inup 1.5.6 → 1.6.0

package/README.md

@@ -49,9 +49,38 @@ inup [options]
 -i, --ignore <packages>       Ignore packages (comma-separated, glob supported)
 --max-depth <number>          Maximum scan depth for package discovery (default: 10)
 --package-manager <name>      Force package manager (npm, yarn, pnpm, bun)
+--json                        Print a machine-readable JSON report and exit (read-only)
+-c, --check                   Exit non-zero if updates exist, without writing (for CI)
 --debug                       Write verbose debug logs
 ```
 
+## CI & Scripting
+
+`inup` runs headless automatically when stdout isn't a TTY or `$CI` is set, so it never hangs in a
+pipeline waiting on the interactive UI. Both `--json` and `--check` are **read-only** — they report,
+they never edit `package.json` or install.
+
+```bash
+inup --check            # exit 1 if anything is outdated → fails the build
+inup --json | jq        # structured drift report for dashboards/bots
+inup | cat              # plain line-based report when piped to a log
+```
+
+Each reported package carries its health signals: `deprecated` (npm deprecation message), `enginesNode`
+(declared `engines.node`), and `vulnerability` (known advisories on the currently-installed version,
+from one bulk `npm audit`-style request). Every advisory is **cross-referenced against the upgrade
+targets**, so you know whether the upgrade actually fixes it:
+
+- `vulnerability.advisories[].fixedByRange` / `fixedByLatest` — does the in-range / latest target escape
+  this advisory's affected range?
+- `vulnerability.fixedByRange` / `fixedByLatest` — does the target clear **every** advisory?
+
+The summary includes a `vulnerable` count, and the payload carries a `schemaVersion` so scripts and
+agents can pin to a known shape.
+
+Output hygiene: with `--json`, stdout carries **only** the JSON document; all progress and warnings go
+to stderr. Exit codes: `0` up to date, `1` updates exist (`--check`), `2` error.
+
 ## Keyboard Shortcuts
 
 <!-- KEYS:START -->

package/dist/cli.js

@@ -9,6 +9,7 @@ const commander_1 = require("commander");
 const chalk_1 = __importDefault(require("chalk"));
 const path_1 = require("path");
 const index_1 = require("./index");
+const headless_1 = require("./features/headless");
 const services_1 = require("./services");
 const config_1 = require("./config");
 const utils_1 = require("./utils");
@@ -16,16 +17,24 @@ const git_1 = require("./utils/git");
 const ui_1 = require("./ui");
 const program = new commander_1.Command();
 async function runCli(options) {
+    // Resolve colored-output intent before anything renders.
+    (0, utils_1.applyColorSetting)(options.color);
     const cwd = (0, path_1.resolve)(options.dir);
     if (options.debug || process.env.INUP_DEBUG === '1') {
         (0, utils_1.enableDebugLogging)();
     }
-    const gitState = (0, git_1.getGitWorkingTreeState)(cwd);
-    if (gitState.isRepo && gitState.isDirty) {
-        const shouldProceed = await ui_1.TerminalInput.promptForImmediateConfirmation(`${chalk_1.default.yellow('Warning:')} dirty working tree. Proceed anyway? ${chalk_1.default.dim('[y/N]')} `, false);
-        if (!shouldProceed) {
-            console.log(chalk_1.default.yellow('Upgrade cancelled.'));
-            return;
+    // Headless when piped, in CI, or when a non-interactive flag is set. The TUI only renders in
+    // interactive mode; everything else routes through the read-only headless report path.
+    const interactive = !!process.stdout.isTTY && !process.env.CI && !options.json && !options.check;
+    // The dirty-tree prompt would hang without a TTY; headless is read-only anyway, so skip it.
