dep-brain 1.3.0 → 1.5.0

package/dist/core/graph-builder.js

@@ -7,32 +7,29 @@ export async function buildDependencyGraph(rootDir) {
     const pnpmLockfilePath = path.join(rootDir, "pnpm-lock.yaml");
     const yarnLockfilePath = path.join(rootDir, "yarn.lock");
     const packageJson = await readJsonFile(packageJsonPath);
-    const lockPackages = new Map();
     try {
         const packageLock = await readJsonFile(lockfilePath);
-        for (const [packagePath, details] of Object.entries(packageLock.packages ?? {})) {
-            const name = extractPackageName(packagePath);
-            const version = details.version;
-            if (!name || !version) {
-                continue;
-            }
-            const instances = lockPackages.get(name) ?? new Map();
-            const normalizedPath = packagePath || "node_modules/" + name;
-            instances.set(normalizedPath, { path: normalizedPath, version });
-            lockPackages.set(name, instances);
-        }
-        for (const [name, details] of Object.entries(packageLock.dependencies ?? {})) {
-            if (!details.version) {
-                continue;
-            }
-            const instances = lockPackages.get(name) ?? new Map();
-            const normalizedPath = `node_modules/${name}`;
-            instances.set(normalizedPath, { path: normalizedPath, version: details.version });
-            lockPackages.set(name, instances);
-        }
+        const parsed = parseNpmLockfile(packageLock, {
+            ...packageJson.dependencies,
+            ...packageJson.devDependencies
+        });
+        return {
+            rootDir,
+            packageJsonPath,
+            lockfilePath,
+            dependencies: packageJson.dependencies ?? {},
+            devDependencies: packageJson.devDependencies ?? {},
+            overrides: packageJson.overrides ?? {},
+            scripts: packageJson.scripts ?? {},
+            lockPackages: parsed.lockPackages,
+            lockDependencies: parsed.lockDependencies
+        };
     }
     catch {
-        const fallbackLockfile = await readAlternativeLockfile(pnpmLockfilePath, yarnLockfilePath);
+        const fallbackLockfile = await readAlternativeLockfile(pnpmLockfilePath, yarnLockfilePath, {
+            ...packageJson.dependencies,
+            ...packageJson.devDependencies
+        });
         return {
             rootDir,
             packageJsonPath,
@@ -41,29 +38,19 @@ export async function buildDependencyGraph(rootDir) {
             devDependencies: packageJson.devDependencies ?? {},
             overrides: packageJson.overrides ?? {},
             scripts: packageJson.scripts ?? {},
-            lockPackages: fallbackLockfile.lockPackages
+            lockPackages: fallbackLockfile.lockPackages,
+            lockDependencies: fallbackLockfile.lockDependencies
         };
     }
-    return {
-        rootDir,
-        packageJsonPath,
-        lockfilePath,
-        dependencies: packageJson.dependencies ?? {},
-        devDependencies: packageJson.devDependencies ?? {},
-        overrides: packageJson.overrides ?? {},
-        scripts: packageJson.scripts ?? {},
-        lockPackages: Object.fromEntries(Array.from(lockPackages.entries()).map(([name, instances]) => [
-            name,
-            Array.from(instances.values()).sort((left, right) => left.path.localeCompare(right.path))
-        ]))
-    };
 }
-async function readAlternativeLockfile(pnpmLockfilePath, yarnLockfilePath) {
+async function readAlternativeLockfile(pnpmLockfilePath, yarnLockfilePath, rootDependencies) {
     try {
         const content = await fs.readFile(pnpmLockfilePath, "utf8");
+        const parsed = parsePnpmLockfile(content, rootDependencies);
         return {
             lockfilePath: pnpmLockfilePath,
-            lockPackages: parsePnpmLockfile(content)
+            lockPackages: parsed.lockPackages,
+            lockDependencies: parsed.lockDependencies
         };
     }
     catch {
@@ -71,58 +58,150 @@ async function readAlternativeLockfile(pnpmLockfilePath, yarnLockfilePath) {
     }
     try {
         const content = await fs.readFile(yarnLockfilePath, "utf8");
+        const parsed = parseYarnLockfile(content, rootDependencies);
         return {
             lockfilePath: yarnLockfilePath,
