pastoralist 1.13.2 → 1.13.3

package/README.md

@@ -337,6 +337,19 @@ pastoralist --version # -v
 Use these to check the installed CLI surface before wiring Pastoralist into
 scripts or CI.
 
+#### `--styleguide`
+
+> Type: **`boolean option`**
+
+Opens an interactive radio menu for exploring the Pastoralist DX components
+without reading or changing project configuration. Use the arrow keys and Enter
+to choose a demo. In the prompt demo, Space toggles choices, `a` selects all,
+`n` selects none, and Esc cancels.
+
+```sh
+pastoralist --styleguide
+```
+
 #### `pastoralist doctor`
 
 > Type: **`command`**

package/dist/cli/index.d.ts

@@ -6,5 +6,6 @@ export { buildSecurityResult, buildUpdateResult, createEmptyResult, createErrorR
 export { displayOverrides, displaySummaryTable } from "./display";
 export { handleSetupHook } from "./setup-hook";
 export { buildOnboardingText, showOnboarding } from "./cmds/init";
+export { showStyleguide } from "./styleguide";
 export declare const setEmbeddedAgentSkill: (skill: string) => void;
 export declare const run: (argv?: string[], deps?: RunDeps) => Promise<void>;

package/dist/cli/parser/constants.d.ts

@@ -1,4 +1,4 @@
 import type { OptionDefinition } from "./types";
 export declare const OPTION_DEFINITIONS: OptionDefinition[];
-export declare const HELP_TEXT = "\nPastoralist - A utility CLI to manage your dependency overrides\n\nUsage: pastoralist [command] [options]\n\nCommands:\n  onboard                               Show first-run setup, agent, and GitHub Action guidance\n  init [config|agent-skill]             Initialize config or the Pastoralist agent skill\n  doctor                                Run a read-only setup and override health check\n\nOptions:\n  -v, --version                         Print the installed Pastoralist version\n  --debug                               Enable debug mode\n  --dry-run                             Preview changes without writing to package.json\n  --outputFormat <format>               Output format: text (default) or json\n  -p, --path <path>                     Specifies a path to a package.json (default: \"package.json\")\n  -d, --depPaths [paths...]             Specifies glob paths to package.jsons\n  --ignore [paths...]                   Specifies glob paths to ignore\n  -r, --root <root>                     Specifies a root path\n  -t, --isTestingCLI                    Enable CLI testing (no scripts run)\n  --isTesting                           Enable testing mode (no scripts run)\n  --init [type] [args...]               Initialize config or a named init target\n  --checkSecurity                       Check for security vulnerabilities and generate overrides\n  --forceSecurityRefactor               Automatically apply security overrides without prompting\n  --securityProvider <provider...>      Security provider(s) to use (osv, github, snyk, npm, socket, spektion)\n  --securityProviderToken <token>       Security provider token for API access\n  --interactive                         Run security checks in interactive mode\n  --hasWorkspaceSecurityChecks          Include workspace packages in security scan\n  --promptForReasons                    Prompt for reasons when adding manual overrides\n  --strict                              Fail on any security check errors (network failures, API errors)\n  --summary                             Show summary metrics table after run\n  --onboard, --onboarding               Show first-run onboarding guidance\n  -q, --quiet                           Quiet mode for CI (exit 1 if vulnerabilities, 0 if clean)\n  --setup-hook                          Add postinstall script to run pastoralist automatically\n  --remove-unused                       Remove unused overrides from package.json\n  --cache-dir <path>                    Cache directory (default: node_modules/.cache/pastoralist/)\n  --cache-ttl <seconds>                 Override cache TTL in seconds\n  --no-cache                            Bypass cache reads and writes\n  --refresh-cache                       Bypass cache reads, force refresh (still writes)\n";
+export declare const HELP_TEXT = "\nPastoralist - A utility CLI to manage your dependency overrides\n\nUsage: pastoralist [command] [options]\n\nCommands:\n  onboard                               Show first-run setup, agent, and GitHub Action guidance\n  init [config|agent-skill]             Initialize config or the Pastoralist agent skill\n  doctor                                Run a read-only setup and override health check\n\nOptions:\n  -v, --version                         Print the installed Pastoralist version\n  --debug                               Enable debug mode\n  --dry-run                             Preview changes without writing to package.json\n  --outputFormat <format>               Output format: text (default) or json\n  -p, --path <path>                     Specifies a path to a package.json (default: \"package.json\")\n  -d, --depPaths [paths...]             Specifies glob paths to package.jsons\n  --ignore [paths...]                   Specifies glob paths to ignore\n  -r, --root <root>                     Specifies a root path\n  -t, --isTestingCLI                    Enable CLI testing (no scripts run)\n  --isTesting                           Enable testing mode (no scripts run)\n  --init [type] [args...]               Initialize config or a named init target\n  --checkSecurity                       Check for security vulnerabilities and generate overrides\n  --forceSecurityRefactor               Automatically apply security overrides without prompting\n  --securityProvider <provider...>      Security provider(s) to use (osv, github, snyk, npm, socket, spektion)\n  --securityProviderToken <token>       Security provider token for API access\n  --interactive                         Run security checks in interactive mode\n  --hasWorkspaceSecurityChecks          Include workspace packages in security scan\n  --promptForReasons                    Prompt for reasons when adding manual overrides\n  --strict                              Fail on any security check errors (network failures, API errors)\n  --summary                             Show summary metrics table after run\n  --styleguide                          Render the Pastoralist DX component styleguide\n  --onboard, --onboarding               Show first-run onboarding guidance\n  -q, --quiet                           Quiet mode for CI (exit 1 if vulnerabilities, 0 if clean)\n  --setup-hook                          Add postinstall script to run pastoralist automatically\n  --remove-unused                       Remove unused overrides from package.json\n  --cache-dir <path>                    Cache directory (default: node_modules/.cache/pastoralist/)\n  --cache-ttl <seconds>                 Override cache TTL in seconds\n  --no-cache                            Bypass cache reads and writes\n  --refresh-cache                       Bypass cache reads, force refresh (still writes)\n";
 export declare const ARGS_START_INDEX = 2;

package/dist/cli/prompts/index.d.ts

@@ -13,6 +13,8 @@ export declare class Prompt {
     prompt(options: PromptOptions): Promise<string | boolean>;
     promptMany(questions: PromptOptions[]): Promise<Record<string, string | boolean>>;
 }
+export declare const promptSelect: (message: string, choices: PromptChoice[]) => Promise<string>;
+export declare const promptCheckbox: (message: string, choices: PromptChoice[], required?: boolean) => Promise<string[]>;
 export declare function createPrompt<T = unknown>(callback: (prompt: Prompt) => Promise<T>): Promise<T>;
 export declare function quickConfirm(message: string, defaultValue?: boolean): Promise<boolean>;
 export declare function quickInput(message: string, defaultValue?: string): Promise<string>;

package/dist/cli/prompts/types.d.ts

@@ -1,6 +1,9 @@
 export interface PromptChoice {
     name: string;
     value: string;
+    description?: string;
+    checked?: boolean;
+    disabled?: boolean | string;
 }
 export interface InputOptions {
     type?: "input";

package/dist/cli/styleguide.d.ts

@@ -0,0 +1,7 @@
+import type { Output } from "../dx";
+import type { PromptChoice } from "./prompts/types";
+export type StyleguidePrompts = {
+    select: (message: string, choices: PromptChoice[]) => Promise<string>;
+    checkbox: (message: string, choices: PromptChoice[]) => Promise<string[]>;
+};
+export declare const showStyleguide: (out?: Output, prompts?: StyleguidePrompts) => Promise<void>;

package/dist/cli/types.d.ts

@@ -93,4 +93,5 @@ export type RunDeps = {
     action: CliAction;
     showOnboarding: typeof showOnboarding;
     setupAgentSkill: (options: Options, args?: readonly string[]) => Promise<void> | void;
+    styleguide?: () => Promise<void> | void;
 };