+    if (interactive) {
+        const gitState = (0, git_1.getGitWorkingTreeState)(cwd);
+        if (gitState.isRepo && gitState.isDirty) {
+            const shouldProceed = await ui_1.TerminalInput.promptForImmediateConfirmation(`${chalk_1.default.yellow('Warning:')} dirty working tree. Proceed anyway? ${chalk_1.default.dim('[y/N]')} `, false);
+            if (!shouldProceed) {
+                console.log(chalk_1.default.yellow('Upgrade cancelled.'));
+                return;
+            }
         }
     }
     // Load project config from .inuprc
@@ -52,8 +61,11 @@ async function runCli(options) {
         console.error(chalk_1.default.yellow('Expected a non-negative integer, for example: --max-depth 10'));
         process.exit(1);
     }
-    // Check for updates in the background (non-blocking)
-    const updateCheckPromise = (0, services_1.checkForUpdateAsync)(config_1.PACKAGE_NAME, config_1.PACKAGE_VERSION);
+    // Check for updates in the background (non-blocking). Interactive only — keeps headless stdout
+    // clean and avoids a lingering fetch handle in CI.
+    const updateCheckPromise = interactive
+        ? (0, services_1.checkForUpdateAsync)(config_1.PACKAGE_NAME, config_1.PACKAGE_VERSION)
+        : undefined;
     // Validate package manager if provided
     let packageManager;
     if (options.packageManager) {
@@ -65,17 +77,25 @@ async function runCli(options) {
         }
         packageManager = options.packageManager;
     }
-    const upgrader = new index_1.UpgradeRunner({
+    const runnerOptions = {
         cwd,
         excludePatterns,
+        scanDirs: projectConfig.scanDirs,
         maxDepth,
         ignorePackages,
         packageManager,
         showPeerDependencyVulnerabilities: projectConfig.showPeerDependencyVulnerabilities ?? false,
         showOptionalDependencyVulnerabilities: projectConfig.showOptionalDependencyVulnerabilities ?? false,
         debug: options.debug || process.env.INUP_DEBUG === '1',
-    });
-    await upgrader.run();
+        saveExact: options.saveExact ?? false,
+    };
+    // Non-interactive (piped / CI / --json / --check) routes to the read-only headless feature;
+    // only the interactive path builds the full TUI runner.
+    if (!interactive) {
+        await new headless_1.HeadlessRunner(runnerOptions).run({ json: options.json, check: options.check });
+        return;
+    }
+    await new index_1.UpgradeRunner(runnerOptions).run();
     // After the main flow completes, check if there's an update available
     const updateCheck = await updateCheckPromise;
     if (updateCheck?.isOutdated) {
@@ -109,6 +129,10 @@ program
     .option('--max-depth <number>', 'maximum directory depth for package.json discovery', '10')
     .option('--package-manager <name>', 'manually specify package manager (npm, yarn, pnpm, bun)')
     .option('--debug', 'write verbose debug log to /tmp/inup-debug-YYYY-MM-DD.log')
+    .option('--no-color', 'disable colored output (also respects NO_COLOR / FORCE_COLOR)')
+    .option('--save-exact', 'write exact versions instead of preserving the range prefix (^/~)')
+    .option('--json', 'print a machine-readable JSON report and exit (non-interactive, read-only)')
+    .option('-c, --check', 'exit non-zero if updates exist, without writing (for CI; read-only)')
     .action(runCli);
 // Handle uncaught errors gracefully
 process.on('uncaughtException', (error) => {

package/dist/config/constants.js

@@ -1,15 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.JSDELIVR_POOL_TIMEOUT = exports.JSDELIVR_RETRY_DELAYS = exports.JSDELIVR_RETRY_TIMEOUTS = exports.REQUEST_TIMEOUT = exports.CACHE_TTL = exports.MAX_CONCURRENT_REQUESTS = exports.JSDELIVR_CDN_URL = exports.NPM_REGISTRY_URL = exports.PACKAGE_VERSION = exports.PACKAGE_NAME = void 0;
+exports.REQUEST_TIMEOUT = exports.CACHE_TTL = exports.MAX_CONCURRENT_REQUESTS = exports.NPM_REGISTRY_URL = exports.PACKAGE_VERSION = exports.PACKAGE_NAME = void 0;
 var package_meta_1 = require("./package-meta");
 Object.defineProperty(exports, "PACKAGE_NAME", { enumerable: true, get: function () { return package_meta_1.PACKAGE_NAME; } });
