fyn 2.0.3 → 2.1.0

package/dist/fyn.js

@@ -132,6 +132,7 @@ const PromiseQueue = __webpack_require__("./lib/util/promise-queue.ts");
 const sortObjKeys = __webpack_require__("./lib/util/sort-obj-keys.ts");
 const fyntil = __webpack_require__("./lib/util/fyntil.ts");
 const showStat = __webpack_require__("./cli/show-stat.ts");
+const showAudit = __webpack_require__("./cli/show-audit.ts");
 const { runNpmScript, addNpmLifecycle } = __webpack_require__("./lib/util/run-npm-script.ts");
 const { initEnv, makeNpmEnv } = __webpack_require__("./lib/util/make-npm-env.ts");
 const runScript = __webpack_require__("./node_modules/.f/_/@npmcli/run-script/10.0.2/@npmcli/run-script/lib/run-script.js");
@@ -437,10 +438,11 @@ class FynCli {
    * 3. postinstall
    * 4. prepare
    */
-  install() {
+  install(argv = {}) {
     let failure;
     let installLocked;
     const start = Date.now();
+    const runAudit = argv.opts?.audit !== false;
     return Promise.try(() => this.fyn._initializePkg()).then(async () => {
       checkNewVersion(this.fyn._options);
       if (!this.fyn._changeProdMode && !this.fyn._options.forceInstall && this.fyn._installConfig.time) {
@@ -528,6 +530,17 @@ class FynCli {
         chalk.green("complete in total"),
         chalk.magenta(`${(end - start) / 1e3}`) + "secs"
       );
+      if (runAudit) {
+        try {
+          await showAudit(this.fyn, {
+            colors: this.fyn._options.colors !== false,
+            summary: true
+            // Show brief summary, not full report
+          });
+        } catch (err) {
+          logger.warn("Security audit failed:", err.message);
+        }
+      }
     }).catch((err) => {
       if (err.message === "No Change") {
         logger.info(`No changes detected since last fyn install - nothing to be done.
@@ -555,6 +568,17 @@ class FynCli {
       return this._opts.saveLogs && this.saveLogs(this._opts.saveLogs);
     });
   }
+  audit(argv) {
+    const opts = {
+      json: argv.opts?.json || false,
+      omit: argv.opts?.omit || [],
+      auditLevel: argv.opts?.auditLevel || "info",
+      noCache: argv.opts?.noCache || false
+    };
+    return showAudit(this.fyn, opts).finally(() => {
+      return this._opts.saveLogs && this.saveLogs(this._opts.saveLogs);
+    });
+  }
   async runScript(pkg, script, env, scriptArgs = []) {
     const config = (x) => this.fyn.allrc[x];
     const options = {
@@ -1005,7 +1029,7 @@ const commands = {
     desc: "Install modules",
     async exec(cmd) {
       const cli = new FynCli(await pickOptions(cmd));
-      return cli.install();
+      return cli.install(cmd.jsonMeta);
     },
     options: {
       "run-npm": {
@@ -1016,6 +1040,11 @@ const commands = {
         alias: "fi",
         desc: "force install even if no files changed since last install",
         args: "<flag boolean>"
+      },
+      audit: {
+        desc: "run security audit after install (use --no-audit to skip)",
+        args: "<flag boolean>",
+        default: true
       }
     }
   },
@@ -1040,7 +1069,7 @@ const commands = {
         config.noStartupInfo = true;
         logger.info("installing...");
         fynTil.resetFynpo();
-        return new FynCli(config).install();
+        return new FynCli(config).install({ opts: { audit: meta.opts.audit } });
       });
     },
     options: {
@@ -1110,6 +1139,32 @@ const commands = {
       return new FynCli(await pickOptions(cmd)).stat(cmd.jsonMeta);
     }
   },
+  audit: {
+    desc: "Check for known security vulnerabilities",
+    exec: async (cmd) => {
+      return new FynCli(await pickOptions(cmd)).audit(cmd.jsonMeta);
+    },
+    options: {
+      json: {
+        alias: "j",
+        args: "<flag boolean>",
+        desc: "Output audit report as JSON"
+      },
+      omit: {
+        args: "[types string..]",
+        desc: "Dependency types to omit (dev, optional, peer)"
+      },
+      "audit-level": {
+        args: "<level string>",
+        desc: "Minimum severity level to report (info, low, moderate, high, critical)",
+        default: "info"
+      },
+      "no-cache": {
+        args: "<flag boolean>",
+        desc: "Bypass the audit cache and fetch fresh data"
+      }
+    }
+  },
   run: {
     desc: "Run a npm script",
     args: "[script string] [args...]",
@@ -1437,6 +1492,95 @@ const myPkg = JSON.parse(Fs.readFileSync(Path.join(__dirname, "../package.json")
 module.exports = myPkg;
 
 
+/***/ }),
+
+/***/ "./cli/show-audit.ts":
+/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+
+"use strict";
+
+const Promise = __webpack_require__("./node_modules/.f/_/aveazul/1.1.0/aveazul/cjs-entry.cjs");
+const CliLogger = __webpack_require__("./lib/cli-logger.ts");
+const logger = __webpack_require__("./lib/logger.ts");
+const AuditReport = __webpack_require__("./lib/audit/audit-report.ts");
+const AuditFormatter = __webpack_require__("./lib/audit/audit-formatter.ts");
+const PkgStatProvider = __webpack_require__("./lib/pkg-stat-provider.ts");
+const { FETCH_META } = __webpack_require__("./lib/log-items.ts");
+class ShowAudit {
+  /**
+   * @param {Object} options
+   * @param {Object} options.fyn - Fyn instance
+   * @param {Object} options.opts - CLI options
+   */
+  constructor({ fyn, opts }) {
+    this._fyn = fyn;
+    this._opts = opts || {};
+    this._fyn._options.buildLocal = false;
+  }
+  /**
+   * Run the audit workflow.
+   *
+   * @returns {Promise<void>}
+   */
+  async runAudit() {
+    const spinner = CliLogger.spinners[1];
+    try {
+      let depData = this._fyn._data;
+      if (!depData || Object.keys(depData.pkgs || {}).length === 0) {
+        logger.addItem({ name: FETCH_META, color: "green", spinner });
+        logger.updateItem(FETCH_META, "resolving dependencies...");
+        await this._fyn.resolveDependencies();
+        logger.removeItem(FETCH_META);
+        depData = this._fyn._data;
+      }
+      const pkgCount = Object.keys(depData.pkgs).length;
+      if (pkgCount === 0) {
+        logger.info("No dependencies to audit");
+        return;
+      }
+      logger.addItem({ name: FETCH_META, color: "green", spinner });
+      logger.updateItem(FETCH_META, "fetching security advisories...");
+      const auditReport = new AuditReport({
+        fyn: this._fyn,
+        depData,
+        noCache: this._opts.noCache || false,
+        omit: this._opts.omit || []
+      });
+      const auditResult = await auditReport.fetchAdvisories();
+      logger.removeItem(FETCH_META);
+      const vulnerabilities = auditReport.matchVulnerabilities(auditResult);
+      let statProvider = null;
+      if (!this._opts.summary && !this._opts.json) {
+        statProvider = new PkgStatProvider({ fyn: this._fyn });
+      }
+      const formatter = new AuditFormatter({
+        json: this._opts.json || false,
+        colors: this._fyn._options.colors !== false,
+        auditLevel: this._opts.auditLevel || "info",
+        summary: this._opts.summary || false,
+        statProvider
+      });
+      if (statProvider) {
+        await formatter.precomputeStats(vulnerabilities);
+      }
+      const { output } = formatter.format(auditResult, vulnerabilities);
+      if (output) {
+        console.log(output);
+      }
+    } catch (err) {
+      logger.removeItem(FETCH_META);
+      logger.error("Audit failed:", err.message);
+      if (process.env.FYN_DEBUG) {
+        logger.error(err.stack);
+      }
+    }
+  }
+}
+module.exports = (fyn, opts) => {
+  return new ShowAudit({ fyn, opts }).runAudit();
+};
+
+
 /***/ }),
 
 /***/ "./cli/show-stat.ts":
@@ -1447,13 +1591,10 @@ module.exports = myPkg;
 const chalk = __webpack_require__("./node_modules/.f/_/chalk/4.1.2/chalk/source/index.js");
 const CliLogger = __webpack_require__("./lib/cli-logger.ts");
 const logger = __webpack_require__("./lib/logger.ts");
-const _ = __webpack_require__("./node_modules/.f/_/lodash/4.17.21/lodash/lodash.min.js");
-const semverUtil = __webpack_require__("./lib/util/semver.ts");
 const Promise = __webpack_require__("./node_modules/.f/_/aveazul/1.1.0/aveazul/cjs-entry.cjs");
 const logFormat = __webpack_require__("./lib/util/log-format.ts");
-const PkgDepLinker = __webpack_require__("./lib/pkg-dep-linker.ts");
+const PkgStatProvider = __webpack_require__("./lib/pkg-stat-provider.ts");
 const { FETCH_META } = __webpack_require__("./lib/log-items.ts");
-const { SEMVER } = __webpack_require__("./lib/symbols.ts");
