@lzear/repo-lint 4.2.2 → 4.4.0

package/dist/index.js

@@ -1,149 +1,565 @@
 // src/index.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import { tmpdir } from "os";
-import path2 from "path";
+import path3 from "path";
 
 // src/checks.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "fs";
+import path2 from "path";
+import { fileURLToPath } from "url";
+import { run as ncuRun2 } from "npm-check-updates";
+import { publint } from "publint";
+import { maxSatisfying, satisfies } from "semver";
+
+// src/update.ts
 import { spawnSync } from "child_process";
-import { existsSync, readdirSync, readFileSync } from "fs";
+import { existsSync, readFileSync, writeFileSync } from "fs";
 import path from "path";
-import { fileURLToPath } from "url";
+import { pathToFileURL } from "url";
 import { run as ncuRun } from "npm-check-updates";
-import { publint } from "publint";
-var _dirname = path.dirname(fileURLToPath(import.meta.url));
-var readPkg = (dir) => {
-  const f = path.join(dir, "package.json");
-  if (!existsSync(f)) return null;
+var LOCKFILES = [
+  ["bun.lock", "bun"],
+  ["bun.lockb", "bun"],
+  ["pnpm-lock.yaml", "pnpm"],
+  ["yarn.lock", "yarn"],
+  ["package-lock.json", "npm"]
+];
+var PM_FIELD_RE = /^(npm|yarn|pnpm|bun)@([^+\s]+)/;
+var readJsonFile = (file) => {
+  const raw = readFileSync(file, "utf8");
+  return {
+    data: JSON.parse(raw),
+    indent: /^[ \t]+/m.exec(raw)?.[0] ?? "  ",
+    trailingNewline: raw.endsWith("\n")
+  };
+};
+var writeJsonFile = (file, json) => {
+  writeFileSync(
+    file,
+    JSON.stringify(json.data, null, json.indent) + (json.trailingNewline ? "\n" : ""),
+    "utf8"
+  );
+};
+var detectPackageManager = (dir) => {
+  const packageFile = path.join(dir, "package.json");
+  if (existsSync(packageFile))
+    try {
+      const package_ = JSON.parse(readFileSync(packageFile, "utf8"));
+      if (typeof package_.packageManager === "string") {
+        const match = PM_FIELD_RE.exec(package_.packageManager);
+        if (match?.[1] && match[2])
+          return {
+            name: match[1],
+            version: match[2],
+            source: "packageManager"
+          };
+      }
+    } catch {
+    }
+  for (const [file, name] of LOCKFILES)
+    if (existsSync(path.join(dir, file))) return { name, source: "lockfile" };
+  return { name: "npm", source: "default" };
+};
+var fetchJson = async (url) => {
+  const response = await fetch(url);
+  if (!response.ok) throw new Error(`GET ${url} \u2014 HTTP ${response.status}`);
+  return await response.json();
+};
+var pmRegistryName = (name, currentMajor) => name === "yarn" && currentMajor >= 2 ? "@yarnpkg%2Fcli-dist" : name;
+var latestPackageVersion = async (name) => {
+  const data = await fetchJson(`https://registry.npmjs.org/${name}/latest`);
+  if (typeof data.version !== "string")
+    throw new Error(`no version in registry response for ${name}`);
+  return data.version;
+};
+var hasWorkspaces = (dir) => {
+  try {
+    const package_ = JSON.parse(
+      readFileSync(path.join(dir, "package.json"), "utf8")
+    );
+    const ws = package_.workspaces;
+    if (Array.isArray(ws)) return ws.length > 0;
+    const packages = ws?.packages;
+    return Array.isArray(packages) && packages.length > 0;
+  } catch {
+    return false;
+  }
+};
+var NCURC_FILES = [
+  ".ncurc.json",
+  ".ncurc.js",
+  ".ncurc.cjs",
+  ".ncurc.mjs",
+  ".ncurc"
+];
+var loadNcuRc = async (dir) => {
+  for (const name of NCURC_FILES) {
+    const file = path.join(dir, name);
+    if (!existsSync(file)) continue;
+    if (name === ".ncurc" || name.endsWith(".json"))
