@kaynooo/pkg-tools 0.2.1 → 0.4.0

package/dist/cli.js

@@ -1,18 +1,30 @@
 #!/usr/bin/env bun
 // @bun
-
-// src/cli.ts
-import process7 from "process";
-
-// ../kit/src/args.ts
-import process3 from "process";
-import { parseArgs } from "util";
-
-// ../kit/src/format.ts
-import process2 from "process";
-
-// ../kit/src/style.ts
-import process from "process";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res, err) => () => {
+  if (fn)
+    try {
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
+    }
+  if (err)
+    throw err[0];
+  return res;
+};
 
 // ../../node_modules/.bun/@kaynooo+utils@2.31.0+d0769e28dc4dad16/node_modules/@kaynooo/utils/dist/chunk-mtetydvc.js
 function x(s) {
@@ -94,9 +106,6 @@ function O(s) {
 function v(s, r, t, n) {
   return s /= 100, r /= 100, t /= 100, n /= 100, [Math.round(255 * (1 - s) * (1 - n)), Math.round(255 * (1 - r) * (1 - n)), Math.round(255 * (1 - t) * (1 - n))];
 }
-var m = (s) => s <= 0.04045 ? s / 12.92 : ((s + 0.055) / 1.055) ** 2.4;
-var p = (s) => s <= 0.0031308 ? 12.92 * s : 1.055 * s ** 0.4166666666666667 - 0.055;
-var i = (s, r) => Math.round(s * 10 ** r) / 10 ** r;
 function T(s) {
   let r = m(s[0] / 255), t = m(s[1] / 255), n = m(s[2] / 255), a = Math.cbrt(0.4122214708 * r + 0.5363325363 * t + 0.0514459929 * n), b = Math.cbrt(0.2119034982 * r + 0.6806995451 * t + 0.1073969566 * n), o = Math.cbrt(0.0883024619 * r + 0.2817188376 * t + 0.6299787005 * n);
   return [i(0.2104542553 * a + 0.793617785 * b - 0.0040720468 * o, 4), i(1.9779984951 * a - 2.428592205 * b + 0.4505937099 * o, 4), i(0.0259040371 * a + 0.7827717662 * b - 0.808675766 * o, 4)];
@@ -233,16 +242,10 @@ class e {
     return t >= n ? s : r;
   }
 }
+var m = (s) => s <= 0.04045 ? s / 12.92 : ((s + 0.055) / 1.055) ** 2.4, p = (s) => s <= 0.0031308 ? 12.92 * s : 1.055 * s ** 0.4166666666666667 - 0.055, i = (s, r) => Math.round(s * 10 ** r) / 10 ** r;
+var init_chunk_mtetydvc = () => {};
 
 // ../../node_modules/.bun/@kaynooo+utils@2.31.0+d0769e28dc4dad16/node_modules/@kaynooo/utils/dist/chunk-y1msbssb.js
-var r = 39;
-var o = 49;
-var f2 = "\x1B[";
-var C2 = { reset: [0, 0], bold: [1, 22], dim: [2, 22], italic: [3, 23], underline: [4, 24], inverse: [7, 27], hidden: [8, 28], strikethrough: [9, 29], black: [30, r], red: [31, r], green: [32, r], yellow: [33, r], blue: [34, r], magenta: [35, r], cyan: [36, r], white: [37, r], gray: [90, r], grey: [90, r], blackBright: [90, r], redBright: [91, r], greenBright: [92, r], yellowBright: [93, r], blueBright: [94, r], magentaBright: [95, r], cyanBright: [96, r], whiteBright: [97, r], bgBlack: [40, o], bgRed: [41, o], bgGreen: [42, o], bgYellow: [43, o], bgBlue: [44, o], bgMagenta: [45, o], bgCyan: [46, o], bgWhite: [47, o], bgBlackBright: [100, o], bgRedBright: [101, o], bgGreenBright: [102, o], bgYellowBright: [103, o], bgBlueBright: [104, o], bgMagentaBright: [105, o], bgCyanBright: [106, o], bgWhiteBright: [107, o], rgb: (i, n, a, l = "fg") => [`${l === "fg" ? 38 : 48};2;${i};${n};${a}`, l === "fg" ? r : o], hex: (i, n = "fg") => {
-  let [a, l, s] = e.from("hex", i).to("rgb");
-  return [`${n === "fg" ? 38 : 48};2;${a};${l};${s}`, n === "fg" ? r : o];
-}, ansi256: (i, n = "fg") => [`${n === "fg" ? 38 : 48};5;${i}`, n === "fg" ? r : o] };
-var b = new Set(["", "1", "2", "3", "true"]);
 function h(i, n = globalThis.process?.env ?? {}) {
   if (n.FORCE_COLOR !== undefined)
     return b.has(n.FORCE_COLOR);
@@ -273,26 +276,69 @@ function u(i, n = []) {
 function le(i = {}) {
   return u(i);
 }
-var t = le();
+var r = 39, o = 49, f2 = "\x1B[", C2, b, t;
+var init_chunk_y1msbssb = __esm(() => {
+  init_chunk_mtetydvc();
+  C2 = { reset: [0, 0], bold: [1, 22], dim: [2, 22], italic: [3, 23], underline: [4, 24], inverse: [7, 27], hidden: [8, 28], strikethrough: [9, 29], black: [30, r], red: [31, r], green: [32, r], yellow: [33, r], blue: [34, r], magenta: [35, r], cyan: [36, r], white: [37, r], gray: [90, r], grey: [90, r], blackBright: [90, r], redBright: [91, r], greenBright: [92, r], yellowBright: [93, r], blueBright: [94, r], magentaBright: [95, r], cyanBright: [96, r], whiteBright: [97, r], bgBlack: [40, o], bgRed: [41, o], bgGreen: [42, o], bgYellow: [43, o], bgBlue: [44, o], bgMagenta: [45, o], bgCyan: [46, o], bgWhite: [47, o], bgBlackBright: [100, o], bgRedBright: [101, o], bgGreenBright: [102, o], bgYellowBright: [103, o], bgBlueBright: [104, o], bgMagentaBright: [105, o], bgCyanBright: [106, o], bgWhiteBright: [107, o], rgb: (i, n, a, l = "fg") => [`${l === "fg" ? 38 : 48};2;${i};${n};${a}`, l === "fg" ? r : o], hex: (i, n = "fg") => {
+    let [a, l, s] = e.from("hex", i).to("rgb");
+    return [`${n === "fg" ? 38 : 48};2;${a};${l};${s}`, n === "fg" ? r : o];
+  }, ansi256: (i, n = "fg") => [`${n === "fg" ? 38 : 48};5;${i}`, n === "fg" ? r : o] };
+  b = new Set(["", "1", "2", "3", "true"]);
+  t = le();
+});
+
+// ../../node_modules/.bun/@kaynooo+utils@2.31.0+d0769e28dc4dad16/node_modules/@kaynooo/utils/dist/tools/colors.js
+var init_colors = __esm(() => {
+  init_chunk_y1msbssb();
+});
 
 // ../kit/src/style.ts
+import process from "process";
 function takesControlCodes(stream, env = process.env) {
   return stream.isTTY === true && env.NO_COLOR === undefined && env.NODE_DISABLE_COLORS === undefined && env.TERM !== "dumb";
 }
 function paint(stream, env = process.env) {
   return le({ stream: { isTTY: takesControlCodes(stream, env) }, env });
 }
-var STATUSES = {
-  passed: { symbol: "\u2713", words: ["passed", "success", "succeeded", "ok"], paint: (colors) => colors.green },
-  failed: { symbol: "\u2717", words: ["failed", "failure", "error", "errored"], paint: (colors) => colors.red },
-  running: { symbol: "\u25CF", words: ["running", "in_progress", "started"], paint: (colors) => colors.cyan },
-  queued: { symbol: "\u25CB", words: ["queued", "waiting", "pending", "created", "blocked", "scheduled"], paint: (colors) => colors.yellow },
-  skipped: { symbol: "-", words: ["skipped", "cancelled", "canceled", "manual"], paint: (colors) => colors.dim }
-};
-var STATUS_OF = new Map(Object.entries(STATUSES).flatMap(([status, { words }]) => words.map((word) => [word, status])));
+function marked(mark, text, stream, detail, env = process.env) {
+  const colors = paint(stream, env);
+  const { symbol, word, paint: tint } = MARKS[mark];
+  const head = takesControlCodes(stream, env) ? tint(colors)(symbol) : word;
+  return `${head} ${text}${detail === undefined ? "" : ` ${colors.dim(detail)}`}`;
+}
+function ok(text, detail) {
+  console.log(marked("ok", text, process.stdout, detail));
+}
+function note(text, detail) {
+  console.log(marked("note", text, process.stdout, detail));
+}
+function warn(text, detail) {
+  console.error(marked("warn", text, process.stderr, detail));
+}
+function problem(text, detail) {
+  console.error(marked("problem", text, process.stderr, detail));
+}
+var MARKS, STATUSES, STATUS_OF;
+var init_style = __esm(() => {
+  init_colors();
+  MARKS = {
+    ok: { symbol: "\u2713", word: "ok:", paint: (colors) => colors.green },
+    warn: { symbol: "!", word: "warning:", paint: (colors) => colors.yellow },
+    problem: { symbol: "\u2717", word: "error:", paint: (colors) => colors.red },
+    note: { symbol: "\xB7", word: "note:", paint: (colors) => colors.dim }
+  };
+  STATUSES = {
+    passed: { symbol: "\u2713", words: ["passed", "success", "succeeded", "ok"], paint: (colors) => colors.green },
+    failed: { symbol: "\u2717", words: ["failed", "failure", "error", "errored"], paint: (colors) => colors.red },
+    running: { symbol: "\u25CF", words: ["running", "in_progress", "started"], paint: (colors) => colors.cyan },
+    queued: { symbol: "\u25CB", words: ["queued", "waiting", "pending", "created", "blocked", "scheduled"], paint: (colors) => colors.yellow },
+    skipped: { symbol: "-", words: ["skipped", "cancelled", "canceled", "manual"], paint: (colors) => colors.dim }
+  };
+  STATUS_OF = new Map(Object.entries(STATUSES).flatMap(([status, { words }]) => words.map((word) => [word, status])));
+});
 
 // ../kit/src/format.ts
-var UNITS = [["d", 86400], ["h", 3600], ["m", 60], ["s", 1]];
+import process2 from "process";
 function formatSeconds(total) {
   let rest = Math.max(0, Math.round(total));
   const amounts = UNITS.map(([unit, size]) => {
@@ -306,6 +352,9 @@ function formatSeconds(total) {
   const next = amounts[first + 1];
   return next === undefined || next.startsWith("0") ? amounts[first] ?? "0s" : `${amounts[first]} ${next}`;
 }
+function formatDuration(ms) {
+  return ms < 60000 ? `${(Math.max(0, ms) / 1000).toFixed(1)}s` : formatSeconds(ms / 1000);
+}
 function upTo(text, separator) {
   const end = text.indexOf(separator);
   return end === -1 ? text : text.slice(0, end);
@@ -320,8 +369,6 @@ function formatAge(date, now = Date.now()) {
 function truncate(text, width) {
   return text.length <= width ? text : `${text.slice(0, Math.max(0, width - 1))}\u2026`;
 }
-var LINE_BREAKS = /\s*\n\s*/g;
-var ESCAPE = String.fromCharCode(27);
 function textWidth(text) {
   return Bun.stringWidth(text);
 }
@@ -363,56 +410,65 @@ function narrow(rows, widths, limit) {
 function printJson(value) {
   console.log(JSON.stringify(value, undefined, 2));
 }
+var UNITS, LINE_BREAKS, ESCAPE;
+var init_format = __esm(() => {
+  init_style();
+  UNITS = [["d", 86400], ["h", 3600], ["m", 60], ["s", 1]];
+  LINE_BREAKS = /\s*\n\s*/g;
+  ESCAPE = String.fromCharCode(27);
+});
 
 // ../kit/src/args.ts
+import process3 from "process";
+import { parseArgs } from "util";
 function jsonOption(holds) {
   return { type: "boolean", description: holds === undefined ? "print JSON" : `print JSON: ${holds}` };
 }
-
-class Exit extends Error {
-  code;
-  hint;
-  constructor(message, code, hint) {
-    super(message);
-    this.code = code;
-    this.hint = hint;
-  }
-}
 function fail(message, code = 2, hint) {
   throw new Exit(message, code, hint);
 }
-
-class UsageError extends Exit {
-  constructor(message) {
-    super(message, 2);
-  }
-}
 function badUsage(message) {
   throw new UsageError(message);
 }
 
