dep-report 0.0.1 → 0.0.2

package/README.md

@@ -1,5 +1,7 @@
 # dep-report
 
+> **Turn your dependency chaos into a daily, version-controlled risk brief.**
+
 Zero-config CLI tool that generates version-controlled snapshots of dependency risk.
 
 ## Installation
@@ -18,7 +20,19 @@ Or use with npx (no installation needed):
 npx dep-report
 ```
 
-## Quick Start
+## The Problem
+
+Dependency drift is invisible until it explodes.
+
+You get bombarded with automated PRs but can't tell which ones actually matter. No context, just version bumps. A security advisory drops and you're scrambling to figure out your exposure. A build breaks because some package hasn't been touched in 3 years. Management asks about technical debt and you're pulling together an answer on the spot.
+
+The real issue isn't automation—it's visibility. You need to see what's outdated, understand the risk, and have evidence for your decisions. Not just a flood of PRs.
+
+**Renovate/Dependabot create noise. dep-report creates evidence.**
+
+## The Solution
+
+dep-report gives you a daily, human-readable risk brief, checked into your repo.
 
 Run in your project directory:
 
@@ -32,6 +46,15 @@ This will:
 3. Enrich with registry metadata (publish dates, age)
 4. Generate reports in `.dep-report/reports/`
 
+## The Outcome
+
+You can see at a glance whether you're getting healthier or rotting.
+
+**Proof Point:**
+> "Six months ago we had 34 stale dependencies, 9 majors ignored. Today we're at 3 and 1—and we can prove it from the reports in `/.dep-report/reports`."
+
+## Quick Start
+
 ## Usage
 
 ### Initialize Configuration
@@ -118,18 +141,19 @@ Exit code conditions for CI/CD integration:
 
 Whether to generate reports when no outdated packages are found. Default: `true`.
 
-### Notes
+### Notes (Decision Log)
 
-Add custom notes to packages in `.dep-report/notes.json`:
+Transform tribal knowledge into auditable decisions. Add notes to packages in `.dep-report/notes.json`:
 
 ```json
 {
-  "package-name": "Known issue: waiting for v2.0.0 release",
-  "another-package": "Upgrade blocked by breaking changes"
+  "react": "BLOCKED: waiting for team migration",
+  "lodash": "DEFERRED: Q2 2026 - requires architecture refactor",
+  "axios": "ACCEPTED RISK: pinned for stability @platform-team"
 }
 ```
 
-Notes appear in reports next to the package entry.
+Notes with keywords (`BLOCKED:`, `DEFERRED:`, `ACCEPTED RISK:`) are automatically highlighted in reports with badges, creating a self-documenting decision log.
 
 ## Usage Examples
 
@@ -210,6 +234,23 @@ The tool respects npm registry rate limits by:
 
 Age is calculated based on when the **currently installed version** was published, not when the latest version was published. This answers: "How old is the dependency we're actively using?"
 
+## Guarantees
+
+**Privacy:**
+- No tracking, no analytics, no phoning home
+- All data stays local in your repository
+- Registry queries are read-only package metadata
+
+**Control:**
+- Outputs are plain files under your version control
+- No vendor lock-in, no proprietary formats
+- Works offline with cached data
+
+**Transparency:**
+- Open source (MIT license)
+- Readable templates, editable notes
+- Deterministic output (same input = same report)
+
 ## Development
 
 ```bash
@@ -248,15 +289,3 @@ See [sandbox/README.md](sandbox/README.md) for details.
 2. Run `bun run test:sandbox` (must pass)
 3. Visually inspect HTML reports
 4. Run `npm run build` and test CLI manually
-
-## Project Status
-
-✅ **Production Ready**
-- ✅ Package manager detection (npm, pnpm, bun)
-- ✅ Outdated package scanning
-- ✅ Registry enrichment with age calculation
-- ✅ Risk & age calculation
-- ✅ Markdown & HTML report generation
-- ✅ Configuration system
-- ✅ Notes system
-- ✅ Comprehensive test suite

package/dist/chunk-KNT3JZ7P.js

@@ -0,0 +1 @@
+var t={starter:{name:"starter",displayName:"Starter",description:"Just getting visibility - no CI failures",config:{staleThreshold:"24 months",ignorePatterns:[],formats:{markdown:!0,html:!0},concurrency:5,failConditions:{stale:!1,major:!1},reportEmptyState:!0}},production:{name:"production",displayName:"Production",description:"Prevent major upgrades from rotting indefinitely (recommended)",config:{staleThreshold:"12 months",ignorePatterns:[],formats:{markdown:!0,html:!0},concurrency:5,failConditions:{stale:!1,major:!0},reportEmptyState:!0}},strict:{name:"strict",displayName:"Strict",description:"Old dependencies break builds",config:{staleThreshold:"6 months",ignorePatterns:[],formats:{markdown:!0,html:!0},concurrency:5,failConditions:{stale:!0,major:!0},reportEmptyState:!0}}};function r(e){return t[e]}function n(){return Object.values(t)}function s(e){return e in t}export{t as a,r as b,n as c,s as d};

