pastoralist 1.13.2 → 1.13.4

package/README.md

@@ -337,6 +337,19 @@ pastoralist --version # -v
 Use these to check the installed CLI surface before wiring Pastoralist into
 scripts or CI.
 
+#### `--styleguide`
+
+> Type: **`boolean option`**
+
+Opens an interactive radio menu for exploring the Pastoralist DX components
+without reading or changing project configuration. Use the arrow keys and Enter
+to choose a demo. In the prompt demo, Space toggles choices, `a` selects all,
+`n` selects none, and Esc cancels.
+
+```sh
+pastoralist --styleguide
+```
+
 #### `pastoralist doctor`
 
 > Type: **`command`**

package/dist/cli/index.d.ts

@@ -6,5 +6,6 @@ export { buildSecurityResult, buildUpdateResult, createEmptyResult, createErrorR
 export { displayOverrides, displaySummaryTable } from "./display";
 export { handleSetupHook } from "./setup-hook";
 export { buildOnboardingText, showOnboarding } from "./cmds/init";
+export { formatStyleguide, showStyleguide } from "./styleguide";
 export declare const setEmbeddedAgentSkill: (skill: string) => void;
 export declare const run: (argv?: string[], deps?: RunDeps) => Promise<void>;

package/dist/cli/parser/constants.d.ts

@@ -1,4 +1,4 @@
 import type { OptionDefinition } from "./types";
 export declare const OPTION_DEFINITIONS: OptionDefinition[];
-export declare const HELP_TEXT = "\nPastoralist - A utility CLI to manage your dependency overrides\n\nUsage: pastoralist [command] [options]\n\nCommands:\n  onboard                               Show first-run setup, agent, and GitHub Action guidance\n  init [config|agent-skill]             Initialize config or the Pastoralist agent skill\n  doctor                                Run a read-only setup and override health check\n\nOptions:\n  -v, --version                         Print the installed Pastoralist version\n  --debug                               Enable debug mode\n  --dry-run                             Preview changes without writing to package.json\n  --outputFormat <format>               Output format: text (default) or json\n  -p, --path <path>                     Specifies a path to a package.json (default: \"package.json\")\n  -d, --depPaths [paths...]             Specifies glob paths to package.jsons\n  --ignore [paths...]                   Specifies glob paths to ignore\n  -r, --root <root>                     Specifies a root path\n  -t, --isTestingCLI                    Enable CLI testing (no scripts run)\n  --isTesting                           Enable testing mode (no scripts run)\n  --init [type] [args...]               Initialize config or a named init target\n  --checkSecurity                       Check for security vulnerabilities and generate overrides\n  --forceSecurityRefactor               Automatically apply security overrides without prompting\n  --securityProvider <provider...>      Security provider(s) to use (osv, github, snyk, npm, socket, spektion)\n  --securityProviderToken <token>       Security provider token for API access\n  --interactive                         Run security checks in interactive mode\n  --hasWorkspaceSecurityChecks          Include workspace packages in security scan\n  --promptForReasons                    Prompt for reasons when adding manual overrides\n  --strict                              Fail on any security check errors (network failures, API errors)\n  --summary                             Show summary metrics table after run\n  --onboard, --onboarding               Show first-run onboarding guidance\n  -q, --quiet                           Quiet mode for CI (exit 1 if vulnerabilities, 0 if clean)\n  --setup-hook                          Add postinstall script to run pastoralist automatically\n  --remove-unused                       Remove unused overrides from package.json\n  --cache-dir <path>                    Cache directory (default: node_modules/.cache/pastoralist/)\n  --cache-ttl <seconds>                 Override cache TTL in seconds\n  --no-cache                            Bypass cache reads and writes\n  --refresh-cache                       Bypass cache reads, force refresh (still writes)\n";
+export declare const HELP_TEXT = "\nPastoralist - A utility CLI to manage your dependency overrides\n\nUsage: pastoralist [command] [options]\n\nCommands:\n  onboard                               Show first-run setup, agent, and GitHub Action guidance\n  init [config|agent-skill]             Initialize config or the Pastoralist agent skill\n  doctor                                Run a read-only setup and override health check\n\nOptions:\n  -v, --version                         Print the installed Pastoralist version\n  --debug                               Enable debug mode\n  --dry-run                             Preview changes without writing to package.json\n  --outputFormat <format>               Output format: text (default) or json\n  -p, --path <path>                     Specifies a path to a package.json (default: \"package.json\")\n  -d, --depPaths [paths...]             Specifies glob paths to package.jsons\n  --ignore [paths...]                   Specifies glob paths to ignore\n  -r, --root <root>                     Specifies a root path\n  -t, --isTestingCLI                    Enable CLI testing (no scripts run)\n  --isTesting                           Enable testing mode (no scripts run)\n  --init [type] [args...]               Initialize config or a named init target\n  --checkSecurity                       Check for security vulnerabilities and generate overrides\n  --forceSecurityRefactor               Automatically apply security overrides without prompting\n  --securityProvider <provider...>      Security provider(s) to use (osv, github, snyk, npm, socket, spektion)\n  --securityProviderToken <token>       Security provider token for API access\n  --interactive                         Run security checks in interactive mode\n  --hasWorkspaceSecurityChecks          Include workspace packages in security scan\n  --promptForReasons                    Prompt for reasons when adding manual overrides\n  --strict                              Fail on any security check errors (network failures, API errors)\n  --summary                             Show summary metrics table after run\n  --styleguide                          Render the Pastoralist DX component styleguide\n  --onboard, --onboarding               Show first-run onboarding guidance\n  -q, --quiet                           Quiet mode for CI (exit 1 if vulnerabilities, 0 if clean)\n  --setup-hook                          Add postinstall script to run pastoralist automatically\n  --remove-unused                       Remove unused overrides from package.json\n  --cache-dir <path>                    Cache directory (default: node_modules/.cache/pastoralist/)\n  --cache-ttl <seconds>                 Override cache TTL in seconds\n  --no-cache                            Bypass cache reads and writes\n  --refresh-cache                       Bypass cache reads, force refresh (still writes)\n";
 export declare const ARGS_START_INDEX = 2;

package/dist/cli/prompts/index.d.ts

@@ -13,6 +13,8 @@ export declare class Prompt {
     prompt(options: PromptOptions): Promise<string | boolean>;
     promptMany(questions: PromptOptions[]): Promise<Record<string, string | boolean>>;
 }
+export declare const promptSelect: (message: string, choices: PromptChoice[]) => Promise<string>;
+export declare const promptCheckbox: (message: string, choices: PromptChoice[], required?: boolean) => Promise<string[]>;
 export declare function createPrompt<T = unknown>(callback: (prompt: Prompt) => Promise<T>): Promise<T>;
 export declare function quickConfirm(message: string, defaultValue?: boolean): Promise<boolean>;
 export declare function quickInput(message: string, defaultValue?: string): Promise<string>;

package/dist/cli/prompts/types.d.ts

@@ -1,6 +1,9 @@
 export interface PromptChoice {
     name: string;
     value: string;
+    description?: string;
+    checked?: boolean;
+    disabled?: boolean | string;
 }
 export interface InputOptions {
     type?: "input";

package/dist/cli/styleguide.d.ts

@@ -0,0 +1,11 @@
+import type { Output } from "../dx";
+import type { PromptChoice } from "./prompts/types";
+export type StyleguidePrompts = {
+    select: (message: string, choices: PromptChoice[]) => Promise<string>;
+    checkbox: (message: string, choices: PromptChoice[]) => Promise<string[]>;
+    confirm: (message: string, defaultValue?: boolean) => Promise<boolean>;
+    input: (message: string, defaultValue?: string) => Promise<string>;
+    list: (message: string, choices: PromptChoice[]) => Promise<string>;
+};
+export declare const formatStyleguide: () => string;
+export declare const showStyleguide: (out?: Output, prompts?: StyleguidePrompts) => Promise<void>;

package/dist/cli/types.d.ts

@@ -93,4 +93,5 @@ export type RunDeps = {
     action: CliAction;
     showOnboarding: typeof showOnboarding;
     setupAgentSkill: (options: Options, args?: readonly string[]) => Promise<void> | void;
+    styleguide?: () => Promise<void> | void;
 };