package/dist/cli-D2AZT_nM.js

@@ -0,0 +1,59 @@
+import{At as e,B as t,Ct as n,Dt as r,Et as i,Ft as a,H as o,It as s,Lt as c,M as l,Mt as u,Nt as d,Ot as f,P as p,Pt as ee,R as te,Rt as ne,St as re,Tt as m,U as ie,V as ae,W as oe,X as se,Z as ce,_ as h,_t as le,a as ue,at as de,bt as fe,c as pe,ct as g,d as me,dt as he,ft as ge,g as _e,gt as ve,h as ye,ht as be,jt as xe,kt as _,l as Se,lt as Ce,m as we,mt as v,o as Te,ot as Ee,p as De,pt as Oe,st as y,t as ke,tt as Ae,u as je,ut as Me,v as b,vt as Ne,wt as Pe,xt as x,y as Fe,yt as S,zt as Ie}from"./security-Cgjkw8tJ.js";import{dirname as Le,resolve as C}from"node:path";import*as Re from"fs";import{existsSync as ze,readFileSync as Be,writeFileSync as Ve}from"fs";import{dirname as He,resolve as w}from"path";import{fileURLToPath as Ue}from"url";import{spawnSync as We}from"child_process";import*as T from"readline";const Ge=[{flags:[`-h`,`--help`],hasValue:!1},{flags:[`-v`,`--version`],hasValue:!1},{flags:[`--debug`],hasValue:!1},{flags:[`--dry-run`],hasValue:!1},{flags:[`--outputFormat`],hasValue:!0,defaultValue:`text`},{flags:[`-p`,`--path`],hasValue:!0,defaultValue:`package.json`},{flags:[`-d`,`--depPaths`],hasValue:!0,isArray:!0},{flags:[`--ignore`],hasValue:!0,isArray:!0},{flags:[`-r`,`--root`],hasValue:!0},{flags:[`-t`,`--isTestingCLI`],hasValue:!1},{flags:[`--isTesting`],hasValue:!1},{flags:[`--init`],hasValue:!0,isArray:!0,emptyValue:!0},{flags:[`--checkSecurity`],hasValue:!1},{flags:[`--forceSecurityRefactor`],hasValue:!1},{flags:[`--securityProvider`],hasValue:!0,isArray:!0},{flags:[`--securityProviderToken`],hasValue:!0},{flags:[`--interactive`],hasValue:!1},{flags:[`--hasWorkspaceSecurityChecks`],hasValue:!1},{flags:[`--promptForReasons`],hasValue:!1},{flags:[`--strict`],hasValue:!1},{flags:[`--summary`],hasValue:!1},{flags:[`--styleguide`],hasValue:!1},{flags:[`--onboard`,`--onboarding`],hasValue:!1},{flags:[`-q`,`--quiet`],hasValue:!1},{flags:[`--setup-hook`],hasValue:!1},{flags:[`--remove-unused`],hasValue:!1},{flags:[`--cache-dir`],hasValue:!0},{flags:[`--cache-ttl`],hasValue:!0},{flags:[`--no-cache`],hasValue:!1},{flags:[`--refresh-cache`],hasValue:!1}],Ke=e=>Ge.find(t=>t.flags.includes(e)),qe=e=>(e.flags.find(e=>e.startsWith(`--`))||e.flags[0]).replace(/^--?/,``).replace(/-([a-z])/g,(e,t)=>t.toUpperCase()),Je=e=>{let t=e.indexOf(`=`);return t>-1?{flag:e.slice(0,t),value:e.slice(t+1)}:{flag:e}},E=e=>e.startsWith(`-`),Ye=(e,t)=>{let n=e.slice(t+1),r=n.findIndex(E);return r===-1?n:n.slice(0,r)},Xe=(e,t)=>{let n=Ye(e,t);return n.length>0?{value:n,consumed:n.length}:{value:void 0,consumed:0}},Ze=(e,t)=>{let n=e[t+1];return n&&!E(n)?{value:n,consumed:1}:{value:void 0,consumed:0}},Qe=(e,t,n)=>n.isArray?Xe(e,t):Ze(e,t),$e=(e,t)=>{let n=t.emptyValue!==void 0;if(e!==void 0)return e;if(n)return t.emptyValue},et=e=>Ge.reduce((e,t)=>{let n=qe(t);return e[n]===void 0&&t.defaultValue!==void 0?Object.assign({},e,{[n]:t.defaultValue}):e},e),D=(e,t,n=t.options,r=t.command,i=t.commandArgs)=>({nextIndex:e,options:n,command:r,commandArgs:i}),O=(e,t,n)=>Object.assign({},e.options,{[t]:n}),tt=(e,t,n)=>{if(!n.command)return D(t+1,n,n.options,e,n.commandArgs);let r=n.commandArgs.concat(e);return D(t+1,n,n.options,n.command,r)},nt=(e,t,n,r,i)=>{if(n.hasValue)return D(r+1,i,O(i,e,t));if(t===`true`)return rt(e,r,i);if(t===`false`)return D(r+1,i,O(i,e,!1));throw Error(`Boolean option ${e} requires true or false`)},rt=(e,t,n)=>D(t+1,n,O(n,e,!0)),it=(e,t,n,r,i)=>{let{value:a,consumed:o}=Qe(e,t,i),s=t+o+1,c=$e(a,i);if(c===void 0)throw Error(`Option ${r} requires a value`);return D(s,n,O(n,r,c))},at=(e,t,n)=>{let r=e[t];if(!E(r))return tt(r,t,n);let{flag:i,value:a}=Je(r),o=Ke(i);if(!o)throw Error(`Unknown option: ${i}`);let s=qe(o);return a===void 0?o.hasValue?it(e,t,n,s,o):rt(s,t,n):nt(s,a,o,t,n)},ot=(e,t,n)=>{if(t>=e.length)return n;let r=at(e,t,n),i={options:r.options,command:r.command,commandArgs:r.commandArgs};return ot(e,r.nextIndex,i)},st=e=>{let t=e.slice(2),n=ot(t,0,{options:{},command:void 0,commandArgs:[]}),r=et(n.options);return{command:n.command,commandArgs:n.commandArgs,options:r}},ct=e=>{e(`
+Pastoralist - A utility CLI to manage your dependency overrides
+
+Usage: pastoralist [command] [options]
+
+Commands:
+  onboard                               Show first-run setup, agent, and GitHub Action guidance
+  init [config|agent-skill]             Initialize config or the Pastoralist agent skill
+  doctor                                Run a read-only setup and override health check
+
+Options:
+  -v, --version                         Print the installed Pastoralist version
+  --debug                               Enable debug mode
+  --dry-run                             Preview changes without writing to package.json
+  --outputFormat <format>               Output format: text (default) or json
+  -p, --path <path>                     Specifies a path to a package.json (default: "package.json")
+  -d, --depPaths [paths...]             Specifies glob paths to package.jsons
+  --ignore [paths...]                   Specifies glob paths to ignore
+  -r, --root <root>                     Specifies a root path
+  -t, --isTestingCLI                    Enable CLI testing (no scripts run)
+  --isTesting                           Enable testing mode (no scripts run)
+  --init [type] [args...]               Initialize config or a named init target
+  --checkSecurity                       Check for security vulnerabilities and generate overrides
+  --forceSecurityRefactor               Automatically apply security overrides without prompting
+  --securityProvider <provider...>      Security provider(s) to use (osv, github, snyk, npm, socket, spektion)
+  --securityProviderToken <token>       Security provider token for API access
+  --interactive                         Run security checks in interactive mode
+  --hasWorkspaceSecurityChecks          Include workspace packages in security scan
+  --promptForReasons                    Prompt for reasons when adding manual overrides
+  --strict                              Fail on any security check errors (network failures, API errors)
+  --summary                             Show summary metrics table after run
+  --styleguide                          Render the Pastoralist DX component styleguide
+  --onboard, --onboarding               Show first-run onboarding guidance
+  -q, --quiet                           Quiet mode for CI (exit 1 if vulnerabilities, 0 if clean)
+  --setup-hook                          Add postinstall script to run pastoralist automatically
+  --remove-unused                       Remove unused overrides from package.json
+  --cache-dir <path>                    Cache directory (default: node_modules/.cache/pastoralist/)
+  --cache-ttl <seconds>                 Override cache TTL in seconds
+  --no-cache                            Bypass cache reads and writes
+  --refresh-cache                       Bypass cache reads, force refresh (still writes)
+`)},lt={green:i,yellow:_,red:f,cyan:x,gray:m},ut=(e,t)=>{let n=Math.max(0,t-v(e));return e+` `.repeat(n)},dt=(e,t)=>{let n=Math.max(0,t-v(e));return` `.repeat(n)+e},ft=(e,t)=>`+-${`-`.repeat(e)}-+-${`-`.repeat(t)}-+`,pt=(e,t,n,r,i)=>{let a=dt(t,r),o=i?lt[i](a):a;return`| ${ut(e,n)} | ${o} |`},mt=(e,t,n)=>{let r=e.reduce((e,t)=>Math.max(e,v(t.label)),0),i=e.reduce((e,t)=>Math.max(e,v(String(t.value))),0);return{labelWidth:Math.max(t,r),valueWidth:Math.max(n,i)}},ht=(e,t,n)=>{let r=t+n+3;return`| ${ut(e,r)} |`},gt=(e,t={})=>{let{title:n,minLabelWidth:r=20,minValueWidth:i=10}=t,{labelWidth:a,valueWidth:o}=mt(e,r,i),s=ft(a,o),c=n?[s,ht(n,a,o),s]:[s],l=e.map(e=>pt(e.label,String(e.value),a,o,e.color));return c.concat(l,[s]).join(`
+`)},_t=(e,t,n,r=y)=>{let i=e[t];r.clearLine(),r.write(`${i} ${n}`)},k=e=>{let t=e.interval;return t!==null&&clearInterval(t),Object.assign({},e,{interval:null,isSpinning:!1})},vt=(e,t)=>Object.assign({},e,{text:t}),yt=e=>{let t=(e.frameIndex+1)%S.length;return Object.assign({},e,{frameIndex:t})},bt=(e,t=y)=>{let n=setInterval(()=>{_t(S,e.frameIndex,e.text,t),Object.assign(e,yt(e))},80);return Object.assign({},e,{interval:n,isSpinning:!0})},A=(e,t,n=y)=>{n.clearLine(),n.writeLine(`${e} ${t}`)},xt=(e,t=y)=>{if(e.isSpinning)return j(e,t);t.hideCursor();let n=bt(e,t);return Object.assign(e,n),j(e,t)},St=(e,t=y)=>{if(!e.isSpinning)return j(e,t);let n=k(e);return Object.assign(e,n),t.clearLine(),t.showCursor(),j(e,t)},Ct=(e,t,n=y)=>{let r=k(e);Object.assign(e,r);let i=t||e.text;return A(s.success,i,n),n.showCursor(),j(e,n)},wt=(e,t,n=y)=>{let r=k(e);Object.assign(e,r);let i=t||e.text;return A(s.error,i,n),n.showCursor(),j(e,n)},Tt=(e,t,n=y)=>{let r=k(e);Object.assign(e,r);let i=t||e.text;return A(s.info,i,n),n.showCursor(),j(e,n)},Et=(e,t,n=y)=>{let r=k(e);Object.assign(e,r);let i=t||e.text;return A(s.warning,i,n),n.showCursor(),j(e,n)},Dt=(e,t,n=y)=>{let r=vt(e,t);return Object.assign(e,r),j(e,n)},j=(e,t=y)=>({start:()=>xt(e,t),stop:()=>St(e,t),succeed:n=>Ct(e,n,t),fail:n=>wt(e,n,t),info:n=>Tt(e,n,t),warn:n=>Et(e,n,t),update:n=>Dt(e,n,t)}),M=(e,t=y)=>j({text:e,isSpinning:!1,frameIndex:0,interval:null},t),Ot=(e,t,n)=>[Math.round(e[0]+(t[0]-e[0])*n),Math.round(e[1]+(t[1]-e[1])*n),Math.round(e[2]+(t[2]-e[2])*n)],N=(e,t)=>{let n=e.split(``),r=n.length;if(r===0)return``;let i=n.map((e,n)=>{if(e===` `)return e;let i=n/r,a=Math.abs(i-t),o=Math.min(a,1-a),s=Math.max(0,1-o/le),[c,l,u]=Ot(ve,Ne,s);return`${Ie(c,l,u)}${e}`});return d.BOLD+i.join(``)+d.RESET},kt=(e,t)=>Array.from({length:t},()=>e).flat(),At=(e,t,n,r,i)=>{n.clearLine(),n.write(`${r}${N(e,t)}${i}`)},jt=(e,t,n,r)=>{t.clearLine(),t.writeLine(`${n}${N(e,0)}${r}`)},Mt=(e,t,n,r,i,a)=>new Promise(o=>{t.forEach((t,o)=>{setTimeout(()=>At(e,t,r,i,a),o*n)});let s=t.length*n;setTimeout(()=>{jt(e,r,i,a),o()},s)}),Nt=(e,t=50,n=y,r=``,i=``,a=process.stdout.isTTY??!1)=>{let o=a,s=Array.from({length:20},(e,t)=>t/20);if(o){let a=kt(s,2);return Mt(e,a,t,n,r,i)}return n.writeLine(`${r}${N(e,0)}${i}`),Promise.resolve()},P={pipe:`│`,branch:`├──`,last:`└──`,indent:`   `},{BOLD:Pt,RESET:F,FG_RED:I,FG_WHITE:Ft}=d,L=e=>e!==void 0,It={write:()=>{},writeLine:()=>{},clearLine:()=>{},hideCursor:()=>{},showCursor:()=>{}},Lt=e=>e.quiet?It:e.out||y,Rt=e=>{let t=e;return{get:()=>t,set:e=>{t=e}}},zt=()=>({phase:`idle`,ancestors:[],spinner:{active:!1,frame:0,text:``,interval:null},progress:{current:0,total:0}}),R=e=>e.map(e=>e?`${P.pipe}${P.indent}`:`    `).join(``),Bt=e=>e?P.last:P.branch,Vt=(...e)=>e.filter(Boolean).join(` `),Ht=(e,t,...n)=>Vt(R(e)+Bt(t),...n),Ut=(e,t)=>{let n=e.get(),r=n.ancestors.concat(t);e.set(Object.assign({},n,{ancestors:r}))},Wt=e=>{let t=e.get(),n=t.ancestors.slice(0,-1);e.set(Object.assign({},t,{ancestors:n}))},Gt=(e,t)=>({line:(n,...r)=>{let{ancestors:i}=t.get();e.writeLine(Ht(i,n,...r))},open:(e=!0)=>Ut(t,e),close:()=>Wt(t),nested:(e,n)=>{Ut(t,!e);try{n()}finally{Wt(t)}}}),Kt=(e,t)=>{let n=e.get(),r=Object.assign({},n.spinner,{frame:t});e.set(Object.assign({},n,{spinner:r}))},qt=e=>{let t=(e.get().spinner.frame+1)%S.length;Kt(e,t)},Jt=(e,t)=>setInterval(()=>{e(),t()},80),Yt=e=>{e!==null&&clearInterval(e)},Xt=(e,t)=>{let n=t.get(),r=S[n.spinner.frame],i=R(n.ancestors);e.clearLine(),e.write(`${i}${r} ${n.spinner.text}`)},Zt=(e,t,n)=>{let r=e.get(),i=Object.assign({},r.spinner,{active:!0,text:t,interval:n});e.set(Object.assign({},r,{spinner:i}))},Qt=e=>{let t=e.get(),n=Object.assign({},t.spinner,{active:!1,interval:null});e.set(Object.assign({},t,{spinner:n}))},$t=(e,t,n)=>r=>{e.hideCursor();let i=Jt(n,()=>qt(t));Zt(t,r,i)},en=(e,t)=>()=>{Yt(t.get().spinner.interval),Qt(t),e.clearLine(),e.showCursor()},tn=e=>()=>e.get().spinner.active,nn=(e,t)=>{let n=()=>Xt(e,t);return{start:$t(e,t,n),stop:en(e,t),isActive:tn(t),render:n}},rn=e=>t=>(e.stop(),t()),an=e=>(t,n,r)=>Nt(t,50,e,n,r),on=e=>{let t=Lt(e),n=Rt(zt()),r=Gt(t,n),i=nn(t,n);return{out:t,state:n,tree:r,spinner:i,paused:rn(i),completer:an(t)}},sn=()=>[``,`${a} ${i(`Pastoralist`)}`,``].join(`