-class HelpShown extends Exit {
-  constructor() {
-    super("help shown", 0);
-  }
-}
-
 class Completing {
   options;
   constructor(options) {
     this.options = options;
   }
 }
-var completion = { active: false };
-var OPTIONAL = /\[[^\]]+\]/g;
-var USAGE_PREFIX = /^usage:\s*/i;
 function usageLine(usage, colors = paint(process3.stdout)) {
   return `${colors.bold("Usage:")} ${usage.replace(USAGE_PREFIX, "").replaceAll(OPTIONAL, (part) => colors.dim(part))}`;
 }
-function helpText(usage, options, colors = paint(process3.stdout)) {
-  return [usageLine(usage, colors), "", colors.bold("Options:"), ...optionRows(options, colors)].join(`
+function helpText(usage, options, colors = paint(process3.stdout), { examples = [], replaces } = {}) {
+  return [usageLine(usage, colors), ...replacesRows(replaces, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exampleRows(examples, colors)].join(`
 `);
 }
+function replacesRows(replaces, colors = paint(process3.stdout)) {
+  return replaces === undefined ? [] : ["", `${colors.bold("Instead of:")} ${replaces}`];
+}
+function wantsHelpJson(env = process3.env) {
+  return env.KIT_HELP === "json";
+}
+function description(usage, { examples = [], replaces } = {}) {
+  const lines = usage.replace(USAGE_PREFIX, "").split(`
+`);
+  const first = lines[0];
+  const colon = first.indexOf(": ");
+  const prose = lines[lines.indexOf("") + 1] ?? "";
+  const fallback = lines.includes("") ? `${prose.charAt(0).toLowerCase()}${prose.slice(1)}`.replace(FULL_STOP, "") : "";
+  return {
+    synopsis: colon === -1 ? first : first.slice(0, colon),
+    summary: colon === -1 ? fallback : first.slice(colon + 2),
+    ...replaces === undefined ? {} : { replaces },
+    examples: examples.map((example) => typeof example === "string" ? { line: example } : { line: example[0], note: example[1] })
+  };
+}
+function exampleRows(examples, colors = paint(process3.stdout)) {
+  if (examples.length === 0)
+    return [];
+  return ["", colors.bold("Examples:"), ...examples.map((example) => typeof example === "string" ? `  ${example}` : `  ${example[0]}  ${colors.dim(`# ${example[1]}`)}`)];
+}
 function optionRows(options, colors = paint(process3.stdout)) {
   const rows = Object.entries(options).map(([name, option]) => {
     const short = option.short === undefined ? "    " : `${colors.cyan(`-${option.short}`)}, `;
@@ -422,8 +478,23 @@ function optionRows(options, colors = paint(process3.stdout)) {
   const width = Math.max(0, ...rows.map((row) => row.width));
   return rows.map((row) => `  ${row.flag}${" ".repeat(width - row.width)}  ${colors.dim(row.description)}`);
 }
+function applyOutput(color, plain, env = process3.env) {
+  const when = plain === true ? "never" : color ?? "auto";
+  if (when === "auto")
+    return;
+  if (when !== "always" && when !== "never")
+    badUsage(`--color takes auto, always or never, not ${when}`);
+  if (when === "always") {
+    env.FORCE_COLOR = "1";
+    delete env.NO_COLOR;
+  } else {
+    env.NO_COLOR = "1";
+    delete env.FORCE_COLOR;
+  }
+}
 function parse(args, usage, options, settings = {}) {
-  const all = { ...options, help: { type: "boolean", short: "h", description: "show this help" } };
+  const output = Object.fromEntries(Object.entries(OUTPUT_OPTIONS).filter(([name]) => !(name in options)));
+  const all = { ...options, ...output, help: { type: "boolean", short: "h", description: "show this help" } };
   if (completion.active)
     throw new Completing(all);
   const separator = settings.rest === true ? args.indexOf("--") : -1;
@@ -431,12 +502,14 @@ function parse(args, usage, options, settings = {}) {
   const rest = separator === -1 ? undefined : args.slice(separator + 1);
   let parsed;
   try {
-    parsed = parseArgs({ args: own, options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
+    parsed = parseArgs({ args: joinDashValues(own, all), options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
   } catch (error) {
     badUsage(parseError(error));
   }
-  if (parsed.values.help === true) {
-    console.log(helpText(usage, all));
+  const values = parsed.values;
+  applyOutput("color" in output ? values.color : undefined, "plain" in output ? values.plain : undefined);
+  if (values.help === true) {
+    console.log(wantsHelpJson() ? JSON.stringify(description(usage, settings)) : helpText(usage, all, undefined, settings));
     throw new HelpShown;
   }
   if (settings.positionals !== undefined)
@@ -451,6 +524,25 @@ function checkPositionals(given, names) {
   if (!variadic && given.length > names.length)
     badUsage(`unexpected argument ${given[names.length]}`);
 }
+function joinDashValues(args, options) {
+  const longOf = new Map(Object.entries(options).flatMap(([name, option]) => option.short === undefined ? [[`--${name}`, name]] : [[`--${name}`, name], [`-${option.short}`, name]]));
+  const isOption = (arg) => arg === "--" || longOf.has(arg.includes("=") ? arg.slice(0, arg.indexOf("=")) : arg);
+  const joined = [];
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i] ?? "";
+    if (arg === "--")
+      return [...joined, ...args.slice(i)];
+    const name = longOf.get(arg);
+    const next = args[i + 1];
+    if (name !== undefined && options[name]?.type === "string" && next !== undefined && next.startsWith("-") && next !== "-" && !isOption(next)) {
+      joined.push(`--${name}=${next}`);
+      i++;
+    } else {
+      joined.push(arg);
+    }
+  }
+  return joined;
+}
 function parseError(error) {
   const message = upTo(error instanceof Error ? error.message : String(error), ". ");
   return `${message.charAt(0).toLowerCase()}${message.slice(1)}`;
@@ -463,11 +555,57 @@ function wholeNumber(value, name, fallback, min = 1) {
     badUsage(`--${name} takes a whole number from ${min}, not ${value}`);
   return number;
 }
-// ../kit/src/cli.ts
-import process4 from "process";
+function duration(value, name, fallback, unit = "s") {
+  if (value === undefined)
+    return fallback;
+  const match = DURATION.exec(value.trim());
+  const ms = match === null ? 0 : Number(match[1]) * UNIT_MS[match[2] ?? unit];
+  if (ms < 1)
+    badUsage(`--${name} takes a duration such as 30s, 5m or 1h, not ${value}`);
+  return ms;
+}
+var Exit, UsageError, HelpShown, completion, OPTIONAL, USAGE_PREFIX, FULL_STOP, OUTPUT_OPTIONS, DURATION, UNIT_MS;
+var init_args = __esm(() => {
+  init_format();
+  init_style();
+  Exit = class Exit extends Error {
+    code;
+    hint;
+    constructor(message, code, hint) {
+      super(message);
+      this.code = code;
+      this.hint = hint;
+    }
+  };
+  UsageError = class UsageError extends Exit {
+    constructor(message) {
+      super(message, 2);
+    }
+  };
+  HelpShown = class HelpShown extends Exit {
+    constructor() {
+      super("help shown", 0);
+    }
+  };
+  completion = { active: false };
+  OPTIONAL = /\[[^\]]+\]/g;
+  USAGE_PREFIX = /^usage:\s*/i;
+  FULL_STOP = /\.$/;
+  OUTPUT_OPTIONS = {
+    color: { type: "string", description: "auto (on a terminal alone), always or never" },
+    plain: { type: "boolean", description: "plain text, no colour or spinner: --color never" }
+  };
+  DURATION = /^(\d+(?:\.\d+)?)(ms|[smh])?$/;
+  UNIT_MS = { ms: 1, s: 1000, m: 60000, h: 3600000 };
+});
+
+// ../kit/src/chart.ts
+var init_chart = __esm(() => {
+  init_format();
+  init_style();
+});
 
 // ../kit/src/text.ts
-var ANSI = new RegExp(`${String.fromCharCode(27)}\\[[\\d;?]*[a-z]`, "gi");
 function distance(a, b) {
   let previous = Array.from({ length: b.length + 1 }, (_, index) => index);
   for (const [i, left] of [...a].entries()) {
@@ -478,8 +616,71 @@ function distance(a, b) {
   }
   return previous[b.length] ?? 0;
 }
+var ANSI;
+var init_text = __esm(() => {
+  ANSI = new RegExp(`${String.fromCharCode(27)}\\[[\\d;?]*[a-z]`, "gi");
+});
 
 // ../kit/src/cli.ts
+import process4 from "process";
+function commandRows(commands, colors) {
+  const width = Math.max(...Object.keys(commands).map((name) => name.length));
+  const groups = new Map([["Commands:", []]]);
+  for (const [name, { summary, group }] of Object.entries(commands)) {
+    const heading = group === undefined ? "Commands:" : `${group}:`;
+    const rows = groups.get(heading) ?? [];
+    rows.push(`  ${colors.cyan(name.padEnd(width))}  ${colors.dim(summary)}`);
+    groups.set(heading, rows);
+  }
+  return [...groups].filter(([, rows]) => rows.length > 0).flatMap(([heading, rows], index) => [...index === 0 ? [] : [""], colors.bold(heading), ...rows]);
+}
+function takeOutputFlags(argv) {
+  let index = 0;
+  for (;index < argv.length; index++) {
+    const word = argv[index];
+    if (word === "--plain")
+      applyOutput(undefined, true);
+    else if (word.startsWith("--color="))
+      applyOutput(word.slice("--color=".length), undefined);
+    else if (word === "--color" && argv[index + 1] !== undefined)
+      applyOutput(argv[++index], undefined);
+    else
+      break;
+  }
+  return argv.slice(index);
+}
+function closest(name, names) {
+  const started = names.find((known) => known.startsWith(name));
+  if (started !== undefined)
+    return started;
+  const [best] = names.map((known) => ({ known, far: distance(name, known) })).sort((a, b) => a.far - b.far);
+  return best !== undefined && best.far <= (name.length < 4 ? 1 : 2) ? best.known : undefined;
+}
+async function help({ path, header, summary, commands, defaultCommand, examples, replaces }, stream) {
+  const colors = paint(stream);
+  const prefix = path.join(" ");
+  if (wantsHelpJson())
+    return JSON.stringify(description(`${prefix} <command> [options]: ${summary}`, { examples, replaces }));
+  const fallback = defaultCommand === undefined ? undefined : commands[defaultCommand];
+  const options = fallback !== undefined && "run" in fallback ? await optionsOf(fallback.run) : undefined;
+  const own = Object.entries(options ?? {}).filter(([name]) => !(name in TOP_OPTIONS));
+  return [
+    header(colors),
+    "",
+    usageLine(`${prefix} ${defaultCommand === undefined ? colors.cyan("<command>") : `[${colors.cyan("<command>")}]`} [options]`, colors),
+    ...replacesRows(replaces, colors),
+    "",
+    ...commandRows(commands, colors),
+    ...own.length === 0 ? [] : ["", `${colors.bold(`Options of ${defaultCommand}:`)} ${colors.dim("the command run when none is named")}`, ...optionRows(Object.fromEntries(own), colors)],
+    "",
+    colors.bold("Options:"),
+    ...optionRows(path.length === 1 ? TOP_OPTIONS : LEVEL_OPTIONS, colors),
+    ...exampleRows(examples ?? [], colors),
+    "",
+    `${colors.dim("Run")} ${prefix} ${colors.cyan("<command>")} --help ${colors.dim("for its options.")}`
+  ].join(`
+`);
+}
 function printError(prefix, message, hint, cause) {
   const colors = paint(process4.stderr);
   const styled = takesControlCodes(process4.stderr);
@@ -488,17 +689,65 @@ function printError(prefix, message, hint, cause) {
   ${styled ? tint(label) : `${label}:`} ${text}`;
   console.error(`${head} ${message}${under("cause", cause, colors.dim)}${under("hint", hint, colors.yellow)}`);
 }
-function reportThrown(prefix, error, redact = (text) => text) {
+function printJsonError(message, hint, cause) {
+  console.error(JSON.stringify({ error: message, ...hint === undefined ? {} : { hint }, ...cause === undefined ? {} : { cause } }));
+}
+function wantsJson(argv) {
+  const end = argv.indexOf("--");
+  return (end === -1 ? argv : argv.slice(0, end)).includes("--json");
+}
+function reportThrown(prefix, error, redact = (text) => text, json = false) {
   if (error instanceof HelpShown)
     return 0;
   const help = error instanceof UsageError ? `run ${prefix} --help for its options` : undefined;
   const named = error instanceof Error && !(error instanceof Exit) && error.name !== "Error" ? `${error.name}: ${error.message}` : undefined;
   const cause = error instanceof Error && error.cause instanceof Error ? redact(error.cause.message) : undefined;
-  printError(prefix, redact(named ?? (error instanceof Error ? error.message : String(error))), error instanceof Exit ? error.hint ?? help : undefined, cause);
+  const report = json ? printJsonError : (message, hint, causeText) => printError(prefix, message, hint, causeText);
+  report(redact(named ?? (error instanceof Error ? error.message : String(error))), error instanceof Exit ? error.hint ?? help : undefined, cause);
   return error instanceof Exit ? error.code : 1;
 }
-var COMPLETE = "__complete";
-var FILES = "__files__";
+async function dispatch(level, typed, { version, redact }) {
+  const prefix = level.path.join(" ");
+  let argv;
+  try {
+    argv = takeOutputFlags(typed);
+  } catch (error) {
+    return reportThrown(prefix, error);
+  }
+  const [name, ...args] = argv;
+  if (name === undefined && level.path.length > 1) {
+    console.error(await help(level, process4.stderr));
+    return 2;
+  }
+  if (name === undefined || name === "help" || name === "--help" || name === "-h") {
+    console.log(await help(level, process4.stdout));
+    return 0;
+  }
+  if (level.path.length === 1 && (name === "--version" || name === "-v")) {
+    console.log(version);
+    return 0;
+  }
+  let command = level.commands[level.aliases?.[name] ?? name];
+  let rest = args;
+  if (command === undefined && level.defaultCommand !== undefined) {
+    command = level.commands[level.defaultCommand];
+    rest = argv;
+  }
+  if (command === undefined) {
+    const meant = closest(name, Object.keys(level.commands));
+    printError(prefix, `no command ${name}`, meant === undefined ? `run ${prefix} --help for its commands` : `did you mean ${meant}?`);
+    return 2;
+  }
+  if ("commands" in command) {
+    const { summary } = command;
+    return dispatch({ path: [...level.path, name], header: (colors) => `${colors.bold(`${prefix} ${name}`)}  ${summary}`, summary, commands: command.commands, aliases: command.aliases, defaultCommand: undefined, examples: command.examples, replaces: undefined }, rest, { version, redact });
+  }
+  try {
+    return await command.run(rest);
+  } catch (error) {
+    return reportThrown(`${prefix} ${name}`, error, redact, wantsJson(rest));
+  }
+}
 async function optionsOf(run) {
   completion.active = true;
   try {
@@ -516,657 +765,141 @@ async function leafCandidates(run, words) {
     return [FILES];
   return Object.entries(await optionsOf(run)).map(([name, option]) => `--${name}	${option.description}`);
 }
+async function candidates(commands, aliases, defaultCommand, words) {
+  const [word = "", ...rest] = words;
+  const command = commands[aliases?.[word] ?? word];
+  if (rest.length === 0 && !word.startsWith("-"))
+    return Object.entries(commands).map(([name, { summary }]) => `${name}	${summary}`);
+  if (command === undefined) {
+    const fallback = defaultCommand === undefined ? undefined : commands[defaultCommand];
+    return fallback !== undefined && "run" in fallback ? leafCandidates(fallback.run, words) : [];
+  }
+  return "commands" in command ? candidates(command.commands, command.aliases, undefined, rest) : leafCandidates(command.run, rest);
+}
 async function printCandidates(found) {
   for (const line of await found)
     console.log(line);
   return 0;
 }
-async function runMain({ name, version, run, redact }, argv = process4.argv.slice(2)) {
+async function runCli(cli, argv = process4.argv.slice(2)) {
   if (argv[0] === COMPLETE)
-    return printCandidates(leafCandidates(run, argv.slice(1)));
-  if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
-    console.log(version);
-    return 0;
-  }
-  try {
-    return await run(argv);
-  } catch (error) {
-    return reportThrown(name, error, redact);
-  }
-}
-// package.json
-var version = "0.2.1";
+    return printCandidates(candidates(cli.commands, cli.aliases, cli.defaultCommand, argv.slice(1)));
+  return dispatch({ path: [cli.name], header: (colors) => `${colors.bold(cli.name)} ${colors.dim(cli.version)}  ${cli.about}`, summary: cli.about, commands: cli.commands, aliases: cli.aliases, defaultCommand: cli.defaultCommand, examples: cli.examples, replaces: cli.replaces }, argv, { version: cli.version, redact: cli.redact });
+}
+var LEVEL_OPTIONS, TOP_OPTIONS, COMPLETE = "__complete", FILES = "__files__";
+var init_cli = __esm(() => {
+  init_args();
+  init_style();
+  init_text();
+  LEVEL_OPTIONS = {
+    ...OUTPUT_OPTIONS,
+    help: { type: "boolean", short: "h", description: "show this help" }
+  };
+  TOP_OPTIONS = { ...LEVEL_OPTIONS, version: { type: "boolean", short: "v", description: "print the version" } };
+});
 
