inup 1.6.0 → 1.6.2

package/README.md

@@ -112,7 +112,7 @@ to stderr. Exit codes: `0` up to date, `1` updates exist (`--check`), `2` error.
 
 ## Privacy
 
-No tracking, no telemetry, no data collection. Package metadata is fetched directly from the npm registry. Download counts come from the npm downloads API. When needed for exact-version manifests, inup may fetch a pinned `package.json` from jsDelivr.
+No tracking, no telemetry, no data collection. Package metadata is fetched directly from the npm registry. Download counts come from the npm downloads API. Changelog and release notes are fetched from GitHub.
 
 ## License
 

package/dist/cli.js

@@ -15,6 +15,10 @@ const config_1 = require("./config");
 const utils_1 = require("./utils");
 const git_1 = require("./utils/git");
 const ui_1 = require("./ui");
+// Load developer-only toggles from <inup-repo>/.env.local before anything reads
+// env. Best-effort, gitignored, never overrides real env. Lets perf/debug be
+// "set once" across every project without shell config.
+(0, utils_1.loadInupLocalEnv)();
 const program = new commander_1.Command();
 async function runCli(options) {
     // Resolve colored-output intent before anything renders.
@@ -88,6 +92,9 @@ async function runCli(options) {
         showOptionalDependencyVulnerabilities: projectConfig.showOptionalDependencyVulnerabilities ?? false,
         debug: options.debug || process.env.INUP_DEBUG === '1',
         saveExact: options.saveExact ?? false,
+        // Adaptive concurrency defaults ON; it's an internal/dev toggle with no public
+        // flag. Set INUP_ADAPTIVE=0 to disable (e.g. for A/B perf comparisons).
+        adaptive: process.env.INUP_ADAPTIVE !== '0',
     };
     // Non-interactive (piped / CI / --json / --check) routes to the read-only headless feature;
     // only the interactive path builds the full TUI runner.

package/dist/config/constants.js

@@ -1,11 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.REQUEST_TIMEOUT = exports.CACHE_TTL = exports.MAX_CONCURRENT_REQUESTS = exports.NPM_REGISTRY_URL = exports.PACKAGE_VERSION = exports.PACKAGE_NAME = void 0;
+exports.POOL_CONNECTIONS = exports.REQUEST_TIMEOUT = exports.NPM_REGISTRY_URL = exports.PACKAGE_VERSION = exports.PACKAGE_NAME = void 0;
 var package_meta_1 = require("./package-meta");
 Object.defineProperty(exports, "PACKAGE_NAME", { enumerable: true, get: function () { return package_meta_1.PACKAGE_NAME; } });
 Object.defineProperty(exports, "PACKAGE_VERSION", { enumerable: true, get: function () { return package_meta_1.PACKAGE_VERSION; } });
 exports.NPM_REGISTRY_URL = 'https://registry.npmjs.org';
-exports.MAX_CONCURRENT_REQUESTS = 150;
-exports.CACHE_TTL = 5 * 60 * 1000; // 5 minutes in milliseconds
 exports.REQUEST_TIMEOUT = 60000; // 60 seconds in milliseconds
+// Upper bound for both the undici Pool's connection count and the adaptive
+// concurrency controller's ceiling, kept as one const so they never drift apart.
+// With pipelining:1, effective in-flight requests are capped by the pool's
+// connection count, so the controller must never ramp past it.
+exports.POOL_CONNECTIONS = 24;
 //# sourceMappingURL=constants.js.map

