inup 1.6.6 → 1.6.8

package/README.md

@@ -1,13 +1,23 @@
+<p align="center">
+  <a href="https://donfear.github.io/inup/"><img src="docs/brand/inup-logo.webp" alt="inup logo" width="170"></a>
+</p>
+
 # inup — Interactive Dependency Upgrader
 
 [![npm version](https://img.shields.io/npm/v/inup?logo=npm&logoColor=%23CB3837&style=for-the-badge&color=crimson)](https://www.npmjs.com/package/inup)
 [![Downloads](https://img.shields.io/npm/dm/inup?style=for-the-badge&color=646CFF&logoColor=white)](https://www.npmjs.com/package/inup)
 [![Total downloads](https://img.shields.io/npm/dt/inup?style=for-the-badge&color=informational)](https://www.npmjs.com/package/inup)
 [![CI](https://img.shields.io/github/actions/workflow/status/donfear/inup/ci.yml?branch=main&style=for-the-badge&label=CI)](https://github.com/donfear/inup/actions/workflows/ci.yml)
+<!-- TEST-BADGES:START -->
+[![Tests](https://img.shields.io/badge/tests-1095_passing-brightgreen?style=for-the-badge&logo=vitest&logoColor=white)](https://github.com/donfear/inup/actions/workflows/ci.yml)
+[![Coverage](https://img.shields.io/badge/coverage-100%25-brightgreen?style=for-the-badge)](https://github.com/donfear/inup/actions/workflows/ci.yml)
+<!-- TEST-BADGES:END -->
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg?style=for-the-badge)](https://github.com/donfear/inup/blob/main/LICENSE)
 
 **inup** is an interactive CLI for upgrading outdated npm dependencies — npm, yarn, pnpm, and bun all supported. It auto-detects your package manager, works in monorepos and workspaces, and requires zero configuration.
 
+**[Documentation, comparisons & changelog →](https://donfear.github.io/inup/)**
+
 ![Interactive Upgrade Demo](docs/demo/interactive-upgrade.gif)
 
 ## Table of Contents
@@ -44,6 +54,8 @@ Run `inup` in any project — it scans for outdated dependencies and lets you pi
 - **Live Toggles** — filter dependency types (`d`, `p`, `o`) on the fly without restarting.
 - **Zero Config** — auto-detects npm, yarn, pnpm, or bun from your lockfile.
 - **Monorepo & Workspaces Ready** — discovers and upgrades dependencies across every workspace in one pass.
+- **pnpm Catalogs** — dependencies declared as `catalog:` / `catalog:<name>` are resolved from `pnpm-workspace.yaml` and upgraded right there, preserving the file's comments and formatting.
+- **Private Registries** — honors your `.npmrc` (project, user, and global): scoped registries (`@scope:registry=…`) and credentials (`_authToken`, `username`/`_password`, `${ENV_VAR}` expansion) work exactly like npm's own resolution.
 - **Vulnerability Audit** — flags known security vulnerabilities right in the package list, so you know what's risky before you upgrade.
 - **Changelog Viewer** — read release notes and changelogs inline without leaving the terminal.
 - **Built-in Search** — press `/` to filter packages instantly.
@@ -62,7 +74,7 @@ inup [options]
 --json                        Print a machine-readable JSON report and exit (read-only)
 -c, --check                   Exit non-zero if updates exist, without writing (for CI)
 --apply                       Non-interactively write upgrades + install (for CI/automation)
---target <level>              With --apply: how far to bump — minor (default) | patch | latest
+--target <level>              With --apply: minor (default, in-range) | patch (same major.minor) | latest
 --debug                       Write verbose debug logs
 ```
 
@@ -88,10 +100,16 @@ inup --apply --target latest # include major bumps; --json to also emit the repo
 
 Unlike `--json` and `--check`, **`--apply` writes**: it bumps `package.json` and runs your package
 manager's install to update the lockfile. By default (`--target minor`) it only applies **in-range**
-updates and leaves majors for you to review; `--target latest` includes majors. It honors `.inuprc`
+updates and leaves majors for you to review; `--target patch` stays within the current
+`major.minor` line (patch bumps only); `--target latest` includes majors. It honors `.inuprc`
 (`ignore`, `exclude`, `scanDirs`) exactly as the report does — a package the config excludes is
 never written. With `--apply --json`, the install output goes to stderr so stdout stays pure JSON.
 
+**pnpm catalogs work in every mode.** Dependencies declared as `catalog:` / `catalog:<name>` are
+resolved from `pnpm-workspace.yaml`; `--apply` writes the new range back into that file (comments
+and formatting preserved), and in `--json` output such entries carry a `"catalog"` field with their
+`packageJsonPath` pointing at `pnpm-workspace.yaml`.
+
 Each reported package carries its health signals: `deprecated` (npm deprecation message), `enginesNode`
 (declared `engines.node`), and `vulnerability` (known advisories on the currently-installed version,
 from one bulk `npm audit`-style request). Every advisory is **cross-referenced against the upgrade
@@ -160,6 +178,7 @@ Scanned **18** packages — **3** unique upgrade(s) (1 with a major available, 1
 ### ✅ Applied in this PR
 
 - `eslint` `^9.28.0` → `^9.30.1` (devDependencies)
+- `react` `^18.2.0` → `^18.3.1` (dependencies · catalog:default)
 - `undici` `^7.10.0` → `^7.11.0` (dependencies)
 - `vite` `^6.3.0` → `^6.3.5` (devDependencies)
 
@@ -168,10 +187,14 @@ Scanned **18** packages — **3** unique upgrade(s) (1 with a major available, 1
 | Package | Current | → In-range | Latest | Type | Applied | Major? | Security |
 |---|---|---|---|---|---|---|---|
 | `eslint` | ^9.28.0 | ^9.30.1 | 9.30.1 | devDependencies | ✅ | — | — |
+| `react` | ^18.2.0 | ^18.3.1 | 19.2.0 | dependencies · catalog:default | ✅ | ⚠️ yes | — |
 | `undici` | ^7.10.0 | ^7.11.0 | 7.11.0 | dependencies | ✅ | — | 🟢 fixed by in-range bump |
 | `vite` | ^6.3.0 | ^6.3.5 | 7.0.0 | devDependencies | ✅ | ⚠️ yes | — |
 ```
 