+      return {
+        file: name,
+        config: JSON.parse(readFileSync(file, "utf8"))
+      };
+    const module_ = await import(pathToFileURL(file).href);
+    return { file: name, config: module_.default ?? module_ };
+  }
+  return { config: {} };
+};
+var stepDeps = async (dir, isDry) => {
+  const base = { id: "deps", desc: "dependency ranges (ncu)" };
+  try {
+    const isWorkspaces = hasWorkspaces(dir);
+    const rc = await loadNcuRc(dir);
+    const result = await ncuRun({
+      ...rc.config,
+      packageFile: path.join(dir, "package.json"),
+      cwd: dir,
+      upgrade: !isDry,
+      silent: true,
+      dep: ["prod", "dev", "optional", "peer"],
+      ...isWorkspaces && { workspaces: true, root: true }
+    });
+    const entries = isWorkspaces ? Object.values(result).flatMap(
+      (x) => Object.entries(x)
+    ) : Object.entries(result);
+    const rcNote = rc.file ? ` (using ${rc.file})` : "";
+    if (entries.length === 0)
+      return {
+        ...base,
+        pass: true,
+        changed: false,
+        detail: `up to date${rcNote}`
+      };
+    return {
+      ...base,
+      pass: true,
+      changed: true,
+      detail: entries.map(([k, v]) => `${k}  \u2192  ${v}`).join("\n") + rcNote
+    };
+  } catch (error) {
+    return { ...base, pass: false, changed: false, detail: String(error) };
+  }
+};
+var stepPackageManager = async (dir, isDry) => {
+  const base = { id: "package-manager", desc: "packageManager field" };
+  try {
+    const file = path.join(dir, "package.json");
+    const json = readJsonFile(file);
+    if (typeof json.data.packageManager !== "string")
+      return {
+        ...base,
+        pass: true,
+        changed: false,
+        detail: "no packageManager field"
+      };
+    const match = PM_FIELD_RE.exec(json.data.packageManager);
+    if (!match)
+      return {
+        ...base,
+        pass: true,
+        changed: false,
+        detail: `unrecognized: ${json.data.packageManager}`
+      };
+    const [, name, current] = match;
+    const major = Number(current.split(".", 1)[0]);
+    const latest = await latestPackageVersion(pmRegistryName(name, major));
+    if (latest === current)
+      return {
+        ...base,
+        pass: true,
+        changed: false,
+        detail: `${name}@${current} is latest`
+      };
+    json.data.packageManager = `${name}@${latest}`;
+    if (!isDry) writeJsonFile(file, json);
+    return {
+      ...base,
+      pass: true,
+      changed: true,
+      detail: `${name} ${current}  \u2192  ${latest}`
+    };
+  } catch (error) {
+    return { ...base, pass: false, changed: false, detail: String(error) };
+  }
+};
+var updateVersionFile = (file, latest, isDry) => {
+  const raw = readFileSync(file, "utf8");
+  const current = raw.trim();
+  const isVPrefixed = current.startsWith("v");
+  const next = isVPrefixed ? `v${latest}` : latest;
+  if (current === next)
+    return { changed: false, detail: `${path.basename(file)} is latest` };
+  if (!isDry)
+    writeFileSync(file, next + (raw.endsWith("\n") ? "\n" : ""), "utf8");
+  return {
+    changed: true,
+    detail: `${path.basename(file)} ${current}  \u2192  ${next}`
+  };
+};
+var stepNodeVersion = async (dir, isDry) => {
+  const base = { id: "node-version", desc: "node version files" };
+  const files = [".nvmrc", ".node-version"].map((f) => path.join(dir, f)).filter((f) => existsSync(f));
+  if (files.length === 0)
+    return { ...base, pass: true, changed: false, detail: "no version file" };
+  try {
+    const response = await fetch("https://nodejs.org/dist/index.json");
