@kaynooo/cli-pkg 0.7.0 → 0.8.0

package/dist/cli.js

@@ -26,7 +26,19 @@ var __esm = (fn, res, err) => () => {
   return res;
 };
 
-// ../../node_modules/.bun/@kaynooo+utils@2.31.0+d0769e28dc4dad16/node_modules/@kaynooo/utils/dist/chunk-mtetydvc.js
+// ../kit/src/advisory.ts
+function severityRank(severity) {
+  return SEVERITIES.indexOf(severity);
+}
+function isIgnored(advisory, ignore) {
+  return ignore.includes(advisory.ghsa ?? "") || ignore.includes(String(advisory.id));
+}
+var SEVERITIES;
+var init_advisory = __esm(() => {
+  SEVERITIES = ["low", "moderate", "high", "critical"];
+});
+
+// ../../node_modules/.bun/@kaynooo+utils@2.31.2+d0769e28dc4dad16/node_modules/@kaynooo/utils/dist/chunk-mtetydvc.js
 function x(s) {
   let r = s.startsWith("#") ? s.slice(1).toLowerCase() : s.toLowerCase();
   if (!/^[a-f0-9]+$/.test(r))
@@ -245,7 +257,7 @@ class e {
 var m = (s) => s <= 0.04045 ? s / 12.92 : ((s + 0.055) / 1.055) ** 2.4, p = (s) => s <= 0.0031308 ? 12.92 * s : 1.055 * s ** 0.4166666666666667 - 0.055, i = (s, r) => Math.round(s * 10 ** r) / 10 ** r;
 var init_chunk_mtetydvc = () => {};
 
-// ../../node_modules/.bun/@kaynooo+utils@2.31.0+d0769e28dc4dad16/node_modules/@kaynooo/utils/dist/chunk-y1msbssb.js
+// ../../node_modules/.bun/@kaynooo+utils@2.31.2+d0769e28dc4dad16/node_modules/@kaynooo/utils/dist/chunk-y1msbssb.js
 function h(i, n = globalThis.process?.env ?? {}) {
   if (n.FORCE_COLOR !== undefined)
     return b.has(n.FORCE_COLOR);
@@ -287,36 +299,36 @@ var init_chunk_y1msbssb = __esm(() => {
   t = le();
 });
 
-// ../../node_modules/.bun/@kaynooo+utils@2.31.0+d0769e28dc4dad16/node_modules/@kaynooo/utils/dist/tools/colors.js
+// ../../node_modules/.bun/@kaynooo+utils@2.31.2+d0769e28dc4dad16/node_modules/@kaynooo/utils/dist/tools/colors.js
 var init_colors = __esm(() => {
   init_chunk_y1msbssb();
 });
 
 // ../kit/src/style.ts
-import process from "process";
-function takesControlCodes(stream, env = process.env) {
+import process2 from "process";
+function takesControlCodes(stream, env = process2.env) {
   return stream.isTTY === true && env.NO_COLOR === undefined && env.NODE_DISABLE_COLORS === undefined && env.TERM !== "dumb";
 }
-function paint(stream, env = process.env) {
+function paint(stream, env = process2.env) {
   return le({ stream: { isTTY: takesControlCodes(stream, env) }, env });
 }
-function marked(mark, text, stream, detail, env = process.env) {
+function marked(mark, text, stream, detail, env = process2.env) {
   const colors = paint(stream, env);
   const { symbol, word, paint: tint } = MARKS[mark];
   const head = takesControlCodes(stream, env) ? tint(colors)(symbol) : word;
   return `${head} ${text}${detail === undefined ? "" : ` ${colors.dim(detail)}`}`;
 }
 function ok(text, detail) {
-  console.log(marked("ok", text, process.stdout, detail));
+  console.log(marked("ok", text, process2.stdout, detail));
 }
 function note(text, detail) {
-  console.log(marked("note", text, process.stdout, detail));
+  console.log(marked("note", text, process2.stdout, detail));
 }
 function warn(text, detail) {
-  console.error(marked("warn", text, process.stderr, detail));
+  console.error(marked("warn", text, process2.stderr, detail));
 }
 function problem(text, detail) {
-  console.error(marked("problem", text, process.stderr, detail));
+  console.error(marked("problem", text, process2.stderr, detail));
 }
 var MARKS, STATUSES, STATUS_OF;
 var init_style = __esm(() => {
@@ -338,7 +350,7 @@ var init_style = __esm(() => {
 });
 
 // ../kit/src/format.ts
-import process2 from "process";
+import process3 from "process";
 function formatSeconds(total) {
   let rest = Math.max(0, Math.round(total));
   const amounts = UNITS.map(([unit, size]) => {
@@ -383,7 +395,7 @@ function table(rows, { cellWidth, header = false, align = [], fit } = {}) {
       widths[index] = Math.max(widths[index] ?? 0, textWidth(cell));
   }
   const shown = fit === undefined ? cells : narrow(cells, widths, fit);
-  const colors = paint(process2.stdout);
+  const colors = paint(process3.stdout);
   const lines = shown.map((row) => row.map((cell, index) => {
     const width = widths[index] ?? 0;
     const gap = " ".repeat(Math.max(0, width - textWidth(cell)));
@@ -421,6 +433,67 @@ var init_format = __esm(() => {
   ESCAPE = String.fromCharCode(27);
 });
 
+// ../kit/src/help.ts
+import process4 from "process";
+function usageLine(usage, colors = paint(process4.stdout)) {
+  return `${colors.bold("Usage:")} ${usage.replace(USAGE_PREFIX, "").replaceAll(OPTIONAL, (part) => colors.dim(part))}`;
+}
+function helpText(usage, options, colors = paint(process4.stdout), { examples = [], replaces, exits = [] } = {}) {
+  return [usageLine(usage, colors), ...replacesRows(replaces, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exitRows(exits, colors), ...exampleRows(examples, colors)].join(`
+`);
+}
+function exitRows(exits, colors = paint(process4.stdout)) {
+  if (exits.length === 0)
+    return [];
+  const width = Math.max(...exits.map(([code]) => String(code).length));
+  return ["", colors.bold("Exits:"), ...exits.map(([code, meaning]) => `  ${colors.cyan(String(code).padEnd(width))}  ${meaning}`)];
+}
+function replacesRows(replaces, colors = paint(process4.stdout)) {
+  return replaces === undefined ? [] : ["", `${colors.bold("Instead of:")} ${replaces}`];
+}
+function wantsHelpJson(env = process4.env) {
+  return env.KIT_HELP === "json";
+}
+function description(usage, { examples = [], replaces, exits } = {}, options) {
+  const lines = usage.replace(USAGE_PREFIX, "").split(`
+`);
+  const first = lines[0];
+  const colon = first.indexOf(": ");
+  const prose = lines[lines.indexOf("") + 1] ?? "";
+  const fallback = lines.includes("") ? `${prose.charAt(0).toLowerCase()}${prose.slice(1)}`.replace(FULL_STOP, "") : "";
+  return {
+    synopsis: colon === -1 ? first : first.slice(0, colon),
+    summary: colon === -1 ? fallback : first.slice(colon + 2),
+    ...replaces === undefined ? {} : { replaces },
+    examples: examples.map((example) => typeof example === "string" ? { line: example } : { line: example[0], note: example[1] }),
+    ...exits === undefined ? {} : { exits: exits.map(([code, meaning]) => ({ code, meaning })) },
+    ...options === undefined ? {} : { options: Object.entries(options).map(([name, { short, description }]) => ({ name, ...short === undefined ? {} : { short }, ...description === undefined ? {} : { description } })) }
+  };
+}
+function exampleRows(examples, colors = paint(process4.stdout)) {
+  if (examples.length === 0)
+    return [];
+  return ["", colors.bold("Examples:"), ...examples.map((example) => typeof example === "string" ? `  ${example}` : `  ${example[0]}  ${colors.dim(`# ${example[1]}`)}`)];
+}
+function optionRows(options, colors = paint(process4.stdout)) {
+  const rows = Object.entries(options).map(([name, option]) => {
+    const short = option.short === undefined ? "    " : `${colors.cyan(`-${option.short}`)}, `;
+    const named = option.choices === undefined ? "<value>" : `<${option.choices.join("|")}>`;
+    const placeholder = option.optional === undefined ? named : `[${named}]`;
+    const value = option.type === "string" ? ` ${colors.dim(placeholder)}` : "";
+    return { flag: `${short}${colors.cyan(`--${name}`)}${value}`, width: `-x, --${name}`.length + (option.type === "string" ? placeholder.length + 1 : 0), description: option.description ?? "" };
+  });
+  const width = Math.max(0, ...rows.map((row) => row.width));
+  return rows.map((row) => row.description === "" ? `  ${row.flag}` : `  ${row.flag}${" ".repeat(width - row.width)}  ${colors.dim(row.description)}`);
+}
+var OPTIONAL, USAGE_PREFIX, FULL_STOP;
+var init_help = __esm(() => {
+  init_style();
+  OPTIONAL = /\[[^\]]+\]/g;
+  USAGE_PREFIX = /^usage:\s*/i;
+  FULL_STOP = /\.$/;
+});
+
 // ../kit/src/text.ts
 function distance(a, b) {
   let previous = Array.from({ length: b.length + 1 }, (_, index) => index);
@@ -444,8 +517,51 @@ var init_text = __esm(() => {
   ANSI = new RegExp(`${String.fromCharCode(27)}\\[[\\d;?]*[a-z]`, "gi");
 });
 
+// ../kit/src/input.ts
+import { fstatSync } from "fs";
+import process5 from "process";
+function wholeNumber(value, name, fallback, min = 1) {
+  if (value === undefined)
+    return fallback;
+  const number = Number(value);
+  if (!WHOLE.test(value) || !Number.isSafeInteger(number) || number < min)
+    badUsage(`${name.startsWith("<") ? name : `--${name}`} takes a whole number from ${min}, not ${value}`);
+  return number;
+}
+function duration(value, name, fallback, unit = "s") {
+  if (value === undefined)
+    return fallback;
+  const match = DURATION.exec(value.trim());
+  const ms = match === null ? 0 : Number(match[1]) * UNIT_MS[match[2] ?? unit];
+  if (ms < 1)
+    badUsage(`--${name} takes a duration such as 30s, 5m, 1h or 7d, not ${value}`);
+  return ms;
+}
+function isStdinPiped() {
+  const stat = fstatSync(0);
+  return stat.isFIFO() || stat.isFile();
+}
+async function readInput(path, { noStdin = "nothing is piped on stdin" } = {}) {
+  if (path === "-") {
+    if (process5.stdin.isTTY)
+      fail(noStdin);
+    return Bun.stdin.text();
+  }
+  const file = Bun.file(path);
+  if (!await file.exists())
+    fail(`no file ${path}`);
+  return file.text();
+}
+var WHOLE, DURATION, UNIT_MS;
+var init_input = __esm(() => {
+  init_args();
+  WHOLE = /^\d+$/;
+  DURATION = /^(\d+(?:\.\d+)?)(ms|[smhd])?$/;
+  UNIT_MS = { ms: 1, s: 1000, m: 60000, h: 3600000, d: 86400000 };
+});
+
 // ../kit/src/args.ts
-import process3 from "process";
+import process6 from "process";
 import { parseArgs } from "util";
 function jsonOption(holds) {
   return { type: "boolean", description: holds === undefined ? "print JSON" : `print JSON: ${holds}` };
@@ -459,52 +575,15 @@ function badUsage(message) {
 