-// src/popular.json
-var popular_default = [
-  "semver",
-  "minimatch",
-  "debug",
-  "ansi-styles",
-  "brace-expansion",
-  "strip-ansi",
-  "ansi-regex",
-  "ms",
-  "supports-color",
-  "chalk",
-  "commander",
-  "lru-cache",
-  "string-width",
-  "wrap-ansi",
-  "tslib",
-  "picomatch",
-  "emoji-regex",
-  "glob",
-  "type-fest",
-  "color-name",
-  "eslint-visitor-keys",
-  "color-convert",
-  "ajv",
-  "minipass",
-  "source-map",
-  "balanced-match",
-  "readable-stream",
-  "which",
-  "glob-parent",
-  "escape-string-regexp",
-  "has-flag",
-  "find-up",
-  "locate-path",
-  "json-schema-traverse",
-  "p-limit",
-  "yallist",
-  "safe-buffer",
-  "uuid",
-  "p-locate",
-  "undici-types",
-  "ignore",
-  "iconv-lite",
-  "signal-exit",
-  "esbuild",
-  "is-fullwidth-code-point",
-  "js-yaml",
-  "entities",
-  "globals",
-  "postcss",
-  "isexe",
-  "isarray",
-  "path-key",
-  "string_decoder",
-  "argparse",
-  "ws",
-  "mime-db",
-  "resolve",
-  "agent-base",
-  "@esbuild/linux-x64",
-  "yargs-parser",
-  "mime-types",
-  "acorn",
-  "estraverse",
-  "cross-spawn",
-  "react-is",
-  "picocolors",
-  "fs-extra",
-  "hasown",
-  "nanoid",
-  "yargs",
-  "resolve-from",
-  "shebang-command",
-  "pretty-format",
-  "json5",
-  "https-proxy-agent",
-  "path-to-regexp",
-  "path-exists",
-  "punycode",
-  "js-tokens",
-  "cliui",
-  "shebang-regex",
-  "@babel/types",
-  "chokidar",
-  "strip-json-comments",
-  "inherits",
-  "webidl-conversions",
-  "get-stream",
-  "eslint-scope",
-  "cookie",
-  "@babel/parser",
-  "qs",
-  "is-number",
-  "whatwg-url",
-  "@types/estree",
-  "tr46",
-  "convert-source-map",
-  "is-glob",
-  "braces",
-  "fast-deep-equal",
-  "form-data",
-  "lodash",
-  "@babel/helper-validator-identifier",
-  "electron-to-chromium",
-  "fill-range",
-  "function-bind",
-  "readdirp",
-  "escalade",
-  "graceful-fs",
-  "negotiator",
-  "is-stream",
-  "camelcase",
-  "@babel/runtime",
-  "yocto-queue",
-  "to-regex-range",
-  "node-fetch",
-  "micromatch",
-  "node-releases",
-  "get-intrinsic",
-  "universalify",
-  "path-scurry",
-  "jsesc",
-  "browserslist",
-  "es-errors",
-  "statuses",
-  "@radix-ui/react-primitive",
-  "magic-string",
-  "rimraf",
-  "is-extglob",
-  "@jridgewell/trace-mapping",
-  "@jridgewell/resolve-uri",
-  "http-errors",
-  "onetime",
-  "has-symbols",
-  "es-define-property",
-  "gopd",
-  "util-deprecate",
-  "object-assign",
-  "jiti",
-  "yaml",
-  "dotenv",
-  "@babel/generator",
-  "@babel/template",
-  "imurmurhash",
-  "postcss-selector-parser",
-  "fast-glob",
-  "update-browserslist-db",
-  "@types/node",
-  "@babel/compat-data",
-  "eventemitter3",
-  "callsites",
-  "http-proxy-agent",
-  "detect-libc",
-  "espree",
-  "execa",
-  "@babel/core",
-  "@babel/helpers",
-  "concat-map",
-  "source-map-js",
-  "tinyglobby",
-  "call-bind-apply-helpers",
-  "flat-cache",
-  "fdir",
-  "pify",
-  "@jest/types",
-  "normalize-path",
-  "is-core-module",
-  "eslint",
-  "minimist",
-  "estree-walker",
-  "file-entry-cache",
-  "object-inspect",
-  "buffer",
-  "uri-js",
-  "import-fresh",
-  "@babel/helper-module-transforms",
-  "optionator",
-  "flatted",
-  "math-intrinsics",
-  "safer-buffer",
-  "y18n",
-  "@babel/helper-module-imports",
-  "mkdirp",
-  "dunder-proto",
-  "path-parse",
-  "fastq",
-  "levn",
-  "@babel/helper-compilation-targets",
-  "@babel/helper-string-parser",
-  "keyv",
-  "get-proto",
-  "csstype",
-  "npm-run-path",
-  "fast-json-stable-stringify",
-  "reusify",
-  "@babel/helper-plugin-utils",
-  "kind-of",
-  "mime",
-  "caniuse-lite",
-  "lines-and-columns",
-  "fast-levenshtein",
-  "supports-preserve-symlinks-flag",
-  "make-dir",
-  "slash",
-  "prelude-ls",
-  "typescript",
-  "strip-bom",
-  "parent-module",
-  "esutils",
-  "ci-info",
-  "@smithy/util-utf8",
-  "type-check",
-  "mimic-fn",
-  "@babel/helper-validator-option",
-  "@types/json-schema",
-  "@rolldown/pluginutils",
-  "side-channel-list",
-  "json-buffer",
-  "raw-body",
-  "has-tostringtag",
-  "wrappy",
-  "diff",
-  "jackspeak",
-  "baseline-browser-mapping",
-  "deep-is",
-  "foreground-child",
-  "@eslint/js",
-  "anymatch",
-  "natural-compare",
-  "esquery",
-  "@eslint-community/regexpp",
-  "es-set-tostringtag",
-  "acorn-jsx",
-  "parse5",
-  "finalhandler",
-  "parse-json",
-  "depd",
-  "axios",
-  "run-parallel",
-  "source-map-support",
-  "esrecurse",
-  "call-bound",
-  "content-disposition",
-  "human-signals",
-  "ts-api-utils",
-  "ansi-escapes",
-  "jest-util",
-  "send",
-  "@opentelemetry/core",
-  "type-is",
-  "encodeurl",
-  "once",
-  "cosmiconfig",
-  "lodash.merge",
-  "json-stable-stringify-without-jsonify",
-  "open",
-  "prettier",
-  "@eslint/eslintrc",
-  "is-arrayish",
-  "@jridgewell/sourcemap-codec",
-  "gensync",
-  "word-wrap",
-  "express",
-  "arg",
-  "jsonfile",
-  "schema-utils",
-  "@smithy/is-array-buffer",
-  "@typescript-eslint/types",
-  "chownr",
-  "delayed-stream",
-  "@smithy/util-buffer-from",
-  "asynckit",
-  "tapable",
-  "enhanced-resolve",
-  "aria-query",
-  "indent-string",
-  "bytes",
-  "binary-extensions",
-  "ini",
-  "@radix-ui/react-context",
-  "doctrine",
-  "queue-microtask",
-  "accepts",
-  "merge2",
-  "get-caller-file",
-  "@humanwhocodes/retry",
-  "@jridgewell/gen-mapping",
-  "@typescript-eslint/typescript-estree",
-  "jest-worker",
-  "proxy-from-env",
-  "clsx",
-  "side-channel-map",
-  "@typescript-eslint/visitor-keys",
-  "fresh",
-  "restore-cursor",
-  "on-finished",
-  "is-plain-obj",
-  "ipaddr.js",
-  "pathe",
-  "@jest/schemas",
-  "base64-js",
-  "@smithy/types",
-  "require-directory",
-  "tough-cookie",
-  "is-binary-path",
-  "body-parser",
-  "postcss-value-parser",
-  "media-typer",
-  "setprototypeof",
-  "side-channel-weakmap",
-  "@typescript-eslint/tsconfig-utils",
-  "@isaacs/cliui",
-  "@rollup/rollup-linux-x64-gnu",
-  "is-wsl",
-  "retry",
-  "@aws-sdk/types",
-  "@types/react-dom",
-  "combined-stream",
-  "es-object-atoms",
-  "@eslint/core",
-  "whatwg-mimetype",
-  "domutils",
-  "@rollup/rollup-linux-x64-musl",
-  "core-util-is",
-  "@typescript-eslint/scope-manager",
-  "esprima",
-  "loose-envify",
-  "cookie-signature",
-  "follow-redirects",
-  "cli-cursor",
-  "strip-final-newline",
-  "@typescript-eslint/project-service",
-  "eastasianwidth",
-  "json-parse-even-better-errors",
-  "sprintf-js",
-  "path-type",
-  "content-type",
-  "es-module-lexer",
-  "@nodelib/fs.scandir",
-  "write-file-atomic",
-  "@eslint/plugin-kit",
-  "ieee754",
-  "prop-types",
-  "require-from-string",
-  "dom-serializer",
-  "call-bind",
-  "@eslint/config-array",
-  "has-property-descriptors",
-  "@nodelib/fs.stat",
-  "merge-descriptors",
-  "slice-ansi",
-  "rxjs",
-  "p-map",
-  "toidentifier",
-  "globby",
-  "domhandler",
-  "async",
-  "@babel/helper-globals",
-  "pirates",
-  "@opentelemetry/semantic-conventions",
-  "@typescript-eslint/utils",
-  "date-fns",
-  "is-docker",
-  "tar",
-  "which-typed-array",
-  "ajv-formats",
-  "@opentelemetry/api-logs",
-  "@opentelemetry/resources",
-  "side-channel",
-  "cjs-module-lexer",
-  "range-parser",
-  "@humanfs/node",
-  "define-data-property",
-  "node-addon-api",
-  "pako",
-  "lilconfig",
-  "fast-uri",
-  "ip-address",
-  "fs.realpath",
-  "@img/sharp-libvips-linuxmusl-x64",
-  "cssesc",
-  "@opentelemetry/instrumentation",
-  "domelementtype",
-  "hosted-git-info",
-  "@eslint/object-schema",
-  "etag",
-  "@eslint/config-helpers",
-  "package-json-from-dist",
-  "@humanfs/core",
-  "htmlparser2",
-  "jest-message-util",
-  "for-each",
-  "pkg-dir",
-  "unpipe",
-  "buffer-from",
-  "es-abstract",
-  "is-unicode-supported",
-  "@types/yargs",
-  "is-callable",
-  "fast-xml-parser",
-  "istanbul-lib-instrument",
-  "escape-html",
-  "is-regex",
-  "dom-accessibility-api",
-  "css-tree",
-  "error-ex",
-  "ee-first",
-  "@types/unist",
-  "log-symbols",
-  "path-is-absolute",
-  "end-of-stream",
-  "@vitest/utils",
-  "object.assign",
-  "object-keys",
-  "tinyexec",
-  "scheduler",
-  "p-try",
-  "process-nextick-args",
-  "vary",
-  "@babel/traverse",
-  "@pkgjs/parseargs",
-  "@types/babel__generator",
-  "kleur",
-  "zod",
-  "merge-stream",
-  "available-typed-arrays",
-  "mute-stream",
-  "is-typed-array",
-  "safe-regex-test",
-  "tsconfig-paths",
-  "minizlib",
-  "tar-stream",
-  "@floating-ui/core",
-  "jose",
-  "deepmerge",
-  "get-tsconfig",
-  "set-function-length",
-  "@vitest/spy",
-  "css-select",
-  "@types/babel__core",
-  "forwarded",
-  "react",
-  "@typescript-eslint/parser",
-  "ajv-keywords",
-  "define-properties",
-  "is-generator-function",
-  "regexp.prototype.flags",
-  "acorn-walk",
-  "pump",
-  "data-uri-to-buffer",
-  "object-hash",
-  "jsdom",
-  "nopt",
-  "@babel/plugin-syntax-jsx",
-  "@floating-ui/dom",
-  "tiny-invariant",
-  "strip-indent",
-  "d3-array",
-  "chai",
-  "@babel/code-frame",
-  "@typescript-eslint/eslint-plugin",
-  "proxy-addr",
-  "parseurl",
-  "@floating-ui/utils",
-  "ora",
-  "html-encoding-sniffer",
-  "pnpm",
-  "whatwg-encoding",
-  "events",
-  "@typescript-eslint/type-utils",
-  "env-paths",
-  "internal-slot",
-  "string.prototype.trimend",
-  "extend",
-  "resolve-pkg-maps",
-  "istanbul-lib-coverage",
-  "react-dom",
-  "is-number-object",
-  "@radix-ui/primitive",
-  "is-plain-object",
-  "string.prototype.trimstart",
-  "@babel/plugin-syntax-typescript",
-  "jest-diff",
-  "define-lazy-prop",
-  "globalthis",
-  "which-boxed-primitive",
-  "@vitest/expect",
-  "sax",
-  "@floating-ui/react-dom",
-  "@vitest/pretty-format",
-  "internmap",
-  "@radix-ui/react-compose-refs",
-  "is-symbol",
-  "@eslint-community/eslint-utils",
-  "bl",
-  "serve-static",
-  "get-symbol-description",
-  "is-shared-array-buffer",
-  "functions-have-names",
-  "array-buffer-byte-length",
-  "socks-proxy-agent"
-];
+// ../kit/src/config.ts
+var init_config = __esm(() => {
+  init_args();
+});
 
