shopify-upgrade-guard 0.2.6 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shopify-upgrade-guard",
-  "version": "0.2.6",
+  "version": "0.3.0",
   "description": "Check documented Shopify API and platform upgrade compatibility risks with an offline CLI and GitHub Action.",
   "type": "module",
   "bin": {

package/src/action.js

@@ -9,7 +9,7 @@ const target = input('target') || undefined; const threshold = input('fail-on')
 try {
   if (input('fail-on-new') && !['true','false'].includes(input('fail-on-new'))) throw new Error('fail-on-new must be true or false');
   const result = await scan(root, { target, failOn: threshold, baseRef: input('base-ref') || (failOnNew && process.env.GITHUB_BASE_REF ? `origin/${process.env.GITHUB_BASE_REF}` : undefined) }); const json = JSON.stringify(result); const active = result.findings.filter((finding) => !finding.baselined);
-  setOutput('outcome', shouldFail(result, threshold, failOnNew) ? 'failure' : 'success'); setOutput('finding-count', String(active.length)); setOutput('new-finding-count', String(active.filter((item) => item.lifecycle === 'NEW').length)); setOutput('error-count', String(active.filter((item) => item.severity === 'error').length)); setOutput('current-versions', JSON.stringify(result.inventory)); setOutput('result-json', json);
+  setOutput('outcome', shouldFail(result, threshold, failOnNew) ? 'failure' : 'success'); setOutput('finding-count', String(active.length)); setOutput('new-finding-count', String(active.filter((item) => item.lifecycle === 'NEW').length)); setOutput('resolved-finding-count', String(result.resolvedFindings.length)); setOutput('error-count', String(active.filter((item) => item.severity === 'error').length)); setOutput('current-versions', JSON.stringify(result.inventory)); setOutput('result-json', json);
   if (process.env.GITHUB_STEP_SUMMARY) fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, `## Shopify Upgrade Guard\n\n${formatHuman(result)}\n`);
   for (const finding of active) if (finding.file && finding.line) console.error(`::warning file=${finding.file.replaceAll('%','%25').replaceAll('\r','%0D').replaceAll('\n','%0A').replaceAll(':','%3A').replaceAll(',','%2C')},line=${finding.line},col=${finding.column}::${finding.title}`);
   if (shouldFail(result, threshold, failOnNew)) { console.error(`::error::Upgrade findings exceeded --fail-on ${threshold}${failOnNew ? ' for NEW findings' : ''}`); process.exitCode = 1; }

