@ladamczyk/outdated 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Łukasz Adamczyk
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,106 @@
+# @ladamczyk/outdated
+
+CLI that reports outdated dependencies using the npm CLI.
+
+## Usage
+
+```bash
+outdated [options]
+```
+
+The table mirrors `npm outdated` (`Package`, `Current`, `Wanted`, `Latest`, `Location`, `Depended by`) and adds `Last publish` and `Flags` at the end. It is split into `dependencies`, `devDependencies` and `optionalDependencies` sections (empty ones are omitted); packages keep their `package.json` order and the columns line up across sections. `Wanted` falls back to `Current` for packages `npm outdated` does not list.
+
+Flags are coloured: deprecated red, stale yellow, outdated cyan, unknown magenta, blocked blue, ok green; a major version bump shows `Latest` in red. Package names are links to their npmjs.com page in terminals that support hyperlinks. Colours and links turn off automatically when output is piped or `NO_COLOR` is set, and `--json` never contains either.
+
+## Options
+
+- `--cwd <dir>` — Project folder (default: `.`)
+- `--stale-after <months>` — Months without a release before a package is stale (default: `6`)
+- `--include <types>` — Dependency types to check: `prod`, `dev`, `optional`, comma-separated (default: all)
+- `--ignore <pkgs>` — Comma-separated package names to skip entirely
+- `--concurrency <n>` — Parallel `npm view` lookups (default: `6`)
+- `--json` — Output machine-readable JSON
+- `--only-problems` — Hide ok packages from the table
+- `--fail-on <list>` — Exit 1 when any of `stale`, `deprecated`, `outdated`, `unknown` is found (default: none)
+- `--help, -h` — Display help message
+- `--version, -v` — Display version number
+
+## Exit codes
+
+- `0` — Success, and no `--fail-on` condition met
+- `1` — A `--fail-on` condition was met
+- `2` — Usage or runtime error (no `package.json`, npm not found, invalid options, `npm outdated` failure)
+
+## JSON schema
+
+When `--json` is used, the output conforms to the following schema (schemaVersion: 1):
+
+```json
+{
+  "schemaVersion": 1,
+  "generatedAt": "ISO 8601 timestamp",
+  "staleAfterMonths": 6,
+  "project": "package.json name, else the directory name",
+  "packages": [
+    {
+      "name": "package name",
+      "queriedName": "real package for npm: aliases, else null",
+      "type": "prod | dev | optional",
+      "specifier": "version specifier from package.json",
+      "current": "currently installed version or null",
+      "wanted": "npm outdated wanted version or null",
+      "latest": "dist-tags.latest or npm outdated latest or null",
+      "outdated": true,
+      "majorBump": true,
+      "deprecated": "full deprecation message or null",
+      "lastPublish": "ISO 8601 of dist-tags.latest release date or null",
+      "stale": true,
+      "unknown": "reason npm view failed or null",
+      "latestNode": "engines.node of the latest release, or null",
+      "flags": ["deprecated", "stale", "outdated", "unknown", "blocked"]
+    }
+  ],
+  "summary": {
+    "total": 42,
+    "deprecated": 3,
+    "stale": 5,
+    "outdated": 8,
+    "unknown": 2,
+    "blocked": 1,
+    "ok": 24,
+    "skipped": 0
+  },
+  "skipped": [
+    {
+      "name": "package name",
+      "type": "prod | dev | optional",
+      "specifier": "version specifier",
+      "reason": "why it was skipped"
+    }
+  ]
+}
+```
+
+Note that `--only-problems` filters the table output but never filters the JSON `packages` array.
+
+## Behaviour notes
+
+**Age is a signal, not a verdict.** The `lastPublish` date indicates inactivity, not necessarily abandonment. Regularly maintained packages may have long gaps between releases.
+
+**Why `time.modified` is not used.** The npm registry's `time.modified` timestamp changes on metadata edits—deprecation notices, dist-tag moves, owner changes—without a new release. This would hide abandoned packages that changed owners but never shipped again. The `lastPublish` date of `dist-tags.latest` reflects the actual last public version.
+
+**Blocked by Node:** `npm outdated` resolves `Latest` with the running Node's `engines` in mind, so a release that needs a newer Node is skipped. `outdated` notices when the registry's latest release differs from what npm settled on, and instead of `ok` it prints `latest needs node <engines.node of that release>` (flag `blocked`, field `latestNode`). It is informational: it is not accepted by `--fail-on`. A package with a deprecated latest release, or one that declares no `engines.node`, is never marked blocked.
+
+**Specifiers:** Non-npm specifiers (file:, link:, git:, etc.) and invalid package names are skipped with a reason.
+
+**Aliases:** When a dependency uses `npm:` prefix (alias syntax), the lookup queries the real package name.
+
+**Ignore:** The `--ignore` flag uses exact-match on the dependency name and omits matching packages entirely from the report.
+
+**Timeouts:** A timed-out `npm view` lookup is not killed; the process continues in the background. The timeout only affects the result for that package.
+
+**npm stderr:** npm's own error lines may be printed to stderr, inherited from the npm CLI.
+
+**Windows behaviour is untested/unverified.**
+
+Only the npm CLI is used. Registry, proxy, authentication, and certificate settings are inherited from `.npmrc`.

