inup 1.6.5 → 1.6.7

package/README.md

@@ -4,6 +4,10 @@
 [![Downloads](https://img.shields.io/npm/dm/inup?style=for-the-badge&color=646CFF&logoColor=white)](https://www.npmjs.com/package/inup)
 [![Total downloads](https://img.shields.io/npm/dt/inup?style=for-the-badge&color=informational)](https://www.npmjs.com/package/inup)
 [![CI](https://img.shields.io/github/actions/workflow/status/donfear/inup/ci.yml?branch=main&style=for-the-badge&label=CI)](https://github.com/donfear/inup/actions/workflows/ci.yml)
+<!-- TEST-BADGES:START -->
+[![Tests](https://img.shields.io/badge/tests-1095_passing-brightgreen?style=for-the-badge&logo=vitest&logoColor=white)](https://github.com/donfear/inup/actions/workflows/ci.yml)
+[![Coverage](https://img.shields.io/badge/coverage-100%25-brightgreen?style=for-the-badge)](https://github.com/donfear/inup/actions/workflows/ci.yml)
+<!-- TEST-BADGES:END -->
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg?style=for-the-badge)](https://github.com/donfear/inup/blob/main/LICENSE)
 
 **inup** is an interactive CLI for upgrading outdated npm dependencies — npm, yarn, pnpm, and bun all supported. It auto-detects your package manager, works in monorepos and workspaces, and requires zero configuration.
@@ -44,6 +48,8 @@ Run `inup` in any project — it scans for outdated dependencies and lets you pi
 - **Live Toggles** — filter dependency types (`d`, `p`, `o`) on the fly without restarting.
 - **Zero Config** — auto-detects npm, yarn, pnpm, or bun from your lockfile.
 - **Monorepo & Workspaces Ready** — discovers and upgrades dependencies across every workspace in one pass.
+- **pnpm Catalogs** — dependencies declared as `catalog:` / `catalog:<name>` are resolved from `pnpm-workspace.yaml` and upgraded right there, preserving the file's comments and formatting.
+- **Private Registries** — honors your `.npmrc` (project, user, and global): scoped registries (`@scope:registry=…`) and credentials (`_authToken`, `username`/`_password`, `${ENV_VAR}` expansion) work exactly like npm's own resolution.
 - **Vulnerability Audit** — flags known security vulnerabilities right in the package list, so you know what's risky before you upgrade.
 - **Changelog Viewer** — read release notes and changelogs inline without leaving the terminal.
 - **Built-in Search** — press `/` to filter packages instantly.
@@ -92,6 +98,11 @@ updates and leaves majors for you to review; `--target latest` includes majors.
 (`ignore`, `exclude`, `scanDirs`) exactly as the report does — a package the config excludes is
 never written. With `--apply --json`, the install output goes to stderr so stdout stays pure JSON.
 
+**pnpm catalogs work in every mode.** Dependencies declared as `catalog:` / `catalog:<name>` are
+resolved from `pnpm-workspace.yaml`; `--apply` writes the new range back into that file (comments
+and formatting preserved), and in `--json` output such entries carry a `"catalog"` field with their
+`packageJsonPath` pointing at `pnpm-workspace.yaml`.
+
 Each reported package carries its health signals: `deprecated` (npm deprecation message), `enginesNode`
 (declared `engines.node`), and `vulnerability` (known advisories on the currently-installed version,
 from one bulk `npm audit`-style request). Every advisory is **cross-referenced against the upgrade
@@ -160,6 +171,7 @@ Scanned **18** packages — **3** unique upgrade(s) (1 with a major available, 1
 ### ✅ Applied in this PR
 
 - `eslint` `^9.28.0` → `^9.30.1` (devDependencies)
+- `react` `^18.2.0` → `^18.3.1` (dependencies · catalog:default)
 - `undici` `^7.10.0` → `^7.11.0` (dependencies)
 - `vite` `^6.3.0` → `^6.3.5` (devDependencies)
 
@@ -168,10 +180,14 @@ Scanned **18** packages — **3** unique upgrade(s) (1 with a major available, 1
 | Package | Current | → In-range | Latest | Type | Applied | Major? | Security |
 |---|---|---|---|---|---|---|---|
 | `eslint` | ^9.28.0 | ^9.30.1 | 9.30.1 | devDependencies | ✅ | — | — |
+| `react` | ^18.2.0 | ^18.3.1 | 19.2.0 | dependencies · catalog:default | ✅ | ⚠️ yes | — |
 | `undici` | ^7.10.0 | ^7.11.0 | 7.11.0 | dependencies | ✅ | — | 🟢 fixed by in-range bump |
 | `vite` | ^6.3.0 | ^6.3.5 | 7.0.0 | devDependencies | ✅ | ⚠️ yes | — |
 ```
 
+Catalog-sourced upgrades (pnpm `catalog:` deps) are applied to `pnpm-workspace.yaml` and marked
+`catalog:<name>` in the PR body so reviewers know which file the diff touches.
