@gjermundgaraba/upup 0.5.0 → 0.5.2

package/dist/main.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as openFlags, r as reason, t as byName } from "./io-ns6xhFdF.mjs";
+import { i as reason, n as decodeUtf8, r as openFlags, t as byName } from "./io-Dgi-IiVu.mjs";
 import { findPackageJSON } from "node:module";
 import { NodeRuntime, NodeServices, NodeStdio } from "@effect/platform-node";
 import { Cause, Clock, Config, Context, Data, Deferred, Duration, Effect, Equal, Exit, Fiber, FiberHandle, FiberSet, FileSystem, Layer, Option, Predicate, Queue, Ref, Result, Schedule, Schema, Semaphore, Stream, SubscriptionRef, identity } from "effect";
@@ -19,6 +19,7 @@ import lockfile from "proper-lockfile";
 import { BACKGROUND_CONTEXT, withAbortSignal } from "@earendil-works/chord/context";
 import { GenerationTask, Harness, LiveDoc, ROOT_CONVERSATION_ID, ToolTask, createRegistry, defineDoc, defineExtension, defineTool, hook, section } from "@earendil-works/pi-durable";
 import { openNodeSqliteStorage } from "@earendil-works/pi-durable/storage/sqlite/node";
+import { absurd, constVoid } from "effect/Function";
 import { ChildProcess, ChildProcessSpawner, CommandLine } from "effect/process";
 import { Worker } from "node:worker_threads";
 import semver from "semver";
@@ -33,16 +34,14 @@ import { bundleFromJSON, isBundleWithDsseEnvelope } from "@sigstore/bundle";
 import { getTrustedRoot } from "@sigstore/tuf";
 import { Verifier, toSignedEntity, toTrustMaterial } from "@sigstore/verify";
 import { isDeepStrictEqual } from "node:util";
-import { constVoid } from "effect/Function";
 import { applyEdits, modify, parse as parse$1 } from "jsonc-parser";
 import { getStaticTOMLValue, parseTOML, traverseNodes } from "toml-eslint-parser";
 import { XMLParser } from "fast-xml-parser";
-import { isSea } from "node:sea";
 import * as ActionMcp from "@gjermundgaraba/effect-actions/ActionMcp";
 import * as Action from "@gjermundgaraba/effect-actions/Action";
 import { setup, types } from "xstate/fsm";
 // package.json
-var version$1 = "0.5.0";
+var version$1 = "0.5.2";
 // src/ai/Setup.ts
 const Thinking = Schema.Literals([
 	"off",
@@ -428,13 +427,15 @@ const withTarget = (pkg, target) => ({
 const isUnaudited = Schema.is(UnauditedEcosystem);
 const isApp$1 = Schema.is(AppEcosystem);
 const isRuntime = Schema.is(RuntimeEcosystem);
+const isOs = Schema.is(OsEcosystem);
 const isUnauditedUpdate = (pkg) => isUnaudited(pkg.ecosystem);
 const isAppUpdate = (pkg) => isApp$1(pkg.ecosystem);
-const unauditedKind = (pkg) => {
-	if (isApp$1(pkg.ecosystem)) return "app";
-	if (isRuntime(pkg.ecosystem)) return "runtime";
-	if (isUnaudited(pkg.ecosystem)) return "os";
+const ecosystemKind = (ecosystem) => {
+	if (isApp$1(ecosystem)) return "app";
+	if (isRuntime(ecosystem)) return "runtime";
+	return isOs(ecosystem) ? "os" : absurd(ecosystem);
 };
+const unauditedKind = (pkg) => isUnaudited(pkg.ecosystem) ? ecosystemKind(pkg.ecosystem) : void 0;
 // src/inventory/Provider.ts
 var OutputMalformed = class extends Schema.TaggedError()("OutputMalformed", {
 	command: Schema.String,
@@ -560,7 +561,8 @@ const layer$6 = Layer.effect(Exec, Effect.gen(function* () {
 const nodeLayer = layer$6.pipe(Layer.provide(NodeServices.layer));
 // src/brew/Brew.ts
 const caskPrefix = "cask:";
-const isCask = (pkg) => pkg.id.startsWith(caskPrefix);
+const Kind = Schema.Literals(["formula", "cask"]);
+const kindOf$2 = (pkg) => pkg.id.startsWith(caskPrefix) ? "cask" : "formula";
 const Keg = Schema.Struct({
 	version: Schema.String,
 	installed_on_request: Schema.Boolean,
@@ -604,13 +606,12 @@ const Outdated$1 = Schema.Struct({
 	formulae: Schema.Array(OutdatedEntry),
 	casks: Schema.Array(OutdatedEntry)
 });
-const brew$1 = (args, refreshMetadata = false) => ({
+const brew = (args, refreshMetadata = false) => ({
 	command: "brew",
 	args,
 	cwd: "/",
 	env: refreshMetadata ? {} : { HOMEBREW_NO_AUTO_UPDATE: "1" }
 });
-const kindOf$2 = (pkg) => pkg.id.startsWith("cask:") ? "cask" : "formula";
 const activeKeg = (formula) => formula.installed.find((keg) => keg.version === formula.linked_keg) ?? formula.installed.at(-1);
 const describedAs = (desc) => desc === void 0 || desc === null || desc === "" ? {} : { description: desc };
 const packages = (installed, outdated) => {
@@ -657,19 +658,19 @@ const make$14 = Effect.gen(function* () {
 	const exec = yield* Exec;
 	const json = (schema, invocation) => exec.stdout(invocation).pipe(Effect.flatMap(decodeJson(schema, commandLine(invocation))));
 	const list = Effect.gen(function* () {
-		const installed = yield* json(Installed, brew$1([
+		const installed = yield* json(Installed, brew([
 			"info",
 			"--json=v2",
 			"--installed"
 		]));
-		const outdated = yield* json(Outdated$1, brew$1(["outdated", "--json=v2"], true));
+		const outdated = yield* json(Outdated$1, brew(["outdated", "--json=v2"], true));
 		return {
 			packages: packages(installed, outdated),
 			notices: []
 		};
 	}).pipe(Effect.withSpan("Brew.list"));
 	const observe = Effect.fn("Brew.observe")(function* (pkg) {
-		const installed = yield* json(Installed, brew$1([
+		const installed = yield* json(Installed, brew([
 			"info",
 			"--json=v2",
 			`--${kindOf$2(pkg)}`,
@@ -682,7 +683,7 @@ const make$14 = Effect.gen(function* () {
 		return Option.fromUndefinedOr(observed.find((candidate) => candidate.id === pkg.id));
 	});
 	const offered = Effect.fn("Brew.offered")(function* (pkg) {
-		const invocation = brew$1([
+		const invocation = brew([
 			"outdated",
 			"--json=v2",
 			`--${kindOf$2(pkg)}`,
@@ -710,14 +711,14 @@ const make$14 = Effect.gen(function* () {
 				expected: target,
 				...now === void 0 ? {} : { offered: now }
 			});
-			yield* exec.stdout(brew$1([
+			yield* exec.stdout(brew([
 				"upgrade",
 				`--${kindOf$2(pkg)}`,
 				pkg.name
 			]));
 		}),
 		uninstall: Effect.fn("Brew.uninstall")(function* (pkg) {
-			yield* exec.stdout(brew$1([
+			yield* exec.stdout(brew([
 				"uninstall",
 				`--${kindOf$2(pkg)}`,
 				pkg.name
@@ -762,65 +763,88 @@ const Report = Schema.Struct({
 	findings: Schema.Array(Finding),
 	unverified: Schema.Array(Schema.String).annotate({ description: "Each thing you could not verify." })
 });
+const Context$1 = Schema.TaggedUnion({
+	None: {},
+	Brew: { kind: Kind },
+	Python: { python: Schema.String },
+	Revision: { revision: Schema.String }
+});
+const sameContext = Schema.toEquivalence(Context$1);
 Schema.Struct({
 	mode: Mode,
 	delta: Delta,
-	context: Schema.Record(Schema.String, Schema.String)
+	context: Context$1
 });
 var ChangesUnavailable = class extends Schema.TaggedError()("ChangesUnavailable", { issue: Schema.String }) {};
 const isRegistry = Schema.is(RegistryEcosystem);
-const deltaOf = (pkg) => pkg.target === void 0 || !isRegistry(pkg.ecosystem) ? void 0 : {
-	ecosystem: pkg.ecosystem,
-	artifact: pkg.artifact,
-	from: pkg.current,
-	to: pkg.target
-};
 const contextOf = (pkg) => {
-	if (pkg.ecosystem === "brew") return { kind: isCask(pkg) ? "cask" : "formula" };
-	if (pkg.ecosystem === "pypi" && pkg.runtime !== void 0) return { python: pkg.runtime };
-	if (pkg.ecosystem === "github-actions" && pkg.revision !== void 0) return { revision: pkg.revision };
-	return {};
+	if (pkg.ecosystem === "brew") return {
+		_tag: "Brew",
+		kind: kindOf$2(pkg)
+	};
+	if (pkg.ecosystem === "pypi" && pkg.runtime !== void 0) return {
+		_tag: "Python",
+		python: pkg.runtime
+	};
+	if (pkg.ecosystem === "github-actions" && pkg.revision !== void 0) return {
+		_tag: "Revision",
+		revision: pkg.revision
+	};
+	return { _tag: "None" };
+};
+const unauditedReasons = {
+	app: "an app update",
+	runtime: "a Node.js runtime version",
+	os: "an operating-system update"
+};
+const registryOf = (pkg) => {
+	if (!isRegistry(pkg.ecosystem)) return Result.fail(`it is ${unauditedReasons[ecosystemKind(pkg.ecosystem)]}, which upup does not audit`);
+	return pkg.privateRegistry === void 0 ? Result.succeed(pkg.ecosystem) : Result.fail(`it comes from the private registry ${pkg.privateRegistry}, which upup does not audit`);
+};
+const deltaOf = (pkg) => {
+	const { target } = pkg;
+	return target === void 0 ? Result.fail("no update is offered") : Result.map(registryOf(pkg), (ecosystem) => ({
+		ecosystem,
+		artifact: pkg.artifact,
+		from: pkg.current,
+		to: target
+	}));
 };
-const landingOf = (pkg, mode) => pkg.privateRegistry === void 0 && isRegistry(pkg.ecosystem) ? {
+const auditOf = (pkg, mode) => Result.map(deltaOf(pkg), (delta) => ({
 	mode,
-	ecosystem: pkg.ecosystem,
+	delta,
+	context: contextOf(pkg)
+}));
+const identityOf = (pkg, mode) => Result.getOrUndefined(auditOf(pkg, mode));
+const unauditable = (pkg) => Result.getOrUndefined(Result.flip(deltaOf(pkg)));
+const landingOf = (pkg, mode) => Result.getOrUndefined(Result.map(registryOf(pkg), (ecosystem) => ({
+	mode,
+	ecosystem,
 	artifact: pkg.artifact,
 	version: pkg.current,
 	context: contextOf(pkg)
-} : void 0;
+})));
+const landingAt = (identity) => ({
+	mode: identity.mode,
+	ecosystem: identity.delta.ecosystem,
+	artifact: identity.delta.artifact,
+	version: identity.delta.to,
+	context: identity.context
+});
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 const landingKey = (landing) => sha256(JSON.stringify([
 	landing.ecosystem,
 	landing.artifact,
 	landing.version,
-	Object.entries(landing.context).toSorted(([left], [right]) => left.localeCompare(right))
+	landing.context
 ]));
-const unauditedReasons = {
-	app: "an app update",
-	runtime: "a Node.js runtime version",
-	os: "an operating-system update"
-};
-const unauditable = (pkg) => {
-	if (pkg.target === void 0) return "no update is offered";
-	const kind = unauditedKind(pkg);
-	if (kind !== void 0) return `it is ${unauditedReasons[kind]}, which upup does not audit`;
-	return pkg.privateRegistry === void 0 ? void 0 : `it comes from the private registry ${pkg.privateRegistry}, which upup does not audit`;
-};
-const identityOf = (pkg, mode) => {
-	const delta = deltaOf(pkg);
-	return delta === void 0 || pkg.privateRegistry !== void 0 ? void 0 : {
-		mode,
-		delta,
-		context: contextOf(pkg)
-	};
-};
 const deltaKey = (delta) => sha256(JSON.stringify([
 	delta.ecosystem,
 	delta.artifact,
 	delta.from,
 	delta.to
 ]));
-const workspaceKey = (identity) => sha256(JSON.stringify([deltaKey(identity.delta), Object.entries(identity.context).toSorted(([left], [right]) => left.localeCompare(right))]));
+const workspaceKey = (identity) => sha256(JSON.stringify([deltaKey(identity.delta), identity.context]));
 // src/audit/tools.ts
 const limits$1 = {
 	resultBytes: 262144,
@@ -833,16 +857,6 @@ const limits$1 = {
 	longLineMatches: 1025
 };
 const grepTimeoutMs = 3e4;
-const names$1 = {
-	read: "read",
-	grep: "grep",
-	list: "list"
-};
-const descriptions = {
-	read: "Read a bounded byte range from one regular UTF-8 file.",
-	grep: "Find a JavaScript regular expression in UTF-8 regular files below a path. Each line is matched whole. Lines over 1 KiB show a bounded window around each match with its file byte offset; a file stops at a line over 16 MiB.",
-	list: "List workspace entries below a directory to a bounded depth."
