inup 1.5.6 → 1.6.2

package/README.md

@@ -49,9 +49,38 @@ inup [options]
 -i, --ignore <packages>       Ignore packages (comma-separated, glob supported)
 --max-depth <number>          Maximum scan depth for package discovery (default: 10)
 --package-manager <name>      Force package manager (npm, yarn, pnpm, bun)
+--json                        Print a machine-readable JSON report and exit (read-only)
+-c, --check                   Exit non-zero if updates exist, without writing (for CI)
 --debug                       Write verbose debug logs
 ```
 
+## CI & Scripting
+
+`inup` runs headless automatically when stdout isn't a TTY or `$CI` is set, so it never hangs in a
+pipeline waiting on the interactive UI. Both `--json` and `--check` are **read-only** — they report,
+they never edit `package.json` or install.
+
+```bash
+inup --check            # exit 1 if anything is outdated → fails the build
+inup --json | jq        # structured drift report for dashboards/bots
+inup | cat              # plain line-based report when piped to a log
+```
+
+Each reported package carries its health signals: `deprecated` (npm deprecation message), `enginesNode`
+(declared `engines.node`), and `vulnerability` (known advisories on the currently-installed version,
+from one bulk `npm audit`-style request). Every advisory is **cross-referenced against the upgrade
+targets**, so you know whether the upgrade actually fixes it:
+
+- `vulnerability.advisories[].fixedByRange` / `fixedByLatest` — does the in-range / latest target escape
+  this advisory's affected range?
+- `vulnerability.fixedByRange` / `fixedByLatest` — does the target clear **every** advisory?
+
+The summary includes a `vulnerable` count, and the payload carries a `schemaVersion` so scripts and
+agents can pin to a known shape.
+
+Output hygiene: with `--json`, stdout carries **only** the JSON document; all progress and warnings go
+to stderr. Exit codes: `0` up to date, `1` updates exist (`--check`), `2` error.
+
 ## Keyboard Shortcuts
 
 <!-- KEYS:START -->
@@ -83,7 +112,7 @@ inup [options]
 
 ## Privacy
 
-No tracking, no telemetry, no data collection. Package metadata is fetched directly from the npm registry. Download counts come from the npm downloads API. When needed for exact-version manifests, inup may fetch a pinned `package.json` from jsDelivr.
+No tracking, no telemetry, no data collection. Package metadata is fetched directly from the npm registry. Download counts come from the npm downloads API. Changelog and release notes are fetched from GitHub.
 
 ## License
 

package/dist/cli.js

@@ -9,23 +9,36 @@ const commander_1 = require("commander");
 const chalk_1 = __importDefault(require("chalk"));
 const path_1 = require("path");
 const index_1 = require("./index");
+const headless_1 = require("./features/headless");
 const services_1 = require("./services");
 const config_1 = require("./config");
 const utils_1 = require("./utils");
 const git_1 = require("./utils/git");
 const ui_1 = require("./ui");
+// Load developer-only toggles from <inup-repo>/.env.local before anything reads
+// env. Best-effort, gitignored, never overrides real env. Lets perf/debug be
+// "set once" across every project without shell config.
+(0, utils_1.loadInupLocalEnv)();
 const program = new commander_1.Command();
 async function runCli(options) {
+    // Resolve colored-output intent before anything renders.
+    (0, utils_1.applyColorSetting)(options.color);
     const cwd = (0, path_1.resolve)(options.dir);
     if (options.debug || process.env.INUP_DEBUG === '1') {
         (0, utils_1.enableDebugLogging)();
     }
-    const gitState = (0, git_1.getGitWorkingTreeState)(cwd);
-    if (gitState.isRepo && gitState.isDirty) {
-        const shouldProceed = await ui_1.TerminalInput.promptForImmediateConfirmation(`${chalk_1.default.yellow('Warning:')} dirty working tree. Proceed anyway? ${chalk_1.default.dim('[y/N]')} `, false);
-        if (!shouldProceed) {
-            console.log(chalk_1.default.yellow('Upgrade cancelled.'));
-            return;
+    // Headless when piped, in CI, or when a non-interactive flag is set. The TUI only renders in
+    // interactive mode; everything else routes through the read-only headless report path.
+    const interactive = !!process.stdout.isTTY && !process.env.CI && !options.json && !options.check;
+    // The dirty-tree prompt would hang without a TTY; headless is read-only anyway, so skip it.
