inup 1.5.6 → 1.6.2

package/dist/services/http/resizable-semaphore.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResizableSemaphore = void 0;
+/**
+ * A counting semaphore whose limit can change at runtime.
+ *
+ * - `acquire()` resolves immediately if there is headroom, otherwise queues a
+ *   waiter (FIFO) until a `release()` opens a slot.
+ * - `setLimit()` may grow or shrink the limit at any time. Growing wakes as many
+ *   queued waiters as the new headroom allows. Shrinking never aborts in-flight
+ *   holders — it simply stops admitting new ones until natural releases drain
+ *   `inFlight` back below the new limit.
+ * - `release()` is guarded: it only wakes a waiter when `inFlight < limit`. This
+ *   is what makes a shrink actually take effect (an unconditional wake would
+ *   re-admit immediately and ignore the smaller limit).
+ *
+ * Invariant: `inFlight` never exceeds `limit` at the moment of admission. A prior
+ * shrink can leave `inFlight > limit` transiently; no new holder is admitted
+ * until it drains.
+ */
+class ResizableSemaphore {
+    limit;
+    inFlight = 0;
+    waiters = [];
+    constructor(initialLimit) {
+        this.limit = Math.max(1, Math.floor(initialLimit));
+    }
+    getLimit() {
+        return this.limit;
+    }
+    getInFlight() {
+        return this.inFlight;
+    }
+    getWaiterCount() {
+        return this.waiters.length;
+    }
+    setLimit(next) {
+        this.limit = Math.max(1, Math.floor(next));
+        // Growing may have opened headroom for queued waiters.
+        this.drainWaiters();
+    }
+    async acquire() {
+        // `inFlight` is the single authoritative counter and is incremented exactly
+        // once per admission, synchronously at the moment admission is decided —
+        // either here (fast path) or in `drainWaiters` (when a slot frees up). A
+        // woken waiter must NOT increment again, or a concurrent fast-path acquire
+        // reading a stale count could over-admit past the limit.
+        if (this.inFlight < this.limit) {
+            this.inFlight++;
+            return;
+        }
+        await new Promise((resolve) => this.waiters.push(resolve));
+    }
+    release() {
+        this.inFlight--;
+        this.drainWaiters();
+    }
+    /**
+     * Wakes queued waiters while there is headroom, incrementing `inFlight` for
+     * each as it is admitted so the count stays authoritative and synchronous.
+     */
+    drainWaiters() {
+        while (this.inFlight < this.limit && this.waiters.length > 0) {
+            const next = this.waiters.shift();
+            this.inFlight++;
+            next();
+        }
+    }
+}
+exports.ResizableSemaphore = ResizableSemaphore;
+//# sourceMappingURL=resizable-semaphore.js.map

package/dist/services/http/retry.js

@@ -1,10 +1,32 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTransientNetworkError = exports.isRetryableStatus = exports.sleep = void 0;
+exports.isTransientNetworkError = exports.parseRetryAfterMs = exports.isCongestionStatus = exports.isRetryableStatus = exports.sleep = void 0;
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 exports.sleep = sleep;
 const isRetryableStatus = (statusCode) => statusCode === 408 || statusCode === 429 || statusCode >= 500;
 exports.isRetryableStatus = isRetryableStatus;
+// Registry explicitly signaling congestion: the highest-quality back-off signal.
+const isCongestionStatus = (statusCode) => statusCode === 429 || statusCode === 503;
+exports.isCongestionStatus = isCongestionStatus;
+// Parse a Retry-After header (delta-seconds or HTTP-date) into milliseconds.
+// Returns null when absent or unparseable.
