inup 1.5.6 → 1.6.2

package/dist/features/debug/services/performance-tracker.js

@@ -6,6 +6,8 @@ class PerformanceTracker {
     phases = {};
     counts = {};
     batches = [];
+    controlTicks = [];
+    packageTimings = [];
     failedPackages = [];
     packageManager = null;
     start() {
@@ -13,6 +15,8 @@ class PerformanceTracker {
         this.phases = {};
         this.counts = {};
         this.batches = [];
+        this.controlTicks = [];
+        this.packageTimings = [];
         this.failedPackages = [];
         this.packageManager = null;
     }
@@ -30,6 +34,12 @@ class PerformanceTracker {
     recordBatch(batch) {
         this.batches.push(batch);
     }
+    recordControlTick(tick) {
+        this.controlTicks.push(tick);
+    }
+    recordPackageTiming(timing) {
+        this.packageTimings.push(timing);
+    }
     recordFailedPackage(name) {
         if (!this.failedPackages.includes(name)) {
             this.failedPackages.push(name);
@@ -39,15 +49,15 @@ class PerformanceTracker {
         this.packageManager = name;
     }
     snapshot() {
-        const totalMs = this.startedAt === null
-            ? null
-            : (this.phases.allLoaded ?? Date.now() - this.startedAt);
+        const totalMs = this.startedAt === null ? null : (this.phases.allLoaded ?? Date.now() - this.startedAt);
         return {
             startedAt: this.startedAt,
             phases: { ...this.phases },
             totalMs,
             counts: { ...this.counts },
             batches: [...this.batches],
+            controlTicks: [...this.controlTicks],
+            packageTimings: [...this.packageTimings],
             failedPackages: [...this.failedPackages],
             packageManager: this.packageManager,
         };
@@ -57,6 +67,8 @@ class PerformanceTracker {
         this.phases = {};
         this.counts = {};
         this.batches = [];
+        this.controlTicks = [];
+        this.packageTimings = [];
         this.failedPackages = [];
         this.packageManager = null;
     }

package/dist/features/headless/headless-runner.js

@@ -0,0 +1,69 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HeadlessRunner = void 0;
+const chalk_1 = __importDefault(require("chalk"));
+const package_detector_1 = require("../../core/package-detector");
+const vulnerability_audit_1 = require("./vulnerability-audit");
+const report_1 = require("./report");
+const debug_1 = require("../../features/debug");
+/**
+ * Non-interactive entry point. Resolves the outdated list without rendering the TUI, then either
+ * emits a JSON report (--json) or a plain line-based report. With --check, sets a non-zero exit
+ * code when updates exist so CI can gate on it. Read-only: never writes package.json or installs.
+ *
+ * This is the headless counterpart to the interactive `UpgradeRunner`; it shares only the
+ * `PackageDetector` (the scan/resolve layer), not the UI/upgrade machinery.
+ */
+class HeadlessRunner {
+    detector;
+    constructor(options) {
+        this.detector = new package_detector_1.PackageDetector(options);
+    }
+    async run(options) {
+        try {
+            if (!this.detector.hasPackageJson()) {
+                throw new Error('No package.json found in current directory');
+            }
+            // Start perf tracking so headless runs produce clean timing data too
+            // (the interactive runner starts it itself; headless previously did not).
+            const perfEnabled = (0, debug_1.isPerfLoggingEnabled)();
+            const performanceTracker = (0, debug_1.getPerformanceTracker)();
+            if (perfEnabled)
+                performanceTracker.start();
+            const packages = await this.detector.getOutdatedPackages();
+            const outdated = this.detector.getOutdatedPackagesOnly(packages);
+            if (perfEnabled) {
+                performanceTracker.mark('allLoaded');
+                (0, debug_1.writePerfLog)({
+                    ...this.detector.getPerfConfig(),
+                    packageManager: null,
+                    mode: 'headless',
+                    env: (0, debug_1.perfEnv)(),
+                }, performanceTracker.snapshot());
+            }
+            // Audit the current versions (one bulk request, best-effort) and cross-reference each
+            // advisory against the upgrade targets, so the report says whether upgrading *fixes* it.
+            const vulnerabilities = await (0, vulnerability_audit_1.auditVulnerabilities)(outdated);
+            if (options.json) {
+                // stdout is reserved for the JSON document only.
+                console.log(JSON.stringify((0, report_1.buildHeadlessReport)(packages, outdated, vulnerabilities), null, 2));
+            }
+            else {
+                console.log((0, report_1.renderPlainReport)(outdated, vulnerabilities));
+            }
+            // Exit 1 only means "updates exist" (like `prettier --check`); 2 is reserved for errors.
+            if (options.check && outdated.length > 0) {
+                process.exitCode = 1;
+            }
+        }
+        catch (error) {
+            console.error(chalk_1.default.red(`Error: ${error instanceof Error ? error.message : String(error)}`));
+            process.exit(2);
+        }
+    }
+}
+exports.HeadlessRunner = HeadlessRunner;
+//# sourceMappingURL=headless-runner.js.map