package/bin/cli.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import{EExitCode as e,executeCommand as t}from"@ladamczyk/qoq-utils";import n from"cac";import{basename as r,join as i,resolve as a}from"path";import{readFileSync as o}from"fs";import s from"picocolors";var c=`1.0.0`;const l=[[`prod`,`dependencies`],[`optional`,`optionalDependencies`],[`dev`,`devDependencies`]],u=[`file:`,`link:`,`workspace:`,`git+`,`git:`,`github:`,`http:`,`https:`],d=/^(?:@[A-Za-z0-9~-][A-Za-z0-9._~-]*\/)?[A-Za-z0-9~-][A-Za-z0-9._~-]*$/,f=e=>{try{let t=JSON.parse(o(e,`utf8`));return typeof t==`object`&&t?t:null}catch{return null}},ee=e=>{if(!e.startsWith(`npm:`))return null;let t=e.slice(4),n=t.lastIndexOf(`@`);return n>0?t.slice(0,n):t},p=(e,t,n)=>{for(let[r,i]of l){let a=e[i];if(t.includes(r)&&typeof a==`object`&&a)for(let[e,t]of Object.entries(a))!n.has(e)&&typeof t==`string`&&n.set(e,{type:r,specifier:t})}};function te(e,{include:t,ignore:n}){let a=i(e,`package.json`),o=f(a);if(!o)throw Error(`Cannot read or parse package.json at ${a}`);let s=/* @__PURE__ */ new Map;p(o,t,s);let c=[],l=[];for(let[e,{type:t,specifier:r}]of s){if(n.includes(e))continue;let i=u.find(e=>r.startsWith(e));if(i){l.push({name:e,type:t,specifier:r,reason:`unsupported specifier (${i})`});continue}let a=ee(r);c.push({name:e,type:t,specifier:r,queriedName:a,validName:d.test(a??e)})}return{project:typeof o.name==`string`&&o.name?o.name:r(e),entries:c,skipped:l}}function ne(e,t){let n=f(i(e,`node_modules`,t,`package.json`))?.version;return typeof n==`string`?n:null}const m=e=>typeof e==`object`&&!!e&&!Array.isArray(e),h=e=>typeof e==`string`?e:null,g=e=>JSON.parse(e),re=e=>{let t=Array.isArray(e)?e[0]:e,n=m(t)?t:{};return{current:h(n.current),wanted:h(n.wanted),latest:h(n.latest)}},_=e=>!m(e)||e.code===void 0&&e.summary===void 0?null:[h(e.code),h(e.summary)].filter(Boolean).join(` `),v=e=>{if(e.trim()===``)throw Error(`npm outdated printed empty output`);let t;try{t=g(e)}catch{throw Error(`npm outdated printed invalid JSON`)}if(!m(t))throw Error(`npm outdated printed non-object JSON`);let n=_(t.error);if(n!==null)throw Error(`npm outdated failed: ${n}`);return Object.fromEntries(Object.entries(t).map(([e,t])=>[e,re(t)]))},ie=e=>m(e)&&typeof e.node==`string`&&e.node!==``?e.node:null,y={unknown:`unexpected npm view output`},ae=e=>{let t=e[`dist-tags`],n=m(t)?h(t.latest):null;if(n===null||!m(e.time))return y;let r=h(e.time[n]);if(r===null||Number.isNaN(Date.parse(r)))return{unknown:`no valid publish time for ${n}`};let i=e.deprecated;return{latest:n,lastPublish:r,deprecated:typeof i==`string`&&i!==``?i:null,latestNode:ie(e.engines)}},oe=e=>{let t;try{t=g(e)}catch{return{unknown:`invalid npm view JSON`}}return m(t)?`error`in t?{unknown:_(t.error)??`npm view error`}:ae(t):y};async function se(e,t,n){let r=Array(e.length),i=/* @__PURE__ */ new Set;for(let[a,o]of e.entries()){let e=n(o).then(t=>{r[a]=t,i.delete(e)});i.add(e),i.size===t&&await Promise.race(i)}return await Promise.all(i),r}const ce=String.raw`'\''`,le=e=>process.platform===`win32`?`"${e.replaceAll(`"`,`""`)}"`:`'${e.replaceAll(`'`,ce)}'`,ue=()=>async e=>{if(e.some(e=>/[\0\n\r]/.test(e)))throw Error(`npm argument contains a control character`);let n=await t([`npm`,...e.map(le)].join(` `),[],[`ignore`,`pipe`,`pipe`],!0);return String(n)};function b(e,t){let n=e.getUTCFullYear()*12+e.getUTCMonth()+t,r=Math.floor(n/12),i=n-r*12,a=new Date(Date.UTC(r,i+1,0)).getUTCDate(),o=new Date(e);return o.setUTCFullYear(r,i,Math.min(e.getUTCDate(),a)),o}function de(e,t){let n=new Date(e);if(n>t)return`0d ago`;let r=t.getTime()-n.getTime(),i=Math.floor(r/864e5);if(i<30)return`${i}d ago`;let a=0;for(;b(n,a+1)<=t;)a++;return a<12?`${a}m ago`:`${Math.floor(a/12)}y ago`}const fe=[`prod`,`dev`,`optional`],x=e=>{let t=/^v?(\d+)/.exec(e??``);return t?Number(t[1]):null},S=(e,t)=>{let n=x(e),r=x(t);return n!==null&&r!==null&&r>n},C=async(e,t)=>{let n,r=new Promise((e,r)=>{n=setTimeout(()=>{r(/* @__PURE__ */ Error(`npm view timed out after ${t}ms`))},t)});try{return await Promise.race([e,r])}finally{clearTimeout(n)}},w=async(e,t)=>{if(!e.validName)return{unknown:`invalid package name`};let n=[`view`,e.queriedName??e.name,`time`,`dist-tags`,`deprecated`,`engines`,`--json`,`--prefix`,t.cwd];try{return oe(await C(t.runner(n),t.timeoutMs))}catch(e){return{unknown:e instanceof Error?e.message:String(e)}}},T=e=>e.queriedName===null?e.name:`${e.name}:${e.specifier.replace(/^npm:/,``)}`,E=(e,t,n,r)=>{let i=n?n.latest:r;return t!==null&&t.latestNode!==null&&t.deprecated===null&&e!==null&&i!==null&&i!==e},D=(e,t)=>{let n=[];return e.deprecated!==null&&n.push(`deprecated`),e.stale&&n.push(`stale`),e.outdated&&n.push(`outdated`),e.unknown!==null&&n.push(`unknown`),t&&n.push(`blocked`),n.length>0?n:[`ok`]},O=(e,t,n,r)=>{let i=`latest`in t?t:null,a=n?.current??ne(r.cwd,e.name),o=i?.latest??n?.latest??null,s=i?new Date(i.lastPublish):null,c=n!==void 0,l={name:e.name,queriedName:e.queriedName,type:e.type,specifier:e.specifier,current:a,wanted:n?.wanted??null,latest:o,outdated:c,majorBump:c&&S(a,o),deprecated:i?.deprecated??null,latestNode:i?.latestNode??null,lastPublish:s?s.toISOString():null,stale:s!==null&&s<b(r.now,-r.staleAfterMonths),unknown:`unknown`in t?t.unknown:null};return{...l,flags:D(l,E(o,i,n,a))}},k=(e,t)=>{let n=t=>e.filter(e=>e.flags.includes(t)).length;return{total:e.length,deprecated:n(`deprecated`),stale:n(`stale`),outdated:n(`outdated`),unknown:n(`unknown`),blocked:n(`blocked`),ok:n(`ok`),skipped:t}},A=async(e={})=>{let t=a(e.cwd??process.cwd()),n=e.staleAfterMonths??6,r=e.now??/* @__PURE__ */ new Date,i=e.runner??ue(),{project:o,entries:s,skipped:c}=te(t,{include:e.include??fe,ignore:e.ignore??[]}),l=v(await i([`outdated`,`--json`,`--prefix`,t])),u={cwd:t,runner:i,timeoutMs:e.timeoutMs??3e4,now:r,staleAfterMonths:n,outdated:l},d=await se(s,e.concurrency??6,async e=>O(e,await w(e,u),l[T(e)],u));return{schemaVersion:1,generatedAt:r.toISOString(),staleAfterMonths:n,project:o,packages:d,summary:k(d,c.length),skipped:c.sort((e,t)=>e.name<t.name?