inup 1.5.6 → 1.6.0

package/dist/interactive-ui.js

@@ -20,6 +20,7 @@ class InteractiveUI {
     renderer;
     packageManager;
     options;
+    saveExact;
     vulnerabilityAuditController = new controllers_1.VulnerabilityAuditController();
     packageInfoModalController = new controllers_1.PackageInfoModalController();
     refreshView;
@@ -27,6 +28,7 @@ class InteractiveUI {
         this.renderer = new ui_1.UIRenderer();
         this.packageManager = packageManager;
         this.options = normalizeVulnerabilityDisplayOptions(options);
+        this.saveExact = options?.saveExact ?? false;
     }
     async displayPackagesTable(packages) {
         console.log(this.renderer.renderPackagesTable(packages));
@@ -37,7 +39,7 @@ class InteractiveUI {
             return [];
         }
         const selectedStates = await (0, session_1.runInteractiveSession)(selectionStates, this.packageManager, this.renderer, this.packageInfoModalController, this.vulnerabilityAuditController, this.options, (refresh) => { this.refreshView = refresh; });
-        return (0, session_1.createUpgradeChoices)(selectedStates);
+        return (0, session_1.createUpgradeChoices)(selectedStates, this.saveExact);
     }
     createSelectionStates(packages, previousSelections, includeUpToDate = true) {
         return (0, session_1.createSelectionStates)(packages, (name, version, type) => this.vulnerabilityAuditController.getCachedSummary(name, version, type), previousSelections, includeUpToDate);
@@ -63,7 +65,7 @@ class InteractiveUI {
     async selectPackagesToUpgradeProgressive(selectionStates, progress, attachRefresh) {
         this.enqueueSecurityAudit(selectionStates);
         const selectedStates = await (0, session_1.runInteractiveSession)(selectionStates, this.packageManager, this.renderer, this.packageInfoModalController, this.vulnerabilityAuditController, this.options, (refresh) => { this.refreshView = refresh; }, progress, attachRefresh);
-        return (0, session_1.createUpgradeChoices)(selectedStates);
+        return (0, session_1.createUpgradeChoices)(selectedStates, this.saveExact);
     }
     enqueueSecurityAudit(selectionStates) {
         this.vulnerabilityAuditController.enqueueStates(selectionStates, () => this.refreshView?.());

package/dist/services/index.js

@@ -18,7 +18,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./npm-registry"), exports);
-__exportStar(require("./jsdelivr-registry"), exports);
 __exportStar(require("../features/changelog"), exports);
 __exportStar(require("./version-checker"), exports);
 __exportStar(require("./vulnerability-checker"), exports);

