@kaynooo/pkg-tools 0.3.0 → 0.4.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Kaynooo <kaynooo@kevyn.fr>
+Copyright (c) 2026 Kaynooo <contact@kaynooo.fr>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -14,7 +14,31 @@ pkg left-pad@1.3.0 @types/node --json
 - Weekly downloads (public registry only), licence and repository.
 - Warnings for a version under the minimum age (with the `safe` version to use instead), `preinstall`, `install` and `postinstall` scripts, a deprecated version, and a name that is a near miss of a popular package (one or two edits, other separators or case, or the same name under another scope).
 
-`pkg` exits 1 when a package is missing, the request matches no version, or the resolved version is too fresh; other warnings exit 0. `--json` prints one report, or an array for several names, `--min-age <days>` changes the 14 days.
+`pkg` exits 1 when a package is missing, the request matches no version, or the resolved version is too fresh, 2 on a usage error; other warnings exit 0. `--json` prints one report, or an array for several names, `--min-age <days>` changes the 14 days.
+
+## Config: licence allowlist and advisory threshold
+
+`pkg` reads its own settings from a `.pkgrc.json` in the current folder or any folder above it, then from `~/.config/pkg/config.json`; each key comes from the nearest file that sets it, and comments are allowed.
+
+```json
+{ "licenses": ["MIT", "ISC", "Apache-2.0", "BSD-3-Clause"], "blockSeverity": "high" }
+```
+
+- `licenses` is the allowlist of SPDX ids, compared without regard to case. An expression is allowed when one side of an `OR` is and every term of an `AND` is; a `WITH` exception is ignored. With an allowlist set, `pkg check` refuses a package whose licence is outside it or missing (a legacy `SEE LICENSE IN` or `UNLICENSED` counts as outside), so the `bun add` the guard checks through `pkg check` is refused with it. Without the key the licence is only printed.
+- `blockSeverity` (`low`, `moderate`, `high` or `critical`) makes `pkg check` ask the registry for the advisories of the exact `name@version` and refuse it when one is at that severity or above. The request is the one `bun audit` makes: a `POST` of `{"name": ["version"]}` to `<registry>/-/npm/v1/security/advisories/bulk`. A registry without that endpoint (a private one, say) answers nothing and the version is not refused for it.
+
+## Auditing a lockfile
+
+```sh
+pkg audit
+pkg audit ~/Workspace/app --audit-level high --ignore GHSA-238p-pmpm-9mq7 --json
+```
+
+`pkg audit [dir]` reads the `bun.lock` of the folder and runs the checks of `pkg check` on every registry package it pins (workspace, git and link sources left out): the age of the version, install scripts, a deprecated version, a near miss of a popular name and the licence allowlist. It also lists the known advisories of every pinned version, each with its GHSA, severity and the version that fixes it when the range ends at one. Findings come grouped per package, each package looked up on the registry once per run, and all advisories fetched in one request per registry.
+
+- `--audit-level <low|moderate|high|critical>` (`low`) keeps only the advisories at that severity or above, and `--ignore <GHSA or id>` (repeatable) skips an advisory; `blockSeverity` is for `pkg check` and does not apply here.
+- `--json` prints the packages with a finding as `[{name, version, license, blocked, warnings, advisories}]`; `--min-age <days>` changes the 14 days.
+- It exits 1 when a package is missing, too fresh or outside the allowlist, or an advisory remains after the level and the ignores; install scripts and near misses alone exit 0.
 
 ## Moving consumers onto a release
 
@@ -24,7 +48,8 @@ pkg bump @kaynooo/cli-kit 0.8.0 --dry-run
 ```
 
 - `pkg consumers <name>` lists every `package.json` under `--root` (`~/Workspace`) depending on the package, `node_modules`, `dist` and dot folders left out: the folder, the kind of dependency, the version it asks for and the manager its nearest lockfile pins; `--json` for the rows.
-- `pkg bump <name> [version]` waits until the package's registry serves the version (every 5 s, `-t 10m`; the latest when none is given), then runs `bun add --exact --no-cache <name>@<version>` in each of those folders, one after another, as the same kind of dependency (`--dev`, `--optional`, `--peer`), a line per folder. A `workspace:`, `link:` or `file:` dependency, a folder already on the version and one whose lockfile pins another manager are left alone and said so; `--dry-run` prints what would run. It exits 1 when an install fails or the version never shows.
+- `pkg bump <name> [version]` waits until the package's registry serves the version (every 5 s, `-t 10m`; the latest when none is given), then runs `bun add --exact --no-cache <name>@<version>` in each of those folders, one after another, as the same kind of dependency (`--dev`, `--optional`, `--peer`), a line per folder. A `workspace:`, `link:` or `file:` dependency, a folder already on the version and one whose lockfile pins another manager are left alone and said so; `--dry-run` prints what would run. It exits 1 when an install fails or the registry has no such package, 2 when the version never shows within the timeout.
+- `pkg bump <name> [version] --all-consumers` goes on in each folder whose install went through: it runs the folder's own `check` and, only when that passes, commits with `gc 'chore(deps): bump <name> to <version>' -- package.json <lockfile>` (the `bun.lock` or `bun.lockb` nearest the folder, a monorepo's at its root). A folder whose check fails stays uncommitted. It ends on a summary line of the folders bumped and committed, bumped and failing, and skipped, exits 1 when an install, a check or a commit failed, and never pushes. With `--dry-run` it lists the `bun add`, `check` and `gc` each folder would run.
 - `pkg <name>` alone still runs `pkg check`.