package/dist/cli.js

@@ -1,37 +1,121 @@
 #!/usr/bin/env node
-import{Command as At}from"commander";import{existsSync as ot,mkdirSync as nt,writeFileSync as k,readFileSync as Ft}from"fs";import{join as y}from"path";import{existsSync as at}from"fs";import{join as it}from"path";function D(t=process.cwd()){let e=[{file:"pnpm-lock.yaml",manager:"pnpm"},{file:"bun.lock",manager:"bun"},{file:"bun.lockb",manager:"bun"},{file:"package-lock.json",manager:"npm"}];for(let{file:r,manager:o}of e){let s=it(t,r);if(at(s))return{manager:o,lockfile:r}}return null}function N(t){return{npm:"npm outdated --json",pnpm:"pnpm outdated --json",bun:"bun outdated --json"}[t]}import{exec as ct}from"child_process";import{promisify as dt}from"util";var lt=dt(ct);async function T(t,e=process.cwd()){let r=N(t);try{let{stdout:o,stderr:s}=await lt(r,{cwd:e,maxBuffer:10485760}),c=o.trim()||s.trim();if(!c)return{};try{return JSON.parse(c)}catch(i){if(c.includes("All packages are up to date")||c==="{}")return{};throw new Error(`Failed to parse outdated output: ${i instanceof Error?i.message:String(i)}`)}}catch(o){if(o.stdout)try{return JSON.parse(o.stdout)}catch{throw o.code==="ENOENT"?new Error(`Package manager "${t}" not found. Please install it first.`):new Error(`Failed to execute outdated command: ${o.message}`)}if(o.code==="ENOENT")throw new Error(`Package manager "${t}" not found. Please install it first.`);return{}}}function I(t){let e=[];for(let[r,o]of Object.entries(t)){if(typeof o!="object"||o===null||Array.isArray(o))continue;let s=o.current||o.installed||o.version||"-",c=o.latest||o.wanted||s,i=o.wanted||o.current||c,a=o.type||o.dependencyType||mt(r);!r||!c||e.push({name:r,current:String(s),wanted:String(i),latest:String(c),type:a})}return e}function mt(t){return t.startsWith("@types/")||t.includes("-test")||t.includes("-spec")||t==="typescript"||t==="eslint"||t.startsWith("eslint-")||t.startsWith("@eslint/")?"devDependencies":"dependencies"}var x=class{constructor(e="https://registry.npmjs.org"){this.baseUrl=e}async getMetadata(e){try{let r=`${this.baseUrl}/${encodeURIComponent(e)}`,o=await fetch(r,{headers:{Accept:"application/json"}});if(!o.ok){if(o.status===404)return null;throw new Error(`Registry request failed: ${o.status}`)}return await o.json()}catch{return null}}};var A=new x;async function pt(t,e=A,r=new Date){let s=await(typeof e=="string"?new x(e):e).getMetadata(t.name);if(!s||!s.time)return{...t,currentPublishedAt:null,latestPublishedAt:null,age:null,isStale:!1,risk:"Exotic"};let c=s.time[t.current]?new Date(s.time[t.current]):null,i=s.time[t.latest]?new Date(s.time[t.latest]):null,a=null;if(c){let p=r.getTime()-c.getTime();a=Math.floor(p/(1e3*60*60*24))}return{...t,currentPublishedAt:c,latestPublishedAt:i,age:a,isStale:!1,risk:"Exotic"}}async function F(t,e=5,r=A,o=new Date){let s=typeof r=="string"?new x(r):r,c=[];for(let i=0;i<t.length;i+=e){let a=t.slice(i,i+e),p=await Promise.all(a.map(d=>pt(d,s,o)));c.push(...p),i+e<t.length&&await new Promise(d=>setTimeout(d,500))}return c}import{diff as ut,valid as _}from"semver";function ft(t){return!t||t==="-"||t==="missing"?!1:/^(file:|git\+|https?:|link:|workspace:)/.test(t)}function gt(t,e){if(ft(t))return"Exotic";if(!t||t==="-"||t==="missing")return"NotInstalled";if(!_(t)||!_(e))return"Exotic";try{switch(ut(t,e)){case"major":return"Major";case"minor":return"Minor";case"patch":return"Patch";default:return"Patch"}}catch{return"Exotic"}}function L(t,e=null){return t.map(r=>{let o=gt(r.current,r.latest),s=e!==null&&r.age!==null&&r.age>e;return{...r,risk:o,isStale:s}})}import{format as z}from"date-fns";function ht(t){if(t===null)return"Unknown";if(t<30)return`${t}d`;if(t<365)return`${Math.floor(t/30)}m`;let e=Math.floor(t/365),r=Math.floor(t%365/30);return r>0?`${e}y ${r}m`:`${e}y`}function M(t,e=new Date){let r=z(e,"yyyy-MM-dd"),o=z(e,"yyyy-MM-dd HH:mm:ss");if(t.length===0)return`# Dependency Report (${r})
+import{b as oe}from"./chunk-KNT3JZ7P.js";import{Command as $t}from"commander";import{existsSync as Ie,mkdirSync as Ae,writeFileSync as T,readFileSync as wt}from"fs";import{join as v}from"path";import{existsSync as Be}from"fs";import{join as ze}from"path";function se(e=process.cwd()){let t=[{file:"pnpm-lock.yaml",manager:"pnpm"},{file:"bun.lock",manager:"bun"},{file:"bun.lockb",manager:"bun"},{file:"package-lock.json",manager:"npm"}];for(let{file:r,manager:n}of t){let i=ze(e,r);if(Be(i))return{manager:n,lockfile:r}}return null}function ae(e){return{npm:"npm outdated --json",pnpm:"pnpm outdated --json",bun:"bun outdated --json"}[e]}import{exec as _e}from"child_process";import{promisify as He}from"util";var Ke=He(_e);async function ie(e,t=process.cwd()){let r=ae(e);try{let{stdout:n,stderr:i}=await Ke(r,{cwd:t,maxBuffer:10485760}),m=n.trim()||i.trim();if(!m)return{};try{return JSON.parse(m)}catch(a){if(m.includes("All packages are up to date")||m==="{}")return{};throw new Error(`Failed to parse outdated output: ${a instanceof Error?a.message:String(a)}`)}}catch(n){if(n.stdout)try{return JSON.parse(n.stdout)}catch{throw n.code==="ENOENT"?new Error(`Package manager "${e}" not found. Please install it first.`):new Error(`Failed to execute outdated command: ${n.message}`)}if(n.code==="ENOENT")throw new Error(`Package manager "${e}" not found. Please install it first.`);return{}}}function ce(e){let t=[];for(let[r,n]of Object.entries(e)){if(typeof n!="object"||n===null||Array.isArray(n))continue;let i=n.current||n.installed||n.version||"-",m=n.latest||n.wanted||i,a=n.wanted||n.current||m,w=n.type||n.dependencyType||Je(r);!r||!m||t.push({name:r,current:String(i),wanted:String(a),latest:String(m),type:w})}return t}function Je(e){return e.startsWith("@types/")||e.includes("-test")||e.includes("-spec")||e==="typescript"||e==="eslint"||e.startsWith("eslint-")||e.startsWith("@eslint/")?"devDependencies":"dependencies"}var L=class{constructor(t="https://registry.npmjs.org"){this.baseUrl=t}async getMetadata(t){try{let r=`${this.baseUrl}/${encodeURIComponent(t)}`,n=await fetch(r,{headers:{Accept:"application/json"}});if(!n.ok){if(n.status===404)return null;throw new Error(`Registry request failed: ${n.status}`)}return await n.json()}catch{return null}}};var de=new L;async function We(e,t=de,r=new Date){let i=await(typeof t=="string"?new L(t):t).getMetadata(e.name);if(!i||!i.time)return{...e,currentPublishedAt:null,latestPublishedAt:null,age:null,behindByDays:null,isStale:!1,risk:"Exotic"};let m=i.time[e.current]?new Date(i.time[e.current]):null,a=i.time[e.latest]?new Date(i.time[e.latest]):null,w=null;if(m){let k=r.getTime()-m.getTime();w=Math.floor(k/(1e3*60*60*24))}let p=null;if(m&&a){let k=a.getTime()-m.getTime();p=Math.floor(k/(1e3*60*60*24))}return{...e,currentPublishedAt:m,latestPublishedAt:a,age:w,behindByDays:p,isStale:!1,risk:"Exotic"}}async function le(e,t=5,r=de,n=new Date){let i=typeof r=="string"?new L(r):r,m=[];for(let a=0;a<e.length;a+=t){let w=e.slice(a,a+t),p=await Promise.all(w.map(k=>We(k,i,n)));m.push(...p),a+t<e.length&&await new Promise(k=>setTimeout(k,500))}return m}import{diff as Ye,valid as me}from"semver";function Ge(e){return!e||e==="-"||e==="missing"?!1:/^(file:|git\+|https?:|link:|workspace:)/.test(e)}function qe(e,t){if(Ge(e))return"Exotic";if(!e||e==="-"||e==="missing")return"NotInstalled";if(!me(e)||!me(t))return"Exotic";try{switch(Ye(e,t)){case"major":return"Major";case"minor":return"Minor";case"patch":return"Patch";default:return"Patch"}}catch{return"Exotic"}}function ue(e,t=null){return e.map(r=>{let n=qe(r.current,r.latest),i=t!==null&&r.age!==null&&r.age>t;return{...r,risk:n,isStale:i}})}import{format as pe}from"date-fns";function C(e){if(!e)return null;let t={blocked:/^BLOCKED[:\-\s]/i,deferred:/^DEFERRED[:\-\s]/i,accepted:/^ACCEPTED(\s+RISK)?[:\-\s]/i};return t.blocked.test(e)?"blocked":t.deferred.test(e)?"deferred":t.accepted.test(e)?"accepted":null}function I(e){if(!e)return"";let t=C(e);if(!t)return e;let r={blocked:"\u{1F534} BLOCKED",deferred:"\u{1F7E1} DEFERRED",accepted:"\u{1F535} ACCEPTED RISK"},n=e.replace(/^(BLOCKED|DEFERRED|ACCEPTED(\s+RISK)?)[:\-\s]+/i,"").trim();return`${r[t]}: ${n}`}function O(e){let t=0;e.age!==null&&(e.age>730?t+=10:e.age>365&&(t+=5)),e.risk==="Major"?t+=8:e.risk==="Minor"&&(t+=3);let r=C(e.note);return r==="blocked"?t+=15:r==="deferred"&&(t+=5),e.behindByDays!==null&&e.behindByDays>365&&(t+=7),t}function A(e){return e.current===e.latest}function F(e,t,r){let n=e.length,i=e.filter(s=>s.isStale).length,m=t-n,a=e.filter(s=>s.risk==="Major").length,w=e.filter(s=>s.risk==="Minor").length,p=e.filter(s=>s.risk==="Patch").length,k=e.filter(s=>C(s.note)==="blocked").length,c=e.filter(s=>C(s.note)==="deferred").length,y=e.filter(s=>C(s.note)==="accepted").length,d="healthy",g="\u{1F7E2}",o="Healthy";if(r){let s=r.method,h=t>0?i/t*100:0,f=e.filter(u=>u.risk==="Major").length,b=t>0?f/t*100:0;s==="percentage"?h>=r.atRisk.stalePercent||b>=r.atRisk.majorPercent?(d="atRisk",g="\u{1F534}",o=`At Risk (${Math.round(h)}% stale)`):h>=r.degrading.stalePercent||b>=r.degrading.majorPercent?(d="degrading",g="\u{1F7E1}",o=`Degrading (${Math.round(h)}% stale)`):(d="healthy",g="\u{1F7E2}",o="Healthy"):i>=r.atRisk.stalePercent||f>=r.atRisk.majorPercent?(d="atRisk",g="\u{1F534}",o=`At Risk (${i} stale)`):i>=r.degrading.stalePercent||f>=r.degrading.majorPercent?(d="degrading",g="\u{1F7E1}",o=`Degrading (${i} stale)`):(d="healthy",g="\u{1F7E2}",o="Healthy")}else{let s=t>0?i/t*100:0,h=e.filter(b=>b.risk==="Major").length,f=t>0?h/t*100:0;s>=15||f>=20?(d="atRisk",g="\u{1F534}",o=`At Risk (${Math.round(s)}% stale)`):s>=5||f>=10?(d="degrading",g="\u{1F7E1}",o=`Degrading (${Math.round(s)}% stale)`):(d="healthy",g="\u{1F7E2}",o="Healthy")}return{total:t,outdated:n,stale:i,upToDate:m,blocked:k,deferred:c,accepted:y,major:a,minor:w,patch:p,riskStatus:d,riskStatusEmoji:g,riskStatusText:o}}function q(e){if(e===null)return"Unknown";if(e<30)return`${e}d`;if(e<365)return`${Math.floor(e/30)}m`;let t=Math.floor(e/365),r=Math.floor(e%365/30);return r>0?`${t}y ${r}m`:`${t}y`}function V(e){if(e===null)return"\u2014";if(e<30)return`${e}d`;if(e<365)return`${Math.floor(e/30)}m`;let t=Math.floor(e/365),r=Math.floor(e%365/30);return r>0?`${t}y ${r}m`:`${t}y`}function Q(e,t=new Date,r){let n=pe(t,"yyyy-MM-dd"),i=pe(t,"yyyy-MM-dd HH:mm:ss");if(e.length===0)return`# Dependency Report (${n})
 