+    if (interactive) {
+        const gitState = (0, git_1.getGitWorkingTreeState)(cwd);
+        if (gitState.isRepo && gitState.isDirty) {
+            const shouldProceed = await ui_1.TerminalInput.promptForImmediateConfirmation(`${chalk_1.default.yellow('Warning:')} dirty working tree. Proceed anyway? ${chalk_1.default.dim('[y/N]')} `, false);
+            if (!shouldProceed) {
+                console.log(chalk_1.default.yellow('Upgrade cancelled.'));
+                return;
+            }
         }
     }
     // Load project config from .inuprc
@@ -52,8 +65,11 @@ async function runCli(options) {
         console.error(chalk_1.default.yellow('Expected a non-negative integer, for example: --max-depth 10'));
         process.exit(1);
     }
-    // Check for updates in the background (non-blocking)
-    const updateCheckPromise = (0, services_1.checkForUpdateAsync)(config_1.PACKAGE_NAME, config_1.PACKAGE_VERSION);
+    // Check for updates in the background (non-blocking). Interactive only — keeps headless stdout
+    // clean and avoids a lingering fetch handle in CI.
+    const updateCheckPromise = interactive
+        ? (0, services_1.checkForUpdateAsync)(config_1.PACKAGE_NAME, config_1.PACKAGE_VERSION)
+        : undefined;
     // Validate package manager if provided
     let packageManager;
     if (options.packageManager) {
@@ -65,17 +81,28 @@ async function runCli(options) {
         }
         packageManager = options.packageManager;
     }
-    const upgrader = new index_1.UpgradeRunner({
+    const runnerOptions = {
         cwd,
         excludePatterns,
+        scanDirs: projectConfig.scanDirs,
         maxDepth,
         ignorePackages,
         packageManager,
         showPeerDependencyVulnerabilities: projectConfig.showPeerDependencyVulnerabilities ?? false,
         showOptionalDependencyVulnerabilities: projectConfig.showOptionalDependencyVulnerabilities ?? false,
         debug: options.debug || process.env.INUP_DEBUG === '1',
-    });
-    await upgrader.run();
+        saveExact: options.saveExact ?? false,
+        // Adaptive concurrency defaults ON; it's an internal/dev toggle with no public
+        // flag. Set INUP_ADAPTIVE=0 to disable (e.g. for A/B perf comparisons).
+        adaptive: process.env.INUP_ADAPTIVE !== '0',
+    };
+    // Non-interactive (piped / CI / --json / --check) routes to the read-only headless feature;
+    // only the interactive path builds the full TUI runner.
+    if (!interactive) {
+        await new headless_1.HeadlessRunner(runnerOptions).run({ json: options.json, check: options.check });
+        return;
+    }
+    await new index_1.UpgradeRunner(runnerOptions).run();
     // After the main flow completes, check if there's an update available
     const updateCheck = await updateCheckPromise;
     if (updateCheck?.isOutdated) {
@@ -109,6 +136,10 @@ program
     .option('--max-depth <number>', 'maximum directory depth for package.json discovery', '10')
     .option('--package-manager <name>', 'manually specify package manager (npm, yarn, pnpm, bun)')
     .option('--debug', 'write verbose debug log to /tmp/inup-debug-YYYY-MM-DD.log')
+    .option('--no-color', 'disable colored output (also respects NO_COLOR / FORCE_COLOR)')
+    .option('--save-exact', 'write exact versions instead of preserving the range prefix (^/~)')
+    .option('--json', 'print a machine-readable JSON report and exit (non-interactive, read-only)')
+    .option('-c, --check', 'exit non-zero if updates exist, without writing (for CI; read-only)')
     .action(runCli);
 // Handle uncaught errors gracefully
 process.on('uncaughtException', (error) => {

package/dist/config/constants.js