package/dist/services/npm-registry.js

@@ -10,7 +10,6 @@ const gunzipAsync = (0, node_util_1.promisify)(node_zlib_1.gunzip);
 const inflateAsync = (0, node_util_1.promisify)(node_zlib_1.inflate);
 const brotliDecompressAsync = (0, node_util_1.promisify)(node_zlib_1.brotliDecompress);
 const config_1 = require("../config");
-const jsdelivr_registry_1 = require("./jsdelivr-registry");
 const version_1 = require("../utils/version");
 const retry_1 = require("./http/retry");
 const inflight_1 = require("./http/inflight");
@@ -32,13 +31,9 @@ const registryPool = new undici_1.Pool(registryOrigin, {
 });
 const MAX_REGISTRY_ATTEMPTS = 3;
 const RETRY_BACKOFF_MS = [500, 1500, 3000];
-const fetchFromJsdelivrFallback = async (packageName, currentVersion) => {
-    const jsdelivrData = await (0, jsdelivr_registry_1.getAllPackageDataFromJsdelivr)([packageName], currentVersion ? new Map([[packageName, currentVersion]]) : undefined);
-    return jsdelivrData.get(packageName) ?? { latestVersion: 'unknown', allVersions: [] };
-};
 async function getFreshPackageData(packageName, currentVersion) {
     const cacheKey = `${packageName}@${currentVersion ?? ''}`;
-    return inFlightLookups.dedupe(cacheKey, () => fetchPackageFromRegistryWithFallback(packageName, currentVersion));
+    return inFlightLookups.dedupe(cacheKey, () => fetchPackageFromRegistry(packageName));
 }
 const encodeRegistryPath = (packageName) => {
     const encodedName = packageName.startsWith('@')
@@ -110,19 +105,15 @@ async function fetchFromRegistryWithRetries(path) {
     }
     return lastOutcome;
 }
-async function fetchPackageFromRegistryWithFallback(packageName, currentVersion) {
+async function fetchPackageFromRegistry(packageName) {
     const path = encodeRegistryPath(packageName);
     const outcome = await fetchFromRegistryWithRetries(path);
     if (outcome.kind === 'success') {
         return outcome.data;
     }
-    if (outcome.kind === 'not-found') {
-        return { latestVersion: 'unknown', allVersions: [] };
-    }
-    // Only reach here after exhausted retries against real errors — try jsdelivr
-    // as last-resort safety net so we don't silently return 'unknown'.
-    const fallback = await fetchFromJsdelivrFallback(packageName, currentVersion).catch(() => null);
-    return fallback ?? { latestVersion: 'unknown', allVersions: [] };
+    // Not found, or exhausted retries against real errors: report unavailable.
+    // The registry is the single source of truth — there is no secondary fetch.
+    return { latestVersion: 'unknown', allVersions: [] };
 }
 /**
  * Fetches version data for a list of packages from the npm registry.
@@ -132,9 +123,10 @@ async function fetchPackageFromRegistryWithFallback(packageName, currentVersion)
  *   It doesn't interact with batch size — batches exist only to group
  *   emissions for the UI.
  * - No per-request timeouts: slow responses are allowed to finish. Real
- *   network errors are retried with exponential backoff; after that, we
- *   fall back to jsdelivr as a last resort. A result is never silently
- *   dropped due to slowness.
+ *   network errors are retried with exponential backoff; after the retry
+ *   budget is exhausted the package is reported as unavailable
+ *   (`latestVersion: 'unknown'`). A result is never silently dropped due to
+ *   slowness.
  *
  * Callbacks:
  * - `onBatchReady` fires once a whole emission batch has resolved, in

package/dist/services/package-manager-detector.js

@@ -56,8 +56,8 @@ class PackageManagerDetector {
         if (fromLockFile) {
             return fromLockFile;
         }
-        // 3. Fallback to npm
-        console.log(chalk_1.default.yellow('⚠️  No package manager detected. Defaulting to npm. Consider adding a "packageManager" field to your package.json.'));
+        // 3. Fallback to npm. Warn on stderr so it never corrupts --json output on stdout.
+        console.error(chalk_1.default.yellow('⚠️  No package manager detected. Defaulting to npm. Consider adding a "packageManager" field to your package.json.'));
         return PACKAGE_MANAGERS.npm;
     }
     /**
@@ -92,6 +92,8 @@ class PackageManagerDetector {
         const lockFileChecks = [
             { pm: PACKAGE_MANAGERS.pnpm, path: (0, path_1.join)(cwd, 'pnpm-lock.yaml') },
             { pm: PACKAGE_MANAGERS.bun, path: (0, path_1.join)(cwd, 'bun.lockb') },
+            // Bun >= 1.2 writes a text `bun.lock` instead of the binary `bun.lockb`.
+            { pm: PACKAGE_MANAGERS.bun, path: (0, path_1.join)(cwd, 'bun.lock') },
             { pm: PACKAGE_MANAGERS.yarn, path: (0, path_1.join)(cwd, 'yarn.lock') },
             { pm: PACKAGE_MANAGERS.npm, path: (0, path_1.join)(cwd, 'package-lock.json') },
         ];
@@ -107,7 +109,8 @@ class PackageManagerDetector {
         }
         // If multiple lock files, use most recently modified
         if (existingLocks.length > 1) {
-            console.log(chalk_1.default.yellow('⚠️  Multiple lock files detected. Using most recently modified. Consider cleaning up unused lock files.'));
+            // stderr so it never corrupts --json output on stdout.
+            console.error(chalk_1.default.yellow('⚠️  Multiple lock files detected. Using most recently modified. Consider cleaning up unused lock files.'));
             existingLocks.sort((a, b) => b.mtime - a.mtime);
         }
         return existingLocks[0].pm;

