sdkproof 0.1.0

package/dist/models.js

@@ -0,0 +1,186 @@
+import { FatalApiError, RefusalError } from "./core/model.js";
+/** Stochastic refusals on benign SDK tasks; re-sample the same prompt this many times. */
+const REFUSAL_ATTEMPTS = 4;
+/** Transient server errors (529 overloaded, 429 rate limit) — retried with backoff. */
+const TRANSIENT_ATTEMPTS = 5;
+/**
+ * Set once a fatal error is seen, so in-flight siblings fail instantly instead
+ * of each making its own doomed request.
+ */
+let fatal = null;
+/** Reset between runs; only the test suite and long-lived embeddings need this. */
+export function clearFatal() {
+    fatal = null;
+}
+export class ApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = "ApiError";
+    }
+}
+async function post(url, headers, body, timeoutMs) {
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), timeoutMs);
+    try {
+        const res = await fetch(url, {
+            method: "POST",
+            headers: { "content-type": "application/json", ...headers },
+            body: JSON.stringify(body),
+            signal: ac.signal,
+        });
+        const text = await res.text();
+        if (!res.ok)
+            throw new ApiError(res.status, `${res.status} ${text.slice(0, 400)}`);
+        return JSON.parse(text);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Retry the transient failures and stop dead on the terminal ones.
+ *
+ * A 529/429 is the API being busy, not the model saying anything. Left
+ * unretried it drops a task from the run — and a dropped task silently shrinks
+ * the denominator, which on 2026-08-05 scored a context arm HIGHER than bare
+ * simply because overload took its hardest tasks away. A 401/403, or a 400
+ * about billing, is terminal for every remaining request: retrying it just
+ * spends the rest of the run failing.
+ */
+async function withRetry(fn) {
+    for (let t = 1;; t++) {
+        if (fatal)
+            throw new FatalApiError(fatal);
+        try {
+            return await fn();
+        }
+        catch (e) {
+            const status = e instanceof ApiError ? e.status : 0;
+            const msg = String(e.message ?? "");
+            if (status === 401 || status === 403 || (status === 400 && /credit balance|billing|quota/i.test(msg))) {
+                fatal = msg.slice(0, 200);
+                throw new FatalApiError(fatal);
+            }
+            const transient = status === 429 || status >= 500 || /aborted|ETIMEDOUT|ECONNRESET|fetch failed/i.test(msg);
+            if (!transient || t === TRANSIENT_ATTEMPTS)
+                throw e;
+            await new Promise((r) => setTimeout(r, 1500 * 2 ** (t - 1)));
+        }
+    }
+}
+/**
+ * Claude adapter over the raw Messages API — no SDK, so `npx sdkproof` installs
+ * one dependency (typescript) instead of a tree.
+ *
+ * ANTHROPIC_AUTH_TOKEN is accepted alongside ANTHROPIC_API_KEY because an OAuth
+ * token from a Claude subscription is the key most people already have.
+ */
+export function anthropicAdapter(model) {
+    const base = process.env.ANTHROPIC_BASE_URL ?? "https://api.anthropic.com";
+    const key = process.env.ANTHROPIC_API_KEY;
+    const token = process.env.ANTHROPIC_AUTH_TOKEN;
+    return {
+        id: model,
+        async generate({ system, user, maxTokens = 16000 }) {
+            if (fatal)
+                throw new FatalApiError(fatal);
+            // Both guards below exist because either failure used to arrive as an
+            // EMPTY candidate, and an empty file compiles clean — so a generation
+            // failure was scored as a perfect answer. Found 2026-08-04 on the first
+            // Stripe run, which reported 100/100 with four of fifteen candidates blank.
+            for (let attempt = 1; attempt <= REFUSAL_ATTEMPTS; attempt++) {
+                const res = await withRetry(() => post(`${base}/v1/messages`, {
+                    "anthropic-version": "2023-06-01",
+                    ...(key ? { "x-api-key": key } : {}),
+                    ...(token ? { authorization: `Bearer ${token}` } : {}),
+                }, { model, max_tokens: maxTokens, system, messages: [{ role: "user", content: user }] }, 300_000));
+                // A truncated completion loses its closing fence, so extraction returns
+                // a fragment or nothing. That is a harness problem, not model drift.