package/dist/core/package-detector.js

@@ -55,12 +55,14 @@ class PackageDetector {
     maxDepth;
     batchSize = 10;
     maxConcurrency = 10;
+    adaptive;
     constructor(options) {
         this.cwd = options?.cwd || process.cwd();
         this.excludePatterns = options?.excludePatterns || [];
         this.scanDirs = options?.scanDirs || [];
         this.ignorePackages = options?.ignorePackages || [];
         this.maxDepth = options?.maxDepth ?? 10;
+        this.adaptive = options?.adaptive ?? true;
         this.packageJsonPath = (0, utils_1.findPackageJson)(this.cwd);
         if (this.packageJsonPath) {
             this.packageJson = (0, utils_1.readPackageJson)(this.packageJsonPath);
@@ -69,6 +71,19 @@ class PackageDetector {
     hasPackageJson() {
         return this.packageJsonPath !== null && this.packageJson !== null;
     }
+    /**
+     * The resolved fetch configuration for this run, for perf logging. Exposes the
+     * exact values handed to the registry fetcher so a logged run is reproducible.
+     */
+    getPerfConfig() {
+        return {
+            cwd: this.cwd,
+            adaptive: this.adaptive,
+            maxConcurrency: this.maxConcurrency,
+            batchSize: this.batchSize,
+            poolConnections: config_1.POOL_CONNECTIONS,
+        };
+    }
     async getOutdatedPackages() {
         const packages = [];
         await this.streamOutdatedPackages((event) => {
@@ -109,6 +124,11 @@ class PackageDetector {
             currentVersions: prepared.currentVersions,
             batchSize: this.batchSize,
             maxConcurrency: this.maxConcurrency,
+            adaptive: this.adaptive,
+            onControlTick: (tick) => performanceTracker.recordControlTick(tick),
+            onPackageTiming: (0, debug_1.isPerfLoggingEnabled)()
+                ? (name, latencyMs) => performanceTracker.recordPackageTiming({ name, latencyMs })
+                : undefined,
             onBatchReady: (batch) => {
                 const batchStart = lastBatchEndAt;
                 let batchFailedCount = 0;

package/dist/core/upgrade-runner.js

@@ -92,6 +92,14 @@ class UpgradeRunner {
                         progress.isLoading = event.payload.progress.isLoading;
                         performanceTracker.mark('firstBatch');
                         performanceTracker.mark('allLoaded');
+                        if ((0, debug_1.isPerfLoggingEnabled)()) {
+                            (0, debug_1.writePerfLog)({
+                                ...this.detector.getPerfConfig(),
+                                packageManager: this.packageManager.name,
+                                mode: 'interactive',
+                                env: (0, debug_1.perfEnv)(),
+                            }, performanceTracker.snapshot());
+                        }
                         refreshUI?.();
                     }
                 });

package/dist/features/debug/index.js

@@ -16,5 +16,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./types/debug.types"), exports);
 __exportStar(require("./services/performance-tracker"), exports);
+__exportStar(require("./services/perf-logger"), exports);
 __exportStar(require("./renderer/performance-modal"), exports);
 //# sourceMappingURL=index.js.map

package/dist/features/debug/renderer/performance-modal.js

@@ -21,7 +21,7 @@ function labelValue(label, value, labelWidth = 22) {
     return `${chalk_1.default.white(padded)} ${value}`;
 }
 function buildSections(snapshot) {
-    const { phases, counts, batches, failedPackages, packageManager, totalMs } = snapshot;
+    const { phases, counts, batches, controlTicks, failedPackages, packageManager, totalMs } = snapshot;
     const pinned = [
         {
             key: 'header',
@@ -67,6 +67,22 @@ function buildSections(snapshot) {
         bodyRows.push(chalk_1.default.gray('  (no batches recorded)'));
     }
     bodyRows.push('');
+    bodyRows.push(chalk_1.default.bold('Concurrency'));
+    if (controlTicks.length > 0) {
+        const limits = controlTicks.map((t) => t.limit);
+        const finalTick = controlTicks[controlTicks.length - 1];
+        const hardDowns = controlTicks.filter((t) => t.reason === 'hard-down').length;
+        bodyRows.push(labelValue('Start limit', formatCount(controlTicks[0].limit)));
+        bodyRows.push(labelValue('Peak limit', formatCount(Math.max(...limits))));
+        bodyRows.push(labelValue('Final limit', formatCount(finalTick.limit)));
+        bodyRows.push(labelValue('Final EWMA', formatMs(finalTick.ewmaMs)));
+        bodyRows.push(labelValue('Control ticks', formatCount(controlTicks.length)));
+        bodyRows.push(labelValue('Hard back-offs', formatCount(hardDowns)));
+    }
+    else {
+        bodyRows.push(chalk_1.default.gray('  (fixed — adaptive off or run too small)'));
+    }
+    bodyRows.push('');
     bodyRows.push(chalk_1.default.bold('Failures'));
     if (failedPackages.length > 0) {
         for (const name of failedPackages) {