@@ -1,15 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.JSDELIVR_POOL_TIMEOUT = exports.JSDELIVR_RETRY_DELAYS = exports.JSDELIVR_RETRY_TIMEOUTS = exports.REQUEST_TIMEOUT = exports.CACHE_TTL = exports.MAX_CONCURRENT_REQUESTS = exports.JSDELIVR_CDN_URL = exports.NPM_REGISTRY_URL = exports.PACKAGE_VERSION = exports.PACKAGE_NAME = void 0;
+exports.POOL_CONNECTIONS = exports.REQUEST_TIMEOUT = exports.NPM_REGISTRY_URL = exports.PACKAGE_VERSION = exports.PACKAGE_NAME = void 0;
 var package_meta_1 = require("./package-meta");
 Object.defineProperty(exports, "PACKAGE_NAME", { enumerable: true, get: function () { return package_meta_1.PACKAGE_NAME; } });
 Object.defineProperty(exports, "PACKAGE_VERSION", { enumerable: true, get: function () { return package_meta_1.PACKAGE_VERSION; } });
 exports.NPM_REGISTRY_URL = 'https://registry.npmjs.org';
-exports.JSDELIVR_CDN_URL = 'https://cdn.jsdelivr.net/npm';
-exports.MAX_CONCURRENT_REQUESTS = 150;
-exports.CACHE_TTL = 5 * 60 * 1000; // 5 minutes in milliseconds
 exports.REQUEST_TIMEOUT = 60000; // 60 seconds in milliseconds
-exports.JSDELIVR_RETRY_TIMEOUTS = [2000, 3500]; // short retry budget to keep fallback fast
-exports.JSDELIVR_RETRY_DELAYS = [150]; // tiny backoff between jsDelivr retries in ms
-exports.JSDELIVR_POOL_TIMEOUT = 60000; // keep-alive/connect lifecycle should be looser than per-request timeouts
+// Upper bound for both the undici Pool's connection count and the adaptive
+// concurrency controller's ceiling, kept as one const so they never drift apart.
+// With pipelining:1, effective in-flight requests are capped by the pool's
+// connection count, so the controller must never ramp past it.
+exports.POOL_CONNECTIONS = 24;
 //# sourceMappingURL=constants.js.map

package/dist/config/project-config.js

@@ -54,6 +54,11 @@ function normalizeConfig(config) {
             normalized.exclude = config.exclude.filter((item) => typeof item === 'string');
         }
     }
+    if (config.scanDirs) {
+        if (Array.isArray(config.scanDirs)) {
+            normalized.scanDirs = config.scanDirs.filter((item) => typeof item === 'string');
+        }
+    }
     if (typeof config.showPeerDependencyVulnerabilities === 'boolean') {
         normalized.showPeerDependencyVulnerabilities = config.showPeerDependencyVulnerabilities;
     }

package/dist/core/package-detector.js

@@ -32,8 +32,12 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PackageDetector = void 0;
+const chalk_1 = __importDefault(require("chalk"));
 const semver = __importStar(require("semver"));
 const utils_1 = require("../utils");
 const services_1 = require("../services");
@@ -46,15 +50,19 @@ class PackageDetector {
     packageJson = null;
     cwd;
     excludePatterns;
+    scanDirs;
     ignorePackages;
     maxDepth;
     batchSize = 10;
     maxConcurrency = 10;
+    adaptive;
     constructor(options) {
         this.cwd = options?.cwd || process.cwd();
         this.excludePatterns = options?.excludePatterns || [];
+        this.scanDirs = options?.scanDirs || [];
         this.ignorePackages = options?.ignorePackages || [];
         this.maxDepth = options?.maxDepth ?? 10;
+        this.adaptive = options?.adaptive ?? true;
         this.packageJsonPath = (0, utils_1.findPackageJson)(this.cwd);
         if (this.packageJsonPath) {
             this.packageJson = (0, utils_1.readPackageJson)(this.packageJsonPath);
@@ -63,6 +71,19 @@ class PackageDetector {
     hasPackageJson() {
         return this.packageJsonPath !== null && this.packageJson !== null;
     }
+    /**
+     * The resolved fetch configuration for this run, for perf logging. Exposes the
+     * exact values handed to the registry fetcher so a logged run is reproducible.