+Catalog-sourced upgrades (pnpm `catalog:` deps) are applied to `pnpm-workspace.yaml` and marked
+`catalog:<name>` in the PR body so reviewers know which file the diff touches.
+
 <details>
 <summary><strong>Details: commit attribution, all inputs, and outputs</strong></summary>
 

package/dist/{interactive-ui.js → app/interactive-ui.js}

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.InteractiveUI = void 0;
-const ui_1 = require("./ui");
-const controllers_1 = require("./ui/controllers");
-const session_1 = require("./ui/session");
+const audit_1 = require("../features/audit");
+const interactive_1 = require("../features/interactive");
+const terminal_1 = require("../shared/terminal");
 const DEFAULT_VULNERABILITY_DISPLAY_OPTIONS = {
     showPeerDependencyVulnerabilities: false,
     showOptionalDependencyVulnerabilities: false,
@@ -21,11 +21,11 @@ class InteractiveUI {
     packageManager;
     options;
     saveExact;
-    vulnerabilityAuditController = new controllers_1.VulnerabilityAuditController();
-    packageInfoModalController = new controllers_1.PackageInfoModalController();
+    vulnerabilityAuditController = new audit_1.VulnerabilityAuditController();
+    packageInfoModalController = new interactive_1.PackageInfoModalController();
     refreshView;
     constructor(packageManager, options) {
-        this.renderer = new ui_1.UIRenderer();
+        this.renderer = new interactive_1.UIRenderer();
         this.packageManager = packageManager;
         this.options = normalizeVulnerabilityDisplayOptions(options);
         this.saveExact = options?.saveExact ?? false;
@@ -38,23 +38,25 @@ class InteractiveUI {
         if (selectionStates.length === 0) {
             return [];
         }
-        const selectedStates = await (0, session_1.runInteractiveSession)(selectionStates, this.packageManager, this.renderer, this.packageInfoModalController, this.vulnerabilityAuditController, this.options, (refresh) => { this.refreshView = refresh; });
-        return (0, session_1.createUpgradeChoices)(selectedStates, this.saveExact);
+        const selectedStates = await (0, interactive_1.runInteractiveSession)(selectionStates, this.packageManager, this.renderer, this.packageInfoModalController, this.vulnerabilityAuditController, this.options, (refresh) => {
+            this.refreshView = refresh;
+        });
+        return (0, interactive_1.createUpgradeChoices)(selectedStates, this.saveExact);
     }
     createSelectionStates(packages, previousSelections, includeUpToDate = true) {
-        return (0, session_1.createSelectionStates)(packages, (name, version, type) => this.vulnerabilityAuditController.getCachedSummary(name, version, type), previousSelections, includeUpToDate);
+        return (0, interactive_1.createSelectionStates)(packages, (name, version, type) => this.vulnerabilityAuditController.getCachedSummary(name, version, type), previousSelections, includeUpToDate);
     }
     createPendingSelectionStates(packages, previousSelections) {
-        return (0, session_1.createPendingSelectionStates)(packages, (name, version, type) => this.vulnerabilityAuditController.getCachedSummary(name, version, type), previousSelections);
+        return (0, interactive_1.createPendingSelectionStates)(packages, (name, version, type) => this.vulnerabilityAuditController.getCachedSummary(name, version, type), previousSelections);
     }
     appendOutdatedBatchToSelectionStates(selectionStates, batch, previousSelections) {
         const outdatedStates = this.createSelectionStates(batch.flatMap((batchItem) => batchItem.packageInfo).filter((pkg) => pkg.isOutdated), previousSelections, false);
         if (outdatedStates.length === 0) {
             return;
         }
-        const seen = new Set(selectionStates.map((state) => `${state.name}@${state.currentVersionSpecifier}@${state.type}`));
+        const seen = new Set(selectionStates.map((state) => (0, interactive_1.selectionKey)(state.name, state.currentVersionSpecifier, state.type, state.catalog)));
         outdatedStates.forEach((state) => {
-            const key = `${state.name}@${state.currentVersionSpecifier}@${state.type}`;
+            const key = (0, interactive_1.selectionKey)(state.name, state.currentVersionSpecifier, state.type, state.catalog);