package/src/git.js

@@ -1,6 +1,14 @@
 import { spawn } from 'node:child_process';
-export async function changedLines(root, baseRef) {
+import { lstat, mkdtemp, mkdir, realpath, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+
+function validateBaseRef(baseRef) {
   if (!baseRef || baseRef.startsWith('-') || baseRef.includes('..') || !/^[A-Za-z0-9_./-]+$/.test(baseRef)) throw new Error('Invalid Git base ref');
+}
+
+export async function changedLines(root, baseRef) {
+  validateBaseRef(baseRef);
   const output = await runGit(root, ['-c', 'core.quotePath=false', 'diff', '--no-ext-diff', '--no-textconv', '--unified=0', `${baseRef}...HEAD`, '--']);
   const ranges = new Map(); let file = null;
   for (const line of output.split('\n')) {
@@ -10,4 +18,74 @@ export async function changedLines(root, baseRef) {
   }
   return ranges;
 }
-export async function runGit(root, args) { return new Promise((resolve, reject) => { const child = spawn('git', args, { cwd: root, stdio: ['ignore', 'pipe', 'pipe'] }); let stdout = ''; let stderr = ''; child.stdout.on('data', (chunk) => { stdout += chunk; }); child.stderr.on('data', (chunk) => { stderr += chunk; }); child.on('error', reject); child.on('close', (code) => code === 0 ? resolve(stdout) : reject(new Error(`git ${args[0]} failed: ${stderr.trim()}`))); }); }
+
+export async function withBaseTree(root, baseRef, analyze) {
+  validateBaseRef(baseRef);
+  const scanRoot = await realpath(resolve(root));
+  const repositoryRoot = (await runGit(scanRoot, ['rev-parse', '--show-toplevel'])).trim();
+  const scanPath = relative(repositoryRoot, scanRoot);
+  if (scanPath === '..' || scanPath.startsWith(`..${sep}`) || isAbsolute(scanPath)) throw new Error('Scan root must be inside its Git repository');
+  const base = (await runGit(repositoryRoot, ['rev-parse', '--verify', '--end-of-options', `${baseRef}^{commit}`])).trim();
+  const baseCommit = (await runGit(repositoryRoot, ['merge-base', base, 'HEAD'])).trim();
+  if (!/^[0-9a-f]{40,64}$/i.test(baseCommit)) throw new Error('Git did not return a valid base commit');
+  const parent = await mkdtemp(join(tmpdir(), 'upgradeguard-base-'));
+  const worktree = join(parent, 'tree');
+  const hooksPath = join(parent, 'empty-hooks');
+  const emptyConfig = join(parent, 'empty-config');
+  let added = false;
+  try {
+    await mkdir(hooksPath);
+    await writeFile(emptyConfig, '');
+    const filterConfig = await runGit(repositoryRoot, ['config', '--local', '--name-only', '--get-regexp', '^filter\\.'], { allowFailure: true });
+    if (filterConfig.code !== 0 && filterConfig.code !== 1) throw new Error('Could not inspect Git filter configuration safely');
+    const filterNames = new Set(filterConfig.stdout.split('\n').map((key) => key.trim()).filter(Boolean).map((key) => key.slice('filter.'.length, key.lastIndexOf('.'))).filter(Boolean));
+    const checkoutOptions = ['-c', `core.hooksPath=${hooksPath}`, '-c', 'core.fsmonitor=false', '-c', `core.attributesFile=${emptyConfig}`, '-c', 'core.autocrlf=false'];
+    for (const name of filterNames) checkoutOptions.push('-c', `filter.${name}.smudge=`, '-c', `filter.${name}.process=`, '-c', `filter.${name}.clean=`, '-c', `filter.${name}.required=false`);
+    const env = isolatedGitEnvironment(emptyConfig);
+    await runGit(repositoryRoot, [...checkoutOptions, 'worktree', 'add', '--detach', worktree, baseCommit], { env });
+    added = true;
+    let baseRoot = resolve(worktree, scanPath);
+    try { const stat = await lstat(baseRoot); if (!stat.isDirectory()) throw new Error('Base scan root must be a regular directory'); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; baseRoot = join(parent, 'empty-scan-root'); await mkdir(baseRoot); }
+    const renames = await renamedPaths(repositoryRoot, baseCommit, scanPath);
+    return await analyze(baseRoot, { baseCommit, renames });
+  } finally {
+    let cleanupError;
+    if (added) try { await runGit(repositoryRoot, ['worktree', 'remove', '--force', worktree]); } catch (error) { cleanupError = error; }
+    await rm(parent, { recursive: true, force: true });
+    if (cleanupError) throw cleanupError;
+  }
+}
+
+async function renamedPaths(repositoryRoot, baseCommit, scanPath) {
+  const pathspec = scanPath ? `:(literal)${scanPath.replaceAll('\\', '/')}` : '.';
+  const output = await runGit(repositoryRoot, ['-c', 'core.quotePath=false', 'diff', '--no-ext-diff', '--no-textconv', '--find-renames', '--name-status', '-z', baseCommit, 'HEAD', '--', pathspec]);
+  const fields = output.split('\0'); const renames = new Map();
+  const toScanPath = (file) => {
+    const normalized = file.replaceAll('\\', '/');
+    if (!scanPath) return normalized;
+    const prefix = `${scanPath.replaceAll('\\', '/')}/`;
+    return normalized.startsWith(prefix) ? normalized.slice(prefix.length) : null;
+  };
+  for (let index = 0; index < fields.length;) {
+    const status = fields[index++];
+    if (!status) continue;
+    const count = /^[RC]/.test(status) ? 2 : 1;
+    const before = count === 2 ? fields[index++] : null;
+    const after = fields[index++];
+    if (status.startsWith('R')) {
+      const oldPath = toScanPath(before); const newPath = toScanPath(after);
+      if (oldPath && newPath) renames.set(oldPath, newPath);
+    }
+  }
+  return renames;
+}
+
+function isolatedGitEnvironment(emptyConfig) {
+  const env = { ...process.env, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: emptyConfig, GIT_CONFIG_SYSTEM: emptyConfig };
+  for (const key of Object.keys(env)) if (/^GIT_CONFIG_(?:KEY|VALUE)_\d+$/.test(key)) delete env[key];
+  for (const key of ['GIT_CONFIG_COUNT', 'GIT_CONFIG_PARAMETERS', 'GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_COMMON_DIR', 'GIT_OBJECT_DIRECTORY', 'GIT_ALTERNATE_OBJECT_DIRECTORIES']) delete env[key];
+  return env;
+}
+
+export async function runGit(root, args, options = {}) { return new Promise((resolve, reject) => { const child = spawn('git', args, { cwd: root, env: options.env ?? process.env, stdio: ['ignore', 'pipe', 'pipe'] }); let stdout = ''; let stderr = ''; child.stdout.on('data', (chunk) => { stdout += chunk; }); child.stderr.on('data', (chunk) => { stderr += chunk; }); child.on('error', reject); child.on('close', (code) => code === 0 ? resolve(options.allowFailure ? { code, stdout, stderr } : stdout) : options.allowFailure ? resolve({ code, stdout, stderr }) : reject(new Error(`git ${args[0]} failed: ${stderr.trim()}`))); }); }