+
 <details>
 <summary><strong>Details: commit attribution, all inputs, and outputs</strong></summary>
 

package/dist/{interactive-ui.js → app/interactive-ui.js}

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.InteractiveUI = void 0;
-const ui_1 = require("./ui");
-const controllers_1 = require("./ui/controllers");
-const session_1 = require("./ui/session");
+const interactive_1 = require("../features/interactive");
+const terminal_1 = require("../shared/terminal");
+const interactive_2 = require("../features/interactive");
+const audit_1 = require("../features/audit");
+const interactive_3 = require("../features/interactive");
 const DEFAULT_VULNERABILITY_DISPLAY_OPTIONS = {
     showPeerDependencyVulnerabilities: false,
     showOptionalDependencyVulnerabilities: false,
@@ -21,11 +23,11 @@ class InteractiveUI {
     packageManager;
     options;
     saveExact;
-    vulnerabilityAuditController = new controllers_1.VulnerabilityAuditController();
-    packageInfoModalController = new controllers_1.PackageInfoModalController();
+    vulnerabilityAuditController = new audit_1.VulnerabilityAuditController();
+    packageInfoModalController = new interactive_2.PackageInfoModalController();
     refreshView;
     constructor(packageManager, options) {
-        this.renderer = new ui_1.UIRenderer();
+        this.renderer = new interactive_1.UIRenderer();
         this.packageManager = packageManager;
         this.options = normalizeVulnerabilityDisplayOptions(options);
         this.saveExact = options?.saveExact ?? false;
@@ -38,23 +40,25 @@ class InteractiveUI {
         if (selectionStates.length === 0) {
             return [];
         }
-        const selectedStates = await (0, session_1.runInteractiveSession)(selectionStates, this.packageManager, this.renderer, this.packageInfoModalController, this.vulnerabilityAuditController, this.options, (refresh) => { this.refreshView = refresh; });
-        return (0, session_1.createUpgradeChoices)(selectedStates, this.saveExact);
+        const selectedStates = await (0, interactive_3.runInteractiveSession)(selectionStates, this.packageManager, this.renderer, this.packageInfoModalController, this.vulnerabilityAuditController, this.options, (refresh) => {
+            this.refreshView = refresh;
+        });
+        return (0, interactive_3.createUpgradeChoices)(selectedStates, this.saveExact);
     }
     createSelectionStates(packages, previousSelections, includeUpToDate = true) {
-        return (0, session_1.createSelectionStates)(packages, (name, version, type) => this.vulnerabilityAuditController.getCachedSummary(name, version, type), previousSelections, includeUpToDate);
+        return (0, interactive_3.createSelectionStates)(packages, (name, version, type) => this.vulnerabilityAuditController.getCachedSummary(name, version, type), previousSelections, includeUpToDate);
     }
     createPendingSelectionStates(packages, previousSelections) {
-        return (0, session_1.createPendingSelectionStates)(packages, (name, version, type) => this.vulnerabilityAuditController.getCachedSummary(name, version, type), previousSelections);
+        return (0, interactive_3.createPendingSelectionStates)(packages, (name, version, type) => this.vulnerabilityAuditController.getCachedSummary(name, version, type), previousSelections);
     }
     appendOutdatedBatchToSelectionStates(selectionStates, batch, previousSelections) {
         const outdatedStates = this.createSelectionStates(batch.flatMap((batchItem) => batchItem.packageInfo).filter((pkg) => pkg.isOutdated), previousSelections, false);
         if (outdatedStates.length === 0) {
             return;
         }
-        const seen = new Set(selectionStates.map((state) => `${state.name}@${state.currentVersionSpecifier}@${state.type}`));
+        const seen = new Set(selectionStates.map((state) => (0, interactive_3.selectionKey)(state.name, state.currentVersionSpecifier, state.type, state.catalog)));
         outdatedStates.forEach((state) => {
-            const key = `${state.name}@${state.currentVersionSpecifier}@${state.type}`;
+            const key = (0, interactive_3.selectionKey)(state.name, state.currentVersionSpecifier, state.type, state.catalog);
             if (!seen.has(key)) {
                 selectionStates.push(state);
                 seen.add(key);
@@ -64,8 +68,10 @@ class InteractiveUI {
     }
     async selectPackagesToUpgradeProgressive(selectionStates, progress, attachRefresh) {