-// src/nearmiss.ts
-var SEPARATORS = /[-_.]/g;
-var MIN_LENGTH = 5;
-function baseName(name) {
-  return name.slice(name.indexOf("/") + 1);
-}
-function scopeOf(name) {
-  return name.startsWith("@") ? name.slice(0, name.indexOf("/")) : "";
+// ../kit/src/limit.ts
+function limitOptions(fallback) {
+  return {
+    limit: { type: "string", description: `show at most this many rows, the rest counted (${fallback})` },
+    full: { type: "boolean", description: "show every row" }
+  };
 }
-function squash(name) {
-  return name.toLowerCase().replace(SEPARATORS, "");
+function limitOf(values, fallback) {
+  if (values.full === true && values.limit !== undefined)
+    badUsage("--limit and --full exclude each other");
+  if (values.full === true || values.json === true && values.limit === undefined)
+    return Number.POSITIVE_INFINITY;
+  return wholeNumber(values.limit, "limit", fallback);
 }
-function resemblance(name, popular) {
-  if (scopeOf(name) !== scopeOf(popular) && baseName(name) === baseName(popular) && baseName(name).length >= MIN_LENGTH)
-    return `${popular} under another scope`;
-  if (squash(name) === squash(popular))
-    return `${popular} spelled with other separators or case`;
-  const edits = distance(name, popular);
-  const allowed = Math.min(name.length, popular.length) >= MIN_LENGTH * 2 ? 2 : 1;
-  return Math.min(name.length, popular.length) >= MIN_LENGTH && edits <= allowed ? `${popular}, ${edits} ${edits === 1 ? "edit" : "edits"} away` : undefined;
+function moreFooter(more) {
+  return `${more} more, rerun with --full`;
 }
-function nearMisses(name, popular = popular_default) {
-  if (popular.includes(name))
-    return [];
-  const found = [];
-  for (const other of popular) {
-    const text = resemblance(name, other);
-    if (text !== undefined)
-      found.push({ text, edits: distance(name, other) });
-  }
-  return found.sort((a, b) => a.edits - b.edits).slice(0, 3).map((match) => match.text);
+function capped(rows, limit) {
+  const more = rows.length - limit;
+  return more > 0 ? { shown: rows.slice(0, limit), footer: moreFooter(more) } : { shown: [...rows], footer: undefined };
 }
+var init_limit = __esm(() => {
+  init_args();
+});
 
-// src/analyze.ts
-var DEFAULT_MIN_AGE_DAYS = 14;
-var DAY = 86400000;
-var INSTALL_SCRIPTS = ["preinstall", "install", "postinstall"];
-var GIT_PREFIX = /^git\+/;
-var VERSION_SEPARATOR = /(?<=.)@/;
-function parseSpec(text) {
-  const at = text.search(VERSION_SEPARATOR);
-  return at === -1 ? { name: text } : { name: text.slice(0, at), request: text.slice(at + 1) };
-}
-function isStable(version) {
-  return !version.includes("-");
-}
-function resolve(packument, request) {
-  const tags = packument["dist-tags"] ?? {};
-  const versions = Object.keys(packument.versions ?? {});
-  const wanted = request === undefined || request === "" ? "latest" : request;
-  if (tags[wanted] !== undefined)
-    return tags[wanted];
-  if (versions.includes(wanted))
-    return wanted;
-  return versions.filter((version) => Bun.semver.satisfies(version, wanted)).sort(Bun.semver.order).at(-1);
-}
-function licenseOf(license) {
-  return typeof license === "string" ? license : license?.type;
-}
-function repositoryOf(packument) {
-  const repository = typeof packument.repository === "string" ? packument.repository : packument.repository?.url;
-  return repository?.replace(GIT_PREFIX, "") ?? packument.homepage;
-}
-function ageDays(published, now) {
-  const at = Date.parse(published ?? "");
-  return Number.isNaN(at) ? undefined : (now - at) / DAY;
-}
-function installScriptsOf(version) {
-  return Object.fromEntries(INSTALL_SCRIPTS.flatMap((name) => version?.scripts?.[name] === undefined ? [] : [[name, version.scripts[name]]]));
-}
-function safeRelease(packument, now, minAgeDays) {
-  const old = Object.keys(packument.versions ?? {}).filter((version) => isStable(version) && (ageDays(packument.time?.[version], now) ?? 0) >= minAgeDays && packument.time?.[version] !== undefined);
-  const version = old.sort(Bun.semver.order).at(-1);
-  return version === undefined ? undefined : { version, published: packument.time?.[version] };
-}
-function analyze(input) {
-  const { spec, packument, registry, now = Date.now(), minAgeDays = DEFAULT_MIN_AGE_DAYS } = input;
-  const report = { name: spec.name, registry, exists: packument !== undefined, requested: spec.request, installScripts: {}, nearMisses: nearMisses(spec.name), warnings: [], blocked: false, downloads: input.downloads };
-  if (report.nearMisses.length > 0)
-    report.warnings.push(`name looks like ${report.nearMisses.join("; ")}, check it is the package meant`);
-  if (packument === undefined) {
-    report.blocked = true;
-    report.warnings.unshift(`${spec.name} is not on ${registry}, the name may be guessed`);
-    return report;
-  }
-  const latest = packument["dist-tags"]?.latest;
-  const version = resolve(packument, spec.request);
-  const entry = version === undefined ? undefined : packument.versions?.[version];
-  report.description = packument.description;
-  report.license = licenseOf(entry?.license) ?? licenseOf(packument.license);
-  report.repository = repositoryOf(packument);
-  report.latest = latest === undefined ? undefined : { version: latest, published: packument.time?.[latest] };
-  report.safe = safeRelease(packument, now, minAgeDays);
-  report.version = version;
-  report.published = version === undefined ? undefined : packument.time?.[version];
-  report.installScripts = installScriptsOf(entry);
-  report.deprecated = entry?.deprecated;
-  if (version === undefined) {
-    report.blocked = true;
-    report.warnings.push(`no version of ${spec.name} matches ${spec.request}`);
-    return report;
-  }
-  const age = ageDays(report.published, now);
-  if (age === undefined) {
-    report.warnings.push(`${registry} gives no publish date for ${version}, its age cannot be checked`);
-  } else if (age < minAgeDays) {
-    report.blocked = true;
-    report.warnings.push(`${version} was published ${age < 1 ? "less than a day" : `${Math.floor(age)} day${Math.floor(age) === 1 ? "" : "s"}`} ago, under ${minAgeDays} days${report.safe === undefined ? ", and no older stable version exists" : `, use ${spec.name}@${report.safe.version}`}`);
+// ../kit/src/process.ts
+import { constants } from "os";
+import process5 from "process";
+async function collect(stream, name, chunks) {
+  for await (const data of stream)
+    chunks.push({ stream: name, data });
+}
+function exitCodeOf(code, signal) {
+  if (code !== null)
+    return code;
+  if (typeof signal === "number")
+    return 128 + signal;
+  return signal === null ? 129 : 128 + constants.signals[signal];
+}
+function holdSignals(cleanup) {
+  let received;
+  let child;
+  const held = {
+    get signal() {
+      return received;
+    },
+    forward: (to) => {
+      child = to;
+    },
+    release: () => {
+      for (const signal of SIGNALS)
+        process5.off(signal, onSignal);
+    }
+  };
+  function onSignal(signal) {
+    received = signal;
+    if (child !== undefined) {
+      child.kill(signal);
+      return;
+    }
+    if (cleanup === undefined)
+      return;
+    held.release();
+    cleanup(signal);
+    process5.kill(process5.pid, signal);
   }
-  const scripts = Object.keys(report.installScripts);
-  if (scripts.length > 0)
-    report.warnings.push(`${version} runs ${scripts.join(", ")} at install`);
-  if (report.deprecated !== undefined)
-    report.warnings.push(`${version} is deprecated: ${report.deprecated}`);
-  return report;
-}
+  for (const signal of SIGNALS)
+    process5.on(signal, onSignal);
+  return held;
+}
+async function runCommand(argv, { cwd, env, stdin = "ignore" } = {}) {
+  const chunks = [];
+  const proc = Bun.spawn(argv, { ...cwd === undefined ? {} : { cwd }, ...env === undefined ? {} : { env }, stdin, stdout: "pipe", stderr: "pipe" });
+  await Promise.all([collect(proc.stdout, "stdout", chunks), collect(proc.stderr, "stderr", chunks)]);
+  await proc.exited;
+  const output = Buffer.concat(chunks.map(({ data }) => data));
+  return { code: exitCodeOf(proc.exitCode, proc.signalCode), chunks, output, text: output.toString() };
+}
+var SIGNALS;
+var init_process = __esm(() => {
+  SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+});
 
-// src/config.ts
-import { homedir } from "os";
-import { dirname, join } from "path";
-import process6 from "process";
+// ../kit/src/index.ts
+var init_src = __esm(() => {
+  init_args();
+  init_chart();
+  init_cli();
+  init_config();
+  init_format();
+  init_limit();
+  init_process();
+  init_style();
+  init_text();
+});
 
 // src/registry.ts
-var PUBLIC_REGISTRY = "https://registry.npmjs.org";
-var DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week";
-var TRAILING_SLASHES = /\/+$/;
 function isPublic(registry) {
   return registry.url.replace(TRAILING_SLASHES, "") === PUBLIC_REGISTRY;
 }
@@ -1192,14 +925,16 @@ async function fetchDownloads(name, fetcher = fetch) {
   const body = await response.json();
   return body.downloads;
 }
+var PUBLIC_REGISTRY = "https://registry.npmjs.org", DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week", TRAILING_SLASHES;
+var init_registry = __esm(() => {
+  init_src();
+  TRAILING_SLASHES = /\/+$/;
+});
 