package/dist/cli-fpqli-oN.js

@@ -0,0 +1,59 @@
+import{At as e,B as t,Bt as n,Ct as r,Dt as i,Et as a,Ft as o,H as s,Ht as c,It as l,Lt as u,M as d,Mt as f,Nt as p,Ot as m,P as ee,Pt as te,R as ne,Rt as h,St as g,Tt as re,U as ie,V as ae,Vt as oe,W as se,X as ce,Z as le,_ as ue,_t as _,a as de,at as fe,bt as pe,c as me,ct as v,d as he,dt as ge,ft as _e,g as ve,gt as ye,h as be,ht as xe,jt as Se,kt as y,l as Ce,lt as we,m as Te,mt as Ee,o as De,ot as Oe,p as ke,pt as Ae,st as b,t as je,tt as Me,u as Ne,ut as Pe,v as x,vt as S,wt as C,xt as Fe,y as Ie,yt as Le,zt as w}from"./security-DHkg09kQ.js";import{dirname as Re,resolve as T}from"node:path";import*as ze from"fs";import{existsSync as E,readFileSync as Be,writeFileSync as Ve}from"fs";import{dirname as He,resolve as D}from"path";import{fileURLToPath as Ue}from"url";import{spawnSync as We}from"child_process";import*as O from"readline";const Ge=[{flags:[`-h`,`--help`],hasValue:!1},{flags:[`-v`,`--version`],hasValue:!1},{flags:[`--debug`],hasValue:!1},{flags:[`--dry-run`],hasValue:!1},{flags:[`--outputFormat`],hasValue:!0,defaultValue:`text`},{flags:[`-p`,`--path`],hasValue:!0,defaultValue:`package.json`},{flags:[`-d`,`--depPaths`],hasValue:!0,isArray:!0},{flags:[`--ignore`],hasValue:!0,isArray:!0},{flags:[`-r`,`--root`],hasValue:!0},{flags:[`-t`,`--isTestingCLI`],hasValue:!1},{flags:[`--isTesting`],hasValue:!1},{flags:[`--init`],hasValue:!0,isArray:!0,emptyValue:!0},{flags:[`--checkSecurity`],hasValue:!1},{flags:[`--forceSecurityRefactor`],hasValue:!1},{flags:[`--securityProvider`],hasValue:!0,isArray:!0},{flags:[`--securityProviderToken`],hasValue:!0},{flags:[`--interactive`],hasValue:!1},{flags:[`--hasWorkspaceSecurityChecks`],hasValue:!1},{flags:[`--promptForReasons`],hasValue:!1},{flags:[`--strict`],hasValue:!1},{flags:[`--summary`],hasValue:!1},{flags:[`--styleguide`],hasValue:!1},{flags:[`--onboard`,`--onboarding`],hasValue:!1},{flags:[`-q`,`--quiet`],hasValue:!1},{flags:[`--setup-hook`],hasValue:!1},{flags:[`--remove-unused`],hasValue:!1},{flags:[`--cache-dir`],hasValue:!0},{flags:[`--cache-ttl`],hasValue:!0},{flags:[`--no-cache`],hasValue:!1},{flags:[`--refresh-cache`],hasValue:!1}],Ke=e=>Ge.find(t=>t.flags.includes(e)),qe=e=>(e.flags.find(e=>e.startsWith(`--`))||e.flags[0]).replace(/^--?/,``).replace(/-([a-z])/g,(e,t)=>t.toUpperCase()),Je=e=>{let t=e.indexOf(`=`);return t>-1?{flag:e.slice(0,t),value:e.slice(t+1)}:{flag:e}},Ye=e=>e.startsWith(`-`),Xe=(e,t)=>{let n=e.slice(t+1),r=n.findIndex(Ye);return r===-1?n:n.slice(0,r)},Ze=(e,t)=>{let n=Xe(e,t);return n.length>0?{value:n,consumed:n.length}:{value:void 0,consumed:0}},Qe=(e,t)=>{let n=e[t+1];return n&&!Ye(n)?{value:n,consumed:1}:{value:void 0,consumed:0}},$e=(e,t,n)=>n.isArray?Ze(e,t):Qe(e,t),et=(e,t)=>{let n=t.emptyValue!==void 0;if(e!==void 0)return e;if(n)return t.emptyValue},tt=e=>Ge.reduce((e,t)=>{let n=qe(t);return e[n]===void 0&&t.defaultValue!==void 0?Object.assign({},e,{[n]:t.defaultValue}):e},e),k=(e,t,n=t.options,r=t.command,i=t.commandArgs)=>({nextIndex:e,options:n,command:r,commandArgs:i}),A=(e,t,n)=>Object.assign({},e.options,{[t]:n}),nt=(e,t,n)=>{if(!n.command)return k(t+1,n,n.options,e,n.commandArgs);let r=n.commandArgs.concat(e);return k(t+1,n,n.options,n.command,r)},rt=(e,t,n,r,i)=>{if(n.hasValue)return k(r+1,i,A(i,e,t));if(t===`true`)return it(e,r,i);if(t===`false`)return k(r+1,i,A(i,e,!1));throw Error(`Boolean option ${e} requires true or false`)},it=(e,t,n)=>k(t+1,n,A(n,e,!0)),at=(e,t,n,r,i)=>{let{value:a,consumed:o}=$e(e,t,i),s=t+o+1,c=et(a,i);if(c===void 0)throw Error(`Option ${r} requires a value`);return k(s,n,A(n,r,c))},ot=(e,t,n)=>{let r=e[t];if(!Ye(r))return nt(r,t,n);let{flag:i,value:a}=Je(r),o=Ke(i);if(!o)throw Error(`Unknown option: ${i}`);let s=qe(o);return a===void 0?o.hasValue?at(e,t,n,s,o):it(s,t,n):rt(s,a,o,t,n)},st=(e,t,n)=>{if(t>=e.length)return n;let r=ot(e,t,n),i={options:r.options,command:r.command,commandArgs:r.commandArgs};return st(e,r.nextIndex,i)},ct=e=>{let t=e.slice(2),n=st(t,0,{options:{},command:void 0,commandArgs:[]}),r=tt(n.options);return{command:n.command,commandArgs:n.commandArgs,options:r}},lt=e=>{e(`
+Pastoralist - A utility CLI to manage your dependency overrides
+
+Usage: pastoralist [command] [options]
+
+Commands:
+  onboard                               Show first-run setup, agent, and GitHub Action guidance
+  init [config|agent-skill]             Initialize config or the Pastoralist agent skill
+  doctor                                Run a read-only setup and override health check
+
+Options:
+  -v, --version                         Print the installed Pastoralist version
+  --debug                               Enable debug mode
+  --dry-run                             Preview changes without writing to package.json
+  --outputFormat <format>               Output format: text (default) or json
+  -p, --path <path>                     Specifies a path to a package.json (default: "package.json")
+  -d, --depPaths [paths...]             Specifies glob paths to package.jsons
+  --ignore [paths...]                   Specifies glob paths to ignore
+  -r, --root <root>                     Specifies a root path
+  -t, --isTestingCLI                    Enable CLI testing (no scripts run)
+  --isTesting                           Enable testing mode (no scripts run)
+  --init [type] [args...]               Initialize config or a named init target
+  --checkSecurity                       Check for security vulnerabilities and generate overrides
+  --forceSecurityRefactor               Automatically apply security overrides without prompting
+  --securityProvider <provider...>      Security provider(s) to use (osv, github, snyk, npm, socket, spektion)
+  --securityProviderToken <token>       Security provider token for API access
+  --interactive                         Run security checks in interactive mode
+  --hasWorkspaceSecurityChecks          Include workspace packages in security scan
+  --promptForReasons                    Prompt for reasons when adding manual overrides