package/dist/ui/modal/package-info-sections/sections.js

@@ -10,6 +10,7 @@ const chalk_1 = __importDefault(require("chalk"));
 const themes_colors_1 = require("../../themes-colors");
 const vulnerability_1 = require("../../presenters/vulnerability");
 const utils_1 = require("../../utils");
+const utils_2 = require("../../../utils");
 const release_notes_1 = require("./release-notes");
 function formatNumber(num) {
     if (!num)
@@ -88,6 +89,29 @@ function buildPackageInfoSections(state, modalWidth, activeTab) {
         required: true,
         behavior: 'pinned',
     });
+    const warningRows = [];
+    const warningContentWidth = Math.max(10, modalWidth - 4);
+    if (state.deprecated) {
+        // Wrap (don't truncate) so a deprecation URL stays whole and clickable —
+        // truncation with "..." produces a dead link. `wrapPlainText` breaks on
+        // spaces only, so the URL keeps its own intact line. No emoji marker:
+        // `getVisualLength` scores glyphs like ⚠ as width 2 while many terminals
+        // render them as width 1, which throws off the modal's border alignment.
+        for (const line of (0, utils_1.wrapPlainText)(`Deprecated: ${state.deprecated}`, warningContentWidth)) {
+            warningRows.push((0, themes_colors_1.getThemeColor)('warning')(line));
+        }
+    }
+    const engineWarning = (0, utils_2.checkNodeEngineCompatibility)(state.enginesNode);
+    if (engineWarning) {
+        warningRows.push((0, themes_colors_1.getThemeColor)('warning')(`Hold: ${engineWarning}`));
+    }
+    if (warningRows.length > 0) {
+        sections.push({
+            key: 'warnings',
+            rows: warningRows,
+            behavior: 'pinned',
+        });
+    }
     if (state.homepage) {
         sections.push({
             key: 'homepage',

package/dist/ui/presenters/health.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getHealthBadge = getHealthBadge;
+const utils_1 = require("../../utils");
+const themes_colors_1 = require("../themes-colors");
+/**
+ * A compact badge flagging a package's health in the list:
+ *   - `[DEPR]` when the latest version is deprecated (highest priority), or
+ *   - `[ENG]`  when its `engines.node` is incompatible with the running Node.
+ *
+ * Returns an empty string when neither applies. Deprecation wins because an
+ * engines mismatch on an abandoned package is moot. Both render in the theme's
+ * (amber) warning color — a caution signal, not an alarm.
+ */
+function getHealthBadge(state) {
+    if (state.deprecated) {
+        return (0, themes_colors_1.getThemeColor)('warning')('[DEPR]');
+    }
+    if ((0, utils_1.checkNodeEngineCompatibility)(state.enginesNode)) {
+        return (0, themes_colors_1.getThemeColor)('warning')('[ENG]');
+    }
+    return '';
+}
+//# sourceMappingURL=health.js.map

package/dist/ui/renderer/package-list/rows.js

@@ -11,6 +11,7 @@ const chalk_1 = __importDefault(require("chalk"));
 const utils_1 = require("../../utils");
 const themes_colors_1 = require("../../themes-colors");
 const vulnerability_1 = require("../../presenters/vulnerability");
+const health_1 = require("../../presenters/health");
 function padLineToWidth(line, terminalWidth) {
     const padding = Math.max(0, terminalWidth - utils_1.VersionUtils.getVisualLength(line));
     return line + ' '.repeat(padding);
@@ -118,15 +119,19 @@ function renderPackageLine(state, _index, isCurrentRow, terminalWidth = 80, opti
     const shouldShowVulnerability = (0, vulnerability_1.shouldDisplayVulnerabilityForDependency)(state.type, options);
     const vulnBadge = shouldShowVulnerability ? (0, vulnerability_1.getVulnerabilityBadge)(state.vulnerability) : '';
     const vulnBadgeWidth = vulnBadge ? utils_1.VersionUtils.getVisualLength(vulnBadge) + 1 : 0;
+    // Deprecation / engines-incompatibility marker (independent of dep type).
+    const healthBadge = (0, health_1.getHealthBadge)(state);
+    const healthBadgeWidth = healthBadge ? utils_1.VersionUtils.getVisualLength(healthBadge) + 1 : 0;
     const nameLength = utils_1.VersionUtils.getVisualLength(truncatedName);
-    const namePadding = Math.max(0, packageNameWidth - nameLength - 1 - badgeWidth - vulnBadgeWidth);
+    const namePadding = Math.max(0, packageNameWidth - nameLength - 1 - badgeWidth - vulnBadgeWidth - healthBadgeWidth);
     const nameDashes = shouldShowDashes(namePadding)
         ? dashColor('-').repeat(namePadding)
         : ' '.repeat(namePadding);
     const vulnSuffix = vulnBadge ? ` ${vulnBadge}` : '';
+    const healthSuffix = healthBadge ? ` ${healthBadge}` : '';
     const packageNameSection = typeBadge
-        ? `${displayName} ${nameDashes}${vulnSuffix}${typeBadge}`
-        : `${displayName} ${nameDashes}${vulnSuffix}`;
+        ? `${displayName} ${nameDashes}${vulnSuffix}${healthSuffix}${typeBadge}`
+        : `${displayName} ${nameDashes}${vulnSuffix}${healthSuffix}`;
     const currentSection = `${currentDot} ${currentVersion}`;
     const currentSectionLength = utils_1.VersionUtils.getVisualLength(currentSection) + 1;
     const currentPadding = Math.max(0, currentColumnWidth - currentSectionLength);