 const PACKAGE_JSON = "~package.json";
 const formatPkgId = (pkg) => {
   if (pkg.name === PACKAGE_JSON) {
@@ -1462,220 +1603,52 @@ const formatPkgId = (pkg) => {
   const top = pkg.promoted ? "" : "\u2B07";
   return `${logFormat.pkgId(pkg)}${top}`;
 };
-const getPkgId = (pkg) => {
-  if (pkg.name === PACKAGE_JSON) {
-    return pkg.name;
-  }
-  return `${pkg.name}@${pkg.version}`;
-};
 class ShowStat {
   constructor({ fyn }) {
     this._fyn = fyn;
     this._fyn._options.buildLocal = false;
-  }
-  // returns array of packages match id
-  findPkgsById(pkgs, id) {
-    const ix = id.indexOf("@", 1);
-    const sx = ix > 0 ? ix : id.length;
-    const name = id.substr(0, sx);
-    const semver = id.substr(sx + 1);
-    return _(pkgs[name]).map((vpkg, version) => {
-      if (!semver || semverUtil.satisfies(version, semver)) {
-        return vpkg;
-      }
-    }).filter((x) => x).value();
-  }
-  findDependents(pkgs, ask) {
-    const dependents = [];
-    if (!this._fynRes) {
-      const depLinker = new PkgDepLinker({ fyn: this._fyn });
-      this._fynRes = depLinker.makeAppFynRes(this._fyn._data.res, {});
-    }
-    const check = (res, vpkg) => {
-      const semv = ask.local ? semverUtil.unlocalify(ask.version) : ask.version;
-      if (res && semverUtil.satisfies(res.resolved, semv)) {
-        dependents.push(vpkg);
-      }
-    };
-    for (const name in pkgs) {
-      const pkg = pkgs[name];
-      for (const version in pkg) {
-        const vpkg = pkg[version];
-        ["dep", "opt", "per"].forEach((s) => {
-          const x = vpkg.res[s];
-          check(x && x[ask.name], vpkg);
-        });
-      }
-    }
-    check(this._fynRes[ask.name], { name: PACKAGE_JSON, promoted: true });
-    return dependents;
-  }
-  showPkgDependents(pkgs, ask) {
-    const dependents = this.findDependents(pkgs, ask).sort((a, b) => {
-      if (a.name === b.name) {
-        return semverUtil.simpleCompare(a.version, b.version);
-      }
-      return a.name > b.name ? 1 : -1;
-    });
-    if (dependents.length > 0) {
-      logger.prefix("").info(
-        "=>",
-        logFormat.pkgId(ask),
-        `has ${dependents.length} dependents:`,
-        dependents.map(formatPkgId).join(" ")
-      );
-    }
-    return dependents;
+    this._statProvider = new PkgStatProvider({ fyn });
   }
   _show(pkgIds) {
-    const data = this._fyn._data;
-    this._dependentsCache = {};
-    let groups = {};
-    return Promise.each(pkgIds, (pkgId) => {
-      const askPkgs = this.findPkgsById(data.pkgs, pkgId).sort(
-        (a, b) => semverUtil.simpleCompare(a.version, b.version)
-      );
-      if (askPkgs.length === 0) {
+    return Promise.each(pkgIds, async (pkgId) => {
+      const matches = this._statProvider.findMatchingVersions(pkgId);
+      if (matches.versions.length === 0) {
         logger.prefix("").info(chalk.yellow(pkgId), "is not installed");
       } else {
         logger.prefix("").info(
           chalk.green.bgRed(pkgId),
           "matched these installed versions",
-          askPkgs.map(formatPkgId).join(" ")
+          matches.versions.map(formatPkgId).join(" ")
         );
-        return Promise.each(askPkgs, (ask) => {
-          const specificId = getPkgId(ask);
-          const deps = this.showPkgDependents(data.pkgs, ask);
-          this._allPaths = [];
-          return this._findDepPaths(deps.map(getPkgId), [specificId], ask.name).then(() => {
-            const newGroups = _.groupBy(this._allPaths, (x) => x[x.length - 1]);
-            groups = { ...groups, ...newGroups };
-            const paths = groups[specificId];
-            if (paths && paths.length > 0) {
-              this._displayPaths(specificId, paths);
-            }
-          });
-        });
-      }
-    }).then(() => {
-      logger.info(chalk.green(`stat completed for ${pkgIds.join(" ")}`));
-    });
-  }
-  _findDepPaths(pkgIds, output = [], askName = "") {
-    const data = this._fyn._data;
-    return Promise.each(pkgIds, (pkgId) => {
-      const askPkgs = this.findPkgsById(data.pkgs, pkgId).sort(
-        (a, b) => semverUtil.simpleCompare(a.version, b.version)
-      );
-      if (askPkgs.length < 1) {
-        if (pkgId === PACKAGE_JSON) {
-          const newOutput = [].concat(output);
-          ["dependencies", "optionalDependencies", "peerDependencies", "devDependencies"].find(
-            (s) => {
-              const semver = _.get(this._fyn, ["_pkg", s, askName]);
-              if (semver) {
-                newOutput[SEMVER] = semver;
-              }
-              return semver;
-            }
-          );
-          this._allPaths.push(newOutput);
-        } else {
-          this._allPaths.push([pkgId]);
-        }
-        return void 0;
-      }
-      return Promise.map(
-        askPkgs,
-        (pkg) => {
-          const pkgId2 = getPkgId(pkg);
-          if (output.indexOf(pkgId2) >= 0) {
-            logger.debug("stat detected circular dependency:", pkgId2, output.join(" "));
-            return;
-          }
-          let dependents = this._dependentsCache[pkgId2];
-          if (!dependents) {
-            this._dependentsCache[pkgId2] = dependents = this.findDependents(data.pkgs, pkg).sort(
-              (a, b) => {
-                if (a.name === b.name) {
-                  return semverUtil.simpleCompare(a.version, b.version);
-                }
-                return a.name > b.name ? 1 : -1;
-              }
+        for (const match of matches.versions) {
+          const stat = await this._statProvider.getPackageStat(match.name, match.version);
+          if (!stat) continue;
+          if (stat.dependents.length > 0) {
+            logger.prefix("").info(
+              "=>",
+              logFormat.pkgId({ name: stat.name, version: stat.version }),
+              `has ${stat.dependents.length} dependents:`,
+              stat.dependents.map(formatPkgId).join(" ")
             );
           }
-          const followIds = dependents.filter((x) => x.name !== PACKAGE_JSON).map((x) => `${x.name}@${x.version.replace("-fynlocal_h", "")}`);
-          if (dependents.length > 0) {
-            const newOutput = [pkgId2].concat(output);
-            if (output.length === 1) {
-              ["dep", "opt", "per", "dev"].find((s) => {
-                const sv = _.get(pkg, ["res", s, askName]);
-                if (sv) {
-                  newOutput[SEMVER] = sv.semver;
-                }
-                return sv;
-              });
-            } else {
-              newOutput[SEMVER] = output[SEMVER];
-            }
-            if (followIds.length > 0) {
-              return this._findDepPaths(followIds, newOutput, askName);
-            } else if (output) {
-              this._allPaths.push(newOutput);
+          if (stat.circularDeps && stat.circularDeps.length > 0) {
+            for (const circular of stat.circularDeps) {
+              logger.prefix("").info("stat detected circular dependency:", circular.join(" "));
             }
-          } else {
-            logger.prefix("").info("no dependents for", pkgId2);
           }
-        },
-        { concurrency: 1 }
-      );
-    });
-  }
-  _displayPaths(pkgId, paths) {
-    const cmpDepPath = (a, b) => {
-      for (let ixA = 0; ixA < a.length; ixA++) {
-        if (b.length <= ixA) {
-          return 1;
-        }
-        const aId = a[ixA];
-        const bId = b[ixA];
-        if (aId !== bId) {
-          return aId > bId ? 1 : -1;
-        }
-      }
-      return 0;
-    };
-    paths = paths.sort((a, b) => a.length - b.length);
-    let minDetails = 5;
-    let briefPaths = paths;
-    while (briefPaths.length > 10 && minDetails > 0) {
-      const occurLevels = {};
-      briefPaths = paths.filter((dp) => {
-        const last = dp.length - 1;
-        for (let ix = 0; ix < last; ix++) {
-          const pkgId2 = dp[ix];
-          const occur = occurLevels[pkgId2];
-          if (occur && occur.level < ix && occur.leaf === dp[last] && dp.length - ix > minDetails) {
-            return false;
+          const paths = stat.allPaths;
+          const briefPaths = stat.significantPaths;
+          if (paths.length > 0) {
+            const formattedPaths = this._statProvider.formatPaths(briefPaths);
+            const msg = paths.length === briefPaths.length ? `these dependency paths:` : `${paths.length} dependency paths, showing the ${briefPaths.length} most significant ones below:`;