+    if (!response.ok)
+      throw new Error(
+        `GET nodejs.org/dist/index.json \u2014 HTTP ${response.status}`
+      );
+    const index = await response.json();
+    const lts = index.find((v) => v.lts);
+    if (!lts) throw new Error("no LTS release found");
+    const latest = lts.version.replace(/^v/, "");
+    const results = files.map((f) => updateVersionFile(f, latest, isDry));
+    return {
+      ...base,
+      pass: true,
+      changed: results.some((r) => r.changed),
+      detail: results.map((r) => r.detail).join("\n")
+    };
+  } catch (error) {
+    return { ...base, pass: false, changed: false, detail: String(error) };
+  }
+};
+var stepBunVersion = async (dir, isDry) => {
+  const base = { id: "bun-version", desc: "bun version file" };
+  const file = path.join(dir, ".bun-version");
+  if (!existsSync(file))
+    return { ...base, pass: true, changed: false, detail: "no version file" };
+  try {
+    const latest = await latestPackageVersion("bun");
+    const result = updateVersionFile(file, latest, isDry);
+    return { ...base, pass: true, ...result };
+  } catch (error) {
+    return { ...base, pass: false, changed: false, detail: String(error) };
+  }
+};
+var LICENSE_FILES = ["LICENSE", "LICENSE.md", "LICENSE.txt"];
+var COPYRIGHT_RE = /(copyright(?:\s+\(c\)|\s+©)?\s+)(\d{4})(?:\s*-\s*(\d{4}))?/i;
+var stepLicenseYear = (dir, isDry) => {
+  const base = { id: "license-year", desc: "LICENSE copyright year" };
+  const file = LICENSE_FILES.map((f) => path.join(dir, f)).find(
+    (f) => existsSync(f)
+  );
+  if (!file)
+    return { ...base, pass: true, changed: false, detail: "no license file" };
+  const raw = readFileSync(file, "utf8");
+  const match = COPYRIGHT_RE.exec(raw);
+  if (!match?.[2])
+    return {
+      ...base,
+      pass: true,
+      changed: false,
+      detail: "no copyright year found"
+    };
+  const year = (/* @__PURE__ */ new Date()).getFullYear();
+  const start = match[2];
+  const end = Number(match[3] ?? start);
+  if (end >= year)
+    return {
+      ...base,
+      pass: true,
+      changed: false,
+      detail: `${start}${match[3] ? "-" + match[3] : ""} is current`
+    };
+  const current = match[0];
+  const next = `${match[1] ?? ""}${start}-${year}`;
+  if (!isDry)
+    writeFileSync(
+      file,
+      raw.replace(COPYRIGHT_RE, () => next),
+      "utf8"
+    );
+  return {
+    ...base,
+    pass: true,
+    changed: true,
+    detail: `${current.trim()}  \u2192  ${next.trim()}`
+  };
+};
+var installCommands = (pm) => {
+  switch (pm.name) {
+    case "bun":
+      return [["bun", "update"]];
+    case "pnpm":
+      return [
+        ["pnpm", "install"],
+        ["pnpm", "update", "--recursive"],
+        ["pnpm", "dedupe"]
+      ];
+    case "yarn":
+      return pm.version?.startsWith("1.") ? [
+        ["yarn", "install"],
+        ["yarn", "upgrade"]
+      ] : [
+        ["yarn", "install"],
+        ["yarn", "up", "--recursive", "*"],
+        ["yarn", "dedupe"]
+      ];
+    case "npm":
+      return [
+        ["npm", "install"],
+        ["npm", "update"],
+        ["npm", "dedupe"]
+      ];
+  }
+};
+var stepInstall = (dir, pm) => {
+  const base = {
+    id: "install",
+    desc: `install & refresh lockfile (${pm.name})`
+  };
+  const lines = [];
+  for (const [command, ...arguments_] of installCommands(pm)) {
+    lines.push(`$ ${[command, ...arguments_].join(" ")}`);
+    const result = spawnSync(command, arguments_, {
+      cwd: dir,
+      stdio: "inherit"
+    });
+    if (result.status !== 0)
+      return {
+        ...base,