+                if (res.stop_reason === "max_tokens") {
+                    throw new Error(`generation truncated at max_tokens=${maxTokens} — raise it with --max-tokens or shorten the task`);
+                }
+                // Refusals are stochastic on ordinary SDK tasks: measured 2026-08-04,
+                // the same Stripe prompts came back refusal/end_turn/end_turn and
+                // end_turn/refusal/end_turn across three trials, including a task that
+                // just lists customers. Re-sampling the identical prompt is the honest
+                // response — the prompt is not reworded to avoid the classifier, and a
+                // task that refuses every time still fails rather than scoring.
+                if (res.stop_reason === "refusal") {
+                    if (attempt === REFUSAL_ATTEMPTS)
+                        throw new RefusalError(REFUSAL_ATTEMPTS);
+                    continue;
+                }
+                const blocks = (res.content ?? []);
+                return blocks.filter((b) => b.type === "text").map((b) => b.text ?? "").join("\n");
+            }
+            throw new Error("unreachable");
+        },
+    };
+}
+/** GPT adapter over the raw Chat Completions API. */
+export function openaiAdapter(model) {
+    const base = process.env.OPENAI_BASE_URL ?? "https://api.openai.com/v1";
+    return {
+        id: model,
+        async generate({ system, user, maxTokens = 16000 }) {
+            if (fatal)
+                throw new FatalApiError(fatal);
+            const res = await withRetry(() => post(`${base}/chat/completions`, { authorization: `Bearer ${process.env.OPENAI_API_KEY ?? ""}` }, {
+                model,
+                max_completion_tokens: maxTokens,
+                messages: [
+                    { role: "system", content: system },
+                    { role: "user", content: user },
+                ],
+            }, 300_000));
+            const choice = res.choices?.[0];
+            // Same guard as Anthropic's max_tokens: a cut-off completion is a harness
+            // failure, and it must not reach verify() as an empty candidate.
+            if (choice?.finish_reason === "length") {
+                throw new Error(`generation truncated at max_completion_tokens=${maxTokens} — raise it with --max-tokens or shorten the task`);
+            }
+            if (choice?.message?.refusal) {
+                throw new RefusalError(1);
+            }
+            return choice?.message?.content ?? "";
+        },
+    };
+}
+export const DEFAULT_ANTHROPIC_MODEL = process.env.SDKPROOF_ANTHROPIC_MODEL ?? "claude-opus-5";
+export const DEFAULT_OPENAI_MODEL = process.env.SDKPROOF_OPENAI_MODEL ?? "gpt-5";
+/**
+ * Turn a `--model` value into a provider + model id. Accepts an explicit
+ * `anthropic:<id>` / `openai:<id>`, or a bare id whose provider is inferred
+ * from its prefix — so `--model claude-sonnet-5` and `--model gpt-5` both work.