 
 ## Registries

package/dist/cli.js

@@ -440,10 +440,30 @@ class Completing {
 function usageLine(usage, colors = paint(process3.stdout)) {
   return `${colors.bold("Usage:")} ${usage.replace(USAGE_PREFIX, "").replaceAll(OPTIONAL, (part) => colors.dim(part))}`;
 }
-function helpText(usage, options, colors = paint(process3.stdout), examples = []) {
-  return [usageLine(usage, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exampleRows(examples, colors)].join(`
+function helpText(usage, options, colors = paint(process3.stdout), { examples = [], replaces } = {}) {
+  return [usageLine(usage, colors), ...replacesRows(replaces, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exampleRows(examples, colors)].join(`
 `);
 }
+function replacesRows(replaces, colors = paint(process3.stdout)) {
+  return replaces === undefined ? [] : ["", `${colors.bold("Instead of:")} ${replaces}`];
+}
+function wantsHelpJson(env = process3.env) {
+  return env.KIT_HELP === "json";
+}
+function description(usage, { examples = [], replaces } = {}) {
+  const lines = usage.replace(USAGE_PREFIX, "").split(`
+`);
+  const first = lines[0];
+  const colon = first.indexOf(": ");
+  const prose = lines[lines.indexOf("") + 1] ?? "";
+  const fallback = lines.includes("") ? `${prose.charAt(0).toLowerCase()}${prose.slice(1)}`.replace(FULL_STOP, "") : "";
+  return {
+    synopsis: colon === -1 ? first : first.slice(0, colon),
+    summary: colon === -1 ? fallback : first.slice(colon + 2),
+    ...replaces === undefined ? {} : { replaces },
+    examples: examples.map((example) => typeof example === "string" ? { line: example } : { line: example[0], note: example[1] })
+  };
+}
 function exampleRows(examples, colors = paint(process3.stdout)) {
   if (examples.length === 0)
     return [];
@@ -482,14 +502,14 @@ function parse(args, usage, options, settings = {}) {
   const rest = separator === -1 ? undefined : args.slice(separator + 1);
   let parsed;
   try {
-    parsed = parseArgs({ args: own, options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
+    parsed = parseArgs({ args: joinDashValues(own, all), options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
   } catch (error) {
     badUsage(parseError(error));
   }
   const values = parsed.values;
   applyOutput("color" in output ? values.color : undefined, "plain" in output ? values.plain : undefined);
   if (values.help === true) {
-    console.log(helpText(usage, all, undefined, settings.examples));
+    console.log(wantsHelpJson() ? JSON.stringify(description(usage, settings)) : helpText(usage, all, undefined, settings));
     throw new HelpShown;
   }
   if (settings.positionals !== undefined)
@@ -504,6 +524,25 @@ function checkPositionals(given, names) {
   if (!variadic && given.length > names.length)
     badUsage(`unexpected argument ${given[names.length]}`);
 }
+function joinDashValues(args, options) {
+  const longOf = new Map(Object.entries(options).flatMap(([name, option]) => option.short === undefined ? [[`--${name}`, name]] : [[`--${name}`, name], [`-${option.short}`, name]]));
+  const isOption = (arg) => arg === "--" || longOf.has(arg.includes("=") ? arg.slice(0, arg.indexOf("=")) : arg);
+  const joined = [];
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i] ?? "";
+    if (arg === "--")
+      return [...joined, ...args.slice(i)];
+    const name = longOf.get(arg);
+    const next = args[i + 1];
+    if (name !== undefined && options[name]?.type === "string" && next !== undefined && next.startsWith("-") && next !== "-" && !isOption(next)) {
+      joined.push(`--${name}=${next}`);
+      i++;
+    } else {
+      joined.push(arg);
+    }
+  }
+  return joined;
+}
 function parseError(error) {
   const message = upTo(error instanceof Error ? error.message : String(error), ". ");
   return `${message.charAt(0).toLowerCase()}${message.slice(1)}`;
@@ -525,7 +564,7 @@ function duration(value, name, fallback, unit = "s") {
     badUsage(`--${name} takes a duration such as 30s, 5m or 1h, not ${value}`);
   return ms;
 }
-var Exit, UsageError, HelpShown, completion, OPTIONAL, USAGE_PREFIX, OUTPUT_OPTIONS, DURATION, UNIT_MS;
+var Exit, UsageError, HelpShown, completion, OPTIONAL, USAGE_PREFIX, FULL_STOP, OUTPUT_OPTIONS, DURATION, UNIT_MS;
 var init_args = __esm(() => {
   init_format();
   init_style();
@@ -551,6 +590,7 @@ var init_args = __esm(() => {
   completion = { active: false };
   OPTIONAL = /\[[^\]]+\]/g;
   USAGE_PREFIX = /^usage:\s*/i;
+  FULL_STOP = /\.$/;
   OUTPUT_OPTIONS = {
     color: { type: "string", description: "auto (on a terminal alone), always or never" },
     plain: { type: "boolean", description: "plain text, no colour or spinner: --color never" }
@@ -616,9 +656,11 @@ function closest(name, names) {
   const [best] = names.map((known) => ({ known, far: distance(name, known) })).sort((a, b) => a.far - b.far);
   return best !== undefined && best.far <= (name.length < 4 ? 1 : 2) ? best.known : undefined;
 }
-async function help({ path, header, commands, defaultCommand, examples }, stream) {
+async function help({ path, header, summary, commands, defaultCommand, examples, replaces }, stream) {
   const colors = paint(stream);
   const prefix = path.join(" ");
+  if (wantsHelpJson())
+    return JSON.stringify(description(`${prefix} <command> [options]: ${summary}`, { examples, replaces }));
   const fallback = defaultCommand === undefined ? undefined : commands[defaultCommand];
   const options = fallback !== undefined && "run" in fallback ? await optionsOf(fallback.run) : undefined;
   const own = Object.entries(options ?? {}).filter(([name]) => !(name in TOP_OPTIONS));
@@ -626,6 +668,7 @@ async function help({ path, header, commands, defaultCommand, examples }, stream
     header(colors),
     "",
     usageLine(`${prefix} ${defaultCommand === undefined ? colors.cyan("<command>") : `[${colors.cyan("<command>")}]`} [options]`, colors),
+    ...replacesRows(replaces, colors),
     "",
     ...commandRows(commands, colors),
     ...own.length === 0 ? [] : ["", `${colors.bold(`Options of ${defaultCommand}:`)} ${colors.dim("the command run when none is named")}`, ...optionRows(Object.fromEntries(own), colors)],
@@ -646,13 +689,21 @@ function printError(prefix, message, hint, cause) {
   ${styled ? tint(label) : `${label}:`} ${text}`;
   console.error(`${head} ${message}${under("cause", cause, colors.dim)}${under("hint", hint, colors.yellow)}`);
 }
-function reportThrown(prefix, error, redact = (text) => text) {
+function printJsonError(message, hint, cause) {
+  console.error(JSON.stringify({ error: message, ...hint === undefined ? {} : { hint }, ...cause === undefined ? {} : { cause } }));
+}
+function wantsJson(argv) {
+  const end = argv.indexOf("--");
+  return (end === -1 ? argv : argv.slice(0, end)).includes("--json");
+}
+function reportThrown(prefix, error, redact = (text) => text, json = false) {
   if (error instanceof HelpShown)
     return 0;
   const help = error instanceof UsageError ? `run ${prefix} --help for its options` : undefined;
   const named = error instanceof Error && !(error instanceof Exit) && error.name !== "Error" ? `${error.name}: ${error.message}` : undefined;
   const cause = error instanceof Error && error.cause instanceof Error ? redact(error.cause.message) : undefined;
-  printError(prefix, redact(named ?? (error instanceof Error ? error.message : String(error))), error instanceof Exit ? error.hint ?? help : undefined, cause);