package/src/graphql.js

@@ -1,6 +1,6 @@
 import { parse, Kind, visit } from 'graphql';
 // Parse only literal GraphQL documents. Dynamic templates remain unsupported.
-export function rootFieldMatches(file, name, guidance) {
+export function rootFieldMatches(file, name, guidance, operation = 'query') {
   const documents = [];
   if (/\.(graphql|gql)$/.test(file.relativePath)) documents.push({ text: file.text, offset: 0 });
   else for (const match of file.text.matchAll(/([`"'])([\s\S]*?)\1/g)) {
@@ -25,12 +25,49 @@ export function rootFieldMatches(file, name, guidance) {
           else if (node.kind === Kind.FRAGMENT_SPREAD && fragments.has(node.name.value) && !stack.includes(node.name.value)) visitRoot(fragments.get(node.name.value).selectionSet.selections,[...stack,node.name.value]);
         }
       };
-      for (const operation of ast.definitions.filter(d=>d.kind===Kind.OPERATION_DEFINITION && d.operation === 'query')) visitRoot(operation.selectionSet.selections);
+      for (const definition of ast.definitions.filter(d=>d.kind===Kind.OPERATION_DEFINITION && d.operation === operation)) visitRoot(definition.selectionSet.selections);
     } catch { /* Unsupported or malformed documents are not evidence of this removal. */ }
   }
   return matches;
 }
 
+// Match enum values only when they are literal inputs to the named mutation.
+// Runtime variables and dynamically assembled documents remain outside this evidence.
+export function mutationEnumMatches(file, mutationNames, argumentName, objectPath, enumValues, guidance) {
+  const documents = literalDocuments(file);
+  const matches = [];
+  for (const doc of documents) try {
+    const ast = parse(doc.text, { maxTokens: 50000 });
+    const fragments = new Map(ast.definitions.filter(d => d.kind === Kind.FRAGMENT_DEFINITION).map(d => [d.name.value, d]));
+    let visits = 0;
+    const findValue = (value) => {
+      let current = value;
+      for (const fieldName of objectPath) {
+        if (current?.kind !== Kind.OBJECT) return null;
+        current = current.fields.find(field => field.name.value === fieldName)?.value;
+      }
+      return current;
+    };
+    const visitRoot = (selections, stack = []) => {
+      for (const node of selections ?? []) {
+        if (++visits > 50000) throw new Error('GraphQL expansion limit');
+        if (node.kind === Kind.FIELD) {
+          if (!mutationNames.includes(node.name.value)) continue;
+          const argument = node.arguments?.find(item => item.name.value === argumentName);
+          const value = findValue(argument?.value);
+          if (value?.kind === Kind.ENUM && enumValues.includes(value.value)) {
+            const index = doc.offset + value.loc.start, before = file.text.slice(0, index);
+            matches.push({ file: file.relativePath, line: before.split('\n').length, column: index - before.lastIndexOf('\n'), snippet: value.value, guidance });
+          }
+        } else if (node.kind === Kind.INLINE_FRAGMENT) visitRoot(node.selectionSet.selections, stack);
+        else if (node.kind === Kind.FRAGMENT_SPREAD && fragments.has(node.name.value) && !stack.includes(node.name.value)) visitRoot(fragments.get(node.name.value).selectionSet.selections, [...stack, node.name.value]);
+      }
+    };
+    for (const definition of ast.definitions.filter(d => d.kind === Kind.OPERATION_DEFINITION && d.operation === 'mutation')) visitRoot(definition.selectionSet.selections);
+  } catch { /* Malformed or dynamic documents cannot establish a literal mutation input. */ }
+  return matches;
+}
+
 // Existing field/type removals require a parseable literal document too.
 export function fieldMatches(file, fields, types, guidance) {
   const documents = [];