+const parseRetryAfterMs = (header, now = Date.now()) => {
+    if (header === undefined)
+        return null;
+    const value = (Array.isArray(header) ? header[0] : header)?.toString().trim();
+    if (!value)
+        return null;
+    const asSeconds = Number(value);
+    if (Number.isFinite(asSeconds)) {
+        return asSeconds >= 0 ? Math.round(asSeconds * 1000) : null;
+    }
+    const asDate = Date.parse(value);
+    if (Number.isFinite(asDate)) {
+        return Math.max(0, asDate - now);
+    }
+    return null;
+};
+exports.parseRetryAfterMs = parseRetryAfterMs;
 const isTransientNetworkError = (error) => {
     if (!(error instanceof Error)) {
         return false;

package/dist/services/index.js

@@ -18,7 +18,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./npm-registry"), exports);
-__exportStar(require("./jsdelivr-registry"), exports);
 __exportStar(require("../features/changelog"), exports);
 __exportStar(require("./version-checker"), exports);
 __exportStar(require("./vulnerability-checker"), exports);

package/dist/services/npm-registry.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fetchPackageVersions = fetchPackageVersions;
 exports.clearPackageCache = clearPackageCache;
-exports.closeRegistryPool = closeRegistryPool;
 const undici_1 = require("undici");
 const node_zlib_1 = require("node:zlib");
 const node_util_1 = require("node:util");
@@ -10,35 +9,44 @@ const gunzipAsync = (0, node_util_1.promisify)(node_zlib_1.gunzip);
 const inflateAsync = (0, node_util_1.promisify)(node_zlib_1.inflate);
 const brotliDecompressAsync = (0, node_util_1.promisify)(node_zlib_1.brotliDecompress);
 const config_1 = require("../config");
-const jsdelivr_registry_1 = require("./jsdelivr-registry");
 const version_1 = require("../utils/version");
 const retry_1 = require("./http/retry");
 const inflight_1 = require("./http/inflight");
+const resizable_semaphore_1 = require("./http/resizable-semaphore");
+const adaptive_controller_1 = require("./http/adaptive-controller");
+const etag_store_1 = require("./http/etag-store");
 const inFlightLookups = new inflight_1.InflightMap();
 const registryOrigin = new URL(config_1.NPM_REGISTRY_URL).origin;
 const registryPathPrefix = new URL(config_1.NPM_REGISTRY_URL).pathname.replace(/\/$/, '');
-// Few connections + many requests per connection = maximum keep-alive reuse.
-// No per-request timeouts: correctness matters more than speed for a CLI that
-// runs on demand. Slow responses are tolerated; only true errors cause retry.
+// Connection count is kept == the adaptive controller's ceiling (POOL_CONNECTIONS)
+// so the controller is never silently throttled below its chosen limit. Idle
+// keep-alive connections are cheap.
+//
+// `headersTimeout` is intentionally non-zero (unlike the rest, where we tolerate
+// slow bodies): a stalled connection that never sends headers would otherwise be
+// consumed forever and stay invisible to the completion-based adaptive
+// controller. With a headers timeout, a stall surfaces as a transient error the
+// controller can react to (and retry handles). `bodyTimeout` stays 0 — large
+// packuments legitimately stream slowly.
 const registryPool = new undici_1.Pool(registryOrigin, {
-    connections: 6,
+    connections: config_1.POOL_CONNECTIONS,
     pipelining: 1,
     keepAliveTimeout: 30_000,
     keepAliveMaxTimeout: 600_000,
-    headersTimeout: 0,
+    headersTimeout: 30_000,
     bodyTimeout: 0,
     connectTimeout: 15_000,
     allowH2: false,
 });
 const MAX_REGISTRY_ATTEMPTS = 3;
 const RETRY_BACKOFF_MS = [500, 1500, 3000];
-const fetchFromJsdelivrFallback = async (packageName, currentVersion) => {
-    const jsdelivrData = await (0, jsdelivr_registry_1.getAllPackageDataFromJsdelivr)([packageName], currentVersion ? new Map([[packageName, currentVersion]]) : undefined);
-    return jsdelivrData.get(packageName) ?? { latestVersion: 'unknown', allVersions: [] };
-};
-async function getFreshPackageData(packageName, currentVersion) {
+// Fixed concurrency used when adaptive is disabled (INUP_ADAPTIVE=0, the A/B
+// control arm). Matches the production caller (PackageDetector) so the fixed path
+// reproduces the legacy behavior exactly.