+  --strict                              Fail on any security check errors (network failures, API errors)
+  --summary                             Show summary metrics table after run
+  --styleguide                          Render the Pastoralist DX component styleguide
+  --onboard, --onboarding               Show first-run onboarding guidance
+  -q, --quiet                           Quiet mode for CI (exit 1 if vulnerabilities, 0 if clean)
+  --setup-hook                          Add postinstall script to run pastoralist automatically
+  --remove-unused                       Remove unused overrides from package.json
+  --cache-dir <path>                    Cache directory (default: node_modules/.cache/pastoralist/)
+  --cache-ttl <seconds>                 Override cache TTL in seconds
+  --no-cache                            Bypass cache reads and writes
+  --refresh-cache                       Bypass cache reads, force refresh (still writes)
+`)},ut={green:y,yellow:f,red:Se,cyan:C,gray:m},dt=(e,t)=>{let n=Math.max(0,t-_(e));return e+` `.repeat(n)},ft=(e,t)=>{let n=Math.max(0,t-_(e));return` `.repeat(n)+e},pt=(e,t)=>`+-${`-`.repeat(e)}-+-${`-`.repeat(t)}-+`,mt=(e,t,n,r,i)=>{let a=ft(t,r),o=i?ut[i](a):a;return`| ${dt(e,n)} | ${o} |`},ht=(e,t,n)=>{let r=e.reduce((e,t)=>Math.max(e,_(t.label)),0),i=e.reduce((e,t)=>Math.max(e,_(String(t.value))),0);return{labelWidth:Math.max(t,r),valueWidth:Math.max(n,i)}},gt=(e,t,n)=>{let r=t+n+3;return`| ${dt(e,r)} |`},_t=(e,t={})=>{let{title:n,minLabelWidth:r=20,minValueWidth:i=10}=t,{labelWidth:a,valueWidth:o}=ht(e,r,i),s=pt(a,o),c=n?[s,gt(n,a,o),s]:[s],l=e.map(e=>mt(e.label,String(e.value),a,o,e.color));return c.concat(l,[s]).join(`
+`)},vt=(e,t,n,r=b)=>{let i=e[t];r.clearLine(),r.write(`${i} ${n}`)},j=e=>{let t=e.interval;return t!==null&&clearInterval(t),Object.assign({},e,{interval:null,isSpinning:!1})},yt=(e,t)=>Object.assign({},e,{text:t}),bt=e=>{let t=(e.frameIndex+1)%g.length;return Object.assign({},e,{frameIndex:t})},xt=(e,t=b)=>{let n=setInterval(()=>{vt(g,e.frameIndex,e.text,t),Object.assign(e,bt(e))},80);return Object.assign({},e,{interval:n,isSpinning:!0})},M=(e,t,n=b)=>{n.clearLine(),n.writeLine(`${e} ${t}`)},St=(e,t=b)=>{if(e.isSpinning)return N(e,t);t.hideCursor();let n=xt(e,t);return Object.assign(e,n),N(e,t)},Ct=(e,t=b)=>{if(!e.isSpinning)return N(e,t);let n=j(e);return Object.assign(e,n),t.clearLine(),t.showCursor(),N(e,t)},wt=(e,t,n=b)=>{let r=j(e);Object.assign(e,r);let i=t||e.text;return M(w.success,i,n),n.showCursor(),N(e,n)},Tt=(e,t,n=b)=>{let r=j(e);Object.assign(e,r);let i=t||e.text;return M(w.error,i,n),n.showCursor(),N(e,n)},Et=(e,t,n=b)=>{let r=j(e);Object.assign(e,r);let i=t||e.text;return M(w.info,i,n),n.showCursor(),N(e,n)},Dt=(e,t,n=b)=>{let r=j(e);Object.assign(e,r);let i=t||e.text;return M(w.warning,i,n),n.showCursor(),N(e,n)},Ot=(e,t,n=b)=>{let r=yt(e,t);return Object.assign(e,r),N(e,n)},N=(e,t=b)=>({start:()=>St(e,t),stop:()=>Ct(e,t),succeed:n=>wt(e,n,t),fail:n=>Tt(e,n,t),info:n=>Et(e,n,t),warn:n=>Dt(e,n,t),update:n=>Ot(e,n,t)}),P=(e,t=b)=>N({text:e,isSpinning:!1,frameIndex:0,interval:null},t),kt=(e,t,n)=>[Math.round(e[0]+(t[0]-e[0])*n),Math.round(e[1]+(t[1]-e[1])*n),Math.round(e[2]+(t[2]-e[2])*n)],F=(e,t)=>{let n=e.split(``),r=n.length;if(r===0)return``;let i=n.map((e,n)=>{if(e===` `)return e;let i=n/r,a=Math.abs(i-t),o=Math.min(a,1-a),s=Math.max(0,1-o/pe),[l,u,d]=kt(Le,Fe,s);return`${c(l,u,d)}${e}`});return l.BOLD+i.join(``)+l.RESET},At=(e,t)=>Array.from({length:t},()=>e).flat(),jt=(e,t,n,r,i)=>{n.clearLine(),n.write(`${r}${F(e,t)}${i}`)},Mt=(e,t,n,r)=>{t.clearLine(),t.writeLine(`${n}${F(e,0)}${r}`)},Nt=(e,t,n,r,i,a)=>new Promise(o=>{t.forEach((t,o)=>{setTimeout(()=>jt(e,t,r,i,a),o*n)});let s=t.length*n;setTimeout(()=>{Mt(e,r,i,a),o()},s)}),Pt=(e,t=50,n=b,r=``,i=``,a=process.stdout.isTTY??!1)=>{let o=a,s=Array.from({length:20},(e,t)=>t/20);if(o){let a=At(s,2);return Nt(e,a,t,n,r,i)}return n.writeLine(`${r}${F(e,0)}${i}`),Promise.resolve()},I={pipe:`│`,branch:`├──`,last:`└──`,indent:`   `},{BOLD:Ft,RESET:L,FG_RED:R,FG_WHITE:It}=l,z=e=>e!==void 0,Lt={write:()=>{},writeLine:()=>{},clearLine:()=>{},hideCursor:()=>{},showCursor:()=>{}},Rt=e=>e.quiet?Lt:e.out||b,zt=e=>{let t=e;return{get:()=>t,set:e=>{t=e}}},Bt=()=>({phase:`idle`,ancestors:[],spinner:{active:!1,frame:0,text:``,interval:null},progress:{current:0,total:0}}),B=e=>e.map(e=>e?`${I.pipe}${I.indent}`:`    `).join(``),Vt=e=>e?I.last:I.branch,Ht=(...e)=>e.filter(Boolean).join(` `),Ut=(e,t,...n)=>Ht(B(e)+Vt(t),...n),Wt=(e,t)=>{let n=e.get(),r=n.ancestors.concat(t);e.set(Object.assign({},n,{ancestors:r}))},Gt=e=>{let t=e.get(),n=t.ancestors.slice(0,-1);e.set(Object.assign({},t,{ancestors:n}))},Kt=(e,t)=>({line:(n,...r)=>{let{ancestors:i}=t.get();e.writeLine(Ut(i,n,...r))},open:(e=!0)=>Wt(t,e),close:()=>Gt(t),nested:(e,n)=>{Wt(t,!e);try{n()}finally{Gt(t)}}}),qt=(e,t)=>{let n=e.get(),r=Object.assign({},n.spinner,{frame:t});e.set(Object.assign({},n,{spinner:r}))},Jt=e=>{let t=(e.get().spinner.frame+1)%g.length;qt(e,t)},Yt=(e,t)=>setInterval(()=>{e(),t()},80),Xt=e=>{e!==null&&clearInterval(e)},Zt=(e,t)=>{let n=t.get(),r=g[n.spinner.frame],i=B(n.ancestors);e.clearLine(),e.write(`${i}${r} ${n.spinner.text}`)},Qt=(e,t,n)=>{let r=e.get(),i=Object.assign({},r.spinner,{active:!0,text:t,interval:n});e.set(Object.assign({},r,{spinner:i}))},$t=e=>{let t=e.get(),n=Object.assign({},t.spinner,{active:!1,interval:null});e.set(Object.assign({},t,{spinner:n}))},en=(e,t,n)=>r=>{e.hideCursor();let i=Yt(n,()=>Jt(t));Qt(t,r,i)},tn=(e,t)=>()=>{Xt(t.get().spinner.interval),$t(t),e.clearLine(),e.showCursor()},nn=e=>()=>e.get().spinner.active,rn=(e,t)=>{let n=()=>Zt(e,t);return{start:en(e,t,n),stop:tn(e,t),isActive:nn(t),render:n}},an=e=>t=>(e.stop(),t()),on=e=>(t,n,r)=>Pt(t,50,e,n,r),sn=e=>{let t=Rt(e),n=zt(Bt()),r=Kt(t,n),i=rn(t,n);return{out:t,state:n,tree:r,spinner:i,paused:an(i),completer:on(t)}},cn=()=>[``,`${h} ${y(`Pastoralist`)}`,``].join(`