-            lockPackages: parseYarnLockfile(content)
+            lockPackages: parsed.lockPackages,
+            lockDependencies: parsed.lockDependencies
         };
     }
     catch {
         return {
-            lockPackages: {}
+            lockPackages: {},
+            lockDependencies: {}
         };
     }
 }
-function extractPackageName(packagePath) {
-    if (!packagePath) {
-        return null;
+function parseNpmLockfile(packageLock, rootDependencies) {
+    const lockPackages = new Map();
+    const lockDependencies = new Map();
+    for (const [packagePath, details] of Object.entries(packageLock.packages ?? {})) {
+        const name = details.name ?? extractPackageName(packagePath);
+        const version = details.version;
+        if (name && version) {
+            const instances = lockPackages.get(name) ?? new Map();
+            const normalizedPath = packagePath || "node_modules/" + name;
+            instances.set(normalizedPath, { path: normalizedPath, version });
+            lockPackages.set(name, instances);
+        }
+        if (name) {
+            addDependencyNames(lockDependencies, name, Object.keys(details.dependencies ?? {}));
+        }
     }
-    const match = packagePath.match(/(?:^|\/)node_modules\/(.+)$/);
-    if (!match) {
-        return null;
+    for (const [name, details] of Object.entries(packageLock.dependencies ?? {})) {
+        if (details.version) {
+            const instances = lockPackages.get(name) ?? new Map();
+            const normalizedPath = `node_modules/${name}`;
+            instances.set(normalizedPath, { path: normalizedPath, version: details.version });
+            lockPackages.set(name, instances);
+        }
+        addDependencyNames(lockDependencies, name, Object.keys(details.requires ?? {}));
     }
-    return match[1];
+    addDependencyNames(lockDependencies, "__root__", Object.keys(rootDependencies));
+    return {
+        lockPackages: toLockPackageRecord(lockPackages),
+        lockDependencies: toDependencyRecord(lockDependencies)
+    };
 }
-function parsePnpmLockfile(content) {
+function parsePnpmLockfile(content, rootDependencies) {
     const lockPackages = new Map();
-    for (const line of content.split(/\r?\n/)) {
-        const match = line.match(/^\s{2}(?:'|")?\/((?:@[^/]+\/)?[^/@'"]+)@([^('":]+)[^:]*:(?:'|")?\s*$/);
-        if (!match) {
+    const lockDependencies = new Map();
+    const lines = content.split(/\r?\n/);
+    let currentName = null;
+    let currentVersion = null;
+    let inDependenciesBlock = false;
+    for (const line of lines) {
+        const packageMatch = line.match(/^\s{2}(?:'|")?\/((?:@[^/]+\/)?[^/@'"]+)@([^('":]+)[^:]*:(?:'|")?\s*$/);
+        if (packageMatch) {
+            currentName = packageMatch[1];
+            currentVersion = packageMatch[2];
+            inDependenciesBlock = false;
+            addLockPackage(lockPackages, currentName, `pnpm:${currentName}@${currentVersion}`, currentVersion);
+            continue;
+        }
+        if (!currentName) {
+            continue;
+        }
+        if (/^\s{4}(?:dependencies|optionalDependencies):\s*$/.test(line)) {
+            inDependenciesBlock = true;
+            continue;
+        }
+        if (/^\s{4}\S/.test(line) && !/^\s{4}(?:dependencies|optionalDependencies):\s*$/.test(line)) {
+            inDependenciesBlock = false;
+        }
+        if (!inDependenciesBlock) {
             continue;
         }
-        addLockPackage(lockPackages, match[1], `pnpm-lock:${match[0].trim()}`, match[2]);
+        const dependencyMatch = line.match(/^\s{6}((?:@[^/]+\/)?[^:\s]+):\s*(.+)?$/);
+        if (!dependencyMatch) {
+            continue;
+        }
+        addDependencyNames(lockDependencies, currentName, [dependencyMatch[1]]);
     }
-    return toLockPackageRecord(lockPackages);
+    addDependencyNames(lockDependencies, "__root__", Object.keys(rootDependencies));
+    return {
+        lockPackages: toLockPackageRecord(lockPackages),
+        lockDependencies: toDependencyRecord(lockDependencies)
+    };
 }
-function parseYarnLockfile(content) {
+function parseYarnLockfile(content, rootDependencies) {
     const lockPackages = new Map();
+    const lockDependencies = new Map();
+    const lines = content.split(/\r?\n/);
