@kaynooo/pkg-tools 0.3.0 → 0.5.0

package/dist/cli.js

@@ -418,6 +418,29 @@ var init_format = __esm(() => {
   ESCAPE = String.fromCharCode(27);
 });
 
+// ../kit/src/text.ts
+function distance(a, b) {
+  let previous = Array.from({ length: b.length + 1 }, (_, index) => index);
+  for (const [i, left] of [...a].entries()) {
+    const current = [i + 1];
+    for (const [j, right] of [...b].entries())
+      current.push(Math.min((previous[j + 1] ?? 0) + 1, (current[j] ?? 0) + 1, (previous[j] ?? 0) + (left === right ? 0 : 1)));
+    previous = current;
+  }
+  return previous[b.length] ?? 0;
+}
+function closest(name, names) {
+  const started = names.find((known) => known.startsWith(name));
+  if (started !== undefined)
+    return started;
+  const [best] = names.map((known) => ({ known, far: distance(name, known) })).sort((a, b) => a.far - b.far);
+  return best !== undefined && best.far <= (name.length < 4 ? 1 : 2) ? best.known : undefined;
+}
+var ANSI;
+var init_text = __esm(() => {
+  ANSI = new RegExp(`${String.fromCharCode(27)}\\[[\\d;?]*[a-z]`, "gi");
+});
+
 // ../kit/src/args.ts
 import process3 from "process";
 import { parseArgs } from "util";
@@ -440,9 +463,29 @@ class Completing {
 function usageLine(usage, colors = paint(process3.stdout)) {
   return `${colors.bold("Usage:")} ${usage.replace(USAGE_PREFIX, "").replaceAll(OPTIONAL, (part) => colors.dim(part))}`;
 }
-function helpText(usage, options, colors = paint(process3.stdout), examples = []) {
-  return [usageLine(usage, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exampleRows(examples, colors)].join(`
+function helpText(usage, options, colors = paint(process3.stdout), { examples = [], replaces } = {}) {
+  return [usageLine(usage, colors), ...replacesRows(replaces, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exampleRows(examples, colors)].join(`
+`);
+}
+function replacesRows(replaces, colors = paint(process3.stdout)) {
+  return replaces === undefined ? [] : ["", `${colors.bold("Instead of:")} ${replaces}`];
+}
+function wantsHelpJson(env = process3.env) {
+  return env.KIT_HELP === "json";
+}
+function description(usage, { examples = [], replaces } = {}) {
+  const lines = usage.replace(USAGE_PREFIX, "").split(`
 `);
+  const first = lines[0];
+  const colon = first.indexOf(": ");
+  const prose = lines[lines.indexOf("") + 1] ?? "";
+  const fallback = lines.includes("") ? `${prose.charAt(0).toLowerCase()}${prose.slice(1)}`.replace(FULL_STOP, "") : "";
+  return {
+    synopsis: colon === -1 ? first : first.slice(0, colon),
+    summary: colon === -1 ? fallback : first.slice(colon + 2),
+    ...replaces === undefined ? {} : { replaces },
+    examples: examples.map((example) => typeof example === "string" ? { line: example } : { line: example[0], note: example[1] })
+  };
 }
 function exampleRows(examples, colors = paint(process3.stdout)) {
   if (examples.length === 0)
@@ -453,10 +496,10 @@ function optionRows(options, colors = paint(process3.stdout)) {
   const rows = Object.entries(options).map(([name, option]) => {
     const short = option.short === undefined ? "    " : `${colors.cyan(`-${option.short}`)}, `;
     const value = option.type === "string" ? ` ${colors.dim("<value>")}` : "";
-    return { flag: `${short}${colors.cyan(`--${name}`)}${value}`, width: `-x, --${name}`.length + (option.type === "string" ? " <value>".length : 0), description: option.description };
+    return { flag: `${short}${colors.cyan(`--${name}`)}${value}`, width: `-x, --${name}`.length + (option.type === "string" ? " <value>".length : 0), description: option.description ?? "" };
   });
   const width = Math.max(0, ...rows.map((row) => row.width));
-  return rows.map((row) => `  ${row.flag}${" ".repeat(width - row.width)}  ${colors.dim(row.description)}`);
+  return rows.map((row) => row.description === "" ? `  ${row.flag}` : `  ${row.flag}${" ".repeat(width - row.width)}  ${colors.dim(row.description)}`);
 }
 function applyOutput(color, plain, env = process3.env) {
   const when = plain === true ? "never" : color ?? "auto";
@@ -482,14 +525,15 @@ function parse(args, usage, options, settings = {}) {
   const rest = separator === -1 ? undefined : args.slice(separator + 1);
   let parsed;
   try {
-    parsed = parseArgs({ args: own, options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
+    parsed = parseArgs({ args: joinDashValues(own, all), options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
   } catch (error) {
-    badUsage(parseError(error));
+    const message = parseError(error);
+    throw new UsageError(message, nearestOption(message, all, settings.allowNegative === true));
   }
   const values = parsed.values;
   applyOutput("color" in output ? values.color : undefined, "plain" in output ? values.plain : undefined);
   if (values.help === true) {
-    console.log(helpText(usage, all, undefined, settings.examples));
+    console.log(wantsHelpJson() ? JSON.stringify(description(usage, settings)) : helpText(usage, all, undefined, settings));
     throw new HelpShown;
   }
   if (settings.positionals !== undefined)
@@ -504,16 +548,50 @@ function checkPositionals(given, names) {
   if (!variadic && given.length > names.length)
     badUsage(`unexpected argument ${given[names.length]}`);
 }
+function joinDashValues(args, options) {
+  const longOf = new Map(Object.entries(options).flatMap(([name, option]) => option.short === undefined ? [[`--${name}`, name]] : [[`--${name}`, name], [`-${option.short}`, name]]));
+  const isOption = (arg) => arg === "--" || longOf.has(arg.includes("=") ? arg.slice(0, arg.indexOf("=")) : arg);
+  const joined = [];
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i] ?? "";
+    if (arg === "--")
+      return [...joined, ...args.slice(i)];
+    const name = longOf.get(arg);
+    const next = args[i + 1];
+    if (name !== undefined && options[name]?.type === "string" && next !== undefined && next.startsWith("-") && next !== "-" && !isOption(next)) {
+      joined.push(`--${name}=${next}`);
+      i++;
+    } else {
+      joined.push(arg);
+    }
+  }
+  return joined;
+}
 function parseError(error) {
   const message = upTo(error instanceof Error ? error.message : String(error), ". ");
   return `${message.charAt(0).toLowerCase()}${message.slice(1)}`;
 }
+function nearestOption(message, options, allowNegative) {
+  const typed = UNKNOWN_OPTION.exec(message)?.[1];
+  if (typed === undefined)
+    return;
+  const word = typed.replace(DASHES, "");
+  if (word.length < 2 && !typed.startsWith("--"))
+    return;
+  const known = Object.entries(options).flatMap(([name, option]) => [
+    ...option.short === undefined ? [] : [`-${option.short}`],
+    `--${name}`,
+    ...allowNegative && option.type === "boolean" ? [`--no-${name}`] : []
+  ]);
+  const meant = closest(word, known.map((flag) => flag.replace(DASHES, "")));
+  return meant === undefined ? undefined : `did you mean ${known.find((flag) => flag.replace(DASHES, "") === meant)}?`;
+}
 function wholeNumber(value, name, fallback, min = 1) {
   if (value === undefined)
     return fallback;
   const number = Number(value);
-  if (!Number.isInteger(number) || number < min)
-    badUsage(`--${name} takes a whole number from ${min}, not ${value}`);
+  if (!WHOLE.test(value) || !Number.isSafeInteger(number) || number < min)
+    badUsage(`${name.startsWith("<") ? name : `--${name}`} takes a whole number from ${min}, not ${value}`);
   return number;
 }
 function duration(value, name, fallback, unit = "s") {
@@ -525,10 +603,11 @@ function duration(value, name, fallback, unit = "s") {
     badUsage(`--${name} takes a duration such as 30s, 5m or 1h, not ${value}`);
   return ms;
 }
-var Exit, UsageError, HelpShown, completion, OPTIONAL, USAGE_PREFIX, OUTPUT_OPTIONS, DURATION, UNIT_MS;
+var Exit, UsageError, HelpShown, completion, OPTIONAL, USAGE_PREFIX, FULL_STOP, DASHES, OUTPUT_OPTIONS, UNKNOWN_OPTION, WHOLE, DURATION, UNIT_MS;
 var init_args = __esm(() => {
   init_format();
   init_style();
+  init_text();
   Exit = class Exit extends Error {
     code;
     hint;
@@ -539,8 +618,8 @@ var init_args = __esm(() => {
     }
   };
   UsageError = class UsageError extends Exit {
-    constructor(message) {
-      super(message, 2);
+    constructor(message, hint) {
+      super(message, 2, hint);
     }
   };
   HelpShown = class HelpShown extends Exit {
@@ -551,10 +630,14 @@ var init_args = __esm(() => {
   completion = { active: false };
   OPTIONAL = /\[[^\]]+\]/g;
   USAGE_PREFIX = /^usage:\s*/i;
+  FULL_STOP = /\.$/;
+  DASHES = /^-+/;
   OUTPUT_OPTIONS = {
     color: { type: "string", description: "auto (on a terminal alone), always or never" },
     plain: { type: "boolean", description: "plain text, no colour or spinner: --color never" }
   };
+  UNKNOWN_OPTION = /^unknown option '(-[^']+)'/;
+  WHOLE = /^\d+$/;
   DURATION = /^(\d+(?:\.\d+)?)(ms|[smh])?$/;
   UNIT_MS = { ms: 1, s: 1000, m: 60000, h: 3600000 };
 });
@@ -565,31 +648,265 @@ var init_chart = __esm(() => {
   init_style();
 });
 