+`),cn=(e,t,n)=>`${n} (${e}/${t})`,ln=e=>`[${e.severity.toUpperCase()}] ${e.packageName}@${e.currentVersion}`,un=e=>e?s.warning:s.error,dn=e=>{if(!(!e||e.length===0))return`CVE: ${e.join(`, `)}`},fn=(e,t)=>!e||!t?`No fix available`:`Fix: upgrade to ${t}`,pn=e=>{let t=dn(e.cves),n=fn(e.fixAvailable,e.patchedVersion);return[e.title,t,n,e.url].filter(L)},mn=e=>`${e.packageName}@${e.version}`,hn=(e,t)=>t?s.info:e?s.warning:s.success,gn=e=>{if(!(!e||e.length===0))return`Patches: ${e.join(`, `)}`},_n=e=>{let t=Object.keys(e??{}).length;if(t!==0)return`Used by: ${t} package${t===1?``:`s`}`},vn=e=>{if(e)return typeof e==`object`&&e.reason?`Kept: ${e.reason}`:`Kept by user`},yn=e=>{if(e)return`Potentially fixed in ${e}, maybe removable`},bn=(e,t)=>{if(t)return`${e}: ${t}`},xn=(e,t)=>{if(t?.length)return`${e}: ${t.join(`, `)}`},Sn=e=>{if(e.type!==`project`)return[];let t=bn(`Pin`,e.pin),n=bn(`Patch`,e.patch),r=xn(`Constraints`,e.constraints),i=xn(`References`,e.references);return[e.summary,t,n,r,i].filter(L)},Cn=e=>e?`optimal`:`bounded`,wn=e=>{if(e.type!==`best-case`)return[];let t=Cn(e.search.provenOptimal),n=e.search.evaluatedStates,r=`Decision: ${e.decisionId} (${t}, ${n} states)`,i=e.impact,a=`Impact: ${i.fixedVulnerabilities} fixed, ${i.introducedVulnerabilities} introduced, ${i.remainingVulnerabilities} remaining`;return[e.summary,r,a]},Tn=e=>e?typeof e==`string`?[e]:e.type===`project`?Sn(e):wn(e):[],En=e=>{let t=dn(e.cves),n=gn(e.patches),r=_n(e.dependents),i=vn(e.keep),a=yn(e.potentiallyFixedIn),o=Tn(e.reason),s=[t,n,r,i,a].filter(L);return o.concat(s)},Dn=e=>`${e.packageName}@${e.toVersion}`,On=e=>{if(!(!e||e.length===0))return`Blocks ${e.join(`, `)}`},kn=e=>[`${e.fromVersion} → ${e.toVersion}`,On(e.cves),e.reason].filter(L),An=e=>`${e.packageName}@${e.version}`,z=(e,t,n)=>e===1?t:n,jn=e=>{let t=z(e,`y`,`ies`);return`${s.CHECK} ${e} vulnerabilit${t} fixed`},Mn=e=>{let t=z(e,``,`s`);return`${s.CHECK} ${e} stale override${t} removed`},Nn=e=>{let t=z(e,``,`s`);return`${s.SHIELD} ${e} package${t} protected`},Pn=e=>[e.vulnerabilitiesFixed?jn(e.vulnerabilitiesFixed):void 0,e.staleOverridesRemoved?Mn(e.staleOverridesRemoved):void 0,e.packagesProtected?Nn(e.packagesProtected):void 0].filter(L),Fn=e=>{let t=m(` . `);return[`${s.error} ${e.severityCritical} crit`,`${s.warning} ${e.severityHigh} high`,`${s.info} ${e.severityMedium} med`,`${s.check} ${e.severityLow} low`,`${s.arrow} ${e.overridesTracked} tracked`,`${s.skip} ${e.overridesRemoved} removed`,`${e.packagesScanned} scanned`].join(t)},In=(e,t)=>{let n=t.length-1;t.forEach((t,r)=>e.line(r===n,t))},Ln=(e,t,n)=>{n.length!==0&&e.nested(t,()=>In(e,n))},Rn=(e,t)=>{let n=Object.keys(t),r=n.length-1;n.forEach((n,i)=>{e.line(i===r,`${n}: ${t[n]}`)})},zn=(e,t,n)=>{Object.keys(t).length!==0&&(e.line(n,`Overrides`),e.nested(n,()=>Rn(e,t)))},Bn=(e,t)=>{if(!t||t.length===0)return;let n=t.length-1;e.line(!0,`Changes`),e.nested(!0,()=>{t.forEach((t,r)=>{e.line(r===n,t)})})},Vn=e=>e%2==0?I:Ft,Hn=e=>Array.from({length:e},(e,t)=>`${Vn(t)}-${F}`).join(``),Un=e=>{let t=` `.repeat(2);return t+e+t},Wn=e=>`${I}|${F}${Pt}${Ft}${e}${F}${I}|${F}`,Gn=e=>{let t=v(e)+4,n=Hn(t+2);return[n,Wn(Un(e)),n]};var Kn=class{completion=Promise.resolve();context;constructor(e){this.context=e}banner(){return this.context.paused(()=>this.context.out.writeLine(sn())),this}startPhase(e,t,n=!1){return this.context.paused(()=>{let r=this.context.state.get();this.context.state.set(Object.assign({},r,{phase:e})),this.context.tree.line(n,t),this.context.tree.open(!n)}),this}progress(e,t,n){let r=cn(e,t,n);return this.updateProgressState(e,t,r),e===1&&!this.context.spinner.isActive()&&this.context.spinner.start(r),this}item(e,t=!1){return this.context.paused(()=>this.context.tree.line(t,s.success,e)),this}vulnerability(e,t=!1){return this.context.paused(()=>{let n=un(e.fixAvailable),r=ln(e),i=pn(e);this.context.tree.line(t,n,r),this.context.tree.nested(t,()=>In(this.context.tree,i))}),this}override(e,t=!1){return this.context.paused(()=>{let n=hn(e.isSecurityFix,e.keep),r=mn(e),i=En(e);this.context.tree.line(t,n,r),Ln(this.context.tree,t,i)}),this}securityFix(e,t=!1){return this.context.paused(()=>{let n=Dn(e),r=kn(e);this.context.tree.line(t,s.success,n),Ln(this.context.tree,t,r)}),this}removedOverride(e,t=!1){return this.context.paused(()=>{let n=An(e);this.context.tree.line(t,s.info,n),this.context.tree.nested(t,()=>this.context.tree.line(!0,e.reason))}),this}endPhase(e){return this.context.paused(()=>{e&&this.context.tree.line(!0,s.success,e),this.context.tree.close()}),this}summary(e,t){return this.context.paused(()=>{let n=!!(t&&t.length>0);zn(this.context.tree,e,!n),Bn(this.context.tree,t)}),this}executiveSummary(e){return this.context.paused(()=>{Pn(e).forEach(e=>this.context.out.writeLine(e))}),this}compactSummary(e){return this.context.paused(()=>{this.context.out.writeLine(Fn(e))}),this}complete(e,t=``){return this.completion=this.context.paused(()=>{let n=this.context.state.get();this.context.state.set(Object.assign({},n,{phase:`complete`,ancestors:[]}));let r=R([])+Bt(!0);return this.context.completer(e,r,t)}),this}waitForCompletion(){return this.completion}notice(e){return this.context.paused(()=>{let t=Gn(e);this.context.out.writeLine(``),t.forEach(e=>this.context.out.writeLine(e)),this.context.out.writeLine(``)}),this}stop(){return this.context.spinner.stop(),this}updateProgressState(e,t,n){let r=this.context.state.get(),i=Object.assign({},r.spinner,{text:n});this.context.state.set(Object.assign({},r,{spinner:i,progress:{current:e,total:t}}))}};const qn=(e={})=>new Kn(on(e)),Jn=()=>Math.min(be()-4,80),Yn=()=>Math.min(be()-4,60),Xn=(e,t,n)=>t===0||t===n-1?_(e):e.replace(/^│/,_(`│`)).replace(/│$/,_(`│`)),B=e=>e.map((t,n)=>Xn(t,n,e.length)),Zn=(e,t)=>`  ${x(`${t+1}.`)} ${e.name}`;function Qn(e,t=!0){let n=t?i(`●`):m(`○`),r=t?i(`Y`):`y`,a=t?`n`:i(`N`),o=i(t?`[enter for yes]`:`[enter for no]`);return`${n} ${e} (${r}/${a}) ${m(o)}: `}function $n(e,t){let n=[`${x(`?`)} ${e}`,``].concat(t.map(Zn)),r=g(n,{title:_(`Configuration`),padding:1,width:Jn()});return B(r).join(`
+`)}function er(){return`\n${x(`▶`)} Enter your choice ${m(`(number)`)}: `}function tr(e,t){let n=x(`◆`);return t?`${n} ${e} ${m(`[enter for "${t}"]`)}: `:`${n} ${e}: `}function V(e,t){let n=[`${x(`▶ Step ${e}:`)} ${t}`],r=g(n,{padding:1,width:Yn()});return`\n${B(r).join(`
+`)}\n`}function nr(e){return Me(m(`${s.info} ${e}`),3)}function rr(e){return`${i(s.CHECK)} ${e}`}function ir(e){return`${_(s.warning)} ${e}`}function ar(e,t,n){let r=n||i(`✓ ${e}`),a=t.map((e,t)=>`  ${x(`${t+1}.`)} ${e}`),o=[r,``].concat(a),s=g(o,{title:_(`Next Steps`),padding:2,width:Jn()});return B(s).join(`
+`)}let H=[],U=0,W=!1,or=!1,G=[];const sr=()=>{W=!0;let e=G;G=[],e.forEach(e=>e())},cr=()=>W?Promise.resolve():new Promise(e=>{G=G.concat(e)});function lr(){if(or||process.stdin.isTTY)return;or=!0;let e=``;process.stdin.setEncoding(`utf8`),process.stdin.on(`data`,t=>{e+=t}),process.stdin.on(`end`,()=>{H=e.trim().split(`
+`),sr()})}function ur(){return!process.stdin.isTTY}async function dr(){ur()&&(lr(),await cr())}function fr(){if(!ur()||!W)return null;if(U<H.length){let e=H[U];return U+=1,e}return``}async function K(e,t,n=(e=>e.trim())){return await dr(),new Promise(r=>{let i=fr();i===null?e.question(t,e=>{r(n(e))}):(console.log(`${t}${i}`),r(n(i)))})}var pr=class{rl;constructor(){this.rl=T.createInterface({input:process.stdin,output:process.stdout})}close(){this.rl.close()}ensureCookedMode(){process.stdin.isTTY&&process.stdin.setRawMode(!1)}input(e,t){return this.ensureCookedMode(),K(this.rl,tr(e,t),e=>e.trim()||t||``)}confirm(e,t=!0){return this.ensureCookedMode(),K(this.rl,Qn(e,t),e=>{let n=e.trim().toLowerCase();return n===``?t:n===`y`||n===`yes`})}list(e,t){return console.log($n(e,t)),this.ensureCookedMode(),this.askForListChoice(t)}async askForListChoice(e,t=1){let n=await K(this.rl,er());return this.getListChoice(n,e)||(console.log(`Invalid choice. Please enter a number between 1 and `+e.length),t>=5?e[0]?.value??``:this.askForListChoice(e,t+1))}getListChoice(e,t){let n=parseInt(e.trim(),10),r=n<1,i=n>t.length;if(!(isNaN(n)||r||i))return t[n-1]?.value}prompt(e){let{type:t=`input`,message:n}=e;switch(t){case`confirm`:return this.confirm(n,e.default??!0);case`list`:return this.list(n,e.choices);default:return this.input(n,e.default??``)}}promptMany(e){return e.reduce(async(e,t,n)=>{let r=await e,i=`answer${n}`;return t.type,t.type,r[i]=await this.prompt(t),r},Promise.resolve({}))}};const q={BOLD:`\x1B[1m`,CYAN:`\x1B[36m`,GRAY:`\x1B[90m`,GREEN:`\x1B[32m`,RED:`\x1B[31m`,RESET:`\x1B[0m`,HIDE_CURSOR:`\x1B[?25l`,SHOW_CURSOR:`\x1B[?25h`},J=e=>e.disabled!==void 0&&e.disabled!==!1,mr=()=>!!process.stdin.isTTY&&!!process.stdout.isTTY,hr=e=>`${q.GRAY}${e}${q.RESET}`,gr=(e,t)=>t?`${q.BOLD}${q.CYAN}${e}${q.RESET}`:e,_r=(e,t,n)=>J(e)?`─`:n===`radio`?t?`●`:`○`:t?`■`:`□`,vr=(e,t,n,r)=>{let i=t===n.cursorIndex,a=n.selected[t]??!1;r===`radio`&&(a=i);let o=`${i?`›`:` `} ${_r(e,a,r)} `,s=e.description?` ${hr(`· ${e.description}`)}`:``,c=`${o}${e.name}${s}`;return J(e)?hr(c):gr(c,i)},yr=(e,t,n,r)=>vr(e,n.viewportStart+t,n,r),br=(e,t,n)=>{if(n===`radio`)return``;let r=e.filter((e,n)=>t.selected[n]).map(({name:e})=>e);return`Selected: ${r.length>0?r.join(`, `):`none`}`},xr=(e,t,n)=>{let r=e.viewportStart>0,i=e.viewportStart+8<t,a=[r?`↑ more`:``,i?`↓ more`:``].filter(Boolean),o=n===`radio`?`↑/↓ navigate · Enter select · Esc cancel`:`↑/↓ navigate · Space toggle · a all · n none · Enter confirm · Esc cancel`,s=n===`radio`?``:`${e.selected.filter(Boolean).length} selected`;return hr(a.concat([o,s]).filter(Boolean).join(` · `))},Sr=(e,t,n)=>{let r=Math.max(0,n-8);if(e<t)return e;if(e>=t+8){let t=e-8+1;return Math.min(r,t)}return t},Cr=(e,t,n,r)=>{let i=t.slice(n.viewportStart,n.viewportStart+8).map((e,t)=>yr(e,t,n,r)),a=`${q.BOLD}${q.CYAN}?${q.RESET} ${e}`,o=br(t,n,r);return[a].concat(i,[xr(n,t.length,r)],o?[o]:[])},wr=(e,t,n=!1)=>(n&&process.stdout.write(`