     let currentNames = [];
-    for (const line of content.split(/\r?\n/)) {
+    let currentVersion = null;
+    let inDependenciesBlock = false;
+    for (const line of lines) {
         if (line.trim().length === 0 || line.startsWith("#")) {
             continue;
         }
         if (!line.startsWith(" ") && line.endsWith(":")) {
             currentNames = extractYarnEntryNames(line.slice(0, -1));
+            currentVersion = null;
+            inDependenciesBlock = false;
             continue;
         }
         const versionMatch = line.match(/^\s+version\s+"?([^"\s]+)"?\s*$/);
-        if (!versionMatch) {
+        if (versionMatch) {
+            currentVersion = versionMatch[1];
+            for (const name of currentNames) {
+                addLockPackage(lockPackages, name, `yarn:${name}@${currentVersion}`, currentVersion);
+            }
+            continue;
+        }
+        if (/^\s{2}dependencies:\s*$/.test(line)) {
+            inDependenciesBlock = true;
+            continue;
+        }
+        if (/^\s{2}\S/.test(line) && !/^\s{2}dependencies:\s*$/.test(line)) {
+            inDependenciesBlock = false;
+        }
+        if (!inDependenciesBlock) {
+            continue;
+        }
+        const dependencyMatch = line.match(/^\s{4}((?:@[^/]+\/)?[^"\s]+)\s+/);
+        if (!dependencyMatch) {
             continue;
         }
         for (const name of currentNames) {
-            addLockPackage(lockPackages, name, `yarn-lock:${name}@${versionMatch[1]}`, versionMatch[1]);
+            addDependencyNames(lockDependencies, name, [dependencyMatch[1]]);
         }
     }
-    return toLockPackageRecord(lockPackages);
+    addDependencyNames(lockDependencies, "__root__", Object.keys(rootDependencies));
+    return {
+        lockPackages: toLockPackageRecord(lockPackages),
+        lockDependencies: toDependencyRecord(lockDependencies)
+    };
+}
+function extractPackageName(packagePath) {
+    if (!packagePath) {
+        return null;
+    }
+    const match = packagePath.match(/(?:^|\/)node_modules\/(.+)$/);
+    if (!match) {
+        return null;
+    }
+    return match[1];
 }
 function extractYarnEntryNames(entry) {
     const names = new Set();
@@ -149,9 +228,25 @@ function addLockPackage(lockPackages, name, packagePath, version) {
     instances.set(packagePath, { path: packagePath, version });
     lockPackages.set(name, instances);
 }
+function addDependencyNames(lockDependencies, name, dependencies) {
+    if (dependencies.length === 0) {
+        return;
+    }
+    const entry = lockDependencies.get(name) ?? new Set();
+    for (const dependency of dependencies) {
+        entry.add(dependency);
+    }
+    lockDependencies.set(name, entry);
+}
 function toLockPackageRecord(lockPackages) {
     return Object.fromEntries(Array.from(lockPackages.entries()).map(([name, instances]) => [
         name,
         Array.from(instances.values()).sort((left, right) => left.path.localeCompare(right.path))
     ]));
 }
+function toDependencyRecord(lockDependencies) {
+    return Object.fromEntries(Array.from(lockDependencies.entries()).map(([name, dependencies]) => [
+        name,
+        Array.from(dependencies).sort((left, right) => left.localeCompare(right))
+    ]));
+}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { analyzeProject } from "./core/analyzer.js";
-export type { AnalysisOptions, AnalysisFocus, AnalysisResult, DepBrainBaseline, DuplicateDependency, OutdatedDependency, PolicyResult, PackageAnalysisResult, Recommendation, RiskFactors, ScoreBreakdown, RiskDependency, TopIssue, TrustScore, UnusedDependency, WorkspaceDependencyUsage, WorkspaceOwnershipSummary } from "./core/analyzer.js";
+export type { AnalysisOptions, AnalysisFocus, AnalysisResult, DepBrainBaseline, DuplicateDependency, OutdatedDependency, PolicyResult, PackageAnalysisResult, Recommendation, RiskFactors, RiskTransitiveDependency, ScoreBreakdown, RiskDependency, TopIssue, TrustScore, UnusedDependency, WorkspaceDependencyUsage, WorkspaceOwnershipSummary } from "./core/analyzer.js";
 export { OUTPUT_VERSION } from "./core/analyzer.js";
 export { PluginManager } from "./core/plugin-manager.js";
 export type { DepBrainPlugin, PluginDiagnostic, ProjectContext } from "./core/plugin-manager.js";

