depfresh 0.9.2

package/dist/chunks/index3.mjs

@@ -0,0 +1,145 @@
+import './config.mjs';
+import { c as createLogger } from '../shared/depfresh.B1o7OHO_.mjs';
+import { execSync } from 'node:child_process';
+import '../shared/depfresh.ClIHCCxD.mjs';
+
+function detectGlobalPackageManager(pm) {
+  if (pm && (pm === "npm" || pm === "pnpm" || pm === "bun")) {
+    return pm;
+  }
+  try {
+    execSync("pnpm --version", { stdio: "ignore" });
+    return "pnpm";
+  } catch {
+  }
+  try {
+    execSync("bun --version", { stdio: "ignore" });
+    return "bun";
+  } catch {
+  }
+  return "npm";
+}
+function parseNpmGlobalList(json) {
+  try {
+    const data = JSON.parse(json);
+    if (!data.dependencies || typeof data.dependencies !== "object") {
+      return [];
+    }
+    return Object.entries(data.dependencies).map(([name, info]) => ({
+      name,
+      version: info.version
+    }));
+  } catch {
+    return [];
+  }
+}
+function parsePnpmGlobalList(json) {
+  try {
+    const data = JSON.parse(json);
+    if (!Array.isArray(data) || data.length === 0) {
+      return [];
+    }
+    const deps = data[0]?.dependencies;
+    if (!deps || typeof deps !== "object") {
+      return [];
+    }
+    return Object.entries(deps).map(([name, info]) => ({
+      name,
+      version: info.version
+    }));
+  } catch {
+    return [];
+  }
+}
+function parseBunGlobalList(output) {
+  const results = [];
+  const lines = output.split("\n");
+  for (const line of lines) {
+    const match = line.match(/[├└]──\s+(.+)@(\d.+)/);
+    if (match) {
+      results.push({ name: match[1], version: match[2] });
+    }
+  }
+  return results;
+}
+function listGlobalPackages(pm) {
+  try {
+    switch (pm) {
+      case "npm": {
+        const output = execSync("npm list -g --depth=0 --json", { encoding: "utf-8" });
+        return parseNpmGlobalList(output);
+      }
+      case "pnpm": {
+        const output = execSync("pnpm list -g --json", { encoding: "utf-8" });
+        return parsePnpmGlobalList(output);
+      }
+      case "bun": {
+        const output = execSync("bun pm ls -g", { encoding: "utf-8" });
+        return parseBunGlobalList(output);
+      }
+      case "yarn":
+        return [];
+    }
+  } catch {
+    return [];
+  }
+}
+function loadGlobalPackages(pm) {
+  const detectedPm = detectGlobalPackageManager(pm);
+  const packages = listGlobalPackages(detectedPm);
+  if (packages.length === 0) {
+    return [];
+  }
+  const deps = packages.map((pkg) => ({
+    name: pkg.name,
+    currentVersion: pkg.version,
+    source: "dependencies",
+    update: true,
+    parents: []
+  }));
+  return [
+    {
+      name: "Global packages",
+      type: "global",
+      filepath: `global:${detectedPm}`,
+      deps,
+      resolved: [],
+      raw: {},
+      indent: "  "
+    }
+  ];
+}
+function writeGlobalPackage(pm, name, version) {
+  const logger = createLogger("info");
+  switch (pm) {
+    case "npm":
+      execSync(`npm install -g ${name}@${version}`, { stdio: "inherit" });
+      break;
+    case "pnpm":
+      execSync(`pnpm add -g ${name}@${version}`, { stdio: "inherit" });
+      break;
+    case "bun":
+      execSync(`bun add -g ${name}@${version}`, { stdio: "inherit" });
+      break;
+    case "yarn":
+      logger.warn("Yarn global packages not supported");
+      break;
+  }
+}
+
+const global = {
+  __proto__: null,
+  detectGlobalPackageManager: detectGlobalPackageManager,
+  listGlobalPackages: listGlobalPackages,
+  loadGlobalPackages: loadGlobalPackages,
+  parseBunGlobalList: parseBunGlobalList,
+  parseNpmGlobalList: parseNpmGlobalList,
+  parsePnpmGlobalList: parsePnpmGlobalList,
+  writeGlobalPackage: writeGlobalPackage
+};
+
+function defineConfig(options) {
+  return options;
+}
+
+export { defineConfig as d, global as g, loadGlobalPackages as l, writeGlobalPackage as w };

