feat/health-signal-and-npm-only (#49)

* feat(cli): headless-friendly quick-wins and hygiene

    - Detect Bun's text lockfile (bun.lock), not just the binary bun.lockb
    - Add --no-color (also honors NO_COLOR / FORCE_COLOR) and stop emitting the
      raw terminal-background escape when color is disabled, so the TUI inherits
      the user's own terminal background
    - Add --save-exact to write bare versions instead of preserving the ^/~ range
      prefix
    - Add a Dependabot config and a `pnpm audit` step in CI (dogfooding)

* feat(health): npm-only resolution + deprecation & engines signals

Resolve package data from the npm registry only and drop the jsDelivr layer
(unreliable for this tool due to aggressive CDN caching): remove the
version-data fallback, the package-manifest fetch, and the CHANGELOG.md
fallback. On exhausted retries a package is now reported as unavailable
rather than served from a stale CDN; changelog text comes from GitHub
releases.

Surface per-version `deprecated` and `engines.node` straight from the
abbreviated packument inup already fetches (zero extra requests):
- [DEPR] / [ENG] badges in the package list
- amber warning rows in the package-info modal; the deprecation message wraps
  so its URL stays whole and clickable

* ci(github): remove dependency audit step from CI

* chore(deps): remove Dependabot configuration

Author: donfear

.github/dependabot.yml

@@ -1,9 +1,5 @@
 export { PACKAGE_NAME, PACKAGE_VERSION } from './package-meta'
 export const NPM_REGISTRY_URL = 'https://registry.npmjs.org'
-export const JSDELIVR_CDN_URL = 'https://cdn.jsdelivr.net/npm'
 export const MAX_CONCURRENT_REQUESTS = 150
 export const CACHE_TTL = 5 * 60 * 1000 // 5 minutes in milliseconds
 export const REQUEST_TIMEOUT = 60000 // 60 seconds in milliseconds
-export const JSDELIVR_RETRY_TIMEOUTS = [2000, 3500] // short retry budget to keep fallback fast
-export const JSDELIVR_RETRY_DELAYS = [150] // tiny backoff between jsDelivr retries in ms
-export const JSDELIVR_POOL_TIMEOUT = 60000 // keep-alive/connect lifecycle should be looser than per-request timeouts

src/config/constants.ts

@@ -350,6 +350,8 @@ export class PackageDetector {
           hasRangeUpdate,
           hasMajorUpdate,
           allVersions,
+          deprecated: packageData.deprecated,
+          enginesNode: packageData.enginesNode,
         }
       } catch (error) {
         debugLog.error('PackageDetector', `error processing ${dep.name}`, error)

src/core/package-detector.ts

@@ -1,17 +1,13 @@
 import { NpmRegistryClient } from '../clients/npm-registry-client'
 import { mapPackageManifestToMetadata } from '../parsers/package-metadata'
 import { PackageManifestInput, PackageMetadata } from '../types/changelog.types'
-import { fetchExactPackageManifest } from '../../../services/jsdelivr-registry'
 import { InflightMap } from '../../../services/http/inflight'
 
 export class PackageMetadataService {
   private cache = new Map<string, PackageMetadata | null>()
   private inFlight = new InflightMap<PackageMetadata | null>()
 
-  constructor(
-    private readonly npmRegistryClient = new NpmRegistryClient(),
-    private readonly exactManifestFetcher = fetchExactPackageManifest
-  ) {}
+  constructor(private readonly npmRegistryClient = new NpmRegistryClient()) {}
 
   clearCache(): void {
     this.cache.clear()
@@ -119,19 +115,9 @@ export class PackageMetadataService {
   ): Promise<Record<string, unknown> | null> {
     signal?.throwIfAborted()
 
-    const normalizedVersion = version?.trim()
-    if (normalizedVersion) {
-      const jsdelivrManifest = await this.exactManifestFetcher(packageName, normalizedVersion)
-      if (jsdelivrManifest) {
-        return jsdelivrManifest
-      }
-    }
-
-    signal?.throwIfAborted()
-
     return await this.npmRegistryClient.fetchPackageManifest(
       packageName,
-      normalizedVersion || 'latest',
+      version?.trim() || 'latest',
       signal
     )
   }

src/features/changelog/services/package-metadata-service.ts

@@ -3,7 +3,6 @@ import { GitHubClient } from '../clients/github-client'
 import { extractVersionSection, normalizeReleaseTag } from '../parsers/changelog-parser'
 import { extractReleaseNotesFromHtml } from '../parsers/github-release-html-parser'
 import { PackageMetadataService } from './package-metadata-service'
-import { JSDELIVR_CDN_URL } from '../../../config/constants'
 
 const RELEASE_NOTES_FETCH_TIMEOUT_MS = 5000
 const PREFER_GITHUB_RELEASE_PAGE = true
@@ -74,9 +73,6 @@ export class ReleaseNotesService {
       }
     }
 
-    const changelogNotes = await this.fetchJsdelivrChangelog(packageName, version, signal)
-    if (changelogNotes) return changelogNotes
-
     return null
   }
 
@@ -167,40 +163,4 @@ export class ReleaseNotesService {
     return extractVersionSection(fullText, version)
   }
 
-  private async fetchJsdelivrChangelog(
-    packageName: string,
-    version: string,
-    signal: AbortSignal
-  ): Promise<string | null> {
-    const fullText = await this.fetchPublishedPackageChangelog(packageName, version, signal)
-    if (!fullText) return null
-
-    return extractVersionSection(fullText, version)
-  }
-
-  private async fetchPublishedPackageChangelog(
-    packageName: string,
-    version: string,
-    signal: AbortSignal
-  ): Promise<string | null> {
-    try {
-      const response = await fetch(
-        `${JSDELIVR_CDN_URL}/${encodeURIComponent(packageName)}@${version}/CHANGELOG.md`,
-        {
-          method: 'GET',
-          signal,
-        }
-      )
-
-      if (!response.ok) return null
-
-      return await response.text()
-    } catch (error) {
-      if (error instanceof DOMException && error.name === 'AbortError') {
-        throw error
-      }
-
-      return null
-    }
-  }
 }

src/features/changelog/services/release-notes-service.ts

@@ -3,7 +3,6 @@
  */
 
 export * from './npm-registry'
-export * from './jsdelivr-registry'
 export * from '../features/changelog'
 export * from './version-checker'
 export * from './vulnerability-checker'