-// ../kit/src/text.ts
-function distance(a, b) {
-  let previous = Array.from({ length: b.length + 1 }, (_, index) => index);
-  for (const [i, left] of [...a].entries()) {
-    const current = [i + 1];
-    for (const [j, right] of [...b].entries())
-      current.push(Math.min((previous[j + 1] ?? 0) + 1, (current[j] ?? 0) + 1, (previous[j] ?? 0) + (left === right ? 0 : 1)));
-    previous = current;
+// ../kit/src/process.ts
+import { constants } from "os";
+import process4 from "process";
+function exitCodeOf(code, signal) {
+  if (code !== null)
+    return code;
+  if (typeof signal === "number")
+    return 128 + signal;
+  return signal === null ? 129 : 128 + constants.signals[signal];
+}
+function holdSignals(cleanup) {
+  let received;
+  let child;
+  const held = {
+    get signal() {
+      return received;
+    },
+    forward: (to) => {
+      child = to;
+    },
+    release: () => {
+      for (const signal of SIGNALS)
+        process4.off(signal, onSignal);
+    }
+  };
+  function onSignal(signal) {
+    received = signal;
+    if (child !== undefined) {
+      child.kill(signal);
+      return;
+    }
+    if (cleanup === undefined)
+      return;
+    held.release();
+    cleanup(signal);
+    process4.kill(process4.pid, signal);
   }
-  return previous[b.length] ?? 0;
+  for (const signal of SIGNALS)
+    process4.on(signal, onSignal);
+  return held;
 }
-var ANSI;
-var init_text = __esm(() => {
-  ANSI = new RegExp(`${String.fromCharCode(27)}\\[[\\d;?]*[a-z]`, "gi");
+async function runCommand(argv, { cwd, env, stdin = "ignore", timeoutMs, signal, maxBytes = Infinity, onChunk, onStart } = {}) {
+  const chunks = [];
+  const grouped = timeoutMs !== undefined || signal !== undefined || onStart !== undefined || onChunk !== undefined;
+  const proc = Bun.spawn(argv, { ...cwd === undefined ? {} : { cwd }, ...env === undefined ? {} : { env }, stdin, stdout: "pipe", stderr: "pipe", ...grouped ? { detached: true } : {} });
+  const state = { kept: 0, truncated: false, timedOut: false, failure: undefined, done: false };
+  const timers = [];
+  const killGroup = (killing) => {
+    if (state.done)
+      return;
+    try {
+      if (grouped)
+        process4.kill(-proc.pid, killing);
+      else
+        proc.kill(killing);
+    } catch {}
+  };
+  const stop = () => {
+    killGroup("SIGTERM");
+    timers.push(setTimeout(killGroup, KILL_GRACE_MS, "SIGKILL"));
+  };
+  const onAbort = () => stop();
+  if (timeoutMs !== undefined) {
+    timers.push(setTimeout(() => {
+      state.timedOut = true;
+      stop();
+    }, timeoutMs));
+  }
+  if (signal?.aborted === true)
+    onAbort();
+  else
+    signal?.addEventListener("abort", onAbort, { once: true });
+  onStart?.({ kill: (killing) => killGroup(killing) });
+  const drain = async (stream, name) => {
+    for await (const data of stream) {
+      if (state.failure !== undefined)
+        continue;
+      try {
+        onChunk?.({ stream: name, data });
+      } catch (error) {
+        state.failure = error;
+        stop();
+        continue;
+      }
+      if (state.kept + data.length > maxBytes) {
+        state.truncated = true;
+        continue;
+      }
+      state.kept += data.length;
+      chunks.push({ stream: name, data });
+    }
+  };
+  try {
+    await Promise.all([drain(proc.stdout, "stdout"), drain(proc.stderr, "stderr")]);
+    await proc.exited;
+  } finally {
+    state.done = true;
+    for (const timer of timers)
+      clearTimeout(timer);
+    signal?.removeEventListener("abort", onAbort);
+  }
+  if (state.failure !== undefined)
+    throw state.failure;
+  const joined = () => Buffer.concat(chunks.map(({ data }) => data));
+  let output;
+  let text;
+  return {
+    code: exitCodeOf(proc.exitCode, proc.signalCode),
+    chunks,
+    timedOut: state.timedOut,
+    truncated: state.truncated,
+    get output() {
+      return output ??= joined();
+    },
+    get text() {
+      return text ??= (output ??= joined()).toString();
+    }
+  };
+}
+var KILL_GRACE_MS = 2000, SIGNALS;
+var init_process = __esm(() => {
+  SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+});
+
+// ../kit/src/progress.ts
+import process5 from "process";
+function liveRegion(render, stream = process5.stderr, env = process5.env) {
+  if (!takesControlCodes(stream, env))
+    return { redraw: () => {
+      return;
+    }, print: (text) => void stream.write(`${text}
+`), stop: () => {
+      return;
+    } };
+  const write = stream.write.bind(stream);
+  let frame = 0;
+  let drawn = 0;
+  const clear = () => {
+    if (drawn > 0)
+      write(`${CLEAR_LINE}${LINE_UP.repeat(drawn - 1)}`);
+    drawn = 0;
+  };
+  const draw = () => {
+    const width = (stream.columns === undefined || stream.columns === 0 ? 80 : stream.columns) - 1;
+    const height = stream.rows === undefined || stream.rows === 0 ? 24 : stream.rows;
+    const lines = render(FRAMES[frame++ % FRAMES.length]).slice(0, Math.max(1, height - 1)).map((line) => cutToWidth(line, width));
+    if (lines.length === 0) {
+      clear();
+      return;
+    }
+    write(`${drawn > 0 ? `${CLEAR_LINE}${LINE_UP.repeat(drawn - 1)}` : CLEAR_LINE}${lines.join(`
+`)}`);
+    drawn = lines.length;
+  };
+  const timer = setInterval(draw, FRAME_MS);
+  const restore = interceptOutput(clear);
+  const onExit = () => clear();
+  const signals = holdSignals(stop);
+  function stop() {
+    clearInterval(timer);
+    clear();
+    restore();
+    process5.off("exit", onExit);
+    signals.release();
+  }
+  timer.unref();
+  process5.on("exit", onExit);
+  return {
+    redraw: draw,
+    print: (text) => {
+      clear();
+      write(`${text}
+`);
+      draw();
+    },
+    stop
+  };
+}
+function cutToWidth(line, width) {
+  if (Bun.stringWidth(line) <= width)
+    return line;
+  let room = width;
+  let kept = "";
+  let index = 0;
+  let linked = false;
+  while (index < line.length) {
+    ESCAPE_CODE.lastIndex = index;
+    const escape = ESCAPE_CODE.exec(line);
+    if (escape !== null) {
+      kept += escape[0];
+      linked ||= escape[0].startsWith(`${ESC}]`);
+      index = ESCAPE_CODE.lastIndex;
+      continue;
+    }
+    const char = String.fromCodePoint(line.codePointAt(index));
+    const columns = Bun.stringWidth(char);
+    if (columns > room)
+      break;
+    kept += char;
+    room -= columns;
+    index += char.length;
+  }
+  return `${kept}${RESET_STYLE}${linked ? CLOSE_LINK : ""}`;
+}
+function interceptOutput(clear) {
+  const targets = [...CONSOLE_METHODS.map((name) => [console, name]), [process5.stdout, "write"], [process5.stderr, "write"]];
+  const wrapped = targets.map(([target, name]) => {
+    const original = Reflect.get(target, name);
+    const wrapper = (...args) => {
+      clear();
+      return original.apply(target, args);
+    };
+    Reflect.set(target, name, wrapper);
+    return { target, name, original, wrapper };
+  });
+  return () => {
+    for (const { target, name, original, wrapper } of wrapped) {
+      if (Reflect.get(target, name) === wrapper)
+        Reflect.set(target, name, original);
+    }
+  };
+}
+var FRAMES, FRAME_MS = 80, CLEAR_LINE = "\r\x1B[2K", LINE_UP = "\x1B[1A\x1B[2K", ESC, ESCAPE_CODE, RESET_STYLE, CLOSE_LINK, CONSOLE_METHODS;
+var init_progress = __esm(() => {
+  init_format();
+  init_process();
+  init_style();
+  FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+  ESC = String.fromCharCode(27);
+  ESCAPE_CODE = new RegExp(`${ESC}(?:\\[[\\x30-\\x3F]*[\\x20-\\x2F]*[\\x40-\\x7E]|\\][^\\u0007${ESC}]*(?:\\u0007|${ESC}\\\\))`, "y");
+  RESET_STYLE = `${ESC}[0m`;
+  CLOSE_LINK = `${ESC}]8;;${ESC}\\`;
+  CONSOLE_METHODS = ["log", "info", "warn", "error", "debug", "dir", "dirxml", "table", "trace", "group", "groupCollapsed", "count", "timeEnd", "timeLog", "assert"];
+});
+
+// ../kit/src/tool.ts
+var init_tool = __esm(() => {
+  init_format();
+  init_process();
+});
+
+// ../kit/src/ci.ts
+var init_ci = __esm(() => {
+  init_args();
+  init_format();
+  init_progress();
+  init_tool();
 });
 