+`),ln=(e,t,n)=>`${n} (${e}/${t})`,un=e=>`[${e.severity.toUpperCase()}] ${e.packageName}@${e.currentVersion}`,dn=e=>e?w.warning:w.error,fn=e=>{if(!(!e||e.length===0))return`CVE: ${e.join(`, `)}`},pn=(e,t)=>!e||!t?`No fix available`:`Fix: upgrade to ${t}`,mn=e=>{let t=fn(e.cves),n=pn(e.fixAvailable,e.patchedVersion);return[e.title,t,n,e.url].filter(z)},hn=e=>`${e.packageName}@${e.version}`,gn=(e,t)=>t?w.info:e?w.warning:w.success,_n=e=>{if(!(!e||e.length===0))return`Patches: ${e.join(`, `)}`},vn=e=>{let t=Object.keys(e??{}).length;if(t!==0)return`Used by: ${t} package${t===1?``:`s`}`},yn=e=>{if(e)return typeof e==`object`&&e.reason?`Kept: ${e.reason}`:`Kept by user`},bn=e=>{if(e)return`Potentially fixed in ${e}, maybe removable`},xn=(e,t)=>{if(t)return`${e}: ${t}`},Sn=(e,t)=>{if(t?.length)return`${e}: ${t.join(`, `)}`},Cn=e=>{if(e.type!==`project`)return[];let t=xn(`Pin`,e.pin),n=xn(`Patch`,e.patch),r=Sn(`Constraints`,e.constraints),i=Sn(`References`,e.references);return[e.summary,t,n,r,i].filter(z)},wn=e=>e?`optimal`:`bounded`,Tn=e=>{if(e.type!==`best-case`)return[];let t=wn(e.search.provenOptimal),n=e.search.evaluatedStates,r=`Decision: ${e.decisionId} (${t}, ${n} states)`,i=e.impact,a=`Impact: ${i.fixedVulnerabilities} fixed, ${i.introducedVulnerabilities} introduced, ${i.remainingVulnerabilities} remaining`;return[e.summary,r,a]},En=e=>e?typeof e==`string`?[e]:e.type===`project`?Cn(e):Tn(e):[],Dn=e=>{let t=fn(e.cves),n=_n(e.patches),r=vn(e.dependents),i=yn(e.keep),a=bn(e.potentiallyFixedIn),o=En(e.reason),s=[t,n,r,i,a].filter(z);return o.concat(s)},On=e=>`${e.packageName}@${e.toVersion}`,kn=e=>{if(!(!e||e.length===0))return`Blocks ${e.join(`, `)}`},An=e=>[`${e.fromVersion} → ${e.toVersion}`,kn(e.cves),e.reason].filter(z),jn=e=>`${e.packageName}@${e.version}`,V=(e,t,n)=>e===1?t:n,Mn=e=>{let t=V(e,`y`,`ies`);return`${w.CHECK} ${e} vulnerabilit${t} fixed`},Nn=e=>{let t=V(e,``,`s`);return`${w.CHECK} ${e} stale override${t} removed`},Pn=e=>{let t=V(e,``,`s`);return`${w.SHIELD} ${e} package${t} protected`},Fn=e=>[e.vulnerabilitiesFixed?Mn(e.vulnerabilitiesFixed):void 0,e.staleOverridesRemoved?Nn(e.staleOverridesRemoved):void 0,e.packagesProtected?Pn(e.packagesProtected):void 0].filter(z),In=e=>{let t=m(` . `);return[`${w.error} ${e.severityCritical} crit`,`${w.warning} ${e.severityHigh} high`,`${w.info} ${e.severityMedium} med`,`${w.check} ${e.severityLow} low`,`${w.arrow} ${e.overridesTracked} tracked`,`${w.skip} ${e.overridesRemoved} removed`,`${e.packagesScanned} scanned`].join(t)},Ln=(e,t)=>{let n=t.length-1;t.forEach((t,r)=>e.line(r===n,t))},Rn=(e,t,n)=>{n.length!==0&&e.nested(t,()=>Ln(e,n))},zn=(e,t)=>{let n=Object.keys(t),r=n.length-1;n.forEach((n,i)=>{e.line(i===r,`${n}: ${t[n]}`)})},Bn=(e,t,n)=>{Object.keys(t).length!==0&&(e.line(n,`Overrides`),e.nested(n,()=>zn(e,t)))},Vn=(e,t)=>{if(!t||t.length===0)return;let n=t.length-1;e.line(!0,`Changes`),e.nested(!0,()=>{t.forEach((t,r)=>{e.line(r===n,t)})})},Hn=e=>e%2==0?R:It,Un=e=>Array.from({length:e},(e,t)=>`${Hn(t)}-${L}`).join(``),Wn=e=>{let t=` `.repeat(2);return t+e+t},Gn=e=>`${R}|${L}${Ft}${It}${e}${L}${R}|${L}`,Kn=e=>{let t=_(e)+4,n=Un(t+2);return[n,Gn(Wn(e)),n]};var qn=class{completion=Promise.resolve();context;constructor(e){this.context=e}banner(){return this.context.paused(()=>this.context.out.writeLine(cn())),this}startPhase(e,t,n=!1){return this.context.paused(()=>{let r=this.context.state.get();this.context.state.set(Object.assign({},r,{phase:e})),this.context.tree.line(n,t),this.context.tree.open(!n)}),this}progress(e,t,n){let r=ln(e,t,n);return this.updateProgressState(e,t,r),e===1&&!this.context.spinner.isActive()&&this.context.spinner.start(r),this}item(e,t=!1){return this.context.paused(()=>this.context.tree.line(t,w.success,e)),this}vulnerability(e,t=!1){return this.context.paused(()=>{let n=dn(e.fixAvailable),r=un(e),i=mn(e);this.context.tree.line(t,n,r),this.context.tree.nested(t,()=>Ln(this.context.tree,i))}),this}override(e,t=!1){return this.context.paused(()=>{let n=gn(e.isSecurityFix,e.keep),r=hn(e),i=Dn(e);this.context.tree.line(t,n,r),Rn(this.context.tree,t,i)}),this}securityFix(e,t=!1){return this.context.paused(()=>{let n=On(e),r=An(e);this.context.tree.line(t,w.success,n),Rn(this.context.tree,t,r)}),this}removedOverride(e,t=!1){return this.context.paused(()=>{let n=jn(e);this.context.tree.line(t,w.info,n),this.context.tree.nested(t,()=>this.context.tree.line(!0,e.reason))}),this}endPhase(e){return this.context.paused(()=>{e&&this.context.tree.line(!0,w.success,e),this.context.tree.close()}),this}summary(e,t){return this.context.paused(()=>{let n=!!(t&&t.length>0);Bn(this.context.tree,e,!n),Vn(this.context.tree,t)}),this}executiveSummary(e){return this.context.paused(()=>{Fn(e).forEach(e=>this.context.out.writeLine(e))}),this}compactSummary(e){return this.context.paused(()=>{this.context.out.writeLine(In(e))}),this}complete(e,t=``){return this.completion=this.context.paused(()=>{let n=this.context.state.get();this.context.state.set(Object.assign({},n,{phase:`complete`,ancestors:[]}));let r=B([])+Vt(!0);return this.context.completer(e,r,t)}),this}waitForCompletion(){return this.completion}notice(e){return this.context.paused(()=>{let t=Kn(e);this.context.out.writeLine(``),t.forEach(e=>this.context.out.writeLine(e)),this.context.out.writeLine(``)}),this}stop(){return this.context.spinner.stop(),this}updateProgressState(e,t,n){let r=this.context.state.get(),i=Object.assign({},r.spinner,{text:n});this.context.state.set(Object.assign({},r,{spinner:i,progress:{current:e,total:t}}))}};const Jn=(e={})=>new qn(sn(e)),Yn=(e=S())=>Math.min(e-4,80),Xn=(e=S())=>Math.min(e-4,60),Zn=(e,t,n)=>t===0||t===n-1?f(e):e.replace(/^│/,f(`│`)).replace(/│$/,f(`│`)),H=e=>e.map((t,n)=>Zn(t,n,e.length)),Qn=(e,t)=>`  ${C(`${t+1}.`)} ${e.name}`;function $n(e,t=!0){let n=t?y(`●`):m(`○`),r=t?y(`Y`):`y`,i=t?`n`:y(`N`),a=y(t?`[enter for yes]`:`[enter for no]`);return`${n} ${e} (${r}/${i}) ${m(a)}: `}function er(e,t,n=S()){let r=[`${C(`?`)} ${e}`,``].concat(t.map(Qn)),i=v(r,{title:f(`Configuration`),padding:1,width:Yn(n)});return H(i).join(`