-Generated at: ${o}
+Generated at: ${i}
 
 \u2705 All dependencies are up to date
-`;let s=[...t].sort((i,a)=>{let p={Major:0,Minor:1,Patch:2,Exotic:3,NotInstalled:4},d=(p[i.risk]||99)-(p[a.risk]||99);return d!==0?d:i.age===null&&a.age===null?0:i.age===null?1:a.age===null?-1:a.age-i.age}),c=`# Dependency Report (${r})
+`;let m=r??e.length,a=F(e,m),w=[...e].sort((c,y)=>{let d={Major:0,Minor:1,Patch:2,Exotic:3,NotInstalled:4},g=(d[c.risk]||99)-(d[y.risk]||99);return g!==0?g:c.age===null&&y.age===null?0:c.age===null?1:y.age===null?-1:y.age-c.age}),p=`# Dependency Report (${n})
 
-Generated at: ${o}
+Generated at: ${i}
 
-## Outdated Packages (${t.length})
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+              ${a.riskStatusEmoji} ${a.riskStatusText}
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
 
-| Package | Current | Latest | Risk | Age | Stale? | Notes |
-|---------|---------|--------|------|-----|--------|-------|
-`;for(let i of s){let a=ht(i.age),p=i.risk,d=i.isStale?"Yes":"No",w=i.note||"";c+=`| ${i.name} | ${i.current} | ${i.latest} | ${p} | ${a} | ${d} | ${w} |
-`}return c}import{format as U}from"date-fns";function b(t){let e={"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#039;"};return t.replace(/[&<>"']/g,r=>e[r])}function yt(t){if(t===null)return"Unknown";if(t<30)return`${t}d`;if(t<365)return`${Math.floor(t/30)}m`;let e=Math.floor(t/365),r=Math.floor(t%365/30);return r>0?`${e}y ${r}m`:`${e}y`}function wt(t){switch(t){case"Major":return"#dc2626";case"Minor":return"#ea580c";case"Patch":return"#ca8a04";case"Exotic":return"#6b7280";case"NotInstalled":return"#9ca3af";default:return"#6b7280"}}function O(t,e=new Date){let r=U(e,"yyyy-MM-dd"),o=U(e,"yyyy-MM-dd HH:mm:ss"),s=[...t].sort((a,p)=>{let d={Major:0,Minor:1,Patch:2,Exotic:3,NotInstalled:4},w=(d[a.risk]||99)-(d[p.risk]||99);return w!==0?w:a.age===null&&p.age===null?0:a.age===null?1:p.age===null?-1:p.age-a.age}),c="";for(let a of s){let p=yt(a.age),d=wt(a.risk),w=a.isStale?"Yes":"No",C=a.isStale?"stale-yes":"stale-no",$=b(a.note||"");c+=`
-      <tr>
-        <td class="package-name">${b(a.name)}</td>
-        <td>${b(a.current)}</td>
-        <td>${b(a.latest)}</td>
-        <td><span class="risk-badge" style="background-color: ${d}">${b(a.risk)}</span></td>
-        <td>${b(p)}</td>
-        <td class="${C}">${w}</td>
-        <td class="notes">${$}</td>
-      </tr>`}let i=t.length===0?`
+Total: ${a.total} | Outdated: ${a.outdated} | Stale: ${a.stale} | Up-to-date: ${a.upToDate}
+`;(a.blocked>0||a.deferred>0||a.accepted>0)&&(p+=`Blocked: ${a.blocked} | Deferred: ${a.deferred} | Accepted Risk: ${a.accepted}
+`),p+=`
+**Risk Assessment:** ${a.stale} stale dependencies and ${a.major} unaddressed major upgrades detected.
+
+`;let k=w.map(c=>({pkg:c,score:O(c)})).filter(({score:c})=>c>15).sort((c,y)=>y.score-c.score).slice(0,7).map(({pkg:c})=>c);if(k.length>0){p+=`\u2501\u2501\u2501 ACTION REQUIRED \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+
+`;let c=k.filter(d=>O(d)>=20||d.risk==="Major"||d.note&&/BLOCKED/i.test(d.note)),y=k.filter(d=>!c.includes(d));if(c.length>0){p+=`\u{1F534} Critical Risk
+`;for(let d of c){let g=q(d.age),o=V(d.behindByDays),s=d.risk==="Major"?"Major update":d.risk==="Minor"?"Minor update":"Patch update",h=d.note?`
+    ${I(d.note)}`:"";p+=`  \u2022 ${d.name} (${d.current} \u2192 ${d.latest})
+`,p+=`    ${g} old, behind by ${o} | ${s}${h}
+
+`}}if(y.length>0){p+=`\u{1F7E1} Review Soon
+`;for(let d of y){let g=q(d.age),o=V(d.behindByDays),s=d.risk==="Major"?"Major update":d.risk==="Minor"?"Minor update":"Patch update",h=d.note?`
+    ${I(d.note)}`:"";p+=`  \u2022 ${d.name} (${d.current} \u2192 ${d.latest})
+`,p+=`    ${g} old, behind by ${o} | ${s}${h}
+
+`}}p+=`
+`}else p+=`\u2501\u2501\u2501 ACTION REQUIRED \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+
+`,p+=`\u2705 No critical actions required
+
+`;p+=`\u2501\u2501\u2501 FULL DEPENDENCY LIST \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+
+`,p+=`| Package | Current | Latest | Age | Behind | Risk | Status | Notes |
+`,p+=`|---------|---------|--------|-----|---------|------|--------|-------|
+`;for(let c of w){let y=q(c.age),d=V(c.behindByDays),g=c.risk==="Major"?"\u{1F534} Major":c.risk==="Minor"?"\u{1F7E1} Minor":c.risk==="Patch"?"\u{1F7E2} Patch":c.risk,o=A(c)?"\u2705 Stable":"Outdated",s=c.note?I(c.note):"";p+=`| ${c.name} | ${c.current} | ${c.latest} | ${y} | ${d} | ${g} | ${o} | ${s} |
+`}return p}import{format as fe}from"date-fns";function R(e){let t={"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#039;"};return e.replace(/[&<>"']/g,r=>t[r])}function X(e){if(e===null)return"Unknown";if(e<30)return`${e}d`;if(e<365)return`${Math.floor(e/30)}m`;let t=Math.floor(e/365),r=Math.floor(e%365/30);return r>0?`${t}y ${r}m`:`${t}y`}function Z(e){if(e===null)return"\u2014";if(e<30)return`${e}d`;if(e<365)return`${Math.floor(e/30)}m`;let t=Math.floor(e/365),r=Math.floor(e%365/30);return r>0?`${t}y ${r}m`:`${t}y`}function Ve(e){switch(e){case"Major":return"#dc2626";case"Minor":return"#ea580c";case"Patch":return"#ca8a04";case"Exotic":return"#6b7280";case"NotInstalled":return"#9ca3af";default:return"#6b7280"}}function ee(e,t=new Date,r){let n=fe(t,"yyyy-MM-dd"),i=fe(t,"yyyy-MM-dd HH:mm:ss");if(e.length===0)return`<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Dependency Report (${n})</title>
+  <style>
+    * { margin: 0; padding: 0; box-sizing: border-box; }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+      line-height: 1.6;
+      color: #1f2937;
+      background-color: #f9fafb;
+      padding: 2rem;
+    }
+    .container {
+      max-width: 1400px;
+      margin: 0 auto;
+      background: white;
+      border-radius: 8px;
+      box-shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
+      padding: 2rem;
+    }
+    .empty-state {
+      text-align: center;
+      padding: 4rem 2rem;
+      color: #059669;
+    }
+    .empty-state h2 {
+      font-size: 1.5rem;
+      font-weight: 500;
+    }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>Dependency Report (${n})</h1>
+    <div class="timestamp">Generated at: ${i}</div>
     <div class="empty-state">
       <h2>\u2705 All dependencies are up to date</h2>
     </div>
-  `:"";return`<!DOCTYPE html>
+  </div>
+</body>
+</html>`;let m=r??e.length,a=F(e,m),w=[...e].sort((o,s)=>{let h={Major:0,Minor:1,Patch:2,Exotic:3,NotInstalled:4},f=(h[o.risk]||99)-(h[s.risk]||99);return f!==0?f:o.age===null&&s.age===null?0:o.age===null?1:s.age===null?-1:s.age-o.age}),p=w.map(o=>({pkg:o,score:O(o)})).filter(({score:o})=>o>15).sort((o,s)=>s.score-o.score).slice(0,7).map(({pkg:o})=>o),k=p.filter(o=>O(o)>=20||o.risk==="Major"||o.note&&/BLOCKED/i.test(o.note)),c=p.filter(o=>!k.includes(o)),y="";if(p.length>0){if(k.length>0){y+='<div class="action-group critical">',y+='<h3 class="action-title critical">\u{1F534} Critical Risk</h3>';for(let o of k){let s=X(o.age),h=Z(o.behindByDays),f=o.risk==="Major"?"Major update":o.risk==="Minor"?"Minor update":"Patch update",b=C(o.note),u=b?`<span class="badge badge-${b}">${b.toUpperCase()}</span>`:"",$=o.note?R(o.note.replace(/^(BLOCKED|DEFERRED|ACCEPTED(\s+RISK)?)[:\-\s]+/i,"").trim()):"";y+=`