             if (!seen.has(key)) {
                 selectionStates.push(state);
                 seen.add(key);
@@ -64,8 +66,10 @@ class InteractiveUI {
     }
     async selectPackagesToUpgradeProgressive(selectionStates, progress, attachRefresh) {
         this.enqueueSecurityAudit(selectionStates);
-        const selectedStates = await (0, session_1.runInteractiveSession)(selectionStates, this.packageManager, this.renderer, this.packageInfoModalController, this.vulnerabilityAuditController, this.options, (refresh) => { this.refreshView = refresh; }, progress, attachRefresh);
-        return (0, session_1.createUpgradeChoices)(selectedStates, this.saveExact);
+        const selectedStates = await (0, interactive_1.runInteractiveSession)(selectionStates, this.packageManager, this.renderer, this.packageInfoModalController, this.vulnerabilityAuditController, this.options, (refresh) => {
+            this.refreshView = refresh;
+        }, progress, attachRefresh);
+        return (0, interactive_1.createUpgradeChoices)(selectedStates, this.saveExact);
     }
     enqueueSecurityAudit(selectionStates) {
         this.vulnerabilityAuditController.enqueueStates(selectionStates, () => this.refreshView?.());
@@ -73,9 +77,14 @@ class InteractiveUI {
     async confirmUpgrade(choices) {
         console.log(this.renderer.renderConfirmation(choices));
         return new Promise((resolve) => {
+            // Replaced synchronously below before any keypress can invoke it, so
+            // the placeholder body is unreachable. (The `v8 ignore next` form is
+            // not honored by coverage-v8 here; the block form is.)
+            /* v8 ignore start */
             let cleanupConfirmationSession = () => {
-                ui_1.CursorUtils.show();
+                terminal_1.CursorUtils.show();
             };
+            /* v8 ignore stop */
             const handleConfirm = (confirmed) => {
                 cleanupConfirmationSession();
                 resolve(confirmed);
@@ -84,31 +93,35 @@ class InteractiveUI {
             // The confirmation screen does not enter the alternate screen, so alt-screen
             // restoration is intentionally omitted here. If that ever changes, mirror the
             // ownsAlternateScreen-gated pattern from selectPackages.
+            // Coverage: the body only runs during a real process 'exit' event, which
+            // cannot be fired safely inside the test process.
+            /* v8 ignore start */
             const confirmEmergencyCleanup = () => {
                 process.stdout.write('\x1b[?25h');
                 if (process.stdin.setRawMode) {
                     process.stdin.setRawMode(false);
                 }
             };
+            /* v8 ignore stop */
             process.on('exit', confirmEmergencyCleanup);
             const handleConfirmWithCleanup = (confirmed) => {
                 handleConfirm(confirmed);
                 process.off('exit', confirmEmergencyCleanup);
             };
-            const inputHandler = new ui_1.ConfirmationInputHandler(handleConfirmWithCleanup);
+            const inputHandler = new interactive_1.ConfirmationInputHandler(handleConfirmWithCleanup);
             const keypressHandler = (str, key) => inputHandler.handleKeypress(str, key);
             // Setup keypress handling
             try {
-                const keypressSession = ui_1.TerminalInput.startKeypressSession(keypressHandler);
+                const keypressSession = terminal_1.TerminalInput.startKeypressSession(keypressHandler);
                 cleanupConfirmationSession = () => {
                     keypressSession.close();
-                    ui_1.CursorUtils.show();
+                    terminal_1.CursorUtils.show();
                 };
-                ui_1.CursorUtils.hide();
+                terminal_1.CursorUtils.hide();
             }
-            catch (error) {
+            catch {
                 process.off('exit', confirmEmergencyCleanup);
-                ui_1.TerminalInput.promptForConfirmation('Proceed with upgrade? [Y/n] ')
+                terminal_1.TerminalInput.promptForConfirmation('Proceed with upgrade? [Y/n] ')
                     .then(resolve)
                     .catch(() => resolve(false));
             }