package/src/output.js

@@ -6,8 +6,8 @@ export function formatHuman(result) {
   lines.push(...sectionLines(result.currentProblems.filter((finding) => !finding.baselined), 'Current debt'));
   lines.push('', 'Upgrade blockers');
   lines.push(...sectionLines(result.upgradeBlockers.filter((finding) => !finding.baselined), 'Target migration')); 
-  const introduced = active.filter((finding) => finding.changeStatus === 'introduced'); const existing = active.filter((finding) => finding.changeStatus === 'pre-existing');
-  if (introduced.length || existing.length) lines.push('', `Introduced by this PR: ${introduced.length}`, `Pre-existing: ${existing.length}`);
+  const introduced = active.filter((finding) => finding.changeStatus === 'introduced'); const existing = active.filter((finding) => finding.changeStatus === 'pre-existing'); const resolved = result.resolvedFindings ?? [];
+  if (result.comparisonAvailable) lines.push('', `Introduced by this PR: ${introduced.length}`, `Pre-existing: ${existing.length}`, `Resolved by this PR: ${resolved.length}`);
   if (!active.length) lines.push('No upgrade risks found.', '', 'Result: scan passed'); else lines.push('', `${active.length} active risk${active.length === 1 ? '' : 's'} found`, `Baselined: ${result.baselinedCount}`, '', 'Result: migration recommended');
   return lines.join('\n');
 }

package/src/rules.js

@@ -1,6 +1,6 @@
 import { isAtOrAfter, statusFor, latestStable, becomesUnsupportedBefore } from './versions.js';
 
-import { rootFieldMatches, fieldMatches, productVariantBarcodeMatches, segmentQueryMatches } from './graphql.js';
+import { rootFieldMatches, fieldMatches, mutationEnumMatches, productVariantBarcodeMatches, segmentQueryMatches } from './graphql.js';
 
 const checkoutDeprecation = '2026-07';
 const removalVersion = '2026-10';
@@ -84,6 +84,20 @@ export const rules = [
     detect(file) { if (!sourceExtensions.test(file.relativePath)) return []; return matches(maskComments(file.text), /(?:(?:===|!==|==|!=)\s*(['"])ITEM_NOT_STOCKED_AT_LOCATION\1|\bcase\s+(['"]?)ITEM_NOT_STOCKED_AT_LOCATION\2|\b[A-Z][A-Za-z0-9_]*\.ITEM_NOT_STOCKED_AT_LOCATION\b)/g, 'Remove handling for ITEM_NOT_STOCKED_AT_LOCATION; Shopify no longer emits this error code from API version 2026-10.'); },
     evaluate(match, context) { return removalAware(match, this, context); }
   },
+  {
+    id: 'UG-ADMIN-006', surface: 'admin_graphql_api', severity: 'error', title: 'marketCurrencySettingsUpdate mutation is removed', removedIn: '2027-01', confidence: 'high',
+    documentationUrl: 'https://shopify.dev/changelog/posts/removing-marketcurrencysettingsupdate-mutation', migrationUrl: 'https://shopify.dev/docs/api/admin-graphql/2027-01/mutations/marketUpdate',
+    description: 'The Admin GraphQL marketCurrencySettingsUpdate mutation is removed in API version 2027-01. Set currency settings through marketCreate or marketUpdate instead.',
+    detect(file) { return rootFieldMatches(file, 'marketCurrencySettingsUpdate', 'Move currency settings into marketCreate or marketUpdate.', 'mutation'); },
+    evaluate(match, context) { return removalAware(match, this, context); }
+  },
+  {
+    id: 'UG-ADMIN-007', surface: 'admin_graphql_api', severity: 'error', title: 'Metaobject admin access enum value is removed', removedIn: '2027-01', confidence: 'high',
+    documentationUrl: 'https://shopify.dev/changelog/posts/removing-deprecated-private-and-public-read-enums-on-metaobject-definitions', migrationUrl: 'https://shopify.dev/docs/api/admin-graphql/2027-01/input-objects/metaobjectaccessinput',
+    description: 'The MetaobjectAdminAccess values PRIVATE and PUBLIC_READ are removed in API version 2027-01. Review the intended access and use a currently supported value.',
+    detect(file) { return mutationEnumMatches(file, ['metaobjectDefinitionCreate', 'metaobjectDefinitionUpdate'], 'definition', ['access', 'admin'], ['PRIVATE', 'PUBLIC_READ'], 'Remove this obsolete access value and choose an intended value supported by the current MetaobjectAdminAccess input.'); },
+    evaluate(match, context) { return removalAware(match, this, context); }
+  },
   {
     id: 'UG-REST-001', surface: 'admin_rest_api', severity: 'warning', title: 'REST Admin API usage is legacy', confidence: 'high',
     documentationUrl: 'https://shopify.dev/docs/api/admin-rest', migrationUrl: 'https://shopify.dev/docs/api/admin-graphql',