+          <div class="package-card">
+            <div class="package-header">
+              <strong>${R(o.name)}</strong> (${R(o.current)} \u2192 ${R(o.latest)})
+            </div>
+            <div class="package-details">
+              ${s} old, behind by ${h} | ${f}
+              ${u?`<br>${u} ${$?R($):""}`:""}
+            </div>
+          </div>`}y+="</div>"}if(c.length>0){y+='<div class="action-group review">',y+='<h3 class="action-title review">\u{1F7E1} Review Soon</h3>';for(let o of c){let s=X(o.age),h=Z(o.behindByDays),f=o.risk==="Major"?"Major update":o.risk==="Minor"?"Minor update":"Patch update",b=C(o.note),u=b?`<span class="badge badge-${b}">${b.toUpperCase()}</span>`:"",$=o.note?R(o.note.replace(/^(BLOCKED|DEFERRED|ACCEPTED(\s+RISK)?)[:\-\s]+/i,"").trim()):"";y+=`
+          <div class="package-card">
+            <div class="package-header">
+              <strong>${R(o.name)}</strong> (${R(o.current)} \u2192 ${R(o.latest)})
+            </div>
+            <div class="package-details">
+              ${s} old, behind by ${h} | ${f}
+              ${u?`<br>${u} ${$?R($):""}`:""}
+            </div>
+          </div>`}y+="</div>"}}else y='<div class="no-actions">\u2705 No critical actions required</div>';let d="";for(let o of w){let s=X(o.age),h=Z(o.behindByDays),f=Ve(o.risk),b=A(o)?'<span class="status-stable">\u2705 Stable</span>':"Outdated",u=C(o.note),$=u?`<span class="badge badge-${u}">${u.toUpperCase()}</span>`:"",E=o.note?R(o.note.replace(/^(BLOCKED|DEFERRED|ACCEPTED(\s+RISK)?)[:\-\s]+/i,"").trim()):"",M=$&&E?`${$} ${E}`:$||E||"";d+=`
+      <tr>
+        <td class="package-name">${R(o.name)}</td>
+        <td>${R(o.current)}</td>
+        <td>${R(o.latest)}</td>
+        <td>${R(s)}</td>
+        <td>${R(h)}</td>
+        <td><span class="risk-badge" style="background-color: ${f}">${R(o.risk)}</span></td>
+        <td>${b}</td>
+        <td class="notes">${M}</td>
+      </tr>`}let g=a.riskStatus==="healthy"?"#10b981":a.riskStatus==="degrading"?"#f59e0b":"#ef4444";return`<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Dependency Report (${r})</title>
+  <title>Dependency Report (${n})</title>
   <style>
     * {
       margin: 0;
@@ -61,24 +145,117 @@ Generated at: ${o}
     .timestamp {
       color: #6b7280;
       font-size: 0.875rem;
-      margin-bottom: 2rem;
+      margin-bottom: 1rem;
     }
-    .empty-state {
+    .status-badge {
+      background: ${g};
+      color: white;
+      padding: 0.5rem 1rem;
+      border-radius: 6px;
+      font-weight: 600;
+      font-size: 1.1rem;
       text-align: center;
-      padding: 4rem 2rem;
-      color: #059669;
+      margin: 1.5rem 0;
     }
-    .empty-state h2 {
+    .summary-grid {
+      display: grid;
+      grid-template-columns: repeat(auto-fit, minmax(150px, 1fr));
+      gap: 1rem;
+      margin: 1.5rem 0;
+    }
+    .summary-card {
+      background: #f9fafb;
+      padding: 1rem;
+      border-radius: 6px;
+      border: 1px solid #e5e7eb;
+    }
+    .summary-card strong {
+      display: block;
       font-size: 1.5rem;
-      font-weight: 500;
+      color: #111827;
+      margin-bottom: 0.25rem;
+    }
+    .summary-card span {
+      color: #6b7280;
+      font-size: 0.875rem;
+    }
+    .risk-assessment {
+      background: #fef3c7;
+      border-left: 4px solid #f59e0b;
+      padding: 1rem;
+      margin: 1.5rem 0;
+      border-radius: 4px;
+    }
+    .action-section {
+      margin: 2rem 0;
+    }
+    .action-group {
+      margin: 1.5rem 0;
+    }
+    .action-title {
+      font-size: 1.25rem;
+      margin-bottom: 1rem;
+      padding-bottom: 0.5rem;
+      border-bottom: 2px solid #e5e7eb;
+    }
+    .action-title.critical {
+      color: #dc2626;
+      border-bottom-color: #dc2626;
+    }
+    .action-title.review {
+      color: #f59e0b;
+      border-bottom-color: #f59e0b;
+    }
+    .package-card {
+      background: #f9fafb;
+      border: 1px solid #e5e7eb;
+      border-radius: 6px;
+      padding: 1rem;
+      margin-bottom: 0.75rem;
+    }
+    .package-header {
+      font-size: 1rem;
+      margin-bottom: 0.5rem;
+    }
+    .package-details {
+      color: #6b7280;
+      font-size: 0.875rem;
+    }
+    .badge {
+      display: inline-block;
+      padding: 0.25rem 0.5rem;
+      border-radius: 4px;
+      font-size: 0.75rem;
+      font-weight: 600;
+      margin-right: 0.5rem;
+    }
+    .badge-blocked {
+      background: #dc2626;
+      color: white;
+    }
+    .badge-deferred {
+      background: #f59e0b;
+      color: white;
+    }
+    .badge-accepted {
+      background: #3b82f6;
+      color: white;
+    }
+    .no-actions {
+      text-align: center;
+      padding: 2rem;
+      color: #059669;
+      font-size: 1.1rem;
     }
     table {
       width: 100%;
       border-collapse: collapse;
-      margin-top: 1rem;
+      margin-top: 2rem;
     }
     thead {
       background-color: #f3f4f6;
+      position: sticky;
+      top: 0;
     }
     th {
       text-align: left;
@@ -111,16 +288,13 @@ Generated at: ${o}
       text-transform: uppercase;
       letter-spacing: 0.05em;
     }
-    .stale-yes {
-      color: #dc2626;
+    .status-stable {
+      color: #10b981;
       font-weight: 600;
     }
-    .stale-no {
-      color: #059669;
-    }
     .notes {
       color: #6b7280;
-      font-style: italic;
+      font-size: 0.875rem;
     }
     @media (max-width: 768px) {
       body {
@@ -129,6 +303,9 @@ Generated at: ${o}
       .container {
         padding: 1rem;
       }
+      .summary-grid {
+        grid-template-columns: repeat(2, 1fr);
+      }
       table {
         font-size: 0.875rem;
       }
@@ -136,35 +313,116 @@ Generated at: ${o}
         padding: 0.5rem;
       }
     }
+    @media print {
+      body {
+        background: white;
+      }
+      .container {
+        box-shadow: none;
+      }
+    }
   </style>
 </head>
 <body>
   <div class="container">
-    <h1>Dependency Report (${r})</h1>
-    <div class="timestamp">Generated at: ${o}</div>
-    ${i||`
-    <h2 style="margin-top: 1.5rem; margin-bottom: 1rem; font-size: 1.25rem; color: #374151;">
-      Outdated Packages (${t.length})
-    </h2>
+    <h1>Dependency Report (${n})</h1>
+    <div class="timestamp">Generated at: ${i}</div>
+    
+    <div class="status-badge">
+      ${a.riskStatusEmoji} ${a.riskStatusText}
+    </div>
+    
+    <div class="summary-grid">
+      <div class="summary-card">
+        <strong>${a.total}</strong>
+        <span>Total dependencies</span>
+      </div>
+      <div class="summary-card">
+        <strong>${a.outdated}</strong>
+        <span>Outdated (${a.major} major, ${a.minor} minor, ${a.patch} patch)</span>
+      </div>
+      <div class="summary-card">
+        <strong>${a.stale}</strong>
+        <span>Stale (>12 months)</span>
+      </div>