+const DEFAULT_FIXED_CONCURRENCY = 10;
+async function getFreshPackageData(packageName, currentVersion, onAttempt) {
     const cacheKey = `${packageName}@${currentVersion ?? ''}`;
-    return inFlightLookups.dedupe(cacheKey, () => fetchPackageFromRegistryWithFallback(packageName, currentVersion));
+    return inFlightLookups.dedupe(cacheKey, () => fetchPackageFromRegistry(packageName, onAttempt));
 }
 const encodeRegistryPath = (packageName) => {
     const encodedName = packageName.startsWith('@')
@@ -47,20 +55,40 @@ const encodeRegistryPath = (packageName) => {
     return `${registryPathPrefix}/${encodedName}`;
 };
 async function attemptRegistryFetch(path) {
+    const startedAt = Date.now();
+    // Conditional request: if we have a stored ETag for this packument, ask the
+    // registry to validate it. Unchanged → 304 (no body) and we reuse stored data.
+    // This still hits the registry every run, so data is never served stale.
+    const cached = (0, etag_store_1.readEtag)(path);
     try {
+        const requestHeaders = {
+            accept: 'application/vnd.npm.install-v1+json',
+            'accept-encoding': 'gzip, deflate, br',
+        };
+        if (cached) {
+            requestHeaders['if-none-match'] = cached.etag;
+        }
         const { statusCode, headers, body } = await registryPool.request({
             path,
             method: 'GET',
-            headers: {
-                accept: 'application/vnd.npm.install-v1+json',
-                'accept-encoding': 'gzip, deflate, br',
-            },
-            headersTimeout: 0,
+            headers: requestHeaders,
+            headersTimeout: 30_000,
             bodyTimeout: 0,
             blocking: false,
         });
+        // Registry confirmed our cached copy is current — reuse it, skip the download.
+        if (statusCode === 304 && cached) {
+            await body.dump().catch(() => undefined);
+            return { kind: 'success', data: cached.data, latencyMs: Date.now() - startedAt };
+        }
         if (statusCode < 200 || statusCode >= 300) {
             await body.dump().catch(() => undefined);
+            if ((0, retry_1.isCongestionStatus)(statusCode)) {
+                return {
+                    kind: 'congested',
+                    retryAfterMs: (0, retry_1.parseRetryAfterMs)(headers['retry-after']),
+                };
+            }
             if ((0, retry_1.isRetryableStatus)(statusCode)) {
                 return { kind: 'retryable' };
             }
@@ -84,7 +112,18 @@ async function attemptRegistryFetch(path) {
         else {
             decoded = raw;
         }
-        return { kind: 'success', data: (0, version_1.parseVersions)(decoded.toString('utf8')) };
+        const data = (0, version_1.parseVersions)(decoded.toString('utf8'));
+        // Persist the ETag for next run's conditional request.
+        const etagHeader = headers['etag'];
+        const etag = Array.isArray(etagHeader) ? etagHeader[0] : etagHeader;
+        if (etag) {
+            (0, etag_store_1.writeEtag)(path, etag.toString(), data);
+        }
+        return {
+            kind: 'success',
+            data,
+            latencyMs: Date.now() - startedAt,
+        };
     }
     catch (error) {
         if ((0, retry_1.isTransientNetworkError)(error)) {
@@ -95,61 +134,81 @@ async function attemptRegistryFetch(path) {
         return { kind: 'transient' };
     }
 }
-async function fetchFromRegistryWithRetries(path) {
+async function fetchFromRegistryWithRetries(path, onAttempt) {
     let lastOutcome = { kind: 'transient' };
     for (let attempt = 0; attempt < MAX_REGISTRY_ATTEMPTS; attempt++) {
         const outcome = await attemptRegistryFetch(path);
+        onAttempt?.(outcome);
         if (outcome.kind === 'success' || outcome.kind === 'not-found') {
             return outcome;
         }
         lastOutcome = outcome;
         if (attempt < MAX_REGISTRY_ATTEMPTS - 1) {
-            const backoff = RETRY_BACKOFF_MS[Math.min(attempt, RETRY_BACKOFF_MS.length - 1)];
+            // Honor Retry-After on congestion; otherwise exponential backoff. These
+            // sleeps are deliberately NOT timed into the controller's latency EWMA.