+`),t>0&&T.moveCursor(process.stdout,0,-(t-1)),T.cursorTo(process.stdout,0),T.clearScreenDown(process.stdout),process.stdout.write(e.join(`
+`)),e.length),Tr=e=>e.findIndex(e=>!J(e)),Er=(e,t,n)=>{let r=e;for(let e=0;e<n.length;e+=1)if(r=(r+t+n.length)%n.length,!J(n[r]))return r;return e},Dr=(e,t,n)=>{let r=Er(e.cursorIndex,t,n),i=Sr(r,e.viewportStart,n.length);return Object.assign({},e,{cursorIndex:r,viewportStart:i})},Or=(e,t,n)=>{let r=e[t.cursorIndex],i=r!==void 0&&!J(r);return n===`radio`&&i?[r.value]:n===`radio`?[]:e.filter((e,n)=>t.selected[n]).map(({value:e})=>e)},kr=()=>{let e=Error(`Prompt cancelled`);return e.name=`PromptCancelled`,e},Ar=(e,t)=>{let n=t.name===`escape`||e===`\x1B`,r=t.ctrl===!0&&t.name===`c`;return n||r},jr=e=>e.name===`return`||e.name===`enter`,Mr=e=>e.name===`up`?-1:+(e.name===`down`),Nr=(e,t,n)=>t===n?!e:e,Pr=(e,t,n)=>{let r=t===` `,i=n[e.cursorIndex],a=i!==void 0&&!J(i);if(r&&a){let t=e.selected.map((t,n)=>Nr(t,n,e.cursorIndex));return Object.assign({},e,{selected:t})}let o=t?.toLowerCase()??``;return o===`a`?Object.assign({},e,{selected:n.map(e=>!J(e))}):o===`n`?Object.assign({},e,{selected:n.map(()=>!1)}):e},Fr=(e,t,n)=>new Promise((r,i)=>{if(t.length===0){i(Error(`Prompt requires at least one choice`));return}let a=Tr(t);if(!(a>=0)){r([]);return}let o={cursorIndex:a,selected:t.map(e=>e.checked===!0&&!J(e)),viewportStart:0},s=0,c=!1,l=()=>{process.stdin.off(`keypress`,f),process.stdin.off(`data`,p),typeof process.stdin.setRawMode==`function`&&process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(q.SHOW_CURSOR)},u=a=>{if(c)return;c=!0,l();let u=a?[`${q.BOLD}${q.RED}✗${q.RESET} ${e}: cancelled`]:[`${q.BOLD}${q.GREEN}✔${q.RESET} ${e}: ${Or(t,o,n).join(`, `)||`none selected`}`];wr(u,s),process.stdout.write(`
+`),a?i(a):r(Or(t,o,n))},d=()=>{s=wr(Cr(e,t,o,n),s,s===0)},f=(e,r={})=>{if(Ar(e,r))return u(kr());if(jr(r))return u();let i=Mr(r);if(i!==0){Object.assign(o,Dr(o,i,t)),d();return}let a=e===` `,s=e?.toLowerCase()??``;n===`multi`&&a||[`a`,`n`].includes(s)&&(Object.assign(o,Pr(o,e,t)),d())},p=e=>{let r=n===`multi`,i=e.toString(`utf8`).includes(` `);r&&i&&(Object.assign(o,Pr(o,` `,t)),d())};try{let e=typeof process.stdin.setRawMode==`function`;if(!(mr()&&e)){i(Error(`Interactive prompt input is unavailable`));return}T.emitKeypressEvents(process.stdin),process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on(`keypress`,f),process.stdin.on(`data`,p),process.stdout.write(q.HIDE_CURSOR),d()}catch(e){l(),i(e)}}),Ir=e=>new Promise(t=>{let n=T.createInterface({input:process.stdin,output:process.stdout});n.question(e,e=>{n.close(),t(e)})}),Lr=(e,t)=>e.split(`,`).map(e=>Number.parseInt(e.trim(),10)).filter(e=>Number.isInteger(e)&&e>=1&&e<=t.length).map(e=>t[e-1]).filter(e=>e!==void 0&&!J(e)).map(({value:e})=>e),Rr=async(e,t)=>{console.log(`\n${e}`),t.forEach((e,t)=>{let n=J(e)?` (${e.disabled})`:``;console.log(`  ${t+1}. ${e.name}${n}`)});let n=await Ir(`
+Enter choices (comma-separated numbers): `);return Lr(n,t)},zr=(e,t)=>mr()?Fr(e,t,`multi`):Rr(e,t),Br=async(e,t)=>mr()?(await Fr(e,t,`radio`))[0]??``:(await Rr(e,t))[0]??``,Vr=async(e,t,n=!1)=>{let r=await zr(e,t);if(n&&r.length===0)throw Error(`At least one choice must be selected`);return r};async function Hr(e){let t=new pr;try{return await e(t)}finally{t.close()}}function Ur(e,t=!0){return Hr(n=>n.confirm(e,t))}const Wr=[{name:`In package.json (recommended for simple setups)`,value:`package.json`},{name:`In a separate config file (recommended for complex setups)`,value:`external`}],Gr=[{name:`.pastoralistrc.json (JSON format)`,value:`.pastoralistrc.json`},{name:`pastoralist.config.cjs (CommonJS module)`,value:`pastoralist.config.cjs`},{name:`pastoralist.config.js (JavaScript module)`,value:`pastoralist.config.js`},{name:`pastoralist.config.mjs (ESM module)`,value:`pastoralist.config.mjs`}],Kr=[{name:`Use "workspace" keyword (auto-detect from package.json)`,value:`workspace`},{name:`Specify custom paths`,value:`custom`}],qr=[{name:`OSV (Open Source Vulnerabilities - free, recommended)`,value:`osv`},{name:`GitHub Advisory Database`,value:`github`},{name:`Snyk (requires token)`,value:`snyk`},{name:`Socket.dev (requires token)`,value:`socket`}],Jr=[{name:`Low (all vulnerabilities)`,value:`low`},{name:`Medium (medium and above)`,value:`medium`},{name:`High (high and critical only)`,value:`high`},{name:`Critical (critical only)`,value:`critical`}],Yr={default:`initialization wizard`,security:`security configuration wizard`,workspace:`workspace configuration wizard`},Xr={required:!1,optional:!1},Zr={github:{required:!1,optional:!0,envVar:`GITHUB_TOKEN`,createUrl:`https://github.com/settings/tokens/new?description=Pastoralist%20Security&scopes=repo`,scopes:[`repo`]},snyk:{required:!0,optional:!1,envVar:`SNYK_TOKEN`,createUrl:`https://app.snyk.io/account`},socket:{required:!0,optional:!1,envVar:`SOCKET_SECURITY_API_KEY`,createUrl:`https://socket.dev/dashboard/settings`}},Y={welcome:`This wizard will help you set up your Pastoralist configuration.`,skipInfo:`You can skip any step by selecting the skip option.`,existingConfigWarning:`Existing Pastoralist configuration detected. Do you want to overwrite it?`,existingFileWarning:e=>`${e} already exists. Overwrite?`,configNotSaved:`Configuration not saved. File preserved.`,configSaved:e=>`Configuration saved to ${e}`,initCancelled:`Initialization cancelled. Your existing configuration is preserved.`,initComplete:`▪▫▪ Pastoralist initialization complete! ▪▫▪`,packageJsonNotFound:`Error: package.json not found`,tokenEnvironmentInfo:e=>`Pastoralist reads this token from ${e} or --securityProviderToken. The init wizard will not write tokens to project config.`,tokenCreationInfo:(e,t)=>`To create a ${e} token, visit: ${t}`,tokenRequiredWarning:e=>`${e} requires a token to function. Security scanning will not work without it.`,workspacesDetected:e=>`Detected workspaces in package.json: ${e.join(`, `)}`,noWorkspacesDetected:`No workspaces detected in package.json.`,savingConfig:`Saving configuration...`,nextSteps:`Next Steps:`},Qr={configLocation:`Step 1: Configuration Location`,workspace:`Step 2: Workspace Configuration`,security:`Step 3: Security Configuration`},X={configLocation:`Where would you like to store your Pastoralist configuration?`,configFormat:`Choose a config file format:`,setupWorkspaces:`Do you want to configure workspace dependencies?`,workspaceType:`How would you like to configure workspace dependencies?`,customWorkspacePaths:`Enter workspace paths (comma-separated glob patterns)`,setupSecurity:`Do you want to enable security vulnerability scanning?`,securityProvider:`Choose a security provider:`,hasToken:e=>`Have you configured a ${e} API token in your environment?`,securityInteractive:`Enable interactive mode for security fixes? (allows you to review/approve each fix)`,securityAutoFix:`Enable auto-fix mode? (automatically applies security overrides without prompting)`,severityThreshold:`What severity level should trigger alerts?`,hasWorkspaceSecurityChecks:`Scan workspace packages for vulnerabilities?`},$r=[{title:`Human quick start`,lines:[`1. Inspect the project without writing files:`,`   npx pastoralist doctor`,`2. Add Pastoralist and create config:`,`   npm install pastoralist --save-dev`,`   npx pastoralist init`,`3. Update the override appendix:`,`   npx pastoralist`,`4. Keep it current after installs:`,`   npx pastoralist --setup-hook`]},{title:`Agent quick setup`,lines:[`1. Install only the Pastoralist skill:`,`   npx pastoralist --init agent-skill`,`2. Preview local dev setup:`,`   pnpm run setup:local-dev -- --dry-run`,`3. Set up Codex with skills and hooks:`,`   pnpm run setup:local-dev -- --agent codex --skills all --hooks git,postinstall`,`4. Set up Claude with skills and hooks:`,`   pnpm run setup:local-dev -- --agent claude --skills all --hooks git,postinstall`]},{title:`Prompt for a setup agent`,lines:[`Set up Pastoralist in this repository.`,"Start with `npx pastoralist doctor` and inspect the current package manager setup.","Run `pnpm run setup:local-dev -- --dry-run` before writing files.",`Configure the Pastoralist skill, local agent config, GitHub Action, and postinstall hook only when appropriate.`,`Keep changes scoped to setup files, docs, and tests.`]},{title:`Prompt for a maintenance agent`,lines:[`Review this repository's Pastoralist setup.`,"Run `npx pastoralist --dry-run` and summarize stale overrides, security checks, and missing setup.","Do not remove overrides unless `npx pastoralist --remove-unused --dry-run` shows they are unused.",`If setup is missing, propose the smallest script, skill, hook, or GitHub Action change.`]},{title:`Agent setup loop`,lines:["1. Run `npx pastoralist doctor`.","2. Run `pnpm run setup:local-dev -- --dry-run`.",`3. Apply the smallest needed setup command.`,"4. Run `npx pastoralist --dry-run`.",`5. Report changed files and remaining manual steps.`]},{title:`GitHub Action setup`,lines:[`Create .github/workflows/pastoralist.yml:`,``,"```yaml",`name: Override Check`,`on: [pull_request]`,`jobs:`,`  pastoralist:`,`    runs-on: ubuntu-latest`,`    steps:`,`      - uses: actions/checkout@v7`,`      - uses: yowainwright/pastoralist@v1`,`        with:`,`          mode: check`,`          check-security: false`,"```"]},{title:`Useful commands`,lines:[`npx pastoralist --dry-run`,`npx pastoralist --summary`,`npx pastoralist --checkSecurity`,`npx pastoralist --remove-unused`]}],ei=e=>[e.title,``].concat(e.lines).join(`
+`),ti=()=>{let e=$r.map(ei);return[`Pastoralist onboarding`].concat(e).join(`
+