         this.enqueueSecurityAudit(selectionStates);
-        const selectedStates = await (0, session_1.runInteractiveSession)(selectionStates, this.packageManager, this.renderer, this.packageInfoModalController, this.vulnerabilityAuditController, this.options, (refresh) => { this.refreshView = refresh; }, progress, attachRefresh);
-        return (0, session_1.createUpgradeChoices)(selectedStates, this.saveExact);
+        const selectedStates = await (0, interactive_3.runInteractiveSession)(selectionStates, this.packageManager, this.renderer, this.packageInfoModalController, this.vulnerabilityAuditController, this.options, (refresh) => {
+            this.refreshView = refresh;
+        }, progress, attachRefresh);
+        return (0, interactive_3.createUpgradeChoices)(selectedStates, this.saveExact);
     }
     enqueueSecurityAudit(selectionStates) {
         this.vulnerabilityAuditController.enqueueStates(selectionStates, () => this.refreshView?.());
@@ -73,8 +79,9 @@ class InteractiveUI {
     async confirmUpgrade(choices) {
         console.log(this.renderer.renderConfirmation(choices));
         return new Promise((resolve) => {
-            let cleanupConfirmationSession = () => {
-                ui_1.CursorUtils.show();
+            // Replaced synchronously below before any keypress can invoke it.
+            let cleanupConfirmationSession = /* v8 ignore next */ () => {
+                terminal_1.CursorUtils.show();
             };
             const handleConfirm = (confirmed) => {
                 cleanupConfirmationSession();
@@ -84,31 +91,35 @@ class InteractiveUI {
             // The confirmation screen does not enter the alternate screen, so alt-screen
             // restoration is intentionally omitted here. If that ever changes, mirror the
             // ownsAlternateScreen-gated pattern from selectPackages.
+            // Coverage: the body only runs during a real process 'exit' event, which
+            // cannot be fired safely inside the test process.
+            /* v8 ignore start */
             const confirmEmergencyCleanup = () => {
                 process.stdout.write('\x1b[?25h');
                 if (process.stdin.setRawMode) {
                     process.stdin.setRawMode(false);
                 }
             };
+            /* v8 ignore stop */
             process.on('exit', confirmEmergencyCleanup);
             const handleConfirmWithCleanup = (confirmed) => {
                 handleConfirm(confirmed);
                 process.off('exit', confirmEmergencyCleanup);
             };
-            const inputHandler = new ui_1.ConfirmationInputHandler(handleConfirmWithCleanup);
+            const inputHandler = new interactive_1.ConfirmationInputHandler(handleConfirmWithCleanup);
             const keypressHandler = (str, key) => inputHandler.handleKeypress(str, key);
             // Setup keypress handling
             try {
-                const keypressSession = ui_1.TerminalInput.startKeypressSession(keypressHandler);
+                const keypressSession = terminal_1.TerminalInput.startKeypressSession(keypressHandler);
                 cleanupConfirmationSession = () => {
                     keypressSession.close();
-                    ui_1.CursorUtils.show();
+                    terminal_1.CursorUtils.show();
                 };
-                ui_1.CursorUtils.hide();
+                terminal_1.CursorUtils.hide();
             }
             catch (error) {
                 process.off('exit', confirmEmergencyCleanup);
-                ui_1.TerminalInput.promptForConfirmation('Proceed with upgrade? [Y/n] ')
+                terminal_1.TerminalInput.promptForConfirmation('Proceed with upgrade? [Y/n] ')
                     .then(resolve)
                     .catch(() => resolve(false));
             }

package/dist/{core → app}/upgrade-runner.js

@@ -5,11 +5,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UpgradeRunner = void 0;
 const chalk_1 = __importDefault(require("chalk"));
-const package_detector_1 = require("./package-detector");
-const interactive_ui_1 = require("../interactive-ui");
-const upgrader_1 = require("./upgrader");
-const package_manager_detector_1 = require("../services/package-manager-detector");
-const utils_1 = require("../ui/utils");
+const upgrade_1 = require("../features/upgrade");
+const interactive_ui_1 = require("./interactive-ui");
+const upgrade_2 = require("../features/upgrade");
+const package_manager_1 = require("../shared/package-manager");