+  const report = json ? printJsonError : (message, hint, causeText) => printError(prefix, message, hint, causeText);
+  report(redact(named ?? (error instanceof Error ? error.message : String(error))), error instanceof Exit ? error.hint ?? help : undefined, cause);
   return error instanceof Exit ? error.code : 1;
 }
 async function dispatch(level, typed, { version, redact }) {
@@ -689,12 +740,12 @@ async function dispatch(level, typed, { version, redact }) {
   }
   if ("commands" in command) {
     const { summary } = command;
-    return dispatch({ path: [...level.path, name], header: (colors) => `${colors.bold(`${prefix} ${name}`)}  ${summary}`, commands: command.commands, aliases: command.aliases, defaultCommand: undefined, examples: command.examples }, rest, { version, redact });
+    return dispatch({ path: [...level.path, name], header: (colors) => `${colors.bold(`${prefix} ${name}`)}  ${summary}`, summary, commands: command.commands, aliases: command.aliases, defaultCommand: undefined, examples: command.examples, replaces: undefined }, rest, { version, redact });
   }
   try {
     return await command.run(rest);
   } catch (error) {
-    return reportThrown(`${prefix} ${name}`, error, redact);
+    return reportThrown(`${prefix} ${name}`, error, redact, wantsJson(rest));
   }
 }
 async function optionsOf(run) {
@@ -733,7 +784,7 @@ async function printCandidates(found) {
 async function runCli(cli, argv = process4.argv.slice(2)) {
   if (argv[0] === COMPLETE)
     return printCandidates(candidates(cli.commands, cli.aliases, cli.defaultCommand, argv.slice(1)));
-  return dispatch({ path: [cli.name], header: (colors) => `${colors.bold(cli.name)} ${colors.dim(cli.version)}  ${cli.about}`, commands: cli.commands, aliases: cli.aliases, defaultCommand: cli.defaultCommand, examples: cli.examples }, argv, { version: cli.version, redact: cli.redact });
+  return dispatch({ path: [cli.name], header: (colors) => `${colors.bold(cli.name)} ${colors.dim(cli.version)}  ${cli.about}`, summary: cli.about, commands: cli.commands, aliases: cli.aliases, defaultCommand: cli.defaultCommand, examples: cli.examples, replaces: cli.replaces }, argv, { version: cli.version, redact: cli.redact });
 }
 var LEVEL_OPTIONS, TOP_OPTIONS, COMPLETE = "__complete", FILES = "__files__";
 var init_cli = __esm(() => {
@@ -752,6 +803,31 @@ var init_config = __esm(() => {
   init_args();
 });
 
+// ../kit/src/limit.ts
+function limitOptions(fallback) {
+  return {
+    limit: { type: "string", description: `show at most this many rows, the rest counted (${fallback})` },
+    full: { type: "boolean", description: "show every row" }
+  };
+}
+function limitOf(values, fallback) {
+  if (values.full === true && values.limit !== undefined)
+    badUsage("--limit and --full exclude each other");
+  if (values.full === true || values.json === true && values.limit === undefined)
+    return Number.POSITIVE_INFINITY;
+  return wholeNumber(values.limit, "limit", fallback);
+}
+function moreFooter(more) {
+  return `${more} more, rerun with --full`;
+}
+function capped(rows, limit) {
+  const more = rows.length - limit;
+  return more > 0 ? { shown: rows.slice(0, limit), footer: moreFooter(more) } : { shown: [...rows], footer: undefined };
+}
+var init_limit = __esm(() => {
+  init_args();
+});
+
 // ../kit/src/process.ts
 import { constants } from "os";
 import process5 from "process";
@@ -817,11 +893,243 @@ var init_src = __esm(() => {
   init_cli();
   init_config();
   init_format();
+  init_limit();
   init_process();
   init_style();
   init_text();
 });
 
+// src/registry.ts
+function isPublic(registry) {
+  return registry.url.replace(TRAILING_SLASHES, "") === PUBLIC_REGISTRY;
+}
+async function get(fetcher, url, token) {
+  try {
+    return await fetcher(url, { headers: { accept: "application/json", ...token === undefined ? {} : { authorization: `Bearer ${token}` } } });
+  } catch (error) {
+    return fail(`cannot reach ${new URL(url).host}: ${error instanceof Error ? error.message : String(error)}`, 1);
+  }
+}
+async function fetchPackument(name, registry, fetcher = fetch) {
+  const response = await get(fetcher, `${registry.url.replace(TRAILING_SLASHES, "")}/${name.replace("/", "%2f")}`, registry.token);
+  if (response.status === 404)
+    return;
+  if (!response.ok)
+    fail(`${new URL(registry.url).host} answered ${response.status} for ${name}`, 1);
+  return await response.json();
+}
+async function fetchDownloads(name, fetcher = fetch) {
+  const response = await get(fetcher, `${DOWNLOADS_API}/${name}`);
+  if (!response.ok)
+    return;
+  const body = await response.json();
+  return body.downloads;
+}
+var PUBLIC_REGISTRY = "https://registry.npmjs.org", DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week", TRAILING_SLASHES;
+var init_registry = __esm(() => {
+  init_src();
+  TRAILING_SLASHES = /\/+$/;
+});
+
+// src/config.ts
+import { homedir } from "os";
+import { dirname, join } from "path";
+import process7 from "process";
+function expand(value, env) {
+  let missing = false;
+  const expanded = value.replace(ENV_REFERENCE, (_, braced, bare) => {
+    const found = env[braced ?? bare ?? ""];
+    missing ||= found === undefined;
+    return found ?? "";
+  });
+  return missing ? undefined : expanded;
+}
+function parseNpmrc(text, env) {
+  const config = { scopes: {}, tokens: {}, scopeTokens: {} };
+  for (const line of text.split(`
+`)) {
+    const at = line.indexOf("=");
+    if (at === -1 || COMMENT.test(line))
+      continue;
+    const key = line.slice(0, at).trim();
+    const value = expand(line.slice(at + 1).trim().replace(QUOTES, "$2"), env);
+    if (value === undefined || value === "")
+      continue;
+    const scope = SCOPE_REGISTRY.exec(key)?.[1];
+    const tokenFor = AUTH_TOKEN.exec(key)?.[1];
+    if (scope !== undefined)
+      config.scopes[scope] = value;
+    else if (tokenFor !== undefined)
+      config.tokens[tokenFor] = value;
+    else if (key === "registry")
+      config.registry = value;
+  }
+  return config;
+}
+function bunEntry(entry, env) {
+  const url = typeof entry === "string" ? entry : entry.url;
+  const token = typeof entry === "string" || entry.token === undefined ? undefined : expand(entry.token, env);
+  return { ...url === undefined ? {} : { url: expand(url, env) ?? url }, ...token === undefined ? {} : { token } };
+}
+function parseBunfig(text, env) {
+  const config = { scopes: {}, tokens: {}, scopeTokens: {} };
+  const install = Bun.TOML.parse(text).install;
+  if (install?.registry !== undefined) {
+    const { url, token } = bunEntry(install.registry, env);
+    if (url !== undefined)
+      config.registry = url;
+    if (url !== undefined && token !== undefined)
+      config.tokens[url.replace(PROTOCOL, "")] = token;
+  }
+  for (const [scope, entry] of Object.entries(install?.scopes ?? {})) {
+    const { url, token } = bunEntry(entry, env);
+    if (url !== undefined)
+      config.scopes[scope.startsWith("@") ? scope : `@${scope}`] = url;
+    if (token !== undefined)
+      config.scopeTokens[scope.startsWith("@") ? scope : `@${scope}`] = token;
+  }
+  return config;
+}
+function tokenFor(config, url) {
+  const address = url.replace(PROTOCOL, "");
+  const best = Object.keys(config.tokens).filter((key) => address.startsWith(key)).sort((a, b) => b.length - a.length)[0];
+  return best === undefined ? undefined : config.tokens[best];
+}
+function registryFor(name, configs) {
+  const scope = name.startsWith("@") ? name.slice(0, name.indexOf("/")) : undefined;
+  for (const config of configs) {