 Object.defineProperty(exports, "PACKAGE_VERSION", { enumerable: true, get: function () { return package_meta_1.PACKAGE_VERSION; } });
 exports.NPM_REGISTRY_URL = 'https://registry.npmjs.org';
-exports.JSDELIVR_CDN_URL = 'https://cdn.jsdelivr.net/npm';
 exports.MAX_CONCURRENT_REQUESTS = 150;
 exports.CACHE_TTL = 5 * 60 * 1000; // 5 minutes in milliseconds
 exports.REQUEST_TIMEOUT = 60000; // 60 seconds in milliseconds
-exports.JSDELIVR_RETRY_TIMEOUTS = [2000, 3500]; // short retry budget to keep fallback fast
-exports.JSDELIVR_RETRY_DELAYS = [150]; // tiny backoff between jsDelivr retries in ms
-exports.JSDELIVR_POOL_TIMEOUT = 60000; // keep-alive/connect lifecycle should be looser than per-request timeouts
 //# sourceMappingURL=constants.js.map

package/dist/config/project-config.js

@@ -54,6 +54,11 @@ function normalizeConfig(config) {
             normalized.exclude = config.exclude.filter((item) => typeof item === 'string');
         }
     }
+    if (config.scanDirs) {
+        if (Array.isArray(config.scanDirs)) {
+            normalized.scanDirs = config.scanDirs.filter((item) => typeof item === 'string');
+        }
+    }
     if (typeof config.showPeerDependencyVulnerabilities === 'boolean') {
         normalized.showPeerDependencyVulnerabilities = config.showPeerDependencyVulnerabilities;
     }

package/dist/core/package-detector.js

@@ -32,8 +32,12 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PackageDetector = void 0;
+const chalk_1 = __importDefault(require("chalk"));
 const semver = __importStar(require("semver"));
 const utils_1 = require("../utils");
 const services_1 = require("../services");
@@ -46,6 +50,7 @@ class PackageDetector {
     packageJson = null;
     cwd;
     excludePatterns;
+    scanDirs;
     ignorePackages;
     maxDepth;
     batchSize = 10;
@@ -53,6 +58,7 @@ class PackageDetector {
     constructor(options) {
         this.cwd = options?.cwd || process.cwd();
         this.excludePatterns = options?.excludePatterns || [];
+        this.scanDirs = options?.scanDirs || [];
         this.ignorePackages = options?.ignorePackages || [];
         this.maxDepth = options?.maxDepth ?? 10;
         this.packageJsonPath = (0, utils_1.findPackageJson)(this.cwd);
@@ -282,6 +288,8 @@ class PackageDetector {
                     hasRangeUpdate,
                     hasMajorUpdate,
                     allVersions,
+                    deprecated: packageData.deprecated,
+                    enginesNode: packageData.enginesNode,
                 };
             }
             catch (error) {
@@ -313,13 +321,17 @@ class PackageDetector {
         };
     }
     async findPackageJsonFilesWithTimeout(timeoutMs) {
+        const skippedPackageDirs = new Set();
         try {
             let timeoutId;
             try {
-                return await Promise.race([
+                const files = await Promise.race([
                     (0, utils_1.findAllPackageJsonFilesAsync)(this.cwd, this.excludePatterns, this.maxDepth, (currentDir, foundCount) => {
                         const truncatedDir = currentDir.length > 50 ? '...' + currentDir.slice(-47) : currentDir;
                         this.showProgress(`🔍 Scanning ${truncatedDir} (found ${foundCount})`);
+                    }, {
+                        scanDirs: this.scanDirs,
+                        onSkippedPackageDir: (relativePath) => skippedPackageDirs.add(relativePath),
                     }),
                     new Promise((_, reject) => {
                         timeoutId = setTimeout(() => {
@@ -328,6 +340,8 @@ class PackageDetector {
                         timeoutId.unref?.();
                     }),
                 ]);
+                this.warnSkippedPackageDirs(skippedPackageDirs);
+                return files;
             }
             finally {
                 if (timeoutId) {
@@ -339,6 +353,20 @@ class PackageDetector {
             throw new Error(`Failed to scan for package.json files: ${err}. Try using --exclude patterns to skip problematic directories.`);
         }
     }
+    /**
+     * Warn (once per directory, after the scan) about package.json-bearing directories that the
+     * default skip list pruned, so the user can re-include them via `.inuprc`'s `scanDirs`.