+        pass: false,
+        changed: true,
+        detail: `${lines.join("\n")}
+exited with ${result.status ?? "signal"}`
+      };
+  }
+  return { ...base, pass: true, changed: true, detail: lines.join("\n") };
+};
+var runUpdate = async (options = {}) => {
+  const {
+    dir = process.cwd(),
+    dry: isDry = false,
+    install: isInstall = true
+  } = options;
+  const packageManager = detectPackageManager(dir);
+  const results = [
+    await stepDeps(dir, isDry),
+    await stepPackageManager(dir, isDry),
+    await stepNodeVersion(dir, isDry),
+    await stepBunVersion(dir, isDry),
+    stepLicenseYear(dir, isDry)
+  ];
+  if (isInstall && !isDry) results.push(stepInstall(dir, packageManager));
+  return { dir, packageManager, results };
+};
+
+// src/checks.ts
+var _dirname = path2.dirname(fileURLToPath(import.meta.url));
+var readPackage = (dir) => {
+  const f = path2.join(dir, "package.json");
+  if (!existsSync2(f)) return null;
   try {
-    return JSON.parse(readFileSync(f, "utf8"));
+    return JSON.parse(readFileSync2(f, "utf8"));
   } catch {
     return null;
   }
 };
-var getWorkspacePatterns = (pkg) => {
-  const ws = pkg.workspaces;
+var getWorkspacePatterns = (package_) => {
+  const ws = package_.workspaces;
   if (Array.isArray(ws)) return ws;
-  const wsPkg = ws;
-  if (Array.isArray(wsPkg?.packages)) return wsPkg.packages;
+  const wsPackage = ws;
+  if (Array.isArray(wsPackage?.packages)) return wsPackage.packages;
   return [];
 };
 var patternToBase = (rootDir, pattern) => {
   const parts = pattern.split("/");
   if (parts.length === 2 && parts[1] === "*")
-    return path.join(rootDir, parts[0] ?? "");
+    return path2.join(rootDir, parts[0] ?? "");
   if (parts.length === 1 && parts[0] === "*") return rootDir;
   return null;
 };
-var getWorkspaceDirs = (rootDir) => {
-  const pkg = readPkg(rootDir);
-  if (!pkg) return [];
-  const dirs = [];
-  for (const pattern of getWorkspacePatterns(pkg)) {
+var getWorkspaceDirectories = (rootDir) => {
+  const package_ = readPackage(rootDir);
+  if (!package_) return [];
+  const directories = [];
+  for (const pattern of getWorkspacePatterns(package_)) {
     const base = patternToBase(rootDir, pattern);
-    if (!base || !existsSync(base)) continue;
-    for (const entry of readdirSync(base, { withFileTypes: true }))
-      if (entry.isDirectory()) dirs.push(path.join(base, entry.name));
+    if (!base || !existsSync2(base)) continue;
+    const entries = readdirSync(base, { withFileTypes: true });
+    for (const entry of entries)
+      if (entry.isDirectory()) directories.push(path2.join(base, entry.name));
   }
-  return dirs;
+  return directories;
 };
 var findBin = (name, startDir) => {
   let dir = startDir;
   while (true) {
-    const bin = path.join(dir, "node_modules", ".bin", name);
-    if (existsSync(bin)) return bin;
-    const parent = path.join(dir, "..");
+    const bin = path2.join(dir, "node_modules", ".bin", name);
+    if (existsSync2(bin)) return bin;
+    const parent = path2.join(dir, "..");
     if (parent === dir) return null;
     dir = parent;
   }
 };
-var eachPublishedPkg = async (dir, fn) => {
-  const pkg = readPkg(dir);
-  if (!pkg) return { pass: true };
-  if (pkg.private === true) {
-    const wsDirs = getWorkspaceDirs(dir);
-    if (wsDirs.length === 0) return { pass: true };
+var eachPublishedPackage = async (dir, function_) => {
+  const package_ = readPackage(dir);
+  if (!package_) return { pass: true };
+  if (package_.private === true) {
+    const wsDirectories = getWorkspaceDirectories(dir);
+    if (wsDirectories.length === 0) return { pass: true };