package/dist/chunks/interactive.mjs

@@ -0,0 +1,85 @@
+import * as p from '@clack/prompts';
+import c from 'ansis';
+import { a as arrow, b as colorizeVersionDiff, e as colorDiff } from '../shared/depfresh.ClIHCCxD.mjs';
+import '../shared/depfresh.B1o7OHO_.mjs';
+import 'node:fs';
+import 'node:os';
+import 'find-up-simple';
+import 'ini';
+import 'pathe';
+import 'node:child_process';
+import 'detect-indent';
+import 'semver';
+import 'pnpm-workspace-yaml';
+import 'yaml';
+import 'p-limit';
+import 'better-sqlite3';
+import 'tinyglobby';
+
+const DIFF_GROUP_ORDER = ["major", "minor", "patch"];
+const GROUP_COLORS = {
+  major: c.red,
+  minor: c.yellow,
+  patch: c.green
+};
+function makeOption(dep) {
+  return {
+    value: dep.name,
+    label: `${dep.name}  ${dep.currentVersion}${arrow()}${colorizeVersionDiff(dep.currentVersion, dep.targetVersion, dep.diff)}  ${colorDiff(dep.diff)}`,
+    hint: dep.deprecated ? c.red("deprecated") : void 0
+  };
+}
+async function runClackFallback(updates) {
+  const grouped = /* @__PURE__ */ new Map();
+  for (const dep of updates) {
+    const existing = grouped.get(dep.diff);
+    if (existing) {
+      existing.push(dep);
+    } else {
+      grouped.set(dep.diff, [dep]);
+    }
+  }
+  const hasStandardGroups = DIFF_GROUP_ORDER.some((d) => grouped.has(d));
+  if (!hasStandardGroups) {
+    const options = updates.map(makeOption);
+    const selected2 = await p.multiselect({
+      message: "Select dependencies to update",
+      options,
+      required: false
+    });
+    if (p.isCancel(selected2)) {
+      p.cancel("Update cancelled");
+      return [];
+    }
+    return updates.filter((u) => selected2.includes(u.name));
+  }
+  const groupOptions = {};
+  for (const diffType of DIFF_GROUP_ORDER) {
+    const deps = grouped.get(diffType);
+    if (!deps) continue;
+    const colorFn = GROUP_COLORS[diffType];
+    const label = colorFn ? colorFn(diffType) : diffType;
+    groupOptions[label] = deps.map(makeOption);
+  }
+  const selected = await p.groupMultiselect({
+    message: "Select dependencies to update",
+    options: groupOptions,
+    required: false,
+    selectableGroups: true
+  });
+  if (p.isCancel(selected)) {
+    p.cancel("Update cancelled");
+    return [];
+  }
+  return updates.filter((u) => selected.includes(u.name));
+}
+async function runInteractive(updates, options) {
+  if (updates.length === 0) return [];
+  if (process.stdin.isTTY && process.stdout.isTTY) {
+    const { createInteractiveTUI } = await import('./index2.mjs');
+    return createInteractiveTUI(updates, { explain: options?.explain ?? false });
+  }
+  return runClackFallback(updates);
+}
+
+export { runInteractive };