-1:Number(e.name>t.name))}},j=[`Package`,`Current`,`Wanted`,`Latest`,`Location`,`Depended by`,`Last publish`,`Flags`],M=/* @__PURE__ */ new Set([1,2,3]),N=[[`prod`,`dependencies`],[`dev`,`devDependencies`],[`optional`,`optionalDependencies`]],P=e=>`${JSON.stringify(e,null,2)}\n`,F=e=>e.length>60?`${e.slice(0,59)}…`:e,I=(e,t)=>t===`deprecated`?`deprecated ${F(e.deprecated??``)}`:t===`blocked`?`latest needs node ${e.latestNode??``}`:t===`unknown`?`unknown ${e.unknown??``}`:t,L=(e,t)=>e.lastPublish===null?`-`:`${e.lastPublish.slice(0,10)} (${de(e.lastPublish,t)})`,R=(e,t,n)=>[e.name,e.current??`-`,e.wanted??e.current??`-`,e.latest??`-`,`node_modules/${e.name}`,t,L(e,n)],z=e=>({deprecated:e.red,stale:e.yellow,outdated:e.cyan,unknown:e.magenta,blocked:e.blue,ok:e.green}),B=(e,t)=>{let n=z(t);return e.flags.map(t=>n[t](I(e,t))).join(` `)},V=(e,t)=>`\u001b]8;;${e}\u001b\\${t}\u001b]8;;\u001b\\`,H=e=>`https://www.npmjs.com/package/${e.queriedName??e.name}`,U=e=>e,W=(e,t)=>e.outdated?e.current===e.wanted?t.yellow:t.red:U,pe=(e,t)=>e.majorBump?t.red:e.outdated?t.magenta:U,me=(e,t,n)=>[n?n=>V(H(e),W(e,t)(n)):W(e,t),U,e.outdated?t.green:U,pe(e,t),t.dim,t.dim,U],G=(e,t,n,r)=>{let i=` `.repeat(Math.max(0,t-e.length));return M.has(n)?i+r(e):r(e)+i},he=(e,t,n,r,i)=>[...me(e,r,i).map((e,r)=>G(t[r]??``,n[r]??0,r,e)),B(e,r)].join(`  `).trimEnd(),ge=(e,t,n,r,i)=>{let a=e.map(e=>({pkg:e,cells:R(e,t,n)})),o=j.map((e,t)=>Math.max(e.length,...a.map(e=>e.cells[t]?.length??0))),s=j.map((e,t)=>t===j.length-1?e:G(e,o[t]??0,t,U)),c=[r.underline(r.bold(s.join(`  `)))];for(let[e,t]of N){let n=a.filter(t=>t.pkg.type===e);n.length>0&&(c.push(``,r.bold(`${t} (${n.length})`)),c.push(...n.map(e=>he(e.pkg,e.cells,o,r,i))))}return c},_e=(e,t)=>{let n=e.summary;return[`${n.total} packages`,t.red(`${n.deprecated} deprecated`),t.yellow(`${n.stale} stale`),t.cyan(`${n.outdated} outdated`),t.magenta(`${n.unknown} unknown`),t.blue(`${n.blocked} blocked`),t.green(`${n.ok} ok`)].join(` · `)},ve=(e,t)=>{let n=t.color??s.isColorSupported,r=s.createColors(n),i=t.onlyProblems?e.packages.filter(e=>e.flags.length!==1||e.flags[0]!==`ok`):e.packages,a=e.packages.length===0?[`No dependencies found`]:ge(i,e.project,t.now,r,n);if(a.push(``,_e(e,r)),e.skipped.length>0){a.push(``,r.bold(`Skipped:`));let t=Math.max(...e.skipped.map(e=>e.name.length));for(let n of e.skipped)a.push(`  ${n.name.padEnd(t)}  ${n.specifier} — ${n.reason}`)}return`${a.join(`
+`)}\n`},K=[`prod`,`dev`,`optional`],ye=[`stale`,`deprecated`,`outdated`,`unknown`],be=/* @__PURE__ */ new Set([`--`,`cwd`,`staleAfter`,`stale-after`,`include`,`ignore`,`concurrency`,`json`,`onlyProblems`,`only-problems`,`failOn`,`fail-on`,`h`,`v`,`help`,`version`]),q=e=>Array.isArray(e)?e.map(q).join(`,`):typeof e==`string`||typeof e==`number`||typeof e==`boolean`?String(e):JSON.stringify(e)??`undefined`,J=(e,t,n)=>e[t]??e[n],Y=(e,t,n)=>{if(e===void 0)return n;let r=q(e);if(!/^[1-9]\d*$/.test(r))throw Error(`${t} must be a positive integer, got "${r}"`);return Number(r)},X=(e,t)=>{let n=q(e),r=n.split(`,`);if(typeof e==`boolean`||r.includes(``))throw Error(`${t} must be a comma-separated list without empty entries, got "${n}"`);return r},Z=(e,t,n,r)=>{if(e===void 0)return r;let i=X(e,t),a=i.find(e=>!n.includes(e));if(a!==void 0)throw Error(`${t} has invalid value "${a}"; allowed: ${n.join(`, `)}`);return i},Q=(e,t)=>{if(e===void 0)return!1;if(typeof e!=`boolean`)throw Error(`${t} is a switch and takes no value, got "${q(e)}"`);return e},xe=e=>{if(e!==void 0){if(typeof e!=`string`&&typeof e!=`number`)throw Error(`--cwd must be a single path, got "${q(e)}"`);return{cwd:String(e)}}},Se=e=>{let t=Object.keys(e).find(e=>!be.has(e));if(t!==void 0)throw Error(`Unknown option: ${t}`);let{ignore:n}=e;return{...xe(e.cwd),staleAfterMonths:Y(J(e,`staleAfter`,`stale-after`),`--stale-after`,6),include:Z(e.include,`--include`,K,K),ignore:n===void 0?[]:X(n,`--ignore`),concurrency:Y(e.concurrency,`--concurrency`,6),json:Q(e.json,`--json`),onlyProblems:Q(J(e,`onlyProblems`,`only-problems`),`--only-problems`),failOn:Z(J(e,`failOn`,`fail-on`),`--fail-on`,ye,[])}},Ce=(t,n)=>n.some(e=>t.summary[e]>0)?e.ERROR:e.OK;var $=class extends Error{};const we=()=>n(`outdated`).usage(`[options]`).help(e=>{throw new $(e.map(e=>e.title?`${e.title}:\n${e.body}`:e.body).join(`
+
+`))}).option(`-v, --version`,`Display version number`).option(`--cwd <dir>`,`Project folder (default: current directory)`).option(`--stale-after <months>`,`Months without a release before a package is stale (default: 6)`).option(`--include <types>`,`Dependency types to check: prod,dev,optional (default: all)`).option(`--ignore <pkgs>`,`Comma-separated package names to skip`).option(`--concurrency <n>`,`Parallel npm view lookups (default: 6)`).option(`--json`,`Output machine-readable JSON`).option(`--only-problems`,`Hide ok packages from the table`).option(`--fail-on <list>`,`Exit 1 when any of stale,deprecated,outdated,unknown is found`),Te=async(t,n,r)=>{let{options:i}=we().parse([`node`,`outdated`,...t],{run:!1});if(i.version)return{stdout:`${c}\n`,code:e.OK};let a=Se(i),o=await A({cwd:a.cwd,staleAfterMonths:a.staleAfterMonths,include:a.include,ignore:a.ignore,concurrency:a.concurrency,runner:n,now:r});return{stdout:a.json?P(o):ve(o,{onlyProblems:a.onlyProblems,now:r}),code:Ce(o,a.failOn)}},{stdout:Ee,stderr:De,code:Oe}=await(async(t,n={})=>{try{return{...await Te(t,n.runner,n.now??/* @__PURE__ */ new Date),stderr:``}}catch(t){return t instanceof $?{stdout:`${t.message}\n`,stderr:``,code:e.OK}:{stdout:``,stderr:`✖ ${t instanceof Error?t.message:String(t)}\n`,code:e.EXCEPTION}}})(process.argv.slice(2));process.stderr.write(De),process.stdout.write(Ee,()=>process.exit(Oe));