     const results = await Promise.all(
-      wsDirs.map((d) => eachPublishedPkg(d, fn))
+      wsDirectories.map((d) => eachPublishedPackage(d, function_))
     );
     const failures = results.filter((r) => !r.pass);
     if (failures.length === 0) return { pass: true };
     const detail = failures.flatMap((r) => r.detail ? [r.detail] : []).join("\n");
     return { pass: false, ...detail && { detail } };
   }
-  return fn(dir);
+  return function_(dir);
 };
 var hasPublishedPkg = (dir) => {
-  const pkg = readPkg(dir);
-  if (!pkg) return false;
-  if (pkg.private !== true) return true;
-  return getWorkspaceDirs(dir).some((d) => hasPublishedPkg(d));
+  const package_ = readPackage(dir);
+  if (!package_) return false;
+  if (package_.private !== true) return true;
+  return getWorkspaceDirectories(dir).some((d) => hasPublishedPkg(d));
 };
 var readmeIncludes = (dir, needle) => {
-  const f = path.join(dir, "README.md");
-  return existsSync(f) && readFileSync(f, "utf8").includes(needle);
+  const f = path2.join(dir, "README.md");
+  return existsSync2(f) && readFileSync2(f, "utf8").includes(needle);
+};
+var FORGE_WORKFLOW_RE = /uses:\s*lzear\/forge\/\.github\/workflows\/ci\.yml@/;
+var isForgeRepo = (dir) => getWorkspaceDirectories(dir).some(
+  (d) => readPackage(d)?.name === "@lzear/forge"
+);
+var callsForgeWorkflow = (dir) => {
+  const wfDir = path2.join(dir, ".github", "workflows");
+  if (!existsSync2(wfDir)) return false;
+  return readdirSync(wfDir).filter((f) => /\.ya?ml$/.test(f)).some(
+    (f) => FORGE_WORKFLOW_RE.test(readFileSync2(path2.join(wfDir, f), "utf8"))
+  );
+};
+var auditCommand = (pm) => {
+  switch (pm.name) {
+    case "npm":
+      return ["npm", "audit", "--omit", "dev", "--audit-level", "high"];
+    case "pnpm":
+      return ["pnpm", "audit", "--prod", "--audit-level", "high"];
+    case "bun":
+      return ["bun", "audit"];
+    case "yarn":
+      return pm.version?.startsWith("1.") ? ["yarn", "audit", "--level", "high"] : [
+        "yarn",
+        "npm",
+        "audit",
+        "--environment",
+        "production",
+        "--severity",
+        "high"
+      ];
+  }
+};
+var DEP_FIELDS = [
+  "dependencies",
+  "devDependencies",
+  "optionalDependencies",
+  "peerDependencies"
+];
+var NON_REGISTRY_RANGE_RE = /^(?:workspace:|file:|link:|portal:|catalog:|git|https?:)/;
+var collectEntry = (dependencies, name, range) => {
+  if (typeof range !== "string" || NON_REGISTRY_RANGE_RE.test(range)) return;
+  const alias = /^npm:(.+)@([^@]+)$/.exec(range);
+  const target = alias?.[1] ?? name;
+  const targetRange = alias?.[2] ?? range;
+  if (!dependencies.has(target)) dependencies.set(target, targetRange);
+};
+var collectFromPackage = (dependencies, packageDir) => {
+  const package_ = readPackage(packageDir);
+  for (const field of DEP_FIELDS) {
+    const section = package_?.[field];
+    if (typeof section !== "object" || section === null) continue;
+    for (const [name, range] of Object.entries(section))
+      collectEntry(dependencies, name, range);
+  }
+};
+var collectDependencies = (dir) => {
+  const dependencies = /* @__PURE__ */ new Map();
+  for (const packageDir of [dir, ...getWorkspaceDirectories(dir)])
+    collectFromPackage(dependencies, packageDir);
+  return dependencies;
+};
+var findDeprecated = async (name, range) => {
+  const response = await fetch(
+    `https://registry.npmjs.org/${name.replace("/", "%2F")}`,
+    {
+      headers: { accept: "application/vnd.npm.install-v1+json" },
+      signal: AbortSignal.timeout(1e4)
+    }
+  );