+            const congestedWait = outcome.kind === 'congested' && outcome.retryAfterMs !== null ? outcome.retryAfterMs : null;
+            const backoff = congestedWait ?? RETRY_BACKOFF_MS[Math.min(attempt, RETRY_BACKOFF_MS.length - 1)];
             await (0, retry_1.sleep)(backoff);
         }
     }
     return lastOutcome;
 }
-async function fetchPackageFromRegistryWithFallback(packageName, currentVersion) {
+async function fetchPackageFromRegistry(packageName, onAttempt) {
     const path = encodeRegistryPath(packageName);
-    const outcome = await fetchFromRegistryWithRetries(path);
+    const outcome = await fetchFromRegistryWithRetries(path, onAttempt);
     if (outcome.kind === 'success') {
         return outcome.data;
     }
-    if (outcome.kind === 'not-found') {
-        return { latestVersion: 'unknown', allVersions: [] };
-    }
-    // Only reach here after exhausted retries against real errors — try jsdelivr
-    // as last-resort safety net so we don't silently return 'unknown'.
-    const fallback = await fetchFromJsdelivrFallback(packageName, currentVersion).catch(() => null);
-    return fallback ?? { latestVersion: 'unknown', allVersions: [] };
+    // Not found, or exhausted retries against real errors: report unavailable.
+    // The registry is the single source of truth — there is no secondary fetch.
+    return { latestVersion: 'unknown', allVersions: [] };
 }
 /**
  * Fetches version data for a list of packages from the npm registry.
  *
  * Concurrency model:
- * - `maxConcurrency` is a global cap on in-flight fetches at any moment.
- *   It doesn't interact with batch size — batches exist only to group
- *   emissions for the UI.
- * - No per-request timeouts: slow responses are allowed to finish. Real
- *   network errors are retried with exponential backoff; after that, we
- *   fall back to jsdelivr as a last resort. A result is never silently
- *   dropped due to slowness.
+ * - A single resizable semaphore caps in-flight fetches. Package names are
+ *   pulled from a work queue and dispatched as slots free up (a lazy pump),
+ *   rather than pre-sliced into fixed batches.
+ * - `adaptive` (default true) enables an AIMD controller that ramps the limit to
+ *   the ceiling on a healthy link and backs off on congestion (429/503) or
+ *   errors. With `adaptive:false` the limit is fixed at `maxConcurrency` (the A/B
+ *   control arm), reproducing the legacy fixed path.
+ * - Tiny runs (<= ceil packages) skip the controller and run at a fixed
+ *   `min(ceil, count)` so they never crawl up from the floor and lose to fixed.
+ * - No body timeout: slow responses finish. Real network errors and header
+ *   stalls are retried with backoff; after the retry budget is exhausted the
+ *   package is reported unavailable (`latestVersion: 'unknown'`).
+ * - Unchanged packuments are revalidated via ETag (304), skipping re-download.
  *
  * Callbacks:
- * - `onBatchReady` fires once a whole emission batch has resolved, in
- *   original batch order.
+ * - `onBatchReady` fires once an emission window has resolved, in original order.
+ *   Emission windows are fixed-size groupings for UI progress only; they do not
+ *   gate concurrency.