package/dist/features/debug/services/perf-logger.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPerfLoggingEnabled = isPerfLoggingEnabled;
+exports.perfEnv = perfEnv;
+exports.getPerfDir = getPerfDir;
+exports.writePerfLog = writePerfLog;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const adaptive_controller_1 = require("../../../services/http/adaptive-controller");
+/**
+ * Performance debug logger.
+ *
+ * When INUP_PERF=1, every run writes ONE self-contained JSON file capturing the
+ * full configuration plus the performance snapshot (phases, batches, adaptive
+ * control ticks, counts). The files accumulate in a gitignored directory so a
+ * series of runs can be diffed to find the best-performing configuration.
+ *
+ * Output location:
+ *  - Default: `<cwd>/.inup-perf` (logs next to the project being scanned).
+ *  - INUP_PERF_DIR=<path>: a single centralized directory (e.g. the inup repo)
+ *    so runs from many different projects collect in one place for analysis.
+ *    The project name is encoded into each filename so they stay distinct.
+ *
+ * Each file is independent: it records every input that could affect timing, so
+ * a run can be understood (and reproduced) without external context.
+ */
+const PERF_DIR_NAME = '.inup-perf';
+/** Filesystem-safe slug of a project name for use in filenames. */
+function projectSlug(cwd) {
+    const name = (0, path_1.basename)((0, path_1.resolve)(cwd)) || 'root';
+    return name.replace(/[^a-zA-Z0-9._-]/g, '-').slice(0, 40);
+}
+function isPerfLoggingEnabled() {
+    return process.env.INUP_PERF === '1';
+}
+/** Capture the env toggles that influence a run, for reproducibility. */
+function perfEnv() {
+    return {
+        INUP_ADAPTIVE: process.env.INUP_ADAPTIVE,
+        INUP_PERF: process.env.INUP_PERF,
+        INUP_DEBUG: process.env.INUP_DEBUG,
+        CI: process.env.CI,
+        NODE_ENV: process.env.NODE_ENV,
+    };
+}
+/**
+ * Resolve (and lazily create) the perf-log directory.
+ *
+ * - INUP_PERF_DIR set → that directory verbatim (centralized collection point,
+ *   e.g. the inup repo's .inup-perf). Relative paths resolve from cwd.
+ * - otherwise → `<cwd>/.inup-perf` (logs sit next to the scanned project).
+ */
+function getPerfDir(cwd = process.cwd()) {
+    const override = process.env.INUP_PERF_DIR;
+    const dir = override
+        ? (0, path_1.isAbsolute)(override)
+            ? override
+            : (0, path_1.resolve)(cwd, override)
+        : (0, path_1.join)(cwd, PERF_DIR_NAME);
+    if (!(0, fs_1.existsSync)(dir)) {
+        (0, fs_1.mkdirSync)(dir, { recursive: true });
+    }
+    return dir;
+}
+const pad = (n, width = 2) => String(n).padStart(width, '0');
+function fileStamp(d) {
+    return (`${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}` +
+        `-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}` +
+        `-${pad(d.getMilliseconds(), 3)}`);
+}
+/**
+ * Write one perf record to its own JSON file. Best-effort: never throws into the
+ * caller (a debugging aid must not break a real run). Returns the path written,
+ * or null if disabled or on failure.
+ */
+function writePerfLog(config, snapshot) {
+    if (!isPerfLoggingEnabled())
+        return null;
+    try {
+        const now = new Date();
+        const record = {
+            schemaVersion: 1,
+            timestamp: now.toISOString(),
+            wallMs: snapshot.totalMs,
+            config,
+            tuning: adaptive_controller_1.DEFAULT_TUNING,
+            snapshot,
+        };
+        const dir = getPerfDir(config.cwd);
+        const modeTag = config.mode;
+        const adaptiveTag = config.adaptive ? 'adaptive' : 'fixed';
+        // Project name in the filename keeps multi-project runs distinct when many
+        // collect into one centralized INUP_PERF_DIR.
+        const fileName = `run-${fileStamp(now)}-${projectSlug(config.cwd)}-${adaptiveTag}-${modeTag}.json`;
+        const filePath = (0, path_1.join)(dir, fileName);
+        (0, fs_1.writeFileSync)(filePath, JSON.stringify(record, null, 2));
+        // Maintain a stable pointer to the most recent run for quick reads.
+        (0, fs_1.writeFileSync)((0, path_1.join)(dir, 'latest.json'), JSON.stringify(record, null, 2));
+        // And a cheap one-line-per-run index for fast scanning.
+        appendPerfIndex(dir, record);
+        if (process.env.INUP_DEBUG === '1') {
+            process.stderr.write(`[inup] perf log → ${filePath}\n`);
+        }
+        return filePath;
+    }
+    catch {
+        // Never let perf logging affect the run.
+        return null;
+    }
+}
+/** Append a single line to a NDJSON index for ultra-cheap scanning, best-effort. */
+function appendPerfIndex(dir, record) {
+    try {
+        const line = JSON.stringify({
+            timestamp: record.timestamp,
+            wallMs: record.wallMs,
+            adaptive: record.config.adaptive,
+            mode: record.config.mode,
+            uniquePackages: record.snapshot.counts.uniquePackages,
+            registryFetch: record.snapshot.phases.registryFetch,
+            controlTicks: record.snapshot.controlTicks.length,
+        }) + '\n';
+        (0, fs_1.appendFileSync)((0, path_1.join)(dir, 'index.ndjson'), line);
+    }
+    catch {
+        /* best-effort */
+    }
+}
+//# sourceMappingURL=perf-logger.js.map