package/dist/chunks/normalize-args.mjs

@@ -0,0 +1,59 @@
+const VALID_MODES = /* @__PURE__ */ new Set([
+  "default",
+  "major",
+  "minor",
+  "patch",
+  "latest",
+  "newest",
+  "next"
+]);
+async function normalizeArgs(args) {
+  const { resolveConfig } = await import('./config.mjs').then(function (n) { return n.c; });
+  const depFields = {};
+  if (args["deps-only"]) {
+    depFields.devDependencies = false;
+    depFields.peerDependencies = false;
+    depFields.optionalDependencies = false;
+  }
+  if (args["dev-only"]) {
+    depFields.dependencies = false;
+    depFields.peerDependencies = false;
+    depFields.optionalDependencies = false;
+  }
+  const mode = args.mode_arg && VALID_MODES.has(args.mode_arg) ? args.mode_arg : args.mode;
+  const include = typeof args.include === "string" ? args.include.split(",").map((s) => s.trim()) : void 0;
+  const exclude = typeof args.exclude === "string" ? args.exclude.split(",").map((s) => s.trim()) : void 0;
+  return resolveConfig({
+    cwd: args.cwd || process.cwd(),
+    recursive: args.recursive,
+    write: args.write,
+    interactive: args.interactive,
+    mode,
+    include,
+    exclude,
+    force: args.force,
+    global: args.global,
+    peer: args.peer,
+    includeLocked: args["include-locked"],
+    output: args.output,
+    concurrency: Number.parseInt(args.concurrency, 10),
+    loglevel: args.loglevel,
+    depFields,
+    all: args.all,
+    group: args.group,
+    sort: args.sort,
+    timediff: args.timediff,
+    cooldown: Number.parseInt(args.cooldown, 10),
+    nodecompat: args.nodecompat,
+    long: args.long,
+    explain: args.explain,
+    install: args.install,
+    update: args.update,
+    execute: args.execute,
+    verifyCommand: args["verify-command"],
+    failOnOutdated: args["fail-on-outdated"],
+    ignoreOtherWorkspaces: args["ignore-other-workspaces"]
+  });
+}
+
+export { normalizeArgs };

package/dist/cli.d.mts

@@ -0,0 +1,2 @@
+
+export { };

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+
+export { };