+ * - `onControlTick` (optional) reports each adaptive control decision for
+ *   instrumentation.
  */
 async function fetchPackageVersions(packageNames, options = {}) {
     const packageData = new Map();
-    if (packageNames.length === 0) {
+    const total = packageNames.length;
+    if (total === 0) {
         return packageData;
     }
-    const batchSizes = options.batchSizes && options.batchSizes.length > 0
-        ? options.batchSizes.map((size) => Math.max(1, size))
-        : [Math.max(1, options.batchSize ?? 25)];
-    const maxConcurrency = Math.max(1, options.maxConcurrency ?? 10);
-    const total = packageNames.length;
+    const adaptive = options.adaptive ?? true;
+    // `maxConcurrency` is the fixed cap used only when adaptive is off; it never
+    // caps the adaptive start (the controller smart-starts near the work size and
+    // ramps to the ceiling, which beats a low fixed start on large runs).
+    const fixedConcurrency = Math.max(1, options.maxConcurrency ?? DEFAULT_FIXED_CONCURRENCY);
+    const controller = adaptive && adaptive_controller_1.AdaptiveController.shouldControl(total)
+        ? new adaptive_controller_1.AdaptiveController(total, options.onControlTick)
+        : null;
+    const initialLimit = controller
+        ? controller.getLimit()
+        : adaptive
+            ? Math.min(config_1.POOL_CONNECTIONS, total) // too small to control: smart fixed start
+            : fixedConcurrency;
+    const semaphore = new resizable_semaphore_1.ResizableSemaphore(initialLimit);
+    // --- emission ordering (unchanged contract) ---------------------------------
     let completedCount = 0;
     const pendingEmissions = new Map();
     let nextEmitIndex = 0;
@@ -161,68 +220,110 @@ async function fetchPackageVersions(packageNames, options = {}) {
             nextEmitIndex++;
         }
     };
-    // Global semaphore: `maxConcurrency` is the total in-flight cap across
-    // all batches. Batches don't gate concurrency — only emission order.
-    let inFlight = 0;
-    const waiters = [];
-    const acquire = async () => {
-        if (inFlight < maxConcurrency) {
-            inFlight++;
-            return;
+    // Emission windows group results for UI progress only (decoupled from
+    // concurrency). Sizes come from `batchSizes` (a sequence, last value repeats)
+    // or a uniform `batchSize`. We precompute, per package index, which window it
+    // belongs to and its position within that window, so a window can flush as soon
+    // as all its items resolve — preserving original order via `flushPending`.
+    const windowSizes = options.batchSizes && options.batchSizes.length > 0
+        ? options.batchSizes.map((size) => Math.max(1, size))
+        : [Math.max(1, options.batchSize ?? 25)];
+    const windowIdByIndex = new Array(total);
+    const itemIndexByIndex = new Array(total);
+    const windowRemaining = [];
+    {
+        let cursorIndex = 0;
+        let windowId = 0;
+        while (cursorIndex < total) {
+            const size = windowSizes[Math.min(windowId, windowSizes.length - 1)];
+            const end = Math.min(cursorIndex + size, total);
+            windowRemaining[windowId] = end - cursorIndex;
+            for (let i = cursorIndex; i < end; i++) {
+                windowIdByIndex[i] = windowId;
+                itemIndexByIndex[i] = i - cursorIndex;
+            }
+            cursorIndex = end;
+            windowId++;
         }
-        await new Promise((resolve) => waiters.push(resolve));
-        inFlight++;
-    };
-    const release = () => {
-        inFlight--;
-        const next = waiters.shift();
-        if (next)
-            next();
+    }
+    const windowResults = windowRemaining.map(() => []);
+    // --- per-attempt observer ---------------------------------------------------
+    // Feeds the adaptive controller AND (optionally) reports per-package latency
+    // for diagnostics. Built per package so the timing callback knows the name.