package/dist/{core → app}/upgrade-runner.js

@@ -5,12 +5,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UpgradeRunner = void 0;
 const chalk_1 = __importDefault(require("chalk"));
-const package_detector_1 = require("./package-detector");
-const interactive_ui_1 = require("../interactive-ui");
-const upgrader_1 = require("./upgrader");
-const package_manager_detector_1 = require("../services/package-manager-detector");
-const utils_1 = require("../ui/utils");
 const debug_1 = require("../features/debug");
+const interactive_1 = require("../features/interactive");
+const upgrade_1 = require("../features/upgrade");
+const package_manager_1 = require("../shared/package-manager");
+const terminal_1 = require("../shared/terminal");
+const interactive_ui_1 = require("./interactive-ui");
 /**
  * Main orchestrator for the inup upgrade process
  */
@@ -23,18 +23,18 @@ class UpgradeRunner {
         // Detect package manager
         const cwd = options?.cwd || process.cwd();
         if (options?.packageManager) {
-            this.packageManager = package_manager_detector_1.PackageManagerDetector.getInfo(options.packageManager);
+            this.packageManager = package_manager_1.PackageManagerDetector.getInfo(options.packageManager);
         }
         else {
-            this.packageManager = package_manager_detector_1.PackageManagerDetector.detect(cwd);
+            this.packageManager = package_manager_1.PackageManagerDetector.detect(cwd);
         }
-        this.detector = new package_detector_1.PackageDetector(options);
+        this.detector = new upgrade_1.PackageDetector(options);
         this.ui = new interactive_ui_1.InteractiveUI(this.packageManager, {
             showPeerDependencyVulnerabilities: options?.showPeerDependencyVulnerabilities ?? false,
             showOptionalDependencyVulnerabilities: options?.showOptionalDependencyVulnerabilities ?? false,
             saveExact: options?.saveExact ?? false,
         });
-        this.upgrader = new upgrader_1.PackageUpgrader(this.packageManager);
+        this.upgrader = new upgrade_1.PackageUpgrader(this.packageManager);
     }
     async run() {
         try {
@@ -120,24 +120,20 @@ class UpgradeRunner {
                 }
                 // Validate selected choices before confirmation
                 this.validateSelectedChoices(selectedChoices, latestPackages);
-                // Store current selections for potential return to selection
-                previousSelections = new Map();
-                // Convert selectedChoices back to selection state format
-                // Group by package name and version specifier
-                const choiceMap = new Map();
+                // Store current selections (keyed by package name and version specifier)
+                // in the format expected by selectPackagesToUpgrade, for potential
+                // return to selection.
+                const nextSelections = new Map();
                 selectedChoices.forEach((choice) => {
-                    const key = `${choice.name}@${choice.currentVersionSpecifier}@${choice.dependencyType}`;
-                    choiceMap.set(key, choice.upgradeType);
-                });
-                // Convert to the format expected by selectPackagesToUpgrade
-                choiceMap.forEach((upgradeType, key) => {
-                    previousSelections.set(key, upgradeType);
+                    const key = (0, interactive_1.selectionKey)(choice.name, choice.currentVersionSpecifier, choice.dependencyType, choice.catalog);
+                    nextSelections.set(key, choice.upgradeType);
                 });
+                previousSelections = nextSelections;
                 // Confirm upgrade
                 shouldProceed = await this.ui.confirmUpgrade(selectedChoices);
                 if (shouldProceed === null) {
                     // User pressed N or ESC - go back to selection with current selections preserved
-                    utils_1.ConsoleUtils.clearProgress();
+                    terminal_1.ConsoleUtils.clearProgress();
                     selectedChoices = progress.isLoading
                         ? await this.ui.selectPackagesToUpgradeProgressive(selectionStates, progress, (refresh) => {
                             refreshUI = refresh;
@@ -180,7 +176,7 @@ class UpgradeRunner {
         // Print summary of what will be upgraded
         const packageJsonPaths = new Set(selectedChoices.map((c) => c.packageJsonPath));
         const uniquePackages = new Set(selectedChoices.map((c) => c.name));
-        console.log('\n' + chalk_1.default.bold('📋 Upgrade Summary'));
+        console.log(`\n${chalk_1.default.bold('📋 Upgrade Summary')}`);
         console.log(chalk_1.default.gray('─'.repeat(50)));
         console.log(`${chalk_1.default.cyan(uniquePackages.size.toString())} package(s) will be upgraded`);
         console.log(`${chalk_1.default.cyan(packageJsonPaths.size.toString())} package.json file(s) will be modified`);