package/dist/cli.mjs

@@ -0,0 +1,202 @@
+#!/usr/bin/env node
+import { defineCommand, runMain } from 'citty';
+
+const version = "0.9.2";
+
+const args = {
+  mode_arg: {
+    type: "positional",
+    description: "Version range mode shorthand (major, minor, patch, latest, newest, next)",
+    required: false
+  },
+  cwd: {
+    type: "string",
+    alias: "C",
+    description: "Working directory for depzy to run in"
+  },
+  recursive: {
+    type: "boolean",
+    alias: "r",
+    description: "Recursively search for package.json in subdirectories",
+    default: true
+  },
+  write: {
+    type: "boolean",
+    alias: "w",
+    description: "Write updated versions to package files",
+    default: false
+  },
+  interactive: {
+    type: "boolean",
+    alias: "I",
+    description: "Interactive mode \u2014 select which deps to update",
+    default: false
+  },
+  mode: {
+    type: "string",
+    alias: "m",
+    description: "Version range mode: default, major, minor, patch, latest, newest, next",
+    default: "default"
+  },
+  include: {
+    type: "string",
+    alias: "n",
+    description: "Only include packages matching this regex (comma-separated)"
+  },
+  exclude: {
+    type: "string",
+    alias: "x",
+    description: "Exclude packages matching this regex (comma-separated)"
+  },
+  force: {
+    type: "boolean",
+    alias: "f",
+    description: "Force update even if the version is satisfied",
+    default: false
+  },
+  global: {
+    type: "boolean",
+    alias: "g",
+    description: "Check global packages",
+    default: false
+  },
+  peer: {
+    type: "boolean",
+    alias: "P",
+    description: "Include peer dependencies",
+    default: false
+  },
+  "include-locked": {
+    type: "boolean",
+    alias: "l",
+    description: "Include locked (pinned) dependencies",
+    default: false
+  },
+  output: {
+    type: "string",
+    alias: "o",
+    description: "Output format: table, json, sarif",
+    default: "table"
+  },
+  concurrency: {
+    type: "string",
+    alias: "c",
+    description: "Max concurrent registry requests",
+    default: "16"
+  },
+  loglevel: {
+    type: "string",
+    description: "Log level: silent, info, debug",
+    default: "info"
+  },
+  "deps-only": {
+    type: "boolean",
+    description: "Only check dependencies (not devDependencies)",
+    default: false
+  },
+  "dev-only": {
+    type: "boolean",
+    description: "Only check devDependencies",
+    default: false
+  },
+  all: {
+    type: "boolean",
+    alias: "a",
+    description: "Show all packages including up-to-date ones",
+    default: false
+  },
+  group: {
+    type: "boolean",
+    alias: "G",
+    description: "Group output by dependency source",
+    default: true
+  },
+  sort: {
+    type: "string",
+    alias: "s",
+    description: "Sort order: diff-asc, diff-desc, time-asc, time-desc, name-asc, name-desc",
+    default: "diff-asc"
+  },
+  timediff: {
+    type: "boolean",
+    alias: "T",
+    description: "Show time since version was published",
+    default: true
+  },
+  cooldown: {
+    type: "string",
+    description: "Skip versions published less than N days ago (0 = disabled)",
+    default: "0"
+  },
+  nodecompat: {
+    type: "boolean",
+    description: "Show Node.js engine compatibility for target versions",
+    default: true
+  },
+  long: {
+    type: "boolean",
+    alias: "L",
+    description: "Show extra details (homepage URL) per package",
+    default: false
+  },
+  explain: {
+    type: "boolean",
+    alias: "E",
+    description: "Show human-readable explanations for update types in interactive mode",
+    default: false
+  },
+  install: {
+    type: "boolean",
+    alias: "i",
+    description: "Run package manager install after writing",
+    default: false
+  },
+  update: {
+    type: "boolean",
+    alias: "u",
+    description: "Run package manager update instead of install after writing",
+    default: false
+  },
+  execute: {
+    type: "string",
+    alias: "e",
+    description: 'Run command after writing updates (e.g. "pnpm test")'
+  },
+  "verify-command": {
+    type: "string",
+    alias: "V",
+    description: "Run command after each dep update, revert on failure"
+  },
+  "fail-on-outdated": {
+    type: "boolean",
+    description: "Exit with code 1 when outdated dependencies are found (CI mode)",
+    default: false
+  },
+  "ignore-other-workspaces": {
+    type: "boolean",
+    description: "Skip packages that belong to nested/separate workspaces",
+    default: true
+  }
+};
+
+const main = defineCommand({
+  meta: {
+    name: "depzy",
+    version,
+    description: "Keep your npm dependencies fresh"
+  },
+  args,
+  async run({ args: args2 }) {
+    try {
+      const { normalizeArgs } = await import('./chunks/normalize-args.mjs');
+      const { check } = await import('./chunks/index.mjs');
+      const options = await normalizeArgs(args2);
+      const exitCode = await check(options);
+      process.exit(exitCode);
+    } catch (error) {
+      console.error("Fatal error:", error instanceof Error ? error.message : String(error));
+      process.exit(2);
+    }
+  }
+});
+runMain(main);