+     */
+    getPerfConfig() {
+        return {
+            cwd: this.cwd,
+            adaptive: this.adaptive,
+            maxConcurrency: this.maxConcurrency,
+            batchSize: this.batchSize,
+            poolConnections: config_1.POOL_CONNECTIONS,
+        };
+    }
     async getOutdatedPackages() {
         const packages = [];
         await this.streamOutdatedPackages((event) => {
@@ -103,6 +124,11 @@ class PackageDetector {
             currentVersions: prepared.currentVersions,
             batchSize: this.batchSize,
             maxConcurrency: this.maxConcurrency,
+            adaptive: this.adaptive,
+            onControlTick: (tick) => performanceTracker.recordControlTick(tick),
+            onPackageTiming: (0, debug_1.isPerfLoggingEnabled)()
+                ? (name, latencyMs) => performanceTracker.recordPackageTiming({ name, latencyMs })
+                : undefined,
             onBatchReady: (batch) => {
                 const batchStart = lastBatchEndAt;
                 let batchFailedCount = 0;
@@ -282,6 +308,8 @@ class PackageDetector {
                     hasRangeUpdate,
                     hasMajorUpdate,
                     allVersions,
+                    deprecated: packageData.deprecated,
+                    enginesNode: packageData.enginesNode,
                 };
             }
             catch (error) {
@@ -313,13 +341,17 @@ class PackageDetector {
         };
     }
     async findPackageJsonFilesWithTimeout(timeoutMs) {
+        const skippedPackageDirs = new Set();
         try {
             let timeoutId;
             try {
-                return await Promise.race([
+                const files = await Promise.race([
                     (0, utils_1.findAllPackageJsonFilesAsync)(this.cwd, this.excludePatterns, this.maxDepth, (currentDir, foundCount) => {
                         const truncatedDir = currentDir.length > 50 ? '...' + currentDir.slice(-47) : currentDir;
                         this.showProgress(`🔍 Scanning ${truncatedDir} (found ${foundCount})`);
+                    }, {
+                        scanDirs: this.scanDirs,
+                        onSkippedPackageDir: (relativePath) => skippedPackageDirs.add(relativePath),
                     }),
                     new Promise((_, reject) => {
                         timeoutId = setTimeout(() => {
@@ -328,6 +360,8 @@ class PackageDetector {
                         timeoutId.unref?.();
                     }),
                 ]);
+                this.warnSkippedPackageDirs(skippedPackageDirs);
+                return files;
             }
             finally {
                 if (timeoutId) {
@@ -339,6 +373,20 @@ class PackageDetector {
             throw new Error(`Failed to scan for package.json files: ${err}. Try using --exclude patterns to skip problematic directories.`);
         }
     }
+    /**
+     * Warn (once per directory, after the scan) about package.json-bearing directories that the
+     * default skip list pruned, so the user can re-include them via `.inuprc`'s `scanDirs`.
+     * Emitted after scanning so it does not corrupt the progress spinner output.
+     */
+    warnSkippedPackageDirs(skippedPackageDirs) {
+        if (skippedPackageDirs.size === 0) {
+            return;
+        }
+        const list = Array.from(skippedPackageDirs).sort();
+        console.warn(chalk_1.default.yellow(`⚠️  Skipped ${list.length} package.json-bearing director${list.length === 1 ? 'y' : 'ies'} matching the default ignore list:\n` +
+            list.map((dir) => `   - ${dir}`).join('\n') +
+            `\n   Add the directory name(s) to "scanDirs" in .inuprc to include them.`));
+    }
     isWorkspaceReference(version) {
         return (version.includes('workspace:') ||
             version === '*' ||

package/dist/core/upgrade-runner.js

@@ -32,6 +32,7 @@ class UpgradeRunner {
         this.ui = new interactive_ui_1.InteractiveUI(this.packageManager, {
             showPeerDependencyVulnerabilities: options?.showPeerDependencyVulnerabilities ?? false,
             showOptionalDependencyVulnerabilities: options?.showOptionalDependencyVulnerabilities ?? false,
+            saveExact: options?.saveExact ?? false,
         });
         this.upgrader = new upgrader_1.PackageUpgrader(this.packageManager);
     }
@@ -91,6 +92,14 @@ class UpgradeRunner {
                         progress.isLoading = event.payload.progress.isLoading;
                         performanceTracker.mark('firstBatch');
                         performanceTracker.mark('allLoaded');
+                        if ((0, debug_1.isPerfLoggingEnabled)()) {
+                            (0, debug_1.writePerfLog)({
+                                ...this.detector.getPerfConfig(),
+                                packageManager: this.packageManager.name,
+                                mode: 'interactive',
+                                env: (0, debug_1.perfEnv)(),
+                            }, performanceTracker.snapshot());
+                        }
                         refreshUI?.();
                     }
                 });

package/dist/core/upgrader.js

@@ -92,7 +92,8 @@ class PackageUpgrader {
         const packageDir = packageJsonPath.replace('/package.json', '');
         const spinner = (0, nanospinner_1.createSpinner)(`Upgrading ${type} in ${packageDir}...`).start();
         try {
-            // Read the current package.json
+            // Read the current package.json — keep the raw text so we can round-trip its formatting
+            const rawContent = (0, fs_1.readFileSync)(packageJsonPath, 'utf-8');
             const packageJson = (0, utils_1.readPackageJson)(packageJsonPath);
             // Group by upgrade type (range vs latest)
             const rangeChoices = choices.filter((c) => c.upgradeType === 'range');
@@ -118,9 +119,14 @@ class PackageUpgrader {
                     modified = true;
                 });
             }
-            // Write back the modified package.json
+            // Write back the modified package.json, preserving the original indentation and
+            // trailing-newline style. Skip the write entirely when nothing actually changed.