+ */
+export function parseModelRef(value) {
+    const [head, ...rest] = value.split(":");
+    if (rest.length && (head === "anthropic" || head === "openai")) {
+        return { provider: head, model: rest.join(":") };
+    }
+    if (/^claude/i.test(value))
+        return { provider: "anthropic", model: value };
+    if (/^(gpt|o\d)/i.test(value))
+        return { provider: "openai", model: value };
+    throw new Error(`cannot tell which provider "${value}" belongs to — write it as anthropic:<id> or openai:<id>`);
+}
+export function adapterFor(ref) {
+    return ref.provider === "anthropic" ? anthropicAdapter(ref.model) : openaiAdapter(ref.model);
+}
+export function hasKeyFor(provider) {
+    return provider === "anthropic"
+        ? Boolean(process.env.ANTHROPIC_API_KEY || process.env.ANTHROPIC_AUTH_TOKEN)
+        : Boolean(process.env.OPENAI_API_KEY);
+}
+/** Every model the environment holds a key for, when --model was not given. */
+export function defaultAdapters() {
+    const out = [];
+    if (hasKeyFor("anthropic"))
+        out.push(anthropicAdapter(DEFAULT_ANTHROPIC_MODEL));
+    if (hasKeyFor("openai"))
+        out.push(openaiAdapter(DEFAULT_OPENAI_MODEL));
+    return out;
+}
+//# sourceMappingURL=models.js.map

package/dist/models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE9D,0FAA0F;AAC1F,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,uFAAuF;AACvF,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B;;;GAGG;AACH,IAAI,KAAK,GAAkB,IAAI,CAAC;AAEhC,mFAAmF;AACnF,MAAM,UAAU,UAAU;IACxB,KAAK,GAAG,IAAI,CAAC;AACf,CAAC;AAED,MAAM,OAAO,QAAS,SAAQ,KAAK;IACZ,MAAM;IAA3B,YAAqB,MAAc,EAAE,OAAe;QAClD,KAAK,CAAC,OAAO,CAAC,CAAC;sBADI,MAAM;QAEzB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,OAA+B,EAAE,IAAa,EAAE,SAAiB;IAChG,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;YAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,SAAS,CAAI,EAAoB;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,GAAI,CAAC,EAAE,EAAE,CAAC;QACtB,IAAI,KAAK;YAAE,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,CAAC,YAAY,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,MAAM,CAAE,CAAW,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAC/C,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACtG,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC1B,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,IAAI,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5G,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,kBAAkB;gBAAE,MAAM,CAAC,CAAC;YACpD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,2BAA2B,CAAC;IAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC/C,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,KAAK,EAAmB;YACjE,IAAI,KAAK;gBAAE,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC;YAC1C,sEAAsE;YACtE,sEAAsE;YACtE,wEAAwE;YACxE,4EAA4E;YAC5E,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;gBAC7D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAC/B,IAAI,CACF,GAAG,IAAI,cAAc,EACrB;oBACE,mBAAmB,EAAE,YAAY;oBACjC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,EACD,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,EACrF,OAAO,CACR,CACF,CAAC;gBAEF,wEAAwE;gBACxE,qEAAqE;gBACrE,IAAI,GAAG,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;oBACrC,MAAM,IAAI,KAAK,CACb,sCAAsC,SAAS,mDAAmD,CACnG,CAAC;gBACJ,CAAC;gBAED,sEAAsE;gBACtE,kEAAkE;gBAClE,uEAAuE;gBACvE,uEAAuE;gBACvE,uEAAuE;gBACvE,gEAAgE;gBAChE,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;oBAClC,IAAI,OAAO,KAAK,gBAAgB;wBAAE,MAAM,IAAI,YAAY,CAAC,gBAAgB,CAAC,CAAC;oBAC3E,SAAS;gBACX,CAAC;gBAED,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAA2C,CAAC;gBAC7E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,2BAA2B,CAAC;IACxE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,KAAK,EAAmB;YACjE,IAAI,KAAK;gBAAE,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAC/B,IAAI,CACF,GAAG,IAAI,mBAAmB,EAC1B,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,EAAE,EAAE,EAC/D;gBACE,KAAK;gBACL,qBAAqB,EAAE,SAAS;gBAChC,QAAQ,EAAE;oBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;oBACnC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;iBAChC;aACF,EACD,OAAO,CACR,CACF,CAAC;YACF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAChC,0EAA0E;YAC1E,iEAAiE;YACjE,IAAI,MAAM,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,iDAAiD,SAAS,mDAAmD,CAC9G,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;gBAC7B,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO,MAAM,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAOD,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,eAAe,CAAC;AAC/F,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,OAAO,CAAC;AAEjF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC3E,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC3E,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,0DAA0D,CAC/F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAa;IACtC,OAAO,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAA8B;IACtD,OAAO,QAAQ,KAAK,WAAW;QAC7B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC5E,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,IAAI,SAAS,CAAC,WAAW,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAChF,IAAI,SAAS,CAAC,QAAQ,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,65 @@
+/**
+ * npm registry access, with no dependencies. Everything here is one GET against
+ * registry.npmjs.org and some arithmetic on the packument — no `npm` process,
+ * no semver package.