package/dist/reporters/console.js

@@ -28,11 +28,11 @@ export function renderConsoleReport(result) {
         ? `${item.name} (${item.section}) [${item.package}]`
         : `${item.name} (${item.section})`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Outdated dependencies", result.outdated.map((item) => formatEntry(item.package
-        ? `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}] [${item.package}]`
-        : `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}]`, item.confidence, item.explanation, item.recommendation)));
+        ? `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}] [${item.package}]${formatOutdatedAdviceSuffix(item)}`
+        : `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}]${formatOutdatedAdviceSuffix(item)}`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Risky dependencies", result.risks.map((item) => formatEntry(item.package
-        ? `${item.name}: ${item.reasons.join("; ")} [${item.package}] [trust ${item.trustScore.toUpperCase()}]`
-        : `${item.name}: ${item.reasons.join("; ")} [trust ${item.trustScore.toUpperCase()}]`, item.confidence, item.explanation, item.recommendation)));
+        ? `${item.name}: ${item.reasons.join("; ")} [${item.package}] [trust ${item.trustScore.toUpperCase()}]${formatTransitiveRiskSuffix(item)}`
+        : `${item.name}: ${item.reasons.join("; ")} [trust ${item.trustScore.toUpperCase()}]${formatTransitiveRiskSuffix(item)}`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Policy reasons", result.policy.reasons);
     if (result.suggestions.length > 0) {
         lines.push("");
@@ -43,6 +43,13 @@ export function renderConsoleReport(result) {
     }
     return lines.join("\n");
 }
+function formatTransitiveRiskSuffix(item) {
+    if (item.riskyTransitiveDeps.length === 0) {
+        return "";
+    }
+    const names = item.riskyTransitiveDeps.slice(0, 3).map((entry) => entry.name).join(", ");
+    return ` [transitive score ${item.transitiveRiskScore}] [via ${names}]`;
+}
 function summaryLine(label, count) {
     const indicator = count === 0 ? "OK" : "WARN";
     return `${indicator} ${label}: ${count}`;
@@ -64,3 +71,12 @@ function formatEntry(label, confidence, explanation, recommendation) {
         : "";
     return `${label} | confidence ${Math.round(confidence * 100)}%${recommendationSummary}${reasonSummary}`;
 }
+function formatOutdatedAdviceSuffix(item) {
+    if (!item.advice.recommendedTarget) {
+        return "";
+    }
+    const steps = item.advice.intermediateSteps.length > 1
+        ? ` steps ${item.advice.intermediateSteps.join(" -> ")}`
+        : "";
+    return ` [advice ${item.advice.risk.toUpperCase()} target ${item.advice.recommendedTarget}${steps}]`;
+}

