refactor(pkg-deps): consume typed dependency-graph fields, drop GenericJSON decoder

[jlitola]

Summary

Migrates package_dependencies off the backend's deprecated GenericJSON fields and onto their typed replacements. Defensive upgrade — the legacy fields are @deprecated but still served, so this is safe to land ahead of removal.

Backend provides typed siblings for all four legacy fields:

Legacy (GenericJSON)	Typed replacement
transitive.dag	transitive.dependencyGraph ({formatVersion, nodes, edges} with indexed edges)
transitive.conflicts	transitive.dependencyConflicts (importer identity fixed — no more from: \"npm\" bug)
transitive.circularDependencies	transitive.circularDependencyCycles (pre-joined displayChain)
dependencyGroups.environmentConstraints	dependencyGroups.environmentMarkers ({type, value, raw})

Changes

Service layer (package-intelligence-service.ts):

• New exported types: DependencyGraph / DependencyGraphNode / DependencyGraphEdge, DependencyConflict / DependencyConflictEdge, CircularDependencyCycle, EnvironmentMarker.
• TransitiveDependencySummary drops the four GenericJSON fields, gains typed ones. DependencyGroupsInfo.environmentConstraints → environmentMarkers.
• PACKAGE_DEPENDENCIES_QUERY selects typed fields only.
• UntypedGenericJSON type retained for ChangelogEntryDetail.metadata (the one remaining passthrough).

Envelope builder (package-dependencies-response.ts):

• Loses ~100 lines of decodeDag / decodeNodes / decodeEdges / decodeObjectNode + tuple-vs-object format tolerance. Replaced with straight field access on the typed graph.
• buildDirectVersionLookup and buildTransitivePackages walk the typed graph. fromIndex: null (synthetic-root edges) handled explicitly so version resolution still works on packages with synthetic-root DAGs.
• buildTypedConflicts / decodeConflictEntryForEnvelope / buildTypedCycles / decodeCycleEntryForEnvelope + raw-fallback machinery collapse to straight .map() calls.

Terminal formatter:

• formatConflictsAndCycles: drops the isTypedConflictArray / isTypedCycleArray guards and JSON-blob fallbacks. Conflict table + cycle chain rendering behaviour preserved.
• groups.environmentMarkers under --verbose upgrades from JSON.stringify per marker to type: value one-liners (e.g. `extra: async`, `python_version: >= 3.8`).

Public envelope shape

Preserved where possible, one rename:

• transitive.conflicts: {name, requiredVersions}[] — unchanged.
• transitive.circularDependencies: {cycle: string[]}[] — unchanged.
• groups.environmentConstraints: UntypedGenericJSON[] → renamed to groups.environmentMarkers: {type?, value?, raw?}[]. Clean break — the rename matches the typed concept and the backend field name; consumers branch on the presence of the new field.

The typed dependencyGraph sits on the service-level result for a future pkg deps-dag command; this tool's envelope deliberately doesn't surface it, consistent with the existing design commitment.

Testing

• 1326 tests pass (bun test).
• Test fixtures migrated from legacy tuple/object DAG shapes to typed form.
• Raw-fallback / garbage-shape tolerance tests removed — no longer reachable under typed-only input.
• Typecheck / lint / build clean.

Live-smoke (production pkgseer)

• pkg deps npm:express --transitive --verbose — 28 direct + 67 transitive packages resolved; per-package importer provenance renders correctly (- ^2.0.0 required by express@5.2.1).
• pkg deps npm:jest --transitive --verbose — all 16 known conflicts render in the conflicts table (ansi-regex: ^5.0.1, ^6.2.2, …).
• pkg deps pypi:requests --groups --verbose — PyPI extras (socks, use-chardet-on-py3) render with (optional, extra) tails.
• --json: runtime.items[].version resolves from the typed graph; transitive.dependencyGraph and legacy dag both absent from the envelope.

Test plan

• bun test passes (1326 / 0)
• bun run typecheck / bun run build / bun run lint clean
• Live-smoke against production pkgseer on npm / PyPI (conflicts, cycles, extras)
• Legacy GenericJSON fields no longer referenced from source or tests

🤖 Generated with Claude Code