-};
 const count$1 = (maximum) => Schema.Number.pipe(Schema.check(Schema.isInt(), Schema.isBetween({
 	minimum: 1,
 	maximum
@@ -895,7 +909,6 @@ const respond = async (signal, run) => {
 const checkPath = (name) => {
 	if (!(name === "." || name !== "" && !name.includes("\\") && !name.includes("\0") && name.split("/").every((segment) => segment !== "" && segment !== "." && segment !== ".."))) fail$1(`path ${JSON.stringify(name)} is not workspace-relative`);
 };
-const isCount = (value, min, max) => Number.isSafeInteger(value) && value >= min && value <= max;
 const kindOf$1 = (info) => {
 	if (info.isFile()) return "file";
 	return info.isDirectory() ? "directory" : "other";
@@ -931,20 +944,9 @@ const trimIncompleteUtf8 = (data) => {
 		return data;
 	}
 };
-const decodeUtf8 = (data) => {
-	try {
-		return new TextDecoder("utf-8", {
-			fatal: true,
-			ignoreBOM: true
-		}).decode(data);
-	} catch {
-		return;
-	}
-};
 const read$2 = async (workspace, args, signal) => await respond(signal, async () => {
 	const name = args.path;
 	checkPath(name);
-	if (!isCount(args.offset, 0, Number.MAX_SAFE_INTEGER) || !isCount(args.limit, 1, limits$1.readBytes)) fail$1("offset or limit is outside the allowed range");
 	const located = await locate$4(workspace, name, `open ${name}`);
 	if (located.kind !== "file") fail$1("path is not a regular file");
 	signal?.throwIfAborted();
@@ -978,7 +980,6 @@ const read$2 = async (workspace, args, signal) => await respond(signal, async ()
 });
 const list = async (workspace, args, signal) => await respond(signal, async () => {
 	checkPath(args.path);
-	if (!isCount(args.depth, 1, limits$1.listDepth)) fail$1("depth is outside the allowed range");
 	const located = await locate$4(workspace, args.path, `list workspace: walk ${args.path}`);
 	if (located.kind !== "directory") return "no entries";
 	let result = "";
@@ -1005,7 +1006,7 @@ const list = async (workspace, args, signal) => await respond(signal, async () =
 	return result === "" ? "no entries" : result;
 });
 const decodeAnswer = Schema.decodeUnknownOption(Schema.Union([Schema.Struct({ text: Schema.String }), Schema.Struct({ error: Schema.String })]));
-const grepWorker = process.env["UPUP_GREP_WORKER"] ?? new URL(`grep-worker${path.extname(new URL(import.meta.url).pathname)}`, import.meta.url);
+const grepWorker = new URL(`grep-worker${path.extname(new URL(import.meta.url).pathname)}`, import.meta.url);
 const search = async (job, timeoutMs, signal) => {
 	const { promise, resolve, reject } = Promise.withResolvers();
 	const worker = new Worker(grepWorker);
@@ -1063,15 +1064,29 @@ const ends = (offset, limit) => {
 	const [from, to] = [span(offset), span(offset + limit)];
 	return from === to ? `${from} +${span(limit)}` : `${from}–${to}`;
 };
+const tool = (description, Args, run, detail) => {
+	const decode = Schema.decodeUnknownSync(Args);
+	return {
+		description,
+		Args,
+		call: async (workspace, args, signal) => await run(workspace, decode(args), signal),
+		detail
+	};
+};
+const tools$3 = {
+	read: tool("Read a bounded byte range from one regular UTF-8 file.", ReadArgs, read$2, ({ path: shown, range }) => `${shown}${range}`),
+	grep: tool("Find a JavaScript regular expression in UTF-8 regular files below a path. Each line is matched whole. Lines over 1 KiB show a bounded window around each match with its file byte offset; a file stops at a line over 16 MiB.", GrepArgs, async (workspace, args, signal) => await grep(workspace, args, signal === void 0 ? {} : { signal }), ({ path: shown, pattern }) => `${pattern} ${shown}`),
+	list: tool("List workspace entries below a directory to a bounded depth.", ListArgs, list, ({ path: shown }) => shown)
+};
+const isTool = (name) => Object.hasOwn(tools$3, name);
 const describeCall = (name, args) => {
-	if (!Predicate.isObject(args)) return name;
+	if (!Predicate.isObject(args) || !isTool(name)) return name;
 	const { path: target, pattern, offset, limit } = args;
-	const shownPath = Predicate.isString(target) ? target : "";
-	const range = Predicate.isNumber(offset) && Predicate.isNumber(limit) ? `  bytes ${ends(offset, limit)}` : "";
-	let detail = "";
-	if (name === names$1.read) detail = `${shownPath}${range}`;
-	else if (name === names$1.list) detail = shownPath;
-	else if (name === names$1.grep) detail = `${Predicate.isString(pattern) ? pattern : ""} ${shownPath}`;
+	const detail = tools$3[name].detail({
+		path: Predicate.isString(target) ? target : "",
+		pattern: Predicate.isString(pattern) ? pattern : "",
+		range: Predicate.isNumber(offset) && Predicate.isNumber(limit) ? `  bytes ${ends(offset, limit)}` : ""
+	});
 	return detail === "" ? name : `${name} ${detail}`;
 };
 // src/audit/hashed-names.ts
@@ -1729,7 +1744,7 @@ const Meta = Schema.Struct({
 	ecosystem: Delta.fields.ecosystem,
 	from: Schema.String,
 	to: Schema.String,
-	context: Schema.Record(Schema.String, Schema.String),
+	context: Context$1,
 	evidence: Grade,
 	evidence_detail: Schema.String,
 	preparation_key: Schema.String
@@ -1740,7 +1755,7 @@ const failed$1 = (workspace) => (cause) => new WorkspaceFailed({
 	issue: cause instanceof Error ? cause.message : String(cause)
 });
 const listed$2 = async (workspace, name) => await readFile(path.join(workspace, name), "utf-8").catch(() => void 0);
-const write = (workspace, identity, diff, evidence, detail, preparationKey) => Effect.tryPromise({
+const write = (workspace, identity, { diff, evidence, detail }, preparationKey) => Effect.tryPromise({
 	try: async () => {
 		await writeFile(path.join(workspace, files.diff), diff, { mode: 384 });
 		await writeFile(path.join(workspace, files.index), buildIndex(diff), { mode: 384 });
@@ -1763,7 +1778,6 @@ const readMeta = (workspace) => Effect.tryPromise({
 	try: async () => await readFile(path.join(workspace, files.meta), "utf-8"),
 	catch: failed$1(workspace)
 }).pipe(Effect.flatMap((text) => Schema.decodeEffect(MetaJson)(text).pipe(Effect.mapError(failed$1(workspace)))));
-const sameContext = (left, right) => JSON.stringify(Object.entries(left).toSorted(([a], [b]) => a.localeCompare(b))) === JSON.stringify(Object.entries(right).toSorted(([a], [b]) => a.localeCompare(b)));
 const describes = (meta, identity) => meta.name === identity.delta.artifact && meta.ecosystem === identity.delta.ecosystem && meta.from === identity.delta.from && meta.to === identity.delta.to && sameContext(meta.context, identity.context);
 const readable = (workspace, identity) => readMeta(workspace).pipe(Effect.flatMap((meta) => describes(meta, identity) ? Effect.promise(async () => await stat(path.join(workspace, files.diff)).then(() => true, () => false)) : Effect.succeed(false)), Effect.orElseSucceed(() => false));
 const prune = (workspace) => Effect.promise(async () => {
@@ -1907,7 +1921,7 @@ const Brief = Schema.Struct({
 	artifact: Schema.String,
 	from: Schema.String,
 	to: Schema.String,
-	context: Schema.Record(Schema.String, Schema.String),
+	context: Context$1,
 	workspace: Schema.String,
 	evidence: Grade,
 	evidenceDetail: Schema.String,
@@ -1928,9 +1942,6 @@ const BriefDoc = defineDoc({
 	checkpointWhen: () => false
 });
 const parameters = (schema) => Schema.toJsonSchemaDocument(schema).schema;
-const decodeRead = Schema.decodeUnknownSync(ReadArgs);
-const decodeGrep = Schema.decodeUnknownSync(GrepArgs);
-const decodeList = Schema.decodeUnknownSync(ListArgs);
 const decodeSubmitted = Schema.decodeUnknownSync(Report);
 const encodeReport = (submitted) => ({
 	...submitted,
@@ -1960,27 +1971,13 @@ const answer = (result) => {
 const auditExtension = (workspace) => {
 	let steps = 0;
 	let nudged = false;
-	const read = defineTool({
-		name: "read",
-		description: descriptions.read,
-		replay: "safe",
-		parameters: parameters(ReadArgs),
-		execute: async (args, _api, invocation) => answer(await read$2(workspace, decodeRead(args), invocation.abortSignal))
-	});
-	const grep$1 = defineTool({
-		name: "grep",
-		description: descriptions.grep,
-		replay: "safe",
-		parameters: parameters(GrepArgs),
-		execute: async (args, _api, invocation) => answer(await grep(workspace, decodeGrep(args), invocation.abortSignal === void 0 ? {} : { signal: invocation.abortSignal }))
-	});
-	const list$1 = defineTool({
-		name: "list",
-		description: descriptions.list,
+	const investigate = Object.entries(tools$3).map(([name, tool]) => defineTool({
+		name,
+		description: tool.description,
 		replay: "safe",
-		parameters: parameters(ListArgs),
-		execute: async (args, _api, invocation) => answer(await list(workspace, decodeList(args), invocation.abortSignal))
-	});
+		parameters: parameters(tool.Args),
+		execute: async (args, _api, invocation) => answer(await tool.call(workspace, args, invocation.abortSignal))
+	}));
 	const submit = defineTool({
 		name: "submit_report",
 		description: "Submit the audit report. Call exactly once, when the investigation is done; the audit ends.",
@@ -2000,12 +1997,7 @@ const auditExtension = (workspace) => {
 	});
 	return defineExtension({
 		name: "upup.audit",
-		tools: [
-			read,
-			grep$1,
-			list$1,
-			submit
-		],
+		tools: [...investigate, submit],
 		sections: [section("audit", () => instructions$1)],
 		hooks: [hook(GenerationTask, {
 			beforeRequest: (request) => {
@@ -2036,17 +2028,15 @@ const policyKey = (prompt, setup) => sha256(JSON.stringify([
 	setup.modelId,
 	setup.thinking
 ]));
+const said = (kind, content) => content.trim() === "" ? [] : [{
+	kind,
+	text: content
+}];
 const entriesOf$1 = (message) => {
 	if (message.role === "assistant") {
 		const blocks = message.content.flatMap((block) => {
-			if (block.type === "thinking") return block.thinking.trim() === "" ? [] : [{
-				kind: "thinking",
-				text: block.thinking
-			}];
-			if (block.type === "text") return block.text.trim() === "" ? [] : [{
-				kind: "text",
-				text: block.text
-			}];
+			if (block.type === "thinking") return said("thinking", block.thinking);
+			if (block.type === "text") return said("text", block.text);
 			return [{
 				kind: "tool",
 				text: describeCall(block.name, block.arguments)
@@ -2082,14 +2072,8 @@ const decodeLive = Schema.decodeUnknownOption(Schema.Struct({ generation: Schema
 	retry: Schema.optional(Schema.Struct({ error: Schema.String }))
 })) }));
 const streamed = (block) => {
-	if (isThinkingBlock(block)) return block.thinking.trim() === "" ? [] : [{
-		kind: "thinking",
-		text: block.thinking
-	}];
-	if (isTextBlock(block)) return block.text.trim() === "" ? [] : [{
-		kind: "text",
-		text: block.text
-	}];
+	if (isThinkingBlock(block)) return said("thinking", block.thinking);
+	if (isTextBlock(block)) return said("text", block.text);
 	return [];
 };
 var Transcript = class {
@@ -2360,6 +2344,42 @@ const lookup$5 = Effect.fn("go.lookup")(function* (client, wanted) {
 		withdrawn: {}
 	};
 });
+// src/registry/npm.ts
+const Version = Schema.Struct({ deprecated: Schema.optionalKey(Schema.Unknown) });
+const Packument$1 = Schema.Struct({
+	description: Schema.optionalKey(Schema.String),
+	homepage: Schema.optionalKey(Schema.String),
+	repository: Schema.optionalKey(Schema.Union([Schema.String, Schema.Struct({ url: Schema.optionalKey(Schema.String) })])),
+	"dist-tags": Schema.optionalKey(Schema.Struct({ latest: Schema.optionalKey(Schema.String) })),
+	time: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
+	versions: Schema.optionalKey(Schema.Record(Schema.String, Version))
+});
+const Downloads = Schema.Struct({ downloads: Schema.Finite });
+const message$2 = (version) => {
+	const deprecated = version?.deprecated;
+	return Predicate.isString(deprecated) && deprecated !== "" ? Option.some(deprecated) : Option.none();
+};
+const npmRegistry = "https://registry.npmjs.org";
+const npmPath = (segment) => encodeURIComponent(segment).replaceAll(/%(?:24|26|2B|3A|3D|40)/gu, (escaped) => decodeURIComponent(escaped));
+const lookup$4 = Effect.fn("npm.lookup")(function* (client, wanted) {