 class Completing {
   options;
-  constructor(options) {
+  positionals;
+  candidates;
+  constructor(options, positionals = [], candidates = {}) {
     this.options = options;
+    this.positionals = positionals;
+    this.candidates = candidates;
   }
 }
-function usageLine(usage, colors = paint(process3.stdout)) {
-  return `${colors.bold("Usage:")} ${usage.replace(USAGE_PREFIX, "").replaceAll(OPTIONAL, (part) => colors.dim(part))}`;
-}
-function helpText(usage, options, colors = paint(process3.stdout), { examples = [], replaces } = {}) {
-  return [usageLine(usage, colors), ...replacesRows(replaces, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exampleRows(examples, colors)].join(`
-`);
-}
-function replacesRows(replaces, colors = paint(process3.stdout)) {
-  return replaces === undefined ? [] : ["", `${colors.bold("Instead of:")} ${replaces}`];
-}
-function wantsHelpJson(env = process3.env) {
-  return env.KIT_HELP === "json";
-}
-function description(usage, { examples = [], replaces } = {}) {
-  const lines = usage.replace(USAGE_PREFIX, "").split(`
-`);
-  const first = lines[0];
-  const colon = first.indexOf(": ");
-  const prose = lines[lines.indexOf("") + 1] ?? "";
-  const fallback = lines.includes("") ? `${prose.charAt(0).toLowerCase()}${prose.slice(1)}`.replace(FULL_STOP, "") : "";
-  return {
-    synopsis: colon === -1 ? first : first.slice(0, colon),
-    summary: colon === -1 ? fallback : first.slice(colon + 2),
-    ...replaces === undefined ? {} : { replaces },
-    examples: examples.map((example) => typeof example === "string" ? { line: example } : { line: example[0], note: example[1] })
-  };
-}
-function exampleRows(examples, colors = paint(process3.stdout)) {
-  if (examples.length === 0)
-    return [];
-  return ["", colors.bold("Examples:"), ...examples.map((example) => typeof example === "string" ? `  ${example}` : `  ${example[0]}  ${colors.dim(`# ${example[1]}`)}`)];
-}
-function optionRows(options, colors = paint(process3.stdout)) {
-  const rows = Object.entries(options).map(([name, option]) => {
-    const short = option.short === undefined ? "    " : `${colors.cyan(`-${option.short}`)}, `;
-    const value = option.type === "string" ? ` ${colors.dim("<value>")}` : "";
-    return { flag: `${short}${colors.cyan(`--${name}`)}${value}`, width: `-x, --${name}`.length + (option.type === "string" ? " <value>".length : 0), description: option.description ?? "" };
-  });
-  const width = Math.max(0, ...rows.map((row) => row.width));
-  return rows.map((row) => row.description === "" ? `  ${row.flag}` : `  ${row.flag}${" ".repeat(width - row.width)}  ${colors.dim(row.description)}`);
-}
-function applyOutput(color, plain, env = process3.env) {
+function applyOutput(color, plain, env = process6.env) {
   const when = plain === true ? "never" : color ?? "auto";
   if (when === "auto")
     return;
@@ -521,14 +600,13 @@ function applyOutput(color, plain, env = process3.env) {
 function parse(args, usage, options, settings = {}) {
   const output = Object.fromEntries(Object.entries(OUTPUT_OPTIONS).filter(([name]) => !(name in options)));
   const all = { ...options, ...output, help: { type: "boolean", short: "h", description: "show this help" } };
+  const listing = listed(all, settings.allowNegative === true);
   if (completion.active)
-    throw new Completing(all);
-  const separator = settings.rest === true ? args.indexOf("--") : -1;
-  const own = separator === -1 ? args : args.slice(0, separator);
-  const rest = separator === -1 ? undefined : args.slice(separator + 1);
+    throw new Completing(listing, settings.positionals, settings.candidates);
+  const { own, rest } = settings.trailing === true ? splitTrailing(args, all, settings.positionals?.length ?? 0) : splitRest(args, settings.rest === true);
   let parsed;
   try {
-    parsed = parseArgs({ args: joinDashValues(own, all), options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
+    parsed = parseArgs({ args: joinDashValues(withBare(withAliases(own, all), all), all), options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
   } catch (error) {
     const message = parseError(error);
     throw new UsageError(message, nearestOption(message, all, settings.allowNegative === true));
@@ -536,12 +614,96 @@ function parse(args, usage, options, settings = {}) {
   const values = parsed.values;
   applyOutput("color" in output ? values.color : undefined, "plain" in output ? values.plain : undefined);
   if (values.help === true) {
-    console.log(wantsHelpJson() ? JSON.stringify(description(usage, settings)) : helpText(usage, all, undefined, settings));
+    console.log(wantsHelpJson() ? JSON.stringify(description(usage, settings, listing)) : helpText(usage, listing, undefined, settings));
     throw new HelpShown;
   }
+  checkChoices(parsed.values, all);
+  checkConflicts(parsed.values, all);
   if (settings.positionals !== undefined)
     checkPositionals(parsed.positionals, settings.positionals);
-  return { ...parsed, positionals: parsed.positionals, rest };
+  return { ...parsed, values: parsed.values, positionals: parsed.positionals, rest };
+}
+function splitRest(args, passes) {
+  const separator = passes ? args.indexOf("--") : -1;
+  return { own: separator === -1 ? args : args.slice(0, separator), rest: separator === -1 ? undefined : args.slice(separator + 1) };
+}
+function splitTrailing(args, options, count) {
+  const takesValue = (word) => !word.includes("=") && Object.entries(options).some(([name, { short, type }]) => type === "string" && (word === `--${name}` || word === `-${short}`));
+  let seen = 0;
+  if (count === 0)
+    return { own: args, rest: undefined };
+  for (let at = 0;at < args.length; at++) {
+    const word = args[at];
+    if (word === "--")
+      break;
+    if (word.startsWith("-")) {
+      if (takesValue(word))
+        at++;
+      continue;
+    }
+    seen++;
+    if (seen === count)
+      return { own: args.slice(0, at + 1), rest: args.slice(at + 1) };
+  }
+  return { own: args, rest: undefined };
+}
+function listed(options, allowNegative) {
+  if (!allowNegative)
+    return options;
+  return Object.fromEntries(Object.entries(options).flatMap(([name, option]) => {
+    if (option.type !== "boolean" || option.negative === undefined)
+      return [[name, option]];
+    return [...option.description === undefined ? [] : [[name, option]], [`no-${name}`, { type: "boolean", description: option.negative }]];
+  }));
+}
+function withAliases(args, options) {
+  const named = new Map(Object.entries(options).flatMap(([name, { aliases = [] }]) => aliases.map((alias) => [`--${alias}`, `--${name}`])));
+  if (named.size === 0)
+    return args;
+  const separator = args.indexOf("--");
+  const own = separator === -1 ? args : args.slice(0, separator);
+  return [...own.map((arg) => {
+    const at = arg.indexOf("=");
+    const current = named.get(at === -1 ? arg : arg.slice(0, at));
+    return current === undefined ? arg : `${current}${at === -1 ? "" : arg.slice(at)}`;
+  }), ...separator === -1 ? [] : args.slice(separator)];
+}
+function withBare(args, options) {
+  const bare = new Map(Object.entries(options).flatMap(([name, { short, optional }]) => optional === undefined ? [] : [[`--${name}`, optional], ...short === undefined ? [] : [[`-${short}`, optional]]]));
+  if (bare.size === 0)
+    return args;
+  const separator = args.indexOf("--");
+  const own = separator === -1 ? args : args.slice(0, separator);
+  return [...own.flatMap((arg, index) => {
+    const optional = bare.get(arg);
+    const next = own[index + 1];
+    const value = next !== undefined && (optional?.accepts === undefined ? !next.startsWith("-") : optional.accepts.test(next));
+    return optional === undefined || value ? [arg] : [arg, optional.bare];
+  }), ...separator === -1 ? [] : args.slice(separator)];
+}
+function checkConflicts(values, options) {
+  const given = (name) => values[name] !== undefined && values[name] !== false;
+  for (const [name, { conflicts = [] }] of Object.entries(options)) {
+    const other = given(name) ? conflicts.find(given) : undefined;
+    if (other !== undefined)
+      badUsage(`--${name} cannot be used with --${other}`);
+  }
+}
+function checkChoices(values, options) {
+  for (const [name, option] of Object.entries(options)) {
+    if (option.choices === undefined)
+      continue;
+    const given = values[name];
+    for (const value of Array.isArray(given) ? given : [given]) {
+      if (typeof value === "string")
+        oneOf(value, name, option.choices);
+    }
+  }
+}
+function oneOf(value, name, choices) {
+  if (!choices.includes(value))
+    badUsage(`${name.startsWith("<") ? name : `--${name}`} takes one of ${choices.join(", ")}, not ${value}`);
+  return value;
 }
 function checkPositionals(given, names) {
   const variadic = names.at(-1)?.replace("]", "").endsWith("...") === true;
@@ -589,28 +751,14 @@ function nearestOption(message, options, allowNegative) {
   const meant = closest(word, known.map((flag) => flag.replace(DASHES, "")));
   return meant === undefined ? undefined : `did you mean ${known.find((flag) => flag.replace(DASHES, "") === meant)}?`;
 }
-function wholeNumber(value, name, fallback, min = 1) {
-  if (value === undefined)
-    return fallback;
-  const number = Number(value);
-  if (!WHOLE.test(value) || !Number.isSafeInteger(number) || number < min)
-    badUsage(`${name.startsWith("<") ? name : `--${name}`} takes a whole number from ${min}, not ${value}`);
-  return number;
-}
-function duration(value, name, fallback, unit = "s") {
-  if (value === undefined)
-    return fallback;
-  const match = DURATION.exec(value.trim());
-  const ms = match === null ? 0 : Number(match[1]) * UNIT_MS[match[2] ?? unit];
-  if (ms < 1)
-    badUsage(`--${name} takes a duration such as 30s, 5m, 1h or 7d, not ${value}`);
-  return ms;
-}
-var Exit, UsageError, HelpShown, completion, OPTIONAL, USAGE_PREFIX, FULL_STOP, DASHES, OUTPUT_OPTIONS, UNKNOWN_OPTION, WHOLE, DURATION, UNIT_MS;
+var DASHES, Exit, UsageError, HelpShown, completion, OUTPUT_OPTIONS, UNKNOWN_OPTION;
 var init_args = __esm(() => {
   init_format();
-  init_style();
+  init_help();
   init_text();
+  init_help();
+  init_input();
+  DASHES = /^-+/;
   Exit = class Exit extends Error {
     code;
     hint;
@@ -631,18 +779,11 @@ var init_args = __esm(() => {
     }
   };
   completion = { active: false };
-  OPTIONAL = /\[[^\]]+\]/g;
-  USAGE_PREFIX = /^usage:\s*/i;
-  FULL_STOP = /\.$/;
-  DASHES = /^-+/;
   OUTPUT_OPTIONS = {
     color: { type: "string", description: "auto (on a terminal alone), always or never" },
     plain: { type: "boolean", description: "plain text, no colour or spinner: --color never" }
   };
   UNKNOWN_OPTION = /^unknown option '(-[^']+)'/;
-  WHOLE = /^\d+$/;
-  DURATION = /^(\d+(?:\.\d+)?)(ms|[smhd])?$/;
-  UNIT_MS = { ms: 1, s: 1000, m: 60000, h: 3600000, d: 86400000 };
 });
 
 // ../kit/src/chart.ts
@@ -653,7 +794,7 @@ var init_chart = __esm(() => {
 
 // ../kit/src/process.ts
 import { constants } from "os";
-import process4 from "process";
+import process7 from "process";
 function exitCodeOf(code, signal) {
   if (code !== null)
     return code;
@@ -673,7 +814,7 @@ function holdSignals(cleanup) {
     },
     release: () => {
       for (const signal of SIGNALS)
-        process4.off(signal, onSignal);
+        process7.off(signal, onSignal);
     }
   };
   function onSignal(signal) {
@@ -686,10 +827,10 @@ function holdSignals(cleanup) {
       return;
     held.release();
     cleanup(signal);
-    process4.kill(process4.pid, signal);
+    process7.kill(process7.pid, signal);
   }
   for (const signal of SIGNALS)
-    process4.on(signal, onSignal);
+    process7.on(signal, onSignal);
   return held;
 }
 async function runCommand(argv, { cwd, env, stdin = "ignore", timeoutMs, signal, maxBytes = Infinity, onChunk, onStart } = {}) {
@@ -703,7 +844,7 @@ async function runCommand(argv, { cwd, env, stdin = "ignore", timeoutMs, signal,
       return;
     try {
       if (grouped)
-        process4.kill(-proc.pid, killing);
+        process7.kill(-proc.pid, killing);
       else
         proc.kill(killing);
     } catch {}
@@ -776,8 +917,8 @@ var init_process = __esm(() => {
 });
 
 // ../kit/src/progress.ts
-import process5 from "process";
-function liveRegion(render, stream = process5.stderr, env = process5.env) {
+import process8 from "process";
+function liveRegion(render, stream = process8.stderr, env = process8.env) {
   if (!takesControlCodes(stream, env))
     return { redraw: () => {
       return;
@@ -818,11 +959,11 @@ function liveRegion(render, stream = process5.stderr, env = process5.env) {
     clear();
     restore();
     release();
-    process5.off("exit", onExit);
+    process8.off("exit", onExit);
     signals.release();
   }
   timer.unref();
-  process5.on("exit", onExit);
+  process8.on("exit", onExit);
   return {
     redraw: draw,
     print: (text) => {
@@ -861,14 +1002,14 @@ function cutToWidth(line, width) {
   return `${kept}${RESET_STYLE}${linked ? CLOSE_LINK : ""}`;
 }
 function swallowInput() {
-  const input = process5.stdin;
+  const input = process8.stdin;
   if (!input.isTTY)
     return () => {
       return;
     };
   const onData = (data) => {
     if (data.includes(CTRL_C))
-      process5.kill(process5.pid, "SIGINT");
+      process8.kill(process8.pid, "SIGINT");
   };
   input.setRawMode(true);
   input.on("data", onData);
@@ -884,7 +1025,7 @@ function swallowInput() {
   };
 }
 function interceptOutput(clear) {
-  const targets = [...CONSOLE_METHODS.map((name) => [console, name]), [process5.stdout, "write"], [process5.stderr, "write"]];
+  const targets = [...CONSOLE_METHODS.map((name) => [console, name]), [process8.stdout, "write"], [process8.stderr, "write"]];
   const wrapped = targets.map(([target, name]) => {
     const original = Reflect.get(target, name);
     const wrapper = (...args) => {
@@ -928,10 +1069,65 @@ var init_ci = __esm(() => {
   init_tool();
 });
 