 // src/config.ts
-var ENV_REFERENCE = /\$\{(\w+)\}|\$(\w+)/g;
-var COMMENT = /^\s*[#;]/;
-var SCOPE_REGISTRY = /^(@[^:]+):registry$/;
-var AUTH_TOKEN = /^(\/\/.+?):_authToken$/;
-var PROTOCOL = /^\w+:/;
-var QUOTES = /^(["'])(.*)\1$/;
+import { homedir } from "os";
+import { dirname, join } from "path";
+import process7 from "process";
 function expand(value, env) {
   let missing = false;
   const expanded = value.replace(ENV_REFERENCE, (_, braced, bare) => {
@@ -1275,7 +1010,7 @@ async function readIfThere(path) {
   const file = Bun.file(path);
   return await file.exists() ? file.text() : undefined;
 }
-async function loadConfigs(cwd = process6.cwd(), env = process6.env, home = homedir()) {
+async function loadConfigs(cwd = process7.cwd(), env = process7.env, home = homedir()) {
   const directories = [];
   for (let dir = cwd;!directories.includes(dir); dir = dirname(dir))
     directories.push(dir);
@@ -1292,22 +1027,775 @@ async function loadConfigs(cwd = process6.cwd(), env = process6.env, home = home
   }
   return configs;
 }
+function isSeverity(value) {
+  return SEVERITIES.includes(value);
+}
+function parseSettings(text) {
+  const raw = Bun.JSONC.parse(text);
+  const settings = {};
+  if (Array.isArray(raw?.licenses) && raw.licenses.every((each) => typeof each === "string"))
+    settings.licenses = raw.licenses;
+  if (isSeverity(raw?.blockSeverity))
+    settings.blockSeverity = raw.blockSeverity;
+  return settings;
+}
+async function loadSettings(cwd = process7.cwd(), home = homedir()) {
+  const files = [];
+  for (let dir = cwd;!files.includes(join(dir, SETTINGS_FILE)); dir = dirname(dir))
+    files.push(join(dir, SETTINGS_FILE));
+  files.push(join(home, ".config", "pkg", "config.json"));
+  const settings = {};
+  for (const file of files) {
+    const text = await readIfThere(file);
+    if (text === undefined)
+      continue;
+    const found = parseSettings(text);
+    settings.licenses ??= found.licenses;
+    settings.blockSeverity ??= found.blockSeverity;
+  }
+  return settings;
+}
+var ENV_REFERENCE, COMMENT, SCOPE_REGISTRY, AUTH_TOKEN, PROTOCOL, QUOTES, SEVERITIES, SETTINGS_FILE = ".pkgrc.json";
+var init_config2 = __esm(() => {
+  init_registry();
+  ENV_REFERENCE = /\$\{(\w+)\}|\$(\w+)/g;
+  COMMENT = /^\s*[#;]/;
+  SCOPE_REGISTRY = /^(@[^:]+):registry$/;
+  AUTH_TOKEN = /^(\/\/.+?):_authToken$/;
+  PROTOCOL = /^\w+:/;
+  QUOTES = /^(["'])(.*)\1$/;
+  SEVERITIES = ["low", "moderate", "high", "critical"];
+});
 
-// src/commands/check.ts
-var usage = `pkg <name>[@version]...
+// src/advisories.ts
+function severityRank(severity) {
+  return SEVERITIES.indexOf(severity);
+}
+function fixedVersion(vulnerable, version) {
+  const range = vulnerable.split("||").map((each) => each.trim()).find((each) => Bun.semver.satisfies(version, each));
+  return range === undefined ? undefined : UPPER_BOUND.exec(range)?.[1];
+}
+async function fetchAdvisories(versions, registry, fetcher = fetch) {
+  const url = `${registry.url.replace(TRAILING_SLASHES2, "")}${BULK_PATH}`;
+  let response;
+  try {
+    response = await fetcher(url, {
+      method: "POST",
+      headers: { accept: "application/json", "content-type": "application/json", ...registry.token === undefined ? {} : { authorization: `Bearer ${registry.token}` } },
+      body: JSON.stringify(versions)
+    });
+  } catch {
+    return {};
+  }
+  if (!response.ok)
+    return {};
+  const body = await response.json();
+  const found = {};
+  for (const [name, raws] of Object.entries(body)) {
+    found[name] = raws.filter((raw) => SEVERITIES.includes(raw.severity)).map((raw) => ({
+      id: raw.id,
+      ghsa: GHSA.exec(raw.url)?.[0],
+      url: raw.url,
+      title: raw.title,
+      severity: raw.severity,
+      vulnerable: raw.vulnerable_versions
+    }));
+  }
+  return found;
+}
+function advisoriesFor(advisories, version) {
+  return (advisories ?? []).filter((each) => Bun.semver.satisfies(version, each.vulnerable)).map((each) => ({ ...each, fixed: fixedVersion(each.vulnerable, version) }));
+}
+function filterAdvisories(advisories, level, ignore = []) {
+  return advisories.filter((each) => severityRank(each.severity) >= severityRank(level) && !ignore.includes(each.ghsa ?? "") && !ignore.includes(String(each.id)));
+}
+var BULK_PATH = "/-/npm/v1/security/advisories/bulk", TRAILING_SLASHES2, GHSA, UPPER_BOUND;
+var init_advisories = __esm(() => {
+  init_config2();
+  TRAILING_SLASHES2 = /\/+$/;
+  GHSA = /GHSA-[\w-]+$/;
+  UPPER_BOUND = /(?:^|\s)<([\w.+-]+)/;
+});
 