+      <div class="summary-card">
+        <strong>${a.upToDate}</strong>
+        <span>Up-to-date</span>
+      </div>
+      ${a.blocked>0||a.deferred>0||a.accepted>0?`
+      <div class="summary-card">
+        <strong>${a.blocked}</strong>
+        <span>Blocked upgrades</span>
+      </div>
+      <div class="summary-card">
+        <strong>${a.deferred}</strong>
+        <span>Deferred upgrades</span>
+      </div>
+      <div class="summary-card">
+        <strong>${a.accepted}</strong>
+        <span>Accepted risks</span>
+      </div>
+      `:""}
+    </div>
+    
+    <div class="risk-assessment">
+      <strong>Risk Assessment:</strong> ${a.stale} stale dependencies and ${a.major} unaddressed major upgrades detected.
+    </div>
+    
+    <div class="action-section">
+      <h2 style="margin-bottom: 1rem; font-size: 1.25rem; color: #374151;">Action Required</h2>
+      ${y}
+    </div>
+    
+    <h2 style="margin-top: 2rem; margin-bottom: 1rem; font-size: 1.25rem; color: #374151;">Full Dependency List</h2>
     <table>
       <thead>
         <tr>
           <th>Package</th>
           <th>Current</th>
           <th>Latest</th>
-          <th>Risk</th>
           <th>Age</th>
-          <th>Stale?</th>
+          <th>Behind</th>
+          <th>Risk</th>
+          <th>Status</th>
           <th>Notes</th>
         </tr>
       </thead>
       <tbody>
-        ${c}
+        ${d}
       </tbody>
     </table>
-    `}
   </div>
 </body>
-</html>`}import{existsSync as J,access as kt,constants as bt,mkdirSync as $t,writeFileSync as xt,unlinkSync as Pt}from"fs";import{join as H}from"path";import{promisify as St}from"util";var jt=St(kt);async function G(t=process.cwd()){let e=H(t,"node_modules");if(!J(e))throw new Error('node_modules directory not found. Please run "npm install", "pnpm install", or "bun install" first.')}async function W(t){if(!J(t))try{$t(t,{recursive:!0})}catch(r){throw new Error(`Cannot create directory ${t}: ${r instanceof Error?r.message:String(r)}`)}try{await jt(t,bt.W_OK)}catch{throw new Error(`No write permission for directory: ${t}`)}let e=H(t,`.write-test-${Date.now()}.tmp`);try{xt(e,"ok"),Pt(e)}catch(r){throw new Error(`Cannot write to directory ${t}: ${r instanceof Error?r.message:String(r)}`)}}function j(t,e){try{return JSON.parse(t)}catch(r){throw r instanceof SyntaxError?new Error(`Invalid JSON in ${e}: ${r.message}`):r}}var m={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",cyan:"\x1B[36m"},Y=["-","\\","|","/"],E=null,q="",n={info:t=>{console.log(`${m.cyan}[INFO]${m.reset} ${t}`)},success:t=>{console.log(`${m.green}${m.bright}[OK]${m.reset} ${m.green}${t}${m.reset}`)},warn:t=>{console.warn(`${m.yellow}[WARN]${m.reset} ${t}`)},error:t=>{console.error(`${m.red}${m.bright}[ERR]${m.reset} ${m.red}${t}${m.reset}`)},progress:(t,e,r)=>{let o=Math.round(t/e*100);process.stdout.write(`\r${m.cyan}${r}${m.reset} ${m.dim}(${t}/${e}, ${o}%)${m.reset}`),t===e&&process.stdout.write(`
-`)},startSpinner:t=>{q=t;let e=0;E=setInterval(()=>{process.stdout.write(`\r${m.cyan}${Y[e]}${m.reset} ${q}`),e=(e+1)%Y.length},100)},stopSpinner:()=>{E&&(clearInterval(E),E=null,process.stdout.write("\r"+" ".repeat(process.stdout.columns||80)+"\r"))}};import{format as st}from"date-fns";import{existsSync as Rt,readFileSync as Ct}from"fs";import{join as Mt}from"path";import{z as g}from"zod";var l={staleThreshold:"18 months",ignorePatterns:[],formats:{markdown:!0,html:!0},concurrency:5,failConditions:{stale:!1,major:!1},reportEmptyState:!0},Et=g.object({staleThreshold:g.string().default(l.staleThreshold),ignorePatterns:g.array(g.string()).default(l.ignorePatterns),formats:g.object({markdown:g.boolean().default(l.formats.markdown),html:g.boolean().default(l.formats.html)}).default(l.formats),concurrency:g.number().int().positive().default(l.concurrency),failConditions:g.object({stale:g.boolean().default(l.failConditions.stale),major:g.boolean().default(l.failConditions.major)}).default(l.failConditions),reportEmptyState:g.boolean().default(l.reportEmptyState)}).passthrough();function B(t){try{return Et.parse(t)}catch(e){if(e instanceof g.ZodError){let r=e.errors.map(o=>`${o.path.join(".")}: ${o.message}`).join(", ");throw new Error(`Invalid config: ${r}`)}throw e}}function K(t=process.cwd()){let e=Mt(t,".dep-report","config.json");if(!Rt(e))return n.info("No config.json found, using defaults"),l;try{let r=Ct(e,"utf-8"),o=j(r,e),s={staleThreshold:o.staleThreshold??l.staleThreshold,ignorePatterns:o.ignorePatterns??l.ignorePatterns,formats:{markdown:o.formats?.markdown??l.formats.markdown,html:o.formats?.html??l.formats.html},concurrency:o.concurrency??l.concurrency,failConditions:{stale:o.failConditions?.stale??l.failConditions.stale,major:o.failConditions?.major??l.failConditions.major},reportEmptyState:o.reportEmptyState??l.reportEmptyState},c=B(s);return n.info("Loaded config from .dep-report/config.json"),c}catch(r){return n.warn(`Failed to load config: ${r instanceof Error?r.message:String(r)}`),n.warn("Using default configuration"),l}}function Ot(t){let r=t.trim().toLowerCase().match(/^(\d+)\s+(year|years|month|months|day|days|week|weeks)$/);if(!r)throw new Error(`Invalid duration format: "${t}". Expected format: "18 months", "2 years", "90 days", etc.`);let o=parseInt(r[1],10),s=r[2];switch(s){case"day":case"days":return o*24*60*60*1e3;case"week":case"weeks":return o*7*24*60*60*1e3;case"month":case"months":return o*30*24*60*60*1e3;case"year":case"years":return o*365*24*60*60*1e3;default:throw new Error(`Unsupported time unit: ${s}`)}}function V(t){let e=Ot(t);return Math.floor(e/(1e3*60*60*24))}import{existsSync as vt,readFileSync as Dt}from"fs";import{join as Nt}from"path";function Z(t=process.cwd()){let e=Nt(t,".dep-report","notes.json");if(!vt(e))return{};try{let r=Dt(e,"utf-8"),o=j(r,e);if(typeof o!="object"||o===null||Array.isArray(o))return n.warn("Invalid notes.json format, expected object"),{};for(let[s,c]of Object.entries(o))typeof c!="string"&&(n.warn(`Invalid note for ${s}, expected string`),delete o[s]);return n.info(`Loaded ${Object.keys(o).length} notes from notes.json`),o}catch(r){return n.warn(`Failed to load notes: ${r instanceof Error?r.message:String(r)}`),{}}}function Q(t,e){return t.map(r=>{let o=e[r.name];return o?{...r,note:o}:r})}import{minimatch as Tt}from"minimatch";function X(t,e){return e.length===0?t:t.filter(r=>{for(let o of e)if(Tt(r.name,o))return!1;return!0})}import{existsSync as P,mkdirSync as tt,writeFileSync as v}from"fs";import{join as S}from"path";async function et(t=process.cwd(),e=!1){let r=S(t,".dep-report"),o=S(r,"config.json"),s=S(r,"notes.json"),c=S(r,"reports"),i=S(r,".gitignore");if(P(r)?n.info(".dep-report/ directory already exists"):(tt(r,{recursive:!0}),n.success("Created .dep-report/ directory")),P(c)||(tt(c,{recursive:!0}),n.success("Created .dep-report/reports/ directory")),!P(o)||e){let a=JSON.stringify(l,null,2);v(o,a,"utf-8"),n.success("Created .dep-report/config.json")}else n.info("config.json already exists, skipping");if(P(s))n.info("notes.json already exists, skipping");else{let a=JSON.stringify({},null,2);v(s,a,"utf-8"),n.success("Created .dep-report/notes.json")}P(i)?n.info(".gitignore already exists, skipping"):(v(i,`.cache.json
