@leverege/build-tools 2.102.0 → 2.103.0

package/.vscode/launch.json

@@ -58,6 +58,16 @@
       "runtimeExecutable": "node",
       "console": "integratedTerminal"
     },
+    {
+      "name": "chart-to-registry rsrc-srvr",
+      "type": "node",
+      "request": "launch",
+      "program": "${workspaceFolder}/src/chart-to-registry.mjs",
+      "args": [],
+      "cwd": "/Users/john/Work/leverege/cicd/@plt/resource-server",
+      "runtimeExecutable": "node",
+      "console": "integratedTerminal"
+    },
     {
       "name": "ingestor in monorepo",
       "type": "node",

package/README.md

@@ -16,7 +16,7 @@ Most tools assume the following are installed and configured:
 - `kubectl` (with a valid cluster context)
 - `helm` (v3+)
 - `fzf` (for interactive pod selection in `k8x` and `klog`)
-- Node.js 22+
+- Node.js 22+ - prefer 24
 
 ---
 
@@ -85,13 +85,15 @@ init-my-chart [--dry-run] [--debug]
 ```
 
 **`chart-to-registry`** — Pushes Helm charts to GCP Artifact Registry with version
-checking and dependency resolution.
+checking and dependency resolution. Warns if `appVersion` in Chart.yaml does not start
+with `v` (bypass with `--ignore-appv`).
 ```bash
-chart-to-registry --chart <dir> [--project <id>] [--repository <name>] [--force] [--dry-run]
+chart-to-registry --chart <dir> [--project <id>] [--repository <name>] [--force] [--dry-run] [--ignore-appv]
 ```
 
 **`push-my-chart`** — Publishes Helm charts to both GCS Chartmuseum (legacy) and
-GCP Artifact Registry.
+GCP Artifact Registry. Displays chart name, version, and appVersion before pushing;
+warns if `appVersion` does not start with `v`.
 ```bash
 push-my-chart [--chart <dir>] [--no-registry]
 ```
@@ -226,11 +228,20 @@ Manager, updating `.npmrc` / `.yarnrc.yml`. Skips refresh if the token is less t
 refresh-npm-token [--project <id>] [--force] [--dry-run]
 ```
 
-**`pkgck`** — Checks for common package configuration issues (babel, eslint, circleci,
-dockerfile, etc.) with visual pass/fail indicators.
+**`repo-panopticon`** — Multi-repo health dashboard. Checks each repository against a suite
+of indicators in a compact 80-column table. Monorepo-aware: workspace packages are
+auto-discovered, grouped under their parent repo label, and checked individually.
 ```bash
-pkgck
+repo-panopticon <dirs...>                 # check one or more repos / globs
+repo-panopticon @plt/* @kud/* @srv/*      # typical full-org sweep
+repo-panopticon --no-pull @plt/*          # skip git pull/fetch
+repo-panopticon --limit 40 @srv/*         # cap displayed rows (default 80)
+repo-panopticon --concurrency 10 @srv/*   # increase parallelism (default 5)
 ```
+Columns: `mgr` (npm/yrn) · `pkg` (package.json version) · `git` (latest semver tag) ·
+`scop` (package scope) · `cir` (CircleCI — ✘ missing · L legacy · 1 orb v1 · 2 orb v2) ·
+`ESM` (`"type":"module"`) · `har` (.har hooks directory) · `lnt` (ESLint major version) ·
+`bbl` (Babel presence). Repo name shown in orange when dirty or sync failed.
 
 **`pkglint`** — Verifies required documentation files (README.md, LICENSE.md) are
 present before publishing.
@@ -252,8 +263,9 @@ count-lines-of-code [--src-only]
 
 ### CI/CD Integration
 
-**`circle-orb-it`** — Installs or updates CircleCI configuration (Leverege orb) and
-GitHub Dependabot settings for a repository. Preserves existing customizations.
+**`circle-orb-it`** — Installs or updates CircleCI configuration (Leverege orb v2.0.0) and
+GitHub Dependabot settings for a repository. Auto-detects npm vs yarn-berry and writes
+the appropriate template. Preserves existing customizations.
 ```bash
 circle-orb-it [--dry-run] [--debug]
 ```
@@ -340,6 +352,7 @@ BUILD_TOOLS_DEBUG=1 docker-to-registry
 