+// ../kit/src/logs.ts
+var DAY_MS, CLI_FOLDER = "kaynooo-cli";
+var init_logs = __esm(() => {
+  DAY_MS = 24 * 60 * 60 * 1000;
+});
+
+// ../kit/src/usage.ts
+import { appendFileSync, mkdirSync } from "fs";
+import { homedir } from "os";
+import { dirname, isAbsolute, join } from "path";
+import process9 from "process";
+function noteUsageError(message) {
+  usageError = message;
+}
+function stateHome(env = process9.env) {
+  const dir = env.XDG_STATE_HOME;
+  return dir !== undefined && isAbsolute(dir) ? dir : join(homedir(), ".local", "state");
+}
+function usagePath(env = process9.env) {
+  return join(stateHome(env), CLI_FOLDER, "usage.jsonl");
+}
+function usageRecorded(env = process9.env) {
+  const off = env.KAYNOOO_CLI_NO_USAGE;
+  return env.NODE_ENV !== "test" && (off === undefined || off === "" || off === "0");
+}
+function flagNames(argv) {
+  const end = argv.indexOf("--");
+  const names = (end === -1 ? argv : argv.slice(0, end)).filter((word) => word.startsWith("-") && word !== "-").map((word) => word.includes("=") ? word.slice(0, word.indexOf("=")) : word);
+  return [...new Set(names)].filter((name) => name.length <= LONGEST_NAME && FLAG_NAME.test(name));
+}
+function usageEntry(bin, command, argv, code, now = new Date) {
+  const unknown = code === 2 && usageError !== undefined ? UNKNOWN_OPTION2.exec(usageError)?.[1] : undefined;
+  usageError = undefined;
+  return { at: now.toISOString(), bin, ...command === undefined ? {} : { command }, flags: flagNames(argv), code, ...unknown === undefined ? {} : { unknown } };
+}
+function recordUsage(entry, env = process9.env) {
+  if (!usageRecorded(env))
+    return;
+  try {
+    const path = usagePath(env);
+    mkdirSync(dirname(path), { recursive: true, mode: 448 });
+    appendFileSync(path, `${JSON.stringify(entry)}
+`, { mode: 384 });
+  } catch {}
+}
+var UNKNOWN_OPTION2, FLAG_NAME, LONGEST_NAME = 40, usageError;
+var init_usage = __esm(() => {
+  init_logs();
+  UNKNOWN_OPTION2 = /unknown option '(--[a-z][a-z0-9-]*)[=']/;
+  FLAG_NAME = /^(?:--[a-z][a-z0-9-]*|-[a-zA-Z])$/;
+});
+
 // ../kit/src/cli.ts
-import process6 from "process";
-async function commandRows(commands, colors) {
-  const width = Math.max(...Object.keys(commands).map((name) => name.length));
+import { readFileSync, realpathSync } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+import process10 from "process";
+async function commandRows(all, colors) {
+  const commands = shown(all);
+  const width = Math.max(0, ...Object.keys(commands).map((name) => name.length));
   const groups = new Map([["Commands:", []]]);
   const summaries = await Promise.all(Object.values(commands).map(async ({ summary }) => resolveSummary(summary)));
   for (const [index, [name, { group }]] of Object.entries(commands).entries()) {
@@ -942,6 +1138,9 @@ async function commandRows(commands, colors) {
   }
   return [...groups].filter(([, rows]) => rows.length > 0).flatMap(([heading, rows], index) => [...index === 0 ? [] : [""], colors.bold(heading), ...rows]);
 }
+function shown(commands) {
+  return Object.fromEntries(Object.entries(commands).filter(([, { hidden }]) => hidden !== true));
+}
 function takeOutputFlags(argv) {
   let index = 0;
   for (;index < argv.length; index++) {
@@ -973,7 +1172,7 @@ async function expand(scope, words) {
   }
   return { ...scope, commands, lazy: [] };
 }
-async function help({ path, header, summary: lazySummary, commands, defaultCommand, examples, replaces }, stream) {
+async function help2({ path, header, summary: lazySummary, commands, defaultCommand, examples, replaces }, stream) {
   const colors = paint(stream);
   const prefix = path.join(" ");
   const summary = await resolveSummary(lazySummary);
@@ -1000,8 +1199,8 @@ async function help({ path, header, summary: lazySummary, commands, defaultComma
 `);
 }
 function printError(prefix, message, hint, cause) {
-  const colors = paint(process6.stderr);
-  const styled = takesControlCodes(process6.stderr);
+  const colors = paint(process10.stderr);
+  const styled = takesControlCodes(process10.stderr);
   const head = styled ? `${colors.red.bold("error")} ${colors.dim(`${prefix}:`)}` : `error: ${prefix}:`;
   const under = (label, text, tint) => text === undefined ? "" : `
   ${styled ? tint(label) : `${label}:`} ${text}`;
@@ -1020,6 +1219,8 @@ function reportThrown(prefix, error, redact = (text) => text, json = false) {
   const help = error instanceof UsageError ? `run ${prefix} --help for its options` : undefined;
   const named = error instanceof Error && !(error instanceof Exit) && error.name !== "Error" ? `${error.name}: ${error.message}` : undefined;
   const cause = error instanceof Error && error.cause instanceof Error ? redact(error.cause.message) : undefined;
+  if (error instanceof UsageError)
+    noteUsageError(error.message);
   const report = json ? printJsonError : (message, hint, causeText) => printError(prefix, message, hint, causeText);
   report(redact(named ?? (error instanceof Error ? error.message : String(error))), error instanceof Exit ? error.hint ?? help : undefined, cause);
   return error instanceof Exit ? error.code : 1;
@@ -1033,12 +1234,20 @@ async function dispatch(level, typed, { version, redact }) {
     return reportThrown(prefix, error);
   }
   const [name, ...args] = argv;
+  const fallback = level.defaultCommand === undefined ? undefined : level.commands[level.defaultCommand];
+  if (name === undefined && level.runBare && fallback !== undefined && "run" in fallback) {
+    try {
+      return await fallback.run([]);
+    } catch (error) {
+      return reportThrown(`${prefix} ${level.defaultCommand}`, error, redact, false);
+    }
+  }
   if (name === undefined && level.path.length > 1) {
-    console.error(await help(await expand(level, [...level.path.slice(1), ...argv]), process6.stderr));
+    console.error(await help2(await expand(level, [...level.path.slice(1), ...argv]), process10.stderr));
     return 2;
   }
   if (name === undefined || name === "help" || name === "--help" || name === "-h") {
-    console.log(await help(await expand(level, [...level.path.slice(1), ...argv]), process6.stdout));
+    console.log(await help2(await expand(level, [...level.path.slice(1), ...argv]), process10.stdout));
     return 0;
   }
   if (level.path.length === 1 && (name === "--version" || name === "-v")) {
@@ -1047,6 +1256,7 @@ async function dispatch(level, typed, { version, redact }) {
   }
   let command = level.commands[level.aliases?.[name] ?? name];
   let rest = args;
+  let ran = name;
   if (command === undefined && level.lazy.length > 0) {
     level = await expand(level, [...level.path.slice(1), ...argv]);
     command = level.commands[level.aliases?.[name] ?? name];
@@ -1054,38 +1264,75 @@ async function dispatch(level, typed, { version, redact }) {
   if (command === undefined && level.defaultCommand !== undefined) {
     command = level.commands[level.defaultCommand];
     rest = argv;
+    ran = level.defaultCommand;
   }
   if (command === undefined) {
-    const meant = closest(name, Object.keys(level.commands));
+    const meant = closest(name, Object.keys(shown(level.commands)));
     printError(prefix, `no command ${name}`, meant === undefined ? `run ${prefix} --help for its commands` : `did you mean ${meant}?`);
     return 2;
   }
   if ("commands" in command) {
     const { summary } = command;
-    return dispatch({ path: [...level.path, name], header: (colors, text) => `${colors.bold(`${prefix} ${name}`)}  ${text}`, summary, ...scopeOf(command.commands, command.extraCommands, command.aliases), defaultCommand: undefined, examples: command.examples, replaces: undefined }, rest, { version, redact });
+    return dispatch({ path: [...level.path, name], header: (colors, text) => `${colors.bold(`${prefix} ${name}`)}  ${text}`, summary, ...scopeOf(command.commands, command.extraCommands, command.aliases), defaultCommand: undefined, runBare: false, examples: command.examples, replaces: undefined }, rest, { version, redact });
   }
   try {
     return await command.run(rest);
   } catch (error) {
-    return reportThrown(`${prefix} ${name}`, error, redact, wantsJson(rest));
+    return reportThrown(`${prefix} ${ran}`, error, redact, wantsJson(rest));
   }
 }
-async function optionsOf(run) {
+async function completingOf(run) {
   completion.active = true;
   try {
     await run([]);
   } catch (error) {
     if (error instanceof Completing)
-      return error.options;
+      return error;
   } finally {
     completion.active = false;
   }
-  return {};
+  return new Completing({});
+}
+async function optionsOf(run) {
+  return (await completingOf(run)).options;
+}
+function candidateLine(candidate) {
+  return typeof candidate === "string" ? candidate : candidate.join("\t");
+}
+function positionalBeingTyped(before, { options, positionals }) {
+  const takesValue = (word) => !word.includes("=") && Object.entries(options).some(([name, { short, type }]) => type === "string" && (word === `--${name}` || word === `-${short}`));
+  let index = 0;
+  let at = 0;
+  while (at < before.length) {
+    const word = before[at];
+    if (word === "--") {
+      index += before.length - at - 1;
+      break;
+    }
+    if (!word.startsWith("-"))
+      index++;
+    else if (takesValue(word))
+      at++;
+    at++;
+  }
+  const last = positionals.at(-1);
+  if (index < positionals.length)
+    return positionals[index];
+  return last?.replace("]", "").endsWith("...") === true ? last : undefined;
 }
 async function leafCandidates(run, words) {
-  if (!(words.at(-1) ?? "").startsWith("-"))
-    return [FILES];
-  return Object.entries(await optionsOf(run)).map(([name, option]) => option.description === undefined ? `--${name}` : `--${name}	${option.description}`);
+  const completing = await completingOf(run);
+  if ((words.at(-1) ?? "").startsWith("-"))
+    return Object.entries(completing.options).map(([name, option]) => option.description === undefined ? `--${name}` : `--${name}	${option.description}`);
+  const flag = words.at(-2);
+  const option = flag?.startsWith("-") === true ? Object.entries(completing.options).find(([name, { short }]) => flag === `--${name}` || flag === `-${short}`)?.[1] : undefined;
+  if (option?.type === "string") {
+    const values = option.choices === undefined ? await option.candidates?.() : option.choices;
+    return values === undefined ? [FILES] : values.map(candidateLine);
+  }
+  const name = positionalBeingTyped(words.slice(0, -1), completing);
+  const values = name === undefined ? undefined : await completing.candidates[name]?.();
+  return values === undefined ? [FILES] : values.map(candidateLine);
 }
 async function candidates(scope, defaultCommand, words, before = []) {
   const [word = "", ...rest] = words;
@@ -1096,8 +1343,13 @@ async function candidates(scope, defaultCommand, words, before = []) {
     ({ commands, aliases } = await expand(scope, [...before, ...words]));
     command = commands[aliases?.[word] ?? word];
   }
-  if (listing)
-    return Promise.all(Object.entries(commands).map(async ([name, { summary }]) => `${name}	${await resolveSummary(summary)}`));
+  if (listing) {
+    const own = await Promise.all(Object.entries(shown(commands)).map(async ([name, { summary }]) => `${name}	${await resolveSummary(summary)}`));
+    const fallback = defaultCommand === undefined ? undefined : commands[defaultCommand];
+    const values = fallback !== undefined && "run" in fallback ? await leafCandidates(fallback.run, [word]) : [];
+    const valueOf = (line) => line.slice(0, line.includes("\t") ? line.indexOf("\t") : undefined);
+    return [...own, ...values.filter((line) => line !== FILES && !(valueOf(line) in commands))];
+  }
   if (command === undefined) {
     const fallback = defaultCommand === undefined ? undefined : commands[defaultCommand];
     return fallback !== undefined && "run" in fallback ? leafCandidates(fallback.run, words) : [];
@@ -1109,23 +1361,56 @@ async function printCandidates(found) {
     console.log(line);
   return 0;
 }
-async function runCli(cli, argv = process6.argv.slice(2)) {
+function packageVersion(entry = Bun.main) {
+  for (let dir = dirname2(realpathSync(entry));; dir = dirname2(dir)) {
+    try {
+      const { version } = JSON.parse(readFileSync(join2(dir, "package.json"), "utf8"));
+      if (typeof version === "string")
+        return version;
+    } catch {}
+    if (dirname2(dir) === dir)
+      return "0.0.0";
+  }
+}
+async function runCli(cli, argv = process10.argv.slice(2)) {
+  const version = cli.version ?? packageVersion();
   if (argv[0] === COMPLETE)
     return printCandidates(candidates(scopeOf(cli.commands, cli.extraCommands, cli.aliases), cli.defaultCommand, argv.slice(1)));
-  return dispatch({ path: [cli.name], header: (colors, about) => `${colors.bold(cli.name)} ${colors.dim(cli.version)}  ${about}`, summary: cli.about, ...scopeOf(cli.commands, cli.extraCommands, cli.aliases), defaultCommand: cli.defaultCommand, examples: cli.examples, replaces: cli.replaces }, argv, { version: cli.version, redact: cli.redact });
+  const code = await dispatch({ path: [cli.name], header: (colors, about) => `${colors.bold(cli.name)} ${colors.dim(version)}  ${about}`, summary: cli.about, ...scopeOf(cli.commands, cli.extraCommands, cli.aliases), defaultCommand: cli.defaultCommand, runBare: cli.runBare === true, examples: cli.examples, replaces: cli.replaces }, argv, { version, redact: cli.redact });
+  if (cli.usage !== false) {
+    try {
+      recordUsage(usageEntry(cli.name, commandPath(scopeOf(cli.commands, cli.extraCommands, cli.aliases), argv), argv, code));
+    } catch {}
+  }
+  return code;
+}
+function commandPath(scope, argv) {
+  const path = [];
+  let level = scope;
+  for (const word of argv.filter((each) => !each.startsWith("-"))) {
+    const name = level.aliases !== undefined && Object.hasOwn(level.aliases, word) ? level.aliases[word] ?? word : word;
+    const command = Object.hasOwn(level.commands, name) ? level.commands[name] : undefined;
+    if (command === undefined)
+      break;
+    path.push(word);
+    if (!("commands" in command))
+      break;
+    level = scopeOf(command.commands, command.extraCommands, command.aliases);
+  }
+  return path.length === 0 ? undefined : path.join(" ");
 }
 var LEVEL_OPTIONS, TOP_OPTIONS, COMPLETE = "__complete", FILES = "__files__";
 var init_cli = __esm(() => {
   init_args();
   init_style();
   init_text();
+  init_usage();
   LEVEL_OPTIONS = {
     ...OUTPUT_OPTIONS,
     help: { type: "boolean", short: "h", description: "show this help" }
   };
   TOP_OPTIONS = { ...LEVEL_OPTIONS, version: { type: "boolean", short: "v", description: "print the version" } };
 });
-
 // ../kit/src/config.ts
 var init_config = __esm(() => {
   init_args();
@@ -1140,7 +1425,7 @@ var init_git = __esm(() => {
 // ../kit/src/limit.ts
 function limitOptions(fallback) {
   return {
-    limit: { type: "string", description: `show at most this many rows, the rest counted (${fallback})` },
+    limit: { type: "string", short: "n", description: `show at most this many rows, the rest counted (${fallback})` },
     full: { type: "boolean", description: "show every row" }
   };
 }
@@ -1162,12 +1447,6 @@ var init_limit = __esm(() => {
   init_args();
 });
 