package/dist/ui/session/selection-state-builder.js

@@ -85,6 +85,8 @@ function createSelectionStates(packages, getCachedSummary, previousSelections, i
             hasRangeUpdate: pkg.hasRangeUpdate,
             hasMajorUpdate: pkg.hasMajorUpdate,
             type: pkg.type,
+            deprecated: pkg.deprecated,
+            enginesNode: pkg.enginesNode,
             vulnerability: getCachedSummary(pkg.name, pkg.currentVersion, pkg.type),
             allVersions: pkg.allVersions,
         };
@@ -120,13 +122,16 @@ function createPendingSelectionStates(packages, getCachedSummary, previousSelect
         };
     });
 }
-function createUpgradeChoices(selectedStates) {
+function createUpgradeChoices(selectedStates, saveExact = false) {
     const choices = [];
     selectedStates
         .filter((state) => state.loadState === 'ready' && state.selectedOption !== 'none')
         .forEach((state) => {
         const targetVersion = state.selectedOption === 'range' ? state.rangeVersion : state.latestVersion;
-        const targetVersionWithPrefix = (0, utils_1.applyVersionPrefix)(state.currentVersionSpecifier, targetVersion);
+        // Preserve the original range prefix (^/~) by default; --save-exact writes the bare version.
+        const targetVersionWithPrefix = saveExact
+            ? targetVersion
+            : (0, utils_1.applyVersionPrefix)(state.currentVersionSpecifier, targetVersion);
         const pathsToUpdate = state.packageJsonPaths || [state.packageJsonPath];
         pathsToUpdate.forEach((packageJsonPath) => {
             choices.push({

package/dist/ui/themes-colors.js

@@ -182,18 +182,27 @@ function hexToRgb(hex) {
         : { r: 0, g: 0, b: 0 };
 }
 /**
- * Get ANSI escape code to set terminal background color
+ * Get ANSI escape code to set terminal background color.
+ *
+ * Returns an empty string when color output is disabled (`--no-color`/`NO_COLOR`
+ * set `chalk.level` to 0), so the TUI inherits the user's own terminal
+ * background instead of painting over it. This escape is raw (not produced by
+ * chalk), so it must be gated explicitly.
  */
 function getTerminalBgColorCode() {
+    if (chalk_1.default.level === 0) {
+        return '';
+    }
     const hex = getThemeBgColor();
     const rgb = hexToRgb(hex);
     return `\x1b[48;2;${rgb.r};${rgb.g};${rgb.b}m`;
 }
 /**
- * Get ANSI escape code to reset terminal colors
+ * Get ANSI escape code to reset terminal colors. Empty when color is disabled,
+ * so a `--no-color` run emits no escape sequences at all.
  */
 function getTerminalResetCode() {
-    return '\x1b[0m';
+    return chalk_1.default.level === 0 ? '' : '\x1b[0m';
 }
 const BRAND_COLORS = [chalk_1.default.red, chalk_1.default.yellow, chalk_1.default.blue, chalk_1.default.magenta];
 function coloredInupLogo() {

package/dist/ui/utils/cursor.js

@@ -67,16 +67,22 @@ exports.ConsoleUtils = {
      */
     LINE_WIDTH: 80,
     /**
-     * Show a progress message on the current line (overwrites previous content)
+     * Show a progress message on the current line (overwrites previous content).
+     * Written to stderr so stdout stays clean for --json / piped output, and only
+     * when stderr is a TTY — the \r animation is just noise in a redirected log.
      */
     showProgress(message) {
-        process.stdout.write(`\r${' '.repeat(exports.ConsoleUtils.LINE_WIDTH)}\r${message}`);
+        if (!process.stderr.isTTY)
+            return;
+        process.stderr.write(`\r${' '.repeat(exports.ConsoleUtils.LINE_WIDTH)}\r${message}`);
     },
     /**
      * Clear the current progress line
      */
     clearProgress() {
-        process.stdout.write('\r' + ' '.repeat(exports.ConsoleUtils.LINE_WIDTH) + '\r');
+        if (!process.stderr.isTTY)
+            return;
+        process.stderr.write('\r' + ' '.repeat(exports.ConsoleUtils.LINE_WIDTH) + '\r');
     },
 };
 //# sourceMappingURL=cursor.js.map