 | Tool | Replacement |
 |------|-------------|
+| `pkgck` | `repo-panopticon` |
 | `docker-to-registry-py` | `docker-to-registry` |
 | `chart-to-museum` | `push-my-chart` |
 | `refresh-py-idx` | No longer needed |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.102.0",
+  "version": "2.103.0",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -16,7 +16,6 @@
     "prepack": "npm exec prepack"
   },
   "bin": {
-    "build-and-push": "src/build-and-push.sh",
     "build-cnpg-image": "src/build-cnpg-image.mjs",
     "build-tools": "src/build-tools.mjs",
     "change-up": "src/change-up.sh",
@@ -29,8 +28,6 @@
     "decrypt-secrets": "src/decrypt-secrets.sh",
     "dirty-git": "src/dirty-git.sh",
     "docker-to-registry": "src/docker-to-registry.mjs",
-    "docker-to-registry-py": "src/docker-to-registry-py.mjs",
-    "docker-to-registry.sh": "src/docker-to-registry.sh",
     "dockreate": "src/dockreate.sh",
     "encrypt-secrets": "src/encrypt-secrets.sh",
     "firebaseDeploy": "src/firebaseDeploy.mjs",
@@ -55,7 +52,7 @@
     "npm-link": "src/npm-link.sh",
     "npm-unlink": "src/npm-unlink.sh",
     "overwhelm": "src/overwhelm.mjs",
-    "pkgck": "src/pkgck.sh",
+    "pkgck": "echo '*** Use repo-panopticon instead! ***",
     "pkglint": "src/pkglint.sh",
     "prepack": "src/prepack.mjs",
     "prune-git": "src/prune-git.sh",
@@ -65,10 +62,10 @@
     "push-my-chart": "src/push-my-chart.mjs",
     "refresh-npm-token": "src/refresh-npm-token.mjs",
     "refresh-py-idx": "src/refresh-py-idx.sh",
+    "repo-panopticon": "src/repo-panopticon.mjs",
     "send-to-slack": "src/send-to-slack.mjs",
     "service-man": "src/service-man/service-man.mjs",
     "snapshot-cnpg": "src/snapshot-cnpg.mjs",
-    "tag-release": "src/tag-release.mjs",
     "unleash": "src/unleash.mjs",
     "upload-model": "src/upload-model.sh",
     "yarn-build": "src/yarn-build.mjs"
@@ -109,7 +106,7 @@
     "sloc": "^0.3.2",
     "superstruct": "^2.0.2",
     "tmp": "^0.2.5",
-    "toml": "^3.0.0",
+    "toml": "^4.1.1",
     "yaml": "^2.9.0",
     "zx": "^8.8.5"
   },

package/src/Utils.mjs

@@ -534,6 +534,7 @@ export const parseHelmChart = async ( helmroot = './helm' ) => {
   const chartName = chartYaml.name
   const chartLibrary = chartYaml?.type === 'library'
   const chartVersion = chartYaml.version
+  const chartAppVersion = chartYaml.appVersion
   const chartPackage = `${chartName}-${chartVersion}.tgz`
   const valuesText = fs.readFileSync( `${helmroot}/values.yaml`, 'utf8' )
   const valuesYaml = YAML.load( valuesText )
@@ -573,6 +574,7 @@ export const parseHelmChart = async ( helmroot = './helm' ) => {
     chartLibrary,
     chartPackage,
     chartVersion,
+    chartAppVersion,
     hasDependencies,
     depsOutOfSync,
     imageRegistry,

package/src/chart-to-registry.mjs

@@ -14,9 +14,10 @@ import {
   errorExit,
   establishOauthAccess,
   log,
-  warning,
   parseHelmChart,
+  proceed,
   shellCmd,
+  warning,
 } from './Utils.mjs'
 
 const commandLineOptions = [ // Use commandLineOptions to tie into the Usage statements
@@ -46,6 +47,11 @@ const commandLineOptions = [ // Use commandLineOptions to tie into the Usage sta
     type : Boolean,
     description : '{green update artifact registry auth token and exit}',
   },
+  {
+    name : 'ignore-appv',
+    type : Boolean,
+    description : '{green ignore the Char.yaml appVersion format}',
+  },
   {
     name : 'dry-run',
     type : Boolean,
@@ -98,6 +104,11 @@ if ( semverLt( process.version, minNodejsVersion ) ) {
 // load up all we need to know about the chart
 const helmChart = await parseHelmChart( args.chart )
 
+if ( !helmChart.chartAppVersion.startsWith( 'v' ) && !args.ignoreAppv ) {
+  warning( 'Chart.yaml appVersion does not begin with the letter "v"\n' )
+  await proceed( 'You sure about this?' )
+}
+
 // helm push helm-package.tgz oci://REGISTRY_LOCATION/REGISTRY_PROJECT/REGISTRY_REPOSITORY/charts
 //
 const registryLocation = args.location || helmChart.registryLocation

package/src/circle-orb-it/{circle-orb.yml → circle-npm.yml}

@@ -1,25 +1,28 @@
 version: 2.1
 
 orbs:
-  leverege: leverege/circle-nodejs-ci@1.2.6
+  leverege: leverege/circle-nodejs-ci@2.0.0
 
 workflows:
   build-and-verify:
     jobs:
       - leverege/install-dependencies:
           context: npm
-          # pkg-manager: yarn-berry   # uncomment for Yarn Berry repos
       - leverege/code-analysis:
+          context: npm
           requires:
             - leverege/install-dependencies
       - leverege/code-coverage:
+          context:
+            - npm
+            - leverege-gcp                # provides GCP_SA_KEY_JSON for tests that need GCP access
           coverage-threshold: 70          # percentage threshold for functions, lines, and statements
-          context: leverege-gcp           # provides GCP_SA_KEY_JSON for tests that need GCP access
           enable-redis: false             # set to true if tests require a live Redis connection
           cache-config: '{"type":"inMemory"}' # sets CACHE_CONFIG env var - options: inMemory, redis
           requires:
             - leverege/install-dependencies
       - leverege/generate-docs:
+          context: npm
           requires:
             - leverege/install-dependencies
       - leverege/mirror-to-github:

package/src/circle-orb-it/circle-orb-it.mjs

@@ -11,14 +11,19 @@ import {
   enableDebug,
   errorExit,
   getGitRootDirectory,
+  getIsYarnProject,
   log,
+  mkdirSafe,
   proceed,
+  warning,
 } from '../Utils.mjs'
 