+    const observerFor = (packageName) => {
+        if (!controller && !options.onPackageTiming)
+            return undefined;
+        return (outcome) => {
+            if (outcome.kind === 'success') {
+                controller?.record('success', outcome.latencyMs);
+                options.onPackageTiming?.(packageName, outcome.latencyMs);
+            }
+            else if (outcome.kind === 'congested') {
+                const next = controller?.record('congested');
+                if (next != null)
+                    semaphore.setLimit(next);
+            }
+            else if (outcome.kind === 'retryable') {
+                controller?.record('retryable');
+            }
+            else if (outcome.kind === 'transient') {
+                controller?.record('transient');
+            }
+        };
     };
-    const batchPromises = [];
-    let batchStart = 0;
-    let batchIndex = 0;
-    while (batchStart < packageNames.length) {
-        const batchSize = batchSizes[Math.min(batchIndex, batchSizes.length - 1)];
-        const batchNames = packageNames.slice(batchStart, batchStart + batchSize);
-        const capturedBatchIndex = batchIndex;
-        const batchResults = new Array(batchNames.length);
-        const batchPromise = Promise.all(batchNames.map(async (packageName, itemIndex) => {
-            await acquire();
-            try {
-                const data = await getFreshPackageData(packageName, options.currentVersions?.get(packageName));
-                packageData.set(packageName, data);
-                completedCount++;
-                batchResults[itemIndex] = {
-                    packageName,
-                    data,
-                    completed: completedCount,
-                    total,
-                    batchIndex: capturedBatchIndex,
-                    itemIndex,
-                };
+    // --- worker: pull from the queue until exhausted ----------------------------
+    let cursor = 0;
+    const runOne = async (index) => {
+        const packageName = packageNames[index];
+        await semaphore.acquire();
+        try {
+            const data = await getFreshPackageData(packageName, options.currentVersions?.get(packageName), observerFor(packageName));
+            packageData.set(packageName, data);
+            completedCount++;
+            const w = windowIdByIndex[index];
+            const itemIndex = itemIndexByIndex[index];
+            // Index by position (not push) so items keep their original in-window order
+            // even when they resolve out of order.
+            windowResults[w][itemIndex] = {
+                packageName,
+                data,
+                completed: completedCount,
+                total,
+                batchIndex: w,
+                itemIndex,
+            };
+            if (--windowRemaining[w] === 0) {
+                pendingEmissions.set(w, windowResults[w]);
+                flushPending();
             }
-            finally {
-                release();
+            if (controller) {
+                const next = controller.maybeTick();
+                if (next !== null)
+                    semaphore.setLimit(next);
             }
-        })).then(() => {
-            pendingEmissions.set(capturedBatchIndex, batchResults.filter(Boolean));
-            flushPending();
-        });
-        batchPromises.push(batchPromise);
-        batchStart += batchSize;
-        batchIndex++;
+        }
+        finally {
+            semaphore.release();
+        }
+    };
+    // The pump: keep enough workers running to saturate the (possibly growing)
+    // limit. We dispatch all indices as promises but each one waits on the
+    // semaphore before doing work, so the semaphore — not the dispatch loop —
+    // enforces the limit. Growing the limit lets queued acquirers through.
+    const workers = [];
+    while (cursor < total) {
+        workers.push(runOne(cursor));
+        cursor++;
     }
-    await Promise.all(batchPromises);
+    await Promise.all(workers);
     return packageData;
 }
 /**
- * Retained for backward compatibility. Registry responses are fresh-by-default.
+ * Clears the in-run in-flight dedupe map. Only meaningful within a single run
+ * (the map collapses duplicate concurrent lookups); registry data itself is
+ * never cached in memory across runs. Used by tests to isolate fetches.