+`)};function ni(e){return e.split(`,`).map(e=>e.trim()).filter(e=>e.length>0)}function ri(e){let t={};return e.setupWorkspaces&&(e.workspaceType===`workspace`&&(t.depPaths=`workspace`),e.workspaceType===`custom`&&e.customWorkspacePaths?.length&&(t.depPaths=e.customWorkspacePaths)),e.setupSecurity&&(t.checkSecurity=!0,t.security={enabled:!0,provider:e.securityProvider,interactive:e.securityInteractive,autoFix:e.securityAutoFix,severityThreshold:e.severityThreshold,hasWorkspaceSecurityChecks:e.hasWorkspaceSecurityChecks}),t}function ii(e,t){return t.endsWith(`.json`)?JSON.stringify(e,null,2)+`
+`:t.endsWith(`.js`)||t.endsWith(`.cjs`)?`module.exports = ${JSON.stringify(e,null,2)};\n`:`export default ${JSON.stringify(e,null,2)};\n`}const ai=()=>{u({file:`init/index.ts`,isLogging:!1}).print(ti())};async function oi(e,t,n){n.print(V(1,`Configuration Location`)),t.configLocation=await e.list(X.configLocation,Wr),t.configLocation===`external`&&(t.configFormat=await e.list(X.configFormat,Gr))}async function si(e,t){t.workspaceType===`custom`&&(t.customWorkspacePaths=await hi(e))}async function ci(e,t,n,r){if(r.print(V(2,`Workspace Configuration`)),t.setupWorkspaces=await e.confirm(X.setupWorkspaces,!0),!t.setupWorkspaces)return;let i=Si(n),a=i.length>0;Ci(a,r),t.workspaceType=await vi(e,a,i,r),await si(e,t)}async function li(e,t,n){n.print(V(3,`Security Configuration`)),t.setupSecurity=await e.confirm(X.setupSecurity,!0),t.setupSecurity&&await di(e,t,n,{askWorkspaceSecurity:t.setupWorkspaces,selectProvider:!0})}async function ui(e,t,n){n.print(`\n${Qr.security}`),t.setupSecurity=!0,await di(e,t,n,{askWorkspaceSecurity:t.setupWorkspaces&&!t.hasWorkspaceSecurityChecks,selectProvider:!t.securityProvider})}async function di(e,t,n,r){await fi(e,t,n,r.selectProvider),await pi(e,t),t.severityThreshold=await _i(e),await mi(e,t,r.askWorkspaceSecurity)}async function fi(e,t,n,r){r&&(t.securityProvider=await gi(e)),t.securityProvider&&await yi(e,t.securityProvider,n)}async function pi(e,t){t.securityInteractive=await e.confirm(X.securityInteractive,!0),!t.securityInteractive&&(t.securityAutoFix=await e.confirm(X.securityAutoFix,!1))}async function mi(e,t,n){n&&(t.hasWorkspaceSecurityChecks=await e.confirm(X.hasWorkspaceSecurityChecks,!0))}async function hi(e){return ni(await e.input(X.customWorkspacePaths,`packages/*/package.json`))}async function gi(e){return await e.list(X.securityProvider,qr)}async function _i(e){return await e.list(X.severityThreshold,Jr)}async function vi(e,t,n,r){return t?(r.print(`\n   ${Y.workspacesDetected(n)}`),await e.list(X.workspaceType,Kr)):`custom`}async function yi(e,t,n){let r=xi(t);!r.required&&!r.optional||(bi(t,r,n),!await e.confirm(X.hasToken(t),!1)&&r.required&&n.print(`\n   ${Y.tokenRequiredWarning(t)}`))}function bi(e,t,n){t.createUrl&&n.print(`\n   ${Y.tokenCreationInfo(e,t.createUrl)}`),t.envVar&&n.print(`\n   ${Y.tokenEnvironmentInfo(t.envVar)}`)}function xi(e){return Zr[e]??Xr}function Si(e){return te(e?.workspaces)}function Ci(e,t){e||t.print(nr(Y.noWorkspacesDetected))}function wi(e,t,n,r,i=!1){if(!n){r.print(Y.packageJsonNotFound);return}n.pastoralist=e,i||Ve(t,JSON.stringify(n,null,2)+`
+`),r.print(Y.configSaved(t))}async function Ti(e,t,n,r,i,a=!1){let o=w(n,t);await Ei(t,o,r,i)&&(Di(e,t,o,a),i.print(Y.configSaved(o)))}async function Ei(e,t,n,r){if(!ze(t))return!0;let i=await n.confirm(Y.existingFileWarning(e),!1);return i||r.print(`\n${Y.configNotSaved}`),i}function Di(e,t,n,r){r||Ve(n,ii(e,t))}function Oi(e,t){let n=`Run ${i(`pastoralist`)} to check and update your dependencies`,r=`Check the documentation for advanced configuration options`,o=`Run ${i(`pastoralist --checkSecurity`)} to scan for security vulnerabilities`,s=e?[n,o,r]:[n,r],c=`Pastoralist initialization complete!`,l=N(c,0)+` ${a}`;t.print(ar(c,s,l))}async function ki(e,t,n){let r=await me(t,!1),i=l(n);return r||i?.pastoralist?e.confirm(Y.existingConfigWarning,!1):!0}async function Ai(e={}){let t=u({file:`init/index.ts`,isLogging:!0}),n=Fi(e);zi(n,t),await Hr(async r=>{await ji(r,e,n,t)})}async function ji(e,t,n,r){if(!await ki(e,n.root,n.path)){r.print(`\n${Y.initCancelled}`);return}let i=l(n.path),a=Ii(t,n);await Mi(e,a,i,n,r),await Pi(e,t,n,a,i,r),Oi(a.setupSecurity,r)}async function Mi(e,t,n,r,i){if(await oi(e,t,i),!r.hasFocusedContext){await ci(e,t,n,i),await li(e,t,i);return}await Ni(e,t,n,r,i)}async function Ni(e,t,n,r,i){r.hasWorkspaceContext&&await ci(e,t,n,i),r.hasSecurityContext&&await ui(e,t,i)}async function Pi(e,t,n,r,i,a){let o=ri(r);if(a.print(`\n${Y.savingConfig}\n`),r.configLocation===`package.json`&&wi(o,n.path,i,a,t.isTesting),r.configLocation===`external`){let i=r.configFormat;if(!i)return;await Ti(o,i,n.root,e,a,t.isTesting)}}function Fi(e){let t=!!(e.checkSecurity||e.securityProvider),n=!!e.hasWorkspaceSecurityChecks,r=e.root||process.cwd(),i=Fe(e.path||`package.json`,r);return{hasSecurityContext:t,hasWorkspaceContext:n,hasFocusedContext:t||n,root:r,path:i}}function Ii(e,t){let n={configLocation:`package.json`,setupSecurity:!1,setupWorkspaces:!1};return Li(n,e,t),Ri(n,t),n}function Li(e,t,n){n.hasSecurityContext&&(e.setupSecurity=!0,t.securityProvider&&(e.securityProvider=t.securityProvider))}function Ri(e,t){t.hasWorkspaceContext&&(e.setupWorkspaces=!0,e.hasWorkspaceSecurityChecks=!0)}function zi(e,t){let n=Bi(e);t.print(`\n${ee} ${n}\n`),!e.hasFocusedContext&&(t.print(`${Y.welcome}\n`),t.print(`${Y.skipInfo}\n`))}function Bi(e){return e.hasSecurityContext?Yr.security:e.hasWorkspaceContext?Yr.workspace:Yr.default}const Vi=[{label:`Packages scanned`,key:`total`},{label:`Appendix entries updated`,key:`appendixEntriesUpdated`},{label:`Vulnerabilities blocked`,key:`vulnerabilitiesBlocked`},{label:`Overrides added`,key:`overridesAdded`},{label:`Overrides removed`,key:`overridesRemoved`},{label:`By severity:`,key:`severityHeader`},{label:`  Critical`,key:`severityCritical`},{label:`  High`,key:`severityHigh`},{label:`  Medium`,key:`severityMedium`},{label:`  Low`,key:`severityLow`},{label:`Write status`,key:`writeStatus`}],Hi=(e,t,n)=>({packageName:e,version:t,reason:n?.ledger?.reason,dependents:n?.dependents,patches:n?.patches,isSecurityFix:n?.ledger?.securityChecked,cves:n?.ledger?.cves,keep:n?.ledger?.keep,potentiallyFixedIn:n?.ledger?.potentiallyFixedIn}),Ui=(e,t)=>{let n=t.finalOverrides[e];return typeof n==`string`?{pkg:e,version:n}:null},Wi=(e,t)=>{let n=`${e.pkg}@${e.version}`,r=t.finalAppendix[n];return Hi(e.pkg,e.version,r)},Gi=(e,t)=>{Object.keys(t.finalOverrides).map(e=>Ui(e,t)).filter(e=>e!==null).map(e=>Wi(e,t)).forEach(t=>e.override(t,!1))},Ki=(e,t)=>{if(!t)return;let n=t.removableKeys.length,r=`Removal verification: vulnerabilities ${t.beforeAlertCount} -> ${t.afterAlertCount}, risk ${t.beforeRiskScore} -> ${t.afterRiskScore}`;if(e.notice(r),t.status===`safe`){e.notice(`${n} unused override${b(n)} approved for cleanup.`);return}if(t.status===`declined`){let n=t.blockedKeys.length;e.notice(`Cleanup of ${n} override${b(n)} declined by user.`);return}let i=t.blockedKeys.length,a=t.reason?` ${t.reason}`:``;e.notice(`${i} override${b(i)} kept after removal verification.${a}`)},qi=e=>e===1?`y`:`ies`,Ji=e=>{let t=e.title||e.description||`Vulnerability`;return{severity:e.severity||`unknown`,packageName:e.packageName,currentVersion:e.currentVersion||`?`,title:t,cves:e.cves,fixAvailable:e.fixAvailable,patchedVersion:e.patchedVersion,url:e.url}},Yi=e=>({packageName:e.packageName,fromVersion:e.fromVersion||`?`,toVersion:e.toVersion,cves:e.cves,severity:e.severity,reason:e.reason}),Xi=(e,t)=>e===0?`No vulnerabilities in ${t} packages`:`${e} vulnerabilit${qi(e)} found`,Zi=(e,t)=>e.length>0&&!!(t.forceSecurityRefactor||t.interactive),Qi=(e,t,n,r,i)=>{t.map(Ji).forEach(t=>{e.vulnerability(t,!1)}),e.endPhase(Xi(t.length,i)),Zi(n,r)&&$i(e,n)},$i=(e,t)=>{e.startPhase(`resolving`,`Fixes applied`),t.map(Yi).forEach(t=>{e.securityFix(t,!1)});let n=t.length;e.endPhase(`${n} override${b(n)} added`)},ea=e=>e===0?`No overrides to update`:`${e} override${b(e)} applied`,ta=(e,t,n,r)=>{e.startPhase(`writing`,`Updating overrides`,r),Gi(e,{finalOverrides:t.finalOverrides??{},finalAppendix:t.finalAppendix??{}}),e.endPhase(ea(n.overrideCount))},na=(e,t)=>{if(t.length===0)return;e.startPhase(`writing`,`Cleaned up stale overrides`,!0),t.forEach(t=>{e.removedOverride({packageName:t.packageName,version:t.version,reason:`Override no longer needed`},!1)});let n=t.length;e.endPhase(`${n} stale override${b(n)} removed`)},ra=async(e,t,n,r)=>{let i=t.metrics;e.executiveSummary({vulnerabilitiesFixed:i?.vulnerabilitiesBlocked??0,staleOverridesRemoved:i?.removedOverridePackages?.length??0,packagesProtected:r}),e.compactSummary({severityCritical:i?.severityCritical??0,severityHigh:i?.severityHigh??0,severityMedium:i?.severityMedium??0,severityLow:i?.severityLow??0,overridesTracked:i?.appendixEntriesUpdated??0,overridesRemoved:i?.overridesRemoved??0,packagesScanned:i?.packagesScanned??0}),e.complete(`The herd is safe!`,` ${ne}`),await e.waitForCompletion()},ia=(e,t)=>{t.updated&&e.notice(`Run an install to capture the updates!`)},aa=(e,t)=>{let n=t.skipRemovalKeys||[];if(n.length===0)return;let r=n.length;e.notice(`${r} override${b(r)} kept after verification - ${n.join(`, `)}`)},oa=(e,t,n)=>{let r=o(t.finalAppendix??{});if(!(r.length>0&&!n.removeUnused))return;let i=r.length;e.notice(`${i} unused override${b(i)} detected. Run with --remove-unused to clean up.`)},sa=(e,t,n,r,i)=>{ia(e,n),aa(e,r),oa(e,t,i)},ca=async(e,t,n,r,i,a,o)=>{let s=t.metrics?.removedOverridePackages??[];ta(e,t,n,s.length===0),na(e,s),await ra(e,t,r,i),sa(e,t,n,a,o)},la=(e,t)=>{if(t===`total`)return e.packagesScanned;if(t===`severityHeader`)return``;if(t===`writeStatus`)return e.writeSuccess?`Success`:`Skipped`;let n=e[t];return typeof n==`boolean`?+!!n:n},ua=(e,t,n)=>{let r=(typeof t==`number`?t:0)>0;if(e===`severityCritical`&&r||e===`severityHigh`&&r)return`red`;if(e===`severityMedium`&&r)return`yellow`;if(e===`severityLow`&&r)return`gray`;if(e===`vulnerabilitiesBlocked`&&r)return`green`;if(e===`overridesAdded`&&r)return`cyan`;if(e===`writeStatus`&&n.writeSuccess)return`green`;if(e===`writeStatus`)return`yellow`},da=(e,t)=>{let n=la(e,t.key),r=ua(t.key,n,e);return{label:t.label,value:n,color:r}},fa=e=>{let t=e.metrics;if(!t)return;let n=Vi.map(e=>da(t,e)),r=gt(n,{title:`${a} Pastoralist Summary`});console.log(`