-const ORB_VERSION = '1.2.6' // Keep this in sync with the version in circle-orb.yml
+const ORB_VERSION = '2.0.0' // Keep this in sync with the versions in circle-npm.yml and circle-yarn.yml
 const CIRCLE_DIR = '.circleci'
 const CIRCLE_YML = `${CIRCLE_DIR}/config.yml`
-const CIRCLE_YML_TEMPLATE = path.join( BUILD_TOOLS_ROOT, 'circle-orb-it', 'circle-orb.yml' )
+const CIRCLE_NPM_TEMPLATE = path.join( BUILD_TOOLS_ROOT, 'circle-orb-it', 'circle-npm.yml' )
+const CIRCLE_YARN_TEMPLATE = path.join( BUILD_TOOLS_ROOT, 'circle-orb-it', 'circle-yarn.yml' )
+const CIRCLE_YML_TEMPLATE = isYarn => ( isYarn ? CIRCLE_YARN_TEMPLATE : CIRCLE_NPM_TEMPLATE )
 const GITHUB_DIR = '.github'
 const DEPENDABOT_FILE = `${GITHUB_DIR}/dependabot.yml`
 const DEPENDABOT_TEMPLATE = path.join( BUILD_TOOLS_ROOT, 'circle-orb-it', 'dependabot.yml' )
@@ -52,9 +57,13 @@ if ( !gitRoot ) {
   errorExit( 'This command must be run inside a git repository' )
 }
 
+const isYarn = getIsYarnProject( gitRoot )
+const circleTemplate = CIRCLE_YML_TEMPLATE( isYarn )
+log( chalk.blue( `\nPackage manager: ${isYarn ? 'yarn-berry' : 'npm'}` ) )
+
 // Warn if this looks like a Python project since the orb is Node.js only
 if ( fs.existsSync( path.join( gitRoot, 'pyproject.toml' ) ) ) {
-  log( chalk.yellow( '\n***WARNING: pyproject.toml detected - the leverege orb is Node.js only' ) )
+  warning( 'pyproject.toml detected - the leverege orb is Node.js only' )
   await proceed( 'Continue anyway?' )
 }
 
@@ -119,7 +128,7 @@ if ( !writeCircleYml && !writeDependabot ) {
 
 if ( options.dryRun ) {
   if ( writeCircleYml ) {
-    let dryRunContent = fs.readFileSync( CIRCLE_YML_TEMPLATE, 'utf-8' )
+    let dryRunContent = fs.readFileSync( circleTemplate, 'utf-8' )
     if ( redisEnabled ) {
       dryRunContent = dryRunContent
         .replace( 'enable-redis: false', 'enable-redis: true' )
@@ -142,10 +151,8 @@ if ( options.dryRun ) {
 // ---------- Write ----------
 
 if ( writeCircleYml ) {
-  if ( !fs.existsSync( circleDir ) ) {
-    fs.mkdirSync( circleDir, { recursive : true } )
-  }
-  let circleYmlContent = fs.readFileSync( CIRCLE_YML_TEMPLATE, 'utf-8' )
+  mkdirSafe( circleDir )
+  let circleYmlContent = fs.readFileSync( circleTemplate, 'utf-8' )
   if ( redisEnabled ) {
     circleYmlContent = circleYmlContent
       .replace( 'enable-redis: false', 'enable-redis: true' )
@@ -162,9 +169,7 @@ if ( writeCircleYml ) {
 }
 
 if ( writeDependabot ) {
-  if ( !fs.existsSync( githubDir ) ) {
-    fs.mkdirSync( githubDir, { recursive : true } )
-  }
+  mkdirSafe( githubDir )
   fs.writeFileSync( dependabotPath, fs.readFileSync( DEPENDABOT_TEMPLATE, 'utf-8' ) )
   log( chalk.green( `Dependabot config written => ${dependabotPath}` ) )
 }

package/src/circle-orb-it/circle-yarn.yml

@@ -0,0 +1,25 @@
+version: 2.1
+
+orbs:
+  leverege: leverege/circle-nodejs-ci@2.0.0
+
+workflows:
+  build-and-verify:
+    jobs:
+      - leverege/code-analysis:
+          context: npm
+          pkg-manager: yarn-berry
+      - leverege/code-coverage:
+          context:
+            - npm
+            - leverege-gcp                # provides GCP_SA_KEY_JSON for tests that need GCP access
+          pkg-manager: yarn-berry
+          coverage-threshold: 70          # percentage threshold for functions, lines, and statements
+          enable-redis: false             # set to true if tests require a live Redis connection
+          cache-config: '{"type":"inMemory"}' # sets CACHE_CONFIG env var - options: inMemory, redis
+      - leverege/generate-docs:
+          context: npm
+          pkg-manager: yarn-berry
+      - leverege/mirror-to-github:
+          context: github-mirror
+          # github-team: platform   # available teams: platform, utilities, pitcrew, recovr

package/src/push-my-chart.mjs

@@ -9,7 +9,9 @@ import {
   errorExit,
   log,
   parseHelmChart,
-  shellCmd
+  proceed,
+  shellCmd,
+  warning,
 } from './Utils.mjs'
 
 const commandLineOptions = [
@@ -56,11 +58,18 @@ if ( args.help ) {
 const {
   chartName,
   chartVersion,
+  chartAppVersion,
   depsOutOfSync,
 } = await parseHelmChart( args.chart )
 