package/dist/index.d.mts

@@ -0,0 +1,204 @@
+type ProvenanceLevel = 'trusted' | 'attested' | 'none';
+interface PackageData {
+    name: string;
+    versions: string[];
+    distTags: Record<string, string>;
+    time?: Record<string, string>;
+    deprecated?: Record<string, string>;
+    description?: string;
+    homepage?: string;
+    repository?: string;
+    provenance?: Record<string, ProvenanceLevel>;
+    engines?: Record<string, string>;
+}
+interface RegistryConfig {
+    url: string;
+    token?: string;
+    authType?: 'bearer' | 'basic';
+    scope?: string;
+}
+interface NpmrcConfig {
+    registries: Map<string, RegistryConfig>;
+    defaultRegistry: string;
+    proxy?: string;
+    httpsProxy?: string;
+    strictSsl: boolean;
+    cafile?: string;
+}
+
+type RangeMode = 'default' | 'major' | 'minor' | 'patch' | 'latest' | 'newest' | 'next' | 'ignore';
+type DiffType = 'major' | 'minor' | 'patch' | 'none' | 'error';
+type SortOption = 'diff-asc' | 'diff-desc' | 'time-asc' | 'time-desc' | 'name-asc' | 'name-desc';
+type DepFieldType = 'dependencies' | 'devDependencies' | 'peerDependencies' | 'optionalDependencies' | 'overrides' | 'resolutions' | 'packageManager' | 'pnpm.overrides' | 'catalog';
+interface RawDep {
+    name: string;
+    currentVersion: string;
+    source: DepFieldType;
+    update: boolean;
+    parents: string[];
+    aliasName?: string;
+    protocol?: string;
+}
+interface UpdateScore {
+    confidence: number;
+    maturity: number;
+    adoption: number;
+    breaking: boolean;
+}
+interface ResolvedDepChange extends RawDep {
+    targetVersion: string;
+    diff: DiffType;
+    pkgData: PackageData;
+    resolvedUrl?: string;
+    deprecated?: string | boolean;
+    latestVersion?: string;
+    publishedAt?: string;
+    currentVersionTime?: string;
+    score?: UpdateScore;
+    provenance?: ProvenanceLevel;
+    currentProvenance?: ProvenanceLevel;
+    nodeCompat?: string;
+    nodeCompatible?: boolean;
+}
+
+type PackageManagerName = 'npm' | 'pnpm' | 'yarn' | 'bun';
+type OutputFormat = 'table' | 'json' | 'sarif';
+interface PackageManagerField {
+    name: PackageManagerName;
+    version: string;
+    hash?: string;
+    raw: string;
+}
+interface CatalogSource {
+    type: 'pnpm' | 'bun' | 'yarn';
+    name: string;
+    filepath: string;
+    deps: RawDep[];
+    raw: unknown;
+    indent: string;
+}
+type PackageType = 'package.json' | 'package.yaml' | 'pnpm-workspace' | 'bun-workspace' | 'yarn-workspace' | 'global';
+interface PackageMeta {
+    name: string;
+    type: PackageType;
+    filepath: string;
+    deps: RawDep[];
+    resolved: ResolvedDepChange[];
+    raw: unknown;
+    indent: string;
+    catalogs?: CatalogSource[];
+    packageManager?: PackageManagerField;
+}
+
+interface DepzyOptions {
+    cwd: string;
+    recursive: boolean;
+    mode: RangeMode;
+    write: boolean;
+    interactive: boolean;
+    force: boolean;
+    includeLocked: boolean;
+    includeWorkspace: boolean;
+    include?: string[];
+    exclude?: string[];
+    depFields?: Partial<Record<DepFieldType, boolean>>;
+    packageMode?: Record<string, RangeMode>;
+    concurrency: number;
+    timeout: number;
+    retries: number;
+    cacheTTL: number;
+    output: OutputFormat;
+    loglevel: 'silent' | 'info' | 'debug';
+    peer: boolean;
+    global: boolean;
+    ignorePaths: string[];
+    ignoreOtherWorkspaces: boolean;
+    all: boolean;
+    group: boolean;
+    sort: SortOption;
+    timediff: boolean;
+    cooldown: number;
+    nodecompat: boolean;
+    long: boolean;
+    explain: boolean;
+    failOnOutdated: boolean;
+    install: boolean;
