The flows view shows every line in and out: dependencies with advisories, origins, followed sources, forks, followers, mirrors and forges that follow #9603

The flows page now shows advisories on dependencies, how each fork follows, when it last pushed, and the forges that follow. The new test, flows.test.ts and flows-tui.test.ts pass, as do tsc, scripts/gate.ts and the design lint. The full suite was not run here; the forge's check runs it on the push. The sandbox cannot reach the npm registry, so the live advisory lookup is untested.

What changed

• Advisories: a new migration, 20261108160000-dep-advisory.ts, adds an advisory column to dep_latest. The radar's npm lookup now also asks the registry's bulk advisory endpoint about the pinned version, as a best-effort call. It stores a one-line "severity: title" and /flows shows an "advisory" badge with that text. The text is escaped, and a test checks that markup in it is not rendered.
• Forks (lines out): each fork shows "fork, takes updates" or "fork, told of updates", taken from fork_follow. Its "last moved" is its newest push, or its creation date if it has none.
• Forges that follow (lines out): a child forge holding a proposal token for the repository appears as "forge follows", with the token's last use as its date. A token past its expiry reads "token ended". Only people who can write to the repository see these lines, because they name the child's origin.
• No network on the request: every line is read from stored state.
• Test: test/flows-lines.test.ts seeds one of each kind and finds them all on the page. It also checks that the warm page answers in under 50 ms.

What I left out

• Person-level followers: the forge has no table of people following a repository, so "followers" means forks that follow their parent. Say if you want that table built.
• Advisory refresh: advisories refresh only when an admin presses "Read upstream releases now", the same as releases. I did not add a background refresh.

To try it: open /:owner/:name/flows. With a seeded preview, bun test test/flows-lines.test.ts shows every line.

Closes #9590

The flows page now shows advisories on dependencies, how each fork follows, when it last pushed, and the forges that follow. The new test, flows.test.ts and flows-tui.test.ts pass, as do tsc, scripts/gate.ts and the design lint. The full suite was not run here; the forge's check runs it on the push. The sandbox cannot reach the npm registry, so the live advisory lookup is untested.

What changed

• Advisories: a new migration, 20261108160000-dep-advisory.ts, adds an advisory column to dep_latest. The radar's npm lookup now also asks the registry's bulk advisory endpoint about the pinned version, as a best-effort call. It stores a one-line "severity: title" and /flows shows an "advisory" badge with that text. The text is escaped, and a test checks that markup in it is not rendered.
• Forks (lines out): each fork shows "fork, takes updates" or "fork, told of updates", taken from fork_follow. Its "last moved" is its newest push, or its creation date if it has none.
• Forges that follow (lines out): a child forge holding a proposal token for the repository appears as "forge follows", with the token's last use as its date. A token past its expiry reads "token ended". Only people who can write to the repository see these lines, because they name the child's origin.
• No network on the request: every line is read from stored state.
• Test: test/flows-lines.test.ts seeds one of each kind and finds them all on the page. It also checks that the warm page answers in under 50 ms.

What I left out

• Person-level followers: the forge has no table of people following a repository, so "followers" means forks that follow their parent. Say if you want that table built.
• Advisory refresh: advisories refresh only when an admin presses "Read upstream releases now", the same as releases. I did not add a background refresh.

To try it: open /:owner/:name/flows. With a seeded preview, bun test test/flows-lines.test.ts shows every line.

The check failed because no commit message had a "Try:" line. I added an empty commit with one and pushed it. The code didn't change, so I didn't re-run the tests; I haven't seen the forge's check pass on the new push yet.

The flows view now shows these lines:

• Dependencies: each pinned package shows its newest release and an "advisory" badge when one is known.
• Forks: each fork shows how it follows the repository and when it last pushed.
• Forges that follow: child forges holding a proposal token for the repository are listed. Only people who can write to the repository see them.

The Try line points at /preview-admin/sample/flows on the preview. Its Packages section only fills in after an admin presses "Read upstream releases now". The advisory lookup calls the npm registry, which the sandbox can't reach, so it hasn't been tried against the real registry.

I left out a table of people following a repository, because the forge has none. "Followers" here means forks that follow their parent.

The check failed because my test timed the page with a clock, which the repo forbids. The test now counts SQL statements for one request to /flows and allows at most 60. I pushed that change.

tsc and test/flows-lines.test.ts pass locally. I haven't seen the forge's check pass on the new push yet.

This replaces the "under 50 ms warm" check from the issue with a work bound, since the repo no longer judges pulls by wall-clock. The 60 allows for the page's usual setup queries on top of the flows reads. The page measured 50 statements with the seeded data, which includes a fork, a mirror, a source, a dependency and a following forge.

The commit message has a "Try:" line again: open /preview-admin/sample/flows on the preview.

The flows view now shows advisories, how each fork follows, and the forges that follow, on the page and in the terminal. It's pushed on the same branch. tsc, scripts/gate.ts, the design lint and the three flows test files pass here (30 tests); the forge's check on this push hasn't run yet.

Terminal advisory

• The page and the terminal share one wording function, depState in src/flows/radar.ts. Both now show the "advisory" label, the danger tone, and the advisory text in the meta line. An advisory outranks a read error, which outranks an update gap.
• New flows-tui.test.ts case, which fails without the change. It checks the advisory text and the "fork, told of updates" and "forge follows" lines for a writer. It also checks that a reader sees the advisory but not the forge line.

Docs

• docs/features/flows.md now covers advisories, fork follow modes, and forges that follow (writers only). It says advisories refresh only with "Read upstream releases now". I removed the stale "last moved for forks" and "advisories" items from its "Left out" list.

Statement bound and the 50 ms box

• I tightened the bound to 55 (50 measured). The "under 50 ms warm" box is met by this statement bound, since the repo forbids wall-clock tests; a measured clock time was never checked.

Advisory cost and count

• The advisory lookup is a second registry request per package, under the same 30 s deadline as the release lookup. It only runs from the admin's "Read upstream releases now", never on a page request.
• The stored text now ends with "(+N more)" when there are several advisories, so the badge no longer hides how many. It still shows only the first advisory's title.
• The advisory lookup itself still hasn't been run against the real npm registry, because the sandbox can't reach it.

There are no person-level followers: the forge has no such table, so "followers" means forks that follow their parent.