+`)}function tr(){return`\n${C(`▶`)} Enter your choice ${m(`(number)`)}: `}function nr(e,t){let n=C(`◆`);return t?`${n} ${e} ${m(`[enter for "${t}"]`)}: `:`${n} ${e}: `}function U(e,t,n=S()){let r=[`${C(`▶ Step ${e}:`)} ${t}`],i=v(r,{padding:1,width:Xn(n)});return`\n${H(i).join(`
+`)}\n`}function rr(e){return ge(m(`${w.info} ${e}`),3)}function ir(e){return`${y(w.CHECK)} ${e}`}function ar(e){return`${f(w.warning)} ${e}`}function or(e,t,n,r=S()){let i=n||y(`✓ ${e}`),a=t.map((e,t)=>`  ${C(`${t+1}.`)} ${e}`),o=[i,``].concat(a),s=v(o,{title:f(`Next Steps`),padding:2,width:Yn(r)});return H(s).join(`
+`)}let W=[],sr=0,cr=!1,lr=!1,G=[];const ur=()=>{cr=!0;let e=G;G=[],e.forEach(e=>e())},dr=()=>cr?Promise.resolve():new Promise(e=>{G=G.concat(e)});function fr(){if(lr||process.stdin.isTTY)return;lr=!0;let e=``;process.stdin.setEncoding(`utf8`),process.stdin.on(`data`,t=>{e+=t}),process.stdin.on(`end`,()=>{W=e.trim().split(`
+`),ur()})}function pr(){return!process.stdin.isTTY}async function mr(){pr()&&(fr(),await dr())}function hr(){if(!pr()||!cr)return null;if(sr<W.length){let e=W[sr];return sr+=1,e}return``}async function gr(e,t,n=(e=>e.trim())){return await mr(),new Promise(r=>{let i=hr();i===null?e.question(t,e=>{r(n(e))}):(console.log(`${t}${i}`),r(n(i)))})}var _r=class{rl;constructor(){this.rl=O.createInterface({input:process.stdin,output:process.stdout})}close(){this.rl.close()}ensureCookedMode(){process.stdin.isTTY&&process.stdin.setRawMode(!1)}input(e,t){return this.ensureCookedMode(),gr(this.rl,nr(e,t),e=>e.trim()||t||``)}confirm(e,t=!0){return this.ensureCookedMode(),gr(this.rl,$n(e,t),e=>{let n=e.trim().toLowerCase();return n===``?t:n===`y`||n===`yes`})}list(e,t){return console.log(er(e,t)),this.ensureCookedMode(),this.askForListChoice(t)}async askForListChoice(e,t=1){let n=await gr(this.rl,tr());return this.getListChoice(n,e)||(console.log(`Invalid choice. Please enter a number between 1 and `+e.length),t>=5?e[0]?.value??``:this.askForListChoice(e,t+1))}getListChoice(e,t){let n=parseInt(e.trim(),10),r=n<1,i=n>t.length;if(!(isNaN(n)||r||i))return t[n-1]?.value}prompt(e){let{type:t=`input`,message:n}=e;switch(t){case`confirm`:return this.confirm(n,e.default??!0);case`list`:return this.list(n,e.choices);default:return this.input(n,e.default??``)}}promptMany(e){return e.reduce(async(e,t,n)=>{let r=await e,i=`answer${n}`;return t.type,t.type,r[i]=await this.prompt(t),r},Promise.resolve({}))}};const K={BOLD:`\x1B[1m`,CYAN:`\x1B[36m`,GRAY:`\x1B[90m`,GREEN:`\x1B[32m`,RED:`\x1B[31m`,RESET:`\x1B[0m`,HIDE_CURSOR:`\x1B[?25l`,SHOW_CURSOR:`\x1B[?25h`},q=e=>e.disabled!==void 0&&e.disabled!==!1,vr=()=>!!process.stdin.isTTY&&!!process.stdout.isTTY,yr=e=>`${K.GRAY}${e}${K.RESET}`,br=(e,t)=>t?`${K.BOLD}${K.CYAN}${e}${K.RESET}`:e,xr=(e,t,n)=>q(e)?`─`:n===`radio`?t?`●`:`○`:t?`■`:`□`,Sr=(e,t,n,r)=>{let i=t===n.cursorIndex,a=n.selected[t]??!1;r===`radio`&&(a=i);let o=`${i?`›`:` `} ${xr(e,a,r)} `,s=e.description?` ${yr(`· ${e.description}`)}`:``,c=`${o}${e.name}${s}`;return q(e)?yr(c):br(c,i)},Cr=(e,t,n,r)=>Sr(e,n.viewportStart+t,n,r),wr=(e,t,n)=>{if(n===`radio`)return``;let r=e.filter((e,n)=>t.selected[n]).map(({name:e})=>e);return`Selected: ${r.length>0?r.join(`, `):`none`}`},Tr=(e,t,n)=>{let r=e.viewportStart>0,i=e.viewportStart+8<t,a=[r?`↑ more`:``,i?`↓ more`:``].filter(Boolean),o=n===`radio`?`↑/↓ navigate · Enter select · Esc cancel`:`↑/↓ navigate · Space toggle · a all · n none · Enter confirm · Esc cancel`,s=n===`radio`?``:`${e.selected.filter(Boolean).length} selected`;return yr(a.concat([o,s]).filter(Boolean).join(` · `))},Er=(e,t,n)=>{let r=Math.max(0,n-8);if(e<t)return e;if(e>=t+8){let t=e-8+1;return Math.min(r,t)}return t},Dr=(e,t,n,r)=>{let i=t.slice(n.viewportStart,n.viewportStart+8).map((e,t)=>Cr(e,t,n,r)),a=`${K.BOLD}${K.CYAN}?${K.RESET} ${e}`,o=wr(t,n,r);return[a].concat(i,[Tr(n,t.length,r)],o?[o]:[])},Or=(e,t,n=!1)=>(n&&process.stdout.write(`
+`),t>0&&O.moveCursor(process.stdout,0,-(t-1)),O.cursorTo(process.stdout,0),O.clearScreenDown(process.stdout),process.stdout.write(e.join(`
+`)),e.length),kr=e=>e.findIndex(e=>!q(e)),Ar=(e,t,n)=>{let r=e;for(let e=0;e<n.length;e+=1)if(r=(r+t+n.length)%n.length,!q(n[r]))return r;return e},jr=(e,t,n)=>{let r=Ar(e.cursorIndex,t,n),i=Er(r,e.viewportStart,n.length);return Object.assign({},e,{cursorIndex:r,viewportStart:i})},Mr=(e,t,n)=>{let r=e[t.cursorIndex],i=r!==void 0&&!q(r);return n===`radio`&&i?[r.value]:n===`radio`?[]:e.filter((e,n)=>t.selected[n]).map(({value:e})=>e)},Nr=()=>{let e=Error(`Prompt cancelled`);return e.name=`PromptCancelled`,e},Pr=(e,t)=>{let n=t.name===`escape`||e===`\x1B`,r=t.ctrl===!0&&t.name===`c`;return n||r},Fr=e=>e.name===`return`||e.name===`enter`,Ir=e=>e.name===`up`?-1:+(e.name===`down`),Lr=(e,t,n)=>t===n?!e:e,Rr=(e,t,n)=>{let r=t===` `,i=n[e.cursorIndex],a=i!==void 0&&!q(i);if(r&&a){let t=e.selected.map((t,n)=>Lr(t,n,e.cursorIndex));return Object.assign({},e,{selected:t})}let o=t?.toLowerCase()??``;return o===`a`?Object.assign({},e,{selected:n.map(e=>!q(e))}):o===`n`?Object.assign({},e,{selected:n.map(()=>!1)}):e},zr=(e,t,n)=>new Promise((r,i)=>{if(t.length===0){i(Error(`Prompt requires at least one choice`));return}let a=kr(t);if(!(a>=0)){r([]);return}let o={cursorIndex:a,selected:t.map(e=>e.checked===!0&&!q(e)),viewportStart:0},s=0,c=!1,l=()=>{process.stdin.off(`keypress`,f),process.stdin.off(`data`,p),typeof process.stdin.setRawMode==`function`&&process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(K.SHOW_CURSOR)},u=a=>{if(c)return;c=!0,l();let u=a?[`${K.BOLD}${K.RED}✗${K.RESET} ${e}: cancelled`]:[`${K.BOLD}${K.GREEN}✔${K.RESET} ${e}: ${Mr(t,o,n).join(`, `)||`none selected`}`];Or(u,s),process.stdout.write(`