+const terminal_1 = require("../shared/terminal");
+const interactive_1 = require("../features/interactive");
 const debug_1 = require("../features/debug");
 /**
  * Main orchestrator for the inup upgrade process
@@ -23,18 +24,18 @@ class UpgradeRunner {
         // Detect package manager
         const cwd = options?.cwd || process.cwd();
         if (options?.packageManager) {
-            this.packageManager = package_manager_detector_1.PackageManagerDetector.getInfo(options.packageManager);
+            this.packageManager = package_manager_1.PackageManagerDetector.getInfo(options.packageManager);
         }
         else {
-            this.packageManager = package_manager_detector_1.PackageManagerDetector.detect(cwd);
+            this.packageManager = package_manager_1.PackageManagerDetector.detect(cwd);
         }
-        this.detector = new package_detector_1.PackageDetector(options);
+        this.detector = new upgrade_1.PackageDetector(options);
         this.ui = new interactive_ui_1.InteractiveUI(this.packageManager, {
             showPeerDependencyVulnerabilities: options?.showPeerDependencyVulnerabilities ?? false,
             showOptionalDependencyVulnerabilities: options?.showOptionalDependencyVulnerabilities ?? false,
             saveExact: options?.saveExact ?? false,
         });
-        this.upgrader = new upgrader_1.PackageUpgrader(this.packageManager);
+        this.upgrader = new upgrade_2.PackageUpgrader(this.packageManager);
     }
     async run() {
         try {
@@ -126,7 +127,7 @@ class UpgradeRunner {
                 // Group by package name and version specifier
                 const choiceMap = new Map();
                 selectedChoices.forEach((choice) => {
-                    const key = `${choice.name}@${choice.currentVersionSpecifier}@${choice.dependencyType}`;
+                    const key = (0, interactive_1.selectionKey)(choice.name, choice.currentVersionSpecifier, choice.dependencyType, choice.catalog);
                     choiceMap.set(key, choice.upgradeType);
                 });
                 // Convert to the format expected by selectPackagesToUpgrade
@@ -137,7 +138,7 @@ class UpgradeRunner {
                 shouldProceed = await this.ui.confirmUpgrade(selectedChoices);
                 if (shouldProceed === null) {
                     // User pressed N or ESC - go back to selection with current selections preserved
-                    utils_1.ConsoleUtils.clearProgress();
+                    terminal_1.ConsoleUtils.clearProgress();
                     selectedChoices = progress.isLoading
                         ? await this.ui.selectPackagesToUpgradeProgressive(selectionStates, progress, (refresh) => {
                             refreshUI = refresh;

package/dist/cli.js

@@ -10,22 +10,24 @@ const chalk_1 = __importDefault(require("chalk"));
 const path_1 = require("path");
 const index_1 = require("./index");
 const headless_1 = require("./features/headless");
-const services_1 = require("./services");
-const config_1 = require("./config");
-const utils_1 = require("./utils");
-const git_1 = require("./utils/git");
-const ui_1 = require("./ui");
+const version_checker_1 = require("./shared/registry/version-checker");
+const config_1 = require("./shared/config");
+const debug_logger_1 = require("./shared/debug-logger");
+const terminal_1 = require("./shared/terminal");
+const local_env_1 = require("./shared/local-env");
+const git_1 = require("./shared/git");
+const terminal_2 = require("./shared/terminal");
 // Load developer-only toggles from <inup-repo>/.env.local before anything reads
 // env. Best-effort, gitignored, never overrides real env. Lets perf/debug be
 // "set once" across every project without shell config.
-(0, utils_1.loadInupLocalEnv)();
+(0, local_env_1.loadInupLocalEnv)();
 const program = new commander_1.Command();
 async function runCli(options) {
     // Resolve colored-output intent before anything renders.
-    (0, utils_1.applyColorSetting)(options.color);
+    (0, terminal_1.applyColorSetting)(options.color);
     const cwd = (0, path_1.resolve)(options.dir);
     if (options.debug || process.env.INUP_DEBUG === '1') {
-        (0, utils_1.enableDebugLogging)();
+        (0, debug_logger_1.enableDebugLogging)();
     }
     // Headless when piped, in CI, or when a non-interactive flag is set. The TUI only renders in
     // interactive mode; everything else routes through the headless path (read-only, unless --apply).