+    const url = scope === undefined ? config.registry : config.scopes[scope] ?? config.registry;
+    if (url === undefined)
+      continue;
+    const token = (scope === undefined ? undefined : config.scopeTokens[scope]) ?? tokenFor(config, url) ?? configs.map((other) => tokenFor(other, url)).find((found) => found !== undefined);
+    return { url, token };
+  }
+  return { url: PUBLIC_REGISTRY };
+}
+async function readIfThere(path) {
+  const file = Bun.file(path);
+  return await file.exists() ? file.text() : undefined;
+}
+async function loadConfigs(cwd = process7.cwd(), env = process7.env, home = homedir()) {
+  const directories = [];
+  for (let dir = cwd;!directories.includes(dir); dir = dirname(dir))
+    directories.push(dir);
+  if (!directories.includes(home))
+    directories.push(home);
+  const configs = [];
+  for (const dir of directories) {
+    const bunfig = await readIfThere(join(dir, "bunfig.toml"));
+    const npmrc = await readIfThere(join(dir, ".npmrc"));
+    if (bunfig !== undefined)
+      configs.push(parseBunfig(bunfig, env));
+    if (npmrc !== undefined)
+      configs.push(parseNpmrc(npmrc, env));
+  }
+  return configs;
+}
+function isSeverity(value) {
+  return SEVERITIES.includes(value);
+}
+function parseSettings(text) {
+  const raw = Bun.JSONC.parse(text);
+  const settings = {};
+  if (Array.isArray(raw?.licenses) && raw.licenses.every((each) => typeof each === "string"))
+    settings.licenses = raw.licenses;
+  if (isSeverity(raw?.blockSeverity))
+    settings.blockSeverity = raw.blockSeverity;
+  return settings;
+}
+async function loadSettings(cwd = process7.cwd(), home = homedir()) {
+  const files = [];
+  for (let dir = cwd;!files.includes(join(dir, SETTINGS_FILE)); dir = dirname(dir))
+    files.push(join(dir, SETTINGS_FILE));
+  files.push(join(home, ".config", "pkg", "config.json"));
+  const settings = {};
+  for (const file of files) {
+    const text = await readIfThere(file);
+    if (text === undefined)
+      continue;
+    const found = parseSettings(text);
+    settings.licenses ??= found.licenses;
+    settings.blockSeverity ??= found.blockSeverity;
+  }
+  return settings;
+}
+var ENV_REFERENCE, COMMENT, SCOPE_REGISTRY, AUTH_TOKEN, PROTOCOL, QUOTES, SEVERITIES, SETTINGS_FILE = ".pkgrc.json";
+var init_config2 = __esm(() => {
+  init_registry();
+  ENV_REFERENCE = /\$\{(\w+)\}|\$(\w+)/g;
+  COMMENT = /^\s*[#;]/;
+  SCOPE_REGISTRY = /^(@[^:]+):registry$/;
+  AUTH_TOKEN = /^(\/\/.+?):_authToken$/;
+  PROTOCOL = /^\w+:/;
+  QUOTES = /^(["'])(.*)\1$/;
+  SEVERITIES = ["low", "moderate", "high", "critical"];
+});
+
+// src/advisories.ts
+function severityRank(severity) {
+  return SEVERITIES.indexOf(severity);
+}
+function fixedVersion(vulnerable, version) {
+  const range = vulnerable.split("||").map((each) => each.trim()).find((each) => Bun.semver.satisfies(version, each));
+  return range === undefined ? undefined : UPPER_BOUND.exec(range)?.[1];
+}
+async function fetchAdvisories(versions, registry, fetcher = fetch) {
+  const url = `${registry.url.replace(TRAILING_SLASHES2, "")}${BULK_PATH}`;
+  let response;
+  try {
+    response = await fetcher(url, {
+      method: "POST",
+      headers: { accept: "application/json", "content-type": "application/json", ...registry.token === undefined ? {} : { authorization: `Bearer ${registry.token}` } },
+      body: JSON.stringify(versions)
+    });
+  } catch {
+    return {};
+  }
+  if (!response.ok)
+    return {};
+  const body = await response.json();
+  const found = {};
+  for (const [name, raws] of Object.entries(body)) {
+    found[name] = raws.filter((raw) => SEVERITIES.includes(raw.severity)).map((raw) => ({
+      id: raw.id,
+      ghsa: GHSA.exec(raw.url)?.[0],
+      url: raw.url,
+      title: raw.title,
+      severity: raw.severity,
+      vulnerable: raw.vulnerable_versions
+    }));
+  }
+  return found;
+}
+function advisoriesFor(advisories, version) {
+  return (advisories ?? []).filter((each) => Bun.semver.satisfies(version, each.vulnerable)).map((each) => ({ ...each, fixed: fixedVersion(each.vulnerable, version) }));
+}
+function filterAdvisories(advisories, level, ignore = []) {
+  return advisories.filter((each) => severityRank(each.severity) >= severityRank(level) && !ignore.includes(each.ghsa ?? "") && !ignore.includes(String(each.id)));
+}
+var BULK_PATH = "/-/npm/v1/security/advisories/bulk", TRAILING_SLASHES2, GHSA, UPPER_BOUND;
+var init_advisories = __esm(() => {
+  init_config2();
+  TRAILING_SLASHES2 = /\/+$/;
+  GHSA = /GHSA-[\w-]+$/;
+  UPPER_BOUND = /(?:^|\s)<([\w.+-]+)/;
+});
+
+// src/licenses.ts
+function isLicenseAllowed(expression, allowed) {
+  const known = new Set(allowed.map((each) => each.toLowerCase()));
+  return expression.replace(PARENS, " ").trim().split(OR_SPLIT).some((alternative) => alternative.split(AND_SPLIT).every((term) => known.has(term.replace(WITH_EXCEPTION, "").trim().toLowerCase())));
+}
+var OR_SPLIT, AND_SPLIT, WITH_EXCEPTION, PARENS;
+var init_licenses = __esm(() => {
+  OR_SPLIT = /\s+OR\s+/i;
+  AND_SPLIT = /\s+AND\s+/i;
+  WITH_EXCEPTION = /\s+WITH\s+\S+$/i;
+  PARENS = /[()]/g;
+});
+
 // src/popular.json
 var popular_default;
 var init_popular = __esm(() => {
@@ -1405,7 +1713,7 @@ function safeRelease(packument, now, minAgeDays) {
 }
 function analyze(input) {
   const { spec, packument, registry, now = Date.now(), minAgeDays = DEFAULT_MIN_AGE_DAYS } = input;
-  const report = { name: spec.name, registry, exists: packument !== undefined, requested: spec.request, installScripts: {}, nearMisses: nearMisses(spec.name), warnings: [], blocked: false, downloads: input.downloads };
+  const report = { name: spec.name, registry, exists: packument !== undefined, requested: spec.request, installScripts: {}, nearMisses: nearMisses(spec.name), advisories: input.advisories ?? [], warnings: [], blocked: false, downloads: input.downloads };
   if (report.nearMisses.length > 0)
     report.warnings.push(`name looks like ${report.nearMisses.join("; ")}, check it is the package meant`);
   if (packument === undefined) {
@@ -1442,155 +1750,35 @@ function analyze(input) {
     report.warnings.push(`${version} runs ${scripts.join(", ")} at install`);
   if (report.deprecated !== undefined)
     report.warnings.push(`${version} is deprecated: ${report.deprecated}`);
+  if (input.licenses !== undefined) {
+    const isMissing = report.license === undefined || report.license === "";
+    if (isMissing) {
+      report.blocked = true;
+      report.warnings.push(`${version} declares no licence, and the allowlist needs one`);
+    } else if (!isLicenseAllowed(report.license ?? "", input.licenses)) {
+      report.blocked = true;
+      report.warnings.push(`licence ${report.license} is not in the allowlist (${input.licenses.join(", ")})`);
+    }
+  }
+  if (input.blockSeverity !== undefined) {
+    const blocking = filterAdvisories(report.advisories, input.blockSeverity);
+    if (blocking.length > 0) {
+      report.blocked = true;
+      report.warnings.push(`${version} has ${blocking.length} advisor${blocking.length === 1 ? "y" : "ies"} at ${input.blockSeverity} or above: ${blocking.map((each) => each.ghsa ?? each.id).join(", ")}`);
+    }
+  }
   return report;
 }
 var DEFAULT_MIN_AGE_DAYS = 14, DAY = 86400000, INSTALL_SCRIPTS, GIT_PREFIX, VERSION_SEPARATOR;
 var init_analyze = __esm(() => {
+  init_advisories();
+  init_licenses();
   init_nearmiss();
   INSTALL_SCRIPTS = ["preinstall", "install", "postinstall"];
   GIT_PREFIX = /^git\+/;