+            logger.prefix("").info(`=> ${stat.name}@${stat.version} has ${msg}`);
+            logger.prefix("").info(formattedPaths.map((p) => `  > ${p}`).join("\n"));
           }
-          occurLevels[pkgId2] = {
-            level: ix,
-            leaf: dp[last]
-          };
         }
-        return true;
-      });
-      minDetails--;
-    }
-    briefPaths = briefPaths.sort(cmpDepPath);
-    const msg = paths.length === briefPaths.length ? `these dependency paths:` : `${paths.length} dependency paths, showing the ${briefPaths.length} most significant ones below:`;
-    logger.prefix("").info(`=> ${pkgId} has ${msg}`);
-    logger.prefix("").info(
-      briefPaths.map((x) => {
-        const semver = x[SEMVER];
-        return `  > ` + x.join(" > ") + (semver ? ` (${semver})` : "");
-      }).join("\n")
-    );
+      }
+    }).then(() => {
+      logger.info(chalk.green(`stat completed for ${pkgIds.join(" ")}`));
+    });
   }
   showStat(pkgIds) {
     const spinner = CliLogger.spinners[1];
@@ -1972,6 +1945,474 @@ module.exports.__TEST__ = {
 };
 
 
+/***/ }),
+
+/***/ "./lib/audit/audit-cache.ts":
+/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+
+"use strict";
+
+const cacache = __webpack_require__("./node_modules/.f/_/cacache/20.0.1/cacache/lib/index.js");
+const crypto = __webpack_require__("crypto");
+const Path = __webpack_require__("path");
+const AUDIT_CACHE_PREFIX = "fyn-audit-";
+function generateCacheKey(payload) {
+  const sorted = Object.keys(payload).sort().reduce((acc, name) => {
+    acc[name] = [...payload[name]].sort();
+    return acc;
+  }, {});
+  const hash = crypto.createHash("sha256").update(JSON.stringify(sorted)).digest("hex");
+  return `${AUDIT_CACHE_PREFIX}${hash}`;
+}
+async function cacheAuditResult(cacheDir, key, result) {
+  const auditCacheDir = Path.join(cacheDir, "audit");
+  const data = JSON.stringify(result);
+  await cacache.put(auditCacheDir, key, data);
+}
+async function getCachedAuditResult(cacheDir, key) {
+  const auditCacheDir = Path.join(cacheDir, "audit");
+  try {
+    const { data } = await cacache.get(auditCacheDir, key);
+    return JSON.parse(data.toString());
+  } catch (err) {
+    if (err.code === "ENOENT" || err.code === "ENOTCACHED") {
+      return null;
+    }
+    throw err;
+  }
+}
+async function hasAuditCache(cacheDir, key) {
+  const auditCacheDir = Path.join(cacheDir, "audit");
+  try {
+    const info = await cacache.get.info(auditCacheDir, key);
+    return info !== null;
+  } catch (err) {
+    return false;
+  }
+}
+module.exports = {
+  AUDIT_CACHE_PREFIX,
+  generateCacheKey,
+  cacheAuditResult,
+  getCachedAuditResult,
+  hasAuditCache
+};
+
+
+/***/ }),
+
+/***/ "./lib/audit/audit-formatter.ts":
+/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+
+"use strict";
+
+const chalk = __webpack_require__("./node_modules/.f/_/chalk/4.1.2/chalk/source/index.js");
+const { SEMVER } = __webpack_require__("./lib/symbols.ts");
+const SEVERITY_COLORS = {
+  critical: chalk.red.bold,
+  high: chalk.red,
+  moderate: chalk.yellow,
+  low: chalk.cyan,
+  info: chalk.blue
+};
+const SEVERITY_ORDER = ["critical", "high", "moderate", "low", "info"];
+class AuditFormatter {
+  /**
+   * @param {Object} options
+   * @param {boolean} options.json - Output as JSON
+   * @param {boolean} options.colors - Use colors in output
+   * @param {string} options.auditLevel - Minimum severity to report
+   * @param {boolean} options.summary - Output brief summary only (like npm after install)
+   * @param {Object} options.statProvider - PkgStatProvider instance for dependency path info
+   * @param {Object} options.statCache - Pre-computed stat results keyed by "name@version"
+   */
+  constructor(options = {}) {
+    this._json = options.json || false;
+    this._colors = options.colors !== false;
+    this._auditLevel = options.auditLevel || "info";
+    this._summary = options.summary || false;
+    this._statProvider = options.statProvider || null;
+    this._statCache = options.statCache || {};
+  }
+  /**
+   * Get severity level as number for comparison.
+   */
+  getSeverityLevel(severity) {
+    const levels = { critical: 5, high: 4, moderate: 3, low: 2, info: 1 };
+    return levels[severity] || 0;
+  }
+  /**
+   * Check if severity meets minimum audit level.
+   */
+  meetsAuditLevel(severity) {
+    return this.getSeverityLevel(severity) >= this.getSeverityLevel(this._auditLevel);
+  }
+  /**
+   * Colorize text based on severity.
+   */
+  colorize(text, severity) {
+    if (!this._colors) return text;
+    const colorFn = SEVERITY_COLORS[severity] || ((t) => t);
+    return colorFn(text);
+  }
+  /**
+   * Format audit result for output.
+   *
+   * @param {Object} auditResult - Result from AuditReport.fetchAdvisories()
+   * @param {Array} vulnerabilities - Matched vulnerabilities from matchVulnerabilities()
+   * @returns {Object} { output: string, exitCode: number }
+   */
+  format(auditResult, vulnerabilities) {
+    if (this._json) {
+      return this.formatJson(auditResult, vulnerabilities);
+    }
+    if (this._summary) {
+      return this.formatSummary(auditResult, vulnerabilities);
+    }
+    return this.formatHuman(auditResult, vulnerabilities);
+  }
+  /**
+   * Format as brief summary (like npm shows after install).
+   * Example: "audited 745 packages\n3 vulnerabilities (1 moderate, 1 high, 1 critical)"
+   */
+  formatSummary(auditResult, vulnerabilities) {
+    const filtered = vulnerabilities.filter((v) => this.meetsAuditLevel(v.advisory.severity));
+    const pkgCount = auditResult.metadata?.totalDependencies || 0;
+    if (filtered.length === 0) {
+      return { output: `audited ${pkgCount} packages`, exitCode: 0 };
+    }
+    const counts = {};
+    filtered.forEach((v) => {
+      const sev = v.advisory.severity;
+      counts[sev] = (counts[sev] || 0) + 1;
+    });
+    const parts = SEVERITY_ORDER.filter((sev) => counts[sev]).map((sev) => {
+      const count = counts[sev];
+      return this.colorize(`${count} ${sev}`, sev);
+    });
+    const total = filtered.length;
+    const output = `audited ${pkgCount} packages
+
+${total} ${total === 1 ? "vulnerability" : "vulnerabilities"} (${parts.join(", ")})
+
+Run \`fyn audit\` for details.`;
+    return { output, exitCode: 0 };
+  }
+  /**
+   * Format as JSON.
+   */
+  formatJson(auditResult, vulnerabilities) {
+    const filtered = vulnerabilities.filter((v) => this.meetsAuditLevel(v.advisory.severity));
+    const output = JSON.stringify(
+      {
+        vulnerabilities: filtered,
+        metadata: auditResult.metadata,
+        advisories: auditResult.advisories
+      },
+      null,
+      2
+    );
+    return { output, exitCode: 0 };
+  }
+  /**
+   * Format as human-readable table.
+   */
+  formatHuman(auditResult, vulnerabilities) {
+    const lines = [];
+    const { metadata } = auditResult;
+    const filtered = vulnerabilities.filter((v) => this.meetsAuditLevel(v.advisory.severity));
+    const bySeverity = {};
+    SEVERITY_ORDER.forEach((s) => bySeverity[s] = []);
+    filtered.forEach((vuln) => {
+      const sev = vuln.advisory.severity;
+      if (bySeverity[sev]) {
+        bySeverity[sev].push(vuln);
+      }
+    });
+    lines.push("");
+    if (filtered.length === 0) {
+      lines.push(this._colors ? chalk.green("No vulnerabilities found!") : "No vulnerabilities found!");
+      lines.push("");
+      lines.push(`Scanned ${metadata.totalDependencies} packages`);
+    } else {
+      const counts = SEVERITY_ORDER.map((sev) => {
+        const count = bySeverity[sev].length;
+        if (count === 0) return null;
+        return this.colorize(`${count} ${sev}`, sev);
+      }).filter(Boolean);
+      lines.push(`Found ${filtered.length} vulnerabilities (${counts.join(", ")})`);
+      lines.push("");
+      SEVERITY_ORDER.forEach((severity) => {
+        const vulns = bySeverity[severity];
+        if (vulns.length === 0) return;
+        vulns.forEach((vuln) => {
+          const { advisory } = vuln;
+          lines.push(this.formatVulnerability(vuln));
+          lines.push("");
+        });
+      });
+      lines.push(`Scanned ${metadata.totalDependencies} packages`);
+    }
+    lines.push("");
+    return { output: lines.join("\n"), exitCode: 0 };
+  }
+  /**
+   * Format a single vulnerability entry.