+ */
+export interface Packument {
+    name: string;
+    "dist-tags": Record<string, string>;
+    versions: Record<string, VersionMeta>;
+    time: Record<string, string>;
+    readme?: string;
+    description?: string;
+    repository?: {
+        url?: string;
+    } | string;
+    homepage?: string;
+}
+export interface VersionMeta {
+    name: string;
+    version: string;
+    description?: string;
+    types?: string;
+    typings?: string;
+    readme?: string;
+    dependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+    peerDependenciesMeta?: Record<string, {
+        optional?: boolean;
+    }>;
+    deprecated?: string;
+    dist?: {
+        tarball: string;
+    };
+    exports?: unknown;
+}
+export declare function fetchPackument(name: string): Promise<Packument>;
+/** Stable releases only — a prerelease is not what a user installs. */
+export declare function stableVersions(p: Packument): string[];
+export declare function compareVersions(a: string, b: string): number;
+/**
+ * Resolve what the user typed after the `@`. Accepts an exact version, a
+ * dist-tag (`latest`, `next`), a major (`4`) or a major.minor (`4.2`), and
+ * nothing at all — which means the `latest` tag, i.e. what `npm i pkg` gives.
+ */
+export declare function resolveVersion(p: Packument, spec?: string): string;
+export interface MajorLine {
+    major: number;
+    /** ISO date the first release in this major line was published */
+    first: string;
+    /** highest stable version in the line */
+    latest: string;
+}
+/** Every stable major line, oldest first, with the date the major landed. */
+export declare function majorLines(p: Packument): MajorLine[];
+export declare function monthsSince(iso: string): number;
+/**
+ * The README as published for a specific version. The packument carries the
+ * README of the latest release at the top level, which is the wrong document
+ * when an older version is being scored — so the per-version copy wins when the
+ * registry has one.
+ */
+export declare function readmeFor(p: Packument, version: string): string;
+/** The peers a consumer is expected to install themselves, optional ones dropped. */
+export declare function requiredPeers(meta: VersionMeta): string[];
+export declare function repoUrl(p: Packument): string | undefined;

package/dist/registry.js

@@ -0,0 +1,98 @@
+/**
+ * npm registry access, with no dependencies. Everything here is one GET against
+ * registry.npmjs.org and some arithmetic on the packument — no `npm` process,
+ * no semver package.
+ */
+const REGISTRY = process.env.SDKPROOF_REGISTRY ?? "https://registry.npmjs.org";
+export async function fetchPackument(name) {
+    // The scope slash must survive; only the name itself is escaped.
+    const url = `${REGISTRY}/${name.replace(/\//g, "%2f")}`;
+    const res = await fetch(url, { headers: { accept: "application/json" } });
+    if (res.status === 404)
+        throw new Error(`no such package on npm: ${name}`);
+    if (!res.ok)
+        throw new Error(`registry error for ${name}: ${res.status} ${res.statusText}`);
+    return (await res.json());
+}
+/** Stable releases only — a prerelease is not what a user installs. */
+export function stableVersions(p) {
+    return Object.keys(p.versions)
+        .filter((v) => /^\d+\.\d+\.\d+$/.test(v))
+        .sort(compareVersions);
+}
+export function compareVersions(a, b) {
+    const pa = a.split(".").map(Number);
+    const pb = b.split(".").map(Number);
+    for (let i = 0; i < 3; i++)
+        if (pa[i] !== pb[i])
+            return pa[i] - pb[i];
+    return 0;
+}
+/**
+ * Resolve what the user typed after the `@`. Accepts an exact version, a
+ * dist-tag (`latest`, `next`), a major (`4`) or a major.minor (`4.2`), and
+ * nothing at all — which means the `latest` tag, i.e. what `npm i pkg` gives.