package/dist/features/headless/index.js

@@ -0,0 +1,27 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderPlainReport = exports.buildHeadlessReport = exports.upgradeClears = exports.auditVulnerabilities = exports.HeadlessRunner = void 0;
+__exportStar(require("./types"), exports);
+var headless_runner_1 = require("./headless-runner");
+Object.defineProperty(exports, "HeadlessRunner", { enumerable: true, get: function () { return headless_runner_1.HeadlessRunner; } });
+var vulnerability_audit_1 = require("./vulnerability-audit");
+Object.defineProperty(exports, "auditVulnerabilities", { enumerable: true, get: function () { return vulnerability_audit_1.auditVulnerabilities; } });
+Object.defineProperty(exports, "upgradeClears", { enumerable: true, get: function () { return vulnerability_audit_1.upgradeClears; } });
+var report_1 = require("./report");
+Object.defineProperty(exports, "buildHeadlessReport", { enumerable: true, get: function () { return report_1.buildHeadlessReport; } });
+Object.defineProperty(exports, "renderPlainReport", { enumerable: true, get: function () { return report_1.renderPlainReport; } });
+//# sourceMappingURL=index.js.map

package/dist/features/headless/report.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildHeadlessReport = buildHeadlessReport;
+exports.renderPlainReport = renderPlainReport;
+const types_1 = require("./types");
+/** Build the machine-readable `--json` payload from the scanned + outdated package sets. */
+function buildHeadlessReport(all, outdated, vulnerabilities) {
+    return {
+        schemaVersion: types_1.HEADLESS_SCHEMA_VERSION,
+        summary: {
+            total: all.length,
+            outdated: outdated.length,
+            major: outdated.filter((pkg) => pkg.hasMajorUpdate).length,
+            vulnerable: vulnerabilities.size,
+        },
+        outdated: outdated.map((pkg) => {
+            const entry = {
+                name: pkg.name,
+                current: pkg.currentVersion,
+                range: pkg.rangeVersion,
+                latest: pkg.latestVersion,
+                type: pkg.type,
+                packageJsonPath: pkg.packageJsonPath,
+                hasMajorUpdate: pkg.hasMajorUpdate,
+            };
+            if (pkg.deprecated)
+                entry.deprecated = pkg.deprecated;
+            if (pkg.enginesNode)
+                entry.enginesNode = pkg.enginesNode;
+            const vulnerability = vulnerabilities.get(pkg);
+            if (vulnerability)
+                entry.vulnerability = vulnerability;
+            return entry;
+        }),
+    };
+}
+/** Render the plain, line-based report (one line per package + a recap) as a single string. */
+function renderPlainReport(outdated, vulnerabilities) {
+    if (outdated.length === 0) {
+        return 'All dependencies are up to date — no upgrades needed.';
+    }
+    const lines = outdated.map((pkg) => {
+        const major = pkg.hasMajorUpdate ? ' (major)' : '';
+        const deprecated = pkg.deprecated ? '  [deprecated]' : '';
+        return `${pkg.name}  ${pkg.currentVersion} → ${pkg.latestVersion}  [${pkg.type}]${major}${vulnMarker(vulnerabilities.get(pkg))}${deprecated}`;
+    });
+    const fileCount = new Set(outdated.map((pkg) => pkg.packageJsonPath)).size;
+    const vulnNote = vulnerabilities.size > 0 ? ` — ${vulnerabilities.size} with known vulnerabilities` : '';
+    lines.push('', `${outdated.length} package(s) outdated across ${fileCount} file(s)${vulnNote}.`);
+    return lines.join('\n');
+}
+/** A compact `[vuln: N sev → verdict]` tag for the plain report; '' when there are none. */
+function vulnMarker(vulnerability) {
+    if (!vulnerability)
+        return '';
+    // Prefer the cheaper fix: if the in-range bump already clears it, that's the safer action.
+    const verdict = vulnerability.fixedByRange
+        ? 'fixed by range upgrade'
+        : vulnerability.fixedByLatest
+            ? 'fixed by latest only'
+            : 'not fixed by upgrade';
+    return `  [vuln: ${vulnerability.count} ${vulnerability.highestSeverity} → ${verdict}]`;
+}
+//# sourceMappingURL=report.js.map