+     * Emitted after scanning so it does not corrupt the progress spinner output.
+     */
+    warnSkippedPackageDirs(skippedPackageDirs) {
+        if (skippedPackageDirs.size === 0) {
+            return;
+        }
+        const list = Array.from(skippedPackageDirs).sort();
+        console.warn(chalk_1.default.yellow(`⚠️  Skipped ${list.length} package.json-bearing director${list.length === 1 ? 'y' : 'ies'} matching the default ignore list:\n` +
+            list.map((dir) => `   - ${dir}`).join('\n') +
+            `\n   Add the directory name(s) to "scanDirs" in .inuprc to include them.`));
+    }
     isWorkspaceReference(version) {
         return (version.includes('workspace:') ||
             version === '*' ||

package/dist/core/upgrade-runner.js

@@ -32,6 +32,7 @@ class UpgradeRunner {
         this.ui = new interactive_ui_1.InteractiveUI(this.packageManager, {
             showPeerDependencyVulnerabilities: options?.showPeerDependencyVulnerabilities ?? false,
             showOptionalDependencyVulnerabilities: options?.showOptionalDependencyVulnerabilities ?? false,
+            saveExact: options?.saveExact ?? false,
         });
         this.upgrader = new upgrader_1.PackageUpgrader(this.packageManager);
     }

package/dist/core/upgrader.js

@@ -92,7 +92,8 @@ class PackageUpgrader {
         const packageDir = packageJsonPath.replace('/package.json', '');
         const spinner = (0, nanospinner_1.createSpinner)(`Upgrading ${type} in ${packageDir}...`).start();
         try {
-            // Read the current package.json
+            // Read the current package.json — keep the raw text so we can round-trip its formatting
+            const rawContent = (0, fs_1.readFileSync)(packageJsonPath, 'utf-8');
             const packageJson = (0, utils_1.readPackageJson)(packageJsonPath);
             // Group by upgrade type (range vs latest)
             const rangeChoices = choices.filter((c) => c.upgradeType === 'range');
@@ -118,9 +119,14 @@ class PackageUpgrader {
                     modified = true;
                 });
             }
-            // Write back the modified package.json
+            // Write back the modified package.json, preserving the original indentation and
+            // trailing-newline style. Skip the write entirely when nothing actually changed.
             if (modified) {
-                (0, fs_1.writeFileSync)(packageJsonPath, JSON.stringify(packageJson, null, 2) + '\n');
+                const format = (0, utils_1.detectJsonFormat)(rawContent);
+                const nextContent = JSON.stringify(packageJson, null, format.indent) + (format.trailingNewline ? '\n' : '');
+                if (nextContent !== rawContent) {
+                    (0, fs_1.writeFileSync)(packageJsonPath, nextContent);
+                }
             }
             spinner.success({ text: `Upgraded ${choices.length} ${type} in ${packageDir}` });
             // Show which packages were upgraded

package/dist/features/changelog/services/package-metadata-service.js

@@ -3,16 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PackageMetadataService = void 0;
 const npm_registry_client_1 = require("../clients/npm-registry-client");
 const package_metadata_1 = require("../parsers/package-metadata");
-const jsdelivr_registry_1 = require("../../../services/jsdelivr-registry");
 const inflight_1 = require("../../../services/http/inflight");
 class PackageMetadataService {
     npmRegistryClient;
-    exactManifestFetcher;
     cache = new Map();
     inFlight = new inflight_1.InflightMap();
-    constructor(npmRegistryClient = new npm_registry_client_1.NpmRegistryClient(), exactManifestFetcher = jsdelivr_registry_1.fetchExactPackageManifest) {
+    constructor(npmRegistryClient = new npm_registry_client_1.NpmRegistryClient()) {
         this.npmRegistryClient = npmRegistryClient;
-        this.exactManifestFetcher = exactManifestFetcher;
     }
     clearCache() {
         this.cache.clear();
@@ -85,15 +82,7 @@ class PackageMetadataService {
     }
     async fetchPackageManifest(packageName, version, signal) {
         signal?.throwIfAborted();
-        const normalizedVersion = version?.trim();
-        if (normalizedVersion) {
-            const jsdelivrManifest = await this.exactManifestFetcher(packageName, normalizedVersion);