@@ -40,7 +42,7 @@ async function runCli(options) {
     if (interactive) {
         const gitState = (0, git_1.getGitWorkingTreeState)(cwd);
         if (gitState.isRepo && gitState.isDirty) {
-            const shouldProceed = await ui_1.TerminalInput.promptForImmediateConfirmation(`${chalk_1.default.yellow('Warning:')} dirty working tree. Proceed anyway? ${chalk_1.default.dim('[y/N]')} `, false);
+            const shouldProceed = await terminal_2.TerminalInput.promptForImmediateConfirmation(`${chalk_1.default.yellow('Warning:')} dirty working tree. Proceed anyway? ${chalk_1.default.dim('[y/N]')} `, false);
             if (!shouldProceed) {
                 console.log(chalk_1.default.yellow('Upgrade cancelled.'));
                 return;
@@ -74,7 +76,7 @@ async function runCli(options) {
     // Check for updates in the background (non-blocking). Interactive only — keeps headless stdout
     // clean and avoids a lingering fetch handle in CI.
     const updateCheckPromise = interactive
-        ? (0, services_1.checkForUpdateAsync)(config_1.PACKAGE_NAME, config_1.PACKAGE_VERSION)
+        ? (0, version_checker_1.checkForUpdateAsync)(config_1.PACKAGE_NAME, config_1.PACKAGE_VERSION)
         : undefined;
     // Validate package manager if provided
     let packageManager;

package/dist/{services → features/audit}/background-audit.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BackgroundAuditTracker = void 0;
-const utils_1 = require("../utils");
+const debug_logger_1 = require("../../shared/debug-logger");
 class BackgroundAuditTracker {
     pending = new Map();
     inFlight = new Set();
@@ -20,7 +20,7 @@ class BackgroundAuditTracker {
             added++;
         }
         if (added > 0) {
-            utils_1.debugLog.info('background-audit', `queued ${added} package(s)`);
+            debug_logger_1.debugLog.info('background-audit', `queued ${added} package(s)`);
         }
         return added;
     }

package/dist/features/{headless/vulnerability-audit.js → audit/headless-audit.js}

@@ -36,8 +36,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.auditVulnerabilities = auditVulnerabilities;
 exports.upgradeClears = upgradeClears;
 const semver = __importStar(require("semver"));
-const services_1 = require("../../services");
-const utils_1 = require("../../utils");
+const vulnerability_checker_1 = require("./vulnerability-checker");
+const versions_1 = require("../../shared/versions");
 /**
  * Audit the outdated packages' currently-installed versions (one bulk request, matching the
  * interactive audit) and, for each advisory, cross-reference its affected range against the
@@ -56,7 +56,7 @@ async function auditVulnerabilities(outdated) {
         if (!versions.has(pkg.name))
             versions.set(pkg.name, pkg.currentVersion);
     }
-    const advisories = await (0, services_1.fetchVulnerabilities)(versions);
+    const advisories = await (0, vulnerability_checker_1.fetchVulnerabilities)(versions);
     if (advisories.size === 0)
         return result;
     for (const pkg of outdated) {
@@ -91,16 +91,20 @@ function summarizeVulnerability(pkg, vulnerabilities, highestSeverity) {
  * treats an invalid range as "matches nothing", which would otherwise read as a false "fixed".
  */
 function upgradeClears(target, vulnerableVersions) {
-    const comparable = (0, utils_1.toComparableVersion)(target);
+    const comparable = (0, versions_1.toComparableVersion)(target);
     if (!comparable)
         return false;
     if (semver.validRange(vulnerableVersions) === null)
         return false;
     try {
         return !semver.satisfies(comparable, vulnerableVersions, { includePrerelease: true });
+        // validRange above already rejected unparseable ranges and satisfies
+        // swallows the rest internally; this is a safety net for semver changes.