package/dist/cli.js

@@ -5,27 +5,28 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runCli = runCli;
-const commander_1 = require("commander");
+const node_path_1 = require("node:path");
 const chalk_1 = __importDefault(require("chalk"));
-const path_1 = require("path");
-const index_1 = require("./index");
+const commander_1 = require("commander");
 const headless_1 = require("./features/headless");
-const services_1 = require("./services");
-const config_1 = require("./config");
-const utils_1 = require("./utils");
-const git_1 = require("./utils/git");
-const ui_1 = require("./ui");
+const index_1 = require("./index");
+const config_1 = require("./shared/config");
+const debug_logger_1 = require("./shared/debug-logger");
+const git_1 = require("./shared/git");
+const local_env_1 = require("./shared/local-env");
+const version_checker_1 = require("./shared/registry/version-checker");
+const terminal_1 = require("./shared/terminal");
 // Load developer-only toggles from <inup-repo>/.env.local before anything reads
 // env. Best-effort, gitignored, never overrides real env. Lets perf/debug be
 // "set once" across every project without shell config.
-(0, utils_1.loadInupLocalEnv)();
+(0, local_env_1.loadInupLocalEnv)();
 const program = new commander_1.Command();
 async function runCli(options) {
     // Resolve colored-output intent before anything renders.
-    (0, utils_1.applyColorSetting)(options.color);
-    const cwd = (0, path_1.resolve)(options.dir);
+    (0, terminal_1.applyColorSetting)(options.color);
+    const cwd = (0, node_path_1.resolve)(options.dir);
     if (options.debug || process.env.INUP_DEBUG === '1') {
-        (0, utils_1.enableDebugLogging)();
+        (0, debug_logger_1.enableDebugLogging)();
     }
     // Headless when piped, in CI, or when a non-interactive flag is set. The TUI only renders in
     // interactive mode; everything else routes through the headless path (read-only, unless --apply).
@@ -40,7 +41,7 @@ async function runCli(options) {
     if (interactive) {
         const gitState = (0, git_1.getGitWorkingTreeState)(cwd);
         if (gitState.isRepo && gitState.isDirty) {
-            const shouldProceed = await ui_1.TerminalInput.promptForImmediateConfirmation(`${chalk_1.default.yellow('Warning:')} dirty working tree. Proceed anyway? ${chalk_1.default.dim('[y/N]')} `, false);
+            const shouldProceed = await terminal_1.TerminalInput.promptForImmediateConfirmation(`${chalk_1.default.yellow('Warning:')} dirty working tree. Proceed anyway? ${chalk_1.default.dim('[y/N]')} `, false);
             if (!shouldProceed) {
                 console.log(chalk_1.default.yellow('Upgrade cancelled.'));
                 return;
@@ -74,7 +75,7 @@ async function runCli(options) {
     // Check for updates in the background (non-blocking). Interactive only — keeps headless stdout
     // clean and avoids a lingering fetch handle in CI.
     const updateCheckPromise = interactive
-        ? (0, services_1.checkForUpdateAsync)(config_1.PACKAGE_NAME, config_1.PACKAGE_VERSION)
+        ? (0, version_checker_1.checkForUpdateAsync)(config_1.PACKAGE_NAME, config_1.PACKAGE_VERSION)
         : undefined;
     // Validate package manager if provided
     let packageManager;
@@ -128,12 +129,12 @@ async function runCli(options) {
             ' → ' +
             chalk_1.default.green(updateCheck.latestVersion);
         const line2Plain = ` Run: ${updateCheck.updateCommand}`;
-        const line2 = ' ' + chalk_1.default.gray('Run: ') + chalk_1.default.cyan(updateCheck.updateCommand);
+        const line2 = ` ${chalk_1.default.gray('Run: ')}${chalk_1.default.cyan(updateCheck.updateCommand)}`;
         console.log('');
-        console.log(border('┌' + '─'.repeat(innerWidth) + '┐'));
+        console.log(border(`┌${'─'.repeat(innerWidth)}┐`));
         console.log(border('│') + line1 + padTo(line1Plain.length) + border('│'));
         console.log(border('│') + line2 + padTo(line2Plain.length) + border('│'));
-        console.log(border('└' + '─'.repeat(innerWidth) + '┘'));
+        console.log(border(`└${'─'.repeat(innerWidth)}┘`));
         console.log('');
     }
 }
@@ -152,7 +153,7 @@ program
     .option('--json', 'print a machine-readable JSON report and exit (non-interactive, read-only)')
     .option('-c, --check', 'exit non-zero if updates exist, without writing (for CI; read-only)')
     .option('--apply', 'non-interactively write upgrades to package.json and run install (honors .inuprc ignore/exclude)')
-    .option('--target <level>', 'with --apply: how far to bump — minor | patch | latest (default: minor, in-range only)', 'minor')
+    .option('--target <level>', 'with --apply: how far to bump — minor (in-range) | patch (same major.minor only) | latest (default: minor)', 'minor')
     .action(runCli);
 // Handle uncaught errors gracefully
 process.on('uncaughtException', (error) => {