package/dist/utils/color.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shouldDisableColor = shouldDisableColor;
+exports.applyColorSetting = applyColorSetting;
+const chalk_1 = __importDefault(require("chalk"));
+/**
+ * Decide whether colored output should be disabled.
+ *
+ * Precedence (highest first):
+ *   1. An explicit `--no-color` flag (`colorFlag === false`) always wins.
+ *   2. `FORCE_COLOR` keeps colors on.
+ *   3. `NO_COLOR` (any non-empty value) disables them — the de-facto standard.
+ *
+ * chalk v5 already honors the env vars on its own, but the explicit flag does
+ * not flow through automatically, so we resolve the final intent here.
+ */
+function shouldDisableColor(colorFlag, env = process.env) {
+    if (colorFlag === false) {
+        return true;
+    }
+    if (env.FORCE_COLOR) {
+        return false;
+    }
+    return Boolean(env.NO_COLOR);
+}
+/**
+ * Apply the resolved color intent to chalk's global level. Call once at startup
+ * before anything renders.
+ */
+function applyColorSetting(colorFlag, env = process.env) {
+    if (shouldDisableColor(colorFlag, env)) {
+        chalk_1.default.level = 0;
+    }
+}
+//# sourceMappingURL=color.js.map

package/dist/utils/engines.js

@@ -0,0 +1,63 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkNodeEngineCompatibility = checkNodeEngineCompatibility;
+const semver = __importStar(require("semver"));
+/**
+ * Check whether the running Node version satisfies a package's declared
+ * `engines.node` range. Returns a short human-readable warning when it does
+ * not, or `null` when compatible (or when the inputs are unusable).
+ *
+ * Best-effort: an unparseable range is treated as "no opinion" (null) rather
+ * than a false warning.
+ */
+function checkNodeEngineCompatibility(requiredRange, currentNodeVersion = process.versions.node) {
+    if (!requiredRange) {
+        return null;
+    }
+    const range = semver.validRange(requiredRange, { loose: true });
+    if (!range) {
+        return null;
+    }
+    const current = semver.coerce(currentNodeVersion);
+    if (!current) {
+        return null;
+    }
+    if (semver.satisfies(current, range, { includePrerelease: true })) {
+        return null;
+    }
+    return `requires Node ${requiredRange}, you're on ${current.version}`;
+}
+//# sourceMappingURL=engines.js.map

package/dist/utils/filesystem/io.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readPackageJson = readPackageJson;
+exports.detectJsonFormat = detectJsonFormat;
 exports.readPackageJsonAsync = readPackageJsonAsync;
 exports.collectAllDependencies = collectAllDependencies;
 exports.collectAllDependenciesAsync = collectAllDependenciesAsync;
@@ -15,6 +16,21 @@ function readPackageJson(path) {
         throw new Error(`Failed to read package.json: ${error}`);
     }
 }
+/**
+ * Detect the indentation and trailing-newline style of a raw JSON document so a
+ * re-serialized version can preserve the original formatting instead of normalizing it.
+ *
+ * The first indented line's leading whitespace is exactly one indent unit; using it verbatim
+ * as the JSON.stringify indent round-trips tabs, 2-space, and 4-space without branching on type.
+ * Minified/single-line files (no indented line) fall back to 2 spaces, matching prior behavior.
+ */
+function detectJsonFormat(raw) {
+    const match = raw.match(/\n([ \t]+)\S/);
+    return {
+        indent: match ? match[1] : 2,
+        trailingNewline: raw.endsWith('\n'),
+    };
+}
 async function readPackageJsonAsync(path) {
     try {
         const content = await fs_2.promises.readFile(path, 'utf-8');