+	const [packument, downloads] = yield* Effect.all([getJson(client, `${npmRegistry}/${npmPath(wanted.name)}`, Packument$1), getJson(client, `https://api.npmjs.org/downloads/point/last-week/${wanted.name}`, Downloads).pipe(Effect.option)], { concurrency: "unbounded" });
+	const versions = packument.versions ?? {};
+	const latest = packument["dist-tags"]?.latest;
+	const repository = Predicate.isString(packument.repository) ? packument.repository : packument.repository?.url;
+	const deprecated = latest === void 0 ? Option.none() : message$2(versions[latest]);
+	return {
+		...packument.description === void 0 ? {} : { description: packument.description },
+		...packument.homepage === void 0 ? {} : { homepage: packument.homepage },
+		...repository === void 0 ? {} : { repository: repositoryUrl(repository) },
+		...Option.isSome(downloads) ? { popularity: `${count(downloads.value.downloads)} downloads last week` } : {},
+		...Option.isSome(deprecated) ? { deprecated: deprecated.value } : {},
+		released: pick$1(packument.time ?? {}, wanted.versions),
+		withdrawn: Object.fromEntries(wanted.versions.flatMap((version) => Option.match(message$2(versions[version]), {
+			onNone: () => [],
+			onSome: (reason) => [[version, reason]]
+		})))
+	};
+});
 // src/audit/binary.ts
 const startsWith$1 = (prefix, magic) => magic.every((byte, index) => prefix[index] === byte);
 const binaryKind = (prefix) => {
@@ -4274,11 +4294,11 @@ var EvidenceUnavailable = class extends Schema.TaggedError()("EvidenceUnavailabl
 	reason: Schema.optionalKey(Schema.Literals(["gone", "mismatch"]))
 }) {};
 const maxDownloadBytes = 8 * 1024 ** 3;
-const message$2 = (cause) => cause instanceof Error ? cause.message : String(cause);
+const message$1 = (cause) => cause instanceof Error ? cause.message : String(cause);
 const download = Effect.fn("evidence.download")(function* (client, url, limit = maxDownloadBytes, stall) {
 	const unavailable = (cause) => new EvidenceUnavailable({
 		source: url,
-		issue: message$2(cause)
+		issue: message$1(cause)
 	});
 	const stalled = (after) => unavailable(`sent nothing for ${Duration.format(after)}, so upup gave up`);
 	const directory = yield* Effect.acquireRelease(Effect.tryPromise({
@@ -4324,7 +4344,7 @@ const download = Effect.fn("evidence.download")(function* (client, url, limit =
 		sha256: hash.digest("hex")
 	};
 });
-const canonicalSha256$1 = (raw) => {
+const canonicalSha256 = (raw) => {
 	const value = raw.trim().toLowerCase();
 	return /^[0-9a-f]{64}$/u.test(value) ? value : void 0;
 };
@@ -4346,7 +4366,7 @@ const crate = Effect.fn("evidence.crate")(function* (client, name, version) {
 		source,
 		issue: `no crates index entry for ${name} ${version}`
 	});
-	const sum = canonicalSha256$1(entry.cksum);
+	const sum = canonicalSha256(entry.cksum);
 	if (sum === void 0) return yield* new EvidenceUnavailable({
 		source,
 		issue: `crates index publishes an invalid checksum for ${name} ${version}`
@@ -4400,8 +4420,6 @@ const NpmVersion = Schema.Struct({
 		shasum: Schema.optionalKey(Schema.String)
 	}))
 });
-const npmRegistry = "https://registry.npmjs.org";
-const npmPath = (segment) => encodeURIComponent(segment).replaceAll(/%(?:24|26|2B|3A|3D|40)/gu, (escaped) => decodeURIComponent(escaped));
 const strictBase64 = (value) => {
 	const decoded = Buffer.from(value, "base64");
 	return decoded.toString("base64") === value ? decoded : void 0;
@@ -4452,7 +4470,7 @@ const npmPlan = Effect.fn("evidence.npmPlan")(function* (name, version, metadata
 			try: () => npmDigest(dist.integrity ?? "", dist.shasum ?? ""),
 			catch: (error) => new EvidenceUnavailable({
 				source,
-				issue: `npm ${name}@${version}: ${message$2(error)}`
+				issue: `npm ${name}@${version}: ${message$1(error)}`
 			})
 		})
 	};
@@ -4515,7 +4533,7 @@ const fetchVerified = Effect.fn("evidence.fetchVerified")(function* (client, url
 		try: async () => await computedDigest(digest, downloaded),
 		catch: (error) => new EvidenceUnavailable({
 			source: url,
-			issue: message$2(error)
+			issue: message$1(error)
 		})
 	});
 	if (computed === void 0) return yield* new EvidenceUnavailable({
@@ -4568,6 +4586,10 @@ const preparationPlan = (subject, evidence) => {
 		plan: `${JSON.stringify(plan, null, 2)}\n`
 	};
 };
+const prepareWorkspace = Effect.fn("evidence.prepareWorkspace")(function* (workspace, subject, preparation) {
+	const prepared = yield* preparation.materialize(workspace);
+	return yield* write(workspace, subject, prepared, preparation.key);
+});
 // src/registry/github.ts
 const githubApi = "https://api.github.com";
 const githubRepository = (name) => `https://github.com/${name}.git`;
@@ -4630,18 +4652,11 @@ const sourceOf$1 = (entry) => ({
 	tapGitHead: entry.tap_git_head ?? "",
 	rubySourceChecksum: entry.ruby_source_checksum?.sha256 ?? ""
 });
-const brew = (args) => ({
-	command: "brew",
-	args,
-	cwd: "/",
-	env: { HOMEBREW_NO_AUTO_UPDATE: "1" }
-});
 const unavailable$2 = (source, issue) => new EvidenceUnavailable({
 	source,
 	issue
 });
 const query = Effect.fn("brew.query")(function* (kind, name) {
-	if (kind !== "formula" && kind !== "cask") return yield* unavailable$2("brew", `unsupported brew package variant ${JSON.stringify(kind)}`);
 	const raw = yield* (yield* Exec).stdout(brew([
 		"info",
 		"--json=v2",
@@ -4791,9 +4806,7 @@ const nextPage = (current, link) => {
 const githubGet = (client, url, token) => Effect.gen(function* () {
 	const headers = {
 		"user-agent": userAgent,
-		accept: "application/vnd.github+json",
-		"x-github-api-version": "2022-11-28",
-		...token !== void 0 && url.startsWith(`https://api.github.com/`) ? { authorization: `Bearer ${token}` } : {}
+		...githubHeaders(url.startsWith(`https://api.github.com/`) ? token : void 0)
 	};
 	const response = yield* get(client, url, headers);
 	const fail = (issue) => Effect.fail(new EvidenceUnavailable({
@@ -6099,17 +6112,17 @@ const provenanceSource = (statement, integrity) => {
 		commit
 	};
 };
-const message$1 = (cause) => cause instanceof Error ? cause.message : String(cause);
+const message = (cause) => cause instanceof Error ? cause.message : String(cause);
 const sigstoreVerifier = Effect.gen(function* () {
-	const cachePath = path.join(yield* cacheDir.pipe(Effect.mapError((error) => `no cache directory: ${message$1(error)}`)), "sigstore");
+	const cachePath = path.join(yield* cacheDir.pipe(Effect.mapError((error) => `no cache directory: ${message(error)}`)), "sigstore");
 	const root = yield* Effect.tryPromise({
 		try: async () => await getTrustedRoot({ cachePath }),
-		catch: (error) => `the Sigstore trust root could not be loaded: ${message$1(error)}`
+		catch: (error) => `the Sigstore trust root could not be loaded: ${message(error)}`
 	});
 	const verifier = new Verifier(toTrustMaterial(root));
 	return (bundle) => Effect.try({
 		try: () => verifier.verify(toSignedEntity(bundle), {}),
-		catch: (error) => `its Sigstore verification failed: ${message$1(error)}`
+		catch: (error) => `its Sigstore verification failed: ${message(error)}`
 	});
 });
 const sourceRepositoryUri = "1.3.6.1.4.1.57264.1.12";
@@ -6344,7 +6357,7 @@ const sourceEvidence = Effect.fn("brew.sourceEvidence")(function* (client, works
 		detail: ["Checksum-verified publisher source archive Delta is included.", partial("source archive", source.omitted)].filter((sentence) => sentence !== "").join(" ")
 	};
 });
-const materialize$1 = Effect.fn("brew.materialize")(function* (client, workspace, identity, plan, key) {
+const materialize$1 = Effect.fn("brew.materialize")(function* (client, workspace, identity, plan) {
 	const [formula, source, payload] = yield* Effect.all([
 		materializeFormula(workspace, plan.formula),
 		sourceEvidence(client, workspace, archives(plan.formula), plan.sourceGap),
@@ -6360,17 +6373,26 @@ const materialize$1 = Effect.fn("brew.materialize")(function* (client, workspace
 		goSource?.detail ?? "",
 		repository?.detail ?? ""
 	].filter((sentence) => sentence !== "").join(" ");
-	return yield* write(workspace, identity, Buffer.concat([
-		formula,
-		source.diff,
-		payload.diff,
-		goSource?.diff ?? Buffer.alloc(0),
-		repository?.diff ?? Buffer.alloc(0)
-	]), evidence, plan.formula.fromGap === "" ? detail : `The installed version's formula snapshot is unavailable: ${plan.formula.fromGap}. ${detail}`, key);
+	return {
+		diff: Buffer.concat([
+			formula,
+			source.diff,
+			payload.diff,
+			goSource?.diff ?? Buffer.alloc(0),
+			repository?.diff ?? Buffer.alloc(0)
+		]),
+		evidence,
+		detail: plan.formula.fromGap === "" ? detail : `The installed version's formula snapshot is unavailable: ${plan.formula.fromGap}. ${detail}`
+	};
 });
 const resolve$2 = Effect.fn("brew.resolve")(function* (client, identity) {
 	const { artifact, from, to } = identity.delta;
-	const kind = identity.context["kind"] ?? "";
+	const { context } = identity;
+	if (context._tag !== "Brew") return yield* new EvidenceUnavailable({
+		source: "brew",
+		issue: `a brew package's audit needs its kind, not ${context._tag}`
+	});
+	const { kind } = context;
 	const { source, formula: info } = yield* query(kind, artifact);
 	const formula = yield* resolveFormula(client, source, from, to);
 	const formulaGap = formula.fromGap === "" ? archiveUnavailableReason(archives(formula)) : "the installed version's formula snapshot is unavailable";
@@ -6389,25 +6411,21 @@ const resolve$2 = Effect.fn("brew.resolve")(function* (client, identity) {
 		...repository === void 0 ? {} : { repository }
 	};
 });
-const prepareBrewWith = (exec) => (client, identity) => resolve$2(client, identity).pipe(Effect.provide(exec), Effect.map((plan) => {
-	const { key, plan: recorded } = preparationPlan(identity, {
+const prepareBrewWith = (exec) => (client, identity) => resolve$2(client, identity).pipe(Effect.provide(exec), Effect.map((plan) => ({
+	...preparationPlan(identity, {
 		kind: "brew",
 		plan: planKey(plan)
-	});
-	return {
-		key,
-		plan: recorded,
-		artifacts: artifactsOf(plan),
-		materialize: (workspace) => materialize$1(client, workspace, identity, plan, key).pipe(Effect.provide(exec))
-	};
-}));
+	}),
+	artifacts: artifactsOf(plan),
+	materialize: (workspace) => materialize$1(client, workspace, identity, plan).pipe(Effect.provide(exec))
+})));
 const prepareBrew = prepareBrewWith(nodeLayer);
 // src/audit/github-actions.ts
 const unavailable$1 = (error) => new EvidenceUnavailable({
 	source: error.repository,
 	issue: error.issue
 });
-const workspaceOf$1 = Effect.fn("githubActions.workspace")(function* (workspace, identity, repository, commits, key, options) {
+const workspaceOf = Effect.fn("githubActions.workspace")(function* (workspace, identity, repository, commits, options) {
 	const trees = {
 		from: path.join(workspace, files.actionFrom),
 		to: path.join(workspace, files.actionTo)
@@ -6432,17 +6450,25 @@ const workspaceOf$1 = Effect.fn("githubActions.workspace")(function* (workspace,
 	const { from, to } = identity.delta;
 	const commitsSentence = `In ${repository}, ${from} is ${commits.from} and ${to} is ${commits.to}.`;
 	const modes = yield* writeFileDiff(workspace, files.actionModesFrom, files.actionModesTo, json(Object.fromEntries(changed.modes.map((change) => [change.path, change.from]))), json(Object.fromEntries(changed.modes.map((change) => [change.path, change.to]))));
-	if (changed.omitted !== "") return yield* write(workspace, identity, modes, "metadata-only", `${commitsSentence} The changed files were not fetched: ${changed.omitted}.`, key);
+	if (changed.omitted !== "") return {
+		diff: modes,
+		evidence: "metadata-only",
+		detail: `${commitsSentence} The changed files were not fetched: ${changed.omitted}.`
+	};
 	const { diff, omitted } = yield* treeDiff(workspace, files.actionFrom, files.actionTo);
 	const submodules = changed.modes.flatMap((change) => change.submodule ? [change.path] : []);