 // ../kit/src/cli.ts
-import process4 from "process";
-function commandRows(commands, colors) {
+import process6 from "process";
+async function commandRows(commands, colors) {
   const width = Math.max(...Object.keys(commands).map((name) => name.length));
   const groups = new Map([["Commands:", []]]);
-  for (const [name, { summary, group }] of Object.entries(commands)) {
+  const summaries = await Promise.all(Object.values(commands).map(async ({ summary }) => resolveSummary(summary)));
+  for (const [index, [name, { group }]] of Object.entries(commands).entries()) {
     const heading = group === undefined ? "Commands:" : `${group}:`;
     const rows = groups.get(heading) ?? [];
-    rows.push(`  ${colors.cyan(name.padEnd(width))}  ${colors.dim(summary)}`);
+    rows.push(`  ${colors.cyan(name.padEnd(width))}  ${colors.dim(summaries[index])}`);
     groups.set(heading, rows);
   }
   return [...groups].filter(([, rows]) => rows.length > 0).flatMap(([heading, rows], index) => [...index === 0 ? [] : [""], colors.bold(heading), ...rows]);
@@ -609,25 +926,38 @@ function takeOutputFlags(argv) {
   }
   return argv.slice(index);
 }
-function closest(name, names) {
-  const started = names.find((known) => known.startsWith(name));
-  if (started !== undefined)
-    return started;
-  const [best] = names.map((known) => ({ known, far: distance(name, known) })).sort((a, b) => a.far - b.far);
-  return best !== undefined && best.far <= (name.length < 4 ? 1 : 2) ? best.known : undefined;
+async function resolveSummary(summary) {
+  return typeof summary === "string" ? summary : summary();
+}
+function scopeOf(commands, extra, aliases) {
+  return { commands: typeof commands === "function" ? {} : commands, lazy: [...typeof commands === "function" ? [commands] : [], ...extra === undefined ? [] : [extra]], aliases };
 }
-async function help({ path, header, commands, defaultCommand, examples }, stream) {
+async function expand(scope, words) {
+  if (scope.lazy.length === 0)
+    return scope;
+  const commands = { ...scope.commands };
+  for (const added of await Promise.all(scope.lazy.map(async (lazy) => lazy(words)))) {
+    for (const [name, command] of Object.entries(added))
+      commands[name] ??= command;
+  }
+  return { ...scope, commands, lazy: [] };
+}
+async function help({ path, header, summary: lazySummary, commands, defaultCommand, examples, replaces }, stream) {
   const colors = paint(stream);
   const prefix = path.join(" ");
+  const summary = await resolveSummary(lazySummary);
+  if (wantsHelpJson())
+    return JSON.stringify(description(`${prefix} <command> [options]: ${summary}`, { examples, replaces }));
   const fallback = defaultCommand === undefined ? undefined : commands[defaultCommand];
   const options = fallback !== undefined && "run" in fallback ? await optionsOf(fallback.run) : undefined;
   const own = Object.entries(options ?? {}).filter(([name]) => !(name in TOP_OPTIONS));
   return [
-    header(colors),
+    header(colors, summary),
     "",
     usageLine(`${prefix} ${defaultCommand === undefined ? colors.cyan("<command>") : `[${colors.cyan("<command>")}]`} [options]`, colors),
+    ...replacesRows(replaces, colors),
     "",
-    ...commandRows(commands, colors),
+    ...await commandRows(commands, colors),
     ...own.length === 0 ? [] : ["", `${colors.bold(`Options of ${defaultCommand}:`)} ${colors.dim("the command run when none is named")}`, ...optionRows(Object.fromEntries(own), colors)],
     "",
     colors.bold("Options:"),
@@ -639,20 +969,28 @@ async function help({ path, header, commands, defaultCommand, examples }, stream
 `);
 }
 function printError(prefix, message, hint, cause) {
-  const colors = paint(process4.stderr);
-  const styled = takesControlCodes(process4.stderr);
+  const colors = paint(process6.stderr);
+  const styled = takesControlCodes(process6.stderr);
   const head = styled ? `${colors.red.bold("error")} ${colors.dim(`${prefix}:`)}` : `error: ${prefix}:`;
   const under = (label, text, tint) => text === undefined ? "" : `
   ${styled ? tint(label) : `${label}:`} ${text}`;
   console.error(`${head} ${message}${under("cause", cause, colors.dim)}${under("hint", hint, colors.yellow)}`);
 }
-function reportThrown(prefix, error, redact = (text) => text) {
+function printJsonError(message, hint, cause) {
+  console.error(JSON.stringify({ error: message, ...hint === undefined ? {} : { hint }, ...cause === undefined ? {} : { cause } }));
+}
+function wantsJson(argv) {
+  const end = argv.indexOf("--");
+  return (end === -1 ? argv : argv.slice(0, end)).includes("--json");
+}
+function reportThrown(prefix, error, redact = (text) => text, json = false) {
   if (error instanceof HelpShown)
     return 0;
   const help = error instanceof UsageError ? `run ${prefix} --help for its options` : undefined;
   const named = error instanceof Error && !(error instanceof Exit) && error.name !== "Error" ? `${error.name}: ${error.message}` : undefined;
   const cause = error instanceof Error && error.cause instanceof Error ? redact(error.cause.message) : undefined;
-  printError(prefix, redact(named ?? (error instanceof Error ? error.message : String(error))), error instanceof Exit ? error.hint ?? help : undefined, cause);
+  const report = json ? printJsonError : (message, hint, causeText) => printError(prefix, message, hint, causeText);
+  report(redact(named ?? (error instanceof Error ? error.message : String(error))), error instanceof Exit ? error.hint ?? help : undefined, cause);
   return error instanceof Exit ? error.code : 1;
 }
 async function dispatch(level, typed, { version, redact }) {
@@ -665,11 +1003,11 @@ async function dispatch(level, typed, { version, redact }) {
   }
   const [name, ...args] = argv;
   if (name === undefined && level.path.length > 1) {
-    console.error(await help(level, process4.stderr));
+    console.error(await help(await expand(level, [...level.path.slice(1), ...argv]), process6.stderr));
     return 2;
   }
   if (name === undefined || name === "help" || name === "--help" || name === "-h") {
-    console.log(await help(level, process4.stdout));
+    console.log(await help(await expand(level, [...level.path.slice(1), ...argv]), process6.stdout));
     return 0;
   }
   if (level.path.length === 1 && (name === "--version" || name === "-v")) {
@@ -678,6 +1016,10 @@ async function dispatch(level, typed, { version, redact }) {
   }
   let command = level.commands[level.aliases?.[name] ?? name];
   let rest = args;
+  if (command === undefined && level.lazy.length > 0) {
+    level = await expand(level, [...level.path.slice(1), ...argv]);
+    command = level.commands[level.aliases?.[name] ?? name];
+  }
   if (command === undefined && level.defaultCommand !== undefined) {
     command = level.commands[level.defaultCommand];
     rest = argv;
@@ -689,12 +1031,12 @@ async function dispatch(level, typed, { version, redact }) {
   }
   if ("commands" in command) {
     const { summary } = command;
-    return dispatch({ path: [...level.path, name], header: (colors) => `${colors.bold(`${prefix} ${name}`)}  ${summary}`, commands: command.commands, aliases: command.aliases, defaultCommand: undefined, examples: command.examples }, rest, { version, redact });
+    return dispatch({ path: [...level.path, name], header: (colors, text) => `${colors.bold(`${prefix} ${name}`)}  ${text}`, summary, ...scopeOf(command.commands, command.extraCommands, command.aliases), defaultCommand: undefined, examples: command.examples, replaces: undefined }, rest, { version, redact });
   }
   try {
     return await command.run(rest);
   } catch (error) {
-    return reportThrown(`${prefix} ${name}`, error, redact);
+    return reportThrown(`${prefix} ${name}`, error, redact, wantsJson(rest));
   }
 }
 async function optionsOf(run) {
@@ -712,28 +1054,34 @@ async function optionsOf(run) {
 async function leafCandidates(run, words) {
   if (!(words.at(-1) ?? "").startsWith("-"))
     return [FILES];
-  return Object.entries(await optionsOf(run)).map(([name, option]) => `--${name}	${option.description}`);
+  return Object.entries(await optionsOf(run)).map(([name, option]) => option.description === undefined ? `--${name}` : `--${name}	${option.description}`);
 }
-async function candidates(commands, aliases, defaultCommand, words) {
+async function candidates(scope, defaultCommand, words, before = []) {
   const [word = "", ...rest] = words;
-  const command = commands[aliases?.[word] ?? word];
-  if (rest.length === 0 && !word.startsWith("-"))
-    return Object.entries(commands).map(([name, { summary }]) => `${name}	${summary}`);
+  const listing = rest.length === 0 && !word.startsWith("-");
+  let { commands, aliases } = scope;
+  let command = commands[aliases?.[word] ?? word];
+  if (listing || command === undefined) {
+    ({ commands, aliases } = await expand(scope, [...before, ...words]));
+    command = commands[aliases?.[word] ?? word];
+  }
+  if (listing)
+    return Promise.all(Object.entries(commands).map(async ([name, { summary }]) => `${name}	${await resolveSummary(summary)}`));
   if (command === undefined) {
     const fallback = defaultCommand === undefined ? undefined : commands[defaultCommand];
     return fallback !== undefined && "run" in fallback ? leafCandidates(fallback.run, words) : [];
   }
-  return "commands" in command ? candidates(command.commands, command.aliases, undefined, rest) : leafCandidates(command.run, rest);
+  return "commands" in command ? candidates(scopeOf(command.commands, command.extraCommands, command.aliases), undefined, rest, [...before, word]) : leafCandidates(command.run, rest);
 }
 async function printCandidates(found) {
   for (const line of await found)
     console.log(line);
   return 0;
 }
-async function runCli(cli, argv = process4.argv.slice(2)) {
+async function runCli(cli, argv = process6.argv.slice(2)) {
   if (argv[0] === COMPLETE)
-    return printCandidates(candidates(cli.commands, cli.aliases, cli.defaultCommand, argv.slice(1)));
-  return dispatch({ path: [cli.name], header: (colors) => `${colors.bold(cli.name)} ${colors.dim(cli.version)}  ${cli.about}`, commands: cli.commands, aliases: cli.aliases, defaultCommand: cli.defaultCommand, examples: cli.examples }, argv, { version: cli.version, redact: cli.redact });
+    return printCandidates(candidates(scopeOf(cli.commands, cli.extraCommands, cli.aliases), cli.defaultCommand, argv.slice(1)));
+  return dispatch({ path: [cli.name], header: (colors, about) => `${colors.bold(cli.name)} ${colors.dim(cli.version)}  ${about}`, summary: cli.about, ...scopeOf(cli.commands, cli.extraCommands, cli.aliases), defaultCommand: cli.defaultCommand, examples: cli.examples, replaces: cli.replaces }, argv, { version: cli.version, redact: cli.redact });
 }
 var LEVEL_OPTIONS, TOP_OPTIONS, COMPLETE = "__complete", FILES = "__files__";
 var init_cli = __esm(() => {
@@ -752,74 +1100,388 @@ var init_config = __esm(() => {
   init_args();
 });
 
-// ../kit/src/process.ts
-import { constants } from "os";
-import process5 from "process";
-async function collect(stream, name, chunks) {
-  for await (const data of stream)
-    chunks.push({ stream: name, data });
+// ../kit/src/git.ts
+var init_git = __esm(() => {
+  init_args();
+  init_tool();
+});
+
+// ../kit/src/limit.ts
+function limitOptions(fallback) {
+  return {
+    limit: { type: "string", description: `show at most this many rows, the rest counted (${fallback})` },
+    full: { type: "boolean", description: "show every row" }
+  };
 }
-function exitCodeOf(code, signal) {
-  if (code !== null)
-    return code;
-  if (typeof signal === "number")
-    return 128 + signal;
-  return signal === null ? 129 : 128 + constants.signals[signal];
+function limitOf(values, fallback) {
+  if (values.full === true && values.limit !== undefined)
+    badUsage("--limit and --full exclude each other");
+  if (values.full === true || values.json === true && values.limit === undefined)
+    return Number.POSITIVE_INFINITY;
+  return wholeNumber(values.limit, "limit", fallback);
 }
-function holdSignals(cleanup) {
-  let received;
-  let child;
-  const held = {
-    get signal() {
-      return received;
-    },
-    forward: (to) => {
-      child = to;
-    },
-    release: () => {
-      for (const signal of SIGNALS)
-        process5.off(signal, onSignal);
-    }
-  };
-  function onSignal(signal) {
-    received = signal;
-    if (child !== undefined) {
-      child.kill(signal);
-      return;
-    }
-    if (cleanup === undefined)
-      return;
-    held.release();
-    cleanup(signal);
-    process5.kill(process5.pid, signal);
-  }
-  for (const signal of SIGNALS)
-    process5.on(signal, onSignal);
-  return held;
+function moreFooter(more) {
+  return `${more} more, rerun with --full`;
 }
-async function runCommand(argv, { cwd, env, stdin = "ignore" } = {}) {
-  const chunks = [];
-  const proc = Bun.spawn(argv, { ...cwd === undefined ? {} : { cwd }, ...env === undefined ? {} : { env }, stdin, stdout: "pipe", stderr: "pipe" });
-  await Promise.all([collect(proc.stdout, "stdout", chunks), collect(proc.stderr, "stderr", chunks)]);
-  await proc.exited;
-  const output = Buffer.concat(chunks.map(({ data }) => data));
-  return { code: exitCodeOf(proc.exitCode, proc.signalCode), chunks, output, text: output.toString() };
+function capped(rows, limit) {
+  const more = rows.length - limit;
+  return more > 0 ? { shown: rows.slice(0, limit), footer: moreFooter(more) } : { shown: [...rows], footer: undefined };
 }
-var SIGNALS;
-var init_process = __esm(() => {
-  SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+var init_limit = __esm(() => {
+  init_args();
+});
+
+// ../kit/src/logs.ts
+var DAY_MS;
+var init_logs = __esm(() => {
+  DAY_MS = 24 * 60 * 60 * 1000;
+});
+
+// ../kit/src/secrets.ts
+var SECRET_WORDS;
+var init_secrets = __esm(() => {
+  SECRET_WORDS = new Set(["key", "pass", "pwd", "auth", "salt", "cookie", "session", "jwt", "ssn", "iban", "card", "cvv", "otp"]);
 });
 