-log( chalk.green( `Chart   => ${chalk.bold.yellow( chartName )}` ) )
-log( chalk.green( `Version => ${chalk.bold.yellow( chartVersion )}` ) )
+log( chalk.green( `Chart      => ${chalk.bold.yellow( chartName )}` ) )
+log( chalk.green( `Version    => ${chalk.bold.yellow( chartVersion )}` ) )
+log( chalk.green( `AppVersion => ${chalk.bold.yellow( chartAppVersion )}` ) )
+
+if ( !chartAppVersion.startsWith( 'v' ) ) {
+  warning( 'Chart.yaml appVersion does not begin with the letter "v"\n' )
+  await proceed( 'You sure about this?' )
+}
 
 if ( depsOutOfSync ) {
   try {
@@ -89,7 +98,7 @@ if ( args.noRegistry ) {
 
 try {
   log( chalk.green( '  ... pushing to the Artifact Registry' ) )
-  const registry = await shellCmd( `chart-to-registry --chart ${args.chart}` )
+  const registry = await shellCmd( `chart-to-registry --chart ${args.chart} --ignore-appv` )
   debug( { registry }, '<==chart-to-registry' )
   process.exit( museumStatus )
 } catch ( ex ) {

package/src/repo-panopticon.mjs

@@ -0,0 +1,415 @@
+#!/usr/bin/env node
+/* eslint-disable security/detect-non-literal-fs-filename, no-multi-spaces, key-spacing */
+import fs from 'node:fs'
+import path from 'node:path'
+
+import { program } from 'commander'
+import chalk from 'chalk'
+import { glob } from 'glob'
+import ora from 'ora'
+import pLimit from 'p-limit'
+import simpleGit from 'simple-git'
+
+import { clear, enableDebug, log, parseJsonFile } from './Utils.mjs'
+
+// ---------- Symbols ----------
+
+const SYM_GOOD = chalk.green( '✔' )
+const SYM_BAD  = chalk.red( '✘' )
+
+// ---------- Checks ----------
+// Each check: { label: string, fn: ({ dir, pkg, isWorkspace }) => { value: string } }
+// Add new checks here — the table expands automatically.
+
+const CHECKS = [
+  {
+    label : 'cir',
+    fn    : ( { dir } ) => {
+      const cfgPath = path.join( dir, '.circleci', 'config.yml' )
+      if ( !fs.existsSync( cfgPath ) ) return { value : SYM_BAD }
+      try {
+        const content = fs.readFileSync( cfgPath, 'utf8' )
+        const match = content.match( /leverege\/circle-nodejs-ci@(\d+)\.\d+\.\d+/ )
+        if ( !match || parseInt( match[1], 10 ) === 0 ) return { value : chalk.hex( '#FFA500' )( 'L' ) }
+        const major = parseInt( match[1], 10 )
+        return { value : major === 1 ? chalk.yellow( '1' ) : chalk.green( `${major}` ) }
+      } catch {
+        return { value : chalk.hex( '#FFA500' )( 'L' ) }
+      }
+    },
+  },
+  {
+    label : 'ESM',
+    fn    : ( { pkg } ) => {
+      const ok = pkg?.type === 'module'
+      return { value : ok ? SYM_GOOD : SYM_BAD }
+    },
+  },
+  {
+    label : 'har',
+    fn    : ( { gitRoot } ) => {
+      const ok = fs.existsSync( path.join( gitRoot, '.har' ) )
+      return { value : ok ? SYM_GOOD : SYM_BAD }
+    },
+  },
+  {
+    label : 'lnt',
+    fn    : ( { dir, pkg, gitRoot } ) => {
+      if ( !pkg?.scripts?.lint ) return { value : SYM_BAD }
+      try {
+        // Prefer package-local node_modules; fall back to monorepo root (hoisted)
+        const local  = path.join( dir, 'node_modules', 'eslint', 'package.json' )
+        const hoisted = path.join( gitRoot, 'node_modules', 'eslint', 'package.json' )
+        const eslintPkg = JSON.parse( fs.readFileSync(
+          fs.existsSync( local ) ? local : hoisted, 'utf8'
+        ) )
+        const major = parseInt( eslintPkg.version.split( '.' )[0], 10 )
+        return { value : major <= 8 ? chalk.yellow( `${major}` ) : chalk.green( `${major}` ) }
+      } catch {
+        return { value : chalk.dim( '?' ) }
+      }
+    },
+  },
+  {
+    label : 'bbl',
+    fn    : ( { dir, pkg } ) => {
+      const configFiles = [ '.babelrc', '.babelrc.js', '.babelrc.json', 'babel.config.js', 'babel.config.json', 'babel.config.cjs' ]
+      const hasConfig   = configFiles.some( f => fs.existsSync( path.join( dir, f ) ) )
+      const allDeps     = { ...( pkg?.dependencies ?? {} ), ...( pkg?.devDependencies ?? {} ) }
+      const hasDep      = Object.keys( allDeps ).some( k => k.includes( 'babel' ) )