+   */
+  formatVulnerability(vuln) {
+    const { advisory, name, version } = vuln;
+    const lines = [];
+    const sevLabel = this.colorize(advisory.severity.toUpperCase().padEnd(10), advisory.severity);
+    lines.push(`${sevLabel} ${advisory.title}`);
+    const pkgId = this._colors ? chalk.yellow(`${name}@${version}`) : `${name}@${version}`;
+    const vulnRange = this._colors ? chalk.red(`Vulnerable: ${advisory.vulnerable_versions}`) : `Vulnerable: ${advisory.vulnerable_versions}`;
+    const infoUrl = advisory.url ? this._colors ? chalk.cyan(`info: ${advisory.url}`) : `info: ${advisory.url}` : "";
+    let details = `  ${pkgId} - ${vulnRange}`;
+    if (infoUrl) {
+      details += ` - ${infoUrl}`;
+    }
+    lines.push(details);
+    const cacheKey = `${name}@${version}`;
+    const stat = this._statCache[cacheKey];
+    if (stat && stat.significantPaths && stat.significantPaths.length > 0) {
+      const seenFirstLegs = /* @__PURE__ */ new Set();
+      const uniquePaths = [];
+      for (const path of stat.significantPaths) {
+        const firstLeg = path[0];
+        if (!seenFirstLegs.has(firstLeg)) {
+          seenFirstLegs.add(firstLeg);
+          uniquePaths.push(path);
+          if (uniquePaths.length >= 5) break;
+        }
+      }
+      for (const path of uniquePaths) {
+        const semver = path[SEMVER];
+        const pathStr = path.join(" > ");
+        const fullPath = semver ? `${pathStr} (${semver})` : pathStr;
+        lines.push(`  > ${fullPath}`);
+      }
+    }
+    return lines.join("\n");
+  }
+  /**
+   * Pre-compute stat info for all vulnerabilities.
+   * Call this before format() when using a stat provider.
+   *
+   * @param {Array} vulnerabilities - List of vulnerabilities from matchVulnerabilities()
+   * @returns {Promise<void>}
+   */
+  async precomputeStats(vulnerabilities) {
+    if (!this._statProvider) return;
+    const filtered = vulnerabilities.filter((v) => this.meetsAuditLevel(v.advisory.severity));
+    for (const vuln of filtered) {
+      const cacheKey = `${vuln.name}@${vuln.version}`;
+      if (!this._statCache[cacheKey]) {
+        const stat = await this._statProvider.getPackageStat(vuln.name, vuln.version);
+        if (stat) {
+          this._statCache[cacheKey] = stat;
+        }
+      }
+    }
+  }
+}
+module.exports = AuditFormatter;
+
+
+/***/ }),
+
+/***/ "./lib/audit/audit-report.ts":
+/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+
+"use strict";
+
+const npmFetch = __webpack_require__("./node_modules/.f/_/npm-registry-fetch/19.1.0/npm-registry-fetch/lib/index.js");
+const logger = __webpack_require__("./lib/logger.ts");
+const {
+  generateCacheKey,
+  cacheAuditResult,
+  getCachedAuditResult
+} = __webpack_require__("./lib/audit/audit-cache.ts");
+class AuditReport {
+  /**
+   * @param {Object} options
+   * @param {Object} options.fyn - Fyn instance with resolved data
+   * @param {Object} options.depData - DepData with resolved packages
+   * @param {boolean} options.noCache - Skip cache lookup
+   * @param {string[]} options.omit - Dependency types to omit (dev, optional, peer)
+   */
+  constructor(options) {
+    this._fyn = options.fyn;
+    this._depData = options.depData;
+    this._noCache = options.noCache || false;
+    this._omit = options.omit || [];
+    this._cacheDir = options.fyn.fynDir;
+  }
+  /**
+   * Build bulk request payload from resolved packages.
+   * Format: { "packageName": ["version1", "version2"], ... }
+   *
+   * @returns {Object} Bulk payload for npm security API
+   */
+  buildBulkPayload() {
+    const payload = {};
+    const pkgs = this._depData.pkgs;
+    const omitDev = this._omit.includes("dev");
+    const omitOptional = this._omit.includes("optional");
+    const omitPeer = this._omit.includes("peer");
+    Object.keys(pkgs).forEach((name) => {
+      const versions = pkgs[name];
+      Object.keys(versions).forEach((version) => {
+        const pkgInfo = versions[version];
+        if (omitDev && pkgInfo.src === "dev") return;
+        if (omitOptional && pkgInfo.src === "opt") return;
+        if (omitPeer && pkgInfo.src === "per") return;
+        if (pkgInfo.local || pkgInfo.localType) return;
+        if (!payload[name]) {
+          payload[name] = [];
+        }
+        if (!payload[name].includes(version)) {
+          payload[name].push(version);
+        }
+      });
+    });
+    return payload;
+  }
+  /**
+   * Get registry URL for audit API.
+   * Uses the main registry (not scoped registries since audit is global).
+   *
+   * @returns {string} Registry URL with trailing slash
+   */
+  getAuditRegistryUrl() {
+    const registry = this._fyn._options.registry || "https://registry.npmjs.org";
+    return registry.endsWith("/") ? registry : `${registry}/`;
+  }
+  /**
+   * Get npm-registry-fetch options with auth.
+   *
+   * @returns {Object} Options for npm-registry-fetch
+   */
+  getFetchOptions() {
+    const opts = this._fyn._options;
+    const fetchOpts = {
+      registry: this.getAuditRegistryUrl()
+    };
+    if (opts.username) fetchOpts.username = opts.username;
+    if (opts.password) fetchOpts.password = opts.password;
+    if (opts.email) fetchOpts.email = opts.email;
+    if (opts["always-auth"]) fetchOpts.alwaysAuth = opts["always-auth"];
+    Object.keys(opts).forEach((key) => {
+      if (key.endsWith(":_authToken")) {
+        fetchOpts[key] = opts[key];
+      }
+    });
+    return fetchOpts;
+  }
+  /**
+   * Fetch advisories from npm security API.
+   * Uses cache if available and noCache is false.
+   *
+   * @returns {Promise<Object>} Audit result with advisories
+   */
+  async fetchAdvisories() {
+    const payload = this.buildBulkPayload();
+    const packageCount = Object.keys(payload).length;
+    if (packageCount === 0) {
+      logger.info("No packages to audit");
+      return { advisories: {}, metadata: { totalDependencies: 0 } };
+    }
+    const cacheKey = generateCacheKey(payload);
+    if (!this._noCache) {
+      const cached = await getCachedAuditResult(this._cacheDir, cacheKey);
+      if (cached) {
+        logger.debug("Using cached audit result");
+        return cached;
+      }
+    }
+    const registryUrl = this.getAuditRegistryUrl();
+    const auditUrl = `${registryUrl}-/npm/v1/security/advisories/bulk`;
+    logger.info(`Auditing ${packageCount} packages...`);
+    try {
+      const fetchOpts = this.getFetchOptions();
+      const response = await npmFetch(auditUrl, {
+        ...fetchOpts,
+        method: "POST",
+        body: payload,
+        gzip: true
+      });
+      const advisories = await response.json();
+      const result = {
+        advisories,
+        metadata: {
+          totalDependencies: packageCount,
+          vulnerabilities: Object.keys(advisories).length
+        }
+      };
+      await cacheAuditResult(this._cacheDir, cacheKey, result);
+      return result;
+    } catch (err) {
+      if (!this._noCache) {
+        const cached = await getCachedAuditResult(this._cacheDir, cacheKey);
+        if (cached) {
+          logger.warn("Network error, using cached audit data");
+          return cached;
+        }
+      }
+      if (err.code === "ENOTFOUND" || err.code === "ECONNREFUSED") {
+        throw new Error(`Unable to reach npm registry for audit: ${err.message}`);
+      }
+      if (err.statusCode === 401 || err.statusCode === 403) {
+        throw new Error("Authentication required for security audit");
+      }
+      throw err;
+    }
+  }
+  /**
+   * Match advisories to resolved packages.
+   * Returns list of affected packages with advisory details.