-`,"utf-8"),n.success("Created .dep-report/.gitignore")),n.success("Initialization complete!"),n.info("You can now customize .dep-report/config.json and add notes to .dep-report/notes.json")}var It="https://registry.npmjs.org";async function rt(t=It,e=5e3){let r=new AbortController,o=setTimeout(()=>r.abort(),e);try{let s=`${t}/lodash`;return(await fetch(s,{headers:{Accept:"application/json"},signal:r.signal})).ok}catch{return!1}finally{clearTimeout(o)}}var R=new At,_t=new URL("../package.json",import.meta.url),Lt=JSON.parse(Ft(_t,"utf-8")),zt=Lt.version??"0.0.0";R.name("dep-report").description("Zero-config CLI tool that generates version-controlled snapshots of dependency risk").version(zt);R.command("init").description("Scaffold .dep-report/ directory structure").option("--include-config","Force overwrite config.json even if it exists").action(async t=>{try{await et(process.cwd(),t.includeConfig),process.exit(0)}catch(e){n.error(e instanceof Error?e.message:String(e)),process.exit(1)}});R.action(async()=>{try{let t=process.cwd(),e=K(t);n.info("Checking prerequisites..."),await G(t);let r=y(t,".dep-report");await W(r),n.info("Detecting package manager...");let o=D(t);o||(n.error("No package manager detected. Please ensure you have package-lock.json, pnpm-lock.yaml, bun.lock, or bun.lockb in your project."),process.exit(1)),n.success(`Detected: ${o.manager}`),n.info("Scanning for outdated packages...");let s=await T(o.manager,t);if(Object.keys(s).length===0){if(n.success("No outdated packages found!"),e.reportEmptyState){let u=y(t,".dep-report","reports");ot(u)||nt(u,{recursive:!0});let f=st(new Date,"yyyy-MM-dd");if(e.formats.markdown){let h=M([]);k(y(u,`${f}_outdated.md`),h),k(y(u,"latest.md"),h),n.success(`Report generated: .dep-report/reports/${f}_outdated.md`)}if(e.formats.html){let h=O([]);k(y(u,`${f}_outdated.html`),h),k(y(u,"latest.html"),h),n.success(`HTML report generated: .dep-report/reports/${f}_outdated.html`)}}process.exit(0)}n.info(`Found ${Object.keys(s).length} outdated packages`);let c=I(s);n.startSpinner("Checking registry connectivity...");let i=await rt();n.stopSpinner(),i||(n.error("Unable to reach the npm registry."),n.info("If you have a cache, try running with --refresh."),process.exit(1)),n.success("Registry connectivity confirmed"),n.startSpinner(`Enriching ${c.length} packages with registry metadata...`);let a=await F(c,e.concurrency);n.stopSpinner(),n.success("Enrichment complete");let p=V(e.staleThreshold),d=L(a,p),w=d.length;d=X(d,e.ignorePatterns),w>d.length&&n.info(`Filtered out ${w-d.length} packages based on ignorePatterns`);let C=Z(t);if(d=Q(d,C),e.formats.markdown||e.formats.html){n.info("Generating reports...");let u=y(t,".dep-report","reports");ot(u)||nt(u,{recursive:!0});let f=st(new Date,"yyyy-MM-dd");if(e.formats.markdown){let h=M(d);k(y(u,`${f}_outdated.md`),h),k(y(u,"latest.md"),h),n.success(`Report generated: .dep-report/reports/${f}_outdated.md`),n.success("Latest report: .dep-report/reports/latest.md")}if(e.formats.html){let h=O(d);k(y(u,`${f}_outdated.html`),h),k(y(u,"latest.html"),h),n.success(`HTML report generated: .dep-report/reports/${f}_outdated.html`),n.success("Latest HTML report: .dep-report/reports/latest.html")}}let $=!1;e.failConditions.stale&&d.some(f=>f.isStale)&&(n.error("Found stale packages (--fail-if-stale)"),$=!0),e.failConditions.major&&d.some(f=>f.risk==="Major")&&(n.error("Found major version updates (--fail-if-major)"),$=!0),process.exit($?1:0)}catch(t){n.error(t instanceof Error?t.message:String(t)),process.exit(1)}});R.parse();
+</html>`}import{existsSync as ge,access as Qe,constants as Xe,mkdirSync as Ze,writeFileSync as et,unlinkSync as tt}from"fs";import{join as he}from"path";import{promisify as rt}from"util";var nt=rt(Qe);async function ye(e=process.cwd()){let t=he(e,"node_modules");if(!ge(t))throw new Error('node_modules directory not found. Please run "npm install", "pnpm install", or "bun install" first.')}async function be(e){if(!ge(e))try{Ze(e,{recursive:!0})}catch(r){throw new Error(`Cannot create directory ${e}: ${r instanceof Error?r.message:String(r)}`)}try{await nt(e,Xe.W_OK)}catch{throw new Error(`No write permission for directory: ${e}`)}let t=he(e,`.write-test-${Date.now()}.tmp`);try{et(t,"ok"),tt(t)}catch(r){throw new Error(`Cannot write to directory ${e}: ${r instanceof Error?r.message:String(r)}`)}}function H(e,t){try{return JSON.parse(e)}catch(r){throw r instanceof SyntaxError?new Error(`Invalid JSON in ${t}: ${r.message}`):r}}var j={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",cyan:"\x1B[36m"},ke=["-","\\","|","/"],K=null,$e="",l={info:e=>{console.log(`${j.cyan}[INFO]${j.reset} ${e}`)},success:e=>{console.log(`${j.green}${j.bright}[OK]${j.reset} ${j.green}${e}${j.reset}`)},warn:e=>{console.warn(`${j.yellow}[WARN]${j.reset} ${e}`)},error:e=>{console.error(`${j.red}${j.bright}[ERR]${j.reset} ${j.red}${e}${j.reset}`)},progress:(e,t,r)=>{let n=Math.round(e/t*100);process.stdout.write(`\r${j.cyan}${r}${j.reset} ${j.dim}(${e}/${t}, ${n}%)${j.reset}`),e===t&&process.stdout.write(`
+`)},startSpinner:e=>{$e=e;let t=0;K=setInterval(()=>{process.stdout.write(`\r${j.cyan}${ke[t]}${j.reset} ${$e}`),t=(t+1)%ke.length},100)},stopSpinner:()=>{K&&(clearInterval(K),K=null,process.stdout.write("\r"+" ".repeat(process.stdout.columns||80)+"\r"))}};import{format as Fe}from"date-fns";import{existsSync as st,readFileSync as at}from"fs";import{join as it}from"path";import{z as D}from"zod";var P={staleThreshold:"18 months",ignorePatterns:[],formats:{markdown:!0,html:!0},concurrency:5,failConditions:{stale:!1,major:!1},reportEmptyState:!0},ot=D.object({staleThreshold:D.string().default(P.staleThreshold),ignorePatterns:D.array(D.string()).default(P.ignorePatterns),formats:D.object({markdown:D.boolean().default(P.formats.markdown),html:D.boolean().default(P.formats.html)}).default(P.formats),concurrency:D.number().int().positive().default(P.concurrency),failConditions:D.object({stale:D.boolean().default(P.failConditions.stale),major:D.boolean().default(P.failConditions.major)}).default(P.failConditions),reportEmptyState:D.boolean().default(P.reportEmptyState)}).passthrough();function we(e){try{return ot.parse(e)}catch(t){if(t instanceof D.ZodError){let r=t.errors.map(n=>`${n.path.join(".")