+      return { value : ( hasConfig || hasDep ) ? SYM_BAD : chalk.dim( '–' ) }
+    },
+  },
+]
+
+// ---------- Helpers ----------
+
+const ANSI_RE = /\x1B\[[0-9;]*m/g // eslint-disable-line no-control-regex
+
+function visLen( str ) {
+  return str.replace( ANSI_RE, '' ).length
+}
+
+function pad( str, width ) {
+  return str + ' '.repeat( Math.max( 0, width - visLen( str ) ) )
+}
+
+function center( str, width ) {
+  const gap = Math.max( 0, width - visLen( str ) )
+  const left = Math.floor( gap / 2 )
+  return ' '.repeat( left ) + str + ' '.repeat( gap - left )
+}
+
+const NONSEMVER = '!SEMVER'
+
+// Strict x.y.z only — pre-release and build metadata are flagged !SEMVER
+function parseVersion( raw ) {
+  if ( !raw ) return null
+  const v = raw.startsWith( 'v' ) ? raw : `v${raw}`
+  return /^v\d+\.\d+\.\d+$/.test( v ) ? v : NONSEMVER
+}
+
+function fmtPkgVer( ver ) {
+  if ( !ver ) return chalk.dim( '?' )
+  if ( ver === NONSEMVER ) return chalk.yellow( NONSEMVER )
+  return chalk.green( ver )
+}
+
+function fmtGitVer( gitVer, pkgVer ) {
+  if ( !gitVer ) return chalk.bgRed.white( 'UNTAGGD' )
+  if ( gitVer === NONSEMVER ) return chalk.yellow( NONSEMVER )
+  if ( gitVer === pkgVer ) return chalk.green( gitVer )
+  return chalk.yellow( gitVer )
+}
+
+function fmtScope( pkg ) {
+  const name = pkg?.name ?? ''
+  const match = name.match( /^(@[^/]+)/ )
+  if ( match ) return chalk.green( match[1].slice( 0, 4 ) )  // '@' + 3 chars: @leverege → @lev
+  if ( pkg?.private === true ) return chalk.yellow( 'PRVT' )
+  return chalk.bgRed.white( 'PUBL' )
+}
+
+// Extracts { repoName, group } from a directory path.
+// For workspace packages (gitRoot !== dir), group is the monorepo's org/name path
+// and repoName is the package's own directory name.
+// For root repos, group is the @xxx path component and repoName is relative to it.
+function repoLabel( dir, gitRoot ) {
+  const parts = dir.split( path.sep )
+  const atIdx = parts.findIndex( p => /^@\w+$/.test( p ) )
+
+  if ( gitRoot && gitRoot !== dir ) {
+    // Workspace package — group under the monorepo's label
+    const rootParts = gitRoot.split( path.sep )
+    const rootAtIdx = rootParts.findIndex( p => /^@\w+$/.test( p ) )
+    const group = rootAtIdx === -1 ?
+      path.basename( gitRoot ) :
+      rootParts.slice( rootAtIdx ).join( '/' )
+    return { repoName : path.basename( dir ), group }
+  }
+
+  if ( atIdx === -1 ) return { repoName : path.basename( dir ), group : null }
+  const group = parts[atIdx]
+  const repoName = parts.slice( atIdx + 1 ).join( '/' )
+  return { repoName, group }
+}
+
+// ---------- Per-repo ----------
+
+async function checkRepo( dir, { pull } ) {
+  if ( !fs.existsSync( path.join( dir, 'package.json' ) ) ) return null
+
+  let gitRoot
+  try {
+    gitRoot = ( await simpleGit( dir ).revparse( [ '--show-toplevel' ] ) ).trim()
+  } catch {
+    return null
+  }
+
+  const isWorkspace = gitRoot !== dir
+  const git = simpleGit( gitRoot )
+  const pkg = await parseJsonFile( path.join( dir, 'package.json' ) )
+
+  // Monorepo roots are represented by their workspace packages — skip the root itself
+  if ( !isWorkspace && pkg?.workspaces ) return null
+
+  const pkgVer = parseVersion( pkg?.version )
+
+  let syncOk = true
+  if ( isWorkspace ) {
+    try {
+      const relDir = path.relative( gitRoot, dir )
+      const status = await git.status( [ '--', relDir ] )
+      syncOk = status.files.length === 0
+    } catch {
+      syncOk = false
+    }
+  } else if ( pull ) {
+    try {
+      await git.pull()
+      await git.fetch( [ '--tags' ] )
+    } catch {
+      syncOk = false
+    }
+  }
+
+  let gitVer = null
+  if ( isWorkspace ) {
+    // Look for workspace-style tags: pkg-name/vX.Y.Z
+    const pkgBaseName = ( pkg?.name ?? path.basename( dir ) ).replace( /^@[^/]+\//, '' )
+    try {
+      const tagOutput = ( await git.raw( [ 'tag', '--list', `${pkgBaseName}/v*` ] ) ).trim()
+      if ( tagOutput ) {
+        const semverTags = tagOutput.split( '\n' )
+          .map( ( t ) => { const m = t.trim().match( /(?:^|\/)v(\d+\.\d+\.\d+)$/ ); return m ? m[1] : null } )