 	const gaps = [partial("action", omitted), submodules.length === 0 ? "" : `Submodules changed, and their contents were not fetched: ${submodules.join(", ")}.`].filter((sentence) => sentence !== "");
-	return yield* write(workspace, identity, Buffer.concat([diff, modes]), gaps.length === 0 ? "full" : "partial", [commitsSentence, ...gaps].join(" "), key);
+	return {
+		diff: Buffer.concat([diff, modes]),
+		evidence: gaps.length === 0 ? "full" : "partial",
+		detail: [commitsSentence, ...gaps].join(" ")
+	};
 });
 const githubActionPreparer = (repositoryOf, options = {}) => Effect.fn("githubActions.prepare")(function* (_client, identity) {
 	const { artifact, from, to } = identity.delta;
 	const repository = repositoryOf(artifact);
 	const [fromCommit, toCommit] = yield* Effect.all([tagCommit(repository, from, options), tagCommit(repository, to, options)], { concurrency: "unbounded" }).pipe(Effect.mapError(unavailable$1));
-	const listed = identity.context["revision"];
+	const listed = identity.context._tag === "Revision" ? identity.context.revision : void 0;
 	if (listed !== toCommit) return yield* new EvidenceUnavailable({
 		source: repository,
 		issue: listed === void 0 ? `upup listed no commit for ${to}; refresh` : `${to} now points at ${toCommit}, not the ${listed} upup listed; refresh`,
@@ -6452,16 +6478,14 @@ const githubActionPreparer = (repositoryOf, options = {}) => Effect.fn("githubAc
 		from: fromCommit,
 		to: toCommit
 	};
-	const { key, plan } = preparationPlan(identity, {
-		kind: "github-actions",
-		repository,
-		commits
-	});
 	return {
-		key,
-		plan,
+		...preparationPlan(identity, {
+			kind: "github-actions",
+			repository,
+			commits
+		}),
 		artifacts: [`from ${fromCommit}`, `to ${toCommit}`],
-		materialize: (workspace) => workspaceOf$1(workspace, identity, repository, commits, key, options)
+		materialize: (workspace) => workspaceOf(workspace, identity, repository, commits, options)
 	};
 });
 const prepareGitHubAction = githubActionPreparer(githubRepository);
@@ -6475,10 +6499,6 @@ const Release$2 = Schema.Struct({ urls: optional(Schema.Array(Schema.Struct({
 	digests: optional(Schema.Struct({ sha256: optional(Schema.String) }))
 }))) });
 const releaseUrl = (name, version) => `https://pypi.org/pypi/${encodeURIComponent(name)}/${encodeURIComponent(version)}/json`;
-const canonicalSha256 = (raw) => {
-	const value = raw.trim().toLowerCase();
-	return /^[0-9a-f]{64}$/u.test(value) ? value : void 0;
-};
 const formatOf = (url) => {
 	try {
 		return formatOf$1(url);
@@ -6627,7 +6647,7 @@ const trees = [
 	files.wheelFrom,
 	files.wheelTo
 ];
-const pypiWorkspace = Effect.fn("pypi.workspace")(function* (client, workspace, identity, plans, key) {
+const pypiWorkspace = Effect.fn("pypi.workspace")(function* (client, workspace, plans) {
 	yield* Effect.tryPromise({
 		try: async () => await Promise.all(trees.map(async (tree) => await mkdir(path.join(workspace, tree), {
 			recursive: true,
@@ -6647,38 +6667,40 @@ const pypiWorkspace = Effect.fn("pypi.workspace")(function* (client, workspace,
 		writeFileDiff(workspace, files.binaryWheelFrom, files.binaryWheelTo, json(binarySummaries(from.compatible_universal_wheel?.archive_manifest)), json(binarySummaries(to.compatible_universal_wheel?.archive_manifest)))
 	], { concurrency: "unbounded" });
 	const detail = `Checksum-verified PyPI publisher artifacts; ${pairedDetail("source distributions", from.publisher_sdist, to.publisher_sdist)}; ${pairedDetail("compatible universal wheel candidates", from.compatible_universal_wheel, to.compatible_universal_wheel)}; the installer’s exact resolver selection is not known.`;
-	return yield* write(workspace, identity, Buffer.concat([
-		sources.diff,
-		records,
-		sourceBinaries,
-		wheels.diff,
-		wheelBinaries
-	]), "partial", [
-		detail,
-		partial("source distribution", sources.omitted),
-		partial("wheel", wheels.omitted)
-	].filter((sentence) => sentence !== "").join(" "), key);
+	return {
+		diff: Buffer.concat([
+			sources.diff,
+			records,
+			sourceBinaries,
+			wheels.diff,
+			wheelBinaries
+		]),
+		evidence: "partial",
+		detail: [
+			detail,
+			partial("source distribution", sources.omitted),
+			partial("wheel", wheels.omitted)
+		].filter((sentence) => sentence !== "").join(" ")
+	};
 });
 const preparePyPI = Effect.fn("pypi.prepare")(function* (client, identity) {
 	const { artifact, from, to } = identity.delta;
-	const python = identity.context["python"] ?? "";
+	const python = identity.context._tag === "Python" ? identity.context.python : "";
 	const [fromPlan, toPlan] = yield* Effect.all([resolve$1(client, artifact, from, python), resolve$1(client, artifact, to, python)], { concurrency: "unbounded" });
 	const plans = {
 		from: fromPlan,
 		to: toPlan
 	};
-	const { key, plan } = preparationPlan(identity, {
-		kind: "pypi",
-		...plans
-	});
 	return {
-		key,
-		plan,
+		...preparationPlan(identity, {
+			kind: "pypi",
+			...plans
+		}),
 		artifacts: ["from", "to"].flatMap((side) => [plans[side].publisher_sdist, plans[side].compatible_universal_wheel].map((selected) => `${side} ${selected === null ? "none" : `sha256:${selected.sha256}`}`)),
-		materialize: (workspace) => pypiWorkspace(client, workspace, identity, plans, key)
+		materialize: (workspace) => pypiWorkspace(client, workspace, plans)
 	};
 });
-const Packument$1 = Schema.Struct({
+const Packument = Schema.Struct({
 	"dist-tags": Schema.optionalKey(Schema.NullOr(Schema.Record(Schema.String, Schema.String))),
 	versions: Schema.Record(Schema.String, Schema.Unknown)
 });
@@ -6710,7 +6732,7 @@ const resolveSide = (client, host, name, declared, options = {}) => Effect.gen(f
 			issue: `declares ${JSON.stringify(declared.spec)}, which is not a registry version range`
 		});
 		const source = `${npmRegistry}/${npmPath(name)}`;
-		const packument = yield* getJson(client, source, Packument$1, { accept: "application/vnd.npm.install-v1+json" }).pipe(Effect.mapError((error) => new EvidenceUnavailable({
+		const packument = yield* getJson(client, source, Packument, { accept: "application/vnd.npm.install-v1+json" }).pipe(Effect.mapError((error) => new EvidenceUnavailable({
 			source,
 			issue: error.issue
 		})));
@@ -6903,87 +6925,102 @@ const materializeDependencies = Effect.fn("npmDependencies.materialize")(functio
 });
 // src/audit/registry-evidence.ts
 const registryDetail = "Both published packages were downloaded and their checksums verified. File types and modes, and any native binaries, are summarised without running them.";
-const registryWorkspace = Effect.fn("evidence.registryWorkspace")(function* (client, workspace, identity, plans, npm, key) {
+const sentences = (parts) => parts.filter((sentence) => sentence !== "").join(" ");
+const artifactEvidence = Effect.fn("evidence.artifactEvidence")(function* (client, workspace, plans) {
 	const [from, to] = yield* Effect.all([materialize$2(client, plans.from, path.join(workspace, files.from)), materialize$2(client, plans.to, path.join(workspace, files.to))], { concurrency: "unbounded" });
 	const [artifacts, trees, binaries] = yield* Effect.all([
 		writeFileDiff(workspace, files.artifactFrom, files.artifactTo, manifestJson(from), manifestJson(to)),
 		treeDiff(workspace, files.from, files.to),
 		writeFileDiff(workspace, files.binaryFrom, files.binaryTo, json(binarySummaries(from)), json(binarySummaries(to)))
 	], { concurrency: "unbounded" });
-	const treeDetail = [registryDetail, partial("artifact", trees.omitted)].filter((sentence) => sentence !== "").join(" ");
-	if (npm === void 0) return yield* write(workspace, identity, Buffer.concat([
-		artifacts,
-		trees.diff,
-		binaries
-	]), trees.omitted === "" ? "full" : "partial", treeDetail, key);
-	const changed = yield* materializeDependencies(client, workspace, npm.dependencies);
-	const linked = yield* Effect.forEach(changed.binaries, (binary) => releaseAssetSources(client, binary.repository, [binary.from, binary.to]).pipe(Effect.map(([fromRelease, toRelease]) => ({
-		label: binary.label,
-		from: fromRelease ?? { gap: "no release lookup" },
-		to: toRelease ?? { gap: "no release lookup" }
-	}))), { concurrency: 2 });
-	const source = yield* materializeSources(workspace, [npm.source, ...linked]);
-	return yield* write(workspace, identity, Buffer.concat([
-		artifacts,
-		trees.diff,
-		binaries,
-		changed.diff,
-		source.diff
-	]), "partial", [
-		treeDetail,
-		changed.detail,
-		source.detail
-	].filter((sentence) => sentence !== "").join(" "), key);
-});
-const npmExtras = Effect.fn("evidence.npmExtras")(function* (client, name, from, to, manifests) {
-	const fromManifest = manifests.from;
-	const toManifest = manifests.to;
-	const dependencies = yield* resolveDependencies(client, manifests, {
-		os: process.platform,
-		cpu: process.arch
-	});
-	const verifier = yield* Effect.cached(sigstoreVerifier);
-	const [fromSource, toSource] = yield* Effect.all([npmSource(client, name, from, fromManifest, verifier), npmSource(client, name, to, toManifest, verifier)], { concurrency: "unbounded" });
-	const { directory } = npmRepository(toManifest);
 	return {
-		dependencies,
-		source: {
-			label: name,
-			...directory === void 0 ? {} : { directory },
-			from: fromSource,
-			to: toSource
-		}
+		diff: Buffer.concat([
+			artifacts,
+			trees.diff,
+			binaries
+		]),
+		evidence: trees.omitted === "" ? "full" : "partial",
+		detail: sentences([registryDetail, partial("artifact", trees.omitted)])
 	};
 });
+const digests = (plans) => [`from ${plans.from.published_digest}`, `to ${plans.to.published_digest}`];
 const prepareRegistry = Effect.fn("evidence.prepareRegistry")(function* (client, identity) {
 	const { ecosystem, artifact, from, to } = identity.delta;
-	const manifests = ecosystem === "npm" ? yield* Effect.all({
-		from: npmVersion(client, artifact, from),
-		to: npmVersion(client, artifact, to)
-	}, { concurrency: "unbounded" }) : void 0;
-	const [fromPlan, toPlan] = yield* Effect.all(manifests === void 0 ? [resolve$3(client, ecosystem, artifact, from), resolve$3(client, ecosystem, artifact, to)] : [npmPlan(artifact, from, manifests.from), npmPlan(artifact, to, manifests.to)], { concurrency: "unbounded" });
+	const [fromPlan, toPlan] = yield* Effect.all([resolve$3(client, ecosystem, artifact, from), resolve$3(client, ecosystem, artifact, to)], { concurrency: "unbounded" });
 	const plans = {
 		from: fromPlan,
 		to: toPlan
 	};
-	const npm = manifests === void 0 ? void 0 : yield* npmExtras(client, artifact, from, to, manifests);
-	const { key, plan } = preparationPlan(identity, {
-		kind: "registry",
-		...plans,
-		...npm
-	});
 	return {
-		key,
-		plan,
-		artifacts: [`from ${fromPlan.published_digest}`, `to ${toPlan.published_digest}`],
-		materialize: (workspace) => registryWorkspace(client, workspace, identity, plans, npm, key)
+		...preparationPlan(identity, {
+			kind: "registry",
+			...plans
+		}),
+		artifacts: digests(plans),
+		materialize: (workspace) => artifactEvidence(client, workspace, plans)
 	};
 });
 // src/audit/prepare.ts
 const preparers = {
 	crates: prepareRegistry,
 	go: prepareRegistry,
-	npm: prepareRegistry,
+	npm: Effect.fn("evidence.prepareNpm")(function* (client, identity) {
+		const { artifact, from, to } = identity.delta;
+		const manifests = yield* Effect.all({
+			from: npmVersion(client, artifact, from),
+			to: npmVersion(client, artifact, to)
+		}, { concurrency: "unbounded" });
+		const [fromPlan, toPlan] = yield* Effect.all([npmPlan(artifact, from, manifests.from), npmPlan(artifact, to, manifests.to)], { concurrency: "unbounded" });
+		const dependencies = yield* resolveDependencies(client, manifests, {
+			os: process.platform,
+			cpu: process.arch
+		});
+		const verifier = yield* Effect.cached(sigstoreVerifier);
+		const [fromSource, toSource] = yield* Effect.all([npmSource(client, artifact, from, manifests.from, verifier), npmSource(client, artifact, to, manifests.to, verifier)], { concurrency: "unbounded" });