+    update: boolean;
+    execute?: string;
+    verifyCommand?: string;
+    beforePackageStart?: (pkg: PackageMeta) => void | Promise<void>;
+    onDependencyResolved?: (pkg: PackageMeta, dep: ResolvedDepChange) => void | Promise<void>;
+    beforePackageWrite?: (pkg: PackageMeta) => boolean | Promise<boolean>;
+    afterPackageWrite?: (pkg: PackageMeta) => void | Promise<void>;
+    afterPackagesLoaded?: (pkgs: PackageMeta[]) => void | Promise<void>;
+    afterPackageEnd?: (pkg: PackageMeta) => void | Promise<void>;
+    afterPackagesEnd?: (pkgs: PackageMeta[]) => void | Promise<void>;
+}
+declare const DEFAULT_OPTIONS: Partial<DepzyOptions>;
+
+declare function check(options: DepzyOptions): Promise<number>;
+
+declare function resolveConfig(overrides?: Partial<DepzyOptions>): Promise<DepzyOptions>;
+
+interface DepzyErrorOptions {
+    cause?: unknown;
+}
+/**
+ * Base error class for all depzy runtime errors.
+ * Allows API users to reliably branch on `instanceof DepzyError` and `code`.
+ */
+declare class DepzyError extends Error {
+    readonly code: string;
+    readonly cause?: unknown;
+    constructor(message: string, code: string, options?: DepzyErrorOptions);
+}
+declare class RegistryError extends DepzyError {
+    readonly status: number;
+    readonly url: string;
+    constructor(message: string, status: number, url: string, options?: DepzyErrorOptions);
+}
+declare class CacheError extends DepzyError {
+    constructor(message: string, options?: DepzyErrorOptions);
+}
+declare class ConfigError extends DepzyError {
+    constructor(message: string, options?: DepzyErrorOptions);
+}
+declare class WriteError extends DepzyError {
+    constructor(message: string, options?: DepzyErrorOptions);
+}
+declare class ResolveError extends DepzyError {
+    constructor(message: string, options?: DepzyErrorOptions);
+}
+
+declare function parseDependencies(raw: Record<string, unknown>, options: DepzyOptions): RawDep[];
+
+declare function loadGlobalPackages(pm?: string): PackageMeta[];
+declare function writeGlobalPackage(pm: PackageManagerName, name: string, version: string): void;
+
+declare function loadPackages(options: DepzyOptions): Promise<PackageMeta[]>;
+
+interface Cache {
+    get(key: string): PackageData | undefined;
+    set(key: string, data: PackageData, ttl: number): void;
+    has(key: string): boolean;
+    clear(): void;
+    close(): void;
+    stats(): {
+        hits: number;
+        misses: number;
+        size: number;
+    };
+}
+
+declare function resolvePackage(pkg: PackageMeta, options: DepzyOptions, externalCache?: Cache, externalNpmrc?: NpmrcConfig, privatePackages?: Set<string>, onDependencyProcessed?: (pkg: PackageMeta, dep: RawDep) => void | Promise<void>): Promise<ResolvedDepChange[]>;
+
+/**
+ * Single-writer architecture: reads once, applies all mutations, writes once.
+ * Never allow independent writers to clobber each other.
+ */
+declare function writePackage(pkg: PackageMeta, changes: ResolvedDepChange[], loglevel?: 'silent' | 'info' | 'debug'): void;
+
+declare function defineConfig(options: Partial<DepzyOptions>): Partial<DepzyOptions>;
+
+export { CacheError, ConfigError, DEFAULT_OPTIONS, DepzyError, RegistryError, ResolveError, WriteError, check, defineConfig, loadGlobalPackages, loadPackages, parseDependencies, resolveConfig, resolvePackage, writeGlobalPackage, writePackage };
+export type { CatalogSource, DepFieldType, DepzyOptions, DiffType, NpmrcConfig, OutputFormat, PackageData, PackageManagerField, PackageManagerName, PackageMeta, PackageType, ProvenanceLevel, RangeMode, RawDep, RegistryConfig, ResolvedDepChange, SortOption, UpdateScore };