+          .filter( Boolean )
+        if ( semverTags.length ) {
+          semverTags.sort( ( a, b ) => {
+            const av = a.split( '.' ).map( Number )
+            const bv = b.split( '.' ).map( Number )
+            return ( bv[0] - av[0] ) || ( bv[1] - av[1] ) || ( bv[2] - av[2] )
+          } )
+          gitVer = `v${semverTags[0]}`
+        } else {
+          gitVer = NONSEMVER
+        }
+      }
+    } catch { /* no tags → null = UNTAGGD */ }
+  } else {
+    // git describe gives the nearest tag reachable from HEAD, matching original pkgck behavior
+    try {
+      const tag = ( await git.raw( [ 'describe', '--abbrev=0', '--tags' ] ) ).trim()
+      // Handles 'v1.2.3' and workspace-style 'pkg-name/v1.2.3'
+      const match = tag.match( /(?:^|\/)v(\d+\.\d+\.\d+)$/ )
+      gitVer = match ? `v${match[1]}` : NONSEMVER
+    } catch { /* no tags → null = UNTAGGD */ }
+  }
+
+  let needsPush = ''
+  if ( pkgVer && pkgVer !== NONSEMVER && gitVer === pkgVer ) {
+    try {
+      const pkgBaseName = ( pkg?.name ?? path.basename( dir ) ).replace( /^@[^/]+\//, '' )
+      const tagToCheck = isWorkspace ? `${pkgBaseName}/${pkgVer}` : pkgVer
+      const remote = await git.listRemote( [ '--tags', 'origin' ] )
+      if ( !remote.includes( tagToCheck ) ) needsPush = chalk.yellow( '!tags' )
+    } catch { /* ignore */ }
+  }
+
+  const isYarn   = fs.existsSync( path.join( gitRoot, 'yarn.lock' ) ) || fs.existsSync( path.join( gitRoot, '.yarn' ) )
+  const pkgMgr   = isYarn ? chalk.cyan( 'yrn' ) : chalk.red( 'npm' )
+
+  const { repoName, group } = repoLabel( dir, gitRoot )
+  return {
+    repoName,
+    group,
+    pkgMgr,
+    pkgVer      : fmtPkgVer( pkgVer ),
+    gitVer      : fmtGitVer( gitVer, pkgVer ),
+    dirty       : !syncOk,
+    scope       : fmtScope( pkg ),
+    isWorkspace,
+    checks      : CHECKS.map( ( { label, fn } ) => ( { label, ...fn( { dir, pkg, isWorkspace, gitRoot } ) } ) ),
+    needsPush,
+  }
+}
+
+// ---------- Table ----------
+
+function renderTable( rows ) {
+  const pkgW   = Math.max( 3, ...rows.map( r => visLen( r.pkgVer ) ) )
+  const gitW   = Math.max( 7, ...rows.map( r => visLen( r.gitVer ) ) )
+  const scopeW = Math.max( 4, ...rows.map( r => visLen( r.scope ) ) )
+
+  // Fixed width of all columns except name. Elements: mgr pkg git scope checks (no needsPush).
+  // join('  ') puts 2-space sep between N+5 elements = N+4 separators.
+  const checkLabelW = CHECKS.reduce( ( sum, c ) => sum + c.label.length, 0 )
+  const fixedW = 3 + pkgW + gitW + scopeW + checkLabelW + ( CHECKS.length + 4 ) * 2
+
+  // Name area: 2-space indent + repo name. Group label prints on its own line above each section.
+  const hasGroups = rows.some( r => r.group )
+  const indent    = hasGroups ? 2 : 0
+  const maxRepoW  = Math.min( 22, Math.max( 4, ...rows.map( r => r.repoName.length ) ) )
+  const nameW     = Math.min( indent + maxRepoW, 80 - fixedW )
+  const repoW     = nameW - indent
+
+  const nameHdr = pad( `${' '.repeat( indent )}name`, nameW )
+  const hdr = [
+    nameHdr,
+    center( 'mgr', 3 ),
+    center( 'pkg', pkgW ),
+    center( 'git', gitW ),
+    center( 'scop', scopeW ),
+    ...CHECKS.map( c => center( c.label, c.label.length ) ),
+  ].join( '  ' )
+
+  const separator = chalk.dim( '─'.repeat( visLen( hdr ) ) )
+
+  log( '' )
+  log( chalk.dim( hdr ) )
+  log( separator )
+
+  let currentGroup
+  for ( const row of rows ) {
+    if ( row.group !== currentGroup ) {
+      currentGroup = row.group
+      if ( hasGroups ) log( chalk.cyan( row.group ?? '' ) )
+    }
+    const nameStr  = ' '.repeat( indent ) + row.repoName.slice( 0, repoW )
+    const nameCell = row.dirty ? chalk.hex( '#FFA500' )( nameStr ) : nameStr
+    const line = [
+      pad( nameCell, nameW ),
+      pad( row.pkgMgr, 3 ),
+      pad( row.pkgVer, pkgW ),
+      pad( row.gitVer, gitW ),
+      pad( row.scope, scopeW ),
+      ...row.checks.map( c => center( c.value, c.label.length ) ),
+    ].join( '  ' ) + ( row.needsPush ? `  ${row.needsPush}` : '' )