+ */
+export function resolveVersion(p, spec) {
+    const stable = stableVersions(p);
+    if (!spec || spec === "latest") {
+        const tag = p["dist-tags"]?.latest;
+        if (tag)
+            return tag;
+        if (!stable.length)
+            throw new Error(`${p.name} has no stable release`);
+        return stable[stable.length - 1];
+    }
+    if (p["dist-tags"]?.[spec])
+        return p["dist-tags"][spec];
+    if (p.versions[spec])
+        return spec;
+    if (/^\d+(\.\d+)?$/.test(spec)) {
+        const matches = stable.filter((v) => v === spec || v.startsWith(`${spec}.`));
+        if (matches.length)
+            return matches[matches.length - 1];
+    }
+    throw new Error(`${p.name} has no version matching "${spec}"`);
+}
+/** Every stable major line, oldest first, with the date the major landed. */
+export function majorLines(p) {
+    const byMajor = new Map();
+    for (const v of stableVersions(p)) {
+        const major = Number(v.split(".")[0]);
+        const published = p.time?.[v];
+        const cur = byMajor.get(major);
+        if (!cur) {
+            byMajor.set(major, { major, first: published ?? "", latest: v });
+            continue;
+        }
+        if (compareVersions(v, cur.latest) > 0)
+            cur.latest = v;
+        if (published && (!cur.first || new Date(published) < new Date(cur.first)))
+            cur.first = published;
+    }
+    return [...byMajor.values()].sort((a, b) => a.major - b.major);
+}
+export function monthsSince(iso) {
+    if (!iso)
+        return Infinity;
+    return (Date.now() - new Date(iso).getTime()) / (1000 * 60 * 60 * 24 * 30.44);
+}
+/**
+ * The README as published for a specific version. The packument carries the
+ * README of the latest release at the top level, which is the wrong document
+ * when an older version is being scored — so the per-version copy wins when the
+ * registry has one.
+ */
+export function readmeFor(p, version) {
+    return p.versions[version]?.readme ?? (version === p["dist-tags"]?.latest ? p.readme ?? "" : "");
+}
+/** The peers a consumer is expected to install themselves, optional ones dropped. */
+export function requiredPeers(meta) {
+    const peers = meta.peerDependencies ?? {};
+    return Object.keys(peers).filter((name) => !meta.peerDependenciesMeta?.[name]?.optional);
+}
+export function repoUrl(p) {
+    const r = typeof p.repository === "string" ? p.repository : p.repository?.url;
+    return r?.replace(/^git\+/, "").replace(/\.git$/, "");
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,4BAA4B,CAAC;AA4B/E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,iEAAiE;IACjE,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5F,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAc,CAAC;AACzC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,CAAY;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SACxC,IAAI,CAAC,eAAe,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,CAAY,EAAE,IAAa;IACxD,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QACnC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,wBAAwB,CAAC,CAAC;QACvE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;QAC7E,IAAI,OAAO,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,6BAA6B,IAAI,GAAG,CAAC,CAAC;AACjE,CAAC;AAUD,6EAA6E;AAC7E,MAAM,UAAU,UAAU,CAAC,CAAY;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,IAAI,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QACvD,IAAI,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAAE,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC;IACpG,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,CAAY,EAAE,OAAe;IACrD,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,IAAiB;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,CAAY;IAClC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/dist/report.d.ts

@@ -0,0 +1,26 @@
+import type { Result } from "./core/types.ts";
+import type { TaskSet } from "./tasks.ts";
+import { type DriftReport } from "./drift.ts";
+export interface RunContext {
+    packageName: string;
+    version: string;
+    taskSet: TaskSet;
+    drift?: DriftReport;
+    /** modules installed on top of the target to make it type-check */
+    extraInstalls: string[];
+}
+/**
+ * What the run found, for a terminal.
+ *
+ * Findings lead and the score follows, because the score is the part nobody
+ * acts on. Across this project's own distribution, findings pages drew ~10x the
+ * traffic of scorecards and no one has ever written in about a number.
+ */
+export declare function renderTerminal(r: Result, ctx: RunContext): string;
+/** The same run as a markdown report, for pasting into an issue or a thread. */
+export declare function renderMarkdown(r: Result, ctx: RunContext): string;
+/** Drift mode's own output — no model was called, so there is no score. */
+export declare function renderDrift(d: DriftReport, verdict: {
+    worth: boolean;
+    reason: string;
+}): string;

package/dist/report.js

@@ -0,0 +1,240 @@
+import { fmtInterval, rates } from "./core/stats.js";
+import { headlineRemovals, headlineSource } from "./drift.js";
+const BAR = "─".repeat(60);
+function firstLibraryError(v) {
+    return v.errors.find((e) => e.libraryRelated) ?? v.errors[0];
+}
+/**
+ * What the run found, for a terminal.