package/dist/features/headless/types.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HEADLESS_SCHEMA_VERSION = void 0;
+/** Bump when the `--json` shape changes in a way consumers (scripts, agents) must adapt to. */
+exports.HEADLESS_SCHEMA_VERSION = 1;
+//# sourceMappingURL=types.js.map

package/dist/features/headless/vulnerability-audit.js

@@ -0,0 +1,106 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditVulnerabilities = auditVulnerabilities;
+exports.upgradeClears = upgradeClears;
+const semver = __importStar(require("semver"));
+const services_1 = require("../../services");
+const utils_1 = require("../../utils");
+/**
+ * Audit the outdated packages' currently-installed versions (one bulk request, matching the
+ * interactive audit) and, for each advisory, cross-reference its affected range against the
+ * upgrade targets — so callers can state whether upgrading actually *fixes* the issue.
+ *
+ * Best-effort: `fetchVulnerabilities` swallows network errors and returns an empty map, so a
+ * failed audit never blocks the report. Returns only the vulnerable packages, keyed by package.
+ */
+async function auditVulnerabilities(outdated) {
+    const result = new Map();
+    if (outdated.length === 0)
+        return result;
+    // The bulk advisory API is keyed by package name (one version per name), so dedupe by name.
+    const versions = new Map();
+    for (const pkg of outdated) {
+        if (!versions.has(pkg.name))
+            versions.set(pkg.name, pkg.currentVersion);
+    }
+    const advisories = await (0, services_1.fetchVulnerabilities)(versions);
+    if (advisories.size === 0)
+        return result;
+    for (const pkg of outdated) {
+        const found = advisories.get(pkg.name);
+        if (!found || found.vulnerabilities.length === 0 || !found.highestSeverity)
+            continue;
+        result.set(pkg, summarizeVulnerability(pkg, found.vulnerabilities, found.highestSeverity));
+    }
+    return result;
+}
+function summarizeVulnerability(pkg, vulnerabilities, highestSeverity) {
+    const advisories = vulnerabilities.map((vuln) => ({
+        id: vuln.id,
+        title: vuln.title,
+        severity: vuln.severity,
+        url: vuln.url,
+        vulnerableVersions: vuln.vulnerable_versions,
+        fixedByRange: upgradeClears(pkg.rangeVersion, vuln.vulnerable_versions),
+        fixedByLatest: upgradeClears(pkg.latestVersion, vuln.vulnerable_versions),
+    }));
+    return {
+        count: advisories.length,
+        highestSeverity,
+        fixedByRange: advisories.every((advisory) => advisory.fixedByRange),
+        fixedByLatest: advisories.every((advisory) => advisory.fixedByLatest),
+        advisories,
+    };
+}
+/**
+ * True when upgrading to `target` escapes an advisory's affected range. Conservative: if either
+ * the target or the advisory range can't be parsed, we do NOT claim a fix — `semver.satisfies`
+ * treats an invalid range as "matches nothing", which would otherwise read as a false "fixed".
+ */
+function upgradeClears(target, vulnerableVersions) {
+    const comparable = (0, utils_1.toComparableVersion)(target);
+    if (!comparable)
+        return false;
+    if (semver.validRange(vulnerableVersions) === null)
+        return false;
+    try {
+        return !semver.satisfies(comparable, vulnerableVersions, { includePrerelease: true });
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=vulnerability-audit.js.map