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  const data = await response.json();
+  const latest = data["dist-tags"]?.latest;
+  const resolved = latest && satisfies(latest, range) ? latest : maxSatisfying(Object.keys(data.versions), range);
+  if (!resolved) return null;
+  const deprecated = data.versions[resolved]?.deprecated;
+  return deprecated ? `${name}@${resolved} \u2014 ${deprecated.slice(0, 120)}` : null;
 };
 var LOCAL_CHECKS = [
   {
     id: "readme-exists",
-    desc: "README.md exists",
+    desc: "README",
     type: "local",
-    check: (dir) => existsSync(path.join(dir, "README.md"))
-  },
-  {
-    id: "readme-codacy-grade-badge",
-    desc: "README has Codacy grade badge",
-    type: "local",
-    publishedOnly: true,
-    check: (dir) => readmeIncludes(dir, "project/badge/Grade/")
-  },
-  {
-    id: "readme-codacy-coverage-badge",
-    desc: "README has Codacy coverage badge",
-    type: "local",
-    publishedOnly: true,
-    check: (dir) => readmeIncludes(dir, "project/badge/Coverage/")
+    check: (dir) => existsSync2(path2.join(dir, "README.md"))
   },
   {
     id: "readme-npm-badge",
-    desc: "README has npm badge",
+    desc: "npm badge",
     type: "local",
     publishedOnly: true,
     check: (dir) => readmeIncludes(dir, "shields.io/npm/v/")
   },
   {
-    id: "codacy-config",
-    desc: ".codacy.yml exists",
+    id: "codacy",
+    desc: "Codacy",
     type: "local",
     publishedOnly: true,
-    check: (dir) => existsSync(path.join(dir, ".codacy.yml"))
+    check: (dir) => {
+      const missing = [
+        readmeIncludes(dir, "project/badge/Grade/") ? null : "grade badge missing in README",
+        readmeIncludes(dir, "project/badge/Coverage/") ? null : "coverage badge missing in README",
+        existsSync2(path2.join(dir, ".codacy.yml")) ? null : ".codacy.yml missing"
+      ].filter((m) => m !== null);
+      if (missing.length === 0) return true;
+      return { pass: false, detail: missing.join("\n") };
+    }
   },
   {
     id: "license",
-    desc: "LICENSE exists",
+    desc: "LICENSE",
     type: "local",
     publishedOnly: true,
-    check: (dir) => existsSync(path.join(dir, "LICENSE"))
+    check: (dir) => existsSync2(path2.join(dir, "LICENSE"))
   },
   {
     id: "ci-workflow",
-    desc: "CI workflow exists",
+    desc: "CI calls forge workflow",
     type: "local",
     publishedOnly: true,
-    check: (dir) => existsSync(path.join(dir, ".github/workflows/ci.yml"))
+    check: (dir) => {
+      if (callsForgeWorkflow(dir) || isForgeRepo(dir)) return true;
+      return {
+        pass: false,
+        detail: "no workflow calls the forge reusable CI \u2014 replace the local ci.yml copy with:\n  jobs:\n    ci:\n      uses: lzear/forge/.github/workflows/ci.yml@<sha> # vX.Y.Z\n(pin to a commit SHA; renovate keeps it fresh)"
+      };
+    }
   },
   {
     id: "renovate",
-    desc: "renovate.json exists",
+    desc: "renovate.json",
     type: "local",
-    check: (dir) => existsSync(path.join(dir, "renovate.json"))
+    check: (dir) => existsSync2(path2.join(dir, "renovate.json"))
   },
   {
     id: "pkg-publint",
-    desc: "publint (all published packages)",
+    desc: "publint",
     type: "local",
     publishedOnly: true,
-    check: (dir) => eachPublishedPkg(dir, async (pkgDir) => {
+    check: (dir) => eachPublishedPackage(dir, async (pkgDir) => {
       const { messages } = await publint({ pkgDir });
       const failures = messages.filter(
         (m) => m.type === "error" || m.type === "warning"
@@ -157,13 +573,13 @@ var LOCAL_CHECKS = [
   },
   {
     id: "pkg-attw",