+   *
+   * The bulk API returns advisories grouped by package name:
+   * { "package-name": [{ id, vulnerable_versions, ... }, ...] }
+   *
+   * @param {Object} auditResult - Result from fetchAdvisories()
+   * @returns {Array} List of vulnerabilities with package info
+   */
+  matchVulnerabilities(auditResult) {
+    const vulnerabilities = [];
+    const { advisories } = auditResult;
+    const pkgs = this._depData.pkgs;
+    const semver = __webpack_require__("./node_modules/.f/_/semver/7.7.3/semver/index.js");
+    Object.keys(advisories).forEach((pkgName) => {
+      const pkgAdvisories = advisories[pkgName];
+      if (!pkgs[pkgName]) return;
+      pkgAdvisories.forEach((advisory) => {
+        const vulnVersions = advisory.vulnerable_versions;
+        Object.keys(pkgs[pkgName]).forEach((version) => {
+          if (semver.satisfies(version, vulnVersions)) {
+            vulnerabilities.push({
+              name: pkgName,
+              version,
+              advisory: {
+                id: advisory.id,
+                title: advisory.title,
+                severity: advisory.severity,
+                url: advisory.url,
+                vulnerable_versions: vulnVersions,
+                patched_versions: advisory.patched_versions,
+                recommendation: advisory.recommendation
+              },
+              paths: pkgs[pkgName][version].requests || []
+            });
+          }
+        });
+      });
+    });
+    return vulnerabilities;
+  }
+}
+module.exports = AuditReport;
+
+
 /***/ }),
 
 /***/ "./lib/cacache-util.ts":
@@ -2747,9 +3188,12 @@ class FynGlobal {
    */
   constructor(options = {}) {
     this.options = options;
-    this.nodeVersion = options.nodeVersion || process.version.match(/^v(\d+)/)[1];
+    const isBun = typeof process.versions.bun === "string";
+    const runtimeVersion = options.nodeVersion || process.version.match(/^v?(\d+)/)[1];
+    this.runtimePrefix = isBun ? "bun" : "v";
+    this.nodeVersion = runtimeVersion;
     this.globalRoot = options.globalDir || Path.join(Os.homedir(), ".fyn", "global");
-    this.versionDir = Path.join(this.globalRoot, `v${this.nodeVersion}`);
+    this.versionDir = Path.join(this.globalRoot, `${this.runtimePrefix}${runtimeVersion}`);
     this.packagesDir = Path.join(this.versionDir, "packages");
     this.globalBinDir = Path.join(this.versionDir, "bin");
     this.installedJsonPath = Path.join(this.versionDir, "installed.json");
@@ -3053,7 +3497,7 @@ class FynGlobal {
    */
   async ensureBinSymlink() {
     const binSymlink = Path.join(this.globalRoot, "bin");
-    const targetDir = `v${this.nodeVersion}/bin`;
+    const targetDir = `${this.runtimePrefix}${this.nodeVersion}/bin`;
     try {
       const currentTarget = await Fs.readlink(binSymlink);
       if (currentTarget === targetDir) {
@@ -3625,7 +4069,7 @@ Use: fyn global link ${packageName}@<version>`);
     } else {
       const pkgJsonPath = Path.join(pkgDir, "package.json");
       const pkgJson = JSON.parse(await Fs.readFile(pkgJsonPath));
-      pkgJson.dependencies[targetPackageName] = "latest";
+      pkgJson.dependencies[targetPackageName] = targetVersion.semver || "latest";
       await Fs.writeFile(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n");
     }
     const lockPath = Path.join(pkgDir, "fyn-lock.yaml");
@@ -4021,7 +4465,82 @@ class Fyn {
           return { mm: new mm.Minimatch(finalPath), res: resData[depPath] };
         });
       }
+      const overridesData = {
+        ...this._pkg.overrides,
+        ..._.get(this._fynpo, ["config", "overrides"])
+      };
+      if (!_.isEmpty(overridesData)) {
+        this._overrides = overridesData;
+        this._overridesMatchers = this._processOverrides(overridesData);
+      }
+    }
+  }
+  /**
+   * Process npm-style overrides into matchers
+   *
+   * npm overrides support:
+   * 1. Simple: "package-name": "version"
+   * 2. Nested: "parent-pkg": { "child-pkg": "version" }
+   * 3. Version-conditional: "package@^1.0.0": "1.0.5"
+   * 4. Reference: "$package-name" to reference a direct dependency version
+   *
+   * @param {object} overrides - The overrides object from package.json
+   * @param {string} parentPath - The parent path for nested overrides
+   * @returns {Array} Array of override matcher objects
+   */
+  _processOverrides(overrides, parentPath = "") {
+    const matchers = [];
+    for (const key of Object.keys(overrides)) {
+      const value = overrides[key];
+      let pkgName = key;
+      let versionConstraint = null;
+      const atIdx = key.lastIndexOf("@");
+      if (atIdx > 0) {
+        pkgName = key.substring(0, atIdx);
+        versionConstraint = key.substring(atIdx + 1);
+      }
+      if (typeof value === "string") {
+        let resolvedValue = value;
+        if (value.startsWith("$")) {
+          const refPkgName = value.substring(1);
+          const directDepVersion = this._getDirectDependencyVersion(refPkgName);
+          if (directDepVersion) {
+            resolvedValue = directDepVersion;
+          } else {
+            logger.warn(
+              `Override reference $${refPkgName} not found in direct dependencies, using as-is`
+            );
+            resolvedValue = value;
+          }
+        }
+        matchers.push({
+          pkgName,
+          versionConstraint,
+          parentPath,
+          replacement: resolvedValue
+        });
+      } else if (typeof value === "object" && value !== null) {
+        const newParentPath = parentPath ? `${parentPath}/${pkgName}` : pkgName;
+        const nestedMatchers = this._processOverrides(value, newParentPath);
+        matchers.push(...nestedMatchers);
+      }
+    }
+    return matchers;
+  }
+  /**
+   * Get the version of a direct dependency from package.json
+   * @param {string} pkgName - Package name to look up
+   * @returns {string|null} The version or null if not found
+   */
+  _getDirectDependencyVersion(pkgName) {
+    const sections = ["dependencies", "devDependencies", "optionalDependencies"];
+    for (const section of sections) {
+      const version = _.get(this._pkg, [section, pkgName]);
+      if (version) {
+        return version;
+      }
     }
+    return null;
   }
   async _startInstall() {
     if (!this._distFetcher) {
@@ -4616,7 +5135,7 @@ const chalk = __webpack_require__("./node_modules/.f/_/chalk/4.1.2/chalk/source/
 const _ = __webpack_require__("./node_modules/.f/_/lodash/4.17.21/lodash/lodash.min.js");
 const logger = __webpack_require__("./lib/logger.ts");
 const logFormat = __webpack_require__("./lib/util/log-format.ts");
-const VisualExec = __webpack_require__("./node_modules/.f/_/visual-exec/0.1.14/visual-exec/lib/visual-exec.js");
+const { VisualExec } = __webpack_require__("./node_modules/.f/_/visual-exec/0.2.0-fynlocal_h/visual-exec/dist/index.js");
 const fyntil = __webpack_require__("./lib/util/fyntil.ts");
 const requireAt = __webpack_require__("./node_modules/.f/_/require-at/1.0.6/require-at/require-at.js");
 const { setupNodeGypEnv } = __webpack_require__("./lib/util/setup-node-gyp.ts");
@@ -4737,7 +5256,7 @@ module.exports = LifecycleScripts;
 const Path = __webpack_require__("path");
 const logger = __webpack_require__("./lib/logger.ts");
 const PromiseQueue = __webpack_require__("./lib/util/promise-queue.ts");
-const VisualExec = __webpack_require__("./node_modules/.f/_/visual-exec/0.1.14/visual-exec/lib/visual-exec.js");
+const VisualExec = __webpack_require__("./node_modules/.f/_/visual-exec/0.2.0-fynlocal_h/visual-exec/dist/index.js");
 const xaa = __webpack_require__("./node_modules/.f/_/xaa/2.0.0/xaa/dist-cjs/index.cjs");
 const Fs = __webpack_require__("./lib/util/file-ops.ts");
 const _ = __webpack_require__("./node_modules/.f/_/lodash/4.17.21/lodash/lodash.min.js");
@@ -4768,12 +5287,15 @@ class LocalPkgBuilder {
       this._waitItems[data.item.fullPath].resolve({});
     });
     this._promiseQ.on("failItem", (data) => {
+      const debugLog = Path.join(data.item.fullPath, "fyn-debug.log");
       const itemRes = {
         error: new AggregateError(
           [data.error],
-          `failed build local package at ${data.item.fullPath}`
+          `failed build local package at ${data.item.fullPath} - check ${debugLog} for details`
         )
       };
+      logger.error(`Failed to build local package at ${data.item.fullPath}`);
+      logger.error(`Check debug log for details: ${debugLog}`);
       this._waitItems[data.item.fullPath].resolve(itemRes);