+`+r)},pa=`${a} ${n(`Pastoralist`)} is scanning overrides...`,ma=e=>Object.assign({},e.dependencies,e.devDependencies,e.peerDependencies),ha=e=>({low:1,medium:2,high:3,critical:4})[e?.toLowerCase()||``]||0,Z=e=>e.reduce((e,t)=>e+ha(t.severity),0),ga=e=>e.cves?.length?e.cves.slice().sort().join(`,`):e.title?e.title:e.description?e.description:e.vulnerableVersions||``,_a=e=>`${e.packageName}@${e.currentVersion}:${ga(e)}`,va=(e,t)=>{let n=new Set(e.map(_a));return t.map(_a).filter(e=>!n.has(e))},ya=e=>e.path?e.root?C(e.root,e.path):C(e.path):C(e.root||`.`,`package.json`),ba=(e,t)=>ce({config:e,manifestPath:ya(t)}),xa=(e,t,n)=>{let r=e.pastoralist?.appendix||{},i=new Set(t.skipRemovalKeys||[]),a=new Set(Object.keys(n.overrides));return o(r,ma(e)).filter(e=>!i.has(e)&&a.has(ae([e])[0]))},Sa=(e,t,n)=>{let r=ae(t),i=ie(n.overrides,r);return n.kind===`yaml`?Ae(e,i,`pnpm`):se(e,n,i)},Ca=(e,t)=>{let n=e.pastoralist?.security,r=Object.assign({},t,{root:t.root||`./`});return n?.excludePackages&&(r.excludePackages=n.excludePackages),n?.severityThreshold&&(r.severityThreshold=n.severityThreshold),r},wa=async(e,t,n)=>{let r=Object.assign({},Ca(e,n),{interactive:!1,requireCompleteScan:!0,scanFullDependencyInventory:!n.isTesting});return(await t.checkSecurity(e,r)).alerts},Ta=(e,t,n)=>Object.assign({},Ca(e,t),{depPaths:[],interactive:!1,refreshCache:!0,requireCompleteScan:!0,root:n,scanFullDependencyInventory:!t.isTesting,skipCacheWrite:!0}),Ea=(e,t,n)=>{let r=async r=>{let i=Ta(e,n,r);return(await t.checkSecurity(e,i)).alerts};return n.isTesting?r(n.root||`./`):p(e,n,r)},Da=(e,t)=>{let n=new Set(t.map(e=>e.packageName));return e.filter(e=>{let[t]=ae([e]);return n.has(t)})},Oa=e=>Array.from(new Set(e)),ka=(e,t,n)=>t.length>e.length||Z(t)>Z(e)||n.length>0,Aa=(e,t=3)=>{let n=e.slice(0,t).join(`, `),r=e.length-t;return r<=0?n:`${n} (+${r} more)`},ja=(e,t,n,r,i,a)=>{if(i.length>0)return`New vulnerabilities detected after removal: ${Aa(i)}.`;if(r>n)return`Risk score increased from ${n} to ${r} after removal.`;if(t.length>e.length)return`Alert count increased from ${e.length} to ${t.length} after removal.`;if(a.length!==0)return`Removed overrides still resolve to vulnerable packages: ${Aa(a)}.`},Ma=(e,t,n)=>{let r=va(t,n),i=Z(t),a=Z(n),o=ka(t,n,r)?e:[],s=Da(e,n),c=Oa(o.concat(s)),l=new Set(c),u=e.filter(e=>!l.has(e)),d=c.length>0?`blocked`:`safe`,f=ja(t,n,i,a,r,s);return{removableKeys:e,allowedKeys:u,blockedKeys:c,beforeAlertCount:t.length,afterAlertCount:n.length,beforeRiskScore:i,afterRiskScore:a,newVulnerabilityKeys:r,status:d,reason:f}},Na=(e,t,n)=>{let r=n instanceof Error?n.message:String(n),i=Z(t);return{removableKeys:e,allowedKeys:[],blockedKeys:e,beforeAlertCount:t.length,afterAlertCount:t.length,beforeRiskScore:i,afterRiskScore:i,newVulnerabilityKeys:[],status:`blocked`,reason:`Post-removal security scan failed: ${r}`}},Pa=(e,t,n)=>{let r=e.blockedKeys.concat(t),i={key:t,reason:n||`Removal could not be verified.`},a=e.blockedReasons.concat(i);return Object.assign({},e,{blockedKeys:r,blockedReasons:a})},Fa=async(e,t,n)=>{let r=t.allowedKeys.concat(n),i=Sa(e.config,r,e.source);try{let a=await Ea(i,e.securityChecker,e.options),o=Ma([n],t.afterAlerts,a);return o.blockedKeys.length>0?Pa(t,n,o.reason):Object.assign({},t,{allowedKeys:r,afterAlerts:a})}catch(e){let r=Na([n],t.afterAlerts,e);return Pa(t,n,r.reason)}},Ia=(e,t)=>{let n={allowedKeys:[],blockedKeys:[],afterAlerts:e.beforeAlerts,blockedReasons:[]};return t.reduce(async(t,n)=>Fa(e,await t,n),Promise.resolve(n))},La=e=>{if(e.length!==0)return e.length===1?e[0].reason:e.map(({key:e,reason:t})=>`${e}: ${t}`).join(` `)},Ra=(e,t,n)=>{let r=Z(t),i=Z(n.afterAlerts),a=va(t,n.afterAlerts),o=n.blockedKeys.length>0?`blocked`:`safe`,s=La(n.blockedReasons);return{removableKeys:e,allowedKeys:n.allowedKeys,blockedKeys:n.blockedKeys,beforeAlertCount:t.length,afterAlertCount:n.afterAlerts.length,beforeRiskScore:r,afterRiskScore:i,newVulnerabilityKeys:a,status:o,reason:s}},za=async(e,t,n)=>{let r=ba(e,n),i=xa(e,n,r);if(i.length===0)return;let a=await wa(e,t,n),o=await Ia({config:e,source:r,securityChecker:t,options:n,beforeAlerts:a},i);return Ra(i,a,o)},Ba=u({file:`program.ts`,isLogging:!1}),Va=e=>e.root?e.root:e.path?Le(C(e.path)):`./`,Ha=e=>{if(e===void 0)return;let t=typeof e==`number`,n=typeof e==`string`&&e.trim()!==``,r=t||n?Number(e):NaN;if(Number.isFinite(r)&&r>=0)return r;throw Error(`--cache-ttl must be a non-negative number of seconds`)},Ua=(e,t,n,r)=>{let i=e.securityProvider??r??`osv`,a=Ha(e.cacheTtl??t.cacheTtl),o=e.checkSecurity??n.enabled,s=e.forceSecurityRefactor??n.autoFix,c=e.securityProviderToken??n.securityProviderToken,l=e.interactive??n.interactive,u=e.hasWorkspaceSecurityChecks??n.hasWorkspaceSecurityChecks,d=e.strict??n.strict;return Object.assign({},t,{checkSecurity:o,forceSecurityRefactor:s,securityProvider:i,securityProviderToken:c,interactive:l,hasWorkspaceSecurityChecks:u,strict:d,cacheTtl:a})},Wa=e=>{let t=[[`cves`,e.cves?.length?e.cves:void 0],[`severity`,e.severity],[`description`,e.description],[`url`,e.url],[`vulnerableRange`,e.vulnerableRange],[`patchedVersion`,e.patchedVersion],[`sources`,e.sources]].filter(([,e])=>e!==void 0).reduce((e,[t,n])=>Object.assign({},e,{[t]:n}),{});return Object.assign({},{packageName:e.packageName,reason:e.ledgerReason??e.reason},t)},Ga=(e,t,n)=>new n({provider:e.securityProvider,forceRefactor:e.forceSecurityRefactor,interactive:e.interactive,token:e.securityProviderToken,debug:t,strict:e.strict,root:e.root,cacheDir:e.cacheDir,cacheTtl:e.cacheTtl,noCache:e.noCache,refreshCache:e.refreshCache}),Ka=(e,t,n)=>new n({provider:e.securityProvider,forceRefactor:e.forceSecurityRefactor,interactive:e.interactive,token:e.securityProviderToken,debug:t,strict:e.strict,root:e.root,cacheTtl:e.cacheTtl}),qa=(e,n,r=Ba)=>{let i=e?.pastoralist?.depPaths,a=n.checkSecurity||e?.pastoralist?.checkSecurity||!1;if(Ja(i,a))return r.debug(`Using depPaths configuration for security checks: ${i.join(`, `)}`,`determineSecurityScanPaths`),i;let o=t(e,n.root||`./`,r);return Ya(i,o,a,n)?(r.debug(`Using workspace configuration for security checks: ${o.join(`, `)}`,`determineSecurityScanPaths`),o):[]},Ja=(e,t)=>Array.isArray(e)&&t,Ya=(e,t,n,r)=>Xa(e,t,n)||Za(r,t.length>0),Xa=(e,t,n)=>e!==`workspace`&&e!==`workspaces`||t.length===0?!1:n,Za=(e,t)=>(e.hasWorkspaceSecurityChecks||!1)&&t,Qa=e=>t=>{e.update(t.message)},$a=(e,t,n,r)=>Object.assign({},t,{depPaths:n,root:Va(t),packageJsonPath:t.path,onProgress:Qa(r),severityThreshold:e?.pastoralist?.security?.severityThreshold,excludePackages:e?.pastoralist?.security?.excludePackages}),eo=(e,t,n)=>({spinner:e,securityChecker:t,alerts:n.alerts,securityOverrides:n.overrides,updates:n.updates,packagesScanned:n.packagesScanned,bestCase:n.bestCase,userOwnedOverridesAdded:n.userOwnedOverridesAdded,skipped:!1}),to=async(e,t,n,r,i,a)=>{let o=Ga(t,n,a.SecurityChecker),s=a.determineSecurityScanPaths(e,t,r),c=$a(e,t,s,i),l=await o.checkSecurity(e,c);return eo(i,o,l)},no=async(e,t,n,r,a={createSpinner:M,SecurityChecker:ke,determineSecurityScanPaths:qa,green:i,yellow:_})=>{let o=a.createSpinner(pa).start();try{return await to(e,t,n,r,o,a)}catch(e){return ro(e,o,t,n,a)}},ro=(e,t,n,r,i)=>{if(e instanceof ue)return t.warn(`${i.yellow(`pastoralist`)} ${e.message}`),{spinner:t,securityChecker:Ka(n,r,i.SecurityChecker),alerts:[],securityOverrides:[],updates:[],packagesScanned:0,bestCase:void 0,userOwnedOverridesAdded:void 0,skipped:!0};let a=e instanceof Error?e.message:String(e);throw t.fail(`${i.yellow(`pastoralist`)} security check failed: ${a}`),e},io=e=>({packageName:e.packageName,fromVersion:e.currentOverride,toVersion:e.newerVersion,reason:e.reason,severity:`medium`}),ao=(e,t)=>e.filter(e=>{let n=t[e.packageName];return typeof n==`string`&&n===e.toVersion}),oo=(e,t,n)=>{let r=t.generatePackageOverrides(e),i=ao(e,r),a=i.map(Wa);return i.length>0&&!n.dryRun&&t.applyAutoFix(i,n.path,n.config),{securityOverrides:r,securityOverrideDetails:a}},so=(e,t,n,r,i,a=[],o=!1)=>{let s=i.forceSecurityRefactor||i.interactive,c=e.length>0&&s,l=o?[]:a,u=l.length>0&&s;if(!c&&!u)return r.stop(),{};let d=l.map(io),f=t.concat(d),p=oo(f,n,i);return r.stop(),p},co=()=>({hasSecurityIssues:!1,securityAlertCount:0,securityAlerts:[]}),lo=e=>{if(e)return{selectedState:e.selectedState,decisionId:e.decisionId,policyHash:e.policyHash,search:e.search,impact:e.impact,failedStates:e.failedStates}},uo=(e,t=5)=>{let n=e.slice(0,t).join(`, `),r=e.length-t;return r<=0?n:`${n}, +${r} more`},fo=e=>{let t=e.allowedKeys.length,n=uo(e.allowedKeys);return`Removal verification check found ${e.beforeAlertCount} -> ${e.afterAlertCount} vulnerabilities. Remove ${t} unused ${`override${t===1?``:`s`}`} (${n})?`},po=async(e,t,n,r)=>{if(!t.removeUnused)return t;let i=await za(e,n,t);if(!i)return t;let a=await mo(i,t,r),o=t.skipRemovalKeys||[],s=Array.from(new Set(o.concat(a.blockedKeys))),c=Object.assign({},t,{removalVerification:a});return s.length===0?c:Object.assign({},c,{skipRemovalKeys:s})},mo=async(e,t,n)=>{let r=t.interactive===!0,i=e.allowedKeys.length>0;return!(r&&i)||await n.quickConfirm(fo(e),!1)?e:Object.assign({},e,{status:`declined`,allowedKeys:[],blockedKeys:e.removableKeys,reason:`User declined cleanup after reviewing the removal verification.`})},ho=(e,t,n)=>{if(e.skipped)return t;let r=n.handleSecurityResults(e.alerts,e.securityOverrides,e.securityChecker,e.spinner,t,e.updates,!!e.bestCase);return Object.assign({},t,r)},go=(e,t)=>{let n=e?.userOwnedOverrides??[],r=Array.from(new Set(n.concat(t)));return Object.assign({},e,{userOwnedOverrides:r})},_o=(e,t)=>{if(!e)return;let n=e.pastoralist??{},r=go(n.bestCase,t),i=Object.assign({},n,{bestCase:r});return Object.assign({},e,{pastoralist:i})},vo=(e,t)=>{if(!t?.length)return e;let n=go(e.bestCase,t),r=_o(e.config,t),i=_o(e.manifestConfig,t);return Object.assign({},e,{bestCase:n,config:r,manifestConfig:i})},yo=e=>({mergedOptions:e,securityResult:co(),packagesScanned:0,bestCase:void 0}),bo=async(e,t,n,r)=>{let i=vo(t,n.userOwnedOverridesAdded),a=Object.assign({},i,{securityAlerts:n.alerts}),o=await po(e,a,n.securityChecker,r);return ho(n,o,r)},xo=(e,t,n,r)=>{t.skipped||r||(Qi(e,t.alerts,t.securityOverrides,n,t.packagesScanned),Ki(e,n.removalVerification))},So=async(e,t,n,r,i,a,o)=>{r||e.startPhase(`scanning`,`Scanning packages`);let s=await o.runSecurityCheck(t,n,i,a),c=De(s.alerts),l=await bo(t,n,s,o);xo(e,s,l,r);let u=lo(s.bestCase);return{mergedOptions:l,securityResult:c,packagesScanned:s.packagesScanned,bestCase:u}},Co=(e,t,n,r,i,a,o)=>n.checkSecurity?So(e,t,n,r,i,a,o):yo(n),wo=(e,t,n)=>e?(t.debug(`action:options:`,`action`,{options:n}),!0):!1,To=e=>{if(e===!0||e===`config`)return!0;if(!Array.isArray(e))return!1;let[t]=e;return t===`config`},Eo=async(e,t,n,r={initCommand:Ai})=>{if(!To(e))return!1;let i=Array.isArray(n.securityProvider)?n.securityProvider[0]:n.securityProvider;return await r.initCommand({path:t.path,root:t.root,checkSecurity:n.checkSecurity,securityProvider:i,hasWorkspaceSecurityChecks:n.hasWorkspaceSecurityChecks}),!0},Do=(e,t)=>{let n=!!