-// ../kit/src/logs.ts
-var DAY_MS;
-var init_logs = __esm(() => {
-  DAY_MS = 24 * 60 * 60 * 1000;
-});
-
 // ../kit/src/secrets.ts
 var SECRET_WORDS;
 var init_secrets = __esm(() => {
@@ -1182,8 +1461,33 @@ var init_sessions = __esm(() => {
   ACCOUNT_DIRS = new Glob("*/sessions");
 });
 
+// ../kit/src/size.ts
+var init_size = () => {};
+
+// ../kit/src/user-config.ts
+import { existsSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+import process11 from "process";
+function configBase(where = {}) {
+  const xdg = where.xdg ?? (where.home === undefined ? process11.env.XDG_CONFIG_HOME : undefined);
+  return xdg !== undefined && xdg !== "" ? xdg : join3(where.home ?? homedir2(), ".config");
+}
+function userConfigPath(bin, where = {}) {
+  return join3(configBase(where), "kaynooo-cli", `${bin}.json`);
+}
+function userConfigReadPath(bin, legacy = [], where = {}) {
+  const current = userConfigPath(bin, where);
+  if (existsSync(current))
+    return current;
+  const base = configBase(where);
+  return legacy.map((parts) => join3(base, ...parts)).find((path) => existsSync(path)) ?? current;
+}
+var init_user_config = () => {};
+
 // ../kit/src/index.ts
 var init_src = __esm(() => {
+  init_advisory();
   init_args();
   init_chart();
   init_ci();
@@ -1196,276 +1500,70 @@ var init_src = __esm(() => {
   init_process();
   init_secrets();
   init_sessions();
+  init_size();
   init_style();
   init_text();
   init_tool();
+  init_usage();
+  init_user_config();
 });
 
-// src/registry.ts
-function isPublic(registry) {
-  return registry.url.replace(TRAILING_SLASHES, "") === PUBLIC_REGISTRY;
+// src/semver.ts
+function isRange(text) {
+  if (text.trim() === "")
+    return true;
+  return text.split(OR).every((alternative) => {
+    const words = alternative.trim().split(WHITESPACE);
+    return words.every((word, index) => word === "-" ? index > 0 && index < words.length - 1 : COMPARATOR.test(word));
+  });
 }
-function unreachable(message) {
-  return fail(`could not check: ${message}`, 2);
+function compare(version, word) {
+  const bound = BOUND.exec(word);
+  if (bound === null)
+    return;
+  const order = Bun.semver.order(version, bound[2] ?? "");
+  const operator = bound[1] ?? "=";
+  if (operator === "<")
+    return order < 0;
+  if (operator === "<=")
+    return order <= 0;
+  if (operator === ">")
+    return order > 0;
+  return operator === ">=" ? order >= 0 : order === 0;
 }
-function requestInit(token) {
-  return { headers: { accept: "application/json", ...token === undefined ? {} : { authorization: `Bearer ${token}` } }, signal: AbortSignal.timeout(REQUEST_TIMEOUT) };
+function inRange(version, range) {
+  if (Bun.semver.satisfies(version, range))
+    return true;
+  if (!PRERELEASE.test(version))
+    return false;
+  return range.split(OR).some((alternative) => alternative.trim().split(WHITESPACE).every((word) => compare(version, word) ?? Bun.semver.satisfies(version, word)));
 }
-async function get(fetcher, url, token) {
-  try {
-    return await fetcher(url, requestInit(token));
-  } catch (error) {
-    return unreachable(`cannot reach ${new URL(url).host}: ${error instanceof Error ? error.message : String(error)}`);
-  }
-}
-function isValidName(name) {
-  return PACKAGE_NAME.test(name) && name.length <= 214;
-}
-async function fetchPackument(name, registry, fetcher = fetch) {
-  if (!isValidName(name))
-    fail(`${name} is not a valid npm package name`);
-  const response = await get(fetcher, `${registry.url.replace(TRAILING_SLASHES, "")}/${encodeURIComponent(name).replace("%40", "@").replace("%2F", "%2f")}`, registry.token);
-  if (response.status === 404)
-    return;
-  if (!response.ok)
-    unreachable(`${new URL(registry.url).host} answered ${response.status} for ${name}`);
-  let packument;
-  try {
-    packument = await response.json();
-  } catch {
-    return unreachable(`${new URL(registry.url).host} answered ${name} with something that is not JSON`);
-  }
-  if (packument?.name !== name)
-    unreachable(`${new URL(registry.url).host} answered ${name} with the metadata of ${String(packument?.name)}`);
-  return packument;
-}
-async function fetchDownloads(name, fetcher = fetch) {
-  const response = await get(fetcher, `${DOWNLOADS_API}/${encodeURIComponent(name)}`);
-  if (!response.ok)
-    return;
-  try {
-    return (await response.json()).downloads;
-  } catch {
-    return;
-  }
-}
-var PUBLIC_REGISTRY = "https://registry.npmjs.org", DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week", TRAILING_SLASHES, REQUEST_TIMEOUT = 1e4, PACKAGE_NAME;
-var init_registry = __esm(() => {
-  init_src();
-  TRAILING_SLASHES = /\/+$/;
-  PACKAGE_NAME = /^(?:@[\w~-][\w.~-]*\/)?[\w~-][\w.~-]*$/;
-});
-
-// src/config.ts
-import { homedir } from "os";
-import { dirname, join } from "path";
-import process8 from "process";
-function expand2(value, env) {
-  let missing = false;
-  const expanded = value.replace(ENV_REFERENCE, (_, braced, bare) => {
-    const found = env[braced ?? bare ?? ""];
-    missing ||= found === undefined;
-    return found ?? "";
-  });
-  return missing ? undefined : expanded;
-}
-function literal(value) {
-  return expand2(value, {}) === value ? value : undefined;
-}
-function parseNpmrc(text, env) {
-  const config = { scopes: {}, tokens: {}, scopeTokens: {} };
-  for (const line of text.split(`
-`)) {
-    const at = line.indexOf("=");
-    if (at === -1 || COMMENT.test(line))
-      continue;
-    const key = line.slice(0, at).trim();
-    const scope = SCOPE_REGISTRY.exec(key)?.[1];
-    const tokenFor = AUTH_TOKEN.exec(key)?.[1];
-    const raw = line.slice(at + 1).trim().replace(QUOTES, "$2");
-    const value = tokenFor === undefined ? literal(raw) : expand2(raw, env);
-    if (value === undefined || value === "")
-      continue;
-    if (scope !== undefined)
-      config.scopes[scope] = value;
-    else if (tokenFor !== undefined)
-      config.tokens[tokenFor] = value;
-    else if (key === "registry")
-      config.registry = value;
-  }
-  return config;
-}
-function bunEntry(entry, env) {
-  const url = typeof entry === "string" ? entry : entry.url;
-  const token = typeof entry === "string" || entry.token === undefined ? undefined : expand2(entry.token, env);
-  return { ...url === undefined || literal(url) === undefined ? {} : { url }, ...token === undefined ? {} : { token } };
-}
-function parseBunfig(text, env) {
-  const config = { scopes: {}, tokens: {}, scopeTokens: {} };
-  const install = Bun.TOML.parse(text).install;
-  if (install?.registry !== undefined) {
-    const { url, token } = bunEntry(install.registry, env);
-    if (url !== undefined)
-      config.registry = url;
-    if (url !== undefined && token !== undefined)
-      config.tokens[url.replace(PROTOCOL, "")] = token;
-  }
-  for (const [scope, entry] of Object.entries(install?.scopes ?? {})) {
-    const { url, token } = bunEntry(entry, env);
-    if (url !== undefined)
-      config.scopes[scope.startsWith("@") ? scope : `@${scope}`] = url;
-    if (token !== undefined)
-      config.scopeTokens[scope.startsWith("@") ? scope : `@${scope}`] = token;
-  }
-  return config;
-}
-function tokenFor(config, url) {
-  const address = `${url.replace(PROTOCOL, "").replace(TRAILING_SLASHES2, "")}/`;
-  const best = Object.keys(config.tokens).filter((key) => address.startsWith(`${key.replace(TRAILING_SLASHES2, "")}/`)).sort((a, b) => b.length - a.length)[0];
-  return best === undefined ? undefined : config.tokens[best];
-}
-function mayCarryToken(url) {
-  const { protocol, hostname } = new URL(url);
-  return protocol === "https:" || LOCAL_HOSTS.has(hostname);
-}
-function registryFor(name, configs) {
-  const scope = name.startsWith("@") ? name.slice(0, name.indexOf("/")) : undefined;
-  const scoped = scope === undefined ? undefined : configs.find((config) => config.scopes[scope] !== undefined);
-  const url = (scope === undefined ? undefined : scoped?.scopes[scope]) ?? configs.find((config) => config.registry !== undefined)?.registry;
-  if (url === undefined)
-    return { url: PUBLIC_REGISTRY };
-  const token = (scope === undefined ? undefined : scoped?.scopeTokens[scope]) ?? configs.map((other) => tokenFor(other, url)).find((found) => found !== undefined);
-  return { url, token: mayCarryToken(url) ? token : undefined };
-}
-function readable(path, parse) {
-  try {
-    return parse();
-  } catch (error) {
-    return unreachable(`${path} cannot be read: ${error instanceof Error ? error.message : String(error)}`);
-  }
-}
-async function readIfThere(path) {
-  const file = Bun.file(path);
-  return await file.exists() ? file.text() : undefined;
-}
-async function loadConfigs(cwd = process8.cwd(), env = process8.env, home = homedir()) {
-  const directories = [];
-  for (let dir = cwd;!directories.includes(dir); dir = dirname(dir))
-    directories.push(dir);
-  if (!directories.includes(home))
-    directories.push(home);
-  const configs = [];
-  for (const dir of directories) {
-    const bunfig = await readIfThere(join(dir, "bunfig.toml"));
-    const npmrc = await readIfThere(join(dir, ".npmrc"));
-    if (bunfig !== undefined)
-      configs.push(readable(join(dir, "bunfig.toml"), () => parseBunfig(bunfig, env)));
-    if (npmrc !== undefined)
-      configs.push(parseNpmrc(npmrc, env));
-  }
-  return configs;
-}
-function isSeverity(value) {
-  return SEVERITIES.includes(value);
-}
-function parseSettings(text) {
-  const raw = Bun.JSONC.parse(text);
-  const settings = {};
-  if (Array.isArray(raw?.licenses) && raw.licenses.every((each) => typeof each === "string"))
-    settings.licenses = raw.licenses;
-  if (isSeverity(raw?.blockSeverity))
-    settings.blockSeverity = raw.blockSeverity;
-  return settings;
-}
-async function loadSettings(cwd = process8.cwd(), home = homedir()) {
-  const files = [];
-  for (let dir = cwd;!files.includes(join(dir, SETTINGS_FILE)); dir = dirname(dir))
-    files.push(join(dir, SETTINGS_FILE));
-  files.push(join(home, ".config", "pkg", "config.json"));
-  const settings = {};
-  for (const file of files) {
-    const text = await readIfThere(file);
-    if (text === undefined)
-      continue;
-    const found = readable(file, () => parseSettings(text));
-    settings.licenses ??= found.licenses;
-    settings.blockSeverity ??= found.blockSeverity;
-  }
-  return settings;
-}
-var ENV_REFERENCE, COMMENT, SCOPE_REGISTRY, AUTH_TOKEN, PROTOCOL, TRAILING_SLASHES2, LOCAL_HOSTS, QUOTES, SEVERITIES, DEFAULT_BLOCK_SEVERITY = "high", SETTINGS_FILE = ".pkgrc.json";
-var init_config2 = __esm(() => {
-  init_registry();
-  ENV_REFERENCE = /\$\{(\w+)\}|\$(\w+)/g;
-  COMMENT = /^\s*[#;]/;
-  SCOPE_REGISTRY = /^(@[^:]+):registry$/;
-  AUTH_TOKEN = /^(\/\/.+?):_authToken$/;
-  PROTOCOL = /^\w+:/;
-  TRAILING_SLASHES2 = /\/+$/;
-  LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
-  QUOTES = /^(["'])(.*)\1$/;
-  SEVERITIES = ["low", "moderate", "high", "critical"];
-});
-
-// src/semver.ts
-function isRange(text) {
-  if (text.trim() === "")
-    return true;
-  return text.split(OR).every((alternative) => {
-    const words = alternative.trim().split(WHITESPACE);
-    return words.every((word, index) => word === "-" ? index > 0 && index < words.length - 1 : COMPARATOR.test(word));
-  });
-}
-function compare(version, word) {
-  const bound = BOUND.exec(word);
-  if (bound === null)
-    return;
-  const order = Bun.semver.order(version, bound[2] ?? "");
-  const operator = bound[1] ?? "=";
-  if (operator === "<")
-    return order < 0;
-  if (operator === "<=")
-    return order <= 0;
-  if (operator === ">")
-    return order > 0;
-  return operator === ">=" ? order >= 0 : order === 0;
-}
-function inRange(version, range) {
-  if (Bun.semver.satisfies(version, range))
-    return true;
-  if (!PRERELEASE.test(version))
-    return false;
-  return range.split(OR).some((alternative) => alternative.trim().split(WHITESPACE).every((word) => compare(version, word) ?? Bun.semver.satisfies(version, word)));
-}
-var OR, WHITESPACE, PRERELEASE, PART, COMPARATOR, BOUND, EXACT_VERSION;
-var init_semver = __esm(() => {
-  OR = /\s*\|\|\s*/;
-  WHITESPACE = /\s+/;
-  PRERELEASE = /-/;
-  PART = String.raw`(?:\d+|[xX*])`;
-  COMPARATOR = new RegExp(String.raw`^(?:[<>]=?|=|\^|~>?)?v?${PART}(?:\.${PART}){0,2}(?:-[\w.-]+)?(?:\+[\w.-]+)?$`);
-  BOUND = /^(<=|>=|[<>=])?v?(\d+\.\d+\.\d+(?:-[\w.-]+)?)$/;
-  EXACT_VERSION = /^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/;
-});
-
-// src/advisories.ts
-function severityRank(severity) {
-  return SEVERITIES.indexOf(severity);
-}
-function fixedVersion(vulnerable, version) {
-  const range = vulnerable.split("||").map((each) => each.trim()).find((each) => inRange(version, each));
-  return range === undefined ? undefined : UPPER_BOUND.exec(range)?.[1];
-}
-async function fetchAdvisories(versions, registry, fetcher = fetch) {
-  const url = `${registry.url.replace(TRAILING_SLASHES3, "")}${BULK_PATH}`;
-  const host = new URL(registry.url).host;
-  let response;
+var OR, WHITESPACE, PRERELEASE, PART, COMPARATOR, BOUND, EXACT_VERSION;
+var init_semver = __esm(() => {
+  OR = /\s*\|\|\s*/;
+  WHITESPACE = /\s+/;
+  PRERELEASE = /-/;
+  PART = String.raw`(?:\d+|[xX*])`;
+  COMPARATOR = new RegExp(String.raw`^(?:[<>]=?|=|\^|~>?)?v?${PART}(?:\.${PART}){0,2}(?:-[\w.-]+)?(?:\+[\w.-]+)?$`);
+  BOUND = /^(<=|>=|[<>=])?v?(\d+\.\d+\.\d+(?:-[\w.-]+)?)$/;
+  EXACT_VERSION = /^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/;
+});
+
+// src/advisories.ts
+function fixedVersion(vulnerable, version) {
+  const range = vulnerable.split("||").map((each) => each.trim()).find((each) => inRange(version, each));
+  return range === undefined ? undefined : UPPER_BOUND.exec(range)?.[1];
+}
+async function fetchAdvisories(versions, registry, fetcher = fetch) {
+  const url = `${registry.url.replace(TRAILING_SLASHES, "")}${BULK_PATH}`;
+  const host = new URL(registry.url).host;
+  let response;
   try {
     response = await fetcher(url, {
       method: "POST",
       headers: { accept: "application/json", "content-type": "application/json", ...registry.token === undefined ? {} : { authorization: `Bearer ${registry.token}` } },
       body: JSON.stringify(versions),
-      signal: AbortSignal.timeout(REQUEST_TIMEOUT2)
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT)
     });
   } catch (error) {
     return { found: {}, unavailable: `cannot reach ${host} for advisories: ${error instanceof Error ? error.message : String(error)}` };
@@ -1499,13 +1597,13 @@ function advisoriesFor(advisories, version) {
   return (advisories ?? []).filter((each) => inRange(version, each.vulnerable)).map((each) => ({ ...each, fixed: fixedVersion(each.vulnerable, version) }));
 }
 function filterAdvisories(advisories, level, ignore = []) {
-  return advisories.filter((each) => severityRank(each.severity) >= severityRank(level) && !ignore.includes(each.ghsa ?? "") && !ignore.includes(String(each.id)));
+  return advisories.filter((each) => severityRank(each.severity) >= severityRank(level) && !isIgnored(each, ignore));
 }
-var BULK_PATH = "/-/npm/v1/security/advisories/bulk", TRAILING_SLASHES3, REQUEST_TIMEOUT2 = 1e4, GHSA, UPPER_BOUND, NO_ENDPOINT;
+var BULK_PATH = "/-/npm/v1/security/advisories/bulk", TRAILING_SLASHES, REQUEST_TIMEOUT = 1e4, GHSA, UPPER_BOUND, NO_ENDPOINT;
 var init_advisories = __esm(() => {
-  init_config2();
+  init_src();
   init_semver();
-  TRAILING_SLASHES3 = /\/+$/;
+  TRAILING_SLASHES = /\/+$/;
   GHSA = /GHSA-[\w-]+$/;
   UPPER_BOUND = /(?:^|\s)<([\w.+-]+)/;
   NO_ENDPOINT = new Set([404, 405, 501]);
@@ -2071,24 +2169,79 @@ var init_nearmiss = __esm(() => {
   SEPARATORS = /[-_.]/g;
 });
 