package/dist/utils/filesystem/scan.js

@@ -16,15 +16,85 @@ const SKIP_DIRS = new Set([
     'esm',
     'cjs',
 ]);
-function shouldSkipDirectory(name) {
-    return name.startsWith('.') || SKIP_DIRS.has(name);
+/**
+ * Skip dirs that are ambiguous source-vs-build directories where a real package may legitimately
+ * live. Only these trigger the "silently skipped a package" warning — node_modules and build-output
+ * dirs (dist/build/coverage/out) routinely contain package.json files and would be pure noise.
+ */
+const WARN_SKIP_DIRS = new Set(['lib', 'es', 'esm', 'cjs']);
+/** Effective skip set: the defaults minus any directory the caller opted back into via `scanDirs`. */
+function buildSkipSet(scanDirs) {
+    if (!scanDirs || scanDirs.length === 0) {
+        return SKIP_DIRS;
+    }
+    const skip = new Set(SKIP_DIRS);
+    for (const dir of scanDirs) {
+        skip.delete(dir);
+    }
+    return skip;
+}
+function classifyDirectory(name, skipSet) {
+    if (name.startsWith('.'))
+        return 'hidden';
+    if (skipSet.has(name))
+        return 'skip-dir';
+    return null;
 }
-function findAllPackageJsonFiles(rootDir = process.cwd(), excludePatterns = [], maxDepth = 10, onProgress) {
+/**
+ * Cheaply decide whether a pruned directory looks like it holds a real package — a package.json
+ * directly inside it, or inside any immediate child (the common `lib/<pkg>/package.json` monorepo
+ * layout). Stays shallow (depth 1) so detecting a skip doesn't re-walk the subtree we just pruned.
+ */
+function prunedDirHoldsPackage(dir) {
+    if ((0, fs_1.existsSync)((0, path_1.join)(dir, 'package.json'))) {
+        return true;
+    }
+    let entries;
+    try {
+        entries = (0, fs_1.readdirSync)(dir);
+    }
+    catch {
+        return false;
+    }
+    for (const entry of entries) {
+        if (entry.startsWith('.'))
+            continue;
+        const child = (0, path_1.join)(dir, entry);
+        try {
+            if ((0, fs_1.statSync)(child).isDirectory() && (0, fs_1.existsSync)((0, path_1.join)(child, 'package.json'))) {
+                return true;
+            }
+        }
+        catch {
+            // Skip children we can't stat
+        }
+    }
+    return false;
+}
+/**
+ * Decide whether to descend into a directory, and notify when one is pruned by the default skip
+ * list despite containing a package.json (so the caller can surface a "silently skipped" warning).
+ */
+function shouldTraverse(name, fullPath, relativePath, skipSet, onSkippedPackageDir) {
+    const reason = classifyDirectory(name, skipSet);
+    if (reason === null) {
+        return true;
+    }
+    if (reason === 'skip-dir' &&
+        WARN_SKIP_DIRS.has(name) &&
+        onSkippedPackageDir &&
+        prunedDirHoldsPackage(fullPath)) {
+        onSkippedPackageDir(relativePath);
+    }
+    return false;
+}
+function findAllPackageJsonFiles(rootDir = process.cwd(), excludePatterns = [], maxDepth = 10, onProgress, options = {}) {
     const packageJsonFiles = [];
     const visitedPaths = new Set();
     let directoriesScanned = 0;
     let lastProgressAt = 0;
     const progressIntervalMs = 250;
+    const skipSet = buildSkipSet(options.scanDirs);
     const excludeRegexes = excludePatterns.map((pattern) => new RegExp(pattern, 'i'));
     function shouldExcludePath(relativePath) {
         return excludeRegexes.some((regex) => regex.test(relativePath));
@@ -72,8 +142,10 @@ function findAllPackageJsonFiles(rootDir = process.cwd(), excludePatterns = [],
                     // Skip files/dirs we can't stat (broken symlinks, permission issues)
                     continue;
                 }
-                if (stat.isDirectory() && !shouldSkipDirectory(file)) {
-                    traverseDirectory(fullPath, depth + 1);
+                if (stat.isDirectory()) {
+                    if (shouldTraverse(file, fullPath, relativePath, skipSet, options.onSkippedPackageDir)) {
+                        traverseDirectory(fullPath, depth + 1);
+                    }
                 }
                 else if (file === 'package.json' && stat.isFile()) {
                     packageJsonFiles.push(fullPath);
@@ -94,6 +166,7 @@ async function findAllPackageJsonFilesAsync(rootDir = process.cwd(), excludePatt
     let lastProgressAt = 0;
     const progressIntervalMs = 250;
     const concurrency = Math.max(1, Math.min(options.concurrency ?? 16, 64));
+    const skipSet = buildSkipSet(options.scanDirs);
     const excludeRegexes = excludePatterns.map((pattern) => new RegExp(pattern, 'i'));
     function shouldExcludePath(relativePath) {
         return excludeRegexes.some((regex) => regex.test(relativePath));
@@ -167,8 +240,10 @@ async function findAllPackageJsonFilesAsync(rootDir = process.cwd(), excludePatt
             catch {
                 continue;
             }
-            if (stat.isDirectory() && !shouldSkipDirectory(file)) {
-                schedule(fullPath, depth + 1);
+            if (stat.isDirectory()) {
+                if (shouldTraverse(file, fullPath, relativePath, skipSet, options.onSkippedPackageDir)) {
+                    schedule(fullPath, depth + 1);
+                }
             }
             else if (file === 'package.json' && stat.isFile()) {
                 packageJsonFiles.push(fullPath);