+		const { directory } = npmRepository(manifests.to);
+		const source = {
+			label: artifact,
+			...directory === void 0 ? {} : { directory },
+			from: fromSource,
+			to: toSource
+		};
+		const plans = {
+			from: fromPlan,
+			to: toPlan
+		};
+		return {
+			...preparationPlan(identity, {
+				kind: "npm",
+				...plans,
+				dependencies,
+				source
+			}),
+			artifacts: digests(plans),
+			materialize: (workspace) => Effect.gen(function* () {
+				const artifacts = yield* artifactEvidence(client, workspace, plans);
+				const changed = yield* materializeDependencies(client, workspace, dependencies);
+				const linked = yield* Effect.forEach(changed.binaries, (binary) => releaseAssetSources(client, binary.repository, [binary.from, binary.to]).pipe(Effect.map(([fromRelease, toRelease]) => ({
+					label: binary.label,
+					from: fromRelease ?? { gap: "no release lookup" },
+					to: toRelease ?? { gap: "no release lookup" }
+				}))), { concurrency: 2 });
+				const sources = yield* materializeSources(workspace, [source, ...linked]);
+				return {
+					diff: Buffer.concat([
+						artifacts.diff,
+						changed.diff,
+						sources.diff
+					]),
+					evidence: "partial",
+					detail: sentences([
+						artifacts.detail,
+						changed.detail,
+						sources.detail
+					])
+				};
+			})
+		};
+	}),
 	pypi: preparePyPI,
 	brew: prepareBrew,
 	"github-actions": prepareGitHubAction
@@ -7069,7 +7106,7 @@ const within = (effect, what) => effect.pipe(Effect.timeoutOrElse({
 		issue: `evidence preparation timed out after 15 minutes`
 	}))
 }));
-const ensure = (workspace, preparation) => Effect.gen(function* () {
+const ensure = (workspace, identity, preparation) => Effect.gen(function* () {
 	yield* Effect.tryPromise({
 		try: async () => {
 			await rm(workspace, {
@@ -7087,23 +7124,21 @@ const ensure = (workspace, preparation) => Effect.gen(function* () {
 			issue: issueOf$1(error)
 		})
 	});
-	yield* within(preparation.materialize(workspace), "prepare workspace").pipe(Effect.onError(() => Effect.promise(async () => {
+	yield* within(prepareWorkspace(workspace, identity, preparation), "prepare workspace").pipe(Effect.onError(() => Effect.promise(async () => {
 		await rm(workspace, {
 			recursive: true,
 			force: true
 		});
 	})));
 });
-const workspaceOf = (file) => path.join(path.dirname(path.dirname(path.dirname(file))), "workspaces", path.basename(path.dirname(file)));
 const sameArtifacts = (left, right) => left.length === right.length && left.every((artifact, index) => artifact === right[index]);
-const reportedFrom = (file, stored) => Option.isSome(stored.report) && Option.isSome(stored.brief) ? Option.some({
+const reportedFrom = (paths, stored) => Option.isSome(stored.report) && Option.isSome(stored.brief) ? Option.some({
 	_tag: "Reported",
 	report: stored.report.value,
 	evidence: stored.brief.value.evidence,
 	detail: stored.brief.value.evidenceDetail,
 	model: `${stored.brief.value.provider}/${stored.brief.value.modelId}`,
-	file,
-	workspace: workspaceOf(file)
+	...paths
 }) : Option.none();
 const audits$1 = (stored, artifacts) => Option.isSome(stored.brief) && sameArtifacts(stored.brief.value.artifacts, artifacts);
 const children = (directory) => Effect.promise(async () => await readdir(directory).catch(() => []));
@@ -7144,13 +7179,7 @@ const layer$5 = (cacheDir) => Layer.effect(Audits, Effect.gen(function* () {
 	});
 	const landingFile = (landing) => path.join(root, "landed", landing.mode, `${landingKey(landing)}.json`);
 	const land = (identity) => Effect.tryPromise(async () => {
-		const file = landingFile({
-			mode: identity.mode,
-			ecosystem: identity.delta.ecosystem,
-			artifact: identity.delta.artifact,
-			version: identity.delta.to,
-			context: identity.context
-		});
+		const file = landingFile(landingAt(identity));
 		await mkdir(path.dirname(file), {
 			recursive: true,
 			mode: 448
@@ -7164,10 +7193,15 @@ const layer$5 = (cacheDir) => Layer.effect(Audits, Effect.gen(function* () {
 		const note = JSON.parse(text);
 		return Predicate.hasProperty(note, "from") && Predicate.hasProperty(note, "to") && Predicate.isString(note.from) && note.to === landing.version ? Option.some(note.from) : Option.none();
 	}, () => Option.none()));
-	const fileOf = (identity, policyKey) => path.join(root, identity.mode, workspaceKey(identity), `${policyKey}.sqlite`);
-	const storedIn = (file) => Effect.scoped(Effect.gen(function* () {
-		if (!(yield* tryHold(workspaceOf(file)))) return Option.none();
-		return Option.some(yield* stored(file, ai.models));
+	const workspaces = path.join(root, "workspaces");
+	const workspaceFor = (identity) => path.join(workspaces, workspaceKey(identity));
+	const pathsOf = (identity, policyKey) => ({
+		file: path.join(root, identity.mode, workspaceKey(identity), `${policyKey}.sqlite`),
+		workspace: workspaceFor(identity)
+	});
+	const storedIn = (paths) => Effect.scoped(Effect.gen(function* () {
+		if (!(yield* tryHold(paths.workspace))) return Option.none();
+		return Option.some(yield* stored(paths.file, ai.models));
 	})).pipe(Effect.orElseSucceed(() => Option.none()));
 	const attempt = Effect.fn("Audits.attempt")(function* (identity, options) {
 		let transcript = [];
@@ -7186,8 +7220,8 @@ const layer$5 = (cacheDir) => Layer.effect(Audits, Effect.gen(function* () {
 		const prompt = promptFor(identity.mode);
 		const policyKey$1 = policyKey(prompt, setup.value);
 		const preparation = yield* within(prepare(client, identity), "resolve evidence");
-		const file = fileOf(identity, policyKey$1);
-		const workspace = workspaceOf(file);
+		const paths = pathsOf(identity, policyKey$1);
+		const { file, workspace } = paths;
 		yield* hold(workspace);
 		const model = `${setup.value.provider}/${setup.value.modelId}`;
 		if (existsSync(file)) {
@@ -7195,7 +7229,7 @@ const layer$5 = (cacheDir) => Layer.effect(Audits, Effect.gen(function* () {
 				brief: Option.none(),
 				report: Option.none()
 			})));
-			const found = reportedFrom(file, stored$1);
+			const found = reportedFrom(paths, stored$1);
 			if (!options.force && Option.isSome(found) && audits$1(stored$1, preparation.artifacts)) {
 				yield* land(identity);
 				return found.value;
@@ -7209,7 +7243,7 @@ const layer$5 = (cacheDir) => Layer.effect(Audits, Effect.gen(function* () {
 			}, file);
 		}
 		yield* Effect.addFinalizer(() => prune(workspace));
-		yield* ensure(workspace, preparation);
+		yield* ensure(workspace, identity, preparation);
 		const meta = yield* readMeta(workspace);
 		yield* Effect.tryPromise({
 			try: async () => await mkdir(path.dirname(file), {
@@ -7274,8 +7308,7 @@ const layer$5 = (cacheDir) => Layer.effect(Audits, Effect.gen(function* () {
 			evidence: meta.evidence,
 			detail: meta.evidence_detail,
 			model,
-			file,
-			workspace
+			...paths
 		};
 	});
 	const audit = (identity, options) => Effect.sync(() => {
@@ -7294,8 +7327,8 @@ const layer$5 = (cacheDir) => Layer.effect(Audits, Effect.gen(function* () {
 	const recall = Effect.fn("Audits.recall")(function* (identity) {
 		const setup = yield* ai.setup;
 		if (Option.isNone(setup)) return Option.none();
-		const file = fileOf(identity, policyKey(promptFor(identity.mode), setup.value));
-		const found = Option.flatMap(yield* storedIn(file), (stored) => reportedFrom(file, stored));
+		const paths = pathsOf(identity, policyKey(promptFor(identity.mode), setup.value));
+		const found = Option.flatMap(yield* storedIn(paths), (stored) => reportedFrom(paths, stored));
 		if (Option.isSome(found)) yield* land(identity);
 		return found;
 	});
@@ -7303,26 +7336,26 @@ const layer$5 = (cacheDir) => Layer.effect(Audits, Effect.gen(function* () {
 		const setup = yield* ai.setup;
 		if (Option.isNone(setup)) return Option.none();
 		const preparation = yield* within(prepare(client, identity), "resolve evidence");
-		const file = fileOf(identity, policyKey(promptFor(identity.mode), setup.value));
-		return Option.filter(yield* storedIn(file), (stored) => audits$1(stored, preparation.artifacts)).pipe(Option.flatMap((stored) => reportedFrom(file, stored)));
+		const paths = pathsOf(identity, policyKey(promptFor(identity.mode), setup.value));
+		return Option.filter(yield* storedIn(paths), (stored) => audits$1(stored, preparation.artifacts)).pipe(Option.flatMap((stored) => reportedFrom(paths, stored)));
 	}).pipe(Effect.catch((error) => Effect.succeedSome({
 		_tag: "Failed",
 		issue: `the update's artifacts could not be resolved: ${issueOf$1(error)}`,
 		transcript: []
 	})));
 	const changes = (identity) => Effect.scoped(Effect.gen(function* () {
-		const workspace = path.join(root, "workspaces", workspaceKey(identity));
+		const workspace = workspaceFor(identity);
 		const held = yield* tryHold(workspace);
 		if (yield* readable(workspace, identity)) return yield* read$1(workspace);
 		if (!held) return yield* new ChangesUnavailable({ issue: "A running Audit is preparing this evidence." });
 		const preparation = yield* within(prepare(client, identity), "resolve evidence");
-		yield* ensure(workspace, preparation);
+		yield* ensure(workspace, identity, preparation);
 		const view = yield* read$1(workspace);
 		yield* prune(workspace);
 		return view;
 	})).pipe(Effect.mapError((error) => new ChangesUnavailable({ issue: issueOf$1(error) })));
 	const majors = (identity) => Effect.gen(function* () {
-		const workspace = path.join(root, "workspaces", workspaceKey(identity));
+		const workspace = workspaceFor(identity);
 		if (!(yield* readable(workspace, identity))) return [];
 		return yield* readMajors(workspace);
 	}).pipe(Effect.orElseSucceed(() => []));
@@ -7335,9 +7368,8 @@ const layer$5 = (cacheDir) => Layer.effect(Audits, Effect.gen(function* () {
 		mode: 448
 	}));
 	const started = yield* Clock.currentTimeMillis;
-	const base = path.join(root, "workspaces");
-	yield* Effect.forEach((yield* children(base)).filter((name) => !name.endsWith(".lock")), (name) => {
-		const workspace = path.join(base, name);
+	yield* Effect.forEach((yield* children(workspaces)).filter((name) => !name.endsWith(".lock")), (name) => {
+		const workspace = path.join(workspaces, name);
 		return Effect.scoped(Effect.gen(function* () {
 			if (!(yield* tryHold(workspace))) return;
 			const prepared = yield* Effect.promise(async () => await stat(path.join(workspace, files.meta)).then((info) => info.mtimeMs, () => 0));
@@ -7368,8 +7400,8 @@ const layer$5 = (cacheDir) => Layer.effect(Audits, Effect.gen(function* () {
 		changes,
 		majors,
 		landed,
-		transcript: (file) => Effect.scoped(Effect.gen(function* () {
-			if (!(yield* tryHold(workspaceOf(file)))) return yield* new AgentFailed({ issue: "the Audit is running" });
+		transcript: ({ file, workspace }) => Effect.scoped(Effect.gen(function* () {
+			if (!(yield* tryHold(workspace))) return yield* new AgentFailed({ issue: "the Audit is running" });
 			return yield* transcript(file, ai.models);
 		}))
 	}));
@@ -7385,6 +7417,18 @@ const replaceText = Effect.fn("replaceText")(function* (file, text) {
 	yield* fs.writeFileString(temporary, text, { mode }).pipe(Effect.mapError(fileFailed("write", temporary)));
 	yield* fs.rename(temporary, file).pipe(Effect.mapError(fileFailed("replace", file)));
 });
+const editFiles = Effect.fn("editFiles")(function* (root, edits) {
+	const edited = /* @__PURE__ */ new Map();
+	for (const { file, edit } of edits) {
+		const next = edit(edited.get(file) ?? (yield* readText(path.join(root, file))));
+		if (Result.isFailure(next)) return yield* new EditRefused({
+			manifest: file,
+			issue: next.failure
+		});
+		edited.set(file, next.success);
+	}
+	for (const [file, text] of edited) yield* replaceText(path.join(root, file), text);
+});
 // src/project/find-up.ts
 const findUp = Effect.fn("findUp")(function* (start, name) {
 	const fs = yield* FileSystem.FileSystem;
@@ -7782,7 +7826,6 @@ const publicTags = (url) => tags(url, { timeout: lsRemoteTimeout }).pipe(Effect.