-// src/analyze.ts
-function parseSpec(text) {
-  const at = text.search(VERSION_SEPARATOR);
-  return at === -1 ? { name: text } : { name: text.slice(0, at), request: text.slice(at + 1) };
+// src/registry.ts
+function isPublic(registry) {
+  return registry.url.replace(TRAILING_SLASHES2, "") === PUBLIC_REGISTRY;
 }
-function isStable(version) {
-  return !version.includes("-");
+function unreachable(message) {
+  return fail(`could not check: ${message}`, 2);
 }
-function resolve(packument, request) {
-  const tags = packument["dist-tags"] ?? {};
-  const versions = Object.keys(packument.versions ?? {});
-  const wanted = request === undefined || request === "" ? "latest" : request;
-  if (tags[wanted] !== undefined)
-    return tags[wanted];
-  if (versions.includes(wanted))
-    return wanted;
-  if (!isRange(wanted))
-    return;
+function requestInit(token) {
+  return { headers: { accept: "application/json", ...token === undefined ? {} : { authorization: `Bearer ${token}` } }, signal: AbortSignal.timeout(REQUEST_TIMEOUT2) };
+}
+async function get(fetcher, url, token) {
+  try {
+    return await fetcher(url, requestInit(token));
+  } catch (error) {
+    return unreachable(`cannot reach ${new URL(url).host}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function isValidName(name) {
+  return PACKAGE_NAME.test(name) && name.length <= 214;
+}
+async function fetchPackument(name, registry, fetcher = fetch) {
+  if (!isValidName(name))
+    fail(`${name} is not a valid npm package name`);
+  const response = await get(fetcher, `${registry.url.replace(TRAILING_SLASHES2, "")}/${encodeURIComponent(name).replace("%40", "@").replace("%2F", "%2f")}`, registry.token);
+  if (response.status === 404)
+    return;
+  if (!response.ok)
+    unreachable(`${new URL(registry.url).host} answered ${response.status} for ${name}`);
+  let packument;
+  try {
+    packument = await response.json();
+  } catch {
+    return unreachable(`${new URL(registry.url).host} answered ${name} with something that is not JSON`);
+  }
+  if (packument?.name !== name)
+    unreachable(`${new URL(registry.url).host} answered ${name} with the metadata of ${String(packument?.name)}`);
+  return packument;
+}
+async function fetchDownloads(name, fetcher = fetch) {
+  const response = await get(fetcher, `${DOWNLOADS_API}/${encodeURIComponent(name)}`);
+  if (!response.ok)
+    return;
+  try {
+    return (await response.json()).downloads;
+  } catch {
+    return;
+  }
+}
+var PUBLIC_REGISTRY = "https://registry.npmjs.org", DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week", TRAILING_SLASHES2, REQUEST_TIMEOUT2 = 1e4, PACKAGE_NAME;
+var init_registry = __esm(() => {
+  init_src();
+  TRAILING_SLASHES2 = /\/+$/;
+  PACKAGE_NAME = /^(?:@[\w~-][\w.~-]*\/)?[\w~-][\w.~-]*$/;
+});
+
+// src/analyze.ts
+function parseSpec(text) {
+  const at = text.search(VERSION_SEPARATOR);
+  return at === -1 ? { name: text } : { name: text.slice(0, at), request: text.slice(at + 1) };
+}
+function isStable(version) {
+  return !version.includes("-");
+}
+function resolve(packument, request) {
+  const tags = packument["dist-tags"] ?? {};
+  const versions = Object.keys(packument.versions ?? {});
+  const wanted = request === undefined || request === "" ? "latest" : request;
+  if (tags[wanted] !== undefined)
+    return tags[wanted];
+  if (versions.includes(wanted))
+    return wanted;
+  if (!isRange(wanted))
+    return;
   return versions.filter((version) => Bun.semver.satisfies(version, wanted)).sort(Bun.semver.order).at(-1);
 }
 function licenseOf(license) {
@@ -2190,6 +2343,310 @@ var init_analyze = __esm(() => {
   VERSION_SEPARATOR = /(?<=.)@/;
 });
 