package/dist/features/debug/services/performance-tracker.js

@@ -6,6 +6,8 @@ class PerformanceTracker {
     phases = {};
     counts = {};
     batches = [];
+    controlTicks = [];
+    packageTimings = [];
     failedPackages = [];
     packageManager = null;
     start() {
@@ -13,6 +15,8 @@ class PerformanceTracker {
         this.phases = {};
         this.counts = {};
         this.batches = [];
+        this.controlTicks = [];
+        this.packageTimings = [];
         this.failedPackages = [];
         this.packageManager = null;
     }
@@ -30,6 +34,12 @@ class PerformanceTracker {
     recordBatch(batch) {
         this.batches.push(batch);
     }
+    recordControlTick(tick) {
+        this.controlTicks.push(tick);
+    }
+    recordPackageTiming(timing) {
+        this.packageTimings.push(timing);
+    }
     recordFailedPackage(name) {
         if (!this.failedPackages.includes(name)) {
             this.failedPackages.push(name);
@@ -39,15 +49,15 @@ class PerformanceTracker {
         this.packageManager = name;
     }
     snapshot() {
-        const totalMs = this.startedAt === null
-            ? null
-            : (this.phases.allLoaded ?? Date.now() - this.startedAt);
+        const totalMs = this.startedAt === null ? null : (this.phases.allLoaded ?? Date.now() - this.startedAt);
         return {
             startedAt: this.startedAt,
             phases: { ...this.phases },
             totalMs,
             counts: { ...this.counts },
             batches: [...this.batches],
+            controlTicks: [...this.controlTicks],
+            packageTimings: [...this.packageTimings],
             failedPackages: [...this.failedPackages],
             packageManager: this.packageManager,
         };
@@ -57,6 +67,8 @@ class PerformanceTracker {
         this.phases = {};
         this.counts = {};
         this.batches = [];
+        this.controlTicks = [];
+        this.packageTimings = [];
         this.failedPackages = [];
         this.packageManager = null;
     }