 const make$13 = (root, origin, readPublic = publicTags) => Effect.gen(function* () {
 	const exec = yield* Exec;
 	const fs = yield* FileSystem.FileSystem;
-	const read = (file) => readText(file).pipe(Effect.provideService(FileSystem.FileSystem, fs));
 	const scanned = Effect.gen(function* () {
 		const files = yield* workflowFiles(root).pipe(Effect.provideService(FileSystem.FileSystem, fs));
 		return {
@@ -7869,17 +7912,10 @@ const make$13 = (root, origin, readPublic = publicTags) => Effect.gen(function*
 			expected: pinned && pkg.revision !== void 0 ? `${target} at ${short(pkg.revision)}` : target,
 			...sha === void 0 ? {} : { offered: `${target} at ${short(sha)}` }
 		});
-		const edited = /* @__PURE__ */ new Map();
-		for (const use of group.uses) {
-			const text = edited.get(use.file) ?? (yield* read(path.join(root, use.file)));
-			const next = pinned ? editYamlScalar(text, use.path, `${use.name}@${sha}`, movedComment(use.comment, target)) : editYamlScalar(text, use.path, `${use.name}@${target}`);
-			if (Result.isFailure(next)) return yield* new EditRefused({
-				manifest: use.file,
-				issue: next.failure
-			});
-			edited.set(use.file, next.success);
-		}
-		for (const [file, text] of edited) yield* replaceText(path.join(root, file), text).pipe(Effect.provideService(FileSystem.FileSystem, fs));
+		yield* editFiles(root, group.uses.map((use) => ({
+			file: use.file,
+			edit: (text) => pinned ? editYamlScalar(text, use.path, `${use.name}@${sha}`, movedComment(use.comment, target)) : editYamlScalar(text, use.path, `${use.name}@${target}`)
+		}))).pipe(Effect.provideService(FileSystem.FileSystem, fs));
 	});
 	return {
 		name: providerName$1,
@@ -8757,19 +8793,11 @@ const Manifest$2 = Schema.fromJsonString(Schema.Struct({
 }));
 const zipName = "upup-sparkle.zip";
 const manifestName = "upup-sparkle.json";
-const seaKeys = {
-	zip: `sparkle/${zipName}`,
-	manifest: `sparkle/${manifestName}`
-};
 const decode = (text, zip) => Schema.decodeEffect(Manifest$2)(text).pipe(Effect.map((manifest) => ({
 	zip,
 	...manifest
 })), Effect.option);
 const folder = () => {
-	if (isSea()) {
-		const assets = process.env["OTUI_ASSET_ROOT"];
-		return assets === void 0 ? void 0 : path.join(assets, path.dirname(seaKeys.zip));
-	}
 	const packageJson = findPackageJSON(import.meta.url);
 	return packageJson === void 0 ? void 0 : path.join(path.dirname(packageJson), "native", "dist");
 };
@@ -8851,9 +8879,16 @@ ready() {
     return 1
   fi
 }
-# A copy of what upup handed over, where only this user can write; a failure is step $1's.
+# A copy of what upup handed over, where only this user can write; a failure is step $1's. Others
+# may also read a shared one ($2): as root, Sparkle starts its progress agent from upup-sparkle's
+# framework as the user, so it goes in /var/tmp, whose sticky bit keeps others from moving it. An
+# app's copy stays private, since its owner gets it after it is checked.
 secure() {
-  private=$(mktemp -d 2>"$log") || { private=; fail "$1"; return 1; }
+  if [ "$mode" = root ] && [ "$2" = shared ]; then
+    private=$(mktemp -d /var/tmp/upup.XXXXXX 2>"$log") && chmod 755 "$private" 2>"$log" || { fail "$1"; return 1; }
+  else
+    private=$(mktemp -d 2>"$log") || { fail "$1"; return 1; }
+  fi
   payload="$private/$(basename "$source")"
   "$ditto" "$source" "$payload" 2>"$log" || { fail "$1"; return 1; }
 }
@@ -8867,7 +8902,7 @@ app() {
   if [ -e "$old" ] && [ ! -e "$dest" ]; then recover; return; fi
   rm -rf "$old" "$new" 2>"$log" || { fail cleanup; return; }
   if [ "$mode" = root ]; then
-    secure copy || return
+    secure copy private || return
     "$codesign" --verify --deep --strict -R "$check" "$payload" 2>"$log" || { fail recheck; return; }
     owner=$("$stat" -f %u:%g "$dest" 2>"$log") && "$chown" -R "$owner" "$payload" 2>"$log" || { fail copy; return; }
     staged=$payload
@@ -8897,7 +8932,7 @@ app() {
 # upup-sparkle's exit status: 0 installed, 2 nothing to install, 3 Sparkle would install another
 # build, 4 the app is open; its last line on standard error says why.
 sparkle() {
-  secure helper || return
+  secure helper shared || return
   sum=$("$shasum" -a 256 "$payload" 2>"$log") || { fail helper; return; }
   [ "\${sum%% *}" = "$check" ] || { echo "its sha256 is \${sum%% *}, not $check" >"$log"; fail helper; return; }
   "$ditto" -x -k "$payload" "$private" 2>"$log" || { fail helper; return; }
@@ -9021,7 +9056,7 @@ const versionsOf = (kind, installed, offer) => {
 		target: withBuild(offer.short, offer.version)
 	};
 };
-const caskInfo = brew$1([
+const caskInfo = brew([
 	"info",
 	"--json=v2",
 	"--installed",
@@ -9283,7 +9318,7 @@ const makeWith = (options) => Effect.gen(function* () {
 	const queue = yield* Ref.make([]);
 	const using = options.tools ?? tools$2;
 	const helper = options.sparkle === void 0 ? locate$3.pipe(Effect.provideService(FileSystem.FileSystem, fs)) : Effect.succeed(options.sparkle);
-	const sparkleOf = (pkg, install, build) => {
+	const sparkleHelper = (pkg, install) => {
 		const refused = (reason) => new InstallRefused({
 			package: pkg.name,
 			reason
@@ -9294,10 +9329,8 @@ const makeWith = (options) => Effect.gen(function* () {
 			if (Option.isNone(found)) return yield* refused("this copy of upup has no upup-sparkle, which installs Sparkle apps' updates; build it with `vp run sparkle`");
 			if (install.installationType === "package" && found.value.team === null) return yield* refused("its update is an installer package, which Sparkle installs only through an upup-sparkle signed with a Developer ID, and this copy of upup's is signed ad hoc");
 			return {
-				kind: "sparkle",
-				helper: found.value,
-				build,
-				feed: install.feed
+				...install,
+				helper: found.value
 			};
 		});
 	};
@@ -9322,21 +9355,23 @@ const makeWith = (options) => Effect.gen(function* () {
 		const inside = yield* hosts.pipe(Effect.mapError((error) => refused(`upup could not tell which app it runs in, so it risks none: ${describeError(error)}`)));
 		if (inside.paths.has(pkg.id) || inside.ids.has(bundle.bundleId)) return yield* refused(`upup is running inside ${pkg.name}; update it from another terminal app`);
 		yield* unchanged$1(pkg, plist);
-		const planned = install.kind === "sparkle" ? yield* sparkleOf(pkg, install, offer.version) : install;
+		const planned = install.kind === "sparkle" ? yield* sparkleHelper(pkg, install) : install;
 		const writable = yield* Effect.isSuccess(Effect.all([fs.access(pkg.id, { writable: true }), fs.access(path.dirname(pkg.id), { writable: true })]));
-		const ownsApp = install.kind === "sparkle" && (yield* owned(pkg.id));
 		const quitAllowed = permission?.quitApps === true;
 		yield* gate(pkg, bundle.bundleId, quitAllowed);
 		const team = yield* teamOf(pkg.id);
 		if (team === void 0) return yield* refused("it is not signed by a developer team, so upup cannot check its update");
-		const version = {
-			key: install.kind === "sparkle" ? "CFBundleVersion" : "CFBundleShortVersionString",
-			value: offer.version
-		};
 		const prepared = planned.kind === "sparkle" ? {
-			...planned,
-			requirement: requirement(bundle.bundleId, team)
-		} : yield* stage(client, {
+			update: {
+				kind: "sparkle",
+				helper: planned.helper,
+				build: offer.version,
+				feed: planned.feed,
+				requirement: requirement(bundle.bundleId, team)
+			},
+			dir: yield* room(pkg.name),
+			root: !writable || planned.installationType === "package" || !(yield* owned(pkg.id))
+		} : yield* Effect.map(stage(client, {
 			name: pkg.name,
 			url: planned.url,
 			...planned.size === void 0 ? {} : { size: planned.size },
@@ -9345,18 +9380,19 @@ const makeWith = (options) => Effect.gen(function* () {
 			team,
 			arch: listing.here.arch,
 			version: offer.version
-		});
-		const dir = prepared.kind === "app" ? prepared.dir : yield* room(pkg.name);
+		}), (staged) => ({
+			update: staged,
+			dir: staged.dir,
+			root: !writable
+		}));
 		yield* Ref.update(queue, (all) => [...all, {
 			pkg,
 			bundleId: bundle.bundleId,
 			executable: path.join("Contents", "MacOS", bundle.executable ?? pkg.name),
 			installed: plist,
-			update: prepared,
-			dir,
+			...prepared,
 			quitAllowed,
-			root: !writable || install.kind === "sparkle" && (install.installationType === "package" || !ownsApp),
-			version,
+			version: offer.version,
 			team
 		}]);
 	}, provide);
@@ -9366,9 +9402,10 @@ const makeWith = (options) => Effect.gen(function* () {
 		if (now.value === item.installed) return replaceable(now.value);
 		const { info, digest } = yield* readInfoStable(item.pkg.id);
 		if (Option.isNone(info) || digest !== now.value || info.value.CFBundleIdentifier !== item.bundleId || (yield* teamOf(item.pkg.id)) !== item.team) return changed;
-		const version = info.value[item.version.key];
-		if (version === item.version.value) return alreadyUpdated;
-		return version !== void 0 && (item.version.key === "CFBundleVersion" ? isNewer(item.version.value, version) : isNewerRelease(item.version.value, version)) ? replaceable(now.value) : changed;
+		const sparkle = item.update.kind === "sparkle";
+		const version = sparkle ? info.value.CFBundleVersion : info.value.CFBundleShortVersionString;
+		if (version === item.version) return alreadyUpdated;
+		return version !== void 0 && (sparkle ? isNewer(item.version, version) : isNewerRelease(item.version, version)) ? replaceable(now.value) : changed;
 	}).pipe(Effect.orElseSucceed(() => changed));
 	const ready = (item) => Effect.gen(function* () {
 		const now = yield* installedNow(item);
@@ -9473,7 +9510,7 @@ const makeWith = (options) => Effect.gen(function* () {
 		uninstall: Effect.fn("Apps.uninstall")(function* (pkg) {
 			const token = (yield* Ref.get(memory))?.rows.get(pkg.id)?.cask;
 			if (token === void 0) return yield* new Unsupported({ reason: unremovable$1 });
-			yield* exec.stdout(brew$1([
+			yield* exec.stdout(brew([
 				"uninstall",
 				"--cask",
 				token
@@ -9927,6 +9964,11 @@ const matchesGoPattern = (pattern, path) => {
 	const prefix = segments.slice(0, parts.length).join("/");
 	return new RegExp(`^${parts.map((part) => RegExp.escape(part).replaceAll("\\*", "[^/]*").replaceAll("\\?", "[^/]")).join("/")}$`, "u").test(prefix);
 };
+const GoProxyEnv = Schema.Struct({
+	GOPROXY: Schema.optionalKey(Schema.String),
+	GOPRIVATE: Schema.optionalKey(Schema.String),
+	GONOPROXY: Schema.optionalKey(Schema.String)
+});
 const privateGoModule = (env, path) => {
 	if (goPatterns(env.GONOPROXY === void 0 || env.GONOPROXY === "" ? env.GOPRIVATE ?? "" : env.GONOPROXY).some((pattern) => matchesGoPattern(pattern, path))) return "a GOPRIVATE module";
 	const [proxy] = goPatterns((env.GOPROXY ?? "https://proxy.golang.org,direct").replaceAll("|", ","));
@@ -9944,7 +9986,21 @@ const privatePypiIndex = (env = process.env) => {
 	const index = env["UV_DEFAULT_INDEX"] ?? env["UV_INDEX_URL"] ?? env["PIP_INDEX_URL"];
 	return index === void 0 || index === "" || publicPypi.has(trailing(index)) ? void 0 : index;
 };
+const withPypiOrigin = (index) => (pkg) => index === void 0 ? pkg : {
+	...pkg,
+	privateRegistry: index
+};
 // src/go/go-json.ts
+const go = (cwd, args, env = {}) => ({
+	command: "go",
+	args,
+	cwd,
+	env: {
+		GOWORK: "off",
+		GIT_TERMINAL_PROMPT: "0",
+		...env
+	}
+});
 const decodeGoJson = (schema, command) => decodeJson(Schema.toCodecGoJson(schema), command);
 const jsonObjects = (text) => {
 	const objects = [];
@@ -9973,22 +10029,14 @@ const jsonObjects = (text) => {
 const GoEnv = Schema.Struct({
 	GOBIN: Schema.String,
 	GOPATH: Schema.String,