             if (modified) {
-                (0, fs_1.writeFileSync)(packageJsonPath, JSON.stringify(packageJson, null, 2) + '\n');
+                const format = (0, utils_1.detectJsonFormat)(rawContent);
+                const nextContent = JSON.stringify(packageJson, null, format.indent) + (format.trailingNewline ? '\n' : '');
+                if (nextContent !== rawContent) {
+                    (0, fs_1.writeFileSync)(packageJsonPath, nextContent);
+                }
             }
             spinner.success({ text: `Upgraded ${choices.length} ${type} in ${packageDir}` });
             // Show which packages were upgraded

package/dist/features/changelog/services/package-metadata-service.js

@@ -3,16 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PackageMetadataService = void 0;
 const npm_registry_client_1 = require("../clients/npm-registry-client");
 const package_metadata_1 = require("../parsers/package-metadata");
-const jsdelivr_registry_1 = require("../../../services/jsdelivr-registry");
 const inflight_1 = require("../../../services/http/inflight");
 class PackageMetadataService {
     npmRegistryClient;
-    exactManifestFetcher;
     cache = new Map();
     inFlight = new inflight_1.InflightMap();
-    constructor(npmRegistryClient = new npm_registry_client_1.NpmRegistryClient(), exactManifestFetcher = jsdelivr_registry_1.fetchExactPackageManifest) {
+    constructor(npmRegistryClient = new npm_registry_client_1.NpmRegistryClient()) {
         this.npmRegistryClient = npmRegistryClient;
-        this.exactManifestFetcher = exactManifestFetcher;
     }
     clearCache() {
         this.cache.clear();
@@ -85,15 +82,7 @@ class PackageMetadataService {
     }
     async fetchPackageManifest(packageName, version, signal) {
         signal?.throwIfAborted();
-        const normalizedVersion = version?.trim();
-        if (normalizedVersion) {
-            const jsdelivrManifest = await this.exactManifestFetcher(packageName, normalizedVersion);
-            if (jsdelivrManifest) {
-                return jsdelivrManifest;
-            }
-        }
-        signal?.throwIfAborted();
-        return await this.npmRegistryClient.fetchPackageManifest(packageName, normalizedVersion || 'latest', signal);
+        return await this.npmRegistryClient.fetchPackageManifest(packageName, version?.trim() || 'latest', signal);
     }
     buildMetadata(packageName, rawData) {
         return (0, package_metadata_1.mapPackageManifestToMetadata)(packageName, rawData);

package/dist/features/changelog/services/release-notes-service.js

@@ -38,7 +38,6 @@ const semver = __importStar(require("semver"));
 const github_client_1 = require("../clients/github-client");
 const changelog_parser_1 = require("../parsers/changelog-parser");
 const github_release_html_parser_1 = require("../parsers/github-release-html-parser");
-const constants_1 = require("../../../config/constants");
 const RELEASE_NOTES_FETCH_TIMEOUT_MS = 5000;
 const PREFER_GITHUB_RELEASE_PAGE = true;
 class ReleaseNotesService {
@@ -89,9 +88,6 @@ class ReleaseNotesService {
                     return notes;
             }
         }
-        const changelogNotes = await this.fetchJsdelivrChangelog(packageName, version, signal);
-        if (changelogNotes)
-            return changelogNotes;
         return null;
     }
     getGitHubSources(repoUrl, version, signal) {
@@ -154,29 +150,6 @@ class ReleaseNotesService {
             return null;
         return (0, changelog_parser_1.extractVersionSection)(fullText, version);
     }
-    async fetchJsdelivrChangelog(packageName, version, signal) {
-        const fullText = await this.fetchPublishedPackageChangelog(packageName, version, signal);
-        if (!fullText)
-            return null;
-        return (0, changelog_parser_1.extractVersionSection)(fullText, version);
-    }
-    async fetchPublishedPackageChangelog(packageName, version, signal) {
-        try {