 // ../kit/src/index.ts
 var init_src = __esm(() => {
   init_args();
   init_chart();
+  init_ci();
   init_cli();
   init_config();
   init_format();
+  init_git();
+  init_limit();
+  init_logs();
   init_process();
+  init_secrets();
   init_style();
   init_text();
+  init_tool();
+});
+
+// src/registry.ts
+function isPublic(registry) {
+  return registry.url.replace(TRAILING_SLASHES, "") === PUBLIC_REGISTRY;
+}
+function unreachable(message) {
+  return fail(`could not check: ${message}`, 2);
+}
+function requestInit(token) {
+  return { headers: { accept: "application/json", ...token === undefined ? {} : { authorization: `Bearer ${token}` } }, signal: AbortSignal.timeout(REQUEST_TIMEOUT) };
+}
+async function get(fetcher, url, token) {
+  try {
+    return await fetcher(url, requestInit(token));
+  } catch (error) {
+    return unreachable(`cannot reach ${new URL(url).host}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function isValidName(name) {
+  return PACKAGE_NAME.test(name) && name.length <= 214;
+}
+async function fetchPackument(name, registry, fetcher = fetch) {
+  if (!isValidName(name))
+    fail(`${name} is not a valid npm package name`);
+  const response = await get(fetcher, `${registry.url.replace(TRAILING_SLASHES, "")}/${encodeURIComponent(name).replace("%40", "@").replace("%2F", "%2f")}`, registry.token);
+  if (response.status === 404)
+    return;
+  if (!response.ok)
+    unreachable(`${new URL(registry.url).host} answered ${response.status} for ${name}`);
+  let packument;
+  try {
+    packument = await response.json();
+  } catch {
+    return unreachable(`${new URL(registry.url).host} answered ${name} with something that is not JSON`);
+  }
+  if (packument?.name !== name)
+    unreachable(`${new URL(registry.url).host} answered ${name} with the metadata of ${String(packument?.name)}`);
+  return packument;
+}
+async function fetchDownloads(name, fetcher = fetch) {
+  const response = await get(fetcher, `${DOWNLOADS_API}/${encodeURIComponent(name)}`);
+  if (!response.ok)
+    return;
+  try {
+    return (await response.json()).downloads;
+  } catch {
+    return;
+  }
+}
+var PUBLIC_REGISTRY = "https://registry.npmjs.org", DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week", TRAILING_SLASHES, REQUEST_TIMEOUT = 1e4, PACKAGE_NAME;
+var init_registry = __esm(() => {
+  init_src();
+  TRAILING_SLASHES = /\/+$/;
+  PACKAGE_NAME = /^(?:@[\w~-][\w.~-]*\/)?[\w~-][\w.~-]*$/;
+});
+
+// src/config.ts
+import { homedir } from "os";
+import { dirname, join } from "path";
+import process8 from "process";
+function expand2(value, env) {
+  let missing = false;
+  const expanded = value.replace(ENV_REFERENCE, (_, braced, bare) => {
+    const found = env[braced ?? bare ?? ""];
+    missing ||= found === undefined;
+    return found ?? "";
+  });
+  return missing ? undefined : expanded;
+}
+function literal(value) {
+  return expand2(value, {}) === value ? value : undefined;
+}
+function parseNpmrc(text, env) {
+  const config = { scopes: {}, tokens: {}, scopeTokens: {} };
+  for (const line of text.split(`
+`)) {
+    const at = line.indexOf("=");
+    if (at === -1 || COMMENT.test(line))
+      continue;
+    const key = line.slice(0, at).trim();
+    const scope = SCOPE_REGISTRY.exec(key)?.[1];
+    const tokenFor = AUTH_TOKEN.exec(key)?.[1];
+    const raw = line.slice(at + 1).trim().replace(QUOTES, "$2");
+    const value = tokenFor === undefined ? literal(raw) : expand2(raw, env);
+    if (value === undefined || value === "")
+      continue;
+    if (scope !== undefined)
+      config.scopes[scope] = value;
+    else if (tokenFor !== undefined)
+      config.tokens[tokenFor] = value;
+    else if (key === "registry")
+      config.registry = value;
+  }
+  return config;
+}
+function bunEntry(entry, env) {
+  const url = typeof entry === "string" ? entry : entry.url;
+  const token = typeof entry === "string" || entry.token === undefined ? undefined : expand2(entry.token, env);
+  return { ...url === undefined || literal(url) === undefined ? {} : { url }, ...token === undefined ? {} : { token } };
+}
+function parseBunfig(text, env) {
+  const config = { scopes: {}, tokens: {}, scopeTokens: {} };
+  const install = Bun.TOML.parse(text).install;
+  if (install?.registry !== undefined) {
+    const { url, token } = bunEntry(install.registry, env);
+    if (url !== undefined)
+      config.registry = url;
+    if (url !== undefined && token !== undefined)
+      config.tokens[url.replace(PROTOCOL, "")] = token;
+  }
+  for (const [scope, entry] of Object.entries(install?.scopes ?? {})) {
+    const { url, token } = bunEntry(entry, env);
+    if (url !== undefined)
+      config.scopes[scope.startsWith("@") ? scope : `@${scope}`] = url;
+    if (token !== undefined)
+      config.scopeTokens[scope.startsWith("@") ? scope : `@${scope}`] = token;
+  }
+  return config;
+}
+function tokenFor(config, url) {
+  const address = `${url.replace(PROTOCOL, "").replace(TRAILING_SLASHES2, "")}/`;
+  const best = Object.keys(config.tokens).filter((key) => address.startsWith(`${key.replace(TRAILING_SLASHES2, "")}/`)).sort((a, b) => b.length - a.length)[0];
+  return best === undefined ? undefined : config.tokens[best];
+}
+function mayCarryToken(url) {
+  const { protocol, hostname } = new URL(url);
+  return protocol === "https:" || LOCAL_HOSTS.has(hostname);
+}
+function registryFor(name, configs) {
+  const scope = name.startsWith("@") ? name.slice(0, name.indexOf("/")) : undefined;
+  const scoped = scope === undefined ? undefined : configs.find((config) => config.scopes[scope] !== undefined);
+  const url = (scope === undefined ? undefined : scoped?.scopes[scope]) ?? configs.find((config) => config.registry !== undefined)?.registry;
+  if (url === undefined)
+    return { url: PUBLIC_REGISTRY };
+  const token = (scope === undefined ? undefined : scoped?.scopeTokens[scope]) ?? configs.map((other) => tokenFor(other, url)).find((found) => found !== undefined);
+  return { url, token: mayCarryToken(url) ? token : undefined };
+}
+function readable(path, parse) {
+  try {
+    return parse();
+  } catch (error) {
+    return unreachable(`${path} cannot be read: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function readIfThere(path) {
+  const file = Bun.file(path);
+  return await file.exists() ? file.text() : undefined;
+}
+async function loadConfigs(cwd = process8.cwd(), env = process8.env, home = homedir()) {
+  const directories = [];
+  for (let dir = cwd;!directories.includes(dir); dir = dirname(dir))
+    directories.push(dir);
+  if (!directories.includes(home))
+    directories.push(home);
+  const configs = [];
+  for (const dir of directories) {
+    const bunfig = await readIfThere(join(dir, "bunfig.toml"));
+    const npmrc = await readIfThere(join(dir, ".npmrc"));
+    if (bunfig !== undefined)
+      configs.push(readable(join(dir, "bunfig.toml"), () => parseBunfig(bunfig, env)));
+    if (npmrc !== undefined)
+      configs.push(parseNpmrc(npmrc, env));
+  }
+  return configs;
+}
+function isSeverity(value) {
+  return SEVERITIES.includes(value);
+}
+function parseSettings(text) {
+  const raw = Bun.JSONC.parse(text);
+  const settings = {};
+  if (Array.isArray(raw?.licenses) && raw.licenses.every((each) => typeof each === "string"))
+    settings.licenses = raw.licenses;
+  if (isSeverity(raw?.blockSeverity))
+    settings.blockSeverity = raw.blockSeverity;
+  return settings;
+}
+async function loadSettings(cwd = process8.cwd(), home = homedir()) {
+  const files = [];
+  for (let dir = cwd;!files.includes(join(dir, SETTINGS_FILE)); dir = dirname(dir))
+    files.push(join(dir, SETTINGS_FILE));
+  files.push(join(home, ".config", "pkg", "config.json"));
+  const settings = {};
+  for (const file of files) {
+    const text = await readIfThere(file);
+    if (text === undefined)
+      continue;
+    const found = readable(file, () => parseSettings(text));
+    settings.licenses ??= found.licenses;
+    settings.blockSeverity ??= found.blockSeverity;
+  }
+  return settings;
+}
+var ENV_REFERENCE, COMMENT, SCOPE_REGISTRY, AUTH_TOKEN, PROTOCOL, TRAILING_SLASHES2, LOCAL_HOSTS, QUOTES, SEVERITIES, DEFAULT_BLOCK_SEVERITY = "high", SETTINGS_FILE = ".pkgrc.json";
+var init_config2 = __esm(() => {
+  init_registry();
+  ENV_REFERENCE = /\$\{(\w+)\}|\$(\w+)/g;
+  COMMENT = /^\s*[#;]/;
+  SCOPE_REGISTRY = /^(@[^:]+):registry$/;
+  AUTH_TOKEN = /^(\/\/.+?):_authToken$/;
+  PROTOCOL = /^\w+:/;
+  TRAILING_SLASHES2 = /\/+$/;
+  LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+  QUOTES = /^(["'])(.*)\1$/;
+  SEVERITIES = ["low", "moderate", "high", "critical"];
+});
+
+// src/semver.ts
+function isRange(text) {
+  if (text.trim() === "")
+    return true;
+  return text.split(OR).every((alternative) => {
+    const words = alternative.trim().split(WHITESPACE);
+    return words.every((word, index) => word === "-" ? index > 0 && index < words.length - 1 : COMPARATOR.test(word));
+  });
+}
+function compare(version, word) {
+  const bound = BOUND.exec(word);
+  if (bound === null)
+    return;
+  const order = Bun.semver.order(version, bound[2] ?? "");
+  const operator = bound[1] ?? "=";
+  if (operator === "<")
+    return order < 0;
+  if (operator === "<=")
+    return order <= 0;
+  if (operator === ">")
+    return order > 0;
+  return operator === ">=" ? order >= 0 : order === 0;
+}
+function inRange(version, range) {
+  if (Bun.semver.satisfies(version, range))
+    return true;
+  if (!PRERELEASE.test(version))
+    return false;
+  return range.split(OR).some((alternative) => alternative.trim().split(WHITESPACE).every((word) => compare(version, word) ?? Bun.semver.satisfies(version, word)));
+}
+var OR, WHITESPACE, PRERELEASE, PART, COMPARATOR, BOUND, EXACT_VERSION;
+var init_semver = __esm(() => {
+  OR = /\s*\|\|\s*/;
+  WHITESPACE = /\s+/;
+  PRERELEASE = /-/;
+  PART = String.raw`(?:\d+|[xX*])`;
+  COMPARATOR = new RegExp(String.raw`^(?:[<>]=?|=|\^|~>?)?v?${PART}(?:\.${PART}){0,2}(?:-[\w.-]+)?(?:\+[\w.-]+)?$`);
+  BOUND = /^(<=|>=|[<>=])?v?(\d+\.\d+\.\d+(?:-[\w.-]+)?)$/;
+  EXACT_VERSION = /^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/;
+});
+
+// src/advisories.ts
+function severityRank(severity) {
+  return SEVERITIES.indexOf(severity);
+}
+function fixedVersion(vulnerable, version) {
+  const range = vulnerable.split("||").map((each) => each.trim()).find((each) => inRange(version, each));
+  return range === undefined ? undefined : UPPER_BOUND.exec(range)?.[1];
+}
+async function fetchAdvisories(versions, registry, fetcher = fetch) {
+  const url = `${registry.url.replace(TRAILING_SLASHES3, "")}${BULK_PATH}`;
+  const host = new URL(registry.url).host;
+  let response;
+  try {
+    response = await fetcher(url, {
+      method: "POST",
+      headers: { accept: "application/json", "content-type": "application/json", ...registry.token === undefined ? {} : { authorization: `Bearer ${registry.token}` } },
+      body: JSON.stringify(versions),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT2)
+    });
+  } catch (error) {
+    return { found: {}, unavailable: `cannot reach ${host} for advisories: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  if (NO_ENDPOINT.has(response.status))
+    return { found: {}, isUnsupported: true, unavailable: `${host} has no advisory endpoint` };
+  if (!response.ok)
+    return { found: {}, unavailable: `${host} answered ${response.status} for advisories` };
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    return { found: {}, unavailable: `${host} answered advisories with something that is not JSON` };
+  }
+  const found = {};
+  for (const [name, raws] of Object.entries(body)) {
+    if (!Array.isArray(raws))
+      continue;
+    found[name] = raws.filter((raw) => SEVERITIES.includes(raw.severity)).map((raw) => ({
+      id: raw.id,
+      ghsa: GHSA.exec(raw.url)?.[0],
+      url: raw.url,
+      title: raw.title,
+      severity: raw.severity,
+      vulnerable: raw.vulnerable_versions
+    }));
+  }
+  return { found };
+}
+function advisoriesFor(advisories, version) {
+  return (advisories ?? []).filter((each) => inRange(version, each.vulnerable)).map((each) => ({ ...each, fixed: fixedVersion(each.vulnerable, version) }));
+}
+function filterAdvisories(advisories, level, ignore = []) {
+  return advisories.filter((each) => severityRank(each.severity) >= severityRank(level) && !ignore.includes(each.ghsa ?? "") && !ignore.includes(String(each.id)));
+}
+var BULK_PATH = "/-/npm/v1/security/advisories/bulk", TRAILING_SLASHES3, REQUEST_TIMEOUT2 = 1e4, GHSA, UPPER_BOUND, NO_ENDPOINT;
+var init_advisories = __esm(() => {
+  init_config2();
+  init_semver();
+  TRAILING_SLASHES3 = /\/+$/;
+  GHSA = /GHSA-[\w-]+$/;
+  UPPER_BOUND = /(?:^|\s)<([\w.+-]+)/;
+  NO_ENDPOINT = new Set([404, 405, 501]);
+});
+
+// src/licenses.ts
+function isLicenseAllowed(expression, allowed) {
+  const known = new Set(allowed.map((each) => each.toLowerCase()));
+  return expression.replace(PARENS, " ").trim().split(OR_SPLIT).some((alternative) => alternative.split(AND_SPLIT).every((term) => known.has(term.replace(WITH_EXCEPTION, "").trim().toLowerCase())));
+}
+var OR_SPLIT, AND_SPLIT, WITH_EXCEPTION, PARENS;
+var init_licenses = __esm(() => {
+  OR_SPLIT = /\s+OR\s+/i;
+  AND_SPLIT = /\s+AND\s+/i;
+  WITH_EXCEPTION = /\s+WITH\s+\S+$/i;
+  PARENS = /[()]/g;
 });
 