package/dist/features/headless/headless-runner.js

@@ -8,6 +8,7 @@ const chalk_1 = __importDefault(require("chalk"));
 const package_detector_1 = require("../../core/package-detector");
 const vulnerability_audit_1 = require("./vulnerability-audit");
 const report_1 = require("./report");
+const debug_1 = require("../../features/debug");
 /**
  * Non-interactive entry point. Resolves the outdated list without rendering the TUI, then either
  * emits a JSON report (--json) or a plain line-based report. With --check, sets a non-zero exit
@@ -26,8 +27,23 @@ class HeadlessRunner {
             if (!this.detector.hasPackageJson()) {
                 throw new Error('No package.json found in current directory');
             }
+            // Start perf tracking so headless runs produce clean timing data too
+            // (the interactive runner starts it itself; headless previously did not).
+            const perfEnabled = (0, debug_1.isPerfLoggingEnabled)();
+            const performanceTracker = (0, debug_1.getPerformanceTracker)();
+            if (perfEnabled)
+                performanceTracker.start();
             const packages = await this.detector.getOutdatedPackages();
             const outdated = this.detector.getOutdatedPackagesOnly(packages);
+            if (perfEnabled) {
+                performanceTracker.mark('allLoaded');
+                (0, debug_1.writePerfLog)({
+                    ...this.detector.getPerfConfig(),
+                    packageManager: null,
+                    mode: 'headless',
+                    env: (0, debug_1.perfEnv)(),
+                }, performanceTracker.snapshot());
+            }
             // Audit the current versions (one bulk request, best-effort) and cross-reference each
             // advisory against the upgrade targets, so the report says whether upgrading *fixes* it.
             const vulnerabilities = await (0, vulnerability_audit_1.auditVulnerabilities)(outdated);

