(join(root, 'bun.lock')) || existsSync(join(root, 'bun.lockb')) ? 'bun' : 'npm';
+// How each package manager appends extra arguments to a package script.
+export const runScript = (pm, script, args) => (pm === 'npm' ? ['npm', ['run', script, '--', ...args]] : [pm, ['run', script, ...args]]);
+export const readJson = (file) => {
+    try {
+        return JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+};
+// A script that fans out to every package (turbo, nx, lerna, pnpm -r) can't be narrowed to files.
+const FANS_OUT = /\b(turbo|nx|lerna)\b|\s-r\b|--recursive|--workspaces?\b/;
+// File paths appended to a chained script reach only its last command.
+const CHAINED = /&&|\|\||;/;
+const takesFiles = (script) => Boolean(script) && !FANS_OUT.test(script) && !CHAINED.test(script);
+/** Affected test files grouped by the workspace package that owns them; each group runs through its own script, else the root's. */
+export function plan(root, graph, tests, script = 'test') {
+    const byDir = new Map();
+    for (const t of tests) {
+        const dir = graph.packages.find((p) => t.startsWith(p)) ?? '';
+        (byDir.get(dir) ?? byDir.set(dir, []).get(dir)).push(t.slice(dir.length));
+    }
+    const rootTakesFiles = takesFiles(readJson(join(root, 'package.json'))?.scripts?.[script]);
+    return [...byDir]
+        .map(([dir, files]) => {
+        const pkg = readJson(join(root, dir, 'package.json'));
+        const via = dir && takesFiles(pkg?.scripts?.[script]) ? 'package' : rootTakesFiles ? 'root' : undefined;
+        return { dir, name: pkg?.name ?? (dir || '(root)'), files: files.sort(), via };
+    })
+        .sort((a, b) => a.name.localeCompare(b.name));
+}
+/** Turbo repos whose test task depends on ^build test against built dependencies, so rebuild those first (cached when unchanged). */
+function buildCommand(root, pm, runs) {
+    const deps = readJson(join(root, 'turbo.json'))?.tasks?.test?.dependsOn ?? [];
+    if (!deps.includes('^build'))
+        return undefined;
+    const filters = runs.filter((r) => r.dir).map((r) => `--filter=${r.name}^...`);
+    if (!filters.length)
+        return undefined;
+    return pm === 'npm' ? ['npx', ['turbo', 'run', 'build', ...filters]] : [pm, ['exec', 'turbo', 'run', 'build', ...filters]];
+}
+/** Runs only the tests a change can reach. Returns the process exit code. */
+export async function testAffected(o) {
+    const root = repoRoot(o.cwd);
+    const changed = changedFiles(root, o.since);
+    if (!changed.length) {
+        o.log(`No changes since ${o.since ?? 'HEAD'}; nothing to test.`);
+        return 0;
+    }
+    const graph = await buildGraph(root);
+    const affected = affectedTests(graph, changed);
+    const pm = packageManager(root);
+    const exec = ([cmd, args], cwd) => {
+        o.log(`$ ${cmd} ${args.join(' ')}${cwd === root ? '' : `   (in ${cwd.slice(root.length + 1)})`}`);
+        return spawnSync(cmd, args, { cwd, stdio: 'inherit' }).status ?? 1;
+    };
+    if (affected === 'all') {
+        const why = changed.filter((f) => affectedTests(graph, [f]) === 'all');
+        o.log(`${changed.length} changed files; ${why.slice(0, 3).join(', ')} can affect every test, so running the full suite.`);
+        if (o.list) {
+            for (const t of [...graph.tests].sort())
+                console.log(t);
+            return 0;
+        }
+        return exec(runScript(pm, o.script ?? 'test', []), root);
+    }
+    const script = o.script ?? 'test';
+    const runs = plan(root, graph, affected, script);
+    o.log(`${changed.length} changed files → ${affected.size} of ${graph.tests.size} test files in ${runs.length} packages`);
+    if (o.list) {
+        for (const t of [...affected].sort())
+            console.log(t);
+        return 0;
+    }
+    if (!affected.size)
+        return 0;
+    const build = buildCommand(root, pm, runs);
+    if (build && exec(build, root) !== 0) {
+        o.log('Building dependencies failed; not running tests.');
+        return 1;
+    }
+    // Never report success for tests that did not run.
+    const stranded = runs.filter((r) => !r.via);
+    if (stranded.length) {
+        for (const r of stranded)
+            o.log(`${r.name}: no "${script}" script here or at the root that accepts file paths, so ${r.files.length} affected test files can't run: ${r.files.slice(0, 3).join(', ')}`);
+        o.log(`Not running a partial suite. Pass --script <name> for a script that takes test files, or run the full suite.`);
+        return 1;
+    }
+    let failed = 0;
+    for (const r of runs.filter((r) => r.via === 'package'))
+        if (exec(runScript(pm, script, r.files), join(root, r.dir)) !== 0)
+            failed++;
+    const viaRoot = runs.filter((r) => r.via === 'root').flatMap((r) => r.files.map((f) => r.dir + f));
+    if (viaRoot.length && exec(runScript(pm, script, viaRoot), root) !== 0)
+        failed++;
+    o.log(failed ? 'Some affected tests failed.' : `All affected tests passed (${affected.size} of ${graph.tests.size} test files).`);
+    return failed ? 1 : 0;
+}

package/package.json

@@ -1,7 +1,37 @@
 {
   "name": "ci-sdk",
-  "version": "0.0.1",
-  "description": "Placeholder — coming soon.",
+  "version": "0.0.3",
+  "description": "Insanely fast CI. No migration. By Diffling.",
   "license": "MIT",
-  "files": ["README.md"]
+  "type": "module",
+  "homepage": "https://ci-sdk.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jaymalve/ci-sdk.git"
+  },
+  "bin": {
+    "ci-sdk": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22.18"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "node --test test/*.test.ts",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "dependencies": {
+    "oxc-parser": "^0.156.0",
+    "oxc-resolver": "^11.24.2",
+    "tinyglobby": "^0.2.17"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.6",
+    "typescript": "^7.0.2"
+  }
 }