(c||e.debug),r=e.outputFormat===`json`,i=e.quiet===!0,a=t.createLogger({file:`program.ts`,isLogging:n}),o=t.createTerminalGraph({quiet:i}),s=ye(),{isTestingCLI:l=!1,init:u=!1,...d}=e;return{emptyResult:s,graph:o,init:u,isJsonOutput:r,isLogging:n,isQuietMode:i,isTestingCLI:l,log:a,rest:d}},Oo=t=>{let n=xe({cacheDir:t.cacheDir,root:t.root});e(n)},ko=e=>(h(e.emptyResult,e.isJsonOutput),e.emptyResult),Ao=async(e,t,n)=>{if(t.handleTestMode(n.isTestingCLI,n.log,e)||await t.handleInitMode(n.init,e,n.rest))return ko(n)},jo=e=>{!e.isJsonOutput&&!e.isQuietMode&&e.graph.banner()},Mo=(e,t,n,r)=>Co(r.graph,e.config,t,r.isJsonOutput,!!r.isLogging,r.log,n),No=(e,t)=>{let n=t.getLedgerAddedDate();return Object.assign({},e,{addedDate:n})},Po=(e,t,n,r)=>{let i=r.update(t);return{updateContext:i,updateResultData:we(i,e,n.dryRun||!1)}},Fo=async(e,t,n)=>{let r=await pe(e,n.rest,t),i=await Mo(r,r.mergedOptions,t,n),a=No(i.mergedOptions,t),o=Po(r.config,a,e,t);return Object.assign({},r,{mergedOptions:a,securityPhase:i},o)},Io=(e,t)=>Object.assign({},e.emptyResult,t.securityPhase.securityResult,t.updateResultData,{removalVerification:t.mergedOptions.removalVerification,bestCase:t.securityPhase.bestCase,metrics:t.updateContext.metrics}),Lo=(e,t,n,r)=>(r.summary&&!n.isJsonOutput&&fa(e),h(e,n.isJsonOutput),n.isQuietMode&&e.hasSecurityIssues&&t.processExit(1),e),Ro=async(e,t,n)=>{t.isJsonOutput||await ca(t.graph,e.updateContext,e.updateResultData,e.securityPhase.securityResult,e.securityPhase.packagesScanned,e.mergedOptions,n)},zo=async(e,t,n)=>{let r=await Fo(e,t,n);return await Ro(r,n,e),Lo(Io(n,r),t,n,e)},Bo=(e,t,n)=>{n.graph.stop();let r=_e(e);return n.isJsonOutput?h(r,n.isJsonOutput):n.log.fail(r.errors[0]||`Action failed`),t.processExit(1),r},Vo={createLogger:u,handleTestMode:wo,handleInitMode:Eo,resolveJSON:l,buildMergedOptions:Ua,runSecurityCheck:no,handleSecurityResults:so,createSpinner:M,green:i,quickConfirm:Ur,update:Te,createTerminalGraph:qn,getLedgerAddedDate:oe,loadConfig:Se,loadConfigWithSource:je,processExit:e=>process.exit(e)};async function Ho(e={},t=Vo){Oo(e);let n=Do(e,t),r=await Ao(e,t,n);if(r)return r;jo(n);try{return await zo(e,t,n)}catch(e){return Bo(e,t,n)}}const Uo={readFileSync:Re.readFileSync,writeFileSync:Re.writeFileSync,resolve:w},Wo=(e,t)=>t.resolve(Fe(e.path||`package.json`,e.root)),Go=(e,t)=>JSON.parse(t.readFileSync(e,`utf8`)),Ko=e=>e?`${e} && pastoralist`:`pastoralist`,qo=e=>{let t=e.scripts||{},n=Object.assign({},t,{postinstall:Ko(t.postinstall||``)});return Object.assign({},e,{scripts:n})},Jo=(e,t,n)=>{n.writeFileSync(e,JSON.stringify(t,null,2)+`
+`)},Yo=(e,t,n=Uo)=>{if(e.setupHook!==!0)return!1;try{let r=Wo(e,n),i=Go(r,n);return(i.scripts?.postinstall||``).includes(`pastoralist`)?(t.print(`postinstall hook already configured`),!0):e.dryRun?(t.print(`[DRY RUN] would add postinstall hook to package.json`),!0):(Jo(r,qo(i),n),t.print(`added postinstall hook to package.json`),!0)}catch(e){let n=e instanceof Error?e.message:String(e);return t.fail(`Failed to setup hook: ${n}`),process.exitCode=1,!0}},Q=(e,t)=>{e.writeLine(``),e.writeLine(x(`◆ ${t}`))},$=(e,t)=>{e.writeLine(t)},Xo=e=>{Q(e,`Colors and links`),$(e,`  ${i(`green`)} ${f(`red`)} ${_(`yellow`)} ${re(`gold`)}`),$(e,`  ${fe(`copper`)} ${x(`cyan`)} ${m(`gray`)}`),$(e,`  ${Pe()}`),$(e,`  ${n(`green to tan`)}`),$(e,`  ${r(`https://jeffry.in/pastoralist`,`documentation link`)}`)},Zo=e=>{Q(e,`Formatting`),$(e,g([i(`Boxed content`),`Aligned with visible-width support`],{title:`Box`}).join(`
+`)),$(e,Ce(`─`,40)),$(e,Oe(75)),$(e,Me(`Indented text`)),$(e,ge(`Leading newline`)),$(e,he(1,`Numbered item`))},Qo=e=>{Q(e,`Prompts`),$(e,Qn(`Apply the example fix`)),$(e,$n(`Choose a package manager`,[{name:`npm`,value:`npm`},{name:`pnpm`,value:`pnpm`}])),$(e,er()),$(e,tr(`Project name`,`pastoralist`)),$(e,V(1,`Configuration`)),$(e,nr(`Informational message`)),$(e,rr(`Successful message`)),$(e,ir(`Warning message`)),$(e,ar(`Complete`,[`Inspect output`,`Keep building`]))},$o=e=>{Q(e,`Table`),$(e,gt([{label:`Packages scanned`,value:12,color:`cyan`},{label:`Security fixes`,value:3,color:`green`},{label:`Unused overrides`,value:1,color:`yellow`}],{title:`DX metrics`}))},es=e=>{Q(e,`Spinner`),M(`Loading dependency graph`,e).start().update(`Dependency graph loaded`).succeed(),M(`Example failure`,e).fail(),M(`Example information`,e).info(),M(`Example warning`,e).warn()},ts=async e=>{Q(e,`Shimmer`),$(e,`  ${N(`Shimmer frame`,.5)}`),await Nt(`Animated shimmer`,30,e,`  `)},ns=e=>{Q(e,`Hint`),$(e,de(`Hints can be rendered without changing the hint cache.`))},rs={severity:`high`,packageName:`demo-package`,currentVersion:`1.0.0`,title:`Example vulnerability`,cves:[`CVE-2026-0001`],fixAvailable:!0,patchedVersion:`1.0.1`,url:`https://osv.dev/`},is={packageName:`demo-package`,version:`1.0.1`,reason:`security`,dependents:{"styleguide-app":`demo-package@^1.0.0`},patches:[`1.0.0 -> 1.0.1`],isSecurityFix:!0,cves:[`CVE-2026-0001`]},as={packageName:`demo-package`,fromVersion:`1.0.0`,toVersion:`1.0.1`,cves:[`CVE-2026-0001`],severity:`high`,reason:`Patched security release`},os={packageName:`stale-package`,version:`1.0.0`,reason:`No longer required`},ss=e=>{e.startPhase(`scanning`,`Scanning dependencies`).progress(1,3,`package.json`).progress(3,3,`dependency tree`).item(`Dependency tree ready`).vulnerability(rs,!0).endPhase(`Scan complete`)},cs=e=>{e.startPhase(`resolving`,`Resolving overrides`).override(is).securityFix(as).removedOverride(os,!0).endPhase(`Resolution complete`)},ls=async e=>{let t=qn({out:e});t.banner(),ss(t),cs(t),t.summary({"demo-package":`1.0.1`},[`Applied security fix`]).executiveSummary({vulnerabilitiesFixed:1,packagesProtected:1}).compactSummary({severityCritical:0,severityHigh:1,severityMedium:0,severityLow:0,overridesTracked:1,overridesRemoved:1,packagesScanned:12}).notice(`Terminal graph components are composable.`),t.stop().complete(`DX styleguide complete`),await t.waitForCompletion()},us=async e=>{Xo(e),Zo(e),Qo(e),$o(e),es(e),await ts(e),ns(e),await ls(e)},ds=[{name:`Colors and links`,value:`colors`,description:`color and hyperlink helpers`},{name:`Formatting`,value:`formatting`,description:`boxes, dividers, and progress`},{name:`Interactive prompts`,value:`prompts`,description:`radio, checkbox, and input`},{name:`Tables`,value:`table`,description:`aligned metrics`},{name:`Spinners`,value:`spinner`,description:`success and status states`},{name:`Shimmer`,value:`shimmer`,description:`animated progress text`},{name:`Hints`,value:`hint`,description:`cached guidance rendering`},{name:`Terminal graph`,value:`graph`,description:`scan and resolution lifecycle`},{name:`Run all demos`,value:`all`,description:`render every non-interactive example`},{name:`Exit styleguide`,value:`exit`,description:`return to the shell`}],fs=[{name:`npm`,value:`npm`,description:`package manager available`},{name:`pnpm`,value:`pnpm`,description:`package manager available`,checked:!0},{name:`Yarn`,value:`yarn`,description:`package manager available`},{name:`Bun`,value:`bun`,description:`package manager available`,disabled:`not installed`}],ps={select:Br,checkbox:Vr},ms=async(e,t)=>{Q(e,`Interactive prompts`);let n=await t.checkbox(`Choose package managers`,fs);$(e,m(`Selected: ${n.join(`, `)||`none`}`)),Qo(e)},hs=async(e,t,n)=>{if(e===`prompts`)return await ms(t,n);if(e===`all`)return await us(t);if(e===`colors`)return Xo(t);if(e===`formatting`)return Zo(t);if(e===`table`)return $o(t);if(e===`spinner`)return es(t);if(e===`shimmer`)return await ts(t);if(e===`hint`)return ns(t);if(e===`graph`)return await ls(t)},gs=async(e=Ee(),t=ps)=>{$(e,`${Pe()} ${x(`DX styleguide`)}`),$(e,m(`A live tour of Pastoralist's terminal UI components.`));try{for(;;){let n=await t.select(`Choose a component demo`,ds);if(n===`exit`)return;await hs(n,e,t)}}catch(t){if(!(t instanceof Error&&t.name===`PromptCancelled`))throw t;$(e,m(`Styleguide closed.`))}},_s=[`config`,`agent-skill`],vs=[`doctor`,`init`,`onboard`,`onboarding`],ys=(e,t)=>{let n=e instanceof Error?e.message:String(e);t.fail(`Error: ${n}`),ct(t.print),process.exitCode=1},bs=(e,t)=>{try{return st(e)}catch(e){ys(e,t);return}},xs=(e,t)=>!!(t.help||e.includes(`-h`)||e.includes(`--help`)),Ss=(e,t)=>!!(t.version||e.includes(`-v`)||e.includes(`--version`)),Cs=e=>!e||vs.some(t=>t===e),ws=e=>e===`onboard`||e===`onboarding`,Ts=(e,t)=>t.onboard===!0||ws(e),Es=e=>_s.includes(e),Ds=e=>e===!0?[]:typeof e==`string`?[e]:Array.isArray(e)?e:[],Os=e=>{let[t,...n]=e;if(!t)return{type:`config`,args:[]};if(Es(t))return{type:t,args:n};throw Error(`Unknown init type: ${t}. Expected config or agent-skill.`)},ks=(e,t,n)=>Os(e===`init`?t:Ds(n)),As=(e,t)=>e===`init`||t!==void 0&&t!==!1,js=e=>{if(!ze(e))return;let t=JSON.parse(Be(e,`utf8`));if(typeof t.version==`string`)return t.version},Ms=()=>He(Ue(import.meta.url)),Ns=()=>{let e=Ms(),t=[w(e,`../package.json`),w(e,`../../package.json`)].map(js).find(e=>e!==void 0);if(!t)throw Error(`Unable to read package version`);return t},Ps=()=>{let e=Ms(),t=[w(e,`scripts/setup/setup.sh`),w(e,`../scripts/setup/setup.sh`),w(e,`../../scripts/setup/setup.sh`)].find(ze);if(!t)throw Error(`Unable to find scripts/setup/setup.sh`);return t},Fs=(e,t=[])=>{let n=Ps(),r=e.dryRun?[`--dry-run`]:[];return[n,`skill`].concat(r,t)},Is=e=>Array.isArray(e.securityProvider)?e.securityProvider[0]:e.securityProvider,Ls=async(e,t)=>{let n=Object.assign({},e,{securityProvider:Is(e)});await t.initCommand(n)},Rs=async(e,t,n)=>{let r=Object.assign({},e,{dryRun:!0,summary:!0});r.outputFormat!==`json`&&n(`Pastoralist doctor runs in dry-run mode and will not modify package.json.`),await t.action(r)},zs=(e,t)=>!1,Bs=(e,t=[])=>{if(zs(e,t))return;let n=Fs(e,t),r=e.root||process.cwd(),i=We(`sh`,n,{cwd:r,stdio:`inherit`});if(i.error)throw i.error;i.status!==0&&(process.exitCode=i.status??1)},Vs=e=>{let t=e[0];if(t)throw Error(`Unexpected init config argument: ${t}`)},Hs=async(e,t,n,r)=>{let i=ks(e,t,n.init);if(i.type===`agent-skill`){await r.setupAgentSkill(n,i.args);return}Vs(i.args),await Ls(n,r)},Us={initCommand:Ai,action:Ho,showOnboarding:ai,setupAgentSkill:Bs,styleguide:gs},Ws=async(e=process.argv,t=Us)=>{let n=u({file:`program.ts`,isLogging:!1}),r=bs(e,n);if(!r)return;let i=r.options;if(xs(e,i)){ct(n.print);return}if(Ss(e,i)){n.print(Ns());return}if(!Cs(r.command)){ys(Error(`Unknown command: ${r.command}`),n);return}if(i.styleguide){await(t.styleguide||gs)();return}if(Ts(r.command,i)){t.showOnboarding();return}if(!Yo(i,n)){if(As(r.command,i.init)){try{await Hs(r.command,r.commandArgs,i,t)}catch(e){ys(e,n)}return}if(r.command===`doctor`)return Rs(i,t,n.print);await t.action(i)}};export{Ws as run};