package/dist/reporters/dashboard.js

@@ -1,6 +1,17 @@
 export function renderDashboardReport(result) {
     const topIssues = result.topIssues.map(renderTopIssue).join("");
     const suggestions = result.suggestions.map((item) => `<li>${escapeHtml(item)}</li>`).join("");
+    const transitiveHotspots = result.risks
+        .filter((item) => item.riskyTransitiveDeps.length > 0)
+        .sort((left, right) => right.transitiveRiskScore - left.transitiveRiskScore)
+        .map(renderTransitiveHotspot)
+        .join("");
+    const upgradeAdvice = result.outdated
+        .filter((item) => item.advice.risk !== "low" || item.updateType === "major")
+        .sort((left, right) => compareAdviceRisk(right.advice.risk, left.advice.risk) ||
+        left.name.localeCompare(right.name))
+        .map(renderUpgradeAdvice)
+        .join("");
     return [
         "<!doctype html>",
         '<html lang="en">',
@@ -14,9 +25,11 @@ export function renderDashboardReport(result) {
         "header{display:flex;justify-content:space-between;gap:24px;align-items:flex-start;margin-bottom:24px}",
         "h1{font-size:28px;margin:0 0 8px}",
         "h2{font-size:18px;margin:0 0 12px}",
+        "h3{font-size:15px;margin:0 0 8px}",
         ".muted{color:#637083;font-size:13px}",
         ".score{font-size:48px;font-weight:700}",
         ".grid{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:12px;margin-bottom:20px}",
+        ".split{display:grid;grid-template-columns:1.2fr .8fr;gap:16px;margin-top:16px}",
         ".panel{background:#fff;border:1px solid #dce3ee;border-radius:8px;padding:16px}",
         ".metric{font-size:28px;font-weight:700;margin-top:4px}",
         ".pass{color:#167a43}.fail{color:#b42318}",
@@ -24,7 +37,9 @@ export function renderDashboardReport(result) {
         "li{margin:8px 0}",
         ".issue{margin-bottom:10px}",
         ".kind{font-size:12px;text-transform:uppercase;color:#637083}",
-        "@media(max-width:760px){main{padding:20px}.grid{grid-template-columns:repeat(2,minmax(0,1fr))}header{display:block}.score{font-size:40px}}",
+        ".hotspot{border-top:1px solid #e7ecf4;padding-top:12px;margin-top:12px}",
+        ".path{font-family:Consolas,monospace;font-size:12px;background:#f3f6fb;border-radius:6px;padding:6px 8px;margin:6px 0}",
+        "@media(max-width:760px){main{padding:20px}.grid{grid-template-columns:repeat(2,minmax(0,1fr))}.split{grid-template-columns:1fr}header{display:block}.score{font-size:40px}}",
         "</style>",
         "</head>",
         "<body>",
@@ -42,20 +57,42 @@ export function renderDashboardReport(result) {
         renderMetric("Outdated", result.outdated.length),
         renderMetric("Risks", result.risks.length),
         "</section>",
-        '<section class="panel">',
+        '<section class="split">',
+        '<div class="panel">',
         "<h2>Policy</h2>",
         `<p class="${result.policy.passed ? "pass" : "fail"}">${result.policy.passed ? "Passed" : "Failed"}</p>`,
         result.policy.reasons.length > 0
             ? `<ul>${result.policy.reasons.map((item) => `<li>${escapeHtml(item)}</li>`).join("")}</ul>`
             : '<p class="muted">No policy failures.</p>',
+        "</div>",
+        '<div class="panel">',
+        "<h2>Risk Snapshot</h2>",
+        `<div class="muted">${result.risks.filter((item) => item.riskyTransitiveDeps.length > 0).length} direct dependencies carry transitive risk.</div>`,
+        `<div class="metric">${result.risks.reduce((total, item) => total + item.transitiveRiskScore, 0)}</div>`,
+        '<div class="muted">Total transitive risk score</div>',
+        "</div>",
         "</section>",
-        '<section class="panel">',
+        '<section class="split">',
+        '<div class="panel">',
         "<h2>Top Issues</h2>",
         topIssues.length > 0 ? `<ol>${topIssues}</ol>` : '<p class="muted">No actionable issues found.</p>',
-        "</section>",
-        '<section class="panel">',
+        "</div>",
+        '<div class="panel">',
         "<h2>Suggestions</h2>",
         suggestions.length > 0 ? `<ul>${suggestions}</ul>` : '<p class="muted">No suggestions.</p>',
+        "</div>",
+        "</section>",
+        '<section class="panel">',
+        "<h2>Upgrade Priorities</h2>",
+        upgradeAdvice.length > 0
+            ? `<ul>${upgradeAdvice}</ul>`
+            : '<p class="muted">No high-risk upgrades found.</p>',
+        "</section>",
+        '<section class="panel">',
+        "<h2>Transitive Risk Hotspots</h2>",
+        transitiveHotspots.length > 0
+            ? transitiveHotspots
+            : '<p class="muted">No transitive risk hotspots found.</p>',
         "</section>",
         "</main>",
         "</body>",
@@ -74,6 +111,38 @@ function renderTopIssue(item) {
         "</li>"
     ].join("");
 }
+function renderTransitiveHotspot(item) {
+    return [
+        '<div class="hotspot">',
+        `<h3>${escapeHtml(item.name)} <span class="muted">score ${item.transitiveRiskScore}</span></h3>`,
+        `<div class="muted">${item.riskFactors.transitiveDependencyCount} transitive dependencies, ${item.riskyTransitiveDeps.length} risky transitive dependencies</div>`,
+        "<ul>",
+        item.riskyTransitiveDeps
+            .slice(0, 4)
+            .map((entry) => `<li><strong>${escapeHtml(entry.name)}</strong> [${escapeHtml(entry.trustScore.toUpperCase())}]<div>${escapeHtml(entry.reasons.join("; "))}</div>${entry.introducedByPaths.map((trace) => `<div class="path">${escapeHtml(trace)}</div>`).join("")}</li>`)
+            .join(""),
+        "</ul>",
+        "</div>"
+    ].join("");
+}
+function renderUpgradeAdvice(item) {
+    return [
+        "<li>",
+        `<strong>${escapeHtml(item.name)}</strong> <span class="muted">[${escapeHtml(item.advice.risk.toUpperCase())}]</span>`,
+        `<div>${escapeHtml(item.current)} -> ${escapeHtml(item.latest)} | target ${escapeHtml(item.advice.recommendedTarget)}</div>`,
+        item.advice.intermediateSteps.length > 1
+            ? `<div class="path">${escapeHtml(item.advice.intermediateSteps.join(" -> "))}</div>`
+            : "",
+        item.advice.releaseNotes[0]
+            ? `<div class="muted">${escapeHtml(item.advice.releaseNotes[0])}</div>`
+            : "",
+        "</li>"
+    ].join("");
+}
+function compareAdviceRisk(left, right) {
+    const rank = { high: 3, medium: 2, low: 1 };
+    return rank[left] - rank[right];
+}
 function escapeHtml(value) {
     return value
         .replace(/&/g, "&amp;")