-Checks npm packages before they are added: whether the name exists, the latest and the newest version at least two weeks old, weekly downloads, licence, repository, install scripts and a near miss of a popular name.
-Exits 1 when a package is missing or the version asked for is under the minimum age.`;
-var options = {
-  json: jsonOption(),
-  "min-age": { type: "string", description: `days a version must be old (${DEFAULT_MIN_AGE_DAYS})` }
-};
+// src/licenses.ts
+function isLicenseAllowed(expression, allowed) {
+  const known = new Set(allowed.map((each) => each.toLowerCase()));
+  return expression.replace(PARENS, " ").trim().split(OR_SPLIT).some((alternative) => alternative.split(AND_SPLIT).every((term) => known.has(term.replace(WITH_EXCEPTION, "").trim().toLowerCase())));
+}
+var OR_SPLIT, AND_SPLIT, WITH_EXCEPTION, PARENS;
+var init_licenses = __esm(() => {
+  OR_SPLIT = /\s+OR\s+/i;
+  AND_SPLIT = /\s+AND\s+/i;
+  WITH_EXCEPTION = /\s+WITH\s+\S+$/i;
+  PARENS = /[()]/g;
+});
+
+// src/popular.json
+var popular_default;
+var init_popular = __esm(() => {
+  popular_default = [
+    "semver",
+    "minimatch",
+    "debug",
+    "ansi-styles",
+    "brace-expansion",
+    "strip-ansi",
+    "ansi-regex",
+    "ms",
+    "supports-color",
+    "chalk",
+    "commander",
+    "lru-cache",
+    "string-width",
+    "wrap-ansi",
+    "tslib",
+    "picomatch",
+    "emoji-regex",
+    "glob",
+    "type-fest",
+    "color-name",
+    "eslint-visitor-keys",
+    "color-convert",
+    "ajv",
+    "minipass",
+    "source-map",
+    "balanced-match",
+    "readable-stream",
+    "which",
+    "glob-parent",
+    "escape-string-regexp",
+    "has-flag",
+    "find-up",
+    "locate-path",
+    "json-schema-traverse",
+    "p-limit",
+    "yallist",
+    "safe-buffer",
+    "uuid",
+    "p-locate",
+    "undici-types",
+    "ignore",
+    "iconv-lite",
+    "signal-exit",
+    "esbuild",
+    "is-fullwidth-code-point",
+    "js-yaml",
+    "entities",
+    "globals",
+    "postcss",
+    "isexe",
+    "isarray",
+    "path-key",
+    "string_decoder",
+    "argparse",
+    "ws",
+    "mime-db",
+    "resolve",
+    "agent-base",
+    "@esbuild/linux-x64",
+    "yargs-parser",
+    "mime-types",
+    "acorn",
+    "estraverse",
+    "cross-spawn",
+    "react-is",
+    "picocolors",
+    "fs-extra",
+    "hasown",
+    "nanoid",
+    "yargs",
+    "resolve-from",
+    "shebang-command",
+    "pretty-format",
+    "json5",
+    "https-proxy-agent",
+    "path-to-regexp",
+    "path-exists",
+    "punycode",
+    "js-tokens",
+    "cliui",
+    "shebang-regex",
+    "@babel/types",
+    "chokidar",
+    "strip-json-comments",
+    "inherits",
+    "webidl-conversions",
+    "get-stream",
+    "eslint-scope",
+    "cookie",
+    "@babel/parser",
+    "qs",
+    "is-number",
+    "whatwg-url",
+    "@types/estree",
+    "tr46",
+    "convert-source-map",
+    "is-glob",
+    "braces",
+    "fast-deep-equal",
+    "form-data",
+    "lodash",
+    "@babel/helper-validator-identifier",
+    "electron-to-chromium",
+    "fill-range",
+    "function-bind",
+    "readdirp",
+    "escalade",
+    "graceful-fs",
+    "negotiator",
+    "is-stream",
+    "camelcase",
+    "@babel/runtime",
+    "yocto-queue",
+    "to-regex-range",
+    "node-fetch",
+    "micromatch",
+    "node-releases",
+    "get-intrinsic",
+    "universalify",
+    "path-scurry",
+    "jsesc",
+    "browserslist",
+    "es-errors",
+    "statuses",
+    "@radix-ui/react-primitive",
+    "magic-string",
+    "rimraf",
+    "is-extglob",
+    "@jridgewell/trace-mapping",
+    "@jridgewell/resolve-uri",
+    "http-errors",
+    "onetime",
+    "has-symbols",
+    "es-define-property",
+    "gopd",
+    "util-deprecate",
+    "object-assign",
+    "jiti",
+    "yaml",
+    "dotenv",
+    "@babel/generator",
+    "@babel/template",
+    "imurmurhash",
+    "postcss-selector-parser",
+    "fast-glob",
+    "update-browserslist-db",
+    "@types/node",
+    "@babel/compat-data",
+    "eventemitter3",
+    "callsites",
+    "http-proxy-agent",
+    "detect-libc",
+    "espree",
+    "execa",
+    "@babel/core",
+    "@babel/helpers",
+    "concat-map",
+    "source-map-js",
+    "tinyglobby",
+    "call-bind-apply-helpers",
+    "flat-cache",
+    "fdir",
+    "pify",
+    "@jest/types",
+    "normalize-path",
+    "is-core-module",
+    "eslint",
+    "minimist",
+    "estree-walker",
+    "file-entry-cache",
+    "object-inspect",
+    "buffer",
+    "uri-js",
+    "import-fresh",
+    "@babel/helper-module-transforms",
+    "optionator",
+    "flatted",
+    "math-intrinsics",
+    "safer-buffer",
+    "y18n",
+    "@babel/helper-module-imports",
+    "mkdirp",
+    "dunder-proto",
+    "path-parse",
+    "fastq",
+    "levn",
+    "@babel/helper-compilation-targets",
+    "@babel/helper-string-parser",
+    "keyv",
+    "get-proto",
+    "csstype",
+    "npm-run-path",
+    "fast-json-stable-stringify",
+    "reusify",
+    "@babel/helper-plugin-utils",
+    "kind-of",
+    "mime",
+    "caniuse-lite",
+    "lines-and-columns",
+    "fast-levenshtein",
+    "supports-preserve-symlinks-flag",
+    "make-dir",
+    "slash",
+    "prelude-ls",
+    "typescript",
+    "strip-bom",
+    "parent-module",
+    "esutils",
+    "ci-info",
+    "@smithy/util-utf8",
+    "type-check",
+    "mimic-fn",
+    "@babel/helper-validator-option",
+    "@types/json-schema",
+    "@rolldown/pluginutils",
+    "side-channel-list",
+    "json-buffer",
+    "raw-body",
+    "has-tostringtag",
+    "wrappy",
+    "diff",
+    "jackspeak",
+    "baseline-browser-mapping",
+    "deep-is",
+    "foreground-child",
+    "@eslint/js",
+    "anymatch",
+    "natural-compare",
+    "esquery",
+    "@eslint-community/regexpp",
+    "es-set-tostringtag",
+    "acorn-jsx",
+    "parse5",
+    "finalhandler",
+    "parse-json",
+    "depd",
+    "axios",
+    "run-parallel",
+    "source-map-support",
+    "esrecurse",
+    "call-bound",
+    "content-disposition",
+    "human-signals",
+    "ts-api-utils",
+    "ansi-escapes",
+    "jest-util",
+    "send",
+    "@opentelemetry/core",
+    "type-is",
+    "encodeurl",
+    "once",
+    "cosmiconfig",
+    "lodash.merge",
+    "json-stable-stringify-without-jsonify",
+    "open",
+    "prettier",
+    "@eslint/eslintrc",
+    "is-arrayish",
+    "@jridgewell/sourcemap-codec",
+    "gensync",
+    "word-wrap",
+    "express",
+    "arg",
+    "jsonfile",
+    "schema-utils",
+    "@smithy/is-array-buffer",
+    "@typescript-eslint/types",
+    "chownr",
+    "delayed-stream",
+    "@smithy/util-buffer-from",
+    "asynckit",
+    "tapable",
+    "enhanced-resolve",
+    "aria-query",
+    "indent-string",
+    "bytes",
+    "binary-extensions",
+    "ini",
+    "@radix-ui/react-context",
+    "doctrine",
+    "queue-microtask",
+    "accepts",
+    "merge2",
+    "get-caller-file",
+    "@humanwhocodes/retry",
+    "@jridgewell/gen-mapping",
+    "@typescript-eslint/typescript-estree",
+    "jest-worker",
+    "proxy-from-env",
+    "clsx",
+    "side-channel-map",
+    "@typescript-eslint/visitor-keys",
+    "fresh",
+    "restore-cursor",
+    "on-finished",
+    "is-plain-obj",
+    "ipaddr.js",
+    "pathe",
+    "@jest/schemas",
+    "base64-js",
+    "@smithy/types",
+    "require-directory",
+    "tough-cookie",
+    "is-binary-path",
+    "body-parser",
+    "postcss-value-parser",
+    "media-typer",
+    "setprototypeof",
+    "side-channel-weakmap",
+    "@typescript-eslint/tsconfig-utils",
+    "@isaacs/cliui",
+    "@rollup/rollup-linux-x64-gnu",
+    "is-wsl",
+    "retry",
+    "@aws-sdk/types",
+    "@types/react-dom",
+    "combined-stream",
+    "es-object-atoms",
+    "@eslint/core",
+    "whatwg-mimetype",
+    "domutils",
+    "@rollup/rollup-linux-x64-musl",
+    "core-util-is",
+    "@typescript-eslint/scope-manager",
+    "esprima",
+    "loose-envify",
+    "cookie-signature",
+    "follow-redirects",
+    "cli-cursor",
+    "strip-final-newline",
+    "@typescript-eslint/project-service",
+    "eastasianwidth",
+    "json-parse-even-better-errors",
+    "sprintf-js",
+    "path-type",
+    "content-type",
+    "es-module-lexer",
+    "@nodelib/fs.scandir",
+    "write-file-atomic",
+    "@eslint/plugin-kit",
+    "ieee754",
+    "prop-types",
+    "require-from-string",
+    "dom-serializer",
+    "call-bind",
+    "@eslint/config-array",
+    "has-property-descriptors",
+    "@nodelib/fs.stat",
+    "merge-descriptors",
+    "slice-ansi",
+    "rxjs",
+    "p-map",
+    "toidentifier",
+    "globby",
+    "domhandler",
+    "async",
+    "@babel/helper-globals",
+    "pirates",
+    "@opentelemetry/semantic-conventions",
+    "@typescript-eslint/utils",
+    "date-fns",
+    "is-docker",
+    "tar",
+    "which-typed-array",
+    "ajv-formats",
+    "@opentelemetry/api-logs",
+    "@opentelemetry/resources",
+    "side-channel",
+    "cjs-module-lexer",
+    "range-parser",
+    "@humanfs/node",
+    "define-data-property",
+    "node-addon-api",
+    "pako",
+    "lilconfig",
+    "fast-uri",
+    "ip-address",
+    "fs.realpath",
+    "@img/sharp-libvips-linuxmusl-x64",
+    "cssesc",
+    "@opentelemetry/instrumentation",
+    "domelementtype",
+    "hosted-git-info",
+    "@eslint/object-schema",
+    "etag",
+    "@eslint/config-helpers",
+    "package-json-from-dist",
+    "@humanfs/core",
+    "htmlparser2",
+    "jest-message-util",
+    "for-each",
+    "pkg-dir",
+    "unpipe",
+    "buffer-from",
+    "es-abstract",
+    "is-unicode-supported",
+    "@types/yargs",
+    "is-callable",
+    "fast-xml-parser",
+    "istanbul-lib-instrument",
+    "escape-html",
+    "is-regex",
+    "dom-accessibility-api",
+    "css-tree",
+    "error-ex",
+    "ee-first",
+    "@types/unist",
+    "log-symbols",
+    "path-is-absolute",
+    "end-of-stream",
+    "@vitest/utils",
+    "object.assign",
+    "object-keys",
+    "tinyexec",
+    "scheduler",
+    "p-try",
+    "process-nextick-args",
+    "vary",
+    "@babel/traverse",
+    "@pkgjs/parseargs",
+    "@types/babel__generator",
+    "kleur",
+    "zod",
+    "merge-stream",
+    "available-typed-arrays",
+    "mute-stream",
+    "is-typed-array",
+    "safe-regex-test",
+    "tsconfig-paths",
+    "minizlib",
+    "tar-stream",
+    "@floating-ui/core",
+    "jose",
+    "deepmerge",
+    "get-tsconfig",
+    "set-function-length",
+    "@vitest/spy",
+    "css-select",
+    "@types/babel__core",
+    "forwarded",
+    "react",
+    "@typescript-eslint/parser",
+    "ajv-keywords",
+    "define-properties",
+    "is-generator-function",
+    "regexp.prototype.flags",
+    "acorn-walk",
+    "pump",
+    "data-uri-to-buffer",
+    "object-hash",
+    "jsdom",
+    "nopt",
+    "@babel/plugin-syntax-jsx",
+    "@floating-ui/dom",
+    "tiny-invariant",
+    "strip-indent",
+    "d3-array",
+    "chai",
+    "@babel/code-frame",
+    "@typescript-eslint/eslint-plugin",
+    "proxy-addr",
+    "parseurl",
+    "@floating-ui/utils",
+    "ora",
+    "html-encoding-sniffer",
+    "pnpm",
+    "whatwg-encoding",
+    "events",
+    "@typescript-eslint/type-utils",
+    "env-paths",
+    "internal-slot",
+    "string.prototype.trimend",
+    "extend",
+    "resolve-pkg-maps",
+    "istanbul-lib-coverage",
+    "react-dom",
+    "is-number-object",
+    "@radix-ui/primitive",
+    "is-plain-object",
+    "string.prototype.trimstart",
+    "@babel/plugin-syntax-typescript",
+    "jest-diff",
+    "define-lazy-prop",
+    "globalthis",
+    "which-boxed-primitive",
+    "@vitest/expect",
+    "sax",
+    "@floating-ui/react-dom",
+    "@vitest/pretty-format",
+    "internmap",
+    "@radix-ui/react-compose-refs",
+    "is-symbol",
+    "@eslint-community/eslint-utils",
+    "bl",
+    "serve-static",
+    "get-symbol-description",
+    "is-shared-array-buffer",
+    "functions-have-names",
+    "array-buffer-byte-length",
+    "socks-proxy-agent"
+  ];
+});
+
+// src/nearmiss.ts
+function baseName(name) {
+  return name.slice(name.indexOf("/") + 1);
+}
+function scopeOf(name) {
+  return name.startsWith("@") ? name.slice(0, name.indexOf("/")) : "";
+}
+function squash(name) {
+  return name.toLowerCase().replace(SEPARATORS, "");
+}
+function resemblance(name, popular) {
+  if (scopeOf(name) !== scopeOf(popular) && baseName(name) === baseName(popular) && baseName(name).length >= MIN_LENGTH)
+    return `${popular} under another scope`;
+  if (squash(name) === squash(popular))
+    return `${popular} spelled with other separators or case`;
+  const edits = distance(name, popular);
+  const allowed = Math.min(name.length, popular.length) >= MIN_LENGTH * 2 ? 2 : 1;
+  return Math.min(name.length, popular.length) >= MIN_LENGTH && edits <= allowed ? `${popular}, ${edits} ${edits === 1 ? "edit" : "edits"} away` : undefined;
+}
+function nearMisses(name, popular = popular_default) {
+  if (popular.includes(name))
+    return [];
+  const found = [];
+  for (const other of popular) {
+    const text = resemblance(name, other);
+    if (text !== undefined)
+      found.push({ text, edits: distance(name, other) });
+  }
+  return found.sort((a, b) => a.edits - b.edits).slice(0, 3).map((match) => match.text);
+}
+var SEPARATORS, MIN_LENGTH = 5;
+var init_nearmiss = __esm(() => {
+  init_src();
+  init_popular();
+  SEPARATORS = /[-_.]/g;
+});
+
+// src/analyze.ts
+function parseSpec(text) {
+  const at = text.search(VERSION_SEPARATOR);
+  return at === -1 ? { name: text } : { name: text.slice(0, at), request: text.slice(at + 1) };
+}
+function isStable(version) {
+  return !version.includes("-");
+}
+function resolve(packument, request) {
+  const tags = packument["dist-tags"] ?? {};
+  const versions = Object.keys(packument.versions ?? {});
+  const wanted = request === undefined || request === "" ? "latest" : request;
+  if (tags[wanted] !== undefined)
+    return tags[wanted];
+  if (versions.includes(wanted))
+    return wanted;
+  return versions.filter((version) => Bun.semver.satisfies(version, wanted)).sort(Bun.semver.order).at(-1);
+}
+function licenseOf(license) {
+  return typeof license === "string" ? license : license?.type;
+}
+function repositoryOf(packument) {
+  const repository = typeof packument.repository === "string" ? packument.repository : packument.repository?.url;
+  return repository?.replace(GIT_PREFIX, "") ?? packument.homepage;
+}
+function ageDays(published, now) {
+  const at = Date.parse(published ?? "");
+  return Number.isNaN(at) ? undefined : (now - at) / DAY;
+}
+function installScriptsOf(version) {
+  return Object.fromEntries(INSTALL_SCRIPTS.flatMap((name) => version?.scripts?.[name] === undefined ? [] : [[name, version.scripts[name]]]));
+}
+function safeRelease(packument, now, minAgeDays) {
+  const old = Object.keys(packument.versions ?? {}).filter((version) => isStable(version) && (ageDays(packument.time?.[version], now) ?? 0) >= minAgeDays && packument.time?.[version] !== undefined);
+  const version = old.sort(Bun.semver.order).at(-1);
+  return version === undefined ? undefined : { version, published: packument.time?.[version] };
+}
+function analyze(input) {
+  const { spec, packument, registry, now = Date.now(), minAgeDays = DEFAULT_MIN_AGE_DAYS } = input;
+  const report = { name: spec.name, registry, exists: packument !== undefined, requested: spec.request, installScripts: {}, nearMisses: nearMisses(spec.name), advisories: input.advisories ?? [], warnings: [], blocked: false, downloads: input.downloads };
+  if (report.nearMisses.length > 0)
+    report.warnings.push(`name looks like ${report.nearMisses.join("; ")}, check it is the package meant`);
+  if (packument === undefined) {
+    report.blocked = true;
+    report.warnings.unshift(`${spec.name} is not on ${registry}, the name may be guessed`);
+    return report;
+  }
+  const latest = packument["dist-tags"]?.latest;
+  const version = resolve(packument, spec.request);
+  const entry = version === undefined ? undefined : packument.versions?.[version];
+  report.description = packument.description;
+  report.license = licenseOf(entry?.license) ?? licenseOf(packument.license);
+  report.repository = repositoryOf(packument);
+  report.latest = latest === undefined ? undefined : { version: latest, published: packument.time?.[latest] };
+  report.safe = safeRelease(packument, now, minAgeDays);
+  report.version = version;
+  report.published = version === undefined ? undefined : packument.time?.[version];
+  report.installScripts = installScriptsOf(entry);
+  report.deprecated = entry?.deprecated;
+  if (version === undefined) {
+    report.blocked = true;
+    report.warnings.push(`no version of ${spec.name} matches ${spec.request}`);
+    return report;
+  }
+  const age = ageDays(report.published, now);
+  if (age === undefined) {
+    report.warnings.push(`${registry} gives no publish date for ${version}, its age cannot be checked`);
+  } else if (age < minAgeDays) {
+    report.blocked = true;
+    report.warnings.push(`${version} was published ${age < 1 ? "less than a day" : `${Math.floor(age)} day${Math.floor(age) === 1 ? "" : "s"}`} ago, under ${minAgeDays} days${report.safe === undefined ? ", and no older stable version exists" : `, use ${spec.name}@${report.safe.version}`}`);
+  }
+  const scripts = Object.keys(report.installScripts);
+  if (scripts.length > 0)
+    report.warnings.push(`${version} runs ${scripts.join(", ")} at install`);
+  if (report.deprecated !== undefined)
+    report.warnings.push(`${version} is deprecated: ${report.deprecated}`);
+  if (input.licenses !== undefined) {
+    const isMissing = report.license === undefined || report.license === "";
+    if (isMissing) {
+      report.blocked = true;
+      report.warnings.push(`${version} declares no licence, and the allowlist needs one`);
+    } else if (!isLicenseAllowed(report.license ?? "", input.licenses)) {
+      report.blocked = true;
+      report.warnings.push(`licence ${report.license} is not in the allowlist (${input.licenses.join(", ")})`);
+    }
+  }
+  if (input.blockSeverity !== undefined) {
+    const blocking = filterAdvisories(report.advisories, input.blockSeverity);
+    if (blocking.length > 0) {
+      report.blocked = true;
+      report.warnings.push(`${version} has ${blocking.length} advisor${blocking.length === 1 ? "y" : "ies"} at ${input.blockSeverity} or above: ${blocking.map((each) => each.ghsa ?? each.id).join(", ")}`);
+    }
+  }
+  return report;
+}
+var DEFAULT_MIN_AGE_DAYS = 14, DAY = 86400000, INSTALL_SCRIPTS, GIT_PREFIX, VERSION_SEPARATOR;
+var init_analyze = __esm(() => {
+  init_advisories();
+  init_licenses();
+  init_nearmiss();
+  INSTALL_SCRIPTS = ["preinstall", "install", "postinstall"];
+  GIT_PREFIX = /^git\+/;
+  VERSION_SEPARATOR = /(?<=.)@/;
+});
+
+// src/commands/check.ts
+var exports_check = {};
+__export(exports_check, {
+  check: () => check
+});
 async function checkPackage(text, context) {
   const spec = parseSpec(text);
   const registry = registryFor(spec.name, context.configs);
   const packument = await fetchPackument(spec.name, registry, context.fetcher);
   const downloads = packument !== undefined && isPublic(registry) ? await fetchDownloads(spec.name, context.fetcher) : undefined;
-  return analyze({ spec, packument, downloads, registry: new URL(registry.url).host, now: context.now, minAgeDays: context.minAgeDays });
+  const input = { spec, packument, downloads, registry: new URL(registry.url).host, now: context.now, minAgeDays: context.minAgeDays, licenses: context.settings?.licenses };
+  const report = analyze(input);
+  const { blockSeverity } = context.settings ?? {};
+  if (blockSeverity === undefined || report.version === undefined)
+    return report;
+  const found = await fetchAdvisories({ [spec.name]: [report.version] }, registry, context.fetcher);
+  return analyze({ ...input, blockSeverity, advisories: advisoriesFor(found[spec.name], report.version) });
 }
 function when(release, now) {
   return release?.published === undefined ? "" : `, published ${formatAge(release.published, now)} (${release.published.slice(0, 10)})`;
@@ -1340,7 +1828,7 @@ async function check(args) {
     fail(`a package name is needed
 