 // src/popular.json
@@ -1333,20 +1995,23 @@ var init_popular = __esm(() => {
 function baseName(name) {
   return name.slice(name.indexOf("/") + 1);
 }
-function scopeOf(name) {
+function scopeOf2(name) {
   return name.startsWith("@") ? name.slice(0, name.indexOf("/")) : "";
 }
 function squash(name) {
   return name.toLowerCase().replace(SEPARATORS, "");
 }
 function resemblance(name, popular) {
-  if (scopeOf(name) !== scopeOf(popular) && baseName(name) === baseName(popular) && baseName(name).length >= MIN_LENGTH)
+  if (scopeOf2(name) !== scopeOf2(popular) && baseName(name) === baseName(popular) && baseName(name).length >= MIN_LENGTH)
     return `${popular} under another scope`;
   if (squash(name) === squash(popular))
     return `${popular} spelled with other separators or case`;
+  const shortest = Math.min(name.length, popular.length);
+  const allowed = shortest >= MIN_LENGTH * 2 ? 2 : 1;
+  if (shortest < MIN_LENGTH || Math.abs(name.length - popular.length) > allowed)
+    return;
   const edits = distance(name, popular);
-  const allowed = Math.min(name.length, popular.length) >= MIN_LENGTH * 2 ? 2 : 1;
-  return Math.min(name.length, popular.length) >= MIN_LENGTH && edits <= allowed ? `${popular}, ${edits} ${edits === 1 ? "edit" : "edits"} away` : undefined;
+  return edits <= allowed ? `${popular}, ${edits} ${edits === 1 ? "edit" : "edits"} away` : undefined;
 }
 function nearMisses(name, popular = popular_default) {
   if (popular.includes(name))
@@ -1382,6 +2047,8 @@ function resolve(packument, request) {
     return tags[wanted];
   if (versions.includes(wanted))
     return wanted;
+  if (!isRange(wanted))
+    return;
   return versions.filter((version) => Bun.semver.satisfies(version, wanted)).sort(Bun.semver.order).at(-1);
 }
 function licenseOf(license) {
@@ -1405,7 +2072,7 @@ function safeRelease(packument, now, minAgeDays) {
 }
 function analyze(input) {
   const { spec, packument, registry, now = Date.now(), minAgeDays = DEFAULT_MIN_AGE_DAYS } = input;
-  const report = { name: spec.name, registry, exists: packument !== undefined, requested: spec.request, installScripts: {}, nearMisses: nearMisses(spec.name), warnings: [], blocked: false, downloads: input.downloads };
+  const report = { name: spec.name, registry, exists: packument !== undefined, requested: spec.request, installScripts: {}, nearMisses: nearMisses(spec.name), advisories: input.advisories ?? [], warnings: [], blocked: false, downloads: input.downloads };
   if (report.nearMisses.length > 0)
     report.warnings.push(`name looks like ${report.nearMisses.join("; ")}, check it is the package meant`);
   if (packument === undefined) {
@@ -1432,7 +2099,9 @@ function analyze(input) {
   }
   const age = ageDays(report.published, now);
   if (age === undefined) {
-    report.warnings.push(`${registry} gives no publish date for ${version}, its age cannot be checked`);
+    const isBlocking = minAgeDays > 0 && registry === PUBLIC_HOST;
+    report.blocked ||= isBlocking;
+    report.warnings.push(`${registry} gives no publish date for ${version}, its age cannot be checked${isBlocking ? " and it is refused" : ""}`);
   } else if (age < minAgeDays) {
     report.blocked = true;
     report.warnings.push(`${version} was published ${age < 1 ? "less than a day" : `${Math.floor(age)} day${Math.floor(age) === 1 ? "" : "s"}`} ago, under ${minAgeDays} days${report.safe === undefined ? ", and no older stable version exists" : `, use ${spec.name}@${report.safe.version}`}`);
@@ -1442,166 +2111,61 @@ function analyze(input) {
     report.warnings.push(`${version} runs ${scripts.join(", ")} at install`);
   if (report.deprecated !== undefined)
     report.warnings.push(`${version} is deprecated: ${report.deprecated}`);
+  if (input.licenses !== undefined) {
+    const isMissing = report.license === undefined || report.license === "";
+    if (isMissing) {
+      report.blocked = true;
+      report.warnings.push(`${version} declares no licence, and the allowlist needs one`);
+    } else if (!isLicenseAllowed(report.license ?? "", input.licenses)) {
+      report.blocked = true;
+      report.warnings.push(`licence ${report.license} is not in the allowlist (${input.licenses.join(", ")})`);
+    }
+  }
+  if (input.blockSeverity !== undefined) {
+    const blocking = filterAdvisories(report.advisories, input.blockSeverity);
+    if (blocking.length > 0) {
+      report.blocked = true;
+      report.warnings.push(`${version} has ${blocking.length} advisor${blocking.length === 1 ? "y" : "ies"} at ${input.blockSeverity} or above: ${blocking.map((each) => each.ghsa ?? each.id).join(", ")}`);
+    }
+  }
   return report;
 }
-var DEFAULT_MIN_AGE_DAYS = 14, DAY = 86400000, INSTALL_SCRIPTS, GIT_PREFIX, VERSION_SEPARATOR;
+var DEFAULT_MIN_AGE_DAYS = 14, DAY = 86400000, PUBLIC_HOST, INSTALL_SCRIPTS, GIT_PREFIX, VERSION_SEPARATOR;
 var init_analyze = __esm(() => {
+  init_advisories();
+  init_licenses();
   init_nearmiss();
+  init_registry();
+  init_semver();
+  PUBLIC_HOST = new URL(PUBLIC_REGISTRY).host;
   INSTALL_SCRIPTS = ["preinstall", "install", "postinstall"];
   GIT_PREFIX = /^git\+/;
   VERSION_SEPARATOR = /(?<=.)@/;
 });
 
-// src/registry.ts
-function isPublic(registry) {
-  return registry.url.replace(TRAILING_SLASHES, "") === PUBLIC_REGISTRY;
-}
-async function get(fetcher, url, token) {
-  try {
-    return await fetcher(url, { headers: { accept: "application/json", ...token === undefined ? {} : { authorization: `Bearer ${token}` } } });
-  } catch (error) {
-    return fail(`cannot reach ${new URL(url).host}: ${error instanceof Error ? error.message : String(error)}`, 1);
-  }
-}
-async function fetchPackument(name, registry, fetcher = fetch) {
-  const response = await get(fetcher, `${registry.url.replace(TRAILING_SLASHES, "")}/${name.replace("/", "%2f")}`, registry.token);
-  if (response.status === 404)
-    return;
-  if (!response.ok)
-    fail(`${new URL(registry.url).host} answered ${response.status} for ${name}`, 1);
-  return await response.json();
-}
-async function fetchDownloads(name, fetcher = fetch) {
-  const response = await get(fetcher, `${DOWNLOADS_API}/${name}`);
-  if (!response.ok)
-    return;
-  const body = await response.json();
-  return body.downloads;
-}
-var PUBLIC_REGISTRY = "https://registry.npmjs.org", DOWNLOADS_API = "https://api.npmjs.org/downloads/point/last-week", TRAILING_SLASHES;
-var init_registry = __esm(() => {
-  init_src();
-  TRAILING_SLASHES = /\/+$/;
-});
-
-// src/config.ts
-import { homedir } from "os";
-import { dirname, join } from "path";
-import process7 from "process";
-function expand(value, env) {
-  let missing = false;
-  const expanded = value.replace(ENV_REFERENCE, (_, braced, bare) => {
-    const found = env[braced ?? bare ?? ""];
-    missing ||= found === undefined;
-    return found ?? "";
-  });
-  return missing ? undefined : expanded;
-}
-function parseNpmrc(text, env) {
-  const config = { scopes: {}, tokens: {}, scopeTokens: {} };
-  for (const line of text.split(`
-`)) {
-    const at = line.indexOf("=");
-    if (at === -1 || COMMENT.test(line))
-      continue;
-    const key = line.slice(0, at).trim();
-    const value = expand(line.slice(at + 1).trim().replace(QUOTES, "$2"), env);
-    if (value === undefined || value === "")
-      continue;
-    const scope = SCOPE_REGISTRY.exec(key)?.[1];
-    const tokenFor = AUTH_TOKEN.exec(key)?.[1];
-    if (scope !== undefined)
-      config.scopes[scope] = value;
-    else if (tokenFor !== undefined)
-      config.tokens[tokenFor] = value;
-    else if (key === "registry")
-      config.registry = value;
-  }
-  return config;
-}
-function bunEntry(entry, env) {
-  const url = typeof entry === "string" ? entry : entry.url;
-  const token = typeof entry === "string" || entry.token === undefined ? undefined : expand(entry.token, env);
-  return { ...url === undefined ? {} : { url: expand(url, env) ?? url }, ...token === undefined ? {} : { token } };
-}
-function parseBunfig(text, env) {
-  const config = { scopes: {}, tokens: {}, scopeTokens: {} };
-  const install = Bun.TOML.parse(text).install;
-  if (install?.registry !== undefined) {
-    const { url, token } = bunEntry(install.registry, env);
-    if (url !== undefined)
-      config.registry = url;
-    if (url !== undefined && token !== undefined)
-      config.tokens[url.replace(PROTOCOL, "")] = token;
-  }
-  for (const [scope, entry] of Object.entries(install?.scopes ?? {})) {
-    const { url, token } = bunEntry(entry, env);
-    if (url !== undefined)
-      config.scopes[scope.startsWith("@") ? scope : `@${scope}`] = url;
-    if (token !== undefined)
-      config.scopeTokens[scope.startsWith("@") ? scope : `@${scope}`] = token;
-  }
-  return config;
-}
-function tokenFor(config, url) {
-  const address = url.replace(PROTOCOL, "");
-  const best = Object.keys(config.tokens).filter((key) => address.startsWith(key)).sort((a, b) => b.length - a.length)[0];
-  return best === undefined ? undefined : config.tokens[best];
-}
-function registryFor(name, configs) {
-  const scope = name.startsWith("@") ? name.slice(0, name.indexOf("/")) : undefined;
-  for (const config of configs) {
-    const url = scope === undefined ? config.registry : config.scopes[scope] ?? config.registry;
-    if (url === undefined)
-      continue;
-    const token = (scope === undefined ? undefined : config.scopeTokens[scope]) ?? tokenFor(config, url) ?? configs.map((other) => tokenFor(other, url)).find((found) => found !== undefined);
-    return { url, token };
-  }
-  return { url: PUBLIC_REGISTRY };
-}
-async function readIfThere(path) {
-  const file = Bun.file(path);
-  return await file.exists() ? file.text() : undefined;
-}
-async function loadConfigs(cwd = process7.cwd(), env = process7.env, home = homedir()) {
-  const directories = [];
-  for (let dir = cwd;!directories.includes(dir); dir = dirname(dir))
-    directories.push(dir);
-  if (!directories.includes(home))
-    directories.push(home);
-  const configs = [];
-  for (const dir of directories) {
-    const bunfig = await readIfThere(join(dir, "bunfig.toml"));
-    const npmrc = await readIfThere(join(dir, ".npmrc"));
-    if (bunfig !== undefined)
-      configs.push(parseBunfig(bunfig, env));
-    if (npmrc !== undefined)
-      configs.push(parseNpmrc(npmrc, env));
-  }
-  return configs;
-}
-var ENV_REFERENCE, COMMENT, SCOPE_REGISTRY, AUTH_TOKEN, PROTOCOL, QUOTES;
-var init_config2 = __esm(() => {
-  init_registry();
-  ENV_REFERENCE = /\$\{(\w+)\}|\$(\w+)/g;
-  COMMENT = /^\s*[#;]/;
-  SCOPE_REGISTRY = /^(@[^:]+):registry$/;
-  AUTH_TOKEN = /^(\/\/.+?):_authToken$/;
-  PROTOCOL = /^\w+:/;
-  QUOTES = /^(["'])(.*)\1$/;
-});
-
 // src/commands/check.ts
 var exports_check = {};
 __export(exports_check, {
-  check: () => check
+  check: () => check,
+  checkPackage: () => checkPackage
 });
 async function checkPackage(text, context) {
   const spec = parseSpec(text);
   const registry = registryFor(spec.name, context.configs);
   const packument = await fetchPackument(spec.name, registry, context.fetcher);
   const downloads = packument !== undefined && isPublic(registry) ? await fetchDownloads(spec.name, context.fetcher) : undefined;
-  return analyze({ spec, packument, downloads, registry: new URL(registry.url).host, now: context.now, minAgeDays: context.minAgeDays });
+  const input = { spec, packument, downloads, registry: new URL(registry.url).host, now: context.now, minAgeDays: context.minAgeDays, licenses: context.settings?.licenses };
+  const report = analyze(input);
+  const blockSeverity = context.settings?.blockSeverity ?? DEFAULT_BLOCK_SEVERITY;
+  if (report.version === undefined)
+    return report;
+  const { found, unavailable, isUnsupported } = await fetchAdvisories({ [spec.name]: [report.version] }, registry, context.fetcher);
+  if (unavailable !== undefined && isUnsupported !== true)
+    return unreachable(unavailable);
+  const checked = analyze({ ...input, blockSeverity, advisories: advisoriesFor(found[spec.name], report.version) });
+  if (unavailable !== undefined)
+    checked.warnings.push(`${unavailable}, so its known advisories are not checked`);
+  return checked;
 }
 function when(release, now) {
   return release?.published === undefined ? "" : `, published ${formatAge(release.published, now)} (${release.published.slice(0, 10)})`;
@@ -1634,7 +2198,7 @@ async function check(args) {
     fail(`a package name is needed
 