+// src/config.ts
+import { homedir as homedir3 } from "os";
+import { dirname as dirname3, join as join4 } from "path";
+import process13 from "process";
+function expand2(value, env) {
+  let missing = false;
+  const expanded = value.replace(ENV_REFERENCE, (_, braced, bare) => {
+    const found = env[braced ?? bare ?? ""];
+    missing ||= found === undefined;
+    return found ?? "";
+  });
+  return missing ? undefined : expanded;
+}
+function literal(value) {
+  return expand2(value, {}) === value ? value : undefined;
+}
+function parseNpmrc(text, env) {
+  const config = { scopes: {}, tokens: {}, scopeTokens: {} };
+  for (const line of text.split(`
+`)) {
+    const at = line.indexOf("=");
+    if (at === -1 || COMMENT.test(line))
+      continue;
+    const key = line.slice(0, at).trim();
+    const scope = SCOPE_REGISTRY.exec(key)?.[1];
+    const tokenFor = AUTH_TOKEN.exec(key)?.[1];
+    const raw = line.slice(at + 1).trim().replace(QUOTES, "$2");
+    const value = tokenFor === undefined ? literal(raw) : expand2(raw, env);
+    if (value === undefined || value === "")
+      continue;
+    if (scope !== undefined)
+      config.scopes[scope] = value;
+    else if (tokenFor !== undefined)
+      config.tokens[tokenFor] = value;
+    else if (key === "registry")
+      config.registry = value;
+  }
+  return config;
+}
+function bunEntry(entry, env) {
+  const url = typeof entry === "string" ? entry : entry.url;
+  const token = typeof entry === "string" || entry.token === undefined ? undefined : expand2(entry.token, env);
+  return { ...url === undefined || literal(url) === undefined ? {} : { url }, ...token === undefined ? {} : { token } };
+}
+function parseBunfig(text, env) {
+  const config = { scopes: {}, tokens: {}, scopeTokens: {} };
+  const install = Bun.TOML.parse(text).install;
+  if (install?.registry !== undefined) {
+    const { url, token } = bunEntry(install.registry, env);
+    if (url !== undefined)
+      config.registry = url;
+    if (url !== undefined && token !== undefined)
+      config.tokens[url.replace(PROTOCOL, "")] = token;
+  }
+  for (const [scope, entry] of Object.entries(install?.scopes ?? {})) {
+    const { url, token } = bunEntry(entry, env);
+    if (url !== undefined)
+      config.scopes[scope.startsWith("@") ? scope : `@${scope}`] = url;
+    if (token !== undefined)
+      config.scopeTokens[scope.startsWith("@") ? scope : `@${scope}`] = token;
+  }
+  return config;
+}
+function tokenFor(config, url) {
+  const address = `${url.replace(PROTOCOL, "").replace(TRAILING_SLASHES3, "")}/`;
+  const best = Object.keys(config.tokens).filter((key) => address.startsWith(`${key.replace(TRAILING_SLASHES3, "")}/`)).sort((a, b) => b.length - a.length)[0];
+  return best === undefined ? undefined : config.tokens[best];
+}
+function mayCarryToken(url) {
+  const { protocol, hostname } = new URL(url);
+  return protocol === "https:" || LOCAL_HOSTS.has(hostname);
+}
+function registryFor(name, configs) {
+  const scope = name.startsWith("@") ? name.slice(0, name.indexOf("/")) : undefined;
+  const scoped = scope === undefined ? undefined : configs.find((config) => config.scopes[scope] !== undefined);
+  const url = (scope === undefined ? undefined : scoped?.scopes[scope]) ?? configs.find((config) => config.registry !== undefined)?.registry;
+  if (url === undefined)
+    return { url: PUBLIC_REGISTRY };
+  const token = (scope === undefined ? undefined : scoped?.scopeTokens[scope]) ?? configs.map((other) => tokenFor(other, url)).find((found) => found !== undefined);
+  return { url, token: mayCarryToken(url) ? token : undefined };
+}
+function readable(path, parse) {
+  try {
+    return parse();
+  } catch (error) {
+    return unreachable(`${path} cannot be read: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function readIfThere(path) {
+  const file = Bun.file(path);
+  return await file.exists() ? file.text() : undefined;
+}
+async function loadConfigs(cwd = process13.cwd(), env = process13.env, home = homedir3()) {
+  const directories = [];
+  for (let dir = cwd;!directories.includes(dir); dir = dirname3(dir))
+    directories.push(dir);
+  if (!directories.includes(home))
+    directories.push(home);
+  const configs = [];
+  for (const dir of directories) {
+    const bunfig = await readIfThere(join4(dir, "bunfig.toml"));
+    const npmrc = await readIfThere(join4(dir, ".npmrc"));
+    if (bunfig !== undefined)
+      configs.push(readable(join4(dir, "bunfig.toml"), () => parseBunfig(bunfig, env)));
+    if (npmrc !== undefined)
+      configs.push(parseNpmrc(npmrc, env));
+  }
+  return configs;
+}
+function isSeverity(value) {
+  return SEVERITIES.includes(value);
+}
+function parseSettings(text) {
+  const raw = Bun.JSONC.parse(text);
+  const settings = {};
+  if (Array.isArray(raw?.licenses) && raw.licenses.every((each) => typeof each === "string"))
+    settings.licenses = raw.licenses;
+  if (isSeverity(raw?.blockSeverity))
+    settings.blockSeverity = raw.blockSeverity;
+  return settings;
+}
+async function loadSettings(cwd = process13.cwd(), home) {
+  const files = [];
+  for (let dir = cwd;!files.includes(join4(dir, SETTINGS_FILE)); dir = dirname3(dir))
+    files.push(join4(dir, SETTINGS_FILE));
+  files.push(userConfigReadPath("pkg", [["pkg", "config.json"]], { home }));
+  const settings = {};
+  for (const file of files) {
+    const text = await readIfThere(file);
+    if (text === undefined)
+      continue;
+    const found = readable(file, () => parseSettings(text));
+    settings.licenses ??= found.licenses;
+    settings.blockSeverity ??= found.blockSeverity;
+  }
+  return settings;
+}
+var ENV_REFERENCE, COMMENT, SCOPE_REGISTRY, AUTH_TOKEN, PROTOCOL, TRAILING_SLASHES3, LOCAL_HOSTS, QUOTES, DEFAULT_BLOCK_SEVERITY = "high", SETTINGS_FILE = ".pkgrc.json";
+var init_config2 = __esm(() => {
+  init_src();
+  init_registry();
+  ENV_REFERENCE = /\$\{(\w+)\}|\$(\w+)/g;
+  COMMENT = /^\s*[#;]/;
+  SCOPE_REGISTRY = /^(@[^:]+):registry$/;
+  AUTH_TOKEN = /^(\/\/.+?):_authToken$/;
+  PROTOCOL = /^\w+:/;
+  TRAILING_SLASHES3 = /\/+$/;
+  LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+  QUOTES = /^(["'])(.*)\1$/;
+});
+
+// ../kit/src/shell.ts
+function wrapper(short = "", long = [], operands = 0, runsString = false) {
+  return { short, long, operands, runsString };
+}
+var SEPARATORS2, PLAIN_BREAKERS, GLOB_CHARS, COMMENT_PREFIXES, DOUBLE_QUOTED_ESCAPES, KEYWORDS, SHELLS, SCANNED_PROGRAMS, COMMAND_STRING_PROGRAMS, POWERSHELL, SHELL_VALUE_OPTIONS, FISH_VALUE_OPTIONS, PRINTERS, FIND_EXEC, WRAPPERS;
+var init_shell = __esm(() => {
+  SEPARATORS2 = new Set([`
+`, ";", "|"]);
+  PLAIN_BREAKERS = new Set(["<", ">", "(", ")", "&", "|"]);
+  GLOB_CHARS = new Set(["*", "?", "["]);
+  COMMENT_PREFIXES = new Set([";", "&", "|", "(", ")"]);
+  DOUBLE_QUOTED_ESCAPES = new Set(["$", "`", '"', "\\"]);
+  KEYWORDS = new Set(["then", "do", "else", "if", "elif", "while", "until", "!", "{", "}"]);
+  SHELLS = new Set(["sh", "bash", "zsh", "dash", "ash", "ksh", "fish", "csh", "tcsh", "nu", "xonsh", "elvish", "pwsh", "powershell"]);
+  SCANNED_PROGRAMS = new Set(["su", "runuser", "flock"]);
+  COMMAND_STRING_PROGRAMS = new Set([...SHELLS, ...SCANNED_PROGRAMS]);
+  POWERSHELL = new Set(["pwsh", "powershell"]);
+  SHELL_VALUE_OPTIONS = new Set(["-o", "-O", "--rcfile", "--init-file"]);
+  FISH_VALUE_OPTIONS = new Set(["-C", "--init-command"]);
+  PRINTERS = new Set(["echo", "printf"]);
+  FIND_EXEC = new Set(["-exec", "-execdir", "-ok", "-okdir"]);
+  WRAPPERS = new Map([
+    ["command", wrapper()],
+    ["builtin", wrapper()],
+    ["nohup", wrapper()],
+    ["setsid", wrapper()],
+    ["busybox", wrapper()],
+    ["exec", wrapper("a")],
+    ["time", wrapper("fo", ["--format", "--output"])],
+    ["env", wrapper("uCS", ["--unset", "--chdir", "--split-string", "--argv0"])],
+    ["sudo", wrapper("ughpCTrtUDR", ["--user", "--group", "--host", "--prompt", "--close-from", "--command-timeout", "--role", "--type", "--other-user", "--chdir", "--chroot"])],
+    ["doas", wrapper("uC")],
+    ["timeout", wrapper("sk", ["--signal", "--kill-after"], 1)],
+    ["nice", wrapper("n", ["--adjustment"])],
+    ["ionice", wrapper("cnpPu", ["--class", "--classdata", "--pid", "--pgid", "--uid"])],
+    ["stdbuf", wrapper("ioe", ["--input", "--output", "--error"])],
+    ["chroot", wrapper("", ["--userspec", "--groups"], 1)],
+    ["watch", wrapper("n", ["--interval"], 0, true)],
+    ["flock", wrapper("wE", ["--timeout", "--conflict-exit-code"], 1)],
+    ["parallel", wrapper("jnNSaIPlLdTsC", ["--jobs", "--max-args", "--max-replace-args", "--sshlogin", "--arg-file", "--delimiter", "--colsep"], 0, true)],
+    ["unbuffer", wrapper()],
+    ["systemd-run", wrapper("puEMH", ["--property", "--unit", "--description", "--slice", "--setenv", "--machine", "--host", "--uid", "--gid", "--working-directory", "--nice", "--service-type"])],
+    ["xargs", wrapper("IndsEaPL", ["--max-args", "--max-procs", "--max-chars", "--delimiter", "--arg-file", "--eof", "--max-lines", "--process-slot-var"])]
+  ]);
+});
+
+// src/pin.ts
+function actions(byAction) {
+  return new Map(Object.entries(byAction).flatMap(([action, names]) => names.map((name) => [name, action])));
+}
+var LOCKFILES, ACTIONS, OPTION_FLAGS, DIR_FLAGS, VALUE_FLAGS;
+var init_pin = __esm(() => {
+  init_shell();
+  LOCKFILES = [
+    ["bun.lock", "bun"],
+    ["bun.lockb", "bun"],
+    ["pnpm-lock.yaml", "pnpm"],
+    ["yarn.lock", "yarn"],
+    ["package-lock.json", "npm"]
+  ];
+  ACTIONS = {
+    bun: actions({ install: ["install", "i"], add: ["add", "a"], remove: ["remove", "rm"], update: ["update"] }),
+    pnpm: actions({ install: ["install", "i"], add: ["add"], remove: ["remove", "rm"], update: ["update", "up"] }),
+    yarn: new Map([...actions({ install: ["", "install"], add: ["add"], remove: ["remove"], update: ["upgrade"] }), ["upgrade-interactive", null], ["import", null]]),
+    npm: actions({
+      install: ["install", "i", "in", "ins", "inst", "insta", "instal", "isnt", "isnta", "isntal", "isntall"],
+      add: ["add"],
+      frozen: ["ci", "clean-install", "ic", "install-clean", "isntall-clean"],
+      remove: ["uninstall", "unlink", "remove", "rm", "r", "un"],
+      update: ["update", "u", "up", "upgrade", "udpate"]
+    })
+  };
+  OPTION_FLAGS = new Map([
+    ["-D", "dev"],
+    ["--save-dev", "dev"],
+    ["--dev", "dev"],
+    ["-E", "exact"],
+    ["--save-exact", "exact"],
+    ["--exact", "exact"]
+  ]);
+  DIR_FLAGS = new Set(["--cwd", "-C", "--dir", "--prefix"]);
+  VALUE_FLAGS = new Set([...DIR_FLAGS, "--filter", "-F"]);
+});
+
+// src/consumers.ts
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname4, join as join5, relative } from "path";
+function packageFiles(dir, depth, found) {
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return found;
+  }
+  for (const entry of entries) {
+    if (entry.isFile() && entry.name === "package.json")
+      found.push(join5(dir, entry.name));
+    else if (entry.isDirectory() && depth < MAX_DEPTH && !entry.name.startsWith(".") && !SKIPPED.has(entry.name))
+      packageFiles(join5(dir, entry.name), depth + 1, found);
+  }
+  return found;
+}
+function managerFor(dir, root) {
+  for (let at = dir;; at = dirname4(at)) {
+    const lockfile = LOCKFILES.find(([file]) => existsSync2(join5(at, file)));
+    if (lockfile !== undefined)
+      return lockfile[1];
+    if (at === root || at === dirname4(at))
+      return "bun";
+  }
+}
+function findConsumers(name, root) {
+  const consumers = [];
+  for (const path of packageFiles(root, 0, []).sort()) {
+    let manifest;
+    try {
+      manifest = JSON.parse(readFileSync2(path, "utf8"));
+    } catch {
+      continue;
+    }
+    const kind = KINDS.find((each) => typeof manifest[each]?.[name] === "string");
+    const spec = kind === undefined ? undefined : manifest[kind]?.[name];
+    if (kind !== undefined && spec !== undefined)
+      consumers.push({ dir: relative(root, dirname4(path)) || ".", path, kind, spec, manager: managerFor(dirname4(path), root) });
+  }
+  return consumers;
+}
+function isLocal(consumer) {
+  return LOCAL_SPEC.test(consumer.spec);
+}
+function addCommand(consumer, name, version) {
+  return ["bun", "add", ...KIND_FLAGS[consumer.kind], "--exact", "--no-cache", `${name}@${version}`];
+}
+function registryDependencies(text) {
+  let manifest;
+  try {
+    manifest = JSON.parse(text);
+  } catch {
+    return fail("the package.json is not valid JSON");
+  }
+  return REGISTRY_KINDS.flatMap((kind) => Object.entries(manifest?.[kind] ?? {}).flatMap(([name, spec]) => typeof spec === "string" && !LOCAL_SPEC.test(spec) ? [{ name, kind, spec }] : []));
+}
+var KINDS, SKIPPED, MAX_DEPTH = 5, LOCAL_SPEC, KIND_FLAGS, REGISTRY_KINDS;
+var init_consumers = __esm(() => {
+  init_src();
+  init_pin();
+  KINDS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+  SKIPPED = new Set(["node_modules", "dist", "build", "vendor", "target", "coverage"]);
+  LOCAL_SPEC = /[:/]/;
+  KIND_FLAGS = { dependencies: [], devDependencies: ["--dev"], optionalDependencies: ["--optional"], peerDependencies: ["--peer"] };
+  REGISTRY_KINDS = KINDS.filter((kind) => kind !== "peerDependencies");
+});
+
 // src/commands/check.ts
 var exports_check = {};
 __export(exports_check, {
@@ -2239,13 +2696,20 @@ function render(report, now = Date.now()) {
   ].join(`
 `);
 }
+async function wanted(positionals, from) {
+  const names = positionals.filter((each) => each !== "-");
+  const fromFile = from === undefined ? [] : registryDependencies(await readInput(from)).map(({ name, spec }) => `${name}@${spec}`);
+  const fromStdin = positionals.includes("-") || names.length === 0 && fromFile.length === 0 && isStdinPiped() ? (await readInput("-")).split(WORDS).filter((each) => each !== "") : [];
+  return [...new Set([...names, ...fromFile, ...fromStdin])];
+}
 async function check(args) {
-  const parsed = parse(args, usage, options);
-  const { values, positionals } = parsed;
+  const parsed = parse(args, usage2, options, { exits: EXITS });
+  const { values } = parsed;
+  const positionals = await wanted(parsed.positionals, values.from);
   if (positionals.length === 0)
-    fail(`a package name is needed
+    fail(values.from === undefined ? `a package name is needed
 
-${usage}`);
+${usage2}` : `${values.from} has no registry dependency to check`);
   const context = { configs: await loadConfigs(), settings: await loadSettings(), minAgeDays: wholeNumber(values["min-age"], "min-age", DEFAULT_MIN_AGE_DAYS, 0) };
   const reports = await Promise.all(positionals.map(async (text) => checkPackage(text, context)));
   if (values.json === true)
@@ -2256,23 +2720,27 @@ ${usage}`);
 `));
   return reports.some((report) => report.blocked) ? 1 : 0;
 }
-var usage = `pkg [check] <name>[@version]...
+var usage2 = `pkg [check] <name>[@version]... | --from <package.json> | -
 
 Checks npm packages before they are added: whether the name exists, the latest and the newest version at least two weeks old, weekly downloads, licence, repository, install scripts and a near miss of a popular name.
 
-A \`.pkgrc.json\` (or ~/.config/pkg/config.json) with \`licenses\` (SPDX ids) refuses a licence outside the list or a missing one, and \`blockSeverity\` (low, moderate, high, critical; high when unset) refuses a version with an advisory at that level or above.
+Names come from the arguments, from the dependencies of a package.json with --from (each checked as \`name@range\`, so it resolves what an install would; dev and optional ones included, peer ranges and local or remote sources left out), or from stdin, separated by spaces or lines, when \`-\` is given or nothing else is and stdin is piped.
 