package/dist/utils/index.js

@@ -23,6 +23,9 @@ __exportStar(require("./exec"), exports);
 __exportStar(require("./git"), exports);
 __exportStar(require("./version"), exports);
 __exportStar(require("./debug-logger"), exports);
+__exportStar(require("./color"), exports);
+__exportStar(require("./engines"), exports);
+__exportStar(require("./manifest"), exports);
 // Re-export async functions for convenience
 var filesystem_1 = require("./filesystem");
 Object.defineProperty(exports, "readPackageJsonAsync", { enumerable: true, get: function () { return filesystem_1.readPackageJsonAsync; } });

package/dist/utils/manifest.js

@@ -0,0 +1,35 @@
+"use strict";
+/**
+ * Helpers for reading optional health signals out of an npm version manifest
+ * (the per-version object inside an abbreviated packument, or a full version
+ * document). Both fields are advisory and frequently absent.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeDeprecatedMessage = normalizeDeprecatedMessage;
+exports.extractEnginesNode = extractEnginesNode;
+/**
+ * npm represents deprecation as either a string message or the boolean `true`.
+ * Normalize both into a displayable message, or `undefined` when not deprecated.
+ */
+function normalizeDeprecatedMessage(value) {
+    if (typeof value === 'string' && value.trim()) {
+        return value;
+    }
+    if (value === true) {
+        return 'This version is deprecated.';
+    }
+    return undefined;
+}
+/**
+ * Extract the `engines.node` range from a manifest's `engines` object, if any.
+ */
+function extractEnginesNode(engines) {
+    if (typeof engines === 'object' && engines !== null) {
+        const node = engines.node;
+        if (typeof node === 'string' && node.trim()) {
+            return node;
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=manifest.js.map

package/dist/utils/version.js

@@ -41,6 +41,7 @@ exports.isVersionOutdated = isVersionOutdated;
 exports.getOptimizedRangeVersion = getOptimizedRangeVersion;
 exports.findClosestMinorVersion = findClosestMinorVersion;
 const semver = __importStar(require("semver"));
+const manifest_1 = require("./manifest");
 function extractMajorVersion(version) {
     if (!version)
         return null;
@@ -62,10 +63,16 @@ function versionIdentity(version) {
 }
 function parseVersions(raw) {
     const data = JSON.parse(raw);
-    const allVersions = Object.keys(data.versions || {}).filter((v) => /^[0-9]+\.[0-9]+\.[0-9]+$/.test(v));
+    const versions = data.versions || {};
+    const allVersions = Object.keys(versions).filter((v) => /^[0-9]+\.[0-9]+\.[0-9]+$/.test(v));
     const sortedVersions = allVersions.sort(semver.rcompare);
     const latestVersion = sortedVersions.length > 0 ? sortedVersions[0] : 'unknown';
-    return { latestVersion, allVersions };
+    // Surface health signals for the latest version straight from the abbreviated
+    // packument we already fetched — no extra request. Both fields are optional.
+    const latestManifest = versions[latestVersion];
+    const deprecated = (0, manifest_1.normalizeDeprecatedMessage)(latestManifest?.deprecated);
+    const enginesNode = (0, manifest_1.extractEnginesNode)(latestManifest?.engines);
+    return { latestVersion, allVersions, deprecated, enginesNode };
 }
 /**
  * Checks if a version is outdated compared to the latest version.