+`),a?i(a):r(Mr(t,o,n))},d=()=>{s=Or(Dr(e,t,o,n),s,s===0)},f=(e,r={})=>{if(Pr(e,r))return u(Nr());if(Fr(r))return u();let i=Ir(r);if(i!==0){Object.assign(o,jr(o,i,t)),d();return}let a=e===` `,s=e?.toLowerCase()??``;n===`multi`&&a||[`a`,`n`].includes(s)&&(Object.assign(o,Rr(o,e,t)),d())},p=e=>{let r=n===`multi`,i=e.toString(`utf8`).includes(` `);r&&i&&(Object.assign(o,Rr(o,` `,t)),d())};try{let e=typeof process.stdin.setRawMode==`function`;if(!(vr()&&e)){i(Error(`Interactive prompt input is unavailable`));return}O.emitKeypressEvents(process.stdin),process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on(`keypress`,f),process.stdin.on(`data`,p),process.stdout.write(K.HIDE_CURSOR),d()}catch(e){l(),i(e)}}),Br=e=>new Promise(t=>{let n=O.createInterface({input:process.stdin,output:process.stdout});n.question(e,e=>{n.close(),t(e)})}),Vr=(e,t)=>e.split(`,`).map(e=>Number.parseInt(e.trim(),10)).filter(e=>Number.isInteger(e)&&e>=1&&e<=t.length).map(e=>t[e-1]).filter(e=>e!==void 0&&!q(e)).map(({value:e})=>e),Hr=async(e,t)=>{console.log(`\n${e}`),t.forEach((e,t)=>{let n=q(e)?` (${e.disabled})`:``;console.log(`  ${t+1}. ${e.name}${n}`)});let n=await Br(`
+Enter choices (comma-separated numbers): `);return Vr(n,t)},Ur=(e,t)=>vr()?zr(e,t,`multi`):Hr(e,t),Wr=async(e,t)=>vr()?(await zr(e,t,`radio`))[0]??``:(await Hr(e,t))[0]??``,Gr=async(e,t,n=!1)=>{let r=await Ur(e,t);if(n&&r.length===0)throw Error(`At least one choice must be selected`);return r};async function J(e){let t=new _r;try{return await e(t)}finally{t.close()}}function Kr(e,t=!0){return J(n=>n.confirm(e,t))}function qr(e,t){return J(n=>n.input(e,t??``))}function Jr(e,t){return J(n=>n.list(e,t))}const Yr=[{name:`In package.json (recommended for simple setups)`,value:`package.json`},{name:`In a separate config file (recommended for complex setups)`,value:`external`}],Xr=[{name:`.pastoralistrc.json (JSON format)`,value:`.pastoralistrc.json`},{name:`pastoralist.config.cjs (CommonJS module)`,value:`pastoralist.config.cjs`},{name:`pastoralist.config.js (JavaScript module)`,value:`pastoralist.config.js`},{name:`pastoralist.config.mjs (ESM module)`,value:`pastoralist.config.mjs`}],Zr=[{name:`Use "workspace" keyword (auto-detect from package.json)`,value:`workspace`},{name:`Specify custom paths`,value:`custom`}],Qr=[{name:`OSV (Open Source Vulnerabilities - free, recommended)`,value:`osv`},{name:`GitHub Advisory Database`,value:`github`},{name:`Snyk (requires token)`,value:`snyk`},{name:`Socket.dev (requires token)`,value:`socket`}],$r=[{name:`Low (all vulnerabilities)`,value:`low`},{name:`Medium (medium and above)`,value:`medium`},{name:`High (high and critical only)`,value:`high`},{name:`Critical (critical only)`,value:`critical`}],ei={default:`initialization wizard`,security:`security configuration wizard`,workspace:`workspace configuration wizard`},ti={required:!1,optional:!1},ni={github:{required:!1,optional:!0,envVar:`GITHUB_TOKEN`,createUrl:`https://github.com/settings/tokens/new?description=Pastoralist%20Security&scopes=repo`,scopes:[`repo`]},snyk:{required:!0,optional:!1,envVar:`SNYK_TOKEN`,createUrl:`https://app.snyk.io/account`},socket:{required:!0,optional:!1,envVar:`SOCKET_SECURITY_API_KEY`,createUrl:`https://socket.dev/dashboard/settings`}},Y={welcome:`This wizard will help you set up your Pastoralist configuration.`,skipInfo:`You can skip any step by selecting the skip option.`,existingConfigWarning:`Existing Pastoralist configuration detected. Do you want to overwrite it?`,existingFileWarning:e=>`${e} already exists. Overwrite?`,configNotSaved:`Configuration not saved. File preserved.`,configSaved:e=>`Configuration saved to ${e}`,initCancelled:`Initialization cancelled. Your existing configuration is preserved.`,initComplete:`▪▫▪ Pastoralist initialization complete! ▪▫▪`,packageJsonNotFound:`Error: package.json not found`,tokenEnvironmentInfo:e=>`Pastoralist reads this token from ${e} or --securityProviderToken. The init wizard will not write tokens to project config.`,tokenCreationInfo:(e,t)=>`To create a ${e} token, visit: ${t}`,tokenRequiredWarning:e=>`${e} requires a token to function. Security scanning will not work without it.`,workspacesDetected:e=>`Detected workspaces in package.json: ${e.join(`, `)}`,noWorkspacesDetected:`No workspaces detected in package.json.`,savingConfig:`Saving configuration...`,nextSteps:`Next Steps:`},ri={configLocation:`Step 1: Configuration Location`,workspace:`Step 2: Workspace Configuration`,security:`Step 3: Security Configuration`},X={configLocation:`Where would you like to store your Pastoralist configuration?`,configFormat:`Choose a config file format:`,setupWorkspaces:`Do you want to configure workspace dependencies?`,workspaceType:`How would you like to configure workspace dependencies?`,customWorkspacePaths:`Enter workspace paths (comma-separated glob patterns)`,setupSecurity:`Do you want to enable security vulnerability scanning?`,securityProvider:`Choose a security provider:`,hasToken:e=>`Have you configured a ${e} API token in your environment?`,securityInteractive:`Enable interactive mode for security fixes? (allows you to review/approve each fix)`,securityAutoFix:`Enable auto-fix mode? (automatically applies security overrides without prompting)`,severityThreshold:`What severity level should trigger alerts?`,hasWorkspaceSecurityChecks:`Scan workspace packages for vulnerabilities?`},ii=[{title:`Human quick start`,lines:[`1. Inspect the project without writing files:`,`   npx pastoralist doctor`,`2. Add Pastoralist and create config:`,`   npm install pastoralist --save-dev`,`   npx pastoralist init`,`3. Update the override appendix:`,`   npx pastoralist`,`4. Keep it current after installs:`,`   npx pastoralist --setup-hook`]},{title:`Agent quick setup`,lines:[`1. Install only the Pastoralist skill:`,`   npx pastoralist --init agent-skill`,`2. Preview local dev setup:`,`   pnpm run setup:local-dev -- --dry-run`,`3. Set up Codex with skills and hooks:`,`   pnpm run setup:local-dev -- --agent codex --skills all --hooks git,postinstall`,`4. Set up Claude with skills and hooks:`,`   pnpm run setup:local-dev -- --agent claude --skills all --hooks git,postinstall`]},{title:`Prompt for a setup agent`,lines:[`Set up Pastoralist in this repository.`,"Start with `npx pastoralist doctor` and inspect the current package manager setup.","Run `pnpm run setup:local-dev -- --dry-run` before writing files.",`Configure the Pastoralist skill, local agent config, GitHub Action, and postinstall hook only when appropriate.`,`Keep changes scoped to setup files, docs, and tests.