package/dist/interactive-ui.js

@@ -20,6 +20,7 @@ class InteractiveUI {
     renderer;
     packageManager;
     options;
+    saveExact;
     vulnerabilityAuditController = new controllers_1.VulnerabilityAuditController();
     packageInfoModalController = new controllers_1.PackageInfoModalController();
     refreshView;
@@ -27,6 +28,7 @@ class InteractiveUI {
         this.renderer = new ui_1.UIRenderer();
         this.packageManager = packageManager;
         this.options = normalizeVulnerabilityDisplayOptions(options);
+        this.saveExact = options?.saveExact ?? false;
     }
     async displayPackagesTable(packages) {
         console.log(this.renderer.renderPackagesTable(packages));
@@ -37,7 +39,7 @@ class InteractiveUI {
             return [];
         }
         const selectedStates = await (0, session_1.runInteractiveSession)(selectionStates, this.packageManager, this.renderer, this.packageInfoModalController, this.vulnerabilityAuditController, this.options, (refresh) => { this.refreshView = refresh; });
-        return (0, session_1.createUpgradeChoices)(selectedStates);
+        return (0, session_1.createUpgradeChoices)(selectedStates, this.saveExact);
     }
     createSelectionStates(packages, previousSelections, includeUpToDate = true) {
         return (0, session_1.createSelectionStates)(packages, (name, version, type) => this.vulnerabilityAuditController.getCachedSummary(name, version, type), previousSelections, includeUpToDate);
@@ -63,7 +65,7 @@ class InteractiveUI {
     async selectPackagesToUpgradeProgressive(selectionStates, progress, attachRefresh) {
         this.enqueueSecurityAudit(selectionStates);
         const selectedStates = await (0, session_1.runInteractiveSession)(selectionStates, this.packageManager, this.renderer, this.packageInfoModalController, this.vulnerabilityAuditController, this.options, (refresh) => { this.refreshView = refresh; }, progress, attachRefresh);
-        return (0, session_1.createUpgradeChoices)(selectedStates);
+        return (0, session_1.createUpgradeChoices)(selectedStates, this.saveExact);
     }
     enqueueSecurityAudit(selectionStates) {
         this.vulnerabilityAuditController.enqueueStates(selectionStates, () => this.refreshView?.());