package/src/scan.js

@@ -4,7 +4,7 @@ import { discover, validateExcludePattern } from './discovery.js';
 import { rules, attachFile } from './rules.js';
 import { latestStable, parseVersion, targetRecord } from './versions.js';
 import { applyBaseline, loadBaseline } from './baseline.js';
-import { changedLines } from './git.js';
+import { withBaseTree } from './git.js';
 import { safeRead } from './safe-file.js';
 import { validatePolicy } from './output.js';
 
@@ -14,6 +14,29 @@ export async function loadConfig(root) {
 }
 function validateConfig(config) { if (!config || typeof config !== 'object' || Array.isArray(config)) throw new Error('Configuration must be an object.'); if (config.targetVersion !== undefined && !parseVersion(config.targetVersion)) throw new Error('targetVersion must be a quarterly YYYY-MM version.'); if (config.failOn !== undefined && !['never', 'error', 'warning', 'info'].includes(config.failOn)) throw new Error('failOn must be never, error, warning, or info.'); if (config.exclude !== undefined && (!Array.isArray(config.exclude) || config.exclude.some((pattern) => validateExcludePattern(pattern) === undefined))) throw new Error('exclude must be an array of repository-relative glob patterns.'); if (config.baseline !== undefined && (typeof config.baseline !== 'string' || config.baseline.startsWith('/') || config.baseline.includes('..'))) throw new Error('baseline must be a repository-relative file path.'); }
 export async function scan(root, options = {}) {
+  root = resolve(root);
+  const head = await analyze(root, options);
+  const baseline = options.noBaseline ? { fingerprints: new Set(), entries: [], file: null } : await loadBaseline(root, options.baseline ?? head.baselinePath);
+  let findings = head.findings;
+  let resolvedFindings = [];
+  let comparisonAvailable = false;
+  if (options.baseRef) {
+    const comparison = await withBaseTree(root, options.baseRef, async (baseRoot, metadata) => ({
+      base: await analyze(baseRoot, { ...options, baseRef: undefined, noBaseline: true }),
+      renames: metadata.renames
+    }));
+    const classified = classifyFindings(comparison.base.findings, head.findings, comparison.renames);
+    findings = classified.findings;
+    resolvedFindings = classified.resolved;
+    comparisonAvailable = true;
+  }
+  let resultFindings = applyBaseline(findings, baseline);
+  if (!comparisonAvailable) resultFindings = resultFindings.map((finding) => ({ ...finding, lifecycle: finding.baselined ? 'EXISTING' : 'UNCHANGED' }));
+  const active = resultFindings.filter((finding) => !finding.baselined); const currentProblems = active.filter((finding) => finding.classification === 'current'); const upgradeBlockers = active.filter((finding) => finding.classification === 'target');
+  return { schemaVersion: 1, comparisonAvailable, skipped: head.skipped, tool: 'shopify-upgrade-guard', targetVersion: head.targetVersion, failOn: head.failOn, latestStable: latestStable.version, filesScanned: head.filesScanned, inventory: head.inventory, findings: resultFindings, resolvedFindings, currentProblems, upgradeBlockers, baselinedCount: resultFindings.filter((finding) => finding.baselined).length, resolvedBaselineCount: [...baseline.fingerprints].filter((fingerprint) => !resultFindings.some((finding) => finding.fingerprint === fingerprint)).length, baselineFile: baseline.file };
+}
+
+async function analyze(root, options = {}) {
   root = resolve(root);
   if (!(await lstat(root)).isDirectory()) throw new Error('Scan root must be a regular directory');
   const config = await loadConfig(root); const targetVersion = options.target ?? config.targetVersion ?? latestStable.version; const failOn = options.failOn ?? config.failOn ?? 'never'; targetRecord(targetVersion); validatePolicy(failOn);
@@ -24,14 +47,34 @@ export async function scan(root, options = {}) {
     const detected = rule.detect(file); const matches = detected.length ? attachFile(detected, file) : inventoryMatches(rule, inventory, file);
     for (const match of matches) { const evaluated = rule.evaluate(match, context); if (evaluated) findings.push(toFinding(rule, evaluated, targetVersion)); }
   }
-  const baseline = options.noBaseline ? { fingerprints: new Set(), entries: [], file: null } : await loadBaseline(root, options.baseline ?? config.baseline); let resultFindings = applyBaseline(dedupe(findings), baseline);