-            if (jsdelivrManifest) {
-                return jsdelivrManifest;
-            }
-        }
-        signal?.throwIfAborted();
-        return await this.npmRegistryClient.fetchPackageManifest(packageName, normalizedVersion || 'latest', signal);
+        return await this.npmRegistryClient.fetchPackageManifest(packageName, version?.trim() || 'latest', signal);
     }
     buildMetadata(packageName, rawData) {
         return (0, package_metadata_1.mapPackageManifestToMetadata)(packageName, rawData);

package/dist/features/changelog/services/release-notes-service.js

@@ -38,7 +38,6 @@ const semver = __importStar(require("semver"));
 const github_client_1 = require("../clients/github-client");
 const changelog_parser_1 = require("../parsers/changelog-parser");
 const github_release_html_parser_1 = require("../parsers/github-release-html-parser");
-const constants_1 = require("../../../config/constants");
 const RELEASE_NOTES_FETCH_TIMEOUT_MS = 5000;
 const PREFER_GITHUB_RELEASE_PAGE = true;
 class ReleaseNotesService {
@@ -89,9 +88,6 @@ class ReleaseNotesService {
                     return notes;
             }
         }
-        const changelogNotes = await this.fetchJsdelivrChangelog(packageName, version, signal);
-        if (changelogNotes)
-            return changelogNotes;
         return null;
     }
     getGitHubSources(repoUrl, version, signal) {
@@ -154,29 +150,6 @@ class ReleaseNotesService {
             return null;
         return (0, changelog_parser_1.extractVersionSection)(fullText, version);
     }
-    async fetchJsdelivrChangelog(packageName, version, signal) {
-        const fullText = await this.fetchPublishedPackageChangelog(packageName, version, signal);
-        if (!fullText)
-            return null;
-        return (0, changelog_parser_1.extractVersionSection)(fullText, version);
-    }
-    async fetchPublishedPackageChangelog(packageName, version, signal) {
-        try {
-            const response = await fetch(`${constants_1.JSDELIVR_CDN_URL}/${encodeURIComponent(packageName)}@${version}/CHANGELOG.md`, {
-                method: 'GET',
-                signal,
-            });
-            if (!response.ok)
-                return null;
-            return await response.text();
-        }
-        catch (error) {
-            if (error instanceof DOMException && error.name === 'AbortError') {
-                throw error;
-            }
-            return null;
-        }
-    }
 }
 exports.ReleaseNotesService = ReleaseNotesService;
 //# sourceMappingURL=release-notes-service.js.map

package/dist/features/headless/headless-runner.js

@@ -0,0 +1,53 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HeadlessRunner = void 0;
+const chalk_1 = __importDefault(require("chalk"));
+const package_detector_1 = require("../../core/package-detector");
+const vulnerability_audit_1 = require("./vulnerability-audit");
+const report_1 = require("./report");
+/**
+ * Non-interactive entry point. Resolves the outdated list without rendering the TUI, then either
+ * emits a JSON report (--json) or a plain line-based report. With --check, sets a non-zero exit
+ * code when updates exist so CI can gate on it. Read-only: never writes package.json or installs.
+ *
+ * This is the headless counterpart to the interactive `UpgradeRunner`; it shares only the
+ * `PackageDetector` (the scan/resolve layer), not the UI/upgrade machinery.
+ */
+class HeadlessRunner {
+    detector;
+    constructor(options) {
+        this.detector = new package_detector_1.PackageDetector(options);
+    }
+    async run(options) {
+        try {
+            if (!this.detector.hasPackageJson()) {
+                throw new Error('No package.json found in current directory');
+            }
+            const packages = await this.detector.getOutdatedPackages();
+            const outdated = this.detector.getOutdatedPackagesOnly(packages);
+            // Audit the current versions (one bulk request, best-effort) and cross-reference each
+            // advisory against the upgrade targets, so the report says whether upgrading *fixes* it.
+            const vulnerabilities = await (0, vulnerability_audit_1.auditVulnerabilities)(outdated);
+            if (options.json) {
+                // stdout is reserved for the JSON document only.