+ *
+ * Findings lead and the score follows, because the score is the part nobody
+ * acts on. Across this project's own distribution, findings pages drew ~10x the
+ * traffic of scorecards and no one has ever written in about a number.
+ */
+export function renderTerminal(r, ctx) {
+    const out = [];
+    const failed = r.verdicts.filter((v) => !v.passed);
+    const passed = r.verdicts.filter((v) => v.passed).length;
+    out.push("");
+    out.push(BAR);
+    // Counts, not a percentage. "0 of 3 compiled" is a claim a reader can check;
+    // "0/100" reads as a grade the tool handed out, and a bare percentage hides
+    // how small the denominator is.
+    out.push(`  ${ctx.packageName}@${ctx.version} — ${passed} of ${r.verdicts.length} answers compiled`);
+    out.push(BAR);
+    if (r.lost?.length) {
+        const ids = [...new Set(r.lost.map((l) => l.taskId))].join(", ");
+        out.push("");
+        out.push(`  INCOMPLETE RUN — ${r.lost.length} task(s) never generated: ${ids}`);
+        out.push("  These are not refusals; the request never landed. The denominator");
+        out.push("  below is smaller than the task set, so do not publish this number.");
+    }
+    out.push("");
+    for (const m of r.perModel) {
+        const refused = r.refusals.filter((x) => x.model === m.model).length;
+        const s = rates({ passed: m.passed, scored: m.total, refused });
+        out.push(`  ${m.model.padEnd(24)} ${String(m.passed).padStart(2)}/${String(m.total).padEnd(3)} ` +
+            `compiled  (${s.conditional.pct}%, 95% CI ${fmtInterval(s.conditional.ci)})`);
+        if (refused) {
+            out.push(`  ${" ".repeat(24)} ${refused} refused — unmeasured, not drift; ` +
+                `${s.unconditional.pct}% of everything asked`);
+        }
+    }
+    if (failed.length) {
+        out.push("");
+        out.push("  WHAT BROKE");
+        out.push("");
+        for (const v of failed) {
+            const e = firstLibraryError(v);
+            const task = ctx.taskSet.tasks.find((t) => t.id === v.taskId);
+            out.push(`  ${v.taskId}${task ? `  (${task.area}, ${task.difficulty})` : ""}`);
+            if (e)
+                out.push(`    ${e.code}: ${truncate(e.message, 140)}`);
+            const extra = v.errors.length - 1;
+            if (extra > 0)
+                out.push(`    +${extra} more diagnostic${extra === 1 ? "" : "s"}`);
+            out.push("");
+        }
+    }
+    else {
+        out.push("");
+        out.push("  Every candidate compiled. Nothing drifted on this task set.");
+        out.push("");
+    }
+    if (r.failurePatterns.length) {
+        out.push("  FAILURE PATTERNS");
+        for (const p of r.failurePatterns) {
+            out.push(`    ${p.category.padEnd(24)} ${p.count}x`);
+        }
+        out.push("");
+    }
+    const headline = ctx.drift ? headlineRemovals(ctx.drift) : [];
+    if (ctx.drift && headline.length) {
+        const d = ctx.drift;
+        out.push(`  DRIFT SURFACE  v${d.from.major} -> v${d.to.major}: ` +
+            `${headline.length} ${headlineSource(d)}`);
+        out.push(`    ${headline.slice(0, 12).map(symbolLabel).join(", ")}${headline.length > 12 ? " ..." : ""}`);
+        out.push("");
+    }
+    if (ctx.taskSet.rejected.length) {
+        out.push(`  ${ctx.taskSet.rejected.length} synthesized task(s) rejected before the run:`);
+        for (const x of ctx.taskSet.rejected.slice(0, 5))
+            out.push(`    ${x.id}: ${x.reason}`);
+        out.push("");
+    }
+    out.push("  Pass means it compiled against the real installed package.");
+    out.push("  No model judged another model; tsc decided.");
+    out.push("");
+    return out.join("\n");
+}
+/** `default` is a real removed export (zustand v5 dropped it) but reads as a typo. */