-            const response = await fetch(`${constants_1.JSDELIVR_CDN_URL}/${encodeURIComponent(packageName)}@${version}/CHANGELOG.md`, {
-                method: 'GET',
-                signal,
-            });
-            if (!response.ok)
-                return null;
-            return await response.text();
-        }
-        catch (error) {
-            if (error instanceof DOMException && error.name === 'AbortError') {
-                throw error;
-            }
-            return null;
-        }
-    }
 }
 exports.ReleaseNotesService = ReleaseNotesService;
 //# sourceMappingURL=release-notes-service.js.map

package/dist/features/debug/index.js

@@ -16,5 +16,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./types/debug.types"), exports);
 __exportStar(require("./services/performance-tracker"), exports);
+__exportStar(require("./services/perf-logger"), exports);
 __exportStar(require("./renderer/performance-modal"), exports);
 //# sourceMappingURL=index.js.map

package/dist/features/debug/renderer/performance-modal.js

@@ -21,7 +21,7 @@ function labelValue(label, value, labelWidth = 22) {
     return `${chalk_1.default.white(padded)} ${value}`;
 }
 function buildSections(snapshot) {
-    const { phases, counts, batches, failedPackages, packageManager, totalMs } = snapshot;
+    const { phases, counts, batches, controlTicks, failedPackages, packageManager, totalMs } = snapshot;
     const pinned = [
         {
             key: 'header',
@@ -67,6 +67,22 @@ function buildSections(snapshot) {
         bodyRows.push(chalk_1.default.gray('  (no batches recorded)'));
     }
     bodyRows.push('');
+    bodyRows.push(chalk_1.default.bold('Concurrency'));
+    if (controlTicks.length > 0) {
+        const limits = controlTicks.map((t) => t.limit);
+        const finalTick = controlTicks[controlTicks.length - 1];
+        const hardDowns = controlTicks.filter((t) => t.reason === 'hard-down').length;
+        bodyRows.push(labelValue('Start limit', formatCount(controlTicks[0].limit)));
+        bodyRows.push(labelValue('Peak limit', formatCount(Math.max(...limits))));
+        bodyRows.push(labelValue('Final limit', formatCount(finalTick.limit)));
+        bodyRows.push(labelValue('Final EWMA', formatMs(finalTick.ewmaMs)));
+        bodyRows.push(labelValue('Control ticks', formatCount(controlTicks.length)));
+        bodyRows.push(labelValue('Hard back-offs', formatCount(hardDowns)));
+    }
+    else {
+        bodyRows.push(chalk_1.default.gray('  (fixed — adaptive off or run too small)'));
+    }
+    bodyRows.push('');
     bodyRows.push(chalk_1.default.bold('Failures'));
     if (failedPackages.length > 0) {
         for (const name of failedPackages) {

package/dist/features/debug/services/perf-logger.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPerfLoggingEnabled = isPerfLoggingEnabled;
+exports.perfEnv = perfEnv;
+exports.getPerfDir = getPerfDir;
+exports.writePerfLog = writePerfLog;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const adaptive_controller_1 = require("../../../services/http/adaptive-controller");
+/**
+ * Performance debug logger.
+ *
+ * When INUP_PERF=1, every run writes ONE self-contained JSON file capturing the
+ * full configuration plus the performance snapshot (phases, batches, adaptive
+ * control ticks, counts). The files accumulate in a gitignored directory so a
+ * series of runs can be diffed to find the best-performing configuration.
+ *
+ * Output location:
+ *  - Default: `<cwd>/.inup-perf` (logs next to the project being scanned).
+ *  - INUP_PERF_DIR=<path>: a single centralized directory (e.g. the inup repo)
+ *    so runs from many different projects collect in one place for analysis.
+ *    The project name is encoded into each filename so they stay distinct.
+ *
+ * Each file is independent: it records every input that could affect timing, so
+ * a run can be understood (and reproduced) without external context.