       this._failedItems[data.item.fullPath] = itemRes;
     });
@@ -4857,8 +5379,9 @@ class LocalPkgBuilder {
       process.argv[0],
       this._fynJs,
       this._fyn._options.registry && `--reg=${this._fyn._options.registry}`,
-      "-q=d --pg=simple --no-build-local",
-      !this._fyn._options.sourceMaps && "--no-source-maps"
+      "-q=d --pg=simple --no-build-local --sl=fyn-debug.log",
+      !this._fyn._options.sourceMaps && "--no-source-maps",
+      "install --no-audit"
     ].filter((x) => x).join(" ");
     const displayTitle = `building local pkg at ${dispPath}`;
     logger.verbose(displayTitle);
@@ -6775,6 +7298,107 @@ ${item.depPath.join(" > ")}`
     }
     return void 0;
   }
+  /**
+   * Apply npm-style overrides to a dependency item
+   *
+   * npm overrides differ from yarn resolutions:
+   * - They apply to ALL instances of a package by default (not path-based)
+   * - They can be scoped to specific parent packages
+   * - They support version constraints on the source package
+   *
+   * @param {*} item - The dependency item to check for overrides
+   * @returns {undefined}
+   */
+  _applyOverrides(item) {
+    if (!this._fyn._overridesMatchers || item._semver.$$) {
+      return void 0;
+    }
+    const matchers = this._fyn._overridesMatchers;
+    for (const matcher of matchers) {
+      const { pkgName, versionConstraint, parentPath, replacement } = matcher;
+      if (pkgName !== item.name) {
+        continue;
+      }
+      if (versionConstraint) {
+        if (!this._matchesVersionConstraint(item.semver, versionConstraint)) {
+          continue;
+        }
+      }
+      if (parentPath) {
+        if (!this._matchesParentPath(item, parentPath)) {
+          continue;
+        }
+      }
+      if (replacement !== item.semver) {
+        const parentInfo = parentPath ? ` (under ${parentPath})` : "";
+        const constraintInfo = versionConstraint ? `@${versionConstraint}` : "";
+        logger.info(
+          `Override: ${item.name}${constraintInfo}${parentInfo} changed from ${item.semver} to ${replacement}`
+        );
+        semverUtil.replace(item._semver, replacement);
+        return void 0;
+      }
+    }
+    return void 0;
+  }
+  /**
+   * Check if the item's semver matches the version constraint specified in the override key
+   *
+   * @param {string} itemSemver - The semver from the dependency
+   * @param {string} constraint - The version constraint from override key (e.g., "^4.0.0", ">=1.0.0")
+   * @returns {boolean}
+   */
+  _matchesVersionConstraint(itemSemver, constraint) {
+    if (Semver.valid(constraint)) {
+      return Semver.satisfies(constraint, itemSemver);
+    }
+    try {
+      return Semver.intersects(itemSemver, constraint);
+    } catch {
+      return itemSemver === constraint;
+    }
+  }
+  /**
+   * Check if the item's parent path matches the override's parent path constraint
+   *
+   * For example, if override is { "foo": { "bar": "1.0.0" } },
+   * parentPath would be "foo" and we check if item's parent chain includes "foo"
+   *
+   * @param {*} item - The dependency item
+   * @param {string} parentPath - The parent path from the override (e.g., "foo" or "foo/baz")
+   * @returns {boolean}
+   */
+  _matchesParentPath(item, parentPath) {
+    if (!item.parent || item.parent.depth === 0) {
+      return false;
+    }
+    const parentChain = [];
+    let current = item.parent;
+    while (current && current.depth > 0) {
+      parentChain.unshift(current.name);
+      current = current.parent;
+    }
+    const pathParts = parentPath.split("/").filter((p) => p);
+    const normalizedParts = [];
+    for (let i = 0; i < pathParts.length; i++) {
+      if (pathParts[i].startsWith("@") && i + 1 < pathParts.length) {
+        normalizedParts.push(`${pathParts[i]}/${pathParts[i + 1]}`);
+        i++;
+      } else {
+        normalizedParts.push(pathParts[i]);
+      }
+    }
+    if (normalizedParts.length > parentChain.length) {
+      return false;
+    }
+    const startIdx = parentChain.length - normalizedParts.length;
+    for (let i = 0; i < normalizedParts.length; i++) {
+      if (parentChain[startIdx + i] !== normalizedParts[i]) {
+        return false;
+      }
+    }
+    return true;
+  }
   _resolveWithLockData(item) {
     const isOpt = item.dsrc && item.dsrc.includes("opt");
     if (isOpt && this._fyn.refreshOptionals) {
@@ -6843,6 +7467,7 @@ ${item.depPath.join(" > ")}`
         return r;
       });
     };
+    this._applyOverrides(item);
     this._replaceWithResolutionsData(item);
     const promise = !item.semverPath || this._fyn.preferLock ? tryLock().then((r) => r || item.semverPath && tryLocal()) : tryLocal().then((r) => r || tryLock());
     return promise.then((r) => {
@@ -8063,7 +8688,7 @@ const longPending = __webpack_require__("./lib/long-pending.ts");
 const { LOCAL_VERSION_MAPS, PACKAGE_RAW_INFO, DEP_ITEM } = __webpack_require__("./lib/symbols.ts");
 const { LONG_WAIT_META, FETCH_META, FETCH_PACKAGE } = __webpack_require__("./lib/log-items.ts");
 const PkgPreper = __webpack_require__("./node_modules/.f/_/pkg-preper/0.1.6-fynlocal_h/pkg-preper/lib/pkg-preper.js");
-const VisualExec = __webpack_require__("./node_modules/.f/_/visual-exec/0.1.14/visual-exec/lib/visual-exec.js");
+const VisualExec = __webpack_require__("./node_modules/.f/_/visual-exec/0.2.0-fynlocal_h/visual-exec/dist/index.js");
 const { readPkgJson, missPipe } = __webpack_require__("./lib/util/fyntil.ts");
 const { MARK_URL_SPEC } = __webpack_require__("./lib/constants.ts");
 const nodeFetch = __webpack_require__("./node_modules/.f/_/node-fetch-npm/2.0.4/node-fetch-npm/src/index.js");
@@ -8837,6 +9462,303 @@ module.exports = PkgSrcManager;
 module.exports.META_CACHE_STALE_TIME = META_CACHE_STALE_TIME;
 
 
+/***/ }),
+
+/***/ "./lib/pkg-stat-provider.ts":
+/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+
+"use strict";
+
+const _ = __webpack_require__("./node_modules/.f/_/lodash/4.17.21/lodash/lodash.min.js");
+const semverUtil = __webpack_require__("./lib/util/semver.ts");
+const PkgDepLinker = __webpack_require__("./lib/pkg-dep-linker.ts");
+const { SEMVER } = __webpack_require__("./lib/symbols.ts");
+const PACKAGE_JSON = "~package.json";
+class PkgStatProvider {
+  _fyn;
+  _fynRes;
+  _dependentsCache;
+  _allPaths;
+  _circularDeps;
+  constructor({ fyn }) {
+    this._fyn = fyn;
+    this._fynRes = null;
+    this._dependentsCache = {};
+    this._allPaths = [];
+    this._circularDeps = [];
+  }
+  /**
+   * Find packages matching the given ID pattern.
+   *
+   * @param pkgId - Package ID (name or name@semver)
+   * @returns Array of matching package info
+   */
+  findPkgsById(pkgId) {
+    const pkgs = this._fyn._data?.pkgs;
+    if (!pkgs) return [];
+    const ix = pkgId.indexOf("@", 1);
+    const sx = ix > 0 ? ix : pkgId.length;
+    const name = pkgId.substr(0, sx);
+    const semver = pkgId.substr(sx + 1);
+    return _(pkgs[name]).map((vpkg, version) => {
+      if (!semver || semverUtil.satisfies(version, semver)) {
+        return vpkg;
+      }
+    }).filter((x) => x).value();
+  }
+  /**
+   * Find all packages that depend on the given package.
+   *
+   * @param ask - Package info { name, version, local? }
+   * @returns Array of dependent packages
+   */
+  findDependents(ask) {
+    const pkgs = this._fyn._data?.pkgs;
+    if (!pkgs) return [];
+    const dependents = [];
+    if (!this._fynRes) {
+      const depLinker = new PkgDepLinker({ fyn: this._fyn });
+      this._fynRes = depLinker.makeAppFynRes(this._fyn._data.res, {});
+    }
+    const check = (res, vpkg) => {
+      const semv = ask.local ? semverUtil.unlocalify(ask.version) : ask.version;
+      if (res && semverUtil.satisfies(res.resolved, semv)) {
+        dependents.push(vpkg);
+      }
+    };
+    for (const name in pkgs) {
+      const pkg = pkgs[name];
+      for (const version in pkg) {
+        const vpkg = pkg[version];
+        ["dep", "opt", "per"].forEach((s) => {
+          const x = vpkg.res[s];
+          check(x && x[ask.name], vpkg);
+        });
+      }
+    }
+    check(this._fynRes[ask.name], { name: PACKAGE_JSON, promoted: true });
+    return dependents;
+  }
+  /**
+   * Get the package ID string.
+   */
+  _getPkgId(pkg) {
+    if (pkg.name === PACKAGE_JSON) {
+      return pkg.name;
+    }
+    return `${pkg.name}@${pkg.version}`;
+  }
+  /**
+   * Find dependency paths from root to the given package.