   VERSION_SEPARATOR = /(?<=.)@/;
 });
 
-// src/registry.ts
-function isPublic(registry) {
-  return registry.url.replace(TRAILING_SLASHES, "") === PUBLIC_REGISTRY;
-}
-async function get(fetcher, url, token) {
-  try {
-    return await fetcher(url, { headers: { accept: "application/json", ...token === undefined ? {} : { authorization: `Bearer ${token}` } } });
-  } catch (error) {
-    return fail(`cannot reach ${new URL(url).host}: ${error instanceof Error ? error.message : String(error)}`, 1);
-  }
-}
-async function fetchPackument(name, registry, fetcher = fetch) {
-  const response = await get(fetcher, `${registry.url.replace(TRAILING_SLASHES, "")}/${name.replace("/", "%2f")}`, registry.token);
-  if (response.status === 404)
-    return;
-  if (!response.ok)
-    fail(`${new URL(registry.url).host} answered ${response.status} for ${name}`, 1);
-  return await response.json();
-}
-async function fetchDownloads(name, fetcher = fetch) {
-  const response = await get(fetcher, `${DOWNLOADS_API}/${name}`);
-  if (!response.ok)
-    return;
-  const body = await response.json();
-  return body.downloads;
-}
-var PUBLIC_REGISTRY = "https://registry.npmjs.org", DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week", TRAILING_SLASHES;
-var init_registry = __esm(() => {
-  init_src();
-  TRAILING_SLASHES = /\/+$/;
-});
-
-// src/config.ts
-import { homedir } from "os";
-import { dirname, join } from "path";
-import process7 from "process";
-function expand(value, env) {
-  let missing = false;
-  const expanded = value.replace(ENV_REFERENCE, (_, braced, bare) => {
-    const found = env[braced ?? bare ?? ""];
-    missing ||= found === undefined;
-    return found ?? "";
-  });
-  return missing ? undefined : expanded;
-}
-function parseNpmrc(text, env) {
-  const config = { scopes: {}, tokens: {}, scopeTokens: {} };
-  for (const line of text.split(`
-`)) {
-    const at = line.indexOf("=");
-    if (at === -1 || COMMENT.test(line))
-      continue;
-    const key = line.slice(0, at).trim();
-    const value = expand(line.slice(at + 1).trim().replace(QUOTES, "$2"), env);
-    if (value === undefined || value === "")
-      continue;
-    const scope = SCOPE_REGISTRY.exec(key)?.[1];
-    const tokenFor = AUTH_TOKEN.exec(key)?.[1];
-    if (scope !== undefined)
-      config.scopes[scope] = value;
-    else if (tokenFor !== undefined)
-      config.tokens[tokenFor] = value;
-    else if (key === "registry")
-      config.registry = value;
-  }
-  return config;
-}
-function bunEntry(entry, env) {
-  const url = typeof entry === "string" ? entry : entry.url;
-  const token = typeof entry === "string" || entry.token === undefined ? undefined : expand(entry.token, env);
-  return { ...url === undefined ? {} : { url: expand(url, env) ?? url }, ...token === undefined ? {} : { token } };
-}
-function parseBunfig(text, env) {
-  const config = { scopes: {}, tokens: {}, scopeTokens: {} };
-  const install = Bun.TOML.parse(text).install;
-  if (install?.registry !== undefined) {
-    const { url, token } = bunEntry(install.registry, env);
-    if (url !== undefined)
-      config.registry = url;
-    if (url !== undefined && token !== undefined)
-      config.tokens[url.replace(PROTOCOL, "")] = token;
-  }
-  for (const [scope, entry] of Object.entries(install?.scopes ?? {})) {
-    const { url, token } = bunEntry(entry, env);
-    if (url !== undefined)
-      config.scopes[scope.startsWith("@") ? scope : `@${scope}`] = url;
-    if (token !== undefined)
-      config.scopeTokens[scope.startsWith("@") ? scope : `@${scope}`] = token;
-  }
-  return config;
-}
-function tokenFor(config, url) {
-  const address = url.replace(PROTOCOL, "");
-  const best = Object.keys(config.tokens).filter((key) => address.startsWith(key)).sort((a, b) => b.length - a.length)[0];
-  return best === undefined ? undefined : config.tokens[best];
-}
-function registryFor(name, configs) {
-  const scope = name.startsWith("@") ? name.slice(0, name.indexOf("/")) : undefined;
-  for (const config of configs) {
-    const url = scope === undefined ? config.registry : config.scopes[scope] ?? config.registry;
-    if (url === undefined)
-      continue;
-    const token = (scope === undefined ? undefined : config.scopeTokens[scope]) ?? tokenFor(config, url) ?? configs.map((other) => tokenFor(other, url)).find((found) => found !== undefined);
-    return { url, token };
-  }
-  return { url: PUBLIC_REGISTRY };
-}
-async function readIfThere(path) {
-  const file = Bun.file(path);
-  return await file.exists() ? file.text() : undefined;
-}
-async function loadConfigs(cwd = process7.cwd(), env = process7.env, home = homedir()) {
-  const directories = [];
-  for (let dir = cwd;!directories.includes(dir); dir = dirname(dir))
-    directories.push(dir);
-  if (!directories.includes(home))
-    directories.push(home);
-  const configs = [];
-  for (const dir of directories) {
-    const bunfig = await readIfThere(join(dir, "bunfig.toml"));
-    const npmrc = await readIfThere(join(dir, ".npmrc"));
-    if (bunfig !== undefined)
-      configs.push(parseBunfig(bunfig, env));
-    if (npmrc !== undefined)
-      configs.push(parseNpmrc(npmrc, env));
-  }
-  return configs;
-}
-var ENV_REFERENCE, COMMENT, SCOPE_REGISTRY, AUTH_TOKEN, PROTOCOL, QUOTES;
-var init_config2 = __esm(() => {
-  init_registry();
-  ENV_REFERENCE = /\$\{(\w+)\}|\$(\w+)/g;
-  COMMENT = /^\s*[#;]/;
-  SCOPE_REGISTRY = /^(@[^:]+):registry$/;
-  AUTH_TOKEN = /^(\/\/.+?):_authToken$/;
-  PROTOCOL = /^\w+:/;
-  QUOTES = /^(["'])(.*)\1$/;
-});
-
 // src/commands/check.ts
 var exports_check = {};
 __export(exports_check, {
@@ -1601,7 +1789,13 @@ async function checkPackage(text, context) {
   const registry = registryFor(spec.name, context.configs);
   const packument = await fetchPackument(spec.name, registry, context.fetcher);
   const downloads = packument !== undefined && isPublic(registry) ? await fetchDownloads(spec.name, context.fetcher) : undefined;
-  return analyze({ spec, packument, downloads, registry: new URL(registry.url).host, now: context.now, minAgeDays: context.minAgeDays });
+  const input = { spec, packument, downloads, registry: new URL(registry.url).host, now: context.now, minAgeDays: context.minAgeDays, licenses: context.settings?.licenses };
+  const report = analyze(input);
+  const { blockSeverity } = context.settings ?? {};
+  if (blockSeverity === undefined || report.version === undefined)
+    return report;
+  const found = await fetchAdvisories({ [spec.name]: [report.version] }, registry, context.fetcher);
+  return analyze({ ...input, blockSeverity, advisories: advisoriesFor(found[spec.name], report.version) });
 }
 function when(release, now) {
   return release?.published === undefined ? "" : `, published ${formatAge(release.published, now)} (${release.published.slice(0, 10)})`;
@@ -1634,7 +1828,7 @@ async function check(args) {
     fail(`a package name is needed
 
 ${usage}`);
-  const context = { configs: await loadConfigs(), minAgeDays: wholeNumber(values["min-age"], "min-age", DEFAULT_MIN_AGE_DAYS, 0) };
+  const context = { configs: await loadConfigs(), settings: await loadSettings(), minAgeDays: wholeNumber(values["min-age"], "min-age", DEFAULT_MIN_AGE_DAYS, 0) };
   const reports = await Promise.all(positionals.map(async (text) => checkPackage(text, context)));
   if (values.json === true)
     printJson(reports.length === 1 ? reports[0] : reports);
@@ -1647,9 +1841,13 @@ ${usage}`);
 var usage = `pkg [check] <name>[@version]...