-    desc: "attw (all published packages)",
+    desc: "attw",
     type: "local",
     check: (dir) => {
       const bin = findBin("attw", _dirname);
       if (!bin) return { pass: false, detail: "attw not available" };
-      return eachPublishedPkg(dir, (pkgDir) => {
-        const r = spawnSync(
+      return eachPublishedPackage(dir, (pkgDir) => {
+        const r = spawnSync2(
           process.execPath,
           [bin, "--pack", "--profile", "esm-only"],
           {
@@ -179,12 +595,12 @@ var LOCAL_CHECKS = [
   },
   {
     id: "pkg-knip",
-    desc: "knip (no unused exports/deps)",
+    desc: "knip",
     type: "local",
     check: (dir) => {
       const bin = findBin("knip", _dirname);
       if (!bin) return { pass: false, detail: "knip not available" };
-      const r = spawnSync(process.execPath, [bin], {
+      const r = spawnSync2(process.execPath, [bin], {
         cwd: dir,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"],
@@ -197,28 +613,90 @@ var LOCAL_CHECKS = [
 Run: npx knip` };
     }
   },
+  {
+    id: "monorepo-lint",
+    desc: "sherif (workspaces)",
+    type: "local",
+    check: (dir) => {
+      const package_ = readPackage(dir);
+      if (!package_ || getWorkspacePatterns(package_).length === 0)
+        return { pass: true, detail: "not a monorepo" };
+      const bin = findBin("sherif", _dirname);
+      if (!bin) return { pass: false, detail: "sherif not available" };
+      const r = spawnSync2(process.execPath, [bin], {
+        cwd: dir,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        env: { ...process.env, NO_COLOR: "1" }
+      });
+      if (r.status === 0) return true;
+      const detail = (r.stdout + r.stderr).trim().split("\n").slice(0, 20).join("\n");
+      return { pass: false, detail };
+    }
+  },
+  {
+    id: "deps-audit",
+    desc: "audit",
+    type: "local",
+    check: (dir) => {
+      const pm = detectPackageManager(dir);
+      const [command, ...arguments_] = auditCommand(pm);
+      const r = spawnSync2(command, arguments_, {
+        cwd: dir,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      if (r.error) return { pass: false, detail: String(r.error) };
+      if (r.status === 0) return true;
+      const detail = (r.stdout + r.stderr).trim().split("\n").slice(0, 20).join("\n");
+      return { pass: false, detail: detail || `audit exited ${r.status}` };
+    }
+  },
+  {
+    id: "deps-deprecated",
+    desc: "no deprecated deps",
+    type: "local",
+    check: async (dir) => {
+      const dependencies = collectDependencies(dir);
+      const failures = [];
+      await Promise.all(
+        [...dependencies].map(async ([name, range]) => {
+          try {
+            const deprecated = await findDeprecated(name, range);
+            if (deprecated) failures.push(deprecated);
+          } catch (error) {
+            failures.push(`${name} \u2014 check failed: ${String(error)}`);
+          }
+        })
+      );
+      if (failures.length === 0) return true;
+      return {
+        pass: false,
+        detail: failures.toSorted((a, b) => a.localeCompare(b)).join("\n")
+      };
+    }
+  },
   {
     id: "deps-fresh",
-    desc: "dependencies up to date (ncu)",
+    desc: "deps up to date",
     type: "local",
     check: async (dir) => {
-      const pkg = readPkg(dir);
-      const hasWorkspaces = Array.isArray(pkg?.workspaces) && pkg.workspaces.length > 0;
+      const package_ = readPackage(dir);
+      const hasWorkspaces2 = Array.isArray(package_?.workspaces) && package_.workspaces.length > 0;
       try {
-        const result = await ncuRun({