package/lib/index.cjs

@@ -0,0 +1,320 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let path = require("path");
+let fs = require("fs");
+let _ladamczyk_qoq_utils = require("@ladamczyk/qoq-utils");
+//#region src/deps.ts
+const FIELDS = [
+	["prod", "dependencies"],
+	["optional", "optionalDependencies"],
+	["dev", "devDependencies"]
+];
+const UNSUPPORTED = [
+	"file:",
+	"link:",
+	"workspace:",
+	"git+",
+	"git:",
+	"github:",
+	"http:",
+	"https:"
+];
+const NAME_RE = /^(?:@[A-Za-z0-9~-][A-Za-z0-9._~-]*\/)?[A-Za-z0-9~-][A-Za-z0-9._~-]*$/;
+const readJson = (file) => {
+	try {
+		const parsed = JSON.parse((0, fs.readFileSync)(file, "utf8"));
+		return typeof parsed === "object" && parsed !== null ? parsed : null;
+	} catch {
+		return null;
+	}
+};
+const aliasTarget = (specifier) => {
+	if (!specifier.startsWith("npm:")) return null;
+	const rest = specifier.slice(4);
+	const at = rest.lastIndexOf("@");
+	return at > 0 ? rest.slice(0, at) : rest;
+};
+const collect = (pkg, include, seen) => {
+	for (const [type, field] of FIELDS) {
+		const deps = pkg[field];
+		if (!include.includes(type) || typeof deps !== "object" || deps === null) continue;
+		for (const [name, specifier] of Object.entries(deps)) if (!seen.has(name) && typeof specifier === "string") seen.set(name, {
+			type,
+			specifier
+		});
+	}
+};
+function readDeps(cwd, { include, ignore }) {
+	const file = (0, path.join)(cwd, "package.json");
+	const pkg = readJson(file);
+	if (!pkg) throw new Error(`Cannot read or parse package.json at ${file}`);
+	const seen = /* @__PURE__ */ new Map();
+	collect(pkg, include, seen);
+	const entries = [];
+	const skipped = [];
+	for (const [name, { type, specifier }] of seen) {
+		if (ignore.includes(name)) continue;
+		const prefix = UNSUPPORTED.find((p) => specifier.startsWith(p));
+		if (prefix) {
+			skipped.push({
+				name,
+				type,
+				specifier,
+				reason: `unsupported specifier (${prefix})`
+			});
+			continue;
+		}
+		const queriedName = aliasTarget(specifier);
+		entries.push({
+			name,
+			type,
+			specifier,
+			queriedName,
+			validName: NAME_RE.test(queriedName ?? name)
+		});
+	}
+	return {
+		project: typeof pkg["name"] === "string" && pkg["name"] ? pkg["name"] : (0, path.basename)(cwd),
+		entries,
+		skipped
+	};
+}
+function readInstalledVersion(cwd, name) {
+	const version = readJson((0, path.join)(cwd, "node_modules", name, "package.json"))?.["version"];
+	return typeof version === "string" ? version : null;
+}
+//#endregion
+//#region src/npm.ts
+const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const str = (v) => typeof v === "string" ? v : null;
+const parseJson = (stdout) => JSON.parse(stdout);
+const toEntry = (value) => {
+	const raw = Array.isArray(value) ? value[0] : value;
+	const e = isRecord(raw) ? raw : {};
+	return {
+		current: str(e.current),
+		wanted: str(e.wanted),
+		latest: str(e.latest)
+	};
+};
+const errorText = (err) => {
+	if (!isRecord(err) || err.code === void 0 && err.summary === void 0) return null;
+	return [str(err.code), str(err.summary)].filter(Boolean).join(" ");
+};
+const parseOutdated = (stdout) => {
+	if (stdout.trim() === "") throw new Error("npm outdated printed empty output");
+	let parsed;
+	try {
+		parsed = parseJson(stdout);
+	} catch {
+		throw new Error("npm outdated printed invalid JSON");
+	}
+	if (!isRecord(parsed)) throw new Error("npm outdated printed non-object JSON");
+	const failure = errorText(parsed.error);
+	if (failure !== null) throw new Error(`npm outdated failed: ${failure}`);
+	return Object.fromEntries(Object.entries(parsed).map(([name, v]) => [name, toEntry(v)]));
+};
+const nodeRange = (engines) => isRecord(engines) && typeof engines.node === "string" && engines.node !== "" ? engines.node : null;
+const UNEXPECTED = { unknown: "unexpected npm view output" };
+const buildView = (parsed) => {
+	const tags = parsed["dist-tags"];
+	const latest = isRecord(tags) ? str(tags.latest) : null;
+	if (latest === null || !isRecord(parsed.time)) return UNEXPECTED;
+	const lastPublish = str(parsed.time[latest]);
+	if (lastPublish === null || Number.isNaN(Date.parse(lastPublish))) return { unknown: `no valid publish time for ${latest}` };
+	const dep = parsed.deprecated;
+	return {
+		latest,
+		lastPublish,
+		deprecated: typeof dep === "string" && dep !== "" ? dep : null,
+		latestNode: nodeRange(parsed.engines)
+	};
+};
+const parseView = (stdout) => {
+	let parsed;
+	try {
+		parsed = parseJson(stdout);
+	} catch {
+		return { unknown: "invalid npm view JSON" };
+	}
+	if (!isRecord(parsed)) return UNEXPECTED;
+	if ("error" in parsed) return { unknown: errorText(parsed.error) ?? "npm view error" };
+	return buildView(parsed);
+};
+//#endregion
+//#region src/pool.ts
+async function mapPool(items, limit, fn) {
+	const results = new Array(items.length);
+	const executing = /* @__PURE__ */ new Set();
+	for (const [i, item] of items.entries()) {
+		const promise = fn(item).then((res) => {
+			results[i] = res;
+			executing.delete(promise);
+		});
+		executing.add(promise);
+		if (executing.size === limit) await Promise.race(executing);
+	}
+	await Promise.all(executing);
+	return results;
+}
+//#endregion
+//#region src/runner.ts