-	GOPROXY: Schema.optionalKey(Schema.String),
-	GOPRIVATE: Schema.optionalKey(Schema.String),
-	GONOPROXY: Schema.optionalKey(Schema.String)
+	...GoProxyEnv.fields
 });
-const envKeys = [
-	"GOBIN",
-	"GOPATH",
-	"GOPROXY",
-	"GOPRIVATE",
-	"GONOPROXY"
-];
+const envKeys = Object.keys(GoEnv.fields);
 const BuildInfo = Schema.Struct({
-	Path: Schema.String,
+	Path: Schema.optionalKey(Schema.String),
 	Main: Schema.Struct({
-		Path: Schema.String,
-		Version: Schema.String,
+		Path: Schema.optionalKey(Schema.String),
+		Version: Schema.optionalKey(Schema.String),
 		Sum: Schema.optionalKey(Schema.String),
 		Replace: Schema.optionalKey(Schema.Unknown)
 	})
@@ -9998,36 +10046,27 @@ const ModuleQuery = Schema.Struct({
 	Version: Schema.String,
 	Error: Schema.optionalKey(Schema.Struct({ Err: Schema.String }))
 });
-const go = (args, env = {}) => ({
-	command: "go",
-	args,
-	cwd: "/",
-	env: {
-		GOWORK: "off",
-		GIT_TERMINAL_PROMPT: "0",
-		...env
-	}
-});
 const executableName = (importPath) => {
 	const elements = importPath.split("/");
 	const last = elements.at(-1) ?? importPath;
 	return /^v\d+$/u.test(last) && elements.length > 1 ? elements.at(-2) ?? last : last;
 };
 const fromBuildInfo = (info, file) => {
-	const { Main: main } = info;
-	return main.Sum !== void 0 && main.Sum !== "" && main.Replace === void 0 && semver.valid(main.Version) !== null && (info.Path === main.Path || info.Path.startsWith(`${main.Path}/`)) && executableName(info.Path) === file ? Option.some({
+	const { Path: importPath, Main: main } = info;
+	const { Path: module, Version: version } = main;
+	return importPath !== void 0 && module !== void 0 && version !== void 0 && main.Sum !== void 0 && main.Replace === void 0 && semver.valid(version) !== null && (importPath === module || importPath.startsWith(`${module}/`)) && executableName(importPath) === file ? Option.some({
 		provider: "go-install",
-		id: info.Path,
+		id: importPath,
 		name: file,
 		ecosystem: "go",
-		artifact: main.Path,
-		current: main.Version
+		artifact: module,
+		current: version
 	}) : Option.none();
 };
 const make$8 = Effect.gen(function* () {
 	const exec = yield* Exec;
 	const fs = yield* FileSystem.FileSystem;
-	const envInvocation = go([
+	const envInvocation = go("/", [
 		"env",
 		"-json",
 		...envKeys
@@ -10035,7 +10074,7 @@ const make$8 = Effect.gen(function* () {
 	const goEnv = yield* Effect.cached(exec.stdout(envInvocation).pipe(Effect.flatMap(decodeGoJson(GoEnv, commandLine(envInvocation)))));
 	const binDir = goEnv.pipe(Effect.map((env) => env.GOBIN || path.join(env.GOPATH.split(":")[0] ?? env.GOPATH, "bin")));
 	const inspect = Effect.fn("GoInstall.inspect")(function* (dir, file) {
-		const invocation = go([
+		const invocation = go("/", [
 			"version",
 			"-m",
 			"-json",
@@ -10057,7 +10096,7 @@ const make$8 = Effect.gen(function* () {
 	});
 	const latest = Effect.fn("GoInstall.latest")(function* (modules) {
 		if (modules.length === 0) return /* @__PURE__ */ new Map();
-		const invocation = go([
+		const invocation = go("/", [
 			"list",
 			"-m",
 			"-e",
@@ -10107,7 +10146,7 @@ const make$8 = Effect.gen(function* () {
 		}),
 		update: Effect.fn("GoInstall.update")(function* (pkg, target) {
 			const dir = yield* binDir;
-			yield* exec.stdout(go([
+			yield* exec.stdout(go("/", [
 				"install",
 				"--",
 				`${pkg.id}@${target}`
@@ -10140,27 +10179,12 @@ const WorkFile = Schema.Struct({
 	Use: Schema.optionalKey(Schema.Array(Schema.Struct({ DiskPath: Schema.String }))),
 	Replace: Schema.optionalKey(Schema.Array(Schema.Struct({ Old: Schema.Struct({ Path: Schema.String }) })))
 });
-const goEnv = {
-	GOWORK: "off",
-	GIT_TERMINAL_PROMPT: "0"
-};
-const GoProxyEnv = Schema.Struct({
-	GOPROXY: Schema.optionalKey(Schema.String),
-	GOPRIVATE: Schema.optionalKey(Schema.String),
-	GONOPROXY: Schema.optionalKey(Schema.String)
-});
 const directRequirements = (mod, local) => {
 	const replaced = new Set((mod.Replace ?? []).map((replace) => replace.Old.Path));
 	return (mod.Require ?? []).filter((requirement) => requirement.Indirect !== true && !replaced.has(requirement.Path) && !local.has(requirement.Path));
 };
-const goIn = (cwd, args) => ({
-	command: "go",
-	args,
-	cwd,
-	env: goEnv
-});
 const readModFile = (exec, cwd) => {
-	const edit = goIn(cwd, [
+	const edit = go(cwd, [
 		"mod",
 		"edit",
 		"-json"
@@ -10170,13 +10194,13 @@ const readModFile = (exec, cwd) => {
 const make$7 = (root, moduleDir, place = "", local = /* @__PURE__ */ new Set()) => Effect.gen(function* () {
 	const exec = yield* Exec;
 	const manifest = path.join(place, path.relative(root, path.join(moduleDir, "go.mod")));
-	const go = (args) => goIn(moduleDir, args);
+	const inModule = (args) => go(moduleDir, args);
 	const requirements = Effect.gen(function* () {
 		return directRequirements(yield* readModFile(exec, moduleDir), local);
 	});
 	const selected = Effect.fn("GoModule.selected")(function* (paths, withUpdates) {
 		if (paths.length === 0) return /* @__PURE__ */ new Map();
-		const list = go([
+		const list = inModule([
 			"list",
 			"-m",
 			...withUpdates ? ["-u"] : [],
@@ -10202,12 +10226,10 @@ const make$7 = (root, moduleDir, place = "", local = /* @__PURE__ */ new Set())
 			selector: requirement.Version
 		}
 	});
-	const env = go([
+	const env = inModule([
 		"env",
 		"-json",
-		"GOPROXY",
-		"GOPRIVATE",
-		"GONOPROXY"
+		...Object.keys(GoProxyEnv.fields)
 	]);
 	const origin = exec.stdout(env).pipe(Effect.flatMap(decodeGoJson(GoProxyEnv, commandLine(env))), Effect.map(withGoOrigin));
 	const list = Effect.gen(function* () {
@@ -10238,16 +10260,16 @@ const make$7 = (root, moduleDir, place = "", local = /* @__PURE__ */ new Set())
 		return Option.some(toPackage(requirement, entries.get(requirement.Path)));
 	});
 	const update = Effect.fn("GoModule.update")(function* (pkg, target) {
-		yield* exec.stdout(go(["get", `${pkg.id}@${target}`]));
+		yield* exec.stdout(inModule(["get", `${pkg.id}@${target}`]));
 	});
 	const uninstall = Effect.fn("GoModule.uninstall")(function* (pkg) {
-		yield* exec.stdout(go([
+		yield* exec.stdout(inModule([
 			"mod",
 			"edit",
 			`-droprequire=${pkg.id}`
 		]));
 	});
-	const reconcile = () => exec.stdout(go(["mod", "tidy"])).pipe(Effect.as(void 0));
+	const reconcile = () => exec.stdout(inModule(["mod", "tidy"])).pipe(Effect.as(void 0));
 	return {
 		name: manifest,
 		mode: "project",
@@ -10663,7 +10685,6 @@ const makeVp = makeGlobal({
 	list: [
 		"list",
 		"-g",
-		"--depth=0",
 		"--json"
 	],
 	outdated: [
@@ -10796,7 +10817,6 @@ const make$6 = (root, dir = root, nested = []) => Effect.gen(function* () {
 	const client = yield* HttpClient.HttpClient;
 	const context = yield* Effect.context();
 	const scanned = scan(root, dir, nested).pipe(Effect.provideContext(context));
-	const read = (file) => readText(path.join(root, file)).pipe(Effect.provideService(FileSystem.FileSystem, fs));
 	const list = Effect.gen(function* () {
 		const pins = yield* scanned;
 		const notices = [];
@@ -10835,19 +10855,15 @@ const make$6 = (root, dir = root, nested = []) => Effect.gen(function* () {
 			manifest: pkg.declaration?.manifest ?? "",
 			issue: `Node.js ${pkg.current} is no longer pinned there`
 		});
-		const edited = /* @__PURE__ */ new Map();
-		for (const pin of group) {
-			const text = edited.get(pin.file) ?? (yield* read(pin.file));
-			const next = `${pin.prefix}${target}`;
-			const { parts, at } = versionLine(text);
-			const moved = pin.path === void 0 ? Result.succeed(parts.map((part, index) => index === at ? part.replace(`${pin.prefix}${pin.version}`, next) : part).join("")) : editYamlScalar(text, pin.path, next);
-			if (Result.isFailure(moved)) return yield* new EditRefused({
-				manifest: pin.file,
-				issue: moved.failure
-			});
-			edited.set(pin.file, moved.success);
-		}
-		for (const [file, text] of edited) yield* replaceText(path.join(root, file), text).pipe(Effect.provideService(FileSystem.FileSystem, fs));
+		yield* editFiles(root, group.map((pin) => ({
+			file: pin.file,
+			edit: (text) => {
+				const next = `${pin.prefix}${target}`;
+				if (pin.path !== void 0) return editYamlScalar(text, pin.path, next);
+				const { parts, at } = versionLine(text);
+				return Result.succeed(parts.map((part, index) => index === at ? part.replace(`${pin.prefix}${pin.version}`, next) : part).join(""));
+			}
+		}))).pipe(Effect.provideService(FileSystem.FileSystem, fs));
 	});
 	return {
 		name: providerName,
@@ -11158,7 +11174,7 @@ const make$5 = (root, manager, place = "", claimed = []) => Effect.gen(function*
 					message: line.failure
 				});
 				const target = Result.getOrUndefined(line);
-				if (target === void 0 || !isNewerStable(pkg.current, target)) return pkg;
+				if (target === void 0) return pkg;
 				const selector = parseSelector(pkg.name, pkg.declaration?.selector ?? "");
 				if (selector === void 0 || moveTo(selector, target) === void 0) {
 					notices.push({
@@ -11829,13 +11845,10 @@ const make = Effect.gen(function* () {
 				"--show-python"
 			])).pipe(Effect.map(parseTools))], { concurrency: "unbounded" });
 			const targets = new Map(outdated.flatMap((tool) => tool.fromPyPI && tool.latest !== void 0 ? [[tool.pkg.id, tool.latest]] : []));
-			const index = privatePypiIndex();
+			const origin = withPypiOrigin(privatePypiIndex());
 			return {
 				packages: packages.map((listed) => {
-					const pkg = index === void 0 ? listed : {
-						...listed,
-						privateRegistry: index
-					};
+					const pkg = origin(listed);
 					const target = targets.get(pkg.id);
 					return target === void 0 ? pkg : withTarget(pkg, target);
 				}),
@@ -11927,12 +11940,12 @@ const deprecationOf = (formula) => {
 	if (formula.disabled) return `Homebrew disabled it (${formula.disable_reason ?? "no reason given"})`;
 	if (formula.deprecated) return formula.deprecation_reason ?? "no reason given";
 };
-const lookup$4 = Effect.fn("brew.lookup")(function* (client, wanted) {
+const lookup$3 = Effect.fn("brew.lookup")(function* (client, wanted) {
 	if (wanted.name.includes("/")) return yield* new MetadataUnavailable({
 		source: wanted.name,
 		issue: "Homebrew's API only describes formulae and casks from the core taps"
 	});
-	const kind = wanted.kind === "cask" ? "cask" : "formula";
+	const kind = wanted.kind ?? "formula";
 	const formula = yield* getJson(client, `https://formulae.brew.sh/api/${kind}/${wanted.name}.json`, Formula);
 	const installs = formula.analytics?.install["30d"][wanted.name];
 	const deprecated = deprecationOf(formula);
@@ -11960,7 +11973,7 @@ const Crate = Schema.Struct({
 		yank_message: Schema.NullOr(Schema.String)
 	}))
 });
-const lookup$3 = Effect.fn("crates.lookup")(function* (client, wanted) {
+const lookup$2 = Effect.fn("crates.lookup")(function* (client, wanted) {
 	const { crate, versions } = yield* getJson(client, `https://crates.io/api/v1/crates/${wanted.name}`, Crate);
 	const relevant = versions.filter((version) => wanted.versions.includes(version.num));
 	return {
@@ -11981,7 +11994,7 @@ const Repository = Schema.Struct({
 	archived: Schema.Boolean
 });
 const Release = Schema.Struct({ published_at: Schema.NullOr(Schema.String) });
-const lookup$2 = Effect.fn("githubActions.lookup")(function* (client, wanted) {
+const lookup$1 = Effect.fn("githubActions.lookup")(function* (client, wanted) {
 	const token = yield* githubToken.pipe(Effect.provide(nodeLayer));
 	const headers = githubHeaders(token);
 	const base = `${githubApi}/repos/${wanted.name}`;
@@ -11997,41 +12010,6 @@ const lookup$2 = Effect.fn("githubActions.lookup")(function* (client, wanted) {