}: ${n.message}`).join(", ");throw new Error(`Invalid config: ${r}`)}throw t}}function Se(e=process.cwd()){let t=it(e,".dep-report","config.json");if(!st(t))return l.info("No config.json found, using defaults"),P;try{let r=at(t,"utf-8"),n=H(r,t),i={staleThreshold:n.staleThreshold??P.staleThreshold,ignorePatterns:n.ignorePatterns??P.ignorePatterns,formats:{markdown:n.formats?.markdown??P.formats.markdown,html:n.formats?.html??P.formats.html},concurrency:n.concurrency??P.concurrency,failConditions:{stale:n.failConditions?.stale??P.failConditions.stale,major:n.failConditions?.major??P.failConditions.major},reportEmptyState:n.reportEmptyState??P.reportEmptyState},m=we(i);return l.info("Loaded config from .dep-report/config.json"),m}catch(r){return l.warn(`Failed to load config: ${r instanceof Error?r.message:String(r)}`),l.warn("Using default configuration"),P}}function ct(e){let r=e.trim().toLowerCase().match(/^(\d+)\s+(year|years|month|months|day|days|week|weeks)$/);if(!r)throw new Error(`Invalid duration format: "${e}". Expected format: "18 months", "2 years", "90 days", etc.`);let n=parseInt(r[1],10),i=r[2];switch(i){case"day":case"days":return n*24*60*60*1e3;case"week":case"weeks":return n*7*24*60*60*1e3;case"month":case"months":return n*30*24*60*60*1e3;case"year":case"years":return n*365*24*60*60*1e3;default:throw new Error(`Unsupported time unit: ${i}`)}}function Pe(e){let t=ct(e);return Math.floor(t/(1e3*60*60*24))}import{existsSync as dt,readFileSync as lt}from"fs";import{join as mt}from"path";function xe(e=process.cwd()){let t=mt(e,".dep-report","notes.json");if(!dt(t))return{};try{let r=lt(t,"utf-8"),n=H(r,t);if(typeof n!="object"||n===null||Array.isArray(n))return l.warn("Invalid notes.json format, expected object"),{};for(let[i,m]of Object.entries(n))typeof m!="string"&&(l.warn(`Invalid note for ${i}, expected string`),delete n[i]);return l.info(`Loaded ${Object.keys(n).length} notes from notes.json`),n}catch(r){return l.warn(`Failed to load notes: ${r instanceof Error?r.message:String(r)}`),{}}}function je(e,t){return e.map(r=>{let n=t[r.name];return n?{...r,note:n}:r})}import{minimatch as ut}from"minimatch";function Ee(e,t){return t.length===0?e:e.filter(r=>{for(let n of t)if(ut(r.name,n))return!1;return!0})}import{existsSync as U,mkdirSync as Re,writeFileSync as te}from"fs";import{join as B}from"path";async function Me(e=process.cwd(),t=!1,r){let n=B(e,".dep-report"),i=B(n,"config.json"),m=B(n,"notes.json"),a=B(n,"reports"),w=B(n,".gitignore");if(U(n)?l.info(".dep-report/ directory already exists"):(Re(n,{recursive:!0}),l.success("Created .dep-report/ directory")),U(a)||(Re(a,{recursive:!0}),l.success("Created .dep-report/reports/ directory")),!U(i)||t){let p=P;if(r){let c=oe(r);p=c.config,l.info(`Using preset: ${c.displayName} - ${c.description}`)}let k=JSON.stringify(p,null,2);te(i,k,"utf-8"),l.success("Created .dep-report/config.json")}else l.info("config.json already exists, skipping");if(U(m))l.info("notes.json already exists, skipping");else{let p=JSON.stringify({},null,2);te(m,p,"utf-8"),l.success("Created .dep-report/notes.json")}U(w)?l.info(".gitignore already exists, skipping"):(te(w,`.cache.json
+`,"utf-8"),l.success("Created .dep-report/.gitignore")),l.success("Initialization complete!"),l.info("You can now customize .dep-report/config.json and add notes to .dep-report/notes.json")}import{readFileSync as De,existsSync as re,readdirSync as pt}from"fs";import{join as J}from"path";import{format as ft,parse as W,subDays as gt,differenceInDays as ne}from"date-fns";function ve(e,t){let r=e.match(/\| Package \|.*?\n\|-+\|\n([\s\S]*?)\n\n/);if(!r)return null;let n=r[1].trim().split(`
+`),i=[];for(let c of n){let y=c.split("|").map(S=>S.trim()).filter(S=>S);if(y.length<6)continue;let[d,g,o,s,h,f,b,u]=y;if(b.includes("Stable"))continue;let $=null;if(s&&s!=="Unknown"){let S=s.match(/(\d+)d|(\d+)m|(\d+)y/);S&&(S[1]?$=parseInt(S[1]):S[2]?$=parseInt(S[2])*30:S[3]&&($=parseInt(S[3])*365))}let E=null;if(h&&h!=="\u2014"){let S=h.match(/(\d+)d|(\d+)m|(\d+)y/);S&&(S[1]?E=parseInt(S[1]):S[2]?E=parseInt(S[2])*30:S[3]&&(E=parseInt(S[3])*365))}let M="Patch";f.includes("Major")?M="Major":f.includes("Minor")?M="Minor":f.includes("Patch")?M="Patch":f.includes("Exotic")?M="Exotic":f.includes("NotInstalled")&&(M="NotInstalled"),i.push({name:d,current:g,latest:o,wanted:o,type:"dependencies",currentPublishedAt:null,latestPublishedAt:null,age:$,behindByDays:E,isStale:$!==null&&$>365,risk:M,note:u||void 0})}let m=e.match(/Total: (\d+) \| Outdated: (\d+) \| Stale: (\d+)/),a=m?parseInt(m[1]):i.length,w=m?parseInt(m[2]):i.length,p=m?parseInt(m[3]):i.filter(c=>c.isStale).length,k=i.filter(c=>c.risk==="Major").length;return{date:t,packages:i,summary:{total:a,outdated:w,stale:p,major:k}}}function Ce(e,t){if(t==="latest"){let r=J(e,"latest.md");return re(r)?r:null}if(t==="last-month"){let n=gt(new Date,30),i=pt(e).filter(m=>m.endsWith("_outdated.md")).map(m=>{let a=m.match(/(\d{4}-\d{2}-\d{2})_outdated\.md/);return a?{file:m,date:W(a[1],"yyyy-MM-dd",new Date)}:null}).filter(m=>m!==null).sort((m,a)=>Math.abs(ne(m.date,n))-Math.abs(ne(a.date,n)));return i.length>0?J(e,i[0].file):null}try{let r=W(t,"yyyy-MM-dd",new Date),n=ft(r,"yyyy-MM-dd"),i=J(e,`${n}_outdated.md`);if(re(i))return i}catch{}return null}function Oe(e){return 100-e.stale*5-e.major*3}async function Te(e,t,r=process.cwd()){let n=J(r,".dep-report","reports");re(n)||(l.error("No reports directory found. Run dep-report first to generate reports."),process.exit(1));let i=Ce(n,e),m=Ce(n,t);i||(l.error(`Report not found for: ${e}`),process.exit(1)),m||(l.error(`Report not found for: ${t}`),process.exit(1));let a=De(i,"utf-8"),w=De(m,"utf-8"),p=i.match(/(\d{4}-\d{2}-\d{2})_outdated\.md/),k=m.match(/(\d{4}-\d{2}-\d{2})_outdated\.md/),c=p?p[1]:e,y=k?k[1]:t,d=ve(a,c),g=ve(w,y);(!d||!g)&&(l.error("Failed to parse reports"),process.exit(1));let o=ne(W(y,"yyyy-MM-dd",new Date),W(c,"yyyy-MM-dd",new Date)),s=g.summary.stale-d.summary.stale,h=g.summary.major-d.summary.major,f=new Set(d.packages.map(x=>x.name)),b=new Set(g.packages.map(x=>x.name)),u=g.packages.filter(x=>!f.has(x.name)),$=d.packages.filter(x=>!b.has(x.name)),E=g.packages.filter(x=>{let _=d.packages.find(G=>G.name===x.name);return _&&_.current!==x.current}),M=Oe(d.summary),S=Oe(g.summary),N=M>0?(S-M)/M*100:0;if(console.log(`
+Dependency Health Comparison`),console.log(`From: ${c} \u2192 ${y} (${o} days)
+`),E.length>0){console.log("\u{1F4C8} Improvements:");for(let x of E.slice(0,5)){let _=d.packages.find(G=>G.name===x.name);console.log(`  \u2022 ${x.name}: ${_?.current} \u2192 ${x.current}`)}E.length>5&&console.log(`  ... and ${E.length-5} more`),console.log("")}if(s!==0||h!==0){if(console.log("\u{1F4CA} Metrics:"),s!==0){let x=s>0?"+":"";console.log(`  \u2022 Stale packages: ${d.summary.stale} \u2192 ${g.summary.stale} (${x}${s})`)}if(h!==0){let x=h>0?"+":"";console.log(`  \u2022 Major upgrades pending: ${d.summary.major} \u2192 ${g.summary.major} (${x}${h})`)}console.log("")}u.length>0&&console.log(`\u2795 Added: ${u.map(x=>x.name).join(", ")}`),$.length>0&&console.log(`\u2796 Removed: ${$.map(x=>x.name).join(", ")}`),(u.length>0||$.length>0)&&console.log("");let Le=N>0?"\u2705":N<0?"\u26A0\uFE0F":"\u27A1\uFE0F",Ue=N>0?"improved":N<0?"regressed":"unchanged";console.log(`${Le} Overall: Health ${Ue} by ${Math.abs(N).toFixed(1)}%`),console.log(`   Score: ${M.toFixed(1)} \u2192 ${S.toFixed(1)}