 
 Checks npm packages before they are added: whether the name exists, the latest and the newest version at least two weeks old, weekly downloads, licence, repository, install scripts and a near miss of a popular name.
-Exits 1 when a package is missing or the version asked for is under the minimum age.`, options;
+
+A \`.pkgrc.json\` (or ~/.config/pkg/config.json) with \`licenses\` (SPDX ids) refuses a licence outside the list or a missing one, and \`blockSeverity\` (low, moderate, high, critical) refuses a version with an advisory at that level or above.
+
+Exits 0 when every package passes, 1 when one is missing, the version asked for is under the minimum age, its licence is outside the allowlist or an advisory reaches the threshold, 2 on a usage error.`, options;
 var init_check = __esm(() => {
   init_src();
+  init_advisories();
   init_analyze();
   init_config2();
   init_registry();
@@ -1659,9 +1857,126 @@ var init_check = __esm(() => {
   };
 });
 
-// ../kit/src/progress.ts
+// src/lockfile.ts
+function parseBunLock(text) {
+  const lock = Bun.JSONC.parse(text);
+  const seen = new Map;
+  for (const entry of Object.values(lock?.packages ?? {})) {
+    const resolution = entry[0];
+    if (typeof resolution !== "string")
+      continue;
+    const at = resolution.search(VERSION_SEPARATOR2);
+    const name = resolution.slice(0, at);
+    const version = resolution.slice(at + 1);
+    if (at !== -1 && !NOT_REGISTRY.test(version))
+      seen.set(`${name}@${version}`, { name, version });
+  }
+  return [...seen.values()].sort((a, b) => a.name.localeCompare(b.name) || Bun.semver.order(a.version, b.version));
+}
+var NOT_REGISTRY, VERSION_SEPARATOR2;
+var init_lockfile = __esm(() => {
+  NOT_REGISTRY = /^(?:workspace|link|file|github|git|http|https|npm):|^[\w.-]+\/[\w.-]+$/;
+  VERSION_SEPARATOR2 = /(?<=.)@/;
+});
+
+// src/commands/audit.ts
+var exports_audit = {};
+__export(exports_audit, {
+  audit: () => audit
+});
+import { join as join2, resolve as resolve2 } from "path";
 import process8 from "process";
-function liveRegion(render, stream = process8.stderr, env = process8.env) {
+function hasFinding(audited) {
+  return audited.blocked || audited.warnings.length > 0 || audited.advisories.length > 0;
+}
+async function auditPackages(packages, context) {
+  const packuments = new Map;
+  const lookup = async (name, registry) => {
+    const key = `${registry.url}|${name}`;
+    if (!packuments.has(key))
+      packuments.set(key, fetchPackument(name, registry, context.fetcher));
+    return packuments.get(key);
+  };
+  const registries = new Map;
+  for (const { name, version } of packages) {
+    const registry = registryFor(name, context.configs);
+    const group = registries.get(registry.url) ?? { registry, versions: {} };
+    group.versions[name] = [...group.versions[name] ?? [], version];
+    registries.set(registry.url, group);
+  }
+  const advisories = {};
+  for (const { registry, versions } of registries.values())
+    Object.assign(advisories, await fetchAdvisories(versions, registry, context.fetcher));
+  const audited = [];
+  for (let start = 0;start < packages.length; start += BATCH) {
+    audited.push(...await Promise.all(packages.slice(start, start + BATCH).map(async ({ name, version }) => {
+      const registry = registryFor(name, context.configs);
+      const found = filterAdvisories(advisoriesFor(advisories[name], version), context.level, context.ignore);
+      const report = analyze({ spec: { name, request: version }, packument: await lookup(name, registry), registry: new URL(registry.url).host, now: context.now, minAgeDays: context.minAgeDays, licenses: context.settings.licenses });
+      return { name, version, license: report.license, blocked: report.blocked || found.length > 0, warnings: report.warnings, advisories: found };
+    })));
+  }
+  return audited;
+}
+function renderAudit(findings, total) {
+  const blocks = findings.map(({ name, version, warnings, advisories }) => [
+    `${name}@${version}`,
+    ...warnings.map((warning) => `  warning: ${warning}`),
+    ...advisories.map((each) => `  ${each.ghsa ?? each.id} ${each.severity}: ${each.title}${each.fixed === undefined ? "" : ` (fixed in ${each.fixed})`}`)
+  ].join(`
+`));
+  return [...blocks, `${findings.length} of ${total} packages with a finding, ${findings.filter((each) => each.blocked).length} blocking`].join(`
+
+`);
+}
+async function audit(args) {
+  const { values, positionals: [asked] } = parse(args, usage2, options2, { positionals: ["[dir]"] });
+  const level = values["audit-level"] ?? "low";
+  if (!isSeverity(level))
+    fail(`--audit-level takes ${SEVERITIES.join(", ")}, not ${level}`);
+  const dir = resolve2(asked ?? process8.cwd());
+  const lock = Bun.file(join2(dir, "bun.lock"));
+  if (!await lock.exists())
+    fail(`no bun.lock in ${dir}`);
+  const packages = parseBunLock(await lock.text());
+  const context = {
+    configs: await loadConfigs(dir),
+    settings: await loadSettings(dir),
+    minAgeDays: wholeNumber(values["min-age"], "min-age", DEFAULT_MIN_AGE_DAYS, 0),
+    level,
+    ignore: values.ignore ?? []
+  };
+  const findings = (await auditPackages(packages, context)).filter(hasFinding);
+  if (values.json === true)
+    printJson(findings);
+  else
+    console.log(renderAudit(findings, packages.length));
+  return findings.some((each) => each.blocked) ? 1 : 0;
+}
+var usage2 = `pkg audit [dir]
+
+Reads the bun.lock in the folder (the current one by default) and runs on every registry package it pins the checks \`pkg check\` runs before an add: age, install scripts, a deprecated version, a near miss of a popular name, and the licence allowlist of the pkg config. It also lists the known advisories of each version, with the GHSA, the severity and the fixed version, from the registry's bulk advisory endpoint, the one \`bun audit\` reads.
+Findings are grouped per package, each registry package looked up once per run.