-Exits 0 when every package passes, 1 when one is blocked (missing, the version asked for is under the minimum age or has no date, its licence is outside the allowlist or an advisory reaches the threshold), 2 when it could not check (the registry unreachable, slow or answering badly, a broken .pkgrc.json, bunfig.toml or .npmrc) or on a usage error.`, options;
+A \`.pkgrc.json\` (or ~/.config/kaynooo-cli/pkg.json) with \`licenses\` (SPDX ids) refuses a licence outside the list or a missing one, and \`blockSeverity\` (low, moderate, high, critical; high when unset) refuses a version with an advisory at that level or above.`, EXITS, options, WORDS;
 var init_check = __esm(() => {
   init_src();
   init_advisories();
   init_analyze();
   init_config2();
+  init_consumers();
   init_registry();
+  EXITS = [[0, "every package passes"], [1, "one is blocked: missing, the version asked for is under the minimum age or has no date, its licence is outside the allowlist or an advisory reaches the threshold"], [2, "it could not check (the registry unreachable, slow or answering badly, a broken .pkgrc.json, bunfig.toml or .npmrc) or a usage error"]];
   options = {
     json: jsonOption(),
-    "min-age": { type: "string", description: `days a version must be old (${DEFAULT_MIN_AGE_DAYS})` }
+    "min-age": { type: "string", description: `days a version must be old (${DEFAULT_MIN_AGE_DAYS})` },
+    from: { type: "string", description: "check the dependencies of this package.json" }
   };
+  WORDS = /\s+/;
 });
 
 // src/lockfile.ts
@@ -2298,6 +2766,42 @@ function parseBunLock(text) {
   }
   return [...seen.values()].sort((a, b) => a.name.localeCompare(b.name) || Bun.semver.order(a.version, b.version));
 }
+function parentKey(key) {
+  const parts = key.split("/");
+  const drop = parts.length > 1 && parts.at(-2)?.startsWith("@") ? 2 : 1;
+  return parts.length > drop ? parts.slice(0, -drop).join("/") : undefined;
+}
+function productionPackages(text) {
+  const lock = Bun.JSONC.parse(text);
+  const packages = lock?.packages ?? {};
+  const reached = new Set;
+  const visited = new Set;
+  const pending = [];
+  for (const workspace of Object.values(lock?.workspaces ?? {})) {
+    for (const name of Object.keys({ ...workspace.dependencies, ...workspace.optionalDependencies }))
+      pending.push({ name, from: undefined });
+  }
+  while (pending.length > 0) {
+    const { name, from } = pending.pop();
+    let scope = from;
+    let key = scope === undefined ? name : `${scope}/${name}`;
+    while (!(key in packages) && scope !== undefined) {
+      scope = parentKey(scope);
+      key = scope === undefined ? name : `${scope}/${name}`;
+    }
+    const entry = packages[key];
+    if (entry === undefined || visited.has(key))
+      continue;
+    visited.add(key);
+    const locked = typeof entry[0] === "string" ? split(entry[0]) : undefined;
+    if (locked !== undefined)
+      reached.add(`${locked.name}@${locked.version}`);
+    const info = entry[2] ?? {};
+    for (const dependency of Object.keys({ ...info.dependencies, ...info.optionalDependencies }))
+      pending.push({ name: dependency, from: key });
+  }
+  return reached;
+}
 var NOT_REGISTRY, VERSION_SEPARATOR2, NPM_ALIAS = "npm:";
 var init_lockfile = __esm(() => {
   NOT_REGISTRY = /^(?:workspace|link|file|github|git|http|https):|^[\w.-]+\/[\w.-]+$/;
@@ -2309,8 +2813,8 @@ var exports_audit = {};
 __export(exports_audit, {
   audit: () => audit
 });
-import { join as join2, resolve as resolve2 } from "path";
-import process9 from "process";
+import { join as join6, resolve as resolve2 } from "path";
+import process14 from "process";
 function hasFinding(audited) {
   return audited.blocked || audited.warnings.length > 0 || audited.advisories.length > 0;
 }
@@ -2365,15 +2869,17 @@ function renderAudit(findings, total) {
 `);
 }
 async function audit(args) {
-  const { values, positionals: [asked] } = parse(args, usage2, options2, { positionals: ["[dir]"] });
-  const level = values["audit-level"] ?? "low";
+  const { values, positionals: [asked] } = parse(args, usage3, options2, { positionals: ["[dir]"], exits: EXITS2 });
+  const level = values.level ?? "moderate";
   if (!isSeverity(level))
-    fail(`--audit-level takes ${SEVERITIES.join(", ")}, not ${level}`);
-  const dir = resolve2(asked ?? process9.cwd());
-  const lock = Bun.file(join2(dir, "bun.lock"));
+    fail(`--level takes ${SEVERITIES.join(", ")}, not ${level}`);
+  const dir = resolve2(asked ?? process14.cwd());
+  const lock = Bun.file(join6(dir, "bun.lock"));
   if (!await lock.exists())
     fail(`no bun.lock in ${dir}`);
-  const packages = parseBunLock(await lock.text());
+  const text = await lock.text();
+  const production = values.prod === true ? productionPackages(text) : undefined;
+  const packages = parseBunLock(text).filter(({ name, version }) => production?.has(`${name}@${version}`) ?? true);
   const context = {
     configs: await loadConfigs(dir),
     settings: await loadSettings(dir),
@@ -2393,12 +2899,11 @@ async function audit(args) {
     return 1;
   return unavailable.length > 0 ? 2 : 0;
 }
-var usage2 = `pkg audit [dir]
+var usage3 = `pkg audit [dir]
 
 Reads the bun.lock in the folder (the current one by default) and runs on every registry package it pins the checks \`pkg check\` runs before an add: age, install scripts, a deprecated version, a near miss of a popular name, and the licence allowlist of the pkg config. It also lists the known advisories of each version, with the GHSA, the severity and the fixed version, from the registry's bulk advisory endpoint, the one \`bun audit\` reads.
 Findings are grouped per package, each registry package looked up once per run.
-
-Exits 0 when nothing blocks, 1 when a package is missing, too fresh or outside the licence allowlist, or an advisory reaches --audit-level, 2 when the registry could not be reached or answered badly (a warning says which, and nothing is reported as clean), on a usage error or without a bun.lock.`, options2, BATCH = 8;
+Reach for it to vet one repository in depth; \`audit\` sweeps many repositories for advisories only, and shares --level, --prod and --ignore.`, EXITS2, options2, BATCH = 8;
 var init_audit = __esm(() => {
   init_src();
   init_advisories();
@@ -2406,146 +2911,95 @@ var init_audit = __esm(() => {
   init_config2();
   init_lockfile();
   init_registry();
+  EXITS2 = [[0, "nothing blocks"], [1, "a package is missing, too fresh or outside the licence allowlist, or an advisory reaches --level"], [2, "the registry could not be reached or answered badly (a warning says which, and nothing is reported as clean), a usage error or no bun.lock"]];
   options2 = {
     json: jsonOption("[{name, version, license, blocked, warnings, advisories}] for the packages with a finding"),
     "min-age": { type: "string", description: `days a version must be old (${DEFAULT_MIN_AGE_DAYS})` },
-    "audit-level": { type: "string", description: "lowest advisory severity listed and failing: low, moderate, high, critical (low)" },
+    level: { type: "string", description: "lowest advisory severity listed and failing: low, moderate, high, critical (moderate)" },
+    prod: { type: "boolean", description: "only the packages a production dependency or an optional one of a workspace reaches" },
     ignore: { type: "string", multiple: true, description: "an advisory skipped by GHSA or numeric id, repeatable" }
   };
 });
 
-// ../kit/src/shell.ts
-function wrapper(short = "", long = [], operands = 0) {
-  return { short, long, operands };
-}
-var SEPARATORS2, PLAIN_BREAKERS, GLOB_CHARS, COMMENT_PREFIXES, DOUBLE_QUOTED_ESCAPES, KEYWORDS, SHELLS, COMMAND_STRING_PROGRAMS, SHELL_VALUE_OPTIONS, PRINTERS, FIND_EXEC, WRAPPERS;
-var init_shell = __esm(() => {
-  SEPARATORS2 = new Set([`
-`, ";", "|"]);
-  PLAIN_BREAKERS = new Set(["<", ">", "(", ")", "&", "|"]);
-  GLOB_CHARS = new Set(["*", "?", "["]);
-  COMMENT_PREFIXES = new Set([";", "&", "|", "(", ")"]);
-  DOUBLE_QUOTED_ESCAPES = new Set(["$", "`", '"', "\\"]);
-  KEYWORDS = new Set(["then", "do", "else", "if", "elif", "while", "until", "!", "{", "}"]);
-  SHELLS = new Set(["sh", "bash", "zsh", "dash", "ash", "ksh"]);
-  COMMAND_STRING_PROGRAMS = new Set([...SHELLS, "su", "runuser"]);
-  SHELL_VALUE_OPTIONS = new Set(["-o", "-O", "--rcfile", "--init-file"]);
-  PRINTERS = new Set(["echo", "printf"]);
-  FIND_EXEC = new Set(["-exec", "-execdir", "-ok", "-okdir"]);
-  WRAPPERS = new Map([
-    ["command", wrapper()],
-    ["builtin", wrapper()],
-    ["nohup", wrapper()],
-    ["setsid", wrapper()],
-    ["busybox", wrapper()],
-    ["exec", wrapper("a")],
-    ["time", wrapper("fo", ["--format", "--output"])],
-    ["env", wrapper("uCS", ["--unset", "--chdir", "--split-string", "--argv0"])],
-    ["sudo", wrapper("ughpCTrtUDR", ["--user", "--group", "--host", "--prompt", "--close-from", "--command-timeout", "--role", "--type", "--other-user", "--chdir", "--chroot"])],
-    ["doas", wrapper("uC")],
-    ["timeout", wrapper("sk", ["--signal", "--kill-after"], 1)],
-    ["nice", wrapper("n", ["--adjustment"])],
-    ["ionice", wrapper("cnpPu", ["--class", "--classdata", "--pid", "--pgid", "--uid"])],
-    ["stdbuf", wrapper("ioe", ["--input", "--output", "--error"])],
-    ["chroot", wrapper("", ["--userspec", "--groups"], 1)],
-    ["xargs", wrapper("IndsEaPL", ["--max-args", "--max-procs", "--max-chars", "--delimiter", "--arg-file", "--eof", "--max-lines", "--process-slot-var"])]
-  ]);
+// src/commands/outdated.ts
+var exports_outdated = {};
+__export(exports_outdated, {
+  outdatedCommand: () => outdatedCommand
 });
-
-// src/pin.ts
-function actions(byAction) {
-  return new Map(Object.entries(byAction).flatMap(([action, names]) => names.map((name) => [name, action])));
+import { existsSync as existsSync3 } from "fs";
+import { join as join7, resolve as resolve3 } from "path";
+function currentOf(name, spec, locked) {
+  const pinned = locked.filter((each) => each.name === name && Bun.semver.satisfies(each.version, spec)).map((each) => each.version).sort(Bun.semver.order).at(-1);
+  const written = FIRST_VERSION.exec(spec)?.[0];
+  return pinned ?? (written === undefined ? undefined : [...written.split("."), "0", "0"].slice(0, 3).join("."));
+}
+function changeOf(current, next) {
+  const [from, to] = [current, next].map((version) => version.split(DOT).map(Number));
+  if (from?.[0] !== to?.[0])
+    return "major";
+  return from?.[1] === to?.[1] ? "patch" : "minor";
+}
+async function outdated(manifest, context) {
+  const configs = await loadConfigs();
+  const dependencies = registryDependencies(manifest);
+  const rows = [];
+  for (let start = 0;start < dependencies.length; start += BATCH2) {
+    const looked = await Promise.all(dependencies.slice(start, start + BATCH2).map(async ({ name, kind, spec }) => {
+      const registry = registryFor(name, configs);
+      const packument = await fetchPackument(name, registry, context.fetcher);
+      if (packument === undefined) {
+        warn(`${name} is not on ${new URL(registry.url).host}`);
+        return;
+      }
+      const { safe, latest } = analyze({ spec: { name }, packument, registry: new URL(registry.url).host, now: context.now, minAgeDays: context.minAgeDays });
+      const current = currentOf(name, spec, context.locked);
+      if (safe === undefined || current === undefined || Bun.semver.order(safe.version, current) <= 0)
+        return;
+      const row = { name, kind, spec, current, safe: safe.version, change: changeOf(current, safe.version), published: safe.published };
+      return latest !== undefined && latest.version !== safe.version && Bun.semver.order(latest.version, safe.version) > 0 ? { ...row, latest: latest.version } : row;
+    }));
+    rows.push(...looked.filter((row) => row !== undefined));
+  }
+  return rows.sort((a, b) => a.name.localeCompare(b.name));
+}
+async function outdatedCommand(args) {
+  const { values, positionals: [dir = "."] } = parse(args, usage4, options3, { positionals: ["[dir]"], exits: EXITS3 });
+  const folder = resolve3(dir);
+  const manifest = Bun.file(join7(folder, "package.json"));
+  if (!await manifest.exists())
+    fail(`no package.json in ${folder}`);
+  const lockPath = join7(folder, "bun.lock");
+  const locked = existsSync3(lockPath) ? parseBunLock(await Bun.file(lockPath).text()) : [];
+  const rows = await outdated(await manifest.text(), { minAgeDays: wholeNumber(values["min-age"], "min-age", DEFAULT_MIN_AGE_DAYS, 0), locked });
+  const { shown, footer } = capped(rows, limitOf(values, OUTDATED_LIMIT));
+  if (values.json === true)
+    printJson(shown);
+  else if (shown.length === 0)
+    console.log("nothing outdated: every dependency is on its safe version");
+  else
+    console.log([table([["PACKAGE", "KIND", "CURRENT", "SAFE", "CHANGE", "PUBLISHED", "LATEST"], ...shown.map((each) => [each.name, each.kind, each.current, each.safe, each.change, each.published === undefined ? "-" : formatAge(each.published), each.latest ?? ""])], { header: true }), ...footer === undefined ? [] : [footer]].join(`
+`));
+  return 0;
 }
-var LOCKFILES, ACTIONS, OPTION_FLAGS, DIR_FLAGS, VALUE_FLAGS;
-var init_pin = __esm(() => {
-  init_shell();
-  LOCKFILES = [
-    ["bun.lock", "bun"],
-    ["bun.lockb", "bun"],
-    ["pnpm-lock.yaml", "pnpm"],
-    ["yarn.lock", "yarn"],
-    ["package-lock.json", "npm"]
-  ];
-  ACTIONS = {
-    bun: actions({ install: ["install", "i"], add: ["add", "a"], remove: ["remove", "rm"], update: ["update"] }),
-    pnpm: actions({ install: ["install", "i"], add: ["add"], remove: ["remove", "rm"], update: ["update", "up"] }),
-    yarn: new Map([...actions({ install: ["", "install"], add: ["add"], remove: ["remove"], update: ["upgrade"] }), ["upgrade-interactive", null], ["import", null]]),
-    npm: actions({
-      install: ["install", "i", "in", "ins", "inst", "insta", "instal", "isnt", "isnta", "isntal", "isntall"],
-      add: ["add"],
-      frozen: ["ci", "clean-install", "ic", "install-clean", "isntall-clean"],
-      remove: ["uninstall", "unlink", "remove", "rm", "r", "un"],
-      update: ["update", "u", "up", "upgrade", "udpate"]
-    })
-  };
-  OPTION_FLAGS = new Map([
-    ["-D", "dev"],
-    ["--save-dev", "dev"],
-    ["--dev", "dev"],
-    ["-E", "exact"],
-    ["--save-exact", "exact"],
-    ["--exact", "exact"]
-  ]);
-  DIR_FLAGS = new Set(["--cwd", "-C", "--dir", "--prefix"]);
-  VALUE_FLAGS = new Set([...DIR_FLAGS, "--filter", "-F"]);
-});
+var usage4 = `pkg outdated [dir]
 