+function symbolLabel(s) {
+    return s === "default" ? "default export" : s;
+}
+function truncate(s, n) {
+    return s.length <= n ? s : `${s.slice(0, n - 1)}…`;
+}
+/** The same run as a markdown report, for pasting into an issue or a thread. */
+export function renderMarkdown(r, ctx) {
+    const lines = [];
+    const failed = r.verdicts.filter((v) => !v.passed);
+    lines.push(`# ${ctx.packageName} v${ctx.version} — SDKProof run`);
+    lines.push("");
+    lines.push(`**Generated:** ${r.generatedAt}  `);
+    lines.push(`**Method:** every answer is type-checked against the real installed package with \`tsc\`. Pass = it compiles. No model judges another model.  `);
+    lines.push(`**Tasks:** ${ctx.taskSet.tasks.length} (${ctx.taskSet.source === "synthesized" ? "written from the package README at this version" : ctx.taskSet.source})`);
+    lines.push("");
+    if (r.lost?.length) {
+        lines.push(`> **Incomplete run — ${r.lost.length} task(s) never generated** (${[...new Set(r.lost.map((l) => l.taskId))].join(", ")}). ` +
+            `Not refusals: generation errored before any code existed, so the denominator is smaller than the task set. ` +
+            `A partial run that loses the hardest tasks scores higher than the real one — do not publish this number.`);
+        lines.push("");
+    }
+    lines.push(`## ${r.verdicts.filter((v) => v.passed).length} of ${r.verdicts.length} answers compiled`);
+    lines.push("");
+    lines.push("**Conditional API correctness** = passes / completions that produced code. " +
+        "**Unconditional task success** = passes / every task asked, refusals included. " +
+        "Ranges are Wilson 95% intervals.");
+    lines.push("");
+    lines.push("| Model | Conditional | Unconditional | Passed | Scored | Refused |");
+    lines.push("|---|---:|---:|---:|---:|---:|");
+    for (const m of r.perModel) {
+        const refused = r.refusals.filter((x) => x.model === m.model).length;
+        const s = rates({ passed: m.passed, scored: m.total, refused });
+        lines.push(`| ${m.model} | ${s.conditional.pct}% (${fmtInterval(s.conditional.ci)}) | ` +
+            `${s.unconditional.pct}% (${fmtInterval(s.unconditional.ci)}) | ${m.passed} | ${m.total} | ${refused || "—"} |`);
+    }
+    lines.push("");
+    if (failed.length) {
+        lines.push("## What broke");
+        lines.push("");
+        for (const v of failed) {
+            const task = ctx.taskSet.tasks.find((t) => t.id === v.taskId);
+            lines.push(`### \`${v.taskId}\`${task ? ` — ${task.area}, ${task.difficulty}` : ""}`);
+            lines.push("");
+            if (task) {
+                lines.push(`> ${task.prompt}`);
+                lines.push("");
+            }
+            lines.push("```");
+            for (const e of v.errors.slice(0, 8)) {
+                lines.push(`${e.line}:${e.column}  error ${e.code}: ${e.message}`);
+            }
+            if (v.errors.length > 8)
+                lines.push(`… ${v.errors.length - 8} more`);
+            lines.push("```");
+            lines.push("");
+        }
+    }
+    else {
+        lines.push("Every candidate compiled. Nothing on this task set drifted.");
+        lines.push("");
+    }
+    if (r.failurePatterns.length) {
+        lines.push("## Failure patterns");
+        lines.push("");
+        lines.push("| Category | Count | Example |");
+        lines.push("|---|---:|---|");
+        for (const p of r.failurePatterns) {
+            lines.push(`| ${p.category} | ${p.count} | \`${p.example.taskId}\`: ${p.example.message.replace(/\|/g, "\\|").slice(0, 120)} |`);
+        }
+        lines.push("");
+    }
+    if (ctx.drift) {
+        const d = ctx.drift;