+const SHELL_SINGLE_QUOTE = String.raw`'\''`;
+const quote = (arg) => process.platform === "win32" ? `"${arg.replaceAll("\"", "\"\"")}"` : `'${arg.replaceAll("'", SHELL_SINGLE_QUOTE)}'`;
+const createNpmRunner = () => async (args) => {
+	if (args.some((arg) => /[\0\n\r]/.test(arg))) throw new Error("npm argument contains a control character");
+	const out = await (0, _ladamczyk_qoq_utils.executeCommand)(["npm", ...args.map(quote)].join(" "), [], [
+		"ignore",
+		"pipe",
+		"pipe"
+	], true);
+	return String(out);
+};
+//#endregion
+//#region src/time.ts
+function addMonths(date, months) {
+	const total = date.getUTCFullYear() * 12 + date.getUTCMonth() + months;
+	const year = Math.floor(total / 12);
+	const month = total - year * 12;
+	const lastDay = new Date(Date.UTC(year, month + 1, 0)).getUTCDate();
+	const result = new Date(date);
+	result.setUTCFullYear(year, month, Math.min(date.getUTCDate(), lastDay));
+	return result;
+}
+//#endregion
+//#region src/check.ts
+const ALL_TYPES = [
+	"prod",
+	"dev",
+	"optional"
+];
+const major = (version) => {
+	const match = /^v?(\d+)/.exec(version ?? "");
+	return match ? Number(match[1]) : null;
+};
+const isMajorBump = (current, latest) => {
+	const from = major(current);
+	const to = major(latest);
+	return from !== null && to !== null && to > from;
+};
+const withTimeout = async (work, ms) => {
+	let timer;
+	const timeout = new Promise((_, reject) => {
+		timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`npm view timed out after ${ms}ms`));
+		}, ms);
+	});
+	try {
+		return await Promise.race([work, timeout]);
+	} finally {
+		clearTimeout(timer);
+	}
+};
+const lookup = async (entry, ctx) => {
+	if (!entry.validName) return { unknown: "invalid package name" };
+	const args = [
+		"view",
+		entry.queriedName ?? entry.name,
+		"time",
+		"dist-tags",
+		"deprecated",
+		"engines",
+		"--json",
+		"--prefix",
+		ctx.cwd
+	];
+	try {
+		return parseView(await withTimeout(ctx.runner(args), ctx.timeoutMs));
+	} catch (error) {
+		return { unknown: error instanceof Error ? error.message : String(error) };
+	}
+};
+const outdatedKey = (entry) => entry.queriedName === null ? entry.name : `${entry.name}:${entry.specifier.replace(/^npm:/, "")}`;
+const isBlocked = (latest, viewed, hit, current) => {
+	const npmLatest = hit ? hit.latest : current;
+	return viewed !== null && viewed.latestNode !== null && viewed.deprecated === null && latest !== null && npmLatest !== null && npmLatest !== latest;
+};
+const flagsFor = (row, blocked) => {
+	const flags = [];
+	if (row.deprecated !== null) flags.push("deprecated");
+	if (row.stale) flags.push("stale");
+	if (row.outdated) flags.push("outdated");
+	if (row.unknown !== null) flags.push("unknown");
+	if (blocked) flags.push("blocked");
+	return flags.length > 0 ? flags : ["ok"];
+};
+const buildRow = (entry, view, hit, ctx) => {
+	const viewed = "latest" in view ? view : null;
+	const current = hit?.current ?? readInstalledVersion(ctx.cwd, entry.name);
+	const latest = viewed?.latest ?? hit?.latest ?? null;
+	const published = viewed ? new Date(viewed.lastPublish) : null;
+	const outdated = hit !== void 0;
+	const partial = {
+		name: entry.name,
+		queriedName: entry.queriedName,
+		type: entry.type,
+		specifier: entry.specifier,
+		current,
+		wanted: hit?.wanted ?? null,
+		latest,
+		outdated,
+		majorBump: outdated && isMajorBump(current, latest),
+		deprecated: viewed?.deprecated ?? null,
+		latestNode: viewed?.latestNode ?? null,
+		lastPublish: published ? published.toISOString() : null,
+		stale: published !== null && published < addMonths(ctx.now, -ctx.staleAfterMonths),
+		unknown: "unknown" in view ? view.unknown : null
+	};
+	return {
+		...partial,
+		flags: flagsFor(partial, isBlocked(latest, viewed, hit, current))
+	};
+};
+const summarise = (packages, skipped) => {
+	const count = (flag) => packages.filter((p) => p.flags.includes(flag)).length;
+	return {
+		total: packages.length,
+		deprecated: count("deprecated"),
+		stale: count("stale"),
+		outdated: count("outdated"),
+		unknown: count("unknown"),
+		blocked: count("blocked"),
+		ok: count("ok"),
+		skipped
+	};
+};
+const check = async (options = {}) => {
+	const cwd = (0, path.resolve)(options.cwd ?? process.cwd());
+	const staleAfterMonths = options.staleAfterMonths ?? 6;
+	const now = options.now ?? /* @__PURE__ */ new Date();
+	const runner = options.runner ?? createNpmRunner();
+	const { project, entries, skipped } = readDeps(cwd, {
+		include: options.include ?? ALL_TYPES,
+		ignore: options.ignore ?? []
+	});
+	const outdated = parseOutdated(await runner([
+		"outdated",
+		"--json",
+		"--prefix",
+		cwd
+	]));
+	const ctx = {
+		cwd,
+		runner,
+		timeoutMs: options.timeoutMs ?? 3e4,
+		now,
+		staleAfterMonths,
+		outdated
+	};
+	const packages = await mapPool(entries, options.concurrency ?? 6, async (entry) => buildRow(entry, await lookup(entry, ctx), outdated[outdatedKey(entry)], ctx));
+	return {
+		schemaVersion: 1,
+		generatedAt: now.toISOString(),
+		staleAfterMonths,
+		project,
+		packages,
+		summary: summarise(packages, skipped.length),
+		skipped: skipped.sort((a, b) => a.name < b.name ? -1 : Number(a.name > b.name))
+	};
+};
+//#endregion
+exports.check = check;