  */
 function clearPackageCache() {
     inFlightLookups.clear();
 }
-async function closeRegistryPool() {
-    await registryPool.close();
-}
 //# sourceMappingURL=npm-registry.js.map

package/dist/services/package-manager-detector.js

@@ -56,8 +56,8 @@ class PackageManagerDetector {
         if (fromLockFile) {
             return fromLockFile;
         }
-        // 3. Fallback to npm
-        console.log(chalk_1.default.yellow('⚠️  No package manager detected. Defaulting to npm. Consider adding a "packageManager" field to your package.json.'));
+        // 3. Fallback to npm. Warn on stderr so it never corrupts --json output on stdout.
+        console.error(chalk_1.default.yellow('⚠️  No package manager detected. Defaulting to npm. Consider adding a "packageManager" field to your package.json.'));
         return PACKAGE_MANAGERS.npm;
     }
     /**
@@ -92,6 +92,8 @@ class PackageManagerDetector {
         const lockFileChecks = [
             { pm: PACKAGE_MANAGERS.pnpm, path: (0, path_1.join)(cwd, 'pnpm-lock.yaml') },
             { pm: PACKAGE_MANAGERS.bun, path: (0, path_1.join)(cwd, 'bun.lockb') },
+            // Bun >= 1.2 writes a text `bun.lock` instead of the binary `bun.lockb`.
+            { pm: PACKAGE_MANAGERS.bun, path: (0, path_1.join)(cwd, 'bun.lock') },
             { pm: PACKAGE_MANAGERS.yarn, path: (0, path_1.join)(cwd, 'yarn.lock') },
             { pm: PACKAGE_MANAGERS.npm, path: (0, path_1.join)(cwd, 'package-lock.json') },
         ];
@@ -107,7 +109,8 @@ class PackageManagerDetector {
         }
         // If multiple lock files, use most recently modified
         if (existingLocks.length > 1) {
-            console.log(chalk_1.default.yellow('⚠️  Multiple lock files detected. Using most recently modified. Consider cleaning up unused lock files.'));
+            // stderr so it never corrupts --json output on stdout.
+            console.error(chalk_1.default.yellow('⚠️  Multiple lock files detected. Using most recently modified. Consider cleaning up unused lock files.'));
             existingLocks.sort((a, b) => b.mtime - a.mtime);
         }
         return existingLocks[0].pm;

package/dist/ui/modal/package-info-sections/sections.js

@@ -10,6 +10,7 @@ const chalk_1 = __importDefault(require("chalk"));
 const themes_colors_1 = require("../../themes-colors");
 const vulnerability_1 = require("../../presenters/vulnerability");
 const utils_1 = require("../../utils");
+const utils_2 = require("../../../utils");
 const release_notes_1 = require("./release-notes");
 function formatNumber(num) {
     if (!num)
@@ -88,6 +89,29 @@ function buildPackageInfoSections(state, modalWidth, activeTab) {
         required: true,
         behavior: 'pinned',
     });
+    const warningRows = [];
+    const warningContentWidth = Math.max(10, modalWidth - 4);
+    if (state.deprecated) {
+        // Wrap (don't truncate) so a deprecation URL stays whole and clickable —
+        // truncation with "..." produces a dead link. `wrapPlainText` breaks on
+        // spaces only, so the URL keeps its own intact line. No emoji marker:
+        // `getVisualLength` scores glyphs like ⚠ as width 2 while many terminals
+        // render them as width 1, which throws off the modal's border alignment.
+        for (const line of (0, utils_1.wrapPlainText)(`Deprecated: ${state.deprecated}`, warningContentWidth)) {
+            warningRows.push((0, themes_colors_1.getThemeColor)('warning')(line));
+        }
+    }
+    const engineWarning = (0, utils_2.checkNodeEngineCompatibility)(state.enginesNode);
+    if (engineWarning) {
+        warningRows.push((0, themes_colors_1.getThemeColor)('warning')(`Hold: ${engineWarning}`));
+    }
+    if (warningRows.length > 0) {
+        sections.push({
+            key: 'warnings',
+            rows: warningRows,
+            behavior: 'pinned',
+        });
+    }
     if (state.homepage) {
         sections.push({
             key: 'homepage',

package/dist/ui/presenters/health.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getHealthBadge = getHealthBadge;
+const utils_1 = require("../../utils");
+const themes_colors_1 = require("../themes-colors");
+/**
+ * A compact badge flagging a package's health in the list:
+ *   - `[DEPR]` when the latest version is deprecated (highest priority), or
+ *   - `[ENG]`  when its `engines.node` is incompatible with the running Node.