+
+Exits 0 when nothing blocks, 1 when a package is missing, too fresh or outside the licence allowlist, or an advisory reaches --audit-level, 2 on a usage error or without a bun.lock.`, options2, BATCH = 8;
+var init_audit = __esm(() => {
+  init_src();
+  init_advisories();
+  init_analyze();
+  init_config2();
+  init_lockfile();
+  init_registry();
+  options2 = {
+    json: jsonOption("[{name, version, license, blocked, warnings, advisories}] for the packages with a finding"),
+    "min-age": { type: "string", description: `days a version must be old (${DEFAULT_MIN_AGE_DAYS})` },
+    "audit-level": { type: "string", description: "lowest advisory severity listed and failing: low, moderate, high, critical (low)" },
+    ignore: { type: "string", multiple: true, description: "an advisory skipped by GHSA or numeric id, repeatable" }
+  };
+});
+
+// ../kit/src/progress.ts
+import process9 from "process";
+function liveRegion(render, stream = process9.stderr, env = process9.env) {
   if (!takesControlCodes(stream, env))
     return { redraw: () => {
       return;
@@ -1697,11 +2012,11 @@ function liveRegion(render, stream = process8.stderr, env = process8.env) {
     clearInterval(timer);
     clear();
     restore();
-    process8.off("exit", onExit);
+    process9.off("exit", onExit);
     signals.release();
   }
   timer.unref();
-  process8.on("exit", onExit);
+  process9.on("exit", onExit);
   return {
     redraw: draw,
     print: (text) => {
@@ -1740,7 +2055,7 @@ function cutToWidth(line, width) {
   return `${kept}${RESET_STYLE}${linked ? CLOSE_LINK : ""}`;
 }
 function interceptOutput(clear) {
-  const targets = [...CONSOLE_METHODS.map((name) => [console, name]), [process8.stdout, "write"], [process8.stderr, "write"]];
+  const targets = [...CONSOLE_METHODS.map((name) => [console, name]), [process9.stdout, "write"], [process9.stderr, "write"]];
   const wrapped = targets.map(([target, name]) => {
     const original = Reflect.get(target, name);
     const wrapper = (...args) => {
@@ -1820,7 +2135,7 @@ var init_pin = __esm(() => {
 
 // src/consumers.ts
 import { existsSync, readdirSync, readFileSync } from "fs";
-import { dirname as dirname2, join as join2, relative } from "path";
+import { dirname as dirname2, join as join3, relative } from "path";
 function packageFiles(dir, depth, found) {
   let entries;
   try {
@@ -1830,15 +2145,15 @@ function packageFiles(dir, depth, found) {
   }
   for (const entry of entries) {
     if (entry.isFile() && entry.name === "package.json")
-      found.push(join2(dir, entry.name));
+      found.push(join3(dir, entry.name));
     else if (entry.isDirectory() && depth < MAX_DEPTH && !entry.name.startsWith(".") && !SKIPPED.has(entry.name))
-      packageFiles(join2(dir, entry.name), depth + 1, found);
+      packageFiles(join3(dir, entry.name), depth + 1, found);
   }
   return found;
 }
 function managerFor(dir, root) {
   for (let at = dir;; at = dirname2(at)) {
-    const lockfile = LOCKFILES.find(([file]) => existsSync(join2(at, file)));
+    const lockfile = LOCKFILES.find(([file]) => existsSync(join3(at, file)));
     if (lockfile !== undefined)
       return lockfile[1];
     if (at === root || at === dirname2(at))
@@ -1882,8 +2197,9 @@ __export(exports_bump, {
   ROOT_OPTION: () => ROOT_OPTION,
   bump: () => bump
 });
+import { existsSync as existsSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
+import { dirname as dirname3, join as join4, relative as relative2 } from "path";
 async function servedVersion(name, version, settings) {
   const registry = registryFor(name, settings.configs);
   const host = new URL(registry.url).host;
@@ -1900,7 +2216,7 @@ async function servedVersion(name, version, settings) {
       if (packument?.versions?.[version] !== undefined)
         return version;
       if (Date.now() - started >= settings.timeout)
-        fail(`${host} does not serve ${name}@${version} after ${formatDuration(settings.timeout)}`, 1);
+        fail(`${host} does not serve ${name}@${version} after ${formatDuration(settings.timeout)}`);
       region.redraw();
       await Bun.sleep(settings.poll ?? POLL);
     }
@@ -1908,11 +2224,33 @@ async function servedVersion(name, version, settings) {
     region.stop();
   }
 }
+function lockfileOf(dir, root) {
+  for (let at = dir;; at = dirname3(at)) {
+    const found = ["bun.lock", "bun.lockb"].find((file) => existsSync2(join4(at, file)));
+    if (found !== undefined)
+      return relative2(dir, join4(at, found));
+    if (at === root || at === dirname3(at))
+      return;
+  }
+}
+async function checkAndCommit(name, version, where, root, run) {
+  const checked = await run(["check"], where);
+  if (checked.code !== 0)
+    return `check exited ${checked.code}: ${checked.text.trim().split(`
+`).at(-1) ?? ""}`;
+  const lockfile = lockfileOf(where, root);
+  const committed = await run(["gc", `chore(deps): bump ${name} to ${version}`, "--", "package.json", ...lockfile === undefined ? [] : [lockfile]], where);
+  return committed.code === 0 ? undefined : `gc exited ${committed.code}: ${committed.text.trim().split(`
+`).at(-1) ?? ""}`;
+}
 async function bumpConsumers(name, version, settings) {
   const found = findConsumers(name, settings.root);
   const consumers = found.filter((each) => !isLocal(each));
   const local = found.length - consumers.length;
   const run = settings.run ?? (async (argv, cwd) => runCommand(argv, { cwd }));
+  const committed = [];
+  const failing = [];
+  const skipped = [];
   let isClean = true;
   if (found.length === 0)
     note(`nothing under ${settings.root} depends on ${name}`);
@@ -1920,42 +2258,60 @@ async function bumpConsumers(name, version, settings) {
     note(`${local} workspace:, link: or file: dependenc${local === 1 ? "y" : "ies"}`, "left as they are");
   for (const consumer of consumers) {
     const argv = addCommand(consumer, name, version);
-    const where = join3(settings.root, consumer.dir);
+    const where = join4(settings.root, consumer.dir);
     if (consumer.spec === version) {
+      skipped.push(consumer.dir);
       note(consumer.dir, `already on ${version}`);
     } else if (consumer.manager !== "bun") {
+      skipped.push(consumer.dir);
       warn(consumer.dir, `${consumer.spec}, its lockfile pins ${consumer.manager}: put ${version} in by hand`);
     } else if (settings.isDryRun === true) {
-      note(consumer.dir, `would run ${argv.join(" ")}`);
+      note(consumer.dir, `would run ${[argv.join(" "), ...settings.isAll === true ? ["check", `gc 'chore(deps): bump ${name} to ${version}'`] : []].join(", then ")}`);
     } else {
       const ran = await run(argv, where);
-      if (ran.code === 0) {
-        ok(consumer.dir, `${consumer.spec} -> ${version}`);
-      } else {
+      if (ran.code !== 0) {
         isClean = false;
+        failing.push(consumer.dir);
         problem(consumer.dir, `${argv.join(" ")} exited ${ran.code}: ${ran.text.trim().split(`
 `).at(-1) ?? ""}`);
+      } else if (settings.isAll !== true) {
+        ok(consumer.dir, `${consumer.spec} -> ${version}`);
+      } else {
+        const failure = await checkAndCommit(name, version, where, settings.root, run);
+        if (failure === undefined) {
+          committed.push(consumer.dir);
+          ok(consumer.dir, `${consumer.spec} -> ${version}, checked and committed`);
+        } else {
+          isClean = false;
+          failing.push(consumer.dir);
+          problem(consumer.dir, `${consumer.spec} -> ${version}, left uncommitted: ${failure}`);
+        }
       }
     }
   }
+  if (settings.isAll === true && settings.isDryRun !== true)
+    note("summary", `${committed.length} bumped and committed, ${failing.length} bumped and failing${failing.length > 0 ? ` (${failing.join(", ")})` : ""}, ${skipped.length + local} skipped`);
   return isClean;
 }
 async function bump(args) {
-  const { values, positionals: [name, asked] } = parse(args, usage2, options2, { positionals: ["<name>", "[version]"] });
+  const { values, positionals: [name, asked] } = parse(args, usage3, options3, { positionals: ["<name>", "[version]"] });
   const settings = {
-    root: values.root ?? join3(homedir2(), "Workspace"),
+    root: values.root ?? join4(homedir2(), "Workspace"),
     configs: await loadConfigs(),
     timeout: duration(values.timeout, "timeout", 10 * 60000),
-    isDryRun: values["dry-run"] === true
+    isDryRun: values["dry-run"] === true,
+    isAll: values["all-consumers"] === true
   };
   const version = await servedVersion(name, asked, settings);
   return await bumpConsumers(name, version, settings) ? 0 : 1;
 }
-var usage2 = `pkg bump <name> [version]
+var usage3 = `pkg bump <name> [version]
 
 Waits until the registry serves the version (the latest when none is given), then runs \`bun add --exact --no-cache\` in each folder under --root whose package.json depends on the package, the kind of dependency kept, a line per folder.