 ${usage}`);
-  const context = { configs: await loadConfigs(), minAgeDays: wholeNumber(values["min-age"], "min-age", DEFAULT_MIN_AGE_DAYS, 0) };
+  const context = { configs: await loadConfigs(), settings: await loadSettings(), minAgeDays: wholeNumber(values["min-age"], "min-age", DEFAULT_MIN_AGE_DAYS, 0) };
   const reports = await Promise.all(positionals.map(async (text) => checkPackage(text, context)));
   if (values.json === true)
     printJson(reports.length === 1 ? reports[0] : reports);
@@ -1350,6 +1838,549 @@ ${usage}`);
 `));
   return reports.some((report) => report.blocked) ? 1 : 0;
 }
+var usage = `pkg [check] <name>[@version]...
+
+Checks npm packages before they are added: whether the name exists, the latest and the newest version at least two weeks old, weekly downloads, licence, repository, install scripts and a near miss of a popular name.
+
+A \`.pkgrc.json\` (or ~/.config/pkg/config.json) with \`licenses\` (SPDX ids) refuses a licence outside the list or a missing one, and \`blockSeverity\` (low, moderate, high, critical) refuses a version with an advisory at that level or above.
+
+Exits 0 when every package passes, 1 when one is missing, the version asked for is under the minimum age, its licence is outside the allowlist or an advisory reaches the threshold, 2 on a usage error.`, options;
+var init_check = __esm(() => {
+  init_src();
+  init_advisories();
+  init_analyze();
+  init_config2();
+  init_registry();
+  options = {
+    json: jsonOption(),
+    "min-age": { type: "string", description: `days a version must be old (${DEFAULT_MIN_AGE_DAYS})` }
+  };
+});
+
+// src/lockfile.ts
+function parseBunLock(text) {
+  const lock = Bun.JSONC.parse(text);
+  const seen = new Map;
+  for (const entry of Object.values(lock?.packages ?? {})) {
+    const resolution = entry[0];
+    if (typeof resolution !== "string")
+      continue;
+    const at = resolution.search(VERSION_SEPARATOR2);
+    const name = resolution.slice(0, at);
+    const version = resolution.slice(at + 1);
+    if (at !== -1 && !NOT_REGISTRY.test(version))
+      seen.set(`${name}@${version}`, { name, version });
+  }
+  return [...seen.values()].sort((a, b) => a.name.localeCompare(b.name) || Bun.semver.order(a.version, b.version));
+}
+var NOT_REGISTRY, VERSION_SEPARATOR2;
+var init_lockfile = __esm(() => {
+  NOT_REGISTRY = /^(?:workspace|link|file|github|git|http|https|npm):|^[\w.-]+\/[\w.-]+$/;
+  VERSION_SEPARATOR2 = /(?<=.)@/;
+});
+
+// src/commands/audit.ts
+var exports_audit = {};
+__export(exports_audit, {
+  audit: () => audit
+});
+import { join as join2, resolve as resolve2 } from "path";
+import process8 from "process";
+function hasFinding(audited) {
+  return audited.blocked || audited.warnings.length > 0 || audited.advisories.length > 0;
+}
+async function auditPackages(packages, context) {
+  const packuments = new Map;
+  const lookup = async (name, registry) => {
+    const key = `${registry.url}|${name}`;
+    if (!packuments.has(key))
+      packuments.set(key, fetchPackument(name, registry, context.fetcher));
+    return packuments.get(key);
+  };
+  const registries = new Map;
+  for (const { name, version } of packages) {
+    const registry = registryFor(name, context.configs);
+    const group = registries.get(registry.url) ?? { registry, versions: {} };
+    group.versions[name] = [...group.versions[name] ?? [], version];
+    registries.set(registry.url, group);
+  }
+  const advisories = {};
+  for (const { registry, versions } of registries.values())
+    Object.assign(advisories, await fetchAdvisories(versions, registry, context.fetcher));
+  const audited = [];
+  for (let start = 0;start < packages.length; start += BATCH) {
+    audited.push(...await Promise.all(packages.slice(start, start + BATCH).map(async ({ name, version }) => {
+      const registry = registryFor(name, context.configs);
+      const found = filterAdvisories(advisoriesFor(advisories[name], version), context.level, context.ignore);
+      const report = analyze({ spec: { name, request: version }, packument: await lookup(name, registry), registry: new URL(registry.url).host, now: context.now, minAgeDays: context.minAgeDays, licenses: context.settings.licenses });
+      return { name, version, license: report.license, blocked: report.blocked || found.length > 0, warnings: report.warnings, advisories: found };
+    })));
+  }
+  return audited;
+}
+function renderAudit(findings, total) {
+  const blocks = findings.map(({ name, version, warnings, advisories }) => [
+    `${name}@${version}`,
+    ...warnings.map((warning) => `  warning: ${warning}`),
+    ...advisories.map((each) => `  ${each.ghsa ?? each.id} ${each.severity}: ${each.title}${each.fixed === undefined ? "" : ` (fixed in ${each.fixed})`}`)
+  ].join(`
+`));
+  return [...blocks, `${findings.length} of ${total} packages with a finding, ${findings.filter((each) => each.blocked).length} blocking`].join(`
+
+`);
+}
+async function audit(args) {
+  const { values, positionals: [asked] } = parse(args, usage2, options2, { positionals: ["[dir]"] });
+  const level = values["audit-level"] ?? "low";
+  if (!isSeverity(level))
+    fail(`--audit-level takes ${SEVERITIES.join(", ")}, not ${level}`);
+  const dir = resolve2(asked ?? process8.cwd());
+  const lock = Bun.file(join2(dir, "bun.lock"));
+  if (!await lock.exists())
+    fail(`no bun.lock in ${dir}`);
+  const packages = parseBunLock(await lock.text());
+  const context = {
+    configs: await loadConfigs(dir),
+    settings: await loadSettings(dir),
+    minAgeDays: wholeNumber(values["min-age"], "min-age", DEFAULT_MIN_AGE_DAYS, 0),
+    level,
+    ignore: values.ignore ?? []
+  };
+  const findings = (await auditPackages(packages, context)).filter(hasFinding);
+  if (values.json === true)
+    printJson(findings);
+  else
+    console.log(renderAudit(findings, packages.length));
+  return findings.some((each) => each.blocked) ? 1 : 0;
+}
+var usage2 = `pkg audit [dir]
+
+Reads the bun.lock in the folder (the current one by default) and runs on every registry package it pins the checks \`pkg check\` runs before an add: age, install scripts, a deprecated version, a near miss of a popular name, and the licence allowlist of the pkg config. It also lists the known advisories of each version, with the GHSA, the severity and the fixed version, from the registry's bulk advisory endpoint, the one \`bun audit\` reads.
+Findings are grouped per package, each registry package looked up once per run.
+
+Exits 0 when nothing blocks, 1 when a package is missing, too fresh or outside the licence allowlist, or an advisory reaches --audit-level, 2 on a usage error or without a bun.lock.`, options2, BATCH = 8;
+var init_audit = __esm(() => {
+  init_src();
+  init_advisories();
+  init_analyze();
+  init_config2();
+  init_lockfile();
+  init_registry();
+  options2 = {
+    json: jsonOption("[{name, version, license, blocked, warnings, advisories}] for the packages with a finding"),
+    "min-age": { type: "string", description: `days a version must be old (${DEFAULT_MIN_AGE_DAYS})` },
+    "audit-level": { type: "string", description: "lowest advisory severity listed and failing: low, moderate, high, critical (low)" },
+    ignore: { type: "string", multiple: true, description: "an advisory skipped by GHSA or numeric id, repeatable" }
+  };
+});
+
+// ../kit/src/progress.ts
+import process9 from "process";
+function liveRegion(render, stream = process9.stderr, env = process9.env) {
+  if (!takesControlCodes(stream, env))
+    return { redraw: () => {
+      return;
+    }, print: (text) => void stream.write(`${text}
+`), stop: () => {
+      return;
+    } };
+  const write = stream.write.bind(stream);
+  let frame = 0;
+  let drawn = 0;
+  const clear = () => {
+    if (drawn > 0)
+      write(`${CLEAR_LINE}${LINE_UP.repeat(drawn - 1)}`);
+    drawn = 0;
+  };
+  const draw = () => {
+    const width = (stream.columns === undefined || stream.columns === 0 ? 80 : stream.columns) - 1;
+    const height = stream.rows === undefined || stream.rows === 0 ? 24 : stream.rows;
+    const lines = render(FRAMES[frame++ % FRAMES.length]).slice(0, Math.max(1, height - 1)).map((line) => cutToWidth(line, width));
+    if (lines.length === 0) {
+      clear();
+      return;
+    }
+    write(`${drawn > 0 ? `${CLEAR_LINE}${LINE_UP.repeat(drawn - 1)}` : CLEAR_LINE}${lines.join(`
+`)}`);
+    drawn = lines.length;
+  };
+  const timer = setInterval(draw, FRAME_MS);
+  const restore = interceptOutput(clear);
+  const onExit = () => clear();
+  const signals = holdSignals(stop);
+  function stop() {
+    clearInterval(timer);
+    clear();
+    restore();
+    process9.off("exit", onExit);
+    signals.release();
+  }
+  timer.unref();
+  process9.on("exit", onExit);
+  return {
+    redraw: draw,
+    print: (text) => {
+      clear();
+      write(`${text}
+`);
+      draw();
+    },
+    stop
+  };
+}
+function cutToWidth(line, width) {
+  if (Bun.stringWidth(line) <= width)
+    return line;
+  let room = width;
+  let kept = "";
+  let index = 0;
+  let linked = false;
+  while (index < line.length) {
+    ESCAPE_CODE.lastIndex = index;
+    const escape = ESCAPE_CODE.exec(line);
+    if (escape !== null) {
+      kept += escape[0];
+      linked ||= escape[0].startsWith(`${ESC}]`);
+      index = ESCAPE_CODE.lastIndex;
+      continue;
+    }
+    const char = String.fromCodePoint(line.codePointAt(index));
+    const columns = Bun.stringWidth(char);
+    if (columns > room)
+      break;
+    kept += char;
+    room -= columns;
+    index += char.length;
+  }
+  return `${kept}${RESET_STYLE}${linked ? CLOSE_LINK : ""}`;
+}
+function interceptOutput(clear) {
+  const targets = [...CONSOLE_METHODS.map((name) => [console, name]), [process9.stdout, "write"], [process9.stderr, "write"]];
+  const wrapped = targets.map(([target, name]) => {
+    const original = Reflect.get(target, name);
+    const wrapper = (...args) => {
+      clear();
+      return original.apply(target, args);
+    };
+    Reflect.set(target, name, wrapper);
+    return { target, name, original, wrapper };
+  });
+  return () => {
+    for (const { target, name, original, wrapper } of wrapped) {
+      if (Reflect.get(target, name) === wrapper)
+        Reflect.set(target, name, original);
+    }
+  };
+}
+var FRAMES, FRAME_MS = 80, CLEAR_LINE = "\r\x1B[2K", LINE_UP = "\x1B[1A\x1B[2K", ESC, ESCAPE_CODE, RESET_STYLE, CLOSE_LINK, CONSOLE_METHODS;
+var init_progress = __esm(() => {
+  init_format();
+  init_process();
+  init_style();
+  FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+  ESC = String.fromCharCode(27);
+  ESCAPE_CODE = new RegExp(`${ESC}(?:\\[[\\x30-\\x3F]*[\\x20-\\x2F]*[\\x40-\\x7E]|\\][^\\u0007${ESC}]*(?:\\u0007|${ESC}\\\\))`, "y");
+  RESET_STYLE = `${ESC}[0m`;
+  CLOSE_LINK = `${ESC}]8;;${ESC}\\`;
+  CONSOLE_METHODS = ["log", "info", "warn", "error", "debug", "dir", "dirxml", "table", "trace", "group", "groupCollapsed", "count", "timeEnd", "timeLog", "assert"];
+});
+
+// ../kit/src/shell.ts
+var SEPARATORS2, PLAIN_BREAKERS, DOUBLE_QUOTED_ESCAPES, WRAPPERS;
+var init_shell = __esm(() => {
+  SEPARATORS2 = new Set([`
+`, ";", "|"]);
+  PLAIN_BREAKERS = new Set(["<", ">", "(", ")", "&", "|"]);
+  DOUBLE_QUOTED_ESCAPES = new Set(["$", "`", '"', "\\"]);
+  WRAPPERS = new Set(["command", "env", "sudo", "exec", "nohup", "time"]);
+});
+
+// src/pin.ts
+function actions(byAction) {
+  return new Map(Object.entries(byAction).flatMap(([action, names]) => names.map((name) => [name, action])));
+}
+var LOCKFILES, ACTIONS, OPTION_FLAGS, DIR_FLAGS, VALUE_FLAGS;
+var init_pin = __esm(() => {
+  init_shell();
+  LOCKFILES = [
+    ["bun.lock", "bun"],
+    ["bun.lockb", "bun"],
+    ["pnpm-lock.yaml", "pnpm"],
+    ["yarn.lock", "yarn"],
+    ["package-lock.json", "npm"]
+  ];
+  ACTIONS = {
+    bun: actions({ install: ["install", "i"], add: ["add", "a"], remove: ["remove", "rm"], update: ["update"] }),
+    pnpm: actions({ install: ["install", "i"], add: ["add"], remove: ["remove", "rm"], update: ["update", "up"] }),
+    yarn: new Map([...actions({ install: ["", "install"], add: ["add"], remove: ["remove"], update: ["upgrade"] }), ["upgrade-interactive", null], ["import", null]]),
+    npm: actions({
+      install: ["install", "i", "in", "ins", "inst", "insta", "instal", "isnt", "isnta", "isntal", "isntall"],
+      add: ["add"],
+      frozen: ["ci", "clean-install", "ic", "install-clean", "isntall-clean"],
+      remove: ["uninstall", "unlink", "remove", "rm", "r", "un"],
+      update: ["update", "u", "up", "upgrade", "udpate"]
+    })
+  };
+  OPTION_FLAGS = new Map([
+    ["-D", "dev"],
+    ["--save-dev", "dev"],
+    ["--dev", "dev"],
+    ["-E", "exact"],
+    ["--save-exact", "exact"],
+    ["--exact", "exact"]
+  ]);
+  DIR_FLAGS = new Set(["--cwd", "-C", "--dir", "--prefix"]);
+  VALUE_FLAGS = new Set([...DIR_FLAGS, "--filter", "-F"]);
+});
+
+// src/consumers.ts
+import { existsSync, readdirSync, readFileSync } from "fs";
+import { dirname as dirname2, join as join3, relative } from "path";
+function packageFiles(dir, depth, found) {
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return found;
+  }
+  for (const entry of entries) {
+    if (entry.isFile() && entry.name === "package.json")
+      found.push(join3(dir, entry.name));
+    else if (entry.isDirectory() && depth < MAX_DEPTH && !entry.name.startsWith(".") && !SKIPPED.has(entry.name))
+      packageFiles(join3(dir, entry.name), depth + 1, found);
+  }
+  return found;
+}
+function managerFor(dir, root) {
+  for (let at = dir;; at = dirname2(at)) {
+    const lockfile = LOCKFILES.find(([file]) => existsSync(join3(at, file)));
+    if (lockfile !== undefined)
+      return lockfile[1];
+    if (at === root || at === dirname2(at))
+      return "bun";
+  }
+}
+function findConsumers(name, root) {
+  const consumers = [];
+  for (const path of packageFiles(root, 0, []).sort()) {
+    let manifest;
+    try {
+      manifest = JSON.parse(readFileSync(path, "utf8"));
+    } catch {
+      continue;
+    }
+    const kind = KINDS.find((each) => typeof manifest[each]?.[name] === "string");
+    const spec = kind === undefined ? undefined : manifest[kind]?.[name];
+    if (kind !== undefined && spec !== undefined)
+      consumers.push({ dir: relative(root, dirname2(path)) || ".", path, kind, spec, manager: managerFor(dirname2(path), root) });
+  }
+  return consumers;
+}
+function isLocal(consumer) {
+  return LOCAL_SPEC.test(consumer.spec);
+}
+function addCommand(consumer, name, version) {
+  return ["bun", "add", ...KIND_FLAGS[consumer.kind], "--exact", "--no-cache", `${name}@${version}`];
+}
+var KINDS, SKIPPED, MAX_DEPTH = 5, LOCAL_SPEC, KIND_FLAGS;
+var init_consumers = __esm(() => {
+  init_pin();
+  KINDS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+  SKIPPED = new Set(["node_modules", "dist", "build", "vendor", "target", "coverage"]);
+  LOCAL_SPEC = /^(?:workspace|link|file|portal):/;
+  KIND_FLAGS = { dependencies: [], devDependencies: ["--dev"], optionalDependencies: ["--optional"], peerDependencies: ["--peer"] };
+});
+
+// src/commands/bump.ts
+var exports_bump = {};
+__export(exports_bump, {
+  ROOT_OPTION: () => ROOT_OPTION,
+  bump: () => bump
+});
+import { existsSync as existsSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname3, join as join4, relative as relative2 } from "path";
+async function servedVersion(name, version, settings) {
+  const registry = registryFor(name, settings.configs);
+  const host = new URL(registry.url).host;
+  const started = Date.now();
+  const region = liveRegion((spinner) => [`${spinner} waiting for ${host} to serve ${name}@${version} ${formatDuration(Date.now() - started)}`]);
+  try {
+    for (;; ) {
+      const packument = await fetchPackument(name, registry, settings.fetcher);
+      const latest = packument?.["dist-tags"]?.latest;
+      if (version === undefined && latest !== undefined)
+        return latest;
+      if (version === undefined)
+        fail(`${host} has no ${name}`, 1);
+      if (packument?.versions?.[version] !== undefined)
+        return version;
+      if (Date.now() - started >= settings.timeout)
+        fail(`${host} does not serve ${name}@${version} after ${formatDuration(settings.timeout)}`);
+      region.redraw();
+      await Bun.sleep(settings.poll ?? POLL);
+    }
+  } finally {
+    region.stop();
+  }
+}
+function lockfileOf(dir, root) {
+  for (let at = dir;; at = dirname3(at)) {
+    const found = ["bun.lock", "bun.lockb"].find((file) => existsSync2(join4(at, file)));
+    if (found !== undefined)
+      return relative2(dir, join4(at, found));
+    if (at === root || at === dirname3(at))
+      return;
+  }
+}
+async function checkAndCommit(name, version, where, root, run) {
+  const checked = await run(["check"], where);
+  if (checked.code !== 0)
+    return `check exited ${checked.code}: ${checked.text.trim().split(`
+`).at(-1) ?? ""}`;
+  const lockfile = lockfileOf(where, root);
+  const committed = await run(["gc", `chore(deps): bump ${name} to ${version}`, "--", "package.json", ...lockfile === undefined ? [] : [lockfile]], where);
+  return committed.code === 0 ? undefined : `gc exited ${committed.code}: ${committed.text.trim().split(`
+`).at(-1) ?? ""}`;
+}
+async function bumpConsumers(name, version, settings) {
+  const found = findConsumers(name, settings.root);
+  const consumers = found.filter((each) => !isLocal(each));
+  const local = found.length - consumers.length;
+  const run = settings.run ?? (async (argv, cwd) => runCommand(argv, { cwd }));
+  const committed = [];
+  const failing = [];
+  const skipped = [];
+  let isClean = true;
+  if (found.length === 0)
+    note(`nothing under ${settings.root} depends on ${name}`);
+  if (local > 0)
+    note(`${local} workspace:, link: or file: dependenc${local === 1 ? "y" : "ies"}`, "left as they are");
+  for (const consumer of consumers) {
+    const argv = addCommand(consumer, name, version);
+    const where = join4(settings.root, consumer.dir);
+    if (consumer.spec === version) {
+      skipped.push(consumer.dir);
+      note(consumer.dir, `already on ${version}`);
+    } else if (consumer.manager !== "bun") {
+      skipped.push(consumer.dir);
+      warn(consumer.dir, `${consumer.spec}, its lockfile pins ${consumer.manager}: put ${version} in by hand`);
+    } else if (settings.isDryRun === true) {
+      note(consumer.dir, `would run ${[argv.join(" "), ...settings.isAll === true ? ["check", `gc 'chore(deps): bump ${name} to ${version}'`] : []].join(", then ")}`);
+    } else {
+      const ran = await run(argv, where);
+      if (ran.code !== 0) {
+        isClean = false;
+        failing.push(consumer.dir);
+        problem(consumer.dir, `${argv.join(" ")} exited ${ran.code}: ${ran.text.trim().split(`
+`).at(-1) ?? ""}`);
+      } else if (settings.isAll !== true) {
+        ok(consumer.dir, `${consumer.spec} -> ${version}`);
+      } else {
+        const failure = await checkAndCommit(name, version, where, settings.root, run);
+        if (failure === undefined) {
+          committed.push(consumer.dir);
+          ok(consumer.dir, `${consumer.spec} -> ${version}, checked and committed`);
+        } else {
+          isClean = false;
+          failing.push(consumer.dir);
+          problem(consumer.dir, `${consumer.spec} -> ${version}, left uncommitted: ${failure}`);
+        }
+      }
+    }
+  }
+  if (settings.isAll === true && settings.isDryRun !== true)
+    note("summary", `${committed.length} bumped and committed, ${failing.length} bumped and failing${failing.length > 0 ? ` (${failing.join(", ")})` : ""}, ${skipped.length + local} skipped`);
+  return isClean;
+}
+async function bump(args) {
+  const { values, positionals: [name, asked] } = parse(args, usage3, options3, { positionals: ["<name>", "[version]"] });
+  const settings = {
+    root: values.root ?? join4(homedir2(), "Workspace"),
+    configs: await loadConfigs(),
+    timeout: duration(values.timeout, "timeout", 10 * 60000),
+    isDryRun: values["dry-run"] === true,
+    isAll: values["all-consumers"] === true
+  };
+  const version = await servedVersion(name, asked, settings);
+  return await bumpConsumers(name, version, settings) ? 0 : 1;
+}
+var usage3 = `pkg bump <name> [version]
+
+Waits until the registry serves the version (the latest when none is given), then runs \`bun add --exact --no-cache\` in each folder under --root whose package.json depends on the package, the kind of dependency kept, a line per folder.
+A workspace:, link: or file: dependency, a folder already on the version and one whose lockfile pins another manager are left as they are, each said so.
+With --all-consumers each folder whose install went through then runs its own \`check\` (the check bin) and is committed with \`gc 'chore(deps): bump <name> to <version>' -- package.json <lockfile>\` only when that passes; a failing one is left uncommitted and listed in the summary with the skipped ones, and nothing is ever pushed.
+
+Exits 0 when every install ran or was left as it is (with --all-consumers, and every check passed and every commit landed), 1 when an install, a check or a commit fails or the registry has no such package, 2 when the version never shows within the timeout or on a usage error.`, ROOT_OPTION, options3, POLL = 5000;
+var init_bump = __esm(() => {
+  init_src();
+  init_progress();
+  init_config2();
+  init_consumers();
+  init_registry();
+  ROOT_OPTION = { type: "string", description: "the folder holding the repositories (~/Workspace)" };
+  options3 = {
+    root: ROOT_OPTION,
+    timeout: { type: "string", short: "t", description: "how long to wait for the registry (10m): 30s, 5m, 1h" },
+    "all-consumers": { type: "boolean", description: "after each install run the folder's check and commit it through gc when it passes" },
+    "dry-run": { type: "boolean", description: "print what would run, changing nothing" }
+  };
+});
+
+// src/commands/consumers.ts
+var exports_consumers = {};
+__export(exports_consumers, {
+  consumers: () => consumers
+});
+import { homedir as homedir3 } from "os";
+import { join as join5 } from "path";
+function consumers(args) {
+  const { values, positionals: [name] } = parse(args, usage4, options4, { positionals: ["<name>"] });
+  const root = values.root ?? join5(homedir3(), "Workspace");
+  const { shown, footer } = capped(findConsumers(name, root), limitOf(values, CONSUMERS_LIMIT));
+  if (values.json === true)
+    printJson(shown);
+  else if (shown.length === 0)
+    console.log(`nothing under ${root} depends on ${name}`);
+  else
+    console.log([table([["FOLDER", "KIND", "VERSION", "MANAGER"], ...shown.map((each) => [each.dir, each.kind, each.spec, each.manager])], { header: true }), ...footer === undefined ? [] : [footer]].join(`
+`));
+  return 0;
+}
+var usage4 = `pkg consumers <name>
+
+Lists the folders under --root whose package.json depends on the package: the folder, the kind of dependency, the version it asks for and the manager its lockfile pins, 30 at most with the count of the rest after them (--limit <n>, --full for all; --json is never cut unless --limit is given).
+
+Exits 0 when it listed them, 2 on a usage error.`, CONSUMERS_LIMIT = 30, options4;
+var init_consumers2 = __esm(() => {
+  init_src();
+  init_consumers();
+  init_bump();
+  options4 = {
+    root: ROOT_OPTION,
+    ...limitOptions(CONSUMERS_LIMIT),
+    json: jsonOption("[{dir, path, kind, spec, manager}]")
+  };
+});
+
+// src/cli.ts
+init_src();
+import process10 from "process";
+// package.json
+var version = "0.4.0";
 