+                console.log(JSON.stringify((0, report_1.buildHeadlessReport)(packages, outdated, vulnerabilities), null, 2));
+            }
+            else {
+                console.log((0, report_1.renderPlainReport)(outdated, vulnerabilities));
+            }
+            // Exit 1 only means "updates exist" (like `prettier --check`); 2 is reserved for errors.
+            if (options.check && outdated.length > 0) {
+                process.exitCode = 1;
+            }
+        }
+        catch (error) {
+            console.error(chalk_1.default.red(`Error: ${error instanceof Error ? error.message : String(error)}`));
+            process.exit(2);
+        }
+    }
+}
+exports.HeadlessRunner = HeadlessRunner;
+//# sourceMappingURL=headless-runner.js.map

package/dist/features/headless/index.js

@@ -0,0 +1,27 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderPlainReport = exports.buildHeadlessReport = exports.upgradeClears = exports.auditVulnerabilities = exports.HeadlessRunner = void 0;
+__exportStar(require("./types"), exports);
+var headless_runner_1 = require("./headless-runner");
+Object.defineProperty(exports, "HeadlessRunner", { enumerable: true, get: function () { return headless_runner_1.HeadlessRunner; } });
+var vulnerability_audit_1 = require("./vulnerability-audit");
+Object.defineProperty(exports, "auditVulnerabilities", { enumerable: true, get: function () { return vulnerability_audit_1.auditVulnerabilities; } });
+Object.defineProperty(exports, "upgradeClears", { enumerable: true, get: function () { return vulnerability_audit_1.upgradeClears; } });
+var report_1 = require("./report");
+Object.defineProperty(exports, "buildHeadlessReport", { enumerable: true, get: function () { return report_1.buildHeadlessReport; } });
+Object.defineProperty(exports, "renderPlainReport", { enumerable: true, get: function () { return report_1.renderPlainReport; } });
+//# sourceMappingURL=index.js.map

package/dist/features/headless/report.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildHeadlessReport = buildHeadlessReport;
+exports.renderPlainReport = renderPlainReport;
+const types_1 = require("./types");
+/** Build the machine-readable `--json` payload from the scanned + outdated package sets. */
+function buildHeadlessReport(all, outdated, vulnerabilities) {
+    return {
+        schemaVersion: types_1.HEADLESS_SCHEMA_VERSION,
+        summary: {
+            total: all.length,
+            outdated: outdated.length,
+            major: outdated.filter((pkg) => pkg.hasMajorUpdate).length,
+            vulnerable: vulnerabilities.size,
+        },
+        outdated: outdated.map((pkg) => {
+            const entry = {
+                name: pkg.name,
+                current: pkg.currentVersion,
+                range: pkg.rangeVersion,
+                latest: pkg.latestVersion,
+                type: pkg.type,
+                packageJsonPath: pkg.packageJsonPath,
+                hasMajorUpdate: pkg.hasMajorUpdate,
+            };
+            if (pkg.deprecated)
+                entry.deprecated = pkg.deprecated;
+            if (pkg.enginesNode)
+                entry.enginesNode = pkg.enginesNode;
+            const vulnerability = vulnerabilities.get(pkg);
+            if (vulnerability)
+                entry.vulnerability = vulnerability;
+            return entry;
+        }),
+    };
+}
+/** Render the plain, line-based report (one line per package + a recap) as a single string. */
+function renderPlainReport(outdated, vulnerabilities) {
+    if (outdated.length === 0) {
+        return 'All dependencies are up to date — no upgrades needed.';
+    }
+    const lines = outdated.map((pkg) => {
+        const major = pkg.hasMajorUpdate ? ' (major)' : '';
+        const deprecated = pkg.deprecated ? '  [deprecated]' : '';
+        return `${pkg.name}  ${pkg.currentVersion} → ${pkg.latestVersion}  [${pkg.type}]${major}${vulnMarker(vulnerabilities.get(pkg))}${deprecated}`;
+    });
+    const fileCount = new Set(outdated.map((pkg) => pkg.packageJsonPath)).size;
+    const vulnNote = vulnerabilities.size > 0 ? ` — ${vulnerabilities.size} with known vulnerabilities` : '';
+    lines.push('', `${outdated.length} package(s) outdated across ${fileCount} file(s)${vulnNote}.`);
+    return lines.join('\n');
+}
+/** A compact `[vuln: N sev → verdict]` tag for the plain report; '' when there are none. */
+function vulnMarker(vulnerability) {
+    if (!vulnerability)
+        return '';
+    // Prefer the cheaper fix: if the in-range bump already clears it, that's the safer action.