 ${usage}`);
-  const context = { configs: await loadConfigs(), minAgeDays: wholeNumber(values["min-age"], "min-age", DEFAULT_MIN_AGE_DAYS, 0) };
+  const context = { configs: await loadConfigs(), settings: await loadSettings(), minAgeDays: wholeNumber(values["min-age"], "min-age", DEFAULT_MIN_AGE_DAYS, 0) };
   const reports = await Promise.all(positionals.map(async (text) => checkPackage(text, context)));
   if (values.json === true)
     printJson(reports.length === 1 ? reports[0] : reports);
@@ -1647,9 +2211,13 @@ ${usage}`);
 var usage = `pkg [check] <name>[@version]...
 
 Checks npm packages before they are added: whether the name exists, the latest and the newest version at least two weeks old, weekly downloads, licence, repository, install scripts and a near miss of a popular name.
-Exits 1 when a package is missing or the version asked for is under the minimum age.`, options;
+
+A \`.pkgrc.json\` (or ~/.config/pkg/config.json) with \`licenses\` (SPDX ids) refuses a licence outside the list or a missing one, and \`blockSeverity\` (low, moderate, high, critical; high when unset) refuses a version with an advisory at that level or above.
+
+Exits 0 when every package passes, 1 when one is blocked (missing, the version asked for is under the minimum age or has no date, its licence is outside the allowlist or an advisory reaches the threshold), 2 when it could not check (the registry unreachable, slow or answering badly, a broken .pkgrc.json, bunfig.toml or .npmrc) or on a usage error.`, options;
 var init_check = __esm(() => {
   init_src();
+  init_advisories();
   init_analyze();
   init_config2();
   init_registry();
@@ -1659,125 +2227,176 @@ var init_check = __esm(() => {
   };
 });
 
-// ../kit/src/progress.ts
-import process8 from "process";
-function liveRegion(render, stream = process8.stderr, env = process8.env) {
-  if (!takesControlCodes(stream, env))
-    return { redraw: () => {
-      return;
-    }, print: (text) => void stream.write(`${text}
-`), stop: () => {
-      return;
-    } };
-  const write = stream.write.bind(stream);
-  let frame = 0;
-  let drawn = 0;
-  const clear = () => {
-    if (drawn > 0)
-      write(`${CLEAR_LINE}${LINE_UP.repeat(drawn - 1)}`);
-    drawn = 0;
-  };
-  const draw = () => {
-    const width = (stream.columns === undefined || stream.columns === 0 ? 80 : stream.columns) - 1;
-    const height = stream.rows === undefined || stream.rows === 0 ? 24 : stream.rows;
-    const lines = render(FRAMES[frame++ % FRAMES.length]).slice(0, Math.max(1, height - 1)).map((line) => cutToWidth(line, width));
-    if (lines.length === 0) {
-      clear();
-      return;
-    }
-    write(`${drawn > 0 ? `${CLEAR_LINE}${LINE_UP.repeat(drawn - 1)}` : CLEAR_LINE}${lines.join(`
-`)}`);
-    drawn = lines.length;
-  };
-  const timer = setInterval(draw, FRAME_MS);
-  const restore = interceptOutput(clear);
-  const onExit = () => clear();
-  const signals = holdSignals(stop);
-  function stop() {
-    clearInterval(timer);
-    clear();
-    restore();
-    process8.off("exit", onExit);
-    signals.release();
-  }
-  timer.unref();
-  process8.on("exit", onExit);
-  return {
-    redraw: draw,
-    print: (text) => {
-      clear();
-      write(`${text}
-`);
-      draw();
-    },
-    stop
-  };
-}
-function cutToWidth(line, width) {
-  if (Bun.stringWidth(line) <= width)
-    return line;
-  let room = width;
-  let kept = "";
-  let index = 0;
-  let linked = false;
-  while (index < line.length) {
-    ESCAPE_CODE.lastIndex = index;
-    const escape = ESCAPE_CODE.exec(line);
-    if (escape !== null) {
-      kept += escape[0];
-      linked ||= escape[0].startsWith(`${ESC}]`);
-      index = ESCAPE_CODE.lastIndex;
+// src/lockfile.ts
+function split(resolution) {
+  const at = resolution.search(VERSION_SEPARATOR2);
+  if (at === -1)
+    return;
+  const target = resolution.slice(at + 1);
+  if (target.startsWith(NPM_ALIAS))
+    return split(target.slice(NPM_ALIAS.length));
+  return NOT_REGISTRY.test(target) ? undefined : { name: resolution.slice(0, at), version: target };
+}
+function parseBunLock(text) {
+  const lock = Bun.JSONC.parse(text);
+  const seen = new Map;
+  for (const entry of Object.values(lock?.packages ?? {})) {
+    const resolution = entry[0];
+    if (typeof resolution !== "string")
       continue;
-    }
-    const char = String.fromCodePoint(line.codePointAt(index));
-    const columns = Bun.stringWidth(char);
-    if (columns > room)
-      break;
-    kept += char;
-    room -= columns;
-    index += char.length;
+    const locked = split(resolution);
+    if (locked !== undefined)
+      seen.set(`${locked.name}@${locked.version}`, locked);
   }
-  return `${kept}${RESET_STYLE}${linked ? CLOSE_LINK : ""}`;
+  return [...seen.values()].sort((a, b) => a.name.localeCompare(b.name) || Bun.semver.order(a.version, b.version));
 }
-function interceptOutput(clear) {
-  const targets = [...CONSOLE_METHODS.map((name) => [console, name]), [process8.stdout, "write"], [process8.stderr, "write"]];
-  const wrapped = targets.map(([target, name]) => {
-    const original = Reflect.get(target, name);
-    const wrapper = (...args) => {
-      clear();
-      return original.apply(target, args);
-    };
-    Reflect.set(target, name, wrapper);
-    return { target, name, original, wrapper };
-  });
-  return () => {
-    for (const { target, name, original, wrapper } of wrapped) {
-      if (Reflect.get(target, name) === wrapper)
-        Reflect.set(target, name, original);
-    }
+var NOT_REGISTRY, VERSION_SEPARATOR2, NPM_ALIAS = "npm:";
+var init_lockfile = __esm(() => {
+  NOT_REGISTRY = /^(?:workspace|link|file|github|git|http|https):|^[\w.-]+\/[\w.-]+$/;
+  VERSION_SEPARATOR2 = /(?<=.)@/;
+});
+
+// src/commands/audit.ts
+var exports_audit = {};
+__export(exports_audit, {
+  audit: () => audit
+});
+import { join as join2, resolve as resolve2 } from "path";
+import process9 from "process";
+function hasFinding(audited) {
+  return audited.blocked || audited.warnings.length > 0 || audited.advisories.length > 0;
+}
+async function auditPackages(packages, context) {
+  const packuments = new Map;
+  const lookup = async (name, registry) => {
+    const key = `${registry.url}|${name}`;
+    if (!packuments.has(key))
+      packuments.set(key, fetchPackument(name, registry, context.fetcher));
+    return packuments.get(key);
   };
+  const registries = new Map;
+  for (const { name, version } of packages) {
+    const registry = registryFor(name, context.configs);
+    const group = registries.get(registry.url) ?? { registry, versions: {} };
+    group.versions[name] = [...group.versions[name] ?? [], version];
+    registries.set(registry.url, group);
+  }
+  const advisories = {};
+  const unavailable = [];
+  for (const { registry, versions } of registries.values()) {
+    const fetched = await fetchAdvisories(versions, registry, context.fetcher);
+    Object.assign(advisories, fetched.found);
+    if (fetched.unavailable !== undefined)
+      unavailable.push(fetched.unavailable);
+  }
+  const audited = [];
+  for (let start = 0;start < packages.length; start += BATCH) {
+    audited.push(...await Promise.all(packages.slice(start, start + BATCH).map(async ({ name, version }) => {
+      const registry = registryFor(name, context.configs);
+      const found = filterAdvisories(advisoriesFor(advisories[name], version), context.level, context.ignore);
+      const report = analyze({ spec: { name, request: version }, packument: await lookup(name, registry), registry: new URL(registry.url).host, now: context.now, minAgeDays: context.minAgeDays, licenses: context.settings.licenses });
+      return { name, version, license: report.license, blocked: report.blocked || found.length > 0, warnings: report.warnings, advisories: found };
+    })));
+  }
+  return { audited, unavailable };
 }
-var FRAMES, FRAME_MS = 80, CLEAR_LINE = "\r\x1B[2K", LINE_UP = "\x1B[1A\x1B[2K", ESC, ESCAPE_CODE, RESET_STYLE, CLOSE_LINK, CONSOLE_METHODS;
-var init_progress = __esm(() => {
-  init_format();
-  init_process();
-  init_style();
-  FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-  ESC = String.fromCharCode(27);
-  ESCAPE_CODE = new RegExp(`${ESC}(?:\\[[\\x30-\\x3F]*[\\x20-\\x2F]*[\\x40-\\x7E]|\\][^\\u0007${ESC}]*(?:\\u0007|${ESC}\\\\))`, "y");
-  RESET_STYLE = `${ESC}[0m`;
-  CLOSE_LINK = `${ESC}]8;;${ESC}\\`;
-  CONSOLE_METHODS = ["log", "info", "warn", "error", "debug", "dir", "dirxml", "table", "trace", "group", "groupCollapsed", "count", "timeEnd", "timeLog", "assert"];
+function renderAudit(findings, total) {
+  const blocks = findings.map(({ name, version, warnings, advisories }) => [
+    `${name}@${version}`,
+    ...warnings.map((warning) => `  warning: ${warning}`),
+    ...advisories.map((each) => `  ${each.ghsa ?? each.id} ${each.severity}: ${each.title}${each.fixed === undefined ? "" : ` (fixed in ${each.fixed})`}`)
+  ].join(`
+`));
+  return [...blocks, `${findings.length} of ${total} packages with a finding, ${findings.filter((each) => each.blocked).length} blocking`].join(`
+
+`);
+}
+async function audit(args) {
+  const { values, positionals: [asked] } = parse(args, usage2, options2, { positionals: ["[dir]"] });
+  const level = values["audit-level"] ?? "low";
+  if (!isSeverity(level))
+    fail(`--audit-level takes ${SEVERITIES.join(", ")}, not ${level}`);
+  const dir = resolve2(asked ?? process9.cwd());
+  const lock = Bun.file(join2(dir, "bun.lock"));
+  if (!await lock.exists())
+    fail(`no bun.lock in ${dir}`);
+  const packages = parseBunLock(await lock.text());
+  const context = {
+    configs: await loadConfigs(dir),
+    settings: await loadSettings(dir),
+    minAgeDays: wholeNumber(values["min-age"], "min-age", DEFAULT_MIN_AGE_DAYS, 0),
+    level,
+    ignore: values.ignore ?? []
+  };
+  const { audited, unavailable } = await auditPackages(packages, context);
+  const findings = audited.filter(hasFinding);
+  if (values.json === true)
+    printJson(findings);
+  else
+    console.log(renderAudit(findings, packages.length));
+  for (const reason of unavailable)
+    warn(`${reason}, so its advisories are not checked`);
+  if (findings.some((each) => each.blocked))
+    return 1;
+  return unavailable.length > 0 ? 2 : 0;
+}
+var usage2 = `pkg audit [dir]
+
+Reads the bun.lock in the folder (the current one by default) and runs on every registry package it pins the checks \`pkg check\` runs before an add: age, install scripts, a deprecated version, a near miss of a popular name, and the licence allowlist of the pkg config. It also lists the known advisories of each version, with the GHSA, the severity and the fixed version, from the registry's bulk advisory endpoint, the one \`bun audit\` reads.
+Findings are grouped per package, each registry package looked up once per run.
+
+Exits 0 when nothing blocks, 1 when a package is missing, too fresh or outside the licence allowlist, or an advisory reaches --audit-level, 2 when the registry could not be reached or answered badly (a warning says which, and nothing is reported as clean), on a usage error or without a bun.lock.`, options2, BATCH = 8;
+var init_audit = __esm(() => {
+  init_src();
+  init_advisories();
+  init_analyze();
+  init_config2();
+  init_lockfile();
+  init_registry();
+  options2 = {
+    json: jsonOption("[{name, version, license, blocked, warnings, advisories}] for the packages with a finding"),
+    "min-age": { type: "string", description: `days a version must be old (${DEFAULT_MIN_AGE_DAYS})` },
+    "audit-level": { type: "string", description: "lowest advisory severity listed and failing: low, moderate, high, critical (low)" },
+    ignore: { type: "string", multiple: true, description: "an advisory skipped by GHSA or numeric id, repeatable" }
+  };
 });
 