+   *
+   * @param pkgIds - Package IDs to trace
+   * @param output - Current path being built
+   * @param askName - Original package name being traced
+   */
+  async _findDepPaths(pkgIds, output = [], askName = "") {
+    const data = this._fyn._data;
+    const pkgs = data?.pkgs;
+    if (!pkgs) return;
+    for (const pkgId of pkgIds) {
+      const askPkgs = this.findPkgsById(pkgId).sort(
+        (a, b) => semverUtil.simpleCompare(a.version, b.version)
+      );
+      if (askPkgs.length < 1) {
+        if (pkgId === PACKAGE_JSON) {
+          const newOutput = [].concat(output);
+          ["dependencies", "optionalDependencies", "peerDependencies", "devDependencies"].find((s) => {
+            const semver = _.get(this._fyn, ["_pkg", s, askName]);
+            if (semver) {
+              newOutput[SEMVER] = semver;
+            }
+            return semver;
+          });
+          this._allPaths.push(newOutput);
+        } else {
+          this._allPaths.push([pkgId]);
+        }
+        continue;
+      }
+      for (const pkg of askPkgs) {
+        const id = this._getPkgId(pkg);
+        if (output.indexOf(id) >= 0) {
+          this._circularDeps.push([id].concat(output));
+          continue;
+        }
+        let dependents = this._dependentsCache[id];
+        if (!dependents) {
+          this._dependentsCache[id] = dependents = this.findDependents(pkg).sort((a, b) => {
+            if (a.name === b.name) {
+              return semverUtil.simpleCompare(a.version, b.version);
+            }
+            return a.name > b.name ? 1 : -1;
+          });
+        }
+        const followIds = dependents.filter((x) => x.name !== PACKAGE_JSON).map((x) => `${x.name}@${x.version.replace("-fynlocal_h", "")}`);
+        if (dependents.length > 0) {
+          const newOutput = [id].concat(output);
+          if (output.length === 1) {
+            ["dep", "opt", "per", "dev"].find((s) => {
+              const sv = _.get(pkg, ["res", s, askName]);
+              if (sv) {
+                newOutput[SEMVER] = sv.semver;
+              }
+              return sv;
+            });
+          } else {
+            newOutput[SEMVER] = output[SEMVER];
+          }
+          if (followIds.length > 0) {
+            await this._findDepPaths(followIds, newOutput, askName);
+          } else if (output) {
+            this._allPaths.push(newOutput);
+          }
+        }
+      }
+    }
+  }
+  /**
+   * Filter paths to show only the most significant ones.
+   *
+   * @param paths - All dependency paths
+   * @param maxPaths - Maximum number of paths to return
+   * @returns Filtered significant paths
+   */
+  _filterSignificantPaths(paths, maxPaths = 5) {
+    const cmpDepPath = (a, b) => {
+      for (let ixA = 0; ixA < a.length; ixA++) {
+        if (b.length <= ixA) return 1;
+        const aId = a[ixA];
+        const bId = b[ixA];
+        if (aId !== bId) return aId > bId ? 1 : -1;
+      }
+      return 0;
+    };
+    paths = paths.sort((a, b) => a.length - b.length);
+    let minDetails = 5;
+    let briefPaths = paths;
+    while (briefPaths.length > maxPaths && minDetails > 0) {
+      const occurLevels = {};
+      briefPaths = paths.filter((dp) => {
+        const last = dp.length - 1;
+        for (let ix = 0; ix < last; ix++) {
+          const pkgId = dp[ix];
+          const occur = occurLevels[pkgId];
+          if (occur && occur.level < ix && occur.leaf === dp[last] && dp.length - ix > minDetails) {
+            return false;
+          }
+          occurLevels[pkgId] = { level: ix, leaf: dp[last] };
+        }
+        return true;
+      });
+      minDetails--;
+    }
+    return briefPaths.sort(cmpDepPath);
+  }
+  /**
+   * Get detailed stat information for a specific package version.
+   *
+   * @param name - Package name
+   * @param version - Package version
+   * @returns Stat result with dependents and paths
+   */
+  async getPackageStat(name, version) {
+    const pkgs = this._fyn._data?.pkgs;
+    if (!pkgs || !pkgs[name] || !pkgs[name][version]) {
+      return null;
+    }
+    const pkg = pkgs[name][version];
+    const pkgId = `${name}@${version}`;
+    const dependents = this.findDependents({ name, version, local: pkg.local }).sort((a, b) => {
+      if (a.name === b.name) {
+        return semverUtil.simpleCompare(a.version, b.version);
+      }
+      return a.name > b.name ? 1 : -1;
+    });
+    this._allPaths = [];
+    this._circularDeps = [];
+    const depIds = dependents.map((d) => this._getPkgId(d));
+    await this._findDepPaths(depIds, [pkgId], name);
+    const paths = this._allPaths.filter((p) => p[0] === pkgId || p.includes(pkgId));
+    return {
+      name,
+      version,
+      promoted: pkg.promoted || false,
+      dependents: dependents.map((d) => ({
+        name: d.name,
+        version: d.version,
+        promoted: d.promoted || false
+      })),
+      allPaths: paths,
+      significantPaths: this._filterSignificantPaths(paths),
+      circularDeps: this._circularDeps
+    };
+  }
+  /**
+   * Find all installed versions matching a package ID pattern.
+   *
+   * @param pkgId - Package ID (name or name@semver)
+   * @returns Matching versions result
+   */
+  findMatchingVersions(pkgId) {
+    const matches = this.findPkgsById(pkgId).sort(
+      (a, b) => semverUtil.simpleCompare(a.version, b.version)
+    );
+    return {
+      searchId: pkgId,
+      versions: matches.map((m) => ({
+        name: m.name,
+        version: m.version,
+        promoted: m.promoted || false
+      }))
+    };
+  }
+  /**
+   * Get stat for all versions of a package.
+   * This is the main entry point for the audit formatter.
+   *
+   * @param name - Package name
+   * @param version - Optional specific version
+   * @returns Array of stat results for all matching versions
+   */
+  async getPackageStats(name, version) {
+    const pkgId = version ? `${name}@${version}` : name;
+    const matches = this.findMatchingVersions(pkgId);
+    const results = [];
+    for (const match of matches.versions) {
+      const stat = await this.getPackageStat(match.name, match.version);
+      if (stat) {
+        results.push(stat);
+      }
+    }
+    return results;
+  }
+  /**
+   * Format dependency paths with semver info.
+   *
+   * @param paths - Array of paths
+   * @returns Formatted path strings
+   */
+  formatPaths(paths) {
+    return paths.map((p) => {
+      const semver = p[SEMVER];
+      const pathStr = p.join(" > ");
+      return semver ? `${pathStr} (${semver})` : pathStr;
+    });
+  }
+  /**
+   * Reset caches. Call this if fyn data changes.