package/lib/index.mjs

@@ -0,0 +1,319 @@
+import { basename, join, resolve } from "path";
+import { readFileSync } from "fs";
+import { executeCommand } from "@ladamczyk/qoq-utils";
+//#region src/deps.ts
+const FIELDS = [
+	["prod", "dependencies"],
+	["optional", "optionalDependencies"],
+	["dev", "devDependencies"]
+];
+const UNSUPPORTED = [
+	"file:",
+	"link:",
+	"workspace:",
+	"git+",
+	"git:",
+	"github:",
+	"http:",
+	"https:"
+];
+const NAME_RE = /^(?:@[A-Za-z0-9~-][A-Za-z0-9._~-]*\/)?[A-Za-z0-9~-][A-Za-z0-9._~-]*$/;
+const readJson = (file) => {
+	try {
+		const parsed = JSON.parse(readFileSync(file, "utf8"));
+		return typeof parsed === "object" && parsed !== null ? parsed : null;
+	} catch {
+		return null;
+	}
+};
+const aliasTarget = (specifier) => {
+	if (!specifier.startsWith("npm:")) return null;
+	const rest = specifier.slice(4);
+	const at = rest.lastIndexOf("@");
+	return at > 0 ? rest.slice(0, at) : rest;
+};
+const collect = (pkg, include, seen) => {
+	for (const [type, field] of FIELDS) {
+		const deps = pkg[field];
+		if (!include.includes(type) || typeof deps !== "object" || deps === null) continue;
+		for (const [name, specifier] of Object.entries(deps)) if (!seen.has(name) && typeof specifier === "string") seen.set(name, {
+			type,
+			specifier
+		});
+	}
+};
+function readDeps(cwd, { include, ignore }) {
+	const file = join(cwd, "package.json");
+	const pkg = readJson(file);
+	if (!pkg) throw new Error(`Cannot read or parse package.json at ${file}`);
+	const seen = /* @__PURE__ */ new Map();
+	collect(pkg, include, seen);
+	const entries = [];
+	const skipped = [];
+	for (const [name, { type, specifier }] of seen) {
+		if (ignore.includes(name)) continue;
+		const prefix = UNSUPPORTED.find((p) => specifier.startsWith(p));
+		if (prefix) {
+			skipped.push({
+				name,
+				type,
+				specifier,
+				reason: `unsupported specifier (${prefix})`
+			});
+			continue;
+		}
+		const queriedName = aliasTarget(specifier);
+		entries.push({
+			name,
+			type,
+			specifier,
+			queriedName,
+			validName: NAME_RE.test(queriedName ?? name)
+		});
+	}
+	return {
+		project: typeof pkg["name"] === "string" && pkg["name"] ? pkg["name"] : basename(cwd),
+		entries,
+		skipped
+	};
+}
+function readInstalledVersion(cwd, name) {
+	const version = readJson(join(cwd, "node_modules", name, "package.json"))?.["version"];
+	return typeof version === "string" ? version : null;
+}
+//#endregion
+//#region src/npm.ts
+const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const str = (v) => typeof v === "string" ? v : null;
+const parseJson = (stdout) => JSON.parse(stdout);
+const toEntry = (value) => {
+	const raw = Array.isArray(value) ? value[0] : value;
+	const e = isRecord(raw) ? raw : {};
+	return {
+		current: str(e.current),
+		wanted: str(e.wanted),
+		latest: str(e.latest)
+	};
+};
+const errorText = (err) => {
+	if (!isRecord(err) || err.code === void 0 && err.summary === void 0) return null;
+	return [str(err.code), str(err.summary)].filter(Boolean).join(" ");
+};
+const parseOutdated = (stdout) => {
+	if (stdout.trim() === "") throw new Error("npm outdated printed empty output");
+	let parsed;
+	try {
+		parsed = parseJson(stdout);
+	} catch {
+		throw new Error("npm outdated printed invalid JSON");
+	}
+	if (!isRecord(parsed)) throw new Error("npm outdated printed non-object JSON");
+	const failure = errorText(parsed.error);
+	if (failure !== null) throw new Error(`npm outdated failed: ${failure}`);
+	return Object.fromEntries(Object.entries(parsed).map(([name, v]) => [name, toEntry(v)]));
+};
+const nodeRange = (engines) => isRecord(engines) && typeof engines.node === "string" && engines.node !== "" ? engines.node : null;
+const UNEXPECTED = { unknown: "unexpected npm view output" };
+const buildView = (parsed) => {
+	const tags = parsed["dist-tags"];
+	const latest = isRecord(tags) ? str(tags.latest) : null;
+	if (latest === null || !isRecord(parsed.time)) return UNEXPECTED;
+	const lastPublish = str(parsed.time[latest]);
+	if (lastPublish === null || Number.isNaN(Date.parse(lastPublish))) return { unknown: `no valid publish time for ${latest}` };
+	const dep = parsed.deprecated;
+	return {
+		latest,
+		lastPublish,
+		deprecated: typeof dep === "string" && dep !== "" ? dep : null,
+		latestNode: nodeRange(parsed.engines)
+	};
+};
+const parseView = (stdout) => {
+	let parsed;
+	try {
+		parsed = parseJson(stdout);
+	} catch {
+		return { unknown: "invalid npm view JSON" };
+	}
+	if (!isRecord(parsed)) return UNEXPECTED;
+	if ("error" in parsed) return { unknown: errorText(parsed.error) ?? "npm view error" };
+	return buildView(parsed);
+};
+//#endregion
+//#region src/pool.ts
+async function mapPool(items, limit, fn) {
+	const results = new Array(items.length);
+	const executing = /* @__PURE__ */ new Set();
+	for (const [i, item] of items.entries()) {
+		const promise = fn(item).then((res) => {
+			results[i] = res;
+			executing.delete(promise);
+		});
+		executing.add(promise);
+		if (executing.size === limit) await Promise.race(executing);
+	}
+	await Promise.all(executing);
+	return results;
+}
+//#endregion
+//#region src/runner.ts
+const SHELL_SINGLE_QUOTE = String.raw`'\''`;
+const quote = (arg) => process.platform === "win32" ? `"${arg.replaceAll("\"", "\"\"")}"` : `'${arg.replaceAll("'", SHELL_SINGLE_QUOTE)}'`;
+const createNpmRunner = () => async (args) => {
+	if (args.some((arg) => /[\0\n\r]/.test(arg))) throw new Error("npm argument contains a control character");
+	const out = await executeCommand(["npm", ...args.map(quote)].join(" "), [], [
+		"ignore",
+		"pipe",
+		"pipe"
+	], true);
+	return String(out);
+};
+//#endregion
+//#region src/time.ts
+function addMonths(date, months) {
+	const total = date.getUTCFullYear() * 12 + date.getUTCMonth() + months;
+	const year = Math.floor(total / 12);
+	const month = total - year * 12;
+	const lastDay = new Date(Date.UTC(year, month + 1, 0)).getUTCDate();
+	const result = new Date(date);
+	result.setUTCFullYear(year, month, Math.min(date.getUTCDate(), lastDay));
+	return result;
+}
+//#endregion
+//#region src/check.ts
+const ALL_TYPES = [
+	"prod",
+	"dev",
+	"optional"
+];
+const major = (version) => {
+	const match = /^v?(\d+)/.exec(version ?? "");
+	return match ? Number(match[1]) : null;
+};
+const isMajorBump = (current, latest) => {
+	const from = major(current);
+	const to = major(latest);
+	return from !== null && to !== null && to > from;
+};
+const withTimeout = async (work, ms) => {
+	let timer;
+	const timeout = new Promise((_, reject) => {
+		timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`npm view timed out after ${ms}ms`));
+		}, ms);
+	});
+	try {
+		return await Promise.race([work, timeout]);
+	} finally {
+		clearTimeout(timer);
+	}
+};
+const lookup = async (entry, ctx) => {
+	if (!entry.validName) return { unknown: "invalid package name" };
+	const args = [
+		"view",
+		entry.queriedName ?? entry.name,
+		"time",
+		"dist-tags",
+		"deprecated",
+		"engines",
+		"--json",
+		"--prefix",
+		ctx.cwd
+	];
+	try {
+		return parseView(await withTimeout(ctx.runner(args), ctx.timeoutMs));
+	} catch (error) {
+		return { unknown: error instanceof Error ? error.message : String(error) };
+	}
+};
+const outdatedKey = (entry) => entry.queriedName === null ? entry.name : `${entry.name}:${entry.specifier.replace(/^npm:/, "")}`;
+const isBlocked = (latest, viewed, hit, current) => {
+	const npmLatest = hit ? hit.latest : current;
+	return viewed !== null && viewed.latestNode !== null && viewed.deprecated === null && latest !== null && npmLatest !== null && npmLatest !== latest;
+};
+const flagsFor = (row, blocked) => {
+	const flags = [];
+	if (row.deprecated !== null) flags.push("deprecated");
+	if (row.stale) flags.push("stale");
+	if (row.outdated) flags.push("outdated");
+	if (row.unknown !== null) flags.push("unknown");
+	if (blocked) flags.push("blocked");
+	return flags.length > 0 ? flags : ["ok"];
+};
+const buildRow = (entry, view, hit, ctx) => {
+	const viewed = "latest" in view ? view : null;
+	const current = hit?.current ?? readInstalledVersion(ctx.cwd, entry.name);
+	const latest = viewed?.latest ?? hit?.latest ?? null;
+	const published = viewed ? new Date(viewed.lastPublish) : null;
+	const outdated = hit !== void 0;
+	const partial = {
+		name: entry.name,
+		queriedName: entry.queriedName,
+		type: entry.type,
+		specifier: entry.specifier,
+		current,
+		wanted: hit?.wanted ?? null,
+		latest,
+		outdated,
+		majorBump: outdated && isMajorBump(current, latest),
+		deprecated: viewed?.deprecated ?? null,
+		latestNode: viewed?.latestNode ?? null,
+		lastPublish: published ? published.toISOString() : null,
+		stale: published !== null && published < addMonths(ctx.now, -ctx.staleAfterMonths),
+		unknown: "unknown" in view ? view.unknown : null
+	};
+	return {
+		...partial,
+		flags: flagsFor(partial, isBlocked(latest, viewed, hit, current))
+	};
+};
+const summarise = (packages, skipped) => {
+	const count = (flag) => packages.filter((p) => p.flags.includes(flag)).length;
+	return {
+		total: packages.length,
+		deprecated: count("deprecated"),
+		stale: count("stale"),
+		outdated: count("outdated"),
+		unknown: count("unknown"),
+		blocked: count("blocked"),
+		ok: count("ok"),
+		skipped
+	};
+};
+const check = async (options = {}) => {
+	const cwd = resolve(options.cwd ?? process.cwd());
+	const staleAfterMonths = options.staleAfterMonths ?? 6;
+	const now = options.now ?? /* @__PURE__ */ new Date();
+	const runner = options.runner ?? createNpmRunner();
+	const { project, entries, skipped } = readDeps(cwd, {
+		include: options.include ?? ALL_TYPES,
+		ignore: options.ignore ?? []
+	});
+	const outdated = parseOutdated(await runner([
+		"outdated",
+		"--json",
+		"--prefix",
+		cwd
+	]));
+	const ctx = {
+		cwd,
+		runner,
+		timeoutMs: options.timeoutMs ?? 3e4,
+		now,
+		staleAfterMonths,
+		outdated
+	};
+	const packages = await mapPool(entries, options.concurrency ?? 6, async (entry) => buildRow(entry, await lookup(entry, ctx), outdated[outdatedKey(entry)], ctx));
+	return {
+		schemaVersion: 1,
+		generatedAt: now.toISOString(),
+		staleAfterMonths,
+		project,
+		packages,
+		summary: summarise(packages, skipped.length),
+		skipped: skipped.sort((a, b) => a.name < b.name ? -1 : Number(a.name > b.name))
+	};
+};
+//#endregion
+export { check };