package/dist/{services → features/audit}/background-audit.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BackgroundAuditTracker = void 0;
-const utils_1 = require("../utils");
+const debug_logger_1 = require("../../shared/debug-logger");
 class BackgroundAuditTracker {
     pending = new Map();
     inFlight = new Set();
@@ -20,7 +20,7 @@ class BackgroundAuditTracker {
             added++;
         }
         if (added > 0) {
-            utils_1.debugLog.info('background-audit', `queued ${added} package(s)`);
+            debug_logger_1.debugLog.info('background-audit', `queued ${added} package(s)`);
         }
         return added;
     }

package/dist/features/{headless/vulnerability-audit.js → audit/headless-audit.js}

@@ -36,8 +36,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.auditVulnerabilities = auditVulnerabilities;
 exports.upgradeClears = upgradeClears;
 const semver = __importStar(require("semver"));
-const services_1 = require("../../services");
-const utils_1 = require("../../utils");
+const versions_1 = require("../../shared/versions");
+const vulnerability_checker_1 = require("./vulnerability-checker");
 /**
  * Audit the outdated packages' currently-installed versions (one bulk request, matching the
  * interactive audit) and, for each advisory, cross-reference its affected range against the
@@ -56,7 +56,7 @@ async function auditVulnerabilities(outdated) {
         if (!versions.has(pkg.name))
             versions.set(pkg.name, pkg.currentVersion);
     }
-    const advisories = await (0, services_1.fetchVulnerabilities)(versions);
+    const advisories = await (0, vulnerability_checker_1.fetchVulnerabilities)(versions);
     if (advisories.size === 0)
         return result;
     for (const pkg of outdated) {
@@ -91,16 +91,13 @@ function summarizeVulnerability(pkg, vulnerabilities, highestSeverity) {
  * treats an invalid range as "matches nothing", which would otherwise read as a false "fixed".
  */
 function upgradeClears(target, vulnerableVersions) {
-    const comparable = (0, utils_1.toComparableVersion)(target);
+    const comparable = (0, versions_1.toComparableVersion)(target);
     if (!comparable)
         return false;
+    // validRange rejects unparseable ranges above and comparable is a concrete
+    // version, so satisfies() has valid inputs and never throws here.
     if (semver.validRange(vulnerableVersions) === null)
         return false;
-    try {
-        return !semver.satisfies(comparable, vulnerableVersions, { includePrerelease: true });
-    }
-    catch {
-        return false;
-    }
+    return !semver.satisfies(comparable, vulnerableVersions, { includePrerelease: true });
 }
-//# sourceMappingURL=vulnerability-audit.js.map
+//# sourceMappingURL=headless-audit.js.map