package/dist/services/http/adaptive-controller.js

@@ -0,0 +1,153 @@
+"use strict";
+/**
+ * AIMD (additive-increase / multiplicative-decrease) concurrency controller.
+ *
+ * Mirrors the congestion-control family TCP uses. It performs no I/O and does not
+ * own the semaphore — it is a pure decision function: feed it the outcome of each
+ * request, and on each control tick it returns the next concurrency limit, which
+ * the caller applies to the resizable semaphore.
+ *
+ * Back-off signals (only real errors move the limit down):
+ *  - congestion (HTTP 429/503): the registry explicitly telling us to slow down →
+ *    immediate hard multiplicative-decrease (×hardDecreaseFactor), the moment the
+ *    signal arrives, not deferred to the next tick.
+ *  - retryable/transient errors in a tick window → soft multiplicative-decrease
+ *    (×softDecreaseFactor) and no increase.
+ *
+ * Otherwise (healthy link) the limit ramps additively (+increaseStep) toward the
+ * ceiling and holds there.
+ *
+ * NOTE on latency: we sample successful single-attempt latency into an EWMA, but
+ * it is used for *instrumentation only* — never to drive back-off. The npm
+ * registry is a CDN whose latency varies widely on a perfectly healthy link;
+ * reacting to that variance made the controller oscillate and lose to a fixed
+ * limit. Real congestion shows up as 429, which we handle directly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdaptiveController = exports.DEFAULT_TUNING = void 0;
+exports.DEFAULT_TUNING = {
+    floor: 6,
+    ceil: 24,
+    increaseStep: 4,
+    softDecreaseFactor: 0.7,
+    hardDecreaseFactor: 0.5,
+    ewmaAlpha: 0.3,
+    ticksEveryCompletions: 6,
+};
+const clamp = (value, lo, hi) => Math.max(lo, Math.min(hi, value));
+class AdaptiveController {
+    onTick;
+    tuning;
+    limit;
+    // EWMA of successful single-attempt latency. Kept for instrumentation only
+    // (the perf modal / logs); it does not drive concurrency decisions.
+    ewmaMs = 0;
+    hasEwma = false;
+    completionsSinceTick = 0;
+    retriesSinceTick = 0;
+    /**
+     * @param packageCount  number of packages this run will fetch; drives the smart
+     *                       initial limit so a run starts near its work size and
+     *                       ramps to the ceiling, rather than crawling up from the
+     *                       floor and losing to a fixed baseline.
+     * @param onTick        optional sink for control decisions (perf modal / logs).
+     * @param tuning        override the defaults (constants live in one place).
+     */
+    constructor(packageCount, onTick, tuning = {}) {
+        this.onTick = onTick;
+        this.tuning = { ...exports.DEFAULT_TUNING, ...tuning };
+        // Smart start: aim at the work size, clamped to [floor, ceil].
+        this.limit = clamp(Math.min(this.tuning.ceil, packageCount), this.tuning.floor, this.tuning.ceil);
+    }
+    /** Whether the controller should even run; tiny runs are better off fixed. */
+    static shouldControl(packageCount, tuning = {}) {
+        const ceil = tuning.ceil ?? exports.DEFAULT_TUNING.ceil;
+        // Nothing to ramp toward and no steady state to learn below the ceiling.
+        return packageCount > ceil;
+    }
+    getLimit() {
+        return this.limit;
+    }
+    /**
+     * Record a completed request. Returns a new limit to apply IMMEDIATELY when a
+     * congestion signal demands a hard back-off, otherwise null (the limit may
+     * still change at the next control tick — see `maybeTick`).
+     */
+    record(kind, latencyMs) {
+        this.completionsSinceTick++;
+        if (kind === 'success' && latencyMs !== undefined) {
+            this.sampleLatency(latencyMs);
+            return null;
+        }
+        if (kind === 'congested') {
+            this.retriesSinceTick++;
+            return this.applyHardDecrease();
+        }
+        // retryable / transient
+        this.retriesSinceTick++;
+        return null;
+    }
+    /**
+     * Call after each completion. If a control tick is due, computes and returns
+     * the next limit (and emits a ControlTick); otherwise returns null.
+     */
+    maybeTick(now = Date.now()) {
+        if (this.completionsSinceTick < this.tuning.ticksEveryCompletions) {
+            return null;
+        }
+        return this.tick(now);
+    }
+    sampleLatency(latencyMs) {
+        if (!this.hasEwma) {
+            this.ewmaMs = latencyMs;
+            this.hasEwma = true;
+        }
+        else {
+            const a = this.tuning.ewmaAlpha;
+            this.ewmaMs = a * latencyMs + (1 - a) * this.ewmaMs;
+        }
+    }
+    applyHardDecrease() {
+        const next = clamp(Math.round(this.limit * this.tuning.hardDecreaseFactor), this.tuning.floor, this.tuning.ceil);
+        this.limit = next;
+        this.emit('hard-down');
+        // A hard decrease resets the tick window so we don't immediately bump back up.
+        this.resetWindow();
+        return next;
+    }
+    tick(now) {
+        // Back off only on real errors seen since the last tick; otherwise ramp to
+        // the ceiling and hold (latency is not a signal — see the class docblock).
+        const retries = this.retriesSinceTick;
+        let reason;
+        if (retries > 0) {
+            this.limit = clamp(Math.round(this.limit * this.tuning.softDecreaseFactor), this.tuning.floor, this.tuning.ceil);
+            reason = 'soft-down';
+        }
+        else if (this.limit < this.tuning.ceil) {
+            this.limit = clamp(this.limit + this.tuning.increaseStep, this.tuning.floor, this.tuning.ceil);
+            reason = 'up';
+        }
+        else {
+            reason = 'hold';
+        }
+        this.emit(reason, now);
+        this.resetWindow();
+        return this.limit;
+    }
+    emit(reason, now = Date.now()) {
+        this.onTick?.({
+            atMs: now,
+            limit: this.limit,
+            ewmaMs: Math.round(this.ewmaMs),
+            retries: this.retriesSinceTick,
+            reason,
+        });
+    }
+    resetWindow() {
+        this.completionsSinceTick = 0;
+        this.retriesSinceTick = 0;
+    }
+}
+exports.AdaptiveController = AdaptiveController;
+//# sourceMappingURL=adaptive-controller.js.map