+ *
+ * Returns an empty string when neither applies. Deprecation wins because an
+ * engines mismatch on an abandoned package is moot. Both render in the theme's
+ * (amber) warning color — a caution signal, not an alarm.
+ */
+function getHealthBadge(state) {
+    if (state.deprecated) {
+        return (0, themes_colors_1.getThemeColor)('warning')('[DEPR]');
+    }
+    if ((0, utils_1.checkNodeEngineCompatibility)(state.enginesNode)) {
+        return (0, themes_colors_1.getThemeColor)('warning')('[ENG]');
+    }
+    return '';
+}
+//# sourceMappingURL=health.js.map

package/dist/ui/renderer/package-list/rows.js

@@ -11,6 +11,7 @@ const chalk_1 = __importDefault(require("chalk"));
 const utils_1 = require("../../utils");
 const themes_colors_1 = require("../../themes-colors");
 const vulnerability_1 = require("../../presenters/vulnerability");
+const health_1 = require("../../presenters/health");
 function padLineToWidth(line, terminalWidth) {
     const padding = Math.max(0, terminalWidth - utils_1.VersionUtils.getVisualLength(line));
     return line + ' '.repeat(padding);
@@ -118,15 +119,19 @@ function renderPackageLine(state, _index, isCurrentRow, terminalWidth = 80, opti
     const shouldShowVulnerability = (0, vulnerability_1.shouldDisplayVulnerabilityForDependency)(state.type, options);
     const vulnBadge = shouldShowVulnerability ? (0, vulnerability_1.getVulnerabilityBadge)(state.vulnerability) : '';
     const vulnBadgeWidth = vulnBadge ? utils_1.VersionUtils.getVisualLength(vulnBadge) + 1 : 0;
+    // Deprecation / engines-incompatibility marker (independent of dep type).
+    const healthBadge = (0, health_1.getHealthBadge)(state);
+    const healthBadgeWidth = healthBadge ? utils_1.VersionUtils.getVisualLength(healthBadge) + 1 : 0;
     const nameLength = utils_1.VersionUtils.getVisualLength(truncatedName);
-    const namePadding = Math.max(0, packageNameWidth - nameLength - 1 - badgeWidth - vulnBadgeWidth);
+    const namePadding = Math.max(0, packageNameWidth - nameLength - 1 - badgeWidth - vulnBadgeWidth - healthBadgeWidth);
     const nameDashes = shouldShowDashes(namePadding)
         ? dashColor('-').repeat(namePadding)
         : ' '.repeat(namePadding);
     const vulnSuffix = vulnBadge ? ` ${vulnBadge}` : '';
+    const healthSuffix = healthBadge ? ` ${healthBadge}` : '';
     const packageNameSection = typeBadge
-        ? `${displayName} ${nameDashes}${vulnSuffix}${typeBadge}`
-        : `${displayName} ${nameDashes}${vulnSuffix}`;
+        ? `${displayName} ${nameDashes}${vulnSuffix}${healthSuffix}${typeBadge}`
+        : `${displayName} ${nameDashes}${vulnSuffix}${healthSuffix}`;
     const currentSection = `${currentDot} ${currentVersion}`;
     const currentSectionLength = utils_1.VersionUtils.getVisualLength(currentSection) + 1;
     const currentPadding = Math.max(0, currentColumnWidth - currentSectionLength);