 		withdrawn: {}
 	};
 });
-// src/registry/npm.ts
-const Version = Schema.Struct({ deprecated: Schema.optionalKey(Schema.Unknown) });
-const Packument = Schema.Struct({
-	description: Schema.optionalKey(Schema.String),
-	homepage: Schema.optionalKey(Schema.String),
-	repository: Schema.optionalKey(Schema.Union([Schema.String, Schema.Struct({ url: Schema.optionalKey(Schema.String) })])),
-	"dist-tags": Schema.optionalKey(Schema.Struct({ latest: Schema.optionalKey(Schema.String) })),
-	time: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
-	versions: Schema.optionalKey(Schema.Record(Schema.String, Version))
-});
-const Downloads = Schema.Struct({ downloads: Schema.Finite });
-const message = (version) => {
-	const deprecated = version?.deprecated;
-	return Predicate.isString(deprecated) && deprecated !== "" ? Option.some(deprecated) : Option.none();
-};
-const lookup$1 = Effect.fn("npm.lookup")(function* (client, wanted) {
-	const path = wanted.name.replace("/", "%2F");
-	const [packument, downloads] = yield* Effect.all([getJson(client, `https://registry.npmjs.org/${path}`, Packument), getJson(client, `https://api.npmjs.org/downloads/point/last-week/${wanted.name}`, Downloads).pipe(Effect.option)], { concurrency: "unbounded" });
-	const versions = packument.versions ?? {};
-	const latest = packument["dist-tags"]?.latest;
-	const repository = Predicate.isString(packument.repository) ? packument.repository : packument.repository?.url;
-	const deprecated = latest === void 0 ? Option.none() : message(versions[latest]);
-	return {
-		...packument.description === void 0 ? {} : { description: packument.description },
-		...packument.homepage === void 0 ? {} : { homepage: packument.homepage },
-		...repository === void 0 ? {} : { repository: repositoryUrl(repository) },
-		...Option.isSome(downloads) ? { popularity: `${count(downloads.value.downloads)} downloads last week` } : {},
-		...Option.isSome(deprecated) ? { deprecated: deprecated.value } : {},
-		released: pick$1(packument.time ?? {}, wanted.versions),
-		withdrawn: Object.fromEntries(wanted.versions.flatMap((version) => Option.match(message(versions[version]), {
-			onNone: () => [],
-			onSome: (reason) => [[version, reason]]
-		})))
-	};
-});
 // src/registry/pypi.ts
 const Project = Schema.Struct({
 	info: Schema.Struct({
@@ -12081,12 +12059,12 @@ const vendor = (source, issue) => (_, wanted) => Effect.fail(new MetadataUnavail
 	issue: `${wanted.name} ${issue}`
 }));
 const sources = {
-	brew: lookup$4,
-	npm: lookup$1,
-	crates: lookup$3,
+	brew: lookup$3,
+	npm: lookup$4,
+	crates: lookup$2,
 	go: lookup$5,
 	pypi: lookup,
-	"github-actions": lookup$2,
+	"github-actions": lookup$1,
 	macos: vendor("Software Update", "comes from Apple's Software Update, which has no registry"),
 	apt: vendor("apt", "comes from your distribution's apt repositories, which upup does not read"),
 	sparkle: vendor("Sparkle", "updates from its own Sparkle feed, which has no registry"),
@@ -12103,7 +12081,7 @@ const freshFor = 864e5;
 const wanted = (pkg) => ({
 	name: pkg.artifact,
 	versions: [pkg.current, ...pkg.target === void 0 ? [] : [pkg.target]],
-	...isCask(pkg) ? { kind: "cask" } : {}
+	...kindOf$2(pkg) === "cask" ? { kind: "cask" } : {}
 });
 const layer$2 = (cacheDir) => Layer.effect(Registry, Effect.gen(function* () {
 	const client = yield* HttpClient.HttpClient;
@@ -12440,15 +12418,16 @@ const auditTools = (home) => Action.implement(AuditActions, Effect.gen(function*
 	const audits = yield* Audits;
 	const ai = yield* Ai;
 	const status = (pkg, mode) => Effect.gen(function* () {
-		const identity = identityOf(pkg, mode);
-		if (identity === void 0) {
-			const reason = unauditable(pkg) ?? "no update is offered";
+		const audit = auditOf(pkg, mode);
+		if (Result.isFailure(audit)) {
+			const reason = audit.failure;
 			return {
 				key: rowKey(pkg),
 				status: "not-auditable",
 				reason: `${reason.charAt(0).toUpperCase()}${reason.slice(1)}.`
 			};
 		}
+		const identity = audit.success;
 		const job = (yield* audits.jobs)[jobKey(identity)];
 		if (job?._tag === "Running") return {
 			key: rowKey(pkg),
@@ -12481,17 +12460,17 @@ const auditTools = (home) => Action.implement(AuditActions, Effect.gen(function*
 		}),
 		package_changes: ({ key, path, ...where }) => Effect.gen(function* () {
 			const { scope, pkg } = yield* resolve.one(where, key);
-			const identity = identityOf(pkg, scope.mode);
-			if (identity === void 0) {
+			const audit = auditOf(pkg, scope.mode);
+			if (Result.isFailure(audit)) {
 				if (pkg.target === void 0) return yield* new ChangesUnavailable({ issue: "No update is offered." });
-				if (pkg.notes === void 0) return yield* new ChangesUnavailable({ issue: `Nothing to compare: ${unauditable(pkg) ?? "it has no exact update to compare"}${isAppUpdate(pkg) ? ", and its feed has no release notes" : ""}.` });
+				if (pkg.notes === void 0) return yield* new ChangesUnavailable({ issue: `Nothing to compare: ${audit.failure}${isAppUpdate(pkg) ? ", and its feed has no release notes" : ""}.` });
 				if (path !== void 0) return yield* new ChangesUnavailable({ issue: `${pkg.name}'s update has release notes but no files to diff; leave out path.` });
 				return {
 					...versions(pkg),
 					notes: pkg.notes
 				};
 			}
-			const view = yield* audits.changes(identity);
+			const view = yield* audits.changes(audit.success);
 			const files = view.sections.map((section) => ({
 				path: sectionPath(section),
 				...changedLines(section),
@@ -12796,33 +12775,34 @@ const reasonFor = (result) => Option.match(result, {
 	onNone: () => "it has no finished audit of these exact artifacts",
 	onSome: (found) => found._tag === "Failed" ? `its audit failed: ${found.issue}` : `its audit found ${found.report.verdict}`
 });
+const approves = (result) => Option.isSome(result) && result.value._tag === "Reported" && result.value.report.verdict === "ok";
 const screen = (targets, mode, resultOf) => Effect.gen(function* () {
-	const identities = /* @__PURE__ */ new Map();
-	for (const target of targets) {
-		const identity = identityOf(target.pkg, mode);
-		if (identity !== void 0) identities.set(workspaceKey(identity), identity);
-	}
-	const results = new Map(yield* Effect.forEach(identities, ([key, identity]) => Effect.map(resultOf(identity), (result) => [key, result]), { concurrency: 4 }));
-	const approved = [];
 	const refused = {};
+	const groups = /* @__PURE__ */ new Map();
 	for (const target of targets) {
-		if (isUnauditedUpdate(target.pkg)) {
-			approved.push(target);
+		if (isUnauditedUpdate(target.pkg)) continue;
+		const audit = auditOf(target.pkg, mode);
+		if (Result.isFailure(audit)) {
+			refused[rowKey(target.pkg)] = Outcome.Excluded({ reason: audit.failure });
 			continue;
 		}
-		const identity = identityOf(target.pkg, mode);
-		const result = identity === void 0 ? void 0 : results.get(workspaceKey(identity));
-		if (result !== void 0 && Option.isSome(result)) {
-			const found = result.value;
-			if (found._tag === "Reported" && found.report.verdict === "ok") {
-				approved.push(target);
-				continue;
-			}
-		}
-		refused[rowKey(target.pkg)] = Outcome.Excluded({ reason: result === void 0 ? unauditable(target.pkg) ?? "it has no exact update to audit" : reasonFor(result) });
+		const key = workspaceKey(audit.success);
+		const group = groups.get(key) ?? {
+			identity: audit.success,
+			members: []
+		};
+		group.members.push(target);
+		groups.set(key, group);
 	}
+	yield* Effect.forEach(groups.values(), ({ identity, members }) => Effect.map(resultOf(identity), (found) => {
+		if (approves(found)) return;
+		for (const target of members) refused[rowKey(target.pkg)] = Outcome.Excluded({ reason: reasonFor(found) });
+	}), {
+		concurrency: 4,
+		discard: true
+	});
 	return {
-		approved,
+		approved: targets.filter((target) => !Object.hasOwn(refused, rowKey(target.pkg))),
 		refused
 	};
 });
@@ -13165,8 +13145,7 @@ const initial = (mode, scope, preferences, audits = {}, settingsIssue) => ({
 	selected: [],
 	operation: machine$1.initialState,
 	activity: {},
-	outcomes: {},
-	actions: {},
+	ran: {},
 	installed: {},
 	removed: {},
 	password: void 0,
@@ -13459,8 +13438,7 @@ const layer = Layer.effect(Session, Effect.gen(function* () {
 	const reset = (mode, scope) => SubscriptionRef.update(state, (current) => {
 		places.set(`${current.mode}:${current.scope}`, {
 			selected: current.selected,
-			outcomes: current.outcomes,
-			actions: current.actions,
+			ran: current.ran,
 			installed: current.installed,
 			removed: current.removed
 		});
@@ -13531,13 +13509,12 @@ const layer = Layer.effect(Session, Effect.gen(function* () {
 		const confirmed = targets.filter((target) => accepted.includes(rowKey(target.pkg)));
 		const chosen = vetting ? vet(targets.filter((target) => !accepted.includes(rowKey(target.pkg))), current.mode).pipe(Effect.flatMap(({ approved, refused }) => update((latest) => ({
 			...latest,
-			outcomes: {
-				...latest.outcomes,
-				...refused
-			},
-			actions: {
-				...latest.actions,
-				...Object.fromEntries(Object.keys(refused).map((key) => [key, action]))
+			ran: {
+				...latest.ran,
+				...Object.fromEntries(Object.entries(refused).map(([key, outcome]) => [key, {
+					action,
+					outcome
+				}]))
 			}
 		})).pipe(Effect.as([...confirmed, ...approved])))) : Effect.succeed(targets);
 		yield* FiberHandle.run(operation, chosen.pipe(Effect.tap((approved) => update((latest) => ({
@@ -13555,13 +13532,12 @@ const layer = Layer.effect(Session, Effect.gen(function* () {
 		} : {
 			...latest,
 			activity: without(latest.activity, event.key),
-			outcomes: {
-				...latest.outcomes,
-				[event.key]: event.outcome
-			},
-			actions: {
-				...latest.actions,
-				[event.key]: action
+			ran: {
+				...latest.ran,
+				[event.key]: {
+					action,
+					outcome: event.outcome
+				}
 			},
 			installed: installedAfter(latest.installed, approved, event),
 			removed: removedAfter(latest.removed, approved, event),
@@ -13587,10 +13563,10 @@ const layer = Layer.effect(Session, Effect.gen(function* () {
 		if ((yield* SubscriptionRef.get(state)).about[key] !== void 0) return;
 		yield* about.load(key, registry.lookup(pkg));
 	});
-	const readTranscript = Effect.fn("Session.readTranscript")(function* (file) {
-		const known = (yield* SubscriptionRef.get(state)).transcripts[file];
+	const readTranscript = Effect.fn("Session.readTranscript")(function* (paths) {
+		const known = (yield* SubscriptionRef.get(state)).transcripts[paths.file];
 		if (known !== void 0 && known._tag !== "Unavailable") return;
-		yield* transcripts.load(file, audits.transcript(file));
+		yield* transcripts.load(paths.file, audits.transcript(paths));
 	});
 	const readChanges = Effect.fn("Session.readChanges")(function* (pkg) {
 		const current = yield* SubscriptionRef.get(state);
@@ -13751,7 +13727,7 @@ const silenceNodeWarningsWhileTuiDraws = () => {
 };
 const loadTui = Effect.suspend(() => {
 	silenceNodeWarningsWhileTuiDraws();
-	return process.getBuiltinModule("node:ffi") === void 0 ? Effect.die(`upup's TUI needs Node 26.13 or newer; this is Node ${process.versions.node}`) : Effect.promise(async () => await import("./Tui-DV_6wbrQ.mjs"));
+	return process.getBuiltinModule("node:ffi") === void 0 ? Effect.die(`upup's TUI needs Node 26.13 or newer; this is Node ${process.versions.node}`) : Effect.promise(async () => await import("./Tui-Ri-yz-Sx.mjs"));
 });
 const open$1 = (begin, projectDir) => Effect.gen(function* () {
 	const { launch } = yield* loadTui;