 A workspace:, link: or file: dependency, a folder already on the version and one whose lockfile pins another manager are left as they are, each said so.
-Exits 1 when an install fails or the version never shows, 2 on a usage error.`, ROOT_OPTION, options2, POLL = 5000;
+With --all-consumers each folder whose install went through then runs its own \`check\` (the check bin) and is committed with \`gc 'chore(deps): bump <name> to <version>' -- package.json <lockfile>\` only when that passes; a failing one is left uncommitted and listed in the summary with the skipped ones, and nothing is ever pushed.
+
+Exits 0 when every install ran or was left as it is (with --all-consumers, and every check passed and every commit landed), 1 when an install, a check or a commit fails or the registry has no such package, 2 when the version never shows within the timeout or on a usage error.`, ROOT_OPTION, options3, POLL = 5000;
 var init_bump = __esm(() => {
   init_src();
   init_progress();
@@ -1963,9 +2319,10 @@ var init_bump = __esm(() => {
   init_consumers();
   init_registry();
   ROOT_OPTION = { type: "string", description: "the folder holding the repositories (~/Workspace)" };
-  options2 = {
+  options3 = {
     root: ROOT_OPTION,
     timeout: { type: "string", short: "t", description: "how long to wait for the registry (10m): 30s, 5m, 1h" },
+    "all-consumers": { type: "boolean", description: "after each install run the folder's check and commit it through gc when it passes" },
     "dry-run": { type: "boolean", description: "print what would run, changing nothing" }
   };
 });
@@ -1976,46 +2333,53 @@ __export(exports_consumers, {
   consumers: () => consumers
 });
 import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function consumers(args) {
-  const { values, positionals: [name] } = parse(args, usage3, options3, { positionals: ["<name>"] });
-  const root = values.root ?? join4(homedir3(), "Workspace");
-  const found = findConsumers(name, root);
+  const { values, positionals: [name] } = parse(args, usage4, options4, { positionals: ["<name>"] });
+  const root = values.root ?? join5(homedir3(), "Workspace");
+  const { shown, footer } = capped(findConsumers(name, root), limitOf(values, CONSUMERS_LIMIT));
   if (values.json === true)
-    printJson(found);
-  else if (found.length === 0)
+    printJson(shown);
+  else if (shown.length === 0)
     console.log(`nothing under ${root} depends on ${name}`);
   else
-    console.log(table([["FOLDER", "KIND", "VERSION", "MANAGER"], ...found.map((each) => [each.dir, each.kind, each.spec, each.manager])], { header: true }));
+    console.log([table([["FOLDER", "KIND", "VERSION", "MANAGER"], ...shown.map((each) => [each.dir, each.kind, each.spec, each.manager])], { header: true }), ...footer === undefined ? [] : [footer]].join(`
+`));
   return 0;
 }
-var usage3 = `pkg consumers <name>
+var usage4 = `pkg consumers <name>
+
+Lists the folders under --root whose package.json depends on the package: the folder, the kind of dependency, the version it asks for and the manager its lockfile pins, 30 at most with the count of the rest after them (--limit <n>, --full for all; --json is never cut unless --limit is given).
 
-Lists the folders under --root whose package.json depends on the package: the folder, the kind of dependency, the version it asks for and the manager its lockfile pins.`, options3;
+Exits 0 when it listed them, 2 on a usage error.`, CONSUMERS_LIMIT = 30, options4;
 var init_consumers2 = __esm(() => {
   init_src();
   init_consumers();
   init_bump();
-  options3 = {
+  options4 = {
     root: ROOT_OPTION,
+    ...limitOptions(CONSUMERS_LIMIT),
     json: jsonOption("[{dir, path, kind, spec, manager}]")
   };
 });
 
 // src/cli.ts
 init_src();
-import process9 from "process";
+import process10 from "process";
 // package.json
-var version = "0.3.0";
+var version = "0.4.0";
 
 // src/cli.ts
-process9.exitCode = await runCli({
+process10.exitCode = await runCli({
   name: "pkg",
   version,
   about: "checks npm packages before they are added, and moves a lib's consumers onto a new release",
+  replaces: "bun add on trust, and a bun info and sleep loop then a bun add per consumer",
+  examples: [["pkg zod", "the name, the newest version two weeks old, its licence and scripts"], ["pkg bump @kaynooo/cli-kit --dry-run", "the consumers a release would move"]],
   defaultCommand: "check",
   commands: {
     check: { summary: "check packages before they are added (`pkg <name>` alone runs it)", run: async (args) => (await Promise.resolve().then(() => (init_check(), exports_check))).check(args) },
+    audit: { summary: "check every package a bun.lock pins, with its known advisories", run: async (args) => (await Promise.resolve().then(() => (init_audit(), exports_audit))).audit(args) },
     bump: { summary: "wait for a release on the registry, then bun add it in every consumer", run: async (args) => (await Promise.resolve().then(() => (init_bump(), exports_bump))).bump(args) },
     consumers: { summary: "list the folders depending on a package, with the version each asks for", run: async (args) => (await Promise.resolve().then(() => (init_consumers2(), exports_consumers))).consumers(args) }
   }

package/package.json

@@ -1,17 +1,17 @@
 {
   "name": "@kaynooo/pkg-tools",
   "type": "module",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "pkg: check an npm package before it is added, for a guessed name, a version under two weeks old and install scripts.",
-  "author": "Kaynooo <kaynooo@kevyn.fr>",
+  "author": "Kaynooo <contact@kaynooo.fr>",
   "license": "MIT",
-  "homepage": "https://git.kevyn.fr/kaynooo/agent-tools/src/branch/main/packages/pkg#readme",
+  "homepage": "https://git.kaynooo.fr/kaynooo/agent-tools/src/branch/main/packages/pkg#readme",
   "repository": {
     "type": "git",
-    "url": "git+https://git.kevyn.fr/kaynooo/agent-tools.git",
+    "url": "git+https://git.kaynooo.fr/kaynooo/agent-tools.git",
     "directory": "packages/pkg"
   },
-  "bugs": "https://git.kevyn.fr/kaynooo/agent-tools/issues",
+  "bugs": "https://git.kaynooo.fr/kaynooo/agent-tools/issues",
   "keywords": ["npm", "package", "typosquat", "supply-chain", "dependencies"],
   "bin": {
     "pkg": "./dist/cli.js"
@@ -21,7 +21,7 @@
     "bun": ">=1.4.3"
   },
   "publishConfig": {
-    "registry": "https://git.kevyn.fr/api/packages/kaynooo/npm/"
+    "registry": "https://git.kaynooo.fr/api/packages/kaynooo/npm/"
   },
   "scripts": {
     "build": "$npm_execpath build src/cli.ts --target bun --outdir dist",