+`),process.exit(N<0?1:0)}var ht="https://registry.npmjs.org";async function Ne(e=ht,t=5e3){let r=new AbortController,n=setTimeout(()=>r.abort(),t);try{let i=`${e}/lodash`;return(await fetch(i,{headers:{Accept:"application/json"},signal:r.signal})).ok}catch{return!1}finally{clearTimeout(n)}}import{readFileSync as yt,existsSync as bt}from"fs";import{join as kt}from"path";function Y(e=process.cwd()){let t=kt(e,"package.json");if(!bt(t))return 0;try{let r=yt(t,"utf-8"),n=JSON.parse(r),i=Object.keys(n.dependencies||{}).length,m=Object.keys(n.devDependencies||{}).length,a=Object.keys(n.peerDependencies||{}).length,w=Object.keys(n.optionalDependencies||{}).length;return i+m+a+w}catch{return 0}}var z=new $t,St=new URL("../package.json",import.meta.url),Pt=JSON.parse(wt(St,"utf-8")),xt=Pt.version??"0.0.0";z.name("dep-report").description("Generate dependency risk reports").version(xt).addHelpText("before",`
+dep-report - Generate dependency risk reports
+
+USAGE
+  dep-report [options]
+
+DESCRIPTION
+  Scans for outdated packages and generates a daily risk brief 
+  showing age, staleness, and major upgrades. Reports are 
+  version-controlled in .dep-report/reports/
+
+QUICK START
+  dep-report              # Run audit, generate reports
+  dep-report init         # Create config files
+`).addHelpText("after",`
+EXAMPLES
+  dep-report                           # Daily audit
+  dep-report init                      # Initialize configuration
+
+LEARN MORE
+  https://github.com/hussmarsidi/dep-reports
+`);z.command("init").description("Scaffold .dep-report/ directory structure").option("--include-config","Force overwrite config.json even if it exists").option("--preset <preset>","Use a preset configuration (starter|production|strict)","production").action(async e=>{try{let{isValidPresetName:t}=await import("./presets-BJSOBSDA.js"),r;e.preset&&(t(e.preset)||(l.error(`Invalid preset: ${e.preset}. Valid options: starter, production, strict`),process.exit(1)),r=e.preset),await Me(process.cwd(),e.includeConfig,r),process.exit(0)}catch(t){l.error(t instanceof Error?t.message:String(t)),process.exit(1)}});z.command("compare").description("Compare two dependency reports to track health over time").argument("<from>",'Start date (YYYY-MM-DD), "latest", or "last-month"').argument("<to>",'End date (YYYY-MM-DD) or "latest"').action(async(e,t)=>{try{await Te(e,t)}catch(r){l.error(r instanceof Error?r.message:String(r)),process.exit(1)}});z.option("--dry-run [level]","Preview summary without writing files (summary|actions|full)","actions").action(async e=>{try{let t=process.cwd(),r=Se(t);l.info("Checking prerequisites..."),await ye(t);let n=v(t,".dep-report");await be(n),l.info("Detecting package manager...");let i=se(t);i||(l.error("No package manager detected. Please ensure you have package-lock.json, pnpm-lock.yaml, bun.lock, or bun.lockb in your project."),process.exit(1)),l.success(`Detected: ${i.manager}`),l.info("Scanning for outdated packages...");let m=await ie(i.manager,t);if(Object.keys(m).length===0){if(l.success("No outdated packages found!"),r.reportEmptyState){let o=v(t,".dep-report","reports");Ie(o)||Ae(o,{recursive:!0});let s=Fe(new Date,"yyyy-MM-dd"),h=Y(t);if(r.formats.markdown){let f=Q([],new Date,h);T(v(o,`${s}_outdated.md`),f),T(v(o,"latest.md"),f),l.success(`Report generated: .dep-report/reports/${s}_outdated.md`)}if(r.formats.html){let f=ee([],new Date,h);T(v(o,`${s}_outdated.html`),f),T(v(o,"latest.html"),f),l.success(`HTML report generated: .dep-report/reports/${s}_outdated.html`)}}process.exit(0)}l.info(`Found ${Object.keys(m).length} outdated packages`);let a=ce(m);l.startSpinner("Checking registry connectivity...");let w=await Ne();l.stopSpinner(),w||(l.error("Unable to reach the npm registry."),l.info("If you have a cache, try running with --refresh."),process.exit(1)),l.success("Registry connectivity confirmed"),l.startSpinner(`Enriching ${a.length} packages with registry metadata...`);let p=await le(a,r.concurrency);l.stopSpinner(),l.success("Enrichment complete");let k=Pe(r.staleThreshold),c=ue(p,k),y=c.length;c=Ee(c,r.ignorePatterns),y>c.length&&l.info(`Filtered out ${y-c.length} packages based on ignorePatterns`);let d=xe(t);if(c=je(c,d),e.dryRun){let o=Y(t),s=F(c,o),h=typeof e.dryRun=="string"?e.dryRun:"actions";if(console.log(`
+Dry Run Summary`),console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"),console.log(`Status: ${s.riskStatusEmoji} ${s.riskStatusText}
+`),console.log(`Total dependencies: ${s.total}`),console.log(`Outdated: ${s.outdated} (${s.major} major, ${s.minor} minor, ${s.patch} patch)`),console.log(`Stale (>12 months): ${s.stale}
+`),h==="actions"||h==="full"){let b=c.map(u=>({pkg:u,score:O(u)})).filter(({score:u})=>u>15).sort((u,$)=>$.score-u.score).slice(0,7).map(({pkg:u})=>u);if(b.length>0){console.log("Action Required:");for(let u of b){let $=u.age!==null?`${u.age}d`:"Unknown",E=u.behindByDays!==null?`${u.behindByDays}d`:"\u2014",M=u.note?I(u.note):"",S=u.risk==="Major"?"\u{1F534}":u.risk==="Minor"?"\u{1F7E1}":"\u{1F7E2}";console.log(`  ${S} ${u.name} (${$}, behind by ${E}) - ${u.risk} ${u.current} \u2192 ${u.latest}${M?`, ${M}`:""}`)}console.log("")}}if(h==="full"){console.log("Full Dependency List:");for(let b of c){let u=b.age!==null?`${b.age}d`:"Unknown",$=b.behindByDays!==null?`${b.behindByDays}d`:"\u2014",E=A(b)?"\u2705 Stable":"Outdated";console.log(`  ${b.name}: ${b.current} \u2192 ${b.latest} (${u}, ${$}, ${b.risk}, ${E})`)}console.log("")}console.log(`[No files written]
+`);let f=!1;r.failConditions.stale&&c.some(u=>u.isStale)&&(l.error("Found stale packages (--fail-if-stale)"),f=!0),r.failConditions.major&&c.some(u=>u.risk==="Major")&&(l.error("Found major version updates (--fail-if-major)"),f=!0),process.exit(f?1:0)}if(r.formats.markdown||r.formats.html){l.info("Generating reports...");let o=v(t,".dep-report","reports");Ie(o)||Ae(o,{recursive:!0});let s=Fe(new Date,"yyyy-MM-dd"),h=Y(t);if(r.formats.markdown){let f=Q(c,new Date,h);T(v(o,`${s}_outdated.md`),f),T(v(o,"latest.md"),f),l.success(`Report generated: .dep-report/reports/${s}_outdated.md`),l.success("Latest report: .dep-report/reports/latest.md")}if(r.formats.html){let f=ee(c,new Date,h);T(v(o,`${s}_outdated.html`),f),T(v(o,"latest.html"),f),l.success(`HTML report generated: .dep-report/reports/${s}_outdated.html`),l.success("Latest HTML report: .dep-report/reports/latest.html")}}let g=!1;r.failConditions.stale&&c.some(s=>s.isStale)&&(l.error("Found stale packages (--fail-if-stale)"),g=!0),r.failConditions.major&&c.some(s=>s.risk==="Major")&&(l.error("Found major version updates (--fail-if-major)"),g=!0),process.exit(g?1:0)}catch(t){l.error(t instanceof Error?t.message:String(t)),process.exit(1)}});z.parse();

package/dist/presets-BJSOBSDA.js

@@ -0,0 +1 @@
+import{a,b,c,d}from"./chunk-KNT3JZ7P.js";export{a as PRESETS,b as getPreset,d as isValidPresetName,c as listPresets};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dep-report",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Zero-config CLI tool that generates version-controlled snapshots of dependency risk",
   "type": "module",
   "main": "dist/cli.js",