-          packageFile: path.join(dir, "package.json"),
-          ...hasWorkspaces ? { workspaces: true } : {},
+        const result = await ncuRun2({
+          packageFile: path2.join(dir, "package.json"),
+          ...hasWorkspaces2 && { workspaces: true },
           silent: true
         });
-        const entries = hasWorkspaces ? Object.values(
+        const entries = hasWorkspaces2 ? Object.values(
           result
         ).flatMap((x) => Object.entries(x)) : Object.entries(result);
         if (entries.length === 0) return true;
         const lines = entries.map(([k, v]) => `${k}  \u2192  ${v}`).join("\n");
-        const cmd = hasWorkspaces ? "yarn dlx npm-check-updates --dep dev,optional,peer,prod,packageManager -u --workspaces && yarn install" : "yarn dlx npm-check-updates --dep dev,optional,peer,prod,packageManager -u && yarn install";
         return { pass: false, detail: `${lines}
 
-Run: ${cmd}` };
+Run: forge update` };
       } catch (error) {
         return { pass: false, detail: String(error) };
       }
@@ -227,7 +705,7 @@ Run: ${cmd}` };
 ];
 var listSecrets = (repo) => {
   try {
-    const result = spawnSync(
+    const result = spawnSync2(
       "gh",
       ["secret", "list", "--repo", repo, "--json", "name"],
       {
@@ -244,7 +722,7 @@ var listSecrets = (repo) => {
 var REMOTE_CHECKS = [
   {
     id: "secret-codacy-token",
-    desc: "Secret CODACY_PROJECT_TOKEN set",
+    desc: "Codacy secret",
     type: "remote",
     publishedOnly: true,
     check: (repo) => {
@@ -265,19 +743,21 @@ var checkLocal = async (options = {}) => {
         stdio: ["ignore", "pipe", "ignore"]
       }).trim();
       const match = /github\.com[:/](.+?)(?:\.git)?$/.exec(remote);
-      return match?.[1] ?? path2.basename(dir);
+      return match?.[1] ?? path3.basename(dir);
     } catch {
       return dir;
     }
   })();
-  const published = hasPublishedPkg(dir);
+  const isPublished = hasPublishedPkg(dir);
   const localResults = await Promise.all(
-    LOCAL_CHECKS.filter((c) => !c.publishedOnly || published).map(async (c) => {
-      const raw = await c.check(dir);
-      return typeof raw === "boolean" ? { id: c.id, desc: c.desc, pass: raw } : { id: c.id, desc: c.desc, ...raw };
-    })
+    LOCAL_CHECKS.filter((c) => !c.publishedOnly || isPublished).map(
+      async (c) => {
+        const raw = await c.check(dir);
+        return typeof raw === "boolean" ? { id: c.id, desc: c.desc, pass: raw } : { id: c.id, desc: c.desc, ...raw };
+      }
+    )
   );
-  const remoteResults = skipRemote ? [] : REMOTE_CHECKS.filter((c) => !c.publishedOnly || published).map((c) => ({
+  const remoteResults = skipRemote ? [] : REMOTE_CHECKS.filter((c) => !c.publishedOnly || isPublished).map((c) => ({
     id: c.id,
     desc: c.desc,
     pass: c.check(repo)
@@ -287,11 +767,11 @@ var checkLocal = async (options = {}) => {
 var checkRepo = async (repo, options = {}) => {
   const {
     token,
-    baseDir = path2.join(tmpdir(), "repo-lint"),
+    baseDir = path3.join(tmpdir(), "repo-lint"),
     skipRemote = false
   } = options;
-  const dir = path2.join(baseDir, repo.replace("/", "__"));
-  if (existsSync2(dir))
+  const dir = path3.join(baseDir, repo.replace("/", "__"));
+  if (existsSync3(dir))
     execSync(`git -C ${dir} pull --quiet`, { stdio: "ignore" });
   else {
     const url = token ? `https://${token}@github.com/${repo}.git` : `https://github.com/${repo}.git`;
@@ -315,5 +795,7 @@ export {
   LOCAL_CHECKS,
   REMOTE_CHECKS,
   checkLocal,
-  checkRepo
+  checkRepo,
+  detectPackageManager,
+  runUpdate
 };