 // ../kit/src/shell.ts
-var SEPARATORS2, PLAIN_BREAKERS, DOUBLE_QUOTED_ESCAPES, WRAPPERS;
+function wrapper(short = "", long = [], operands = 0) {
+  return { short, long, operands };
+}
+var SEPARATORS2, PLAIN_BREAKERS, GLOB_CHARS, COMMENT_PREFIXES, DOUBLE_QUOTED_ESCAPES, KEYWORDS, SHELLS, COMMAND_STRING_PROGRAMS, SHELL_VALUE_OPTIONS, PRINTERS, FIND_EXEC, WRAPPERS;
 var init_shell = __esm(() => {
   SEPARATORS2 = new Set([`
 `, ";", "|"]);
   PLAIN_BREAKERS = new Set(["<", ">", "(", ")", "&", "|"]);
+  GLOB_CHARS = new Set(["*", "?", "["]);
+  COMMENT_PREFIXES = new Set([";", "&", "|", "(", ")"]);
   DOUBLE_QUOTED_ESCAPES = new Set(["$", "`", '"', "\\"]);
-  WRAPPERS = new Set(["command", "env", "sudo", "exec", "nohup", "time"]);
+  KEYWORDS = new Set(["then", "do", "else", "if", "elif", "while", "until", "!", "{", "}"]);
+  SHELLS = new Set(["sh", "bash", "zsh", "dash", "ash", "ksh"]);
+  COMMAND_STRING_PROGRAMS = new Set([...SHELLS, "su", "runuser"]);
+  SHELL_VALUE_OPTIONS = new Set(["-o", "-O", "--rcfile", "--init-file"]);
+  PRINTERS = new Set(["echo", "printf"]);
+  FIND_EXEC = new Set(["-exec", "-execdir", "-ok", "-okdir"]);
+  WRAPPERS = new Map([
+    ["command", wrapper()],
+    ["builtin", wrapper()],
+    ["nohup", wrapper()],
+    ["setsid", wrapper()],
+    ["busybox", wrapper()],
+    ["exec", wrapper("a")],
+    ["time", wrapper("fo", ["--format", "--output"])],
+    ["env", wrapper("uCS", ["--unset", "--chdir", "--split-string", "--argv0"])],
+    ["sudo", wrapper("ughpCTrtUDR", ["--user", "--group", "--host", "--prompt", "--close-from", "--command-timeout", "--role", "--type", "--other-user", "--chdir", "--chroot"])],
+    ["doas", wrapper("uC")],
+    ["timeout", wrapper("sk", ["--signal", "--kill-after"], 1)],
+    ["nice", wrapper("n", ["--adjustment"])],
+    ["ionice", wrapper("cnpPu", ["--class", "--classdata", "--pid", "--pgid", "--uid"])],
+    ["stdbuf", wrapper("ioe", ["--input", "--output", "--error"])],
+    ["chroot", wrapper("", ["--userspec", "--groups"], 1)],
+    ["xargs", wrapper("IndsEaPL", ["--max-args", "--max-procs", "--max-chars", "--delimiter", "--arg-file", "--eof", "--max-lines", "--process-slot-var"])]
+  ]);
 });
 
 // src/pin.ts
@@ -1820,7 +2439,7 @@ var init_pin = __esm(() => {
 
 // src/consumers.ts
 import { existsSync, readdirSync, readFileSync } from "fs";
-import { dirname as dirname2, join as join2, relative } from "path";
+import { dirname as dirname2, join as join3, relative } from "path";
 function packageFiles(dir, depth, found) {
   let entries;
   try {
@@ -1830,15 +2449,15 @@ function packageFiles(dir, depth, found) {
   }
   for (const entry of entries) {
     if (entry.isFile() && entry.name === "package.json")
-      found.push(join2(dir, entry.name));
+      found.push(join3(dir, entry.name));
     else if (entry.isDirectory() && depth < MAX_DEPTH && !entry.name.startsWith(".") && !SKIPPED.has(entry.name))
-      packageFiles(join2(dir, entry.name), depth + 1, found);
+      packageFiles(join3(dir, entry.name), depth + 1, found);
   }
   return found;
 }
 function managerFor(dir, root) {
   for (let at = dir;; at = dirname2(at)) {
-    const lockfile = LOCKFILES.find(([file]) => existsSync(join2(at, file)));
+    const lockfile = LOCKFILES.find(([file]) => existsSync(join3(at, file)));
     if (lockfile !== undefined)
       return lockfile[1];
     if (at === root || at === dirname2(at))
@@ -1872,7 +2491,7 @@ var init_consumers = __esm(() => {
   init_pin();
   KINDS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
   SKIPPED = new Set(["node_modules", "dist", "build", "vendor", "target", "coverage"]);
-  LOCAL_SPEC = /^(?:workspace|link|file|portal):/;
+  LOCAL_SPEC = /[:/]/;
   KIND_FLAGS = { dependencies: [], devDependencies: ["--dev"], optionalDependencies: ["--optional"], peerDependencies: ["--peer"] };
 });
 