+        lines.push(`## Drift surface — v${d.from.major} → v${d.to.major}`);
+        lines.push("");
+        const shown = headlineRemovals(d);
+        lines.push(`Comparing \`${d.from.version}\` with \`${d.to.version}\`: ${shown.length} ${headlineSource(d)}. ` +
+            `(${d.removedFromEntry.length} left the entrypoint in all; ${d.removed.length} removed under the wider \`${d.mode}\` diff.)`);
+        lines.push("");
+        if (shown.length) {
+            lines.push("```");
+            lines.push(shown.map(symbolLabel).join("\n"));
+            lines.push("```");
+            lines.push("");
+        }
+    }
+    if (ctx.extraInstalls.length) {
+        lines.push(`_Sandbox: \`${ctx.packageName}@${ctx.version}\` plus ${ctx.extraInstalls.join(", ")}, ` +
+            `type-checked under \`strict\` with \`skipLibCheck\`._`);
+        lines.push("");
+    }
+    lines.push("---");
+    lines.push("");
+    lines.push("Generated by [SDKProof](https://sdkproof.dev) — `npx sdkproof " + ctx.packageName + "`");
+    return lines.join("\n");
+}
+/** Drift mode's own output — no model was called, so there is no score. */
+export function renderDrift(d, verdict) {
+    const out = [];
+    const headline = headlineRemovals(d);
+    out.push("");
+    out.push(BAR);
+    out.push(`  ${d.package}  v${d.from.version} -> v${d.to.version}`);
+    out.push(BAR);
+    out.push("");
+    out.push(`  v${d.to.major} landed ${d.majorAgeMonths.toFixed(0)} months ago`);
+    out.push(`  ${d.fromCount} exported symbols -> ${d.toCount}  (${d.mode} diff)`);
+    out.push("");
+    if (headline.length) {
+        out.push(`  WHAT LEFT (${headline.length}) — ${headlineSource(d)}`);
+        out.push(`  This is what a model trained on v${d.from.major} will still write.`);
+        out.push("");
+        for (const s of headline.slice(0, 40))
+            out.push(`    ${symbolLabel(s)}`);
+        if (headline.length > 40)
+            out.push(`    ... ${headline.length - 40} more`);
+        out.push("");
+    }
+    const deprecatedFirst = d.removed.filter((s) => !d.withoutRunway.includes(s));
+    if (deprecatedFirst.length) {
+        out.push(`  Deprecated first, then removed (${deprecatedFirst.length}) — these rarely produce drift:`);
+        out.push(`    ${deprecatedFirst.slice(0, 20).map(symbolLabel).join(", ")}${deprecatedFirst.length > 20 ? " ..." : ""}`);
+        out.push("");
+    }
+    const rest = d.removedFromEntry.length - headline.length;
+    if (d.documentedRemovals.length && rest > 0) {
+        out.push(`  (${d.removedFromEntry.length} exports left the entrypoint in total. The ` +
+            `${d.documentedRemovals.length} above ${d.documentedRemovals.length === 1 ? "is the one" : "are the ones"} ` +
+            `v${d.from.major}'s own README taught people to write; the rest are mostly types.)`);
+        out.push("");
+    }
+    else if (d.valueRemovals.length && rest > 0) {
+        out.push(`  (${rest} type-only export(s) also left the entrypoint. They are listed in --json; ` +
+            `a model writes a hook far more often than it writes a type name.)`);
+        out.push("");
+    }
+    else if (d.mode === "all-dts" && d.removedFromEntry.length < d.withoutRunway.length) {
+        out.push(`  (${d.withoutRunway.length} symbols vanished across every .d.ts in the package, but only the ` +
+            `${d.removedFromEntry.length} above were reachable from the entrypoint. The rest are internals.)`);
+        out.push("");
+    }
+    out.push(`  ${verdict.worth ? "WORTH SCORING" : "NOT WORTH SCORING"} — ${verdict.reason}`);
+    out.push("");
+    if (verdict.worth)
+        out.push(`  Next:  npx sdkproof ${d.package}`);
+    out.push("");
+    return out.join("\n");
+}
+//# sourceMappingURL=report.js.map