+ */
+const PERF_DIR_NAME = '.inup-perf';
+/** Filesystem-safe slug of a project name for use in filenames. */
+function projectSlug(cwd) {
+    const name = (0, path_1.basename)((0, path_1.resolve)(cwd)) || 'root';
+    return name.replace(/[^a-zA-Z0-9._-]/g, '-').slice(0, 40);
+}
+function isPerfLoggingEnabled() {
+    return process.env.INUP_PERF === '1';
+}
+/** Capture the env toggles that influence a run, for reproducibility. */
+function perfEnv() {
+    return {
+        INUP_ADAPTIVE: process.env.INUP_ADAPTIVE,
+        INUP_PERF: process.env.INUP_PERF,
+        INUP_DEBUG: process.env.INUP_DEBUG,
+        CI: process.env.CI,
+        NODE_ENV: process.env.NODE_ENV,
+    };
+}
+/**
+ * Resolve (and lazily create) the perf-log directory.
+ *
+ * - INUP_PERF_DIR set → that directory verbatim (centralized collection point,
+ *   e.g. the inup repo's .inup-perf). Relative paths resolve from cwd.
+ * - otherwise → `<cwd>/.inup-perf` (logs sit next to the scanned project).
+ */
+function getPerfDir(cwd = process.cwd()) {
+    const override = process.env.INUP_PERF_DIR;
+    const dir = override
+        ? (0, path_1.isAbsolute)(override)
+            ? override
+            : (0, path_1.resolve)(cwd, override)
+        : (0, path_1.join)(cwd, PERF_DIR_NAME);
+    if (!(0, fs_1.existsSync)(dir)) {
+        (0, fs_1.mkdirSync)(dir, { recursive: true });
+    }
+    return dir;
+}
+const pad = (n, width = 2) => String(n).padStart(width, '0');
+function fileStamp(d) {
+    return (`${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}` +
+        `-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}` +
+        `-${pad(d.getMilliseconds(), 3)}`);
+}
+/**
+ * Write one perf record to its own JSON file. Best-effort: never throws into the
+ * caller (a debugging aid must not break a real run). Returns the path written,
+ * or null if disabled or on failure.
+ */
+function writePerfLog(config, snapshot) {
+    if (!isPerfLoggingEnabled())
+        return null;
+    try {
+        const now = new Date();
+        const record = {
+            schemaVersion: 1,
+            timestamp: now.toISOString(),
+            wallMs: snapshot.totalMs,
+            config,
+            tuning: adaptive_controller_1.DEFAULT_TUNING,
+            snapshot,
+        };
+        const dir = getPerfDir(config.cwd);
+        const modeTag = config.mode;
+        const adaptiveTag = config.adaptive ? 'adaptive' : 'fixed';
+        // Project name in the filename keeps multi-project runs distinct when many
+        // collect into one centralized INUP_PERF_DIR.
+        const fileName = `run-${fileStamp(now)}-${projectSlug(config.cwd)}-${adaptiveTag}-${modeTag}.json`;
+        const filePath = (0, path_1.join)(dir, fileName);
+        (0, fs_1.writeFileSync)(filePath, JSON.stringify(record, null, 2));
+        // Maintain a stable pointer to the most recent run for quick reads.
+        (0, fs_1.writeFileSync)((0, path_1.join)(dir, 'latest.json'), JSON.stringify(record, null, 2));
+        // And a cheap one-line-per-run index for fast scanning.
+        appendPerfIndex(dir, record);
+        if (process.env.INUP_DEBUG === '1') {
+            process.stderr.write(`[inup] perf log → ${filePath}\n`);
+        }
+        return filePath;
+    }
+    catch {
+        // Never let perf logging affect the run.
+        return null;
+    }
+}
+/** Append a single line to a NDJSON index for ultra-cheap scanning, best-effort. */
+function appendPerfIndex(dir, record) {
+    try {
+        const line = JSON.stringify({
+            timestamp: record.timestamp,
+            wallMs: record.wallMs,
+            adaptive: record.config.adaptive,
+            mode: record.config.mode,
+            uniquePackages: record.snapshot.counts.uniquePackages,
+            registryFetch: record.snapshot.phases.registryFetch,
+            controlTicks: record.snapshot.controlTicks.length,
+        }) + '\n';
+        (0, fs_1.appendFileSync)((0, path_1.join)(dir, 'index.ndjson'), line);
+    }
+    catch {
+        /* best-effort */
+    }
+}
+//# sourceMappingURL=perf-logger.js.map