package/dist/services/http/adaptive-controller.js

@@ -0,0 +1,153 @@
+"use strict";
+/**
+ * AIMD (additive-increase / multiplicative-decrease) concurrency controller.
+ *
+ * Mirrors the congestion-control family TCP uses. It performs no I/O and does not
+ * own the semaphore — it is a pure decision function: feed it the outcome of each
+ * request, and on each control tick it returns the next concurrency limit, which
+ * the caller applies to the resizable semaphore.
+ *
+ * Back-off signals (only real errors move the limit down):
+ *  - congestion (HTTP 429/503): the registry explicitly telling us to slow down →
+ *    immediate hard multiplicative-decrease (×hardDecreaseFactor), the moment the
+ *    signal arrives, not deferred to the next tick.
+ *  - retryable/transient errors in a tick window → soft multiplicative-decrease
+ *    (×softDecreaseFactor) and no increase.
+ *
+ * Otherwise (healthy link) the limit ramps additively (+increaseStep) toward the
+ * ceiling and holds there.
+ *
+ * NOTE on latency: we sample successful single-attempt latency into an EWMA, but
+ * it is used for *instrumentation only* — never to drive back-off. The npm
+ * registry is a CDN whose latency varies widely on a perfectly healthy link;
+ * reacting to that variance made the controller oscillate and lose to a fixed
+ * limit. Real congestion shows up as 429, which we handle directly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdaptiveController = exports.DEFAULT_TUNING = void 0;
+exports.DEFAULT_TUNING = {
+    floor: 6,
+    ceil: 24,
+    increaseStep: 4,
+    softDecreaseFactor: 0.7,
+    hardDecreaseFactor: 0.5,
+    ewmaAlpha: 0.3,
+    ticksEveryCompletions: 6,
+};
+const clamp = (value, lo, hi) => Math.max(lo, Math.min(hi, value));
+class AdaptiveController {
+    onTick;
+    tuning;
+    limit;
+    // EWMA of successful single-attempt latency. Kept for instrumentation only
+    // (the perf modal / logs); it does not drive concurrency decisions.
+    ewmaMs = 0;
+    hasEwma = false;
+    completionsSinceTick = 0;
+    retriesSinceTick = 0;
+    /**
+     * @param packageCount  number of packages this run will fetch; drives the smart
+     *                       initial limit so a run starts near its work size and
+     *                       ramps to the ceiling, rather than crawling up from the
+     *                       floor and losing to a fixed baseline.
+     * @param onTick        optional sink for control decisions (perf modal / logs).
+     * @param tuning        override the defaults (constants live in one place).
+     */
+    constructor(packageCount, onTick, tuning = {}) {
+        this.onTick = onTick;
+        this.tuning = { ...exports.DEFAULT_TUNING, ...tuning };
+        // Smart start: aim at the work size, clamped to [floor, ceil].
+        this.limit = clamp(Math.min(this.tuning.ceil, packageCount), this.tuning.floor, this.tuning.ceil);
+    }
+    /** Whether the controller should even run; tiny runs are better off fixed. */
+    static shouldControl(packageCount, tuning = {}) {
+        const ceil = tuning.ceil ?? exports.DEFAULT_TUNING.ceil;
+        // Nothing to ramp toward and no steady state to learn below the ceiling.
+        return packageCount > ceil;
+    }
+    getLimit() {
+        return this.limit;
+    }
+    /**
+     * Record a completed request. Returns a new limit to apply IMMEDIATELY when a
+     * congestion signal demands a hard back-off, otherwise null (the limit may
+     * still change at the next control tick — see `maybeTick`).
+     */
+    record(kind, latencyMs) {
+        this.completionsSinceTick++;
+        if (kind === 'success' && latencyMs !== undefined) {
+            this.sampleLatency(latencyMs);
+            return null;
+        }
+        if (kind === 'congested') {
+            this.retriesSinceTick++;
+            return this.applyHardDecrease();
+        }
+        // retryable / transient
+        this.retriesSinceTick++;
+        return null;
+    }
+    /**
+     * Call after each completion. If a control tick is due, computes and returns
+     * the next limit (and emits a ControlTick); otherwise returns null.
+     */
+    maybeTick(now = Date.now()) {
+        if (this.completionsSinceTick < this.tuning.ticksEveryCompletions) {
+            return null;
+        }
+        return this.tick(now);
+    }
+    sampleLatency(latencyMs) {
+        if (!this.hasEwma) {
+            this.ewmaMs = latencyMs;
+            this.hasEwma = true;
+        }
+        else {
+            const a = this.tuning.ewmaAlpha;
+            this.ewmaMs = a * latencyMs + (1 - a) * this.ewmaMs;
+        }
+    }
+    applyHardDecrease() {
+        const next = clamp(Math.round(this.limit * this.tuning.hardDecreaseFactor), this.tuning.floor, this.tuning.ceil);
+        this.limit = next;
+        this.emit('hard-down');
+        // A hard decrease resets the tick window so we don't immediately bump back up.
+        this.resetWindow();
+        return next;
+    }
+    tick(now) {
+        // Back off only on real errors seen since the last tick; otherwise ramp to
+        // the ceiling and hold (latency is not a signal — see the class docblock).
+        const retries = this.retriesSinceTick;
+        let reason;
+        if (retries > 0) {
+            this.limit = clamp(Math.round(this.limit * this.tuning.softDecreaseFactor), this.tuning.floor, this.tuning.ceil);
+            reason = 'soft-down';
+        }
+        else if (this.limit < this.tuning.ceil) {
+            this.limit = clamp(this.limit + this.tuning.increaseStep, this.tuning.floor, this.tuning.ceil);
+            reason = 'up';
+        }
+        else {
+            reason = 'hold';
+        }
+        this.emit(reason, now);
+        this.resetWindow();
+        return this.limit;
+    }
+    emit(reason, now = Date.now()) {
+        this.onTick?.({
+            atMs: now,
+            limit: this.limit,
+            ewmaMs: Math.round(this.ewmaMs),
+            retries: this.retriesSinceTick,
+            reason,
+        });
+    }
+    resetWindow() {
+        this.completionsSinceTick = 0;
+        this.retriesSinceTick = 0;
+    }
+}
+exports.AdaptiveController = AdaptiveController;
+//# sourceMappingURL=adaptive-controller.js.map