package/dist/core/security/index.d.ts

@@ -49,6 +49,7 @@ export declare class SecurityChecker {
     private extractPackagesForScan;
     private resolveFullDependencyInventory;
     private resolveVersionScanPackages;
+    private resolveDeclaredVersionPackages;
     private resolveConfiguredPackageRoot;
     private resolvePackageRoot;
     private hasCompleteBestCaseInventory;
@@ -62,6 +63,7 @@ export declare class SecurityChecker {
     private logProviderAlerts;
     private fetchProviderAlerts;
     private createProviderRequests;
+    private fetchProviderPackages;
     private normalizeProviderResult;
     private resolveVulnerablePackages;
     private reportVulnerabilityAnalysis;

package/dist/dx/hint.d.ts

@@ -1,3 +1,4 @@
 import type { Output } from "./output";
 export declare function clearHintCache(): void;
+export declare const renderHint: (text: string, width?: number) => string;
 export declare function showHint(hintId: string, text: string, ttlMs?: number, out?: Output): void;

package/dist/dx/index.d.ts

@@ -7,6 +7,6 @@ export { hideCursor, showCursor, clearLine, renderFrame, stopInterval, updateSta
 export type { SpinnerState, Spinner, TerminalGraphState, TerminalGraph, TerminalPhase, } from "./types";
 export { shimmerFrame, playShimmer } from "./shimmer";
 export { createTerminalGraph } from "./terminal-graph";
-export { showHint, clearHintCache } from "./hint";
+export { showHint, renderHint, clearHintCache } from "./hint";
 export { green, red, yellow, gold, copper, cyan, gray, gradientPastoralist, gradientGreenTan, link, } from "./colors";
 export { formatConfirmPrompt, formatChoiceList, formatChoicePrompt, formatInputPrompt, formatStepHeader, formatInfo, formatSuccess, formatWarning, formatCompletion, } from "./prompts";

package/dist/index.js

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-import{$ as e,A as t,C as n,D as r,E as i,F as a,G as o,I as s,J as c,K as l,L as u,M as d,N as f,O as p,Q as m,S as h,St as g,T as _,X as v,Y as y,Z as b,b as x,d as S,et as C,f as w,i as T,it as E,j as D,k as O,l as k,n as A,nt as j,o as M,q as N,r as P,rt as F,s as I,t as L,tt as R,u as z,w as B,x as V,z as H}from"./security-C6XkraQc.js";import{realpathSync as U}from"fs";import{fileURLToPath as W}from"url";if(W(import.meta.url)===(e=>{if(!e)return``;try{return U(e)}catch{return``}})(process.argv[1])||process.argv[1]?.endsWith(`/pastoralist`)||process.argv[1]?.endsWith(`\\pastoralist`)){let{run:e}=await import(`./cli-GG9_l2eA.js`);await e(process.argv)}export{L as SecurityChecker,R as applyOverridesToConfig,v as applyOverridesToSourceConfig,B as attachPatchesToAppendix,a as checkMonorepoOverrides,s as cleanupUnusedOverrides,I as clearConfigCache,r as clearDependencyTreeCache,x as constructAppendix,P as createBestCaseReason,o as defineOverride,j as detectPackageManager,_ as detectPatches,p as findPackageJsonFiles,V as findRemovableAppendixItems,u as findUnusedOverrides,i as findUnusedPatches,O as forceClearCache,t as getCacheStats,F as getExistingOverrideField,E as getOverrideFieldForPackageManager,l as getOverridesByType,D as jsonCache,k as loadConfig,z as loadConfigWithSource,S as loadExternalConfig,g as logger,w as mergeConfigs,H as mergeOverridePaths,A as optimizeBestCasePortfolio,e as parsePnpmWorkspaceOverrides,h as processAndWritePackageJSON,T as resolveBestCasePolicy,d as resolveJSON,b as resolveOverrideSource,N as resolveOverrides,c as resolveOverridesFromSource,M as update,n as updateAppendix,y as updateOverrides,f as updatePackageJSON,C as updatePnpmWorkspaceOverrides,m as writeOverrideSource};
+import{$ as e,A as t,C as n,D as r,E as i,F as a,G as o,I as s,J as c,K as l,L as u,M as d,Mt as f,N as p,O as m,Q as h,S as g,T as _,X as v,Y as y,Z as b,b as x,d as S,et as C,f as w,i as T,it as E,j as D,k as O,l as k,n as A,nt as j,o as M,q as N,r as P,rt as F,s as I,t as L,tt as R,u as z,w as B,x as V,z as H}from"./security-Cgjkw8tJ.js";import{realpathSync as U}from"fs";import{fileURLToPath as W}from"url";if(W(import.meta.url)===(e=>{if(!e)return``;try{return U(e)}catch{return``}})(process.argv[1])||process.argv[1]?.endsWith(`/pastoralist`)||process.argv[1]?.endsWith(`\\pastoralist`)){let{run:e}=await import(`./cli-D2AZT_nM.js`);await e(process.argv)}export{L as SecurityChecker,R as applyOverridesToConfig,v as applyOverridesToSourceConfig,B as attachPatchesToAppendix,a as checkMonorepoOverrides,s as cleanupUnusedOverrides,I as clearConfigCache,r as clearDependencyTreeCache,x as constructAppendix,P as createBestCaseReason,o as defineOverride,j as detectPackageManager,_ as detectPatches,m as findPackageJsonFiles,V as findRemovableAppendixItems,u as findUnusedOverrides,i as findUnusedPatches,O as forceClearCache,t as getCacheStats,F as getExistingOverrideField,E as getOverrideFieldForPackageManager,l as getOverridesByType,D as jsonCache,k as loadConfig,z as loadConfigWithSource,S as loadExternalConfig,f as logger,w as mergeConfigs,H as mergeOverridePaths,A as optimizeBestCasePortfolio,e as parsePnpmWorkspaceOverrides,g as processAndWritePackageJSON,T as resolveBestCasePolicy,d as resolveJSON,b as resolveOverrideSource,N as resolveOverrides,c as resolveOverridesFromSource,M as update,n as updateAppendix,y as updateOverrides,p as updatePackageJSON,C as updatePnpmWorkspaceOverrides,h as writeOverrideSource};