package/dist/services/http/etag-store.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setEtagCacheEnabled = setEtagCacheEnabled;
+exports.readEtag = readEtag;
+exports.writeEtag = writeEtag;
+exports.etagCacheDir = etagCacheDir;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+/** Bump when the on-disk entry shape changes; old generations are ignored. */
+const SCHEMA = 'v1';
+/** Entries untouched for longer than this are swept on first access. */
+const MAX_AGE_MS = 14 * 24 * 60 * 60 * 1000; // 14 days
+let enabled = true;
+let sweptThisProcess = false;
+/** Allow tests/callers to toggle the store without touching call sites. */
+function setEtagCacheEnabled(value) {
+    enabled = value;
+}
+/** Resolve (and lazily create) the cache directory, sweeping stale entries once. */
+function cacheDir() {
+    // Version data is not project-specific, so it lives in the OS temp area, shared
+    // across every project the user scans.
+    const dir = (0, node_path_1.join)((0, node_os_1.tmpdir)(), 'inup', 'etag-cache', SCHEMA);
+    if (!(0, node_fs_1.existsSync)(dir)) {
+        (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    }
+    if (!sweptThisProcess) {
+        sweptThisProcess = true;
+        sweepStale(dir);
+    }
+    return dir;
+}
+/** Delete entries not modified within MAX_AGE_MS. Best-effort, runs once. */
+function sweepStale(dir) {
+    try {
+        const cutoff = Date.now() - MAX_AGE_MS;
+        for (const name of (0, node_fs_1.readdirSync)(dir)) {
+            const file = (0, node_path_1.join)(dir, name);
+            try {
+                if ((0, node_fs_1.statSync)(file).mtimeMs < cutoff)
+                    (0, node_fs_1.unlinkSync)(file);
+            }
+            catch {
+                /* skip files we can't stat/remove */
+            }
+        }
+    }
+    catch {
+        /* sweeping is optional; never fail a run over it */
+    }
+}
+/** Stable, filesystem-safe filename for a cache key (the registry path). */
+function fileFor(key) {
+    const hash = (0, node_crypto_1.createHash)('sha1').update(key).digest('hex');
+    return (0, node_path_1.join)(cacheDir(), `${hash}.json`);
+}
+/** Read a stored entry, or null if absent/unreadable/disabled. */
+function readEtag(key) {
+    if (!enabled)
+        return null;
+    try {
+        const file = fileFor(key);
+        if (!(0, node_fs_1.existsSync)(file))
+            return null;
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(file, 'utf8'));
+        if (!parsed || typeof parsed.etag !== 'string' || !parsed.data)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/** Persist an entry. Best-effort; failures are ignored. */
+function writeEtag(key, etag, data) {
+    if (!enabled || !etag)
+        return;
+    try {
+        (0, node_fs_1.writeFileSync)(fileFor(key), JSON.stringify({ etag, data }));
+    }
+    catch {
+        /* best-effort */
+    }
+}
+/** Test/maintenance helper: the resolved cache directory. */
+function etagCacheDir() {
+    return cacheDir();
+}
+//# sourceMappingURL=etag-store.js.map