package/dist/services/http/etag-store.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setEtagCacheEnabled = setEtagCacheEnabled;
+exports.readEtag = readEtag;
+exports.writeEtag = writeEtag;
+exports.etagCacheDir = etagCacheDir;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+/** Bump when the on-disk entry shape changes; old generations are ignored. */
+const SCHEMA = 'v1';
+/** Entries untouched for longer than this are swept on first access. */
+const MAX_AGE_MS = 14 * 24 * 60 * 60 * 1000; // 14 days
+let enabled = true;
+let sweptThisProcess = false;
+/** Allow tests/callers to toggle the store without touching call sites. */
+function setEtagCacheEnabled(value) {
+    enabled = value;
+}
+/** Resolve (and lazily create) the cache directory, sweeping stale entries once. */
+function cacheDir() {
+    // Version data is not project-specific, so it lives in the OS temp area, shared
+    // across every project the user scans.
+    const dir = (0, node_path_1.join)((0, node_os_1.tmpdir)(), 'inup', 'etag-cache', SCHEMA);
+    if (!(0, node_fs_1.existsSync)(dir)) {
+        (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    }
+    if (!sweptThisProcess) {
+        sweptThisProcess = true;
+        sweepStale(dir);
+    }
+    return dir;
+}
+/** Delete entries not modified within MAX_AGE_MS. Best-effort, runs once. */
+function sweepStale(dir) {
+    try {
+        const cutoff = Date.now() - MAX_AGE_MS;
+        for (const name of (0, node_fs_1.readdirSync)(dir)) {
+            const file = (0, node_path_1.join)(dir, name);
+            try {
+                if ((0, node_fs_1.statSync)(file).mtimeMs < cutoff)
+                    (0, node_fs_1.unlinkSync)(file);
+            }
+            catch {
+                /* skip files we can't stat/remove */
+            }
+        }
+    }
+    catch {
+        /* sweeping is optional; never fail a run over it */
+    }
+}
+/** Stable, filesystem-safe filename for a cache key (the registry path). */
+function fileFor(key) {
+    const hash = (0, node_crypto_1.createHash)('sha1').update(key).digest('hex');
+    return (0, node_path_1.join)(cacheDir(), `${hash}.json`);
+}
+/** Read a stored entry, or null if absent/unreadable/disabled. */
+function readEtag(key) {
+    if (!enabled)
+        return null;
+    try {
+        const file = fileFor(key);
+        if (!(0, node_fs_1.existsSync)(file))
+            return null;
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(file, 'utf8'));
+        if (!parsed || typeof parsed.etag !== 'string' || !parsed.data)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/** Persist an entry. Best-effort; failures are ignored. */
+function writeEtag(key, etag, data) {
+    if (!enabled || !etag)
+        return;
+    try {
+        (0, node_fs_1.writeFileSync)(fileFor(key), JSON.stringify({ etag, data }));
+    }
+    catch {
+        /* best-effort */
+    }
+}
+/** Test/maintenance helper: the resolved cache directory. */
+function etagCacheDir() {
+    return cacheDir();
+}
+//# sourceMappingURL=etag-store.js.map