`]},{title:`Prompt for a maintenance agent`,lines:[`Review this repository's Pastoralist setup.`,"Run `npx pastoralist --dry-run` and summarize stale overrides, security checks, and missing setup.","Do not remove overrides unless `npx pastoralist --remove-unused --dry-run` shows they are unused.",`If setup is missing, propose the smallest script, skill, hook, or GitHub Action change.`]},{title:`Agent setup loop`,lines:["1. Run `npx pastoralist doctor`.","2. Run `pnpm run setup:local-dev -- --dry-run`.",`3. Apply the smallest needed setup command.`,"4. Run `npx pastoralist --dry-run`.",`5. Report changed files and remaining manual steps.`]},{title:`GitHub Action setup`,lines:[`Create .github/workflows/pastoralist.yml:`,``,"```yaml",`name: Override Check`,`on: [pull_request]`,`jobs:`,`  pastoralist:`,`    runs-on: ubuntu-latest`,`    steps:`,`      - uses: actions/checkout@v7`,`      - uses: yowainwright/pastoralist@v1`,`        with:`,`          mode: check`,`          check-security: false`,"```"]},{title:`Useful commands`,lines:[`npx pastoralist --dry-run`,`npx pastoralist --summary`,`npx pastoralist --checkSecurity`,`npx pastoralist --remove-unused`]}],ai=e=>[e.title,``].concat(e.lines).join(`
+`),oi=()=>{let e=ii.map(ai);return[`Pastoralist onboarding`].concat(e).join(`
+
+`)};function si(e){return e.split(`,`).map(e=>e.trim()).filter(e=>e.length>0)}function ci(e){let t={};return e.setupWorkspaces&&(e.workspaceType===`workspace`&&(t.depPaths=`workspace`),e.workspaceType===`custom`&&e.customWorkspacePaths?.length&&(t.depPaths=e.customWorkspacePaths)),e.setupSecurity&&(t.checkSecurity=!0,t.security={enabled:!0,provider:e.securityProvider,interactive:e.securityInteractive,autoFix:e.securityAutoFix,severityThreshold:e.severityThreshold,hasWorkspaceSecurityChecks:e.hasWorkspaceSecurityChecks}),t}function li(e,t){return t.endsWith(`.json`)?JSON.stringify(e,null,2)+`
+`:t.endsWith(`.js`)||t.endsWith(`.cjs`)?`module.exports = ${JSON.stringify(e,null,2)};\n`:`export default ${JSON.stringify(e,null,2)};\n`}const ui=()=>{o({file:`init/index.ts`,isLogging:!1}).print(oi())};async function di(e,t,n){n.print(U(1,`Configuration Location`)),t.configLocation=await e.list(X.configLocation,Yr),t.configLocation===`external`&&(t.configFormat=await e.list(X.configFormat,Xr))}async function fi(e,t){t.workspaceType===`custom`&&(t.customWorkspacePaths=await bi(e))}async function pi(e,t,n,r){if(r.print(U(2,`Workspace Configuration`)),t.setupWorkspaces=await e.confirm(X.setupWorkspaces,!0),!t.setupWorkspaces)return;let i=Di(n),a=i.length>0;Oi(a,r),t.workspaceType=await Ci(e,a,i,r),await fi(e,t)}async function mi(e,t,n){n.print(U(3,`Security Configuration`)),t.setupSecurity=await e.confirm(X.setupSecurity,!0),t.setupSecurity&&await gi(e,t,n,{askWorkspaceSecurity:t.setupWorkspaces,selectProvider:!0})}async function hi(e,t,n){n.print(`\n${ri.security}`),t.setupSecurity=!0,await gi(e,t,n,{askWorkspaceSecurity:t.setupWorkspaces&&!t.hasWorkspaceSecurityChecks,selectProvider:!t.securityProvider})}async function gi(e,t,n,r){await _i(e,t,n,r.selectProvider),await vi(e,t),t.severityThreshold=await Si(e),await yi(e,t,r.askWorkspaceSecurity)}async function _i(e,t,n,r){r&&(t.securityProvider=await xi(e)),t.securityProvider&&await wi(e,t.securityProvider,n)}async function vi(e,t){t.securityInteractive=await e.confirm(X.securityInteractive,!0),!t.securityInteractive&&(t.securityAutoFix=await e.confirm(X.securityAutoFix,!1))}async function yi(e,t,n){n&&(t.hasWorkspaceSecurityChecks=await e.confirm(X.hasWorkspaceSecurityChecks,!0))}async function bi(e){return si(await e.input(X.customWorkspacePaths,`packages/*/package.json`))}async function xi(e){return await e.list(X.securityProvider,Qr)}async function Si(e){return await e.list(X.severityThreshold,$r)}async function Ci(e,t,n,r){return t?(r.print(`\n   ${Y.workspacesDetected(n)}`),await e.list(X.workspaceType,Zr)):`custom`}async function wi(e,t,n){let r=Ei(t);!r.required&&!r.optional||(Ti(t,r,n),!await e.confirm(X.hasToken(t),!1)&&r.required&&n.print(`\n   ${Y.tokenRequiredWarning(t)}`))}function Ti(e,t,n){t.createUrl&&n.print(`\n   ${Y.tokenCreationInfo(e,t.createUrl)}`),t.envVar&&n.print(`\n   ${Y.tokenEnvironmentInfo(t.envVar)}`)}function Ei(e){return ni[e]??ti}function Di(e){return ne(e?.workspaces)}function Oi(e,t){e||t.print(rr(Y.noWorkspacesDetected))}function ki(e,t,n,r,i=!1){if(!n){r.print(Y.packageJsonNotFound);return}n.pastoralist=e,i||Ve(t,JSON.stringify(n,null,2)+`
+`),r.print(Y.configSaved(t))}async function Ai(e,t,n,r,i,a=!1){let o=D(n,t);await ji(t,o,r,i)&&(Mi(e,t,o,a),i.print(Y.configSaved(o)))}async function ji(e,t,n,r){if(!E(t))return!0;let i=await n.confirm(Y.existingFileWarning(e),!1);return i||r.print(`\n${Y.configNotSaved}`),i}function Mi(e,t,n,r){r||Ve(n,li(e,t))}function Ni(e,t){let n=`Run ${y(`pastoralist`)} to check and update your dependencies`,r=`Check the documentation for advanced configuration options`,i=`Run ${y(`pastoralist --checkSecurity`)} to scan for security vulnerabilities`,a=e?[n,i,r]:[n,r],o=`Pastoralist initialization complete!`,s=F(o,0)+` ${h}`;t.print(or(o,a,s))}async function Pi(e,t,n){let r=await he(t,!1),i=d(n);return r||i?.pastoralist?e.confirm(Y.existingConfigWarning,!1):!0}async function Fi(e={}){let t=o({file:`init/index.ts`,isLogging:!0}),n=Bi(e);Wi(n,t),await J(async r=>{await Ii(r,e,n,t)})}async function Ii(e,t,n,r){if(!await Pi(e,n.root,n.path)){r.print(`\n${Y.initCancelled}`);return}let i=d(n.path),a=Vi(t,n);await Li(e,a,i,n,r),await zi(e,t,n,a,i,r),Ni(a.setupSecurity,r)}async function Li(e,t,n,r,i){if(await di(e,t,i),!r.hasFocusedContext){await pi(e,t,n,i),await mi(e,t,i);return}await Ri(e,t,n,r,i)}async function Ri(e,t,n,r,i){r.hasWorkspaceContext&&await pi(e,t,n,i),r.hasSecurityContext&&await hi(e,t,i)}async function zi(e,t,n,r,i,a){let o=ci(r);if(a.print(`\n${Y.savingConfig}\n`),r.configLocation===`package.json`&&ki(o,n.path,i,a,t.isTesting),r.configLocation===`external`){let i=r.configFormat;if(!i)return;await Ai(o,i,n.root,e,a,t.isTesting)}}function Bi(e){let t=!!