+    const verdict = vulnerability.fixedByRange
+        ? 'fixed by range upgrade'
+        : vulnerability.fixedByLatest
+            ? 'fixed by latest only'
+            : 'not fixed by upgrade';
+    return `  [vuln: ${vulnerability.count} ${vulnerability.highestSeverity} → ${verdict}]`;
+}
+//# sourceMappingURL=report.js.map

package/dist/features/headless/types.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HEADLESS_SCHEMA_VERSION = void 0;
+/** Bump when the `--json` shape changes in a way consumers (scripts, agents) must adapt to. */
+exports.HEADLESS_SCHEMA_VERSION = 1;
+//# sourceMappingURL=types.js.map

package/dist/features/headless/vulnerability-audit.js

@@ -0,0 +1,106 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditVulnerabilities = auditVulnerabilities;
+exports.upgradeClears = upgradeClears;
+const semver = __importStar(require("semver"));
+const services_1 = require("../../services");
+const utils_1 = require("../../utils");
+/**
+ * Audit the outdated packages' currently-installed versions (one bulk request, matching the
+ * interactive audit) and, for each advisory, cross-reference its affected range against the
+ * upgrade targets — so callers can state whether upgrading actually *fixes* the issue.
+ *
+ * Best-effort: `fetchVulnerabilities` swallows network errors and returns an empty map, so a
+ * failed audit never blocks the report. Returns only the vulnerable packages, keyed by package.
+ */
+async function auditVulnerabilities(outdated) {
+    const result = new Map();
+    if (outdated.length === 0)
+        return result;
+    // The bulk advisory API is keyed by package name (one version per name), so dedupe by name.
+    const versions = new Map();
+    for (const pkg of outdated) {
+        if (!versions.has(pkg.name))
+            versions.set(pkg.name, pkg.currentVersion);
+    }
+    const advisories = await (0, services_1.fetchVulnerabilities)(versions);
+    if (advisories.size === 0)
+        return result;
+    for (const pkg of outdated) {
+        const found = advisories.get(pkg.name);
+        if (!found || found.vulnerabilities.length === 0 || !found.highestSeverity)
+            continue;
+        result.set(pkg, summarizeVulnerability(pkg, found.vulnerabilities, found.highestSeverity));
+    }
+    return result;
+}
+function summarizeVulnerability(pkg, vulnerabilities, highestSeverity) {
+    const advisories = vulnerabilities.map((vuln) => ({
+        id: vuln.id,
+        title: vuln.title,
+        severity: vuln.severity,
+        url: vuln.url,
+        vulnerableVersions: vuln.vulnerable_versions,
+        fixedByRange: upgradeClears(pkg.rangeVersion, vuln.vulnerable_versions),
+        fixedByLatest: upgradeClears(pkg.latestVersion, vuln.vulnerable_versions),
+    }));
+    return {
+        count: advisories.length,
+        highestSeverity,
+        fixedByRange: advisories.every((advisory) => advisory.fixedByRange),
+        fixedByLatest: advisories.every((advisory) => advisory.fixedByLatest),
+        advisories,
+    };
+}
+/**
+ * True when upgrading to `target` escapes an advisory's affected range. Conservative: if either
+ * the target or the advisory range can't be parsed, we do NOT claim a fix — `semver.satisfies`
+ * treats an invalid range as "matches nothing", which would otherwise read as a false "fixed".
+ */
+function upgradeClears(target, vulnerableVersions) {
+    const comparable = (0, utils_1.toComparableVersion)(target);
+    if (!comparable)
+        return false;
+    if (semver.validRange(vulnerableVersions) === null)
+        return false;
+    try {
+        return !semver.satisfies(comparable, vulnerableVersions, { includePrerelease: true });
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=vulnerability-audit.js.map