+    log( line )
+  }
+
+  log( '' )
+}
+
+// ---------- CLI ----------
+
+program
+  .name( 'package-checker' )
+  .description( chalk.green( 'A panopticon for your git repos!' ) )
+  .argument( '<dirs...>', 'directories to check' )
+  .option( '--no-pull', 'skip git pull and tag fetch' )
+  .option( '--no-clear', 'do not clear the screen before output' )
+  .option( '--concurrency <n>', 'max parallel repos', '5' )
+  .option( '--limit <n>', 'max rows to display', '80' )
+  .option( '--debug', 'enable debug logging' )
+  .addHelpText( 'after', `
+${chalk.yellow( 'Columns:' )}
+  ${chalk.green( 'pkg' )}    version from package.json
+  ${chalk.green( 'git' )}    latest semver git tag (green=match, yellow=mismatch, red=untagged)
+  ${chalk.green( 'name' )}  orange if dirty: pull/fetch failed (regular repos) or local modifications present (workspace packages)
+  ${chalk.green( 'scope' )}  package scope: @org, PRVT, or PUBL
+  ${chalk.green( 'cir' )}    CircleCI config: ✘=missing, L=legacy, 1=orb v1, 2=orb v2
+  ${chalk.green( 'ESM' )}    "type": "module" in package.json
+  ${chalk.green( 'har' )}    .har directory present at repo root
+  ${chalk.green( 'lnt' )}    ESLint version from node_modules (✘=no lint script, ?=not installed, yellow=v8, green=v9+)
+
+${chalk.yellow( 'Monorepos:' )}
+  Workspace packages are discovered automatically — passing a monorepo root
+  expands its workspaces field so you never need to add packages/* globs.
+  Git tags are looked up as pkg-name/vX.Y.Z. Pull/fetch runs at the root.
+
+${chalk.yellow( 'Examples:' )}
+  ${chalk.green( 'package-checker ~/repos/my-service' )}
+  ${chalk.green( 'package-checker --no-pull ~/repos/*' )}
+  ${chalk.green( 'package-checker --concurrency 10 @plt/* @kud/* @srv/* @tpi/*' )}
+` )
+  .parse()
+
+const dirs = program.args
+const options = program.opts()
+if ( options.debug ) { enableDebug() }
+
+if ( options.clear ) { clear() }
+
+// Auto-expand workspace packages from any monorepo roots in the input.
+// Supports both array and yarn-style { packages: [...] } workspaces fields.
+async function expandWorkspaces( dir ) {
+  try {
+    const pkg = await parseJsonFile( path.join( dir, 'package.json' ) )
+    const patterns = Array.isArray( pkg?.workspaces ) ?
+      pkg.workspaces :
+      ( pkg?.workspaces?.packages ?? [] )
+    if ( !patterns.length ) return []
+    const matches = await Promise.all(
+      patterns.map( p => glob( p, { cwd : dir, absolute : true } ) )
+    )
+    return matches.flat().filter( d => !/test|demo/i.test( path.basename( d ) ) )
+  } catch {
+    return []
+  }
+}
+
+const resolvedDirs  = dirs.map( dir => path.resolve( dir ) )
+const wsExpansions  = ( await Promise.all( resolvedDirs.map( expandWorkspaces ) ) ).flat()
+const allDirs       = [ ...new Set( [ ...resolvedDirs, ...wsExpansions ] ) ]
+
+const total   = allDirs.length
+let completed = 0
+const spinner = ora( `Checking repos (0/${total})...` ).start()
+
+process.on( 'SIGINT', () => { spinner.stop(); process.exit( 1 ) } )
+
+const limit = pLimit( parseInt( options.concurrency, 10 ) )
+const results = await Promise.all(
+  allDirs.map( dir => limit( async () => {
+    const result = await checkRepo( dir, { pull : options.pull } )
+    spinner.text = `Checking repos (${++completed}/${total})...`
+    return result
+  } ) )
+)
+
+spinner.stop()
+
+const rows = results
+  .filter( Boolean )
+  .sort( ( a, b ) => {
+    const ga = a.group ?? ''
+    const gb = b.group ?? ''
+    if ( ga !== gb ) return ga.localeCompare( gb )
+    return a.repoName.localeCompare( b.repoName )
+  } )
+
+if ( rows.length === 0 ) {
+  log( chalk.yellow( '\nNo valid repositories found.\n' ) )
+  process.exit( 0 )
+}
+
+const maxRows   = parseInt( options.limit, 10 )
+const checked   = rows.length
+const displayed = rows.slice( 0, maxRows )
+
+renderTable( displayed )
+
+const summary = checked > displayed.length ?
+  `total repositories checked: ${checked} (${displayed.length} displayed)\n` :
+  `total repositories checked: ${checked}\n`
+log( summary )