-// src/consumers.ts
-import { existsSync, readdirSync, readFileSync } from "fs";
-import { dirname as dirname2, join as join3, relative } from "path";
-function packageFiles(dir, depth, found) {
-  let entries;
-  try {
-    entries = readdirSync(dir, { withFileTypes: true });
-  } catch {
-    return found;
-  }
-  for (const entry of entries) {
-    if (entry.isFile() && entry.name === "package.json")
-      found.push(join3(dir, entry.name));
-    else if (entry.isDirectory() && depth < MAX_DEPTH && !entry.name.startsWith(".") && !SKIPPED.has(entry.name))
-      packageFiles(join3(dir, entry.name), depth + 1, found);
-  }
-  return found;
-}
-function managerFor(dir, root) {
-  for (let at = dir;; at = dirname2(at)) {
-    const lockfile = LOCKFILES.find(([file]) => existsSync(join3(at, file)));
-    if (lockfile !== undefined)
-      return lockfile[1];
-    if (at === root || at === dirname2(at))
-      return "bun";
-  }
-}
-function findConsumers(name, root) {
-  const consumers = [];
-  for (const path of packageFiles(root, 0, []).sort()) {
-    let manifest;
-    try {
-      manifest = JSON.parse(readFileSync(path, "utf8"));
-    } catch {
-      continue;
-    }
-    const kind = KINDS.find((each) => typeof manifest[each]?.[name] === "string");
-    const spec = kind === undefined ? undefined : manifest[kind]?.[name];
-    if (kind !== undefined && spec !== undefined)
-      consumers.push({ dir: relative(root, dirname2(path)) || ".", path, kind, spec, manager: managerFor(dirname2(path), root) });
-  }
-  return consumers;
-}
-function isLocal(consumer) {
-  return LOCAL_SPEC.test(consumer.spec);
-}
-function addCommand(consumer, name, version) {
-  return ["bun", "add", ...KIND_FLAGS[consumer.kind], "--exact", "--no-cache", `${name}@${version}`];
-}
-var KINDS, SKIPPED, MAX_DEPTH = 5, LOCAL_SPEC, KIND_FLAGS;
-var init_consumers = __esm(() => {
-  init_pin();
-  KINDS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
-  SKIPPED = new Set(["node_modules", "dist", "build", "vendor", "target", "coverage"]);
-  LOCAL_SPEC = /[:/]/;
-  KIND_FLAGS = { dependencies: [], devDependencies: ["--dev"], optionalDependencies: ["--optional"], peerDependencies: ["--peer"] };
+Lists the dependencies of the package.json in the folder (the current one by default, registry versions only) that have a newer version safe to take: the highest stable one at least --min-age days old, the \`safe\` of \`pkg check\`. The version in use is the highest one the folder's bun.lock pins that the range allows, else the exact version written, else the first version in the range. A dependency whose newest version is still too fresh shows it under \`latest\`.
+It reads only the registry's metadata, no advisories, and changes nothing: \`bun add --exact name@version\` adopts a row.`, EXITS3, OUTDATED_LIMIT = 50, BATCH2 = 8, FIRST_VERSION, DOT, options3;
+var init_outdated = __esm(() => {
+  init_src();
+  init_analyze();
+  init_config2();
+  init_consumers();
+  init_lockfile();
+  init_registry();
+  EXITS3 = [[0, "it listed what is outdated, nothing included"], [2, "the registry could not be reached or answered badly, no package.json, or a usage error"]];
+  FIRST_VERSION = /\d+(?:\.\d+){0,2}(?:-[\w.-]+)?/;
+  DOT = /[.-]/;
+  options3 = {
+    "min-age": { type: "string", description: `days a version must be old (${DEFAULT_MIN_AGE_DAYS})` },
+    ...limitOptions(OUTDATED_LIMIT),
+    json: jsonOption("[{name, kind, spec, current, safe, change, published, latest?}]")
+  };
 });
 
 // src/commands/bump.ts
@@ -2554,9 +3008,9 @@ __export(exports_bump, {
   ROOT_OPTION: () => ROOT_OPTION,
   bump: () => bump
 });
-import { existsSync as existsSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join4, relative as relative2 } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname5, join as join8, relative as relative2 } from "path";
 async function lookup(name, registry, fetcher) {
   try {
     return { packument: await fetchPackument(name, registry, fetcher) };
@@ -2574,7 +3028,7 @@ async function servedVersion(name, version, settings) {
   const registry = registryFor(name, settings.configs);
   const host = new URL(registry.url).host;
   const started = Date.now();
-  const region = liveRegion((spinner) => [`${spinner} waiting for ${host} to serve ${name}@${version} ${formatElapsed(Date.now() - started)}`]);
+  const region = liveRegion((spinner) => [`${spinner} waiting for ${host} to serve ${name}@${version ?? "latest"} ${formatElapsed(Date.now() - started)}`]);
   let lastError = "";
   try {
     for (;; ) {
@@ -2593,7 +3047,7 @@ async function servedVersion(name, version, settings) {
           return version;
       }
       if (Date.now() - started >= settings.timeout)
-        fail(`${host} does not serve ${name}@${version} after ${formatDuration(settings.timeout)}${lastError === "" ? "" : `, last error: ${lastError}`}`);
+        fail(`${host} does not serve ${name}@${version ?? "latest"} after ${formatDuration(settings.timeout)}${lastError === "" ? "" : `, last error: ${lastError}`}`);
       region.redraw();
       await Bun.sleep(settings.poll ?? POLL);
     }
@@ -2616,11 +3070,11 @@ async function vet(name, version, settings) {
   return false;
 }
 function lockfileOf(dir, root) {
-  for (let at = dir;; at = dirname3(at)) {
-    const found = ["bun.lock", "bun.lockb"].find((file) => existsSync2(join4(at, file)));
+  for (let at = dir;; at = dirname5(at)) {
+    const found = ["bun.lock", "bun.lockb"].find((file) => existsSync4(join8(at, file)));
     if (found !== undefined)
-      return relative2(dir, join4(at, found));
-    if (at === root || at === dirname3(at))
+      return relative2(dir, join8(at, found));
+    if (at === root || at === dirname5(at))
       return;
   }
 }
@@ -2654,7 +3108,7 @@ async function bumpConsumers(name, version, settings) {
     note(`${local} non-registry dependenc${local === 1 ? "y" : "ies"} (workspace:, file:, git, URL, alias, catalog:)`, "left as they are");
   for (const consumer of consumers) {
     const argv = addCommand(consumer, name, version);
-    const where = join4(settings.root, consumer.dir);
+    const where = join8(settings.root, consumer.dir);
     if (consumer.kind === "peerDependencies") {
       skipped.push(consumer.dir);
       note(consumer.dir, `peer range ${consumer.spec}, left as it is`);
@@ -2697,9 +3151,9 @@ async function bumpConsumers(name, version, settings) {
   return isClean;
 }
 async function bump(args) {
-  const { values, positionals: [name, asked] } = parse(args, usage3, options3, { positionals: ["<name>", "[version]"] });
+  const { values, positionals: [name, asked] } = parse(args, usage5, options4, { positionals: ["<name>", "[version]"] });
   const settings = {
-    root: values.root ?? join4(homedir2(), "Workspace"),
+    root: values.root ?? join8(homedir4(), "Workspace"),
     configs: await loadConfigs(),
     timeout: duration(values.timeout, "timeout", 10 * 60000),
     isDryRun: values["dry-run"] === true,
@@ -2713,14 +3167,14 @@ async function bump(args) {
     return 1;
   return await bumpConsumers(name, version, settings) ? 0 : 1;
 }
-var usage3 = `pkg bump <name> [version]
+var usage5 = `pkg bump <name> [version]
 
 Waits until the registry serves the version (the latest when none is given, an exact version otherwise), vets it as \`pkg check\` does (advisories, licence allowlist, and a minimum age only when --min-age asks for one), then runs \`bun add --exact --no-cache\` in each folder under --root whose package.json depends on the package, the kind of dependency kept, a line per folder.
 A version the vetting blocks is refused before any folder is touched, unless --force is given.
 A dependency that is not a registry version (workspace:, link:, file:, git, a URL, an npm: alias, catalog:), a peer range, a folder already on the version and one whose lockfile pins another manager are left as they are, each said so.
 With --all-consumers a folder whose package.json or lockfile already has uncommitted changes is left alone, and each folder whose install went through then runs its own \`check\` (the check bin) and is committed with \`gc 'chore(deps): bump <name> to <version>' -- package.json <lockfile>\` only when that passes; a failing one is left uncommitted and listed in the summary with the skipped ones, and nothing is ever pushed.
 
-Exits 0 when every install ran or was left as it is (with --all-consumers, and every check passed and every commit landed), 1 when the vetting refuses the version, an install, a check or a commit fails or the registry has no such package, 2 when the version never shows within the timeout (a registry that cannot be reached is retried until then) or on a usage error.`, ROOT_OPTION, options3, POLL = 5000;
+Exits 0 when every install ran or was left as it is (with --all-consumers, and every check passed and every commit landed), 1 when the vetting refuses the version, an install, a check or a commit fails or the registry has no such package, 2 when the version never shows within the timeout (a registry that cannot be reached is retried until then) or on a usage error.`, ROOT_OPTION, options4, POLL = 5000;
 var init_bump = __esm(() => {
   init_src();
   init_progress();
@@ -2730,7 +3184,7 @@ var init_bump = __esm(() => {
   init_semver();
   init_check();
   ROOT_OPTION = { type: "string", description: "the folder holding the repositories (~/Workspace)" };
-  options3 = {
+  options4 = {
     root: ROOT_OPTION,
     timeout: { type: "string", short: "t", description: "how long to wait for the registry (10m): 30s, 5m, 1h" },
     "all-consumers": { type: "boolean", description: "after each install run the folder's check and commit it through gc when it passes" },
@@ -2745,11 +3199,11 @@ var exports_consumers = {};
 __export(exports_consumers, {
   consumers: () => consumers
 });
-import { homedir as homedir3 } from "os";
-import { join as join5 } from "path";
+import { homedir as homedir5 } from "os";
+import { join as join9 } from "path";
 function consumers(args) {
-  const { values, positionals: [name] } = parse(args, usage4, options4, { positionals: ["<name>"] });
-  const root = values.root ?? join5(homedir3(), "Workspace");
+  const { values, positionals: [name] } = parse(args, usage6, options5, { positionals: ["<name>"] });
+  const root = values.root ?? join9(homedir5(), "Workspace");
   const { shown, footer } = capped(findConsumers(name, root), limitOf(values, CONSUMERS_LIMIT));
   if (values.json === true)
     printJson(shown);
@@ -2760,16 +3214,16 @@ function consumers(args) {
 `));
   return 0;
 }
-var usage4 = `pkg consumers <name>
+var usage6 = `pkg consumers <name>
 
 Lists the folders under --root whose package.json depends on the package: the folder, the kind of dependency, the version it asks for and the manager its lockfile pins, 30 at most with the count of the rest after them (--limit <n>, --full for all; --json is never cut unless --limit is given).
 
-Exits 0 when it listed them, 2 on a usage error.`, CONSUMERS_LIMIT = 30, options4;
+Exits 0 when it listed them, 2 on a usage error.`, CONSUMERS_LIMIT = 30, options5;
 var init_consumers2 = __esm(() => {
   init_src();
   init_consumers();
   init_bump();
-  options4 = {
+  options5 = {
     root: ROOT_OPTION,
     ...limitOptions(CONSUMERS_LIMIT),
     json: jsonOption("[{dir, path, kind, spec, manager}]")
@@ -2778,14 +3232,9 @@ var init_consumers2 = __esm(() => {
 
 // src/cli.ts
 init_src();
-import process10 from "process";
-// package.json
-var version = "0.7.0";
-
-// src/cli.ts
-process10.exitCode = await runCli({
+import process15 from "process";
+process15.exitCode = await runCli({
   name: "pkg",
-  version,
   about: "checks npm packages before they are added, and moves a lib's consumers onto a new release",
   replaces: "bun add on trust, and a bun info and sleep loop then a bun add per consumer",
   examples: [["pkg zod", "the name, the newest version two weeks old, its licence and scripts"], ["pkg bump @kaynooo/cli-kit --dry-run", "the consumers a release would move"]],
@@ -2793,6 +3242,7 @@ process10.exitCode = await runCli({
   commands: {
     check: { summary: "check packages before they are added (`pkg <name>` alone runs it)", run: async (args) => (await Promise.resolve().then(() => (init_check(), exports_check))).check(args) },
     audit: { summary: "check every package a bun.lock pins, with its known advisories", run: async (args) => (await Promise.resolve().then(() => (init_audit(), exports_audit))).audit(args) },
+    outdated: { summary: "list the dependencies of this folder that have a newer version safe to take", run: async (args) => (await Promise.resolve().then(() => (init_outdated(), exports_outdated))).outdatedCommand(args) },
     bump: { summary: "wait for a release on the registry, then bun add it in every consumer", run: async (args) => (await Promise.resolve().then(() => (init_bump(), exports_bump))).bump(args) },
     consumers: { summary: "list the folders depending on a package, with the version each asks for", run: async (args) => (await Promise.resolve().then(() => (init_consumers2(), exports_consumers))).consumers(args) }
   }