+        /* v8 ignore start */
     }
     catch {
         return false;
     }
+    /* v8 ignore stop */
 }
-//# sourceMappingURL=vulnerability-audit.js.map
+//# sourceMappingURL=headless-audit.js.map

package/dist/features/audit/index.js

@@ -0,0 +1,36 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.upgradeClears = exports.auditVulnerabilities = exports.shouldDisplayVulnerabilityForDependency = exports.selectRepresentativeAdvisory = exports.mergeVulnerabilitySummary = exports.getVulnerabilitySeverityColor = exports.getVulnerabilityLinkLabel = exports.getVulnerabilityBadge = exports.createVulnerabilitySummary = exports.VulnerabilityAuditController = exports.BackgroundAuditTracker = exports.fetchVulnerabilities = void 0;
+__exportStar(require("./types"), exports);
+var vulnerability_checker_1 = require("./vulnerability-checker");
+Object.defineProperty(exports, "fetchVulnerabilities", { enumerable: true, get: function () { return vulnerability_checker_1.fetchVulnerabilities; } });
+var background_audit_1 = require("./background-audit");
+Object.defineProperty(exports, "BackgroundAuditTracker", { enumerable: true, get: function () { return background_audit_1.BackgroundAuditTracker; } });
+var vulnerability_audit_controller_1 = require("./vulnerability-audit-controller");
+Object.defineProperty(exports, "VulnerabilityAuditController", { enumerable: true, get: function () { return vulnerability_audit_controller_1.VulnerabilityAuditController; } });
+var presenter_1 = require("./presenter");
+Object.defineProperty(exports, "createVulnerabilitySummary", { enumerable: true, get: function () { return presenter_1.createVulnerabilitySummary; } });
+Object.defineProperty(exports, "getVulnerabilityBadge", { enumerable: true, get: function () { return presenter_1.getVulnerabilityBadge; } });
+Object.defineProperty(exports, "getVulnerabilityLinkLabel", { enumerable: true, get: function () { return presenter_1.getVulnerabilityLinkLabel; } });
+Object.defineProperty(exports, "getVulnerabilitySeverityColor", { enumerable: true, get: function () { return presenter_1.getVulnerabilitySeverityColor; } });
+Object.defineProperty(exports, "mergeVulnerabilitySummary", { enumerable: true, get: function () { return presenter_1.mergeVulnerabilitySummary; } });
+Object.defineProperty(exports, "selectRepresentativeAdvisory", { enumerable: true, get: function () { return presenter_1.selectRepresentativeAdvisory; } });
+Object.defineProperty(exports, "shouldDisplayVulnerabilityForDependency", { enumerable: true, get: function () { return presenter_1.shouldDisplayVulnerabilityForDependency; } });
+var headless_audit_1 = require("./headless-audit");
+Object.defineProperty(exports, "auditVulnerabilities", { enumerable: true, get: function () { return headless_audit_1.auditVulnerabilities; } });
+Object.defineProperty(exports, "upgradeClears", { enumerable: true, get: function () { return headless_audit_1.upgradeClears; } });
+//# sourceMappingURL=index.js.map

package/dist/{ui/presenters/vulnerability.js → features/audit/presenter.js}

@@ -73,4 +73,4 @@ function mergeVulnerabilitySummary(existing, summary) {
         detailsUrl: existing?.detailsUrl || summary.detailsUrl,
     };
 }
-//# sourceMappingURL=vulnerability.js.map
+//# sourceMappingURL=presenter.js.map

package/dist/{ui/controllers → features/audit}/vulnerability-audit-controller.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VulnerabilityAuditController = void 0;
-const services_1 = require("../../services");
-const vulnerability_1 = require("../presenters/vulnerability");
+const background_audit_1 = require("./background-audit");
+const vulnerability_checker_1 = require("./vulnerability-checker");
+const presenter_1 = require("./presenter");
 class VulnerabilityAuditController {
-    tracker = new services_1.BackgroundAuditTracker();
+    tracker = new background_audit_1.BackgroundAuditTracker();
     cache = new Map();
     drainPromise = null;
     getCachedSummary(packageName, currentVersionSpecifier, type) {
@@ -36,7 +37,7 @@ class VulnerabilityAuditController {
                 }
                 const batchUpdates = [];
                 try {
-                    const vulnerabilityData = await (0, services_1.fetchVulnerabilities)(batch.packages);
+                    const vulnerabilityData = await (0, vulnerability_checker_1.fetchVulnerabilities)(batch.packages);
                     const batchNames = new Set(batch.packageNames);
                     for (const state of selectionStates) {
                         if (!batchNames.has(state.name)) {
@@ -48,13 +49,13 @@ class VulnerabilityAuditController {
                             !vulnerability.highestSeverity) {
                             continue;
                         }
-                        const summary = (0, vulnerability_1.createVulnerabilitySummary)(state.vulnerability, vulnerability.vulnerabilities.map((item) => ({
+                        const summary = (0, presenter_1.createVulnerabilitySummary)(state.vulnerability, vulnerability.vulnerabilities.map((item) => ({
                             id: item.id,
                             title: item.title,
                             severity: item.severity,
                             url: item.url,
                         })), vulnerability.highestSeverity);
-                        const merged = (0, vulnerability_1.mergeVulnerabilitySummary)(state.vulnerability, summary);
+                        const merged = (0, presenter_1.mergeVulnerabilitySummary)(state.vulnerability, summary);
                         this.cache.set(this.getCacheKey(state.name, state.currentVersionSpecifier, state.type), merged);
                         batchUpdates.push({ name: state.name, patch: { vulnerability: merged } });
                     }
@@ -76,9 +77,14 @@ class VulnerabilityAuditController {
             }
         })().finally(() => {
             this.drainPromise = null;
+            // Re-drain guard for work enqueued in the microtask gap between the
+            // loop's final empty reserve and this finally — a real but unschedulable
+            // race window, so it cannot be exercised deterministically in tests.