package/lib/src/check.d.ts

@@ -0,0 +1,2 @@
+import type { ICheckOptions, ICheckResult } from './types.ts';
+export declare const check: (options?: ICheckOptions) => Promise<ICheckResult>;

package/lib/src/check.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/src/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/lib/src/deps.d.ts

@@ -0,0 +1,17 @@
+import type { ISkipped, TDepType } from './types.ts';
+export interface IDepEntry {
+    name: string;
+    type: TDepType;
+    specifier: string;
+    queriedName: string | null;
+    validName: boolean;
+}
+export declare function readDeps(cwd: string, { include, ignore }: {
+    include: readonly TDepType[];
+    ignore: readonly string[];
+}): {
+    project: string;
+    entries: IDepEntry[];
+    skipped: ISkipped[];
+};
+export declare function readInstalledVersion(cwd: string, name: string): string | null;

package/lib/src/deps.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/src/format.d.ts

@@ -0,0 +1,7 @@
+import type { ICheckResult } from './types.ts';
+export declare const formatJson: (result: ICheckResult) => string;
+export declare const formatTable: (result: ICheckResult, opts: {
+    onlyProblems: boolean;
+    now: Date;
+    color?: boolean | undefined;
+}) => string;

package/lib/src/format.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/src/index.d.ts