package/dist/reporters/markdown.js

@@ -32,11 +32,11 @@ export function renderMarkdownReport(result) {
         ? `${item.name} (${item.section}) [${item.package}]`
         : `${item.name} (${item.section})`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Outdated dependencies", result.outdated.map((item) => formatEntry(item.package
-        ? `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}] [${item.package}]`
-        : `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}]`, item.confidence, item.explanation, item.recommendation)));
+        ? `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}] [${item.package}]${formatOutdatedAdviceSuffix(item)}`
+        : `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}]${formatOutdatedAdviceSuffix(item)}`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Risky dependencies", result.risks.map((item) => formatEntry(item.package
-        ? `${item.name}: ${item.reasons.join("; ")} [${item.package}] [trust ${item.trustScore.toUpperCase()}]`
-        : `${item.name}: ${item.reasons.join("; ")} [trust ${item.trustScore.toUpperCase()}]`, item.confidence, item.explanation, item.recommendation)));
+        ? `${item.name}: ${item.reasons.join("; ")} [${item.package}] [trust ${item.trustScore.toUpperCase()}]${formatTransitiveRiskSuffix(item)}`
+        : `${item.name}: ${item.reasons.join("; ")} [trust ${item.trustScore.toUpperCase()}]${formatTransitiveRiskSuffix(item)}`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Policy reasons", result.policy.reasons);
     if (result.suggestions.length > 0) {
         lines.push("## Suggestions");
@@ -47,6 +47,13 @@ export function renderMarkdownReport(result) {
     }
     return lines.join("\n");
 }
+function formatTransitiveRiskSuffix(item) {
+    if (item.riskyTransitiveDeps.length === 0) {
+        return "";
+    }
+    const names = item.riskyTransitiveDeps.slice(0, 3).map((entry) => entry.name).join(", ");
+    return ` [transitive score ${item.transitiveRiskScore}] [via ${names}]`;
+}
 function appendSection(lines, title, items) {
     if (items.length === 0) {
         return;
@@ -64,3 +71,12 @@ function formatEntry(label, confidence, explanation, recommendation) {
         : "";
     return `${label} | confidence ${Math.round(confidence * 100)}%${recommendationSummary}${reasonSummary}`;
 }
+function formatOutdatedAdviceSuffix(item) {
+    if (!item.advice.recommendedTarget) {
+        return "";
+    }
+    const steps = item.advice.intermediateSteps.length > 1
+        ? ` steps ${item.advice.intermediateSteps.join(" -> ")}`
+        : "";
+    return ` [advice ${item.advice.risk.toUpperCase()} target ${item.advice.recommendedTarget}${steps}]`;
+}

package/dist/utils/npm-api.d.ts

@@ -1,11 +1,13 @@
 export interface PackageMetadata {
     latestVersion: string | null;
     repository: string | null;
+    homepage: string | null;
     downloads: number | null;
     daysSincePublish: number | null;
     maintainersCount: number | null;
     versionCount: number | null;
     recentReleaseCount: number | null;
+    versions: string[];
 }
 export declare function getLatestVersion(name: string): Promise<string | null>;
 export declare function getPackageMetadata(name: string): Promise<PackageMetadata | null>;

package/dist/utils/npm-api.js

@@ -49,11 +49,13 @@ async function fetchPackageMetadata(name) {
         return {
             latestVersion,
             repository,
+            homepage: typeof packageJson.homepage === "string" ? packageJson.homepage : null,
             downloads: downloadsJson.downloads ?? null,
             daysSincePublish,
             maintainersCount,
             versionCount,
-            recentReleaseCount
+            recentReleaseCount,
+            versions: Object.keys(packageJson.versions ?? {})
         };
     }
     catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dep-brain",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "CLI and library for explainable dependency intelligence",
   "type": "module",
   "main": "dist/index.js",