+            /* v8 ignore start */
             if (this.tracker.getProgress().isRunning) {
                 this.drain(selectionStates, onUpdate);
             }
+            /* v8 ignore stop */
         });
         await this.drainPromise;
         return allUpdates;

package/dist/{services → features/audit}/vulnerability-checker.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fetchVulnerabilities = fetchVulnerabilities;
-const config_1 = require("../config");
-const utils_1 = require("../utils");
+const config_1 = require("../../shared/config");
+const debug_logger_1 = require("../../shared/debug-logger");
 const SEVERITY_ORDER = {
     info: 0,
     low: 1,
@@ -14,8 +14,11 @@ function isKnownSeverity(severity) {
     return severity in SEVERITY_ORDER;
 }
 function getHighestSeverity(vulnerabilities) {
+    // The only caller skips empty advisory lists before calling; type-level net.
+    /* v8 ignore start */
     if (vulnerabilities.length === 0)
         return null;
+    /* v8 ignore stop */
     let highest = 'info';
     for (const vuln of vulnerabilities) {
         if (SEVERITY_ORDER[vuln.severity] > SEVERITY_ORDER[highest]) {
@@ -49,7 +52,7 @@ async function fetchVulnerabilities(packages) {
         return results;
     }
     const url = `${config_1.NPM_REGISTRY_URL}/-/npm/v1/security/advisories/bulk`;
-    utils_1.debugLog.info('vulnerability-checker', `checking ${Object.keys(body).length} packages`);
+    debug_logger_1.debugLog.info('vulnerability-checker', `checking ${Object.keys(body).length} packages`);
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), config_1.REQUEST_TIMEOUT);
     try {
@@ -64,13 +67,13 @@ async function fetchVulnerabilities(packages) {
         });
         clearTimeout(timeoutId);
         if (!response.ok) {
-            utils_1.debugLog.warn('vulnerability-checker', `API returned HTTP ${response.status}`);
+            debug_logger_1.debugLog.warn('vulnerability-checker', `API returned HTTP ${response.status}`);
             return results;
         }
         // Response is keyed by package name, values are arrays of advisories
         const data = (await response.json());
         if (!data || typeof data !== 'object' || Array.isArray(data)) {
-            utils_1.debugLog.warn('vulnerability-checker', 'unexpected API payload shape');
+            debug_logger_1.debugLog.warn('vulnerability-checker', 'unexpected API payload shape');
             return results;
         }
         for (const [packageName, advisories] of Object.entries(data)) {
@@ -114,15 +117,15 @@ async function fetchVulnerabilities(packages) {
                 highestSeverity: getHighestSeverity(unique),
             });
         }
-        utils_1.debugLog.info('vulnerability-checker', `found ${results.size} packages with vulnerabilities`);
+        debug_logger_1.debugLog.info('vulnerability-checker', `found ${results.size} packages with vulnerabilities`);
         return results;
     }
     catch (error) {
         if (error instanceof Error && error.name === 'AbortError') {
-            utils_1.debugLog.warn('vulnerability-checker', 'request timed out');
+            debug_logger_1.debugLog.warn('vulnerability-checker', 'request timed out');
         }
         else {
-            utils_1.debugLog.warn('vulnerability-checker', 'failed to fetch vulnerabilities', error);
+            debug_logger_1.debugLog.warn('vulnerability-checker', 'failed to fetch vulnerabilities', error);
         }
         return results;
     }

package/dist/features/changelog/clients/github-client.js

@@ -2,8 +2,40 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GitHubClient = void 0;
 const repository_ref_1 = require("../parsers/repository-ref");
-const config_1 = require("../../../config");
+const config_1 = require("../../../shared/config");
 const GITHUB_RELEASES_PAGE_LIMIT = 3;
+/**
+ * Headers for api.github.com requests. Honors an ambient token (GitHub Actions
+ * sets GITHUB_TOKEN, gh CLI users often export GH_TOKEN): authenticated requests
+ * get 5,000 req/hr instead of the 60 req/hr anonymous limit, which large upgrade
+ * sessions can exhaust while fetching release notes.