package/src/pkgck.sh

@@ -1,158 +0,0 @@
-#!/bin/bash
-
-C_off='\e[0m'
-C_yellow='\e[93m'
-C_red='\e[101m'
-C_green='\e[92m'
-
-good() {
-  printf "\e[32m✔${C_off}"
-}
-
-meh() {
-  printf "\e[36m✩${C_off}"
-}
-
-bad() {
-  printf "\e[31m✘${C_off}"
-}
-
-semver() {
-  local version=$1
-  local isSemver=`echo $version | egrep -e "^v\d+\.\d+\.\d+$"`
-  if [ -z "$version" ];
-  then
-    printf "UNTAGGD"
-  elif [ $isSemver ];
-  then
-    printf "$version"
-  else
-    printf "!SEMVER"
-  fi
-}
-
-check_babel () {
-  local C_stat=$(bad)
-  [ -f .babelrc ] && grep --silent @leverege/babel-preset-leverege-node .babelrc
-  [ $? -eq 0 ] && C_stat=$(good)
-  [ ! -f .babelrc ] && C_stat=$(meh)
-  printf $C_stat
-}
-
-check_har () {
-  local C_stat=$(bad)
-  local prep="`node -p \"require('./package.json').scripts.prepare\"`"
-  local isHar=`echo $prep | egrep -e "hook-and-release"`
-  [ ! -z "$isHar" ] && C_stat=$(good)
-  printf $C_stat
-}
-
-check_circle () {
-  local C_stat=$(bad)
-  [ -f ".circleci/config.yml" ] && C_stat=$(good)
-  printf $C_stat
-}
-
-check_eslint () {
-  local C_stat=$(bad)
-  [ -f .eslintrc ] && grep --silent @leverege/eslint-config-leverege .eslintrc
-  [ $? -eq 0 ] && C_stat=$(good)
-  printf $C_stat
-}
-
-check_license () {
-  local C_stat=$(meh)
-  local lic="`node -p \"require('./package.json').scripts.licenseCheck == undefined\"`"
-  [ $lic == true ] && C_stat=$(good)
-  printf $C_stat
-}
-
-# Invoke as: version_ck $GITTAG $NPMVER
-#
-check_git_version() {
-  local tag=$1
-  local pkg=$2
-  local clr=$C_green
-
-  if [ "$tag" == 'UNTAGGD' ];
-  then
-    clr=$C_red
-  elif [ "$tag" != "$pkg" ];
-  then
-    clr=$C_yellow
-  fi
-
-  printf "$clr$tag$C_off"
-}
-
-#check_nodemon() {
-#  nodemon="`getjson --file ./package.json --key nodemon`"
-#}
-
-check_scope() {
-  private="`node -p \"require('./package.json').private == true\"`"
-  scoped="`getjson --file ./package.json --key name --regex '^@\w{3}'`"
-  result="${C_red}PUBL${C_off}"
-  if [[ "$scoped" == "" ]] && [[ "$private" == "true" ]];
-  then
-    result="${C_yellow}PRVT"
-  elif [[ "$scoped" != "" ]];
-  then
-    result="${C_green}${scoped}"
-  elif [[ "$private" == "true" ]];
-  then
-    result="${C_green}prv"
-  fi
-  printf "${result}${C_off}"
-}
-
-check_ESM() {
-  local C_stat=$(bad)
-  jstype="`getjson --file package.json --key type`"
-  [[ "$jstype" == "module" ]] && C_stat=$(good)
-  printf $C_stat
-}
-
-repos=0
-check_repo() {
-  local dir=$1
-  [ ! -d $dir/.git ] || [ ! -f $dir/package.json ] && return
-  cd $dir &> /dev/null
-  local gperrs=0
-  git pull -q &> /dev/null;        [ $? -ne 0 ] && let "gperrs++"
-  git pull -q --tags &> /dev/null; [ $? -ne 0 ] && let "gperrs++"
-
-  # It is necessary to use the output from printf to set localmods in order
-  # to get the ANSI escape codes expanded.
-  local localmods=$(good)
-  [ $gperrs -ne 0 ] && localmods=$(bad)
-  pkgver=$(semver "v`node -p \"require('./package.json').version\"`")
-  gitver=$(semver `git describe --abbrev=0 2>/dev/null`)
-  [ $? -ne 0 ] && gitver='UNTAGGD'
-  local needspush=
-  if [ "$pkgver" == "$gitver" ];
-  then
-    git ls-remote --tags origin | grep $gitver &> /dev/null
-    [ $? -ne 0 ] && needspush='!tags'
-  fi
-  local babel7=$(check_babel)
-  local hookar=$(check_har)
-  local circle=$(check_circle)
-  local eslint=$(check_eslint)
-  local esmlib=$(check_ESM)
-  local license=$(check_license)
-  local scoped=$(check_scope)
-  [ $(( $repos % 15)) -eq 0 ] && printf "\n%35s pkg      git  cln scop cir lic ESM har\n"
-  printf "%32s: %-8s %-16s %s  %8s  %s   %s   %s   %s  %s\n" ${dir:0:32} $pkgver $(check_git_version $gitver $pkgver) $localmods $scoped $circle $license $esmlib $hookar "$needspush"
-  let "repos++"
-  cd - &> /dev/null
-}
-
-clear
-
-pkgs="$@"
-for dir in $@; do
-  check_repo $dir
-done
-
-printf "\ntotal repoitories checked: $repos\n\n"