package/dist/features/audit/index.js

@@ -0,0 +1,36 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchVulnerabilities = exports.VulnerabilityAuditController = exports.shouldDisplayVulnerabilityForDependency = exports.selectRepresentativeAdvisory = exports.mergeVulnerabilitySummary = exports.getVulnerabilitySeverityColor = exports.getVulnerabilityLinkLabel = exports.getVulnerabilityBadge = exports.createVulnerabilitySummary = exports.upgradeClears = exports.auditVulnerabilities = exports.BackgroundAuditTracker = void 0;
+var background_audit_1 = require("./background-audit");
+Object.defineProperty(exports, "BackgroundAuditTracker", { enumerable: true, get: function () { return background_audit_1.BackgroundAuditTracker; } });
+var headless_audit_1 = require("./headless-audit");
+Object.defineProperty(exports, "auditVulnerabilities", { enumerable: true, get: function () { return headless_audit_1.auditVulnerabilities; } });
+Object.defineProperty(exports, "upgradeClears", { enumerable: true, get: function () { return headless_audit_1.upgradeClears; } });
+var presenter_1 = require("./presenter");
+Object.defineProperty(exports, "createVulnerabilitySummary", { enumerable: true, get: function () { return presenter_1.createVulnerabilitySummary; } });
+Object.defineProperty(exports, "getVulnerabilityBadge", { enumerable: true, get: function () { return presenter_1.getVulnerabilityBadge; } });
+Object.defineProperty(exports, "getVulnerabilityLinkLabel", { enumerable: true, get: function () { return presenter_1.getVulnerabilityLinkLabel; } });
+Object.defineProperty(exports, "getVulnerabilitySeverityColor", { enumerable: true, get: function () { return presenter_1.getVulnerabilitySeverityColor; } });
+Object.defineProperty(exports, "mergeVulnerabilitySummary", { enumerable: true, get: function () { return presenter_1.mergeVulnerabilitySummary; } });
+Object.defineProperty(exports, "selectRepresentativeAdvisory", { enumerable: true, get: function () { return presenter_1.selectRepresentativeAdvisory; } });
+Object.defineProperty(exports, "shouldDisplayVulnerabilityForDependency", { enumerable: true, get: function () { return presenter_1.shouldDisplayVulnerabilityForDependency; } });
+__exportStar(require("./types"), exports);
+var vulnerability_audit_controller_1 = require("./vulnerability-audit-controller");
+Object.defineProperty(exports, "VulnerabilityAuditController", { enumerable: true, get: function () { return vulnerability_audit_controller_1.VulnerabilityAuditController; } });
+var vulnerability_checker_1 = require("./vulnerability-checker");
+Object.defineProperty(exports, "fetchVulnerabilities", { enumerable: true, get: function () { return vulnerability_checker_1.fetchVulnerabilities; } });
+//# sourceMappingURL=index.js.map

package/dist/{ui/presenters/vulnerability.js → features/audit/presenter.js}

@@ -19,8 +19,6 @@ function getVulnerabilitySeverityColor(severity) {
             return chalk_1.default.red;
         case 'moderate':
             return chalk_1.default.yellow;
-        case 'low':
-        case 'info':
         default:
             return chalk_1.default.gray;
     }
@@ -73,4 +71,4 @@ function mergeVulnerabilitySummary(existing, summary) {
         detailsUrl: existing?.detailsUrl || summary.detailsUrl,
     };
 }
-//# sourceMappingURL=vulnerability.js.map
+//# sourceMappingURL=presenter.js.map

package/dist/{ui/controllers → features/audit}/vulnerability-audit-controller.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VulnerabilityAuditController = void 0;
-const services_1 = require("../../services");
-const vulnerability_1 = require("../presenters/vulnerability");
+const background_audit_1 = require("./background-audit");
+const presenter_1 = require("./presenter");
+const vulnerability_checker_1 = require("./vulnerability-checker");
 class VulnerabilityAuditController {
-    tracker = new services_1.BackgroundAuditTracker();
+    tracker = new background_audit_1.BackgroundAuditTracker();
     cache = new Map();
     drainPromise = null;
     getCachedSummary(packageName, currentVersionSpecifier, type) {
@@ -20,7 +21,7 @@ class VulnerabilityAuditController {
         }));
         const added = this.tracker.enqueue(packages);
         if (added > 0) {
-            this.drain(selectionStates, onUpdate);
+            void this.drain(selectionStates, onUpdate);
         }
     }
     async drain(selectionStates, onUpdate) {
@@ -36,7 +37,7 @@ class VulnerabilityAuditController {
                 }
                 const batchUpdates = [];
                 try {
-                    const vulnerabilityData = await (0, services_1.fetchVulnerabilities)(batch.packages);
+                    const vulnerabilityData = await (0, vulnerability_checker_1.fetchVulnerabilities)(batch.packages);
                     const batchNames = new Set(batch.packageNames);
                     for (const state of selectionStates) {
                         if (!batchNames.has(state.name)) {
@@ -48,13 +49,13 @@ class VulnerabilityAuditController {
                             !vulnerability.highestSeverity) {
                             continue;
                         }
-                        const summary = (0, vulnerability_1.createVulnerabilitySummary)(state.vulnerability, vulnerability.vulnerabilities.map((item) => ({
+                        const summary = (0, presenter_1.createVulnerabilitySummary)(state.vulnerability, vulnerability.vulnerabilities.map((item) => ({
                             id: item.id,
                             title: item.title,
                             severity: item.severity,
                             url: item.url,
                         })), vulnerability.highestSeverity);
-                        const merged = (0, vulnerability_1.mergeVulnerabilitySummary)(state.vulnerability, summary);
+                        const merged = (0, presenter_1.mergeVulnerabilitySummary)(state.vulnerability, summary);
                         this.cache.set(this.getCacheKey(state.name, state.currentVersionSpecifier, state.type), merged);
                         batchUpdates.push({ name: state.name, patch: { vulnerability: merged } });
                     }
@@ -76,9 +77,14 @@ class VulnerabilityAuditController {
             }
         })().finally(() => {
             this.drainPromise = null;
+            // Re-drain guard for work enqueued in the microtask gap between the
+            // loop's final empty reserve and this finally — a real but unschedulable
+            // race window, so it cannot be exercised deterministically in tests.
+            /* v8 ignore start */
             if (this.tracker.getProgress().isRunning) {
-                this.drain(selectionStates, onUpdate);
+                void this.drain(selectionStates, onUpdate);
             }
+            /* v8 ignore stop */
         });
         await this.drainPromise;
         return allUpdates;