@@ -0,0 +1,2 @@
+export { check } from './check.ts';
+export type { ICheckOptions, ICheckResult, IPackageResult, TRunner, ISkipped, ISummary, TDepType, TFlag, TProblem, } from './types.ts';

package/lib/src/npm.d.ts

@@ -0,0 +1,15 @@
+export interface IOutdatedEntry {
+    current: string | null;
+    wanted: string | null;
+    latest: string | null;
+}
+export type TViewResult = {
+    latest: string;
+    lastPublish: string;
+    deprecated: string | null;
+    latestNode: string | null;
+} | {
+    unknown: string;
+};
+export declare const parseOutdated: (stdout: string) => Record<string, IOutdatedEntry>;
+export declare const parseView: (stdout: string) => TViewResult;

package/lib/src/npm.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/src/options.d.ts

@@ -0,0 +1,14 @@
+import { EExitCode } from '@ladamczyk/qoq-utils';
+import type { ICheckResult, TDepType, TProblem } from './types.ts';
+export interface ICliOptions {
+    cwd?: string | undefined;
+    staleAfterMonths: number;
+    include: readonly TDepType[];
+    ignore: readonly string[];
+    concurrency: number;
+    json: boolean;
+    onlyProblems: boolean;
+    failOn: readonly TProblem[];
+}
+export declare const parseCliOptions: (raw: Record<string, unknown>) => ICliOptions;
+export declare const exitCodeFor: (result: ICheckResult, failOn: readonly TProblem[]) => EExitCode;

package/lib/src/options.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/src/pool.d.ts

@@ -0,0 +1 @@
+export declare function mapPool<T, R>(items: readonly T[], limit: number, fn: (item: T) => Promise<R>): Promise<R[]>;

package/lib/src/pool.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/src/readme.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/src/run.d.ts

@@ -0,0 +1,11 @@
+import { EExitCode } from '@ladamczyk/qoq-utils';
+import type { TRunner } from './types.ts';
+export interface IRunResult {
+    stdout: string;
+    stderr: string;
+    code: EExitCode;
+}
+export declare const run: (argv: string[], io?: {
+    runner?: TRunner;
+    now?: Date;
+}) => Promise<IRunResult>;

package/lib/src/run.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/src/runner.d.ts

@@ -0,0 +1,2 @@
+import type { TRunner } from './types.ts';
+export declare const createNpmRunner: () => TRunner;

package/lib/src/runner.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/src/time.d.ts

@@ -0,0 +1,3 @@
+export declare function addMonths(date: Date, months: number): Date;
+export declare function isStale(lastPublish: Date, now: Date, months: number): boolean;
+export declare function relativeAge(iso: string, now: Date): string;

package/lib/src/time.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/src/types.d.ts

@@ -0,0 +1,56 @@
+export type TDepType = 'prod' | 'dev' | 'optional';
+export type TProblem = 'deprecated' | 'stale' | 'outdated' | 'unknown';
+export type TFlag = TProblem | 'blocked' | 'ok';
+export type TRunner = (args: readonly string[]) => Promise<string>;
+export interface ICheckOptions {
+    cwd?: string | undefined;
+    staleAfterMonths?: number | undefined;
+    include?: readonly TDepType[] | undefined;
+    ignore?: readonly string[] | undefined;
+    concurrency?: number | undefined;
+    timeoutMs?: number | undefined;
+    runner?: TRunner | undefined;
+    now?: Date | undefined;
+}
+export interface IPackageResult {
+    name: string;
+    queriedName: string | null;
+    type: TDepType;
+    specifier: string;
+    current: string | null;
+    wanted: string | null;
+    latest: string | null;
+    outdated: boolean;
+    majorBump: boolean;
+    deprecated: string | null;
+    latestNode: string | null;
+    lastPublish: string | null;
+    stale: boolean;
+    unknown: string | null;
+    flags: TFlag[];
+}
+export interface ISkipped {
+    name: string;
+    type: TDepType;
+    specifier: string;
+    reason: string;
+}
+export interface ISummary {
+    total: number;
+    deprecated: number;
+    stale: number;
+    outdated: number;
+    unknown: number;
+    blocked: number;
+    ok: number;
+    skipped: number;
+}
+export interface ICheckResult {
+    schemaVersion: 1;
+    generatedAt: string;
+    staleAfterMonths: number;
+    project: string;
+    packages: IPackageResult[];
+    summary: ISummary;
+    skipped: ISkipped[];
+}

package/package.json

@@ -0,0 +1,81 @@
+{
+  "name": "@ladamczyk/outdated",
+  "version": "1.0.0",
+  "description": "CLI that reports outdated dependencies",
+  "keywords": [
+    "cli",
+    "outdated",
+    "dependencies",
+    "npm"
+  ],
+  "homepage": "https://github.com/ladamczyk-it/outdated",
+  "bugs": {
+    "url": "https://github.com/ladamczyk-it/outdated/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/ladamczyk-it/outdated.git"
+  },
+  "license": "MIT",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./lib/src/index.d.ts",
+      "import": "./lib/index.mjs",
+      "require": "./lib/index.cjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./lib/index.cjs",
+  "module": "./lib/index.mjs",
+  "types": "./lib/src/index.d.ts",
+  "bin": {
+    "outdated": "bin/cli.js"
+  },
+  "files": [
+    "bin",
+    "lib"
+  ],
+  "scripts": {
+    "build": "rimraf ./bin ./lib && rolldown -c && tsc --emitDeclarationOnly && chmod +x ./bin/cli.js",
+    "dev": "npm run build && node ./bin/cli.js",
+    "husky:pre-push": "run-s qoq:check test build",
+    "prepare": "husky",
+    "publish:full": "run-s husky:pre-push publish:release",
+    "publish:release": "npx --package semantic-release --package @semantic-release/changelog --package @semantic-release/git -y semantic-release",
+    "qoq:check": "qoq --check",
+    "qoq:fix": "qoq --fix",
+    "sort:packages:json": "npx -y sort-package-json 'package.json'",
+    "test": "vitest run",
+    "test:coverage": "npm run test -- --coverage"
+  },
+  "dependencies": {
+    "@ladamczyk/qoq-utils": "6.1.10",
+    "cac": "7.0.0",
+    "picocolors": "1.1.1"
+  },
+  "devDependencies": {
+    "@commitlint/cli": "21.2.3",
+    "@commitlint/config-conventional": "21.2.3",
+    "@ladamczyk/qoq-cli": "6.1.10",
+    "@ladamczyk/qoq-eslint-v9-ts": "6.1.10",
+    "@ladamczyk/qoq-jscpd": "6.1.10",
+    "@ladamczyk/qoq-knip": "6.1.10",
+    "@ladamczyk/qoq-prettier-with-json-sort": "6.1.10",
+    "@types/node": "^22",
+    "@vitest/coverage-v8": "5.0.3",
+    "dotenv": "18.0.6",
+    "husky": "9.1.7",
+    "npm-run-all2": "9.0.3",
+    "rimraf": "6.1.3",
+    "rolldown": "1.2.13",
+    "typescript": "6.0.3",
+    "vitest": "5.0.3"
+  },
+  "engines": {
+    "node": ">=22.22.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}