-  const baseRef = options.baseRef;
-  if (baseRef) { const ranges = await changedLines(root, baseRef); resultFindings = resultFindings.map(finding => ({ ...finding, changeStatus: isChanged(finding, ranges) ? 'introduced' : 'pre-existing', lifecycle: isChanged(finding, ranges) ? 'NEW' : 'EXISTING' })); }
-  else resultFindings = resultFindings.map((finding) => ({ ...finding, lifecycle: finding.baselined ? 'EXISTING' : 'UNCHANGED' }));
-  const active = resultFindings.filter((finding) => !finding.baselined); const currentProblems = active.filter((finding) => finding.classification === 'current'); const upgradeBlockers = active.filter((finding) => finding.classification === 'target');
-  return { schemaVersion: 1, comparisonAvailable: Boolean(baseRef), skipped, tool: 'shopify-upgrade-guard', targetVersion, failOn, latestStable: latestStable.version, filesScanned: files.length, inventory, findings: resultFindings, currentProblems, upgradeBlockers, baselinedCount: resultFindings.filter((finding) => finding.baselined).length, resolvedBaselineCount: [...baseline.fingerprints].filter((fingerprint) => !resultFindings.some((finding) => finding.fingerprint === fingerprint)).length, baselineFile: baseline.file };
+  return { targetVersion, failOn, skipped, filesScanned: files.length, inventory, findings: dedupe(findings), baselinePath: options.baseline ?? config.baseline };
 }
+
+function classifyFindings(baseFindings, headFindings, renames) {
+  const identity = (finding, baseSide = false) => {
+    const file = baseSide ? renames.get(finding.file) ?? finding.file : finding.file;
+    const snippet = String(finding.snippet ?? '').replace(/\s+/g, ' ').trim();
+    return `${finding.ruleId}|${finding.surface}|${file}|${snippet}`;
+  };
+  const count = (items, baseSide) => {
+    const counts = new Map();
+    for (const item of items) { const key = identity(item, baseSide); counts.set(key, (counts.get(key) ?? 0) + 1); }
+    return counts;
+  };
+  const baseCounts = count(baseFindings, true); const headCounts = count(headFindings, false); const seenHead = new Map();
+  const findings = headFindings.map((finding) => {
+    const key = identity(finding); const occurrence = seenHead.get(key) ?? 0; seenHead.set(key, occurrence + 1);
+    const existing = occurrence < (baseCounts.get(key) ?? 0);
+    return { ...finding, changeStatus: existing ? 'pre-existing' : 'introduced', lifecycle: existing ? 'EXISTING' : 'NEW' };
+  });
+  const seenBase = new Map(); const resolved = [];
+  for (const finding of baseFindings) {
+    const key = identity(finding, true); const occurrence = seenBase.get(key) ?? 0; seenBase.set(key, occurrence + 1);
+    if (occurrence >= (headCounts.get(key) ?? 0)) resolved.push({ ...finding, changeStatus: 'resolved', lifecycle: 'RESOLVED', baselined: false });
+  }
+  return { findings, resolved };
+}
+
 function inventoryMatches(rule, inventory, file) { if (!rule.id.startsWith('UG-VERSION')) return []; return inventory.filter((item) => item.file === file.relativePath).map((item) => ({ file: item.file, line: item.line, column: 1, snippet: `${item.source}: ${item.version}`, version: item.version, guidance: 'Update this Shopify version to a supported stable release and test the migration.' })); }
 function toFinding(rule, match, targetVersion) { return { ruleId: rule.id, severity: match.severity ?? rule.severity, title: match.title ?? rule.title, surface: rule.surface, file: match.file, line: match.line, column: match.column, snippet: match.snippet, targetVersion, currentState: rule.description, migration: match.guidance, source: rule.documentationUrl, migrationUrl: rule.migrationUrl ?? null, confidence: match.confidence ?? rule.confidence, classification: match.classification, reason: match.reason, deprecatedIn: rule.deprecatedIn ?? null, removedIn: rule.removedIn ?? null }; }
 function dedupe(findings) { return [...new Map(findings.map((finding) => [`${finding.ruleId}|${finding.file}|${finding.line}|${finding.snippet}`, finding])).values()]; }
-function isChanged(finding, ranges) { return Boolean(ranges?.get(finding.file)?.some((range) => finding.line >= range.start && finding.line <= range.end)); }