 // src/cli.ts
-process7.exitCode = await runMain({ name: "pkg", version, run: check });
+process10.exitCode = await runCli({
+  name: "pkg",
+  version,
+  about: "checks npm packages before they are added, and moves a lib's consumers onto a new release",
+  replaces: "bun add on trust, and a bun info and sleep loop then a bun add per consumer",
+  examples: [["pkg zod", "the name, the newest version two weeks old, its licence and scripts"], ["pkg bump @kaynooo/cli-kit --dry-run", "the consumers a release would move"]],
+  defaultCommand: "check",
+  commands: {
+    check: { summary: "check packages before they are added (`pkg <name>` alone runs it)", run: async (args) => (await Promise.resolve().then(() => (init_check(), exports_check))).check(args) },
+    audit: { summary: "check every package a bun.lock pins, with its known advisories", run: async (args) => (await Promise.resolve().then(() => (init_audit(), exports_audit))).audit(args) },
+    bump: { summary: "wait for a release on the registry, then bun add it in every consumer", run: async (args) => (await Promise.resolve().then(() => (init_bump(), exports_bump))).bump(args) },
+    consumers: { summary: "list the folders depending on a package, with the version each asks for", run: async (args) => (await Promise.resolve().then(() => (init_consumers2(), exports_consumers))).consumers(args) }
+  }
+});