@@ -1882,25 +2501,46 @@ __export(exports_bump, {
   ROOT_OPTION: () => ROOT_OPTION,
   bump: () => bump
 });
+import { existsSync as existsSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
+import { dirname as dirname3, join as join4, relative as relative2 } from "path";
+async function lookup(name, registry, fetcher) {
+  try {
+    return { packument: await fetchPackument(name, registry, fetcher) };
+  } catch (error) {
+    if (error instanceof Exit && error.code === 2)
+      return { error: error.message };
+    throw error;
+  }
+}
 async function servedVersion(name, version, settings) {
+  if (!isValidName(name))
+    fail(`${name} is not a valid npm package name`);
+  if (version !== undefined && !EXACT_VERSION.test(version))
+    fail(`bump takes an exact version, not ${version}: leave it out for the latest`);
   const registry = registryFor(name, settings.configs);
   const host = new URL(registry.url).host;
   const started = Date.now();
   const region = liveRegion((spinner) => [`${spinner} waiting for ${host} to serve ${name}@${version} ${formatDuration(Date.now() - started)}`]);
+  let lastError = "";
   try {
     for (;; ) {
-      const packument = await fetchPackument(name, registry, settings.fetcher);
-      const latest = packument?.["dist-tags"]?.latest;
-      if (version === undefined && latest !== undefined)
-        return latest;
-      if (version === undefined)
-        fail(`${host} has no ${name}`, 1);
-      if (packument?.versions?.[version] !== undefined)
-        return version;
+      const looked = await lookup(name, registry, settings.fetcher);
+      if ("error" in looked) {
+        lastError = looked.error;
+      } else {
+        const latest = looked.packument?.["dist-tags"]?.latest;
+        if (looked.packument === undefined)
+          fail(`${host} has no ${name}`, 1);
+        if (version === undefined && latest === undefined)
+          fail(`${host} has no ${name}`, 1);
+        if (version === undefined && latest !== undefined)
+          return latest;
+        if (version !== undefined && looked.packument.versions?.[version] !== undefined)
+          return version;
+      }
       if (Date.now() - started >= settings.timeout)
-        fail(`${host} does not serve ${name}@${version} after ${formatDuration(settings.timeout)}`, 1);
+        fail(`${host} does not serve ${name}@${version} after ${formatDuration(settings.timeout)}${lastError === "" ? "" : `, last error: ${lastError}`}`);
       region.redraw();
       await Bun.sleep(settings.poll ?? POLL);
     }
@@ -1908,65 +2548,142 @@ async function servedVersion(name, version, settings) {
     region.stop();
   }
 }
+async function vet(name, version, settings) {
+  if (settings.isForced === true)
+    return true;
+  const report = await checkPackage(`${name}@${version}`, { configs: settings.configs, fetcher: settings.fetcher, minAgeDays: settings.minAgeDays ?? 0, settings: settings.pkgSettings });
+  if (!report.blocked) {
+    for (const warning of report.warnings)
+      warn(`${name}@${version}`, warning);
+    return true;
+  }
+  for (const warning of report.warnings)
+    problem(`${name}@${version} is refused`, warning);
+  problem(`${name}@${version} is refused`, "no consumer was touched, --force bumps it anyway");
+  return false;
+}
+function lockfileOf(dir, root) {
+  for (let at = dir;; at = dirname3(at)) {
+    const found = ["bun.lock", "bun.lockb"].find((file) => existsSync2(join4(at, file)));
+    if (found !== undefined)
+      return relative2(dir, join4(at, found));
+    if (at === root || at === dirname3(at))
+      return;
+  }
+}
+async function hasUncommittedChanges(where, root, run) {
+  const lockfile = lockfileOf(where, root);
+  const status = await run(["git", "status", "--porcelain", "--", "package.json", ...lockfile === undefined ? [] : [lockfile]], where);
+  return status.code === 0 && status.text.trim() !== "";
+}
+async function checkAndCommit(name, version, where, root, run) {
+  const checked = await run(["check"], where);
+  if (checked.code !== 0)
+    return `check exited ${checked.code}: ${checked.text.trim().split(`
+`).at(-1) ?? ""}`;
+  const lockfile = lockfileOf(where, root);
+  const committed = await run(["gc", `chore(deps): bump ${name} to ${version}`, "--", "package.json", ...lockfile === undefined ? [] : [lockfile]], where);
+  return committed.code === 0 ? undefined : `gc exited ${committed.code}: ${committed.text.trim().split(`
+`).at(-1) ?? ""}`;
+}
 async function bumpConsumers(name, version, settings) {
   const found = findConsumers(name, settings.root);
   const consumers = found.filter((each) => !isLocal(each));
   const local = found.length - consumers.length;
   const run = settings.run ?? (async (argv, cwd) => runCommand(argv, { cwd }));
+  const committed = [];
+  const failing = [];
+  const skipped = [];
   let isClean = true;
   if (found.length === 0)
     note(`nothing under ${settings.root} depends on ${name}`);
   if (local > 0)
-    note(`${local} workspace:, link: or file: dependenc${local === 1 ? "y" : "ies"}`, "left as they are");
+    note(`${local} non-registry dependenc${local === 1 ? "y" : "ies"} (workspace:, file:, git, URL, alias, catalog:)`, "left as they are");
   for (const consumer of consumers) {
     const argv = addCommand(consumer, name, version);
-    const where = join3(settings.root, consumer.dir);
-    if (consumer.spec === version) {
+    const where = join4(settings.root, consumer.dir);
+    if (consumer.kind === "peerDependencies") {
+      skipped.push(consumer.dir);
+      note(consumer.dir, `peer range ${consumer.spec}, left as it is`);
+    } else if (consumer.spec === version) {
+      skipped.push(consumer.dir);
       note(consumer.dir, `already on ${version}`);
     } else if (consumer.manager !== "bun") {
+      skipped.push(consumer.dir);
       warn(consumer.dir, `${consumer.spec}, its lockfile pins ${consumer.manager}: put ${version} in by hand`);
     } else if (settings.isDryRun === true) {
-      note(consumer.dir, `would run ${argv.join(" ")}`);
+      note(consumer.dir, `would run ${[argv.join(" "), ...settings.isAll === true ? ["check", `gc 'chore(deps): bump ${name} to ${version}'`] : []].join(", then ")}`);
+    } else if (settings.isAll === true && await hasUncommittedChanges(where, settings.root, run)) {
+      isClean = false;
+      failing.push(consumer.dir);
+      problem(consumer.dir, "package.json or its lockfile has uncommitted changes, left alone so that gc does not commit them");
     } else {
       const ran = await run(argv, where);
-      if (ran.code === 0) {
-        ok(consumer.dir, `${consumer.spec} -> ${version}`);
-      } else {
+      if (ran.code !== 0) {
         isClean = false;
+        failing.push(consumer.dir);
         problem(consumer.dir, `${argv.join(" ")} exited ${ran.code}: ${ran.text.trim().split(`
 `).at(-1) ?? ""}`);
+      } else if (settings.isAll !== true) {
+        ok(consumer.dir, `${consumer.spec} -> ${version}`);
+      } else {
+        const failure = await checkAndCommit(name, version, where, settings.root, run);
+        if (failure === undefined) {
+          committed.push(consumer.dir);
+          ok(consumer.dir, `${consumer.spec} -> ${version}, checked and committed`);
+        } else {
+          isClean = false;
+          failing.push(consumer.dir);
+          problem(consumer.dir, `${consumer.spec} -> ${version}, left uncommitted: ${failure}`);
+        }
       }
     }
   }
+  if (settings.isAll === true && settings.isDryRun !== true)
+    note("summary", `${committed.length} bumped and committed, ${failing.length} bumped and failing${failing.length > 0 ? ` (${failing.join(", ")})` : ""}, ${skipped.length + local} skipped`);
   return isClean;
 }
 async function bump(args) {
-  const { values, positionals: [name, asked] } = parse(args, usage2, options2, { positionals: ["<name>", "[version]"] });
+  const { values, positionals: [name, asked] } = parse(args, usage3, options3, { positionals: ["<name>", "[version]"] });
   const settings = {
-    root: values.root ?? join3(homedir2(), "Workspace"),
+    root: values.root ?? join4(homedir2(), "Workspace"),
     configs: await loadConfigs(),
     timeout: duration(values.timeout, "timeout", 10 * 60000),
-    isDryRun: values["dry-run"] === true
+    isDryRun: values["dry-run"] === true,
+    isAll: values["all-consumers"] === true,
+    isForced: values.force === true,
+    pkgSettings: await loadSettings(),
+    minAgeDays: wholeNumber(values["min-age"], "min-age", 0, 0)
   };
   const version = await servedVersion(name, asked, settings);
+  if (!await vet(name, version, settings))
+    return 1;
   return await bumpConsumers(name, version, settings) ? 0 : 1;
 }
-var usage2 = `pkg bump <name> [version]
+var usage3 = `pkg bump <name> [version]
 
-Waits until the registry serves the version (the latest when none is given), then runs \`bun add --exact --no-cache\` in each folder under --root whose package.json depends on the package, the kind of dependency kept, a line per folder.
-A workspace:, link: or file: dependency, a folder already on the version and one whose lockfile pins another manager are left as they are, each said so.
-Exits 1 when an install fails or the version never shows, 2 on a usage error.`, ROOT_OPTION, options2, POLL = 5000;
+Waits until the registry serves the version (the latest when none is given, an exact version otherwise), vets it as \`pkg check\` does (advisories, licence allowlist, and a minimum age only when --min-age asks for one), then runs \`bun add --exact --no-cache\` in each folder under --root whose package.json depends on the package, the kind of dependency kept, a line per folder.
+A version the vetting blocks is refused before any folder is touched, unless --force is given.
+A dependency that is not a registry version (workspace:, link:, file:, git, a URL, an npm: alias, catalog:), a peer range, a folder already on the version and one whose lockfile pins another manager are left as they are, each said so.
+With --all-consumers a folder whose package.json or lockfile already has uncommitted changes is left alone, and each folder whose install went through then runs its own \`check\` (the check bin) and is committed with \`gc 'chore(deps): bump <name> to <version>' -- package.json <lockfile>\` only when that passes; a failing one is left uncommitted and listed in the summary with the skipped ones, and nothing is ever pushed.
+
+Exits 0 when every install ran or was left as it is (with --all-consumers, and every check passed and every commit landed), 1 when the vetting refuses the version, an install, a check or a commit fails or the registry has no such package, 2 when the version never shows within the timeout (a registry that cannot be reached is retried until then) or on a usage error.`, ROOT_OPTION, options3, POLL = 5000;
 var init_bump = __esm(() => {
   init_src();
   init_progress();
   init_config2();
   init_consumers();
   init_registry();
+  init_semver();
+  init_check();
   ROOT_OPTION = { type: "string", description: "the folder holding the repositories (~/Workspace)" };
-  options2 = {
+  options3 = {
     root: ROOT_OPTION,
     timeout: { type: "string", short: "t", description: "how long to wait for the registry (10m): 30s, 5m, 1h" },
-    "dry-run": { type: "boolean", description: "print what would run, changing nothing" }
+    "all-consumers": { type: "boolean", description: "after each install run the folder's check and commit it through gc when it passes" },
+    "dry-run": { type: "boolean", description: "print what would run, changing nothing" },
+    force: { type: "boolean", description: "bump even when the version is blocked by the vetting" },
+    "min-age": { type: "string", description: "days a version must be old (0: a bump adopts a release on purpose, often one just made)" }
   };
 });
 
@@ -1976,46 +2693,53 @@ __export(exports_consumers, {
   consumers: () => consumers
 });
 import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function consumers(args) {
-  const { values, positionals: [name] } = parse(args, usage3, options3, { positionals: ["<name>"] });
-  const root = values.root ?? join4(homedir3(), "Workspace");
-  const found = findConsumers(name, root);
+  const { values, positionals: [name] } = parse(args, usage4, options4, { positionals: ["<name>"] });
+  const root = values.root ?? join5(homedir3(), "Workspace");
+  const { shown, footer } = capped(findConsumers(name, root), limitOf(values, CONSUMERS_LIMIT));
   if (values.json === true)
-    printJson(found);
-  else if (found.length === 0)
+    printJson(shown);
+  else if (shown.length === 0)
     console.log(`nothing under ${root} depends on ${name}`);
   else
-    console.log(table([["FOLDER", "KIND", "VERSION", "MANAGER"], ...found.map((each) => [each.dir, each.kind, each.spec, each.manager])], { header: true }));
+    console.log([table([["FOLDER", "KIND", "VERSION", "MANAGER"], ...shown.map((each) => [each.dir, each.kind, each.spec, each.manager])], { header: true }), ...footer === undefined ? [] : [footer]].join(`
+`));
   return 0;
 }
-var usage3 = `pkg consumers <name>
+var usage4 = `pkg consumers <name>
 
-Lists the folders under --root whose package.json depends on the package: the folder, the kind of dependency, the version it asks for and the manager its lockfile pins.`, options3;
+Lists the folders under --root whose package.json depends on the package: the folder, the kind of dependency, the version it asks for and the manager its lockfile pins, 30 at most with the count of the rest after them (--limit <n>, --full for all; --json is never cut unless --limit is given).
+
+Exits 0 when it listed them, 2 on a usage error.`, CONSUMERS_LIMIT = 30, options4;
 var init_consumers2 = __esm(() => {
   init_src();
   init_consumers();
   init_bump();
-  options3 = {
+  options4 = {
     root: ROOT_OPTION,
+    ...limitOptions(CONSUMERS_LIMIT),
     json: jsonOption("[{dir, path, kind, spec, manager}]")
   };
 });
 
 // src/cli.ts
 init_src();
-import process9 from "process";
+import process10 from "process";
 // package.json
-var version = "0.3.0";
+var version = "0.5.0";
 
 // src/cli.ts
-process9.exitCode = await runCli({
+process10.exitCode = await runCli({
   name: "pkg",
   version,
   about: "checks npm packages before they are added, and moves a lib's consumers onto a new release",
+  replaces: "bun add on trust, and a bun info and sleep loop then a bun add per consumer",
+  examples: [["pkg zod", "the name, the newest version two weeks old, its licence and scripts"], ["pkg bump @kaynooo/cli-kit --dry-run", "the consumers a release would move"]],
   defaultCommand: "check",
   commands: {
     check: { summary: "check packages before they are added (`pkg <name>` alone runs it)", run: async (args) => (await Promise.resolve().then(() => (init_check(), exports_check))).check(args) },
+    audit: { summary: "check every package a bun.lock pins, with its known advisories", run: async (args) => (await Promise.resolve().then(() => (init_audit(), exports_audit))).audit(args) },
     bump: { summary: "wait for a release on the registry, then bun add it in every consumer", run: async (args) => (await Promise.resolve().then(() => (init_bump(), exports_bump))).bump(args) },
     consumers: { summary: "list the folders depending on a package, with the version each asks for", run: async (args) => (await Promise.resolve().then(() => (init_consumers2(), exports_consumers))).consumers(args) }
   }