package/dist/{services → features/audit}/vulnerability-checker.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fetchVulnerabilities = fetchVulnerabilities;
-const config_1 = require("../config");
-const utils_1 = require("../utils");
+const config_1 = require("../../shared/config");
+const debug_logger_1 = require("../../shared/debug-logger");
 const SEVERITY_ORDER = {
     info: 0,
     low: 1,
@@ -14,8 +14,7 @@ function isKnownSeverity(severity) {
     return severity in SEVERITY_ORDER;
 }
 function getHighestSeverity(vulnerabilities) {
-    if (vulnerabilities.length === 0)
-        return null;
+    // Caller skips empty advisory lists, so there is always at least one entry.
     let highest = 'info';
     for (const vuln of vulnerabilities) {
         if (SEVERITY_ORDER[vuln.severity] > SEVERITY_ORDER[highest]) {
@@ -49,7 +48,7 @@ async function fetchVulnerabilities(packages) {
         return results;
     }
     const url = `${config_1.NPM_REGISTRY_URL}/-/npm/v1/security/advisories/bulk`;
-    utils_1.debugLog.info('vulnerability-checker', `checking ${Object.keys(body).length} packages`);
+    debug_logger_1.debugLog.info('vulnerability-checker', `checking ${Object.keys(body).length} packages`);
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), config_1.REQUEST_TIMEOUT);
     try {
@@ -64,13 +63,13 @@ async function fetchVulnerabilities(packages) {
         });
         clearTimeout(timeoutId);
         if (!response.ok) {
-            utils_1.debugLog.warn('vulnerability-checker', `API returned HTTP ${response.status}`);
+            debug_logger_1.debugLog.warn('vulnerability-checker', `API returned HTTP ${response.status}`);
             return results;
         }
         // Response is keyed by package name, values are arrays of advisories
         const data = (await response.json());
         if (!data || typeof data !== 'object' || Array.isArray(data)) {
-            utils_1.debugLog.warn('vulnerability-checker', 'unexpected API payload shape');
+            debug_logger_1.debugLog.warn('vulnerability-checker', 'unexpected API payload shape');
             return results;
         }
         for (const [packageName, advisories] of Object.entries(data)) {
@@ -114,15 +113,15 @@ async function fetchVulnerabilities(packages) {
                 highestSeverity: getHighestSeverity(unique),
             });
         }
-        utils_1.debugLog.info('vulnerability-checker', `found ${results.size} packages with vulnerabilities`);
+        debug_logger_1.debugLog.info('vulnerability-checker', `found ${results.size} packages with vulnerabilities`);
         return results;
     }
     catch (error) {
         if (error instanceof Error && error.name === 'AbortError') {
-            utils_1.debugLog.warn('vulnerability-checker', 'request timed out');
+            debug_logger_1.debugLog.warn('vulnerability-checker', 'request timed out');
         }
         else {
-            utils_1.debugLog.warn('vulnerability-checker', 'failed to fetch vulnerabilities', error);
+            debug_logger_1.debugLog.warn('vulnerability-checker', 'failed to fetch vulnerabilities', error);
         }
         return results;
     }