+   */
+  reset() {
+    this._fynRes = null;
+    this._dependentsCache = {};
+    this._allPaths = [];
+    this._circularDeps = [];
+  }
+}
+module.exports = PkgStatProvider;
+
+
 /***/ }),
 
 /***/ "./lib/symbols.ts":
@@ -102709,63 +103631,85 @@ module.exports = validate;
 
 /***/ }),
 
-/***/ "./node_modules/.f/_/visual-exec/0.1.14/visual-exec/lib/get-default-logger.js":
-/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+/***/ "./node_modules/.f/_/visual-exec/0.2.0-fynlocal_h/visual-exec/dist/get-default-logger.js":
+/***/ (function(__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
-const VisualLogger = __webpack_require__("./node_modules/.f/_/visual-logger/1.1.3/visual-logger/lib/visual-logger.js");
-const { isCI } = __webpack_require__("./node_modules/.f/_/ci-info/3.9.0/ci-info/index.js");
-let logger;
-const getLogger = () => {
+var __importDefault = this && this.__importDefault || function(mod) {
+  return mod && mod.__esModule ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getDefaultLogger = getDefaultLogger;
+const visual_logger_1 = __importDefault(__webpack_require__("./node_modules/.f/_/visual-logger/1.1.3/visual-logger/lib/visual-logger.js"));
+const ci_info_1 = __webpack_require__("./node_modules/.f/_/ci-info/3.9.0/ci-info/index.js");
+let logger = null;
+function getDefaultLogger() {
   if (!logger) {
-    logger = new VisualLogger();
-    if (isCI) {
+    logger = new visual_logger_1.default();
+    if (ci_info_1.isCI) {
       logger.info("visual-exec: CI env detected");
       logger.setItemType("none");
     }
   }
   return logger;
-};
-module.exports = getLogger;
+}
+exports["default"] = getDefaultLogger;
 
 
 /***/ }),
 
-/***/ "./node_modules/.f/_/visual-exec/0.1.14/visual-exec/lib/visual-exec.js":
-/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+/***/ "./node_modules/.f/_/visual-exec/0.2.0-fynlocal_h/visual-exec/dist/index.js":
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
 "use strict";
 
-const xsh = __webpack_require__("./node_modules/.f/_/xsh/0.4.6-fynlocal_h/xsh/lib/index.js");
-const chalk = __webpack_require__("./node_modules/.f/_/chalk/4.1.2/chalk/source/index.js");
-const getDefaultLogger = __webpack_require__("./node_modules/.f/_/visual-exec/0.1.14/visual-exec/lib/get-default-logger.js");
-const VisualLogger = __webpack_require__("./node_modules/.f/_/visual-logger/1.1.3/visual-logger/lib/visual-logger.js");
-const hasAnsi = __webpack_require__("./node_modules/.f/_/has-ansi/4.0.1/has-ansi/index.js");
-const stripAnsi = __webpack_require__("./node_modules/.f/_/strip-ansi/6.0.1/strip-ansi/index.js");
-xsh.Promise = Promise;
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports["default"] = exports.getDefaultLogger = exports.VisualExec = void 0;
+var visual_exec_1 = __webpack_require__("./node_modules/.f/_/visual-exec/0.2.0-fynlocal_h/visual-exec/dist/visual-exec.js");
+Object.defineProperty(exports, "VisualExec", ({ enumerable: true, get: function() {
+  return visual_exec_1.VisualExec;
+} }));
+var get_default_logger_1 = __webpack_require__("./node_modules/.f/_/visual-exec/0.2.0-fynlocal_h/visual-exec/dist/get-default-logger.js");
+Object.defineProperty(exports, "getDefaultLogger", ({ enumerable: true, get: function() {
+  return get_default_logger_1.getDefaultLogger;
+} }));
+var visual_exec_2 = __webpack_require__("./node_modules/.f/_/visual-exec/0.2.0-fynlocal_h/visual-exec/dist/visual-exec.js");
+Object.defineProperty(exports, "default", ({ enumerable: true, get: function() {
+  return visual_exec_2.VisualExec;
+} }));
+
+
+/***/ }),
+
+/***/ "./node_modules/.f/_/visual-exec/0.2.0-fynlocal_h/visual-exec/dist/visual-exec.js":
+/***/ (function(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+var __importDefault = this && this.__importDefault || function(mod) {
+  return mod && mod.__esModule ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.VisualExec = void 0;
+const xsh_1 = __importDefault(__webpack_require__("./node_modules/.f/_/xsh/0.4.6-fynlocal_h/xsh/lib/index.js"));
+const chalk_1 = __importDefault(__webpack_require__("./node_modules/.f/_/chalk/4.1.2/chalk/source/index.js"));
+const get_default_logger_1 = __webpack_require__("./node_modules/.f/_/visual-exec/0.2.0-fynlocal_h/visual-exec/dist/get-default-logger.js");
+const visual_logger_1 = __importDefault(__webpack_require__("./node_modules/.f/_/visual-logger/1.1.3/visual-logger/lib/visual-logger.js"));
+const has_ansi_1 = __importDefault(__webpack_require__("./node_modules/.f/_/has-ansi/4.0.1/has-ansi/index.js"));
+const strip_ansi_1 = __importDefault(__webpack_require__("./node_modules/.f/_/strip-ansi/6.0.1/strip-ansi/index.js"));
+xsh_1.default.Promise = Promise;
 const ONE_MB = 1024 * 1024;
 const TEN_MB = 10 * ONE_MB;
 class VisualExec {
-  constructor({
-    command,
-    cwd = process.cwd(),
-    visualLogger,
-    spinner = VisualLogger.spinners[1],
-    displayTitle = void 0,
-    logLabel = void 0,
-    outputLabel = void 0,
-    outputLevel = "verbose",
-    maxBuffer = TEN_MB,
-    forceStderr = true,
-    checkStdoutError = true
-  }) {
+  constructor(options) {
+    const { command, cwd = process.cwd(), visualLogger, spinner = visual_logger_1.default.spinners[1], displayTitle, logLabel, outputLabel, outputLevel = "verbose", maxBuffer = TEN_MB, forceStderr = true, checkStdoutError = true } = options;
     this._title = displayTitle || this._makeTitle(command);
     this._logLabel = logLabel || this._title;
     this._outputLabel = outputLabel || this._title;
     this._command = command;
     this._cwd = cwd || process.cwd();
-    this._logger = visualLogger || getDefaultLogger();
+    this._logger = visualLogger || (0, get_default_logger_1.getDefaultLogger)();
     this._outputLevel = outputLevel;
     this._spinner = spinner;
     this._maxBuffer = maxBuffer;
@@ -102779,11 +103723,10 @@ class VisualExec {
     }
     return `Running ${command}`;
   }
-  /* eslint-disable max-statements */
   _updateDigest(item, buf) {
     const newBuf = item.buf + buf;
     const lines = newBuf.split("\n").map((x) => x && x.trim()).filter((x) => x);
-    const stripLines = lines.map((x) => hasAnsi(x) ? stripAnsi(x) : x);
+    const stripLines = lines.map((x) => (0, has_ansi_1.default)(x) ? (0, strip_ansi_1.default)(x) : x);
     let length = 0;
     let ix = stripLines.length - 1;
     for (; ix >= 0; ix--) {
@@ -102810,7 +103753,7 @@ class VisualExec {
       item.buf += "\n";
     }
     this._logger.updateItem(item.name, {
-      msg: msgs.join(chalk.blue.inverse("\\n")),
+      msg: msgs.join(chalk_1.default.blue.inverse("\\n")),
       _save: false,
       _render: false
     });
@@ -102852,51 +103795,58 @@ stdout`,
     child.stdout.removeListener("data", this._updateStdout);
     child.stderr.removeListener("data", this._updateStderr);
     if (err) {
-      this._logger.error(`${chalk.red("Failed")} ${this._logLabel} - ${chalk.red(err.message)}`);
+      this._logger.error(`${chalk_1.default.red("Failed")} ${this._logLabel} - ${chalk_1.default.red(err.message)}`);
       output = err.output;
     } else {
       const time = ((Date.now() - this._startTime) / 1e3).toFixed(2);
-      const dispTime = `${chalk.magenta(time)}secs`;
-      this._logger.info(`Done ${this._logLabel} ${dispTime} ${chalk.green("exit code 0")}`);
+      const dispTime = `${chalk_1.default.magenta(time)}secs`;
+      this._logger.info(`Done ${this._logLabel} ${dispTime} ${chalk_1.default.green("exit code 0")}`);
     }
     this.logFinalOutput(err, output);
   }
   checkForErrors(text) {
-    return this._checkStdoutError && text && text.match(this._checkStdoutError);
+    if (!this._checkStdoutError || !text)
+      return null;
+    if (this._checkStdoutError instanceof RegExp) {
+      return text.match(this._checkStdoutError);
+    }
+    return null;
   }
+  /**
+   * Log the final output. Can be overridden to customize output handling.
+   * Set to a no-op function to suppress output logging.
+   */
   logFinalOutput(err, output) {
-    const level = err || this._forceStderr && output.stderr || this.checkForErrors(output.stdout) ? "error" : this._outputLevel;
+    const level = err || this._forceStderr && output?.stderr || this.checkForErrors(output?.stdout || "") ? "error" : this._outputLevel;
     if (!output || !output.stdout && !output.stderr) {
-      this._logger[level](`${chalk.green("No output")} from ${this._outputLabel}`);
+      this._logger[level](`${chalk_1.default.green("No output")} from ${this._outputLabel}`);
       return;
     }
-    const colorize = (t) => t.replace(/ERR!/g, chalk.red("ERR!"));
-    const logs = [chalk.green(">>>"), `Start of output from ${this._outputLabel} ===`];
+    const colorize = (t) => t.replace(/ERR!/g, chalk_1.default.red("ERR!"));
+    const logs = [chalk_1.default.green(">>>"), `Start of output from ${this._outputLabel} ===`];
     if (output.stdout) {
       logs.push(`
 ${colorize(output.stdout)}`);
     }
     if (output.stderr) {
-      logs.push(chalk.red("\n=== stderr ===\n") + colorize(output.stderr));
+      logs.push(chalk_1.default.red("\n=== stderr ===\n") + colorize(output.stderr));
     }
-    logs.push(chalk.blue("\n<<<"), `End of output from ${this._outputLabel} ---`);
+    logs.push(chalk_1.default.blue("\n<<<"), `End of output from ${this._outputLabel} ---`);
     this._logger.prefix(false)[level](...logs);
   }
   execute(command) {
     this._startTime = Date.now();
-    const child = xsh.exec(
-      {
-        silent: true,
-        cwd: this._cwd,
-        env: Object.assign({}, process.env, { PWD: this._cwd }),
-        maxBuffer: this._maxBuffer
-      },
-      command || this._command
-    );
+    const child = xsh_1.default.exec({
+      silent: true,
+      cwd: this._cwd,
+      env: Object.assign({}, process.env, { PWD: this._cwd }),
+      maxBuffer: this._maxBuffer
+    }, command || this._command);
     return this.show(child);
   }
 }
-module.exports = VisualExec;
+exports.VisualExec = VisualExec;
+exports["default"] = VisualExec;
 
 
 /***/ }),