+ */
+function githubApiHeaders() {
+    const headers = {
+        accept: 'application/vnd.github.v3+json',
+        'user-agent': `${config_1.PACKAGE_NAME}-cli`,
+    };
+    const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+    if (token) {
+        headers['authorization'] = `Bearer ${token}`;
+    }
+    return headers;
+}
+/**
+ * GET an api.github.com URL, retrying anonymously when the ambient token is
+ * rejected (401). A stale/revoked GITHUB_TOKEN sitting in the environment must
+ * never make release notes *worse* than having no token at all — public-repo
+ * requests that used to succeed anonymously keep succeeding.
+ */
+async function fetchGitHubApi(url, signal) {
+    const headers = githubApiHeaders();
+    const response = await fetch(url, { method: 'GET', headers, signal });
+    if (response.status === 401 && headers['authorization']) {
+        const { authorization: _rejected, ...anonymousHeaders } = headers;
+        return fetch(url, { method: 'GET', headers: anonymousHeaders, signal });
+    }
+    return response;
+}
 class GitHubClient {
     releasesCache = new Map();
     rawChangelogCache = new Map();
@@ -16,14 +48,7 @@ class GitHubClient {
         if (!repo)
             return null;
         try {
-            const response = await fetch(`https://api.github.com/repos/${repo.owner}/${repo.repo}/releases/tags/${tag}`, {
-                method: 'GET',
-                headers: {
-                    accept: 'application/vnd.github.v3+json',
-                    'user-agent': `${config_1.PACKAGE_NAME}-cli`,
-                },
-                signal,
-            });
+            const response = await fetchGitHubApi(`https://api.github.com/repos/${repo.owner}/${repo.repo}/releases/tags/${tag}`, signal);
             if (!response.ok)
                 return null;
             const data = (await response.json());
@@ -67,14 +92,7 @@ class GitHubClient {
         const releases = [];
         for (let page = 1; page <= GITHUB_RELEASES_PAGE_LIMIT; page += 1) {
             try {
-                const response = await fetch(`https://api.github.com/repos/${repo.owner}/${repo.repo}/releases?per_page=100&page=${page}`, {
-                    method: 'GET',
-                    headers: {
-                        accept: 'application/vnd.github.v3+json',
-                        'user-agent': `${config_1.PACKAGE_NAME}-cli`,
-                    },
-                    signal,
-                });
+                const response = await fetchGitHubApi(`https://api.github.com/repos/${repo.owner}/${repo.repo}/releases?per_page=100&page=${page}`, signal);
                 if (!response.ok)
                     break;
                 const pageReleases = (await response.json());

package/dist/features/changelog/clients/npm-registry-client.js

@@ -1,14 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NpmRegistryClient = void 0;
-const constants_1 = require("../../../config/constants");
+const constants_1 = require("../../../shared/config/constants");
+const registry_config_1 = require("../../../shared/registry/registry-config");
+const PUBLIC_REGISTRY_ORIGIN = new URL(constants_1.NPM_REGISTRY_URL).origin;
 class NpmRegistryClient {
+    resolveRegistryTarget;
+    constructor(resolveRegistryTarget = registry_config_1.registryTargetFor) {
+        this.resolveRegistryTarget = resolveRegistryTarget;
+    }
     async fetchPackageManifest(packageName, version, signal) {
         try {
-            const response = await fetch(`${constants_1.NPM_REGISTRY_URL}/${encodeURIComponent(packageName)}/${encodeURIComponent(version)}`, {
+            const target = this.resolveRegistryTarget(packageName);
+            const response = await fetch(`${target.origin}${target.pathPrefix}/${encodeURIComponent(packageName)}/${encodeURIComponent(version)}`, {
                 method: 'GET',
                 headers: {
                     accept: 'application/json',
+                    ...(target.authHeader ? { authorization: target.authHeader } : {}),
                 },
                 signal,
             });
@@ -25,6 +33,12 @@ class NpmRegistryClient {
         }
     }
     async fetchDownloadStats(packageName, signal) {
+        // Download counts only exist for the public registry. Skip the call for
+        // packages that resolve elsewhere — no stats there, and private package
+        // names should not be sent to api.npmjs.org.
+        if (this.resolveRegistryTarget(packageName).origin !== PUBLIC_REGISTRY_ORIGIN) {
+            return null;
+        }
         try {
             const response = await fetch(`https://api.npmjs.org/downloads/point/last-week/${encodeURIComponent(packageName)}`, {
                 method: 'GET',