package/src/version-data.js

@@ -1,6 +1,6 @@
 // Generated from data/versions.json.
 export default {
-  "verifiedAt": "2026-10-04",
+  "verifiedAt": "2026-10-14",
   "source": "https://shopify.dev/docs/api/usage/versioning",
   "versions": [
     {
@@ -25,7 +25,7 @@ export default {
       "version": "2025-10",
       "releaseDate": "2025-10-01",
       "accessibleUntil": "2026-10-16T15:00:00Z",
-      "status": "unsupported"
+      "status": "stable"
     },
     {
       "version": "2026-01",

package/src/version.js

@@ -1,2 +1,2 @@
 // Generated from package.json.
-export const TOOL_VERSION = "0.2.6";
+export const TOOL_VERSION = "0.3.0";

package/src/versions.js

@@ -14,8 +14,16 @@ export function compareVersions(left, right) { const a = parseVersion(left); con
 export function isBefore(left, right) { return compareVersions(left, right) < 0; }
 export function isAtOrAfter(left, right) { return compareVersions(left, right) >= 0; }
 export function versionRecord(value) { const parsed = parseVersion(value); return parsed ? versions.find((item) => item.version === parsed) ?? null : null; }
-export function statusFor(value) { const parsed = parseVersion(value); if (!parsed) return 'unknown'; return versionRecord(parsed)?.status ?? 'unknown/future'; }
+export function statusFor(value, asOf = new Date()) {
+  const parsed = parseVersion(value);
+  if (!parsed) return 'unknown';
+  const record = versionRecord(parsed);
+  if (!record) return 'unknown/future';
+  const timestamp = asOf instanceof Date ? asOf.getTime() : Date.parse(asOf);
+  if (record.accessibleUntil && Number.isFinite(timestamp) && timestamp >= Date.parse(record.accessibleUntil)) return 'unsupported';
+  return record.status;
+}
 export function isKnownVersion(value) { return Boolean(versionRecord(value)); }
-export function targetRecord(value) { const parsed = parseVersion(value); if (!parsed) throw new Error(`Invalid target version: ${value}. Expected a quarterly YYYY-MM version (01, 04, 07, or 10).`); return versionRecord(parsed) ?? { version: parsed, status: 'unknown/future', accessibleUntil: null }; }
+export function targetRecord(value, asOf = new Date()) { const parsed = parseVersion(value); if (!parsed) throw new Error(`Invalid target version: ${value}. Expected a quarterly YYYY-MM version (01, 04, 07, or 10).`); const record = versionRecord(parsed); return record ? { ...record, status: statusFor(parsed, asOf) } : { version: parsed, status: 'unknown/future', accessibleUntil: null }; }
 export function becomesUnsupportedBefore(version, target) { const record = versionRecord(version); const targetVersion = targetRecord(target); return Boolean(record?.accessibleUntil && record.accessibleUntil.slice(0, 7) <= targetVersion.version); }
-export function versionSummary() { return versions; }
+export function versionSummary(asOf = new Date()) { return versions.map((record) => ({ ...record, status: statusFor(record.version, asOf) })); }