(e.checkSecurity||e.securityProvider),n=!!e.hasWorkspaceSecurityChecks,r=e.root||process.cwd(),i=Ie(e.path||`package.json`,r);return{hasSecurityContext:t,hasWorkspaceContext:n,hasFocusedContext:t||n,root:r,path:i}}function Vi(e,t){let n={configLocation:`package.json`,setupSecurity:!1,setupWorkspaces:!1};return Hi(n,e,t),Ui(n,t),n}function Hi(e,t,n){n.hasSecurityContext&&(e.setupSecurity=!0,t.securityProvider&&(e.securityProvider=t.securityProvider))}function Ui(e,t){t.hasWorkspaceContext&&(e.setupWorkspaces=!0,e.hasWorkspaceSecurityChecks=!0)}function Wi(e,t){let n=Gi(e);t.print(`\n${u} ${n}\n`),!e.hasFocusedContext&&(t.print(`${Y.welcome}\n`),t.print(`${Y.skipInfo}\n`))}function Gi(e){return e.hasSecurityContext?ei.security:e.hasWorkspaceContext?ei.workspace:ei.default}const Ki=[{label:`Packages scanned`,key:`total`},{label:`Appendix entries updated`,key:`appendixEntriesUpdated`},{label:`Vulnerabilities blocked`,key:`vulnerabilitiesBlocked`},{label:`Overrides added`,key:`overridesAdded`},{label:`Overrides removed`,key:`overridesRemoved`},{label:`By severity:`,key:`severityHeader`},{label:`  Critical`,key:`severityCritical`},{label:`  High`,key:`severityHigh`},{label:`  Medium`,key:`severityMedium`},{label:`  Low`,key:`severityLow`},{label:`Write status`,key:`writeStatus`}],qi=(e,t,n)=>({packageName:e,version:t,reason:n?.ledger?.reason,dependents:n?.dependents,patches:n?.patches,isSecurityFix:n?.ledger?.securityChecked,cves:n?.ledger?.cves,keep:n?.ledger?.keep,potentiallyFixedIn:n?.ledger?.potentiallyFixedIn}),Ji=(e,t)=>{let n=t.finalOverrides[e];return typeof n==`string`?{pkg:e,version:n}:null},Yi=(e,t)=>{let n=`${e.pkg}@${e.version}`,r=t.finalAppendix[n];return qi(e.pkg,e.version,r)},Xi=(e,t)=>{Object.keys(t.finalOverrides).map(e=>Ji(e,t)).filter(e=>e!==null).map(e=>Yi(e,t)).forEach(t=>e.override(t,!1))},Zi=(e,t)=>{if(!t)return;let n=t.removableKeys.length,r=`Removal verification: vulnerabilities ${t.beforeAlertCount} -> ${t.afterAlertCount}, risk ${t.beforeRiskScore} -> ${t.afterRiskScore}`;if(e.notice(r),t.status===`safe`){e.notice(`${n} unused override${x(n)} approved for cleanup.`);return}if(t.status===`declined`){let n=t.blockedKeys.length;e.notice(`Cleanup of ${n} override${x(n)} declined by user.`);return}let i=t.blockedKeys.length,a=t.reason?` ${t.reason}`:``;e.notice(`${i} override${x(i)} kept after removal verification.${a}`)},Qi=e=>e===1?`y`:`ies`,$i=e=>{let t=e.title||e.description||`Vulnerability`;return{severity:e.severity||`unknown`,packageName:e.packageName,currentVersion:e.currentVersion||`?`,title:t,cves:e.cves,fixAvailable:e.fixAvailable,patchedVersion:e.patchedVersion,url:e.url}},ea=e=>({packageName:e.packageName,fromVersion:e.fromVersion||`?`,toVersion:e.toVersion,cves:e.cves,severity:e.severity,reason:e.reason}),ta=(e,t)=>e===0?`No vulnerabilities in ${t} packages`:`${e} vulnerabilit${Qi(e)} found`,na=(e,t)=>e.length>0&&!!(t.forceSecurityRefactor||t.interactive),ra=(e,t,n,r,i)=>{t.map($i).forEach(t=>{e.vulnerability(t,!1)}),e.endPhase(ta(t.length,i)),na(n,r)&&ia(e,n)},ia=(e,t)=>{e.startPhase(`resolving`,`Fixes applied`),t.map(ea).forEach(t=>{e.securityFix(t,!1)});let n=t.length;e.endPhase(`${n} override${x(n)} added`)},aa=e=>e===0?`No overrides to update`:`${e} override${x(e)} applied`,oa=(e,t,n,r)=>{e.startPhase(`writing`,`Updating overrides`,r),Xi(e,{finalOverrides:t.finalOverrides??{},finalAppendix:t.finalAppendix??{}}),e.endPhase(aa(n.overrideCount))},sa=(e,t)=>{if(t.length===0)return;e.startPhase(`writing`,`Cleaned up stale overrides`,!0),t.forEach(t=>{e.removedOverride({packageName:t.packageName,version:t.version,reason:`Override no longer needed`},!1)});let n=t.length;e.endPhase(`${n} stale override${x(n)} removed`)},ca=async(e,t,n,r)=>{let i=t.metrics;e.executiveSummary({vulnerabilitiesFixed:i?.vulnerabilitiesBlocked??0,staleOverridesRemoved:i?.removedOverridePackages?.length??0,packagesProtected:r}),e.compactSummary({severityCritical:i?.severityCritical??0,severityHigh:i?.severityHigh??0,severityMedium:i?.severityMedium??0,severityLow:i?.severityLow??0,overridesTracked:i?.appendixEntriesUpdated??0,overridesRemoved:i?.overridesRemoved??0,packagesScanned:i?.packagesScanned??0}),e.complete(`The herd is safe!`,` ${oe}`),await e.waitForCompletion()},la=(e,t)=>{t.updated&&e.notice(`Run an install to capture the updates!`)},ua=(e,t)=>{let n=t.skipRemovalKeys||[];if(n.length===0)return;let r=n.length;e.notice(`${r} override${x(r)} kept after verification - ${n.join(`, `)}`)},da=(e,t,n)=>{let r=s(t.finalAppendix??{});if(!(r.length>0&&!n.removeUnused))return;let i=r.length;e.notice(`${i} unused override${x(i)} detected. Run with --remove-unused to clean up.`)},fa=(e,t,n,r,i)=>{la(e,n),ua(e,r),da(e,t,i)},pa=async(e,t,n,r,i,a,o)=>{let s=t.metrics?.removedOverridePackages??[];oa(e,t,n,s.length===0),sa(e,s),await ca(e,t,r,i),fa(e,t,n,a,o)},ma=(e,t)=>{if(t===`total`)return e.packagesScanned;if(t===`severityHeader`)return``;if(t===`writeStatus`)return e.writeSuccess?`Success`:`Skipped`;let n=e[t];return typeof n==`boolean`?+!!n:n},ha=(e,t,n)=>{let r=(typeof t==`number`?t:0)>0;if(e===`severityCritical`&&r||e===`severityHigh`&&r)return`red`;if(e===`severityMedium`&&r)return`yellow`;if(e===`severityLow`&&r)return`gray`;if(e===`vulnerabilitiesBlocked`&&r)return`green`;if(e===`overridesAdded`&&r)return`cyan`;if(e===`writeStatus`&&n.writeSuccess)return`green`;if(e===`writeStatus`)return`yellow`},ga=(e,t)=>{let n=ma(e,t.key),r=ha(t.key,n,e);return{label:t.label,value:n,color:r}},_a=e=>{let t=e.metrics;if(!t)return;let n=Ki.map(e=>ga(t,e)),r=_t(n,{title:`${h} Pastoralist Summary`});console.log(`
+`+r)},va=`${h} ${a(`Pastoralist`)} is scanning overrides...`,ya=e=>Object.assign({},e.dependencies,e.devDependencies,e.peerDependencies),ba=e=>({low:1,medium:2,high:3,critical:4})[e?.toLowerCase()||``]||0,Z=e=>e.reduce((e,t)=>e+ba(t.severity),0),xa=e=>e.cves?.length?e.cves.slice().sort().join(`,`):e.title?e.title:e.description?e.description:e.vulnerableVersions||``,Sa=e=>`${e.packageName}@${e.currentVersion}:${xa(e)}`,Ca=(e,t)=>{let n=new Set(e.map(Sa));return t.map(Sa).filter(e=>!n.has(e))},wa=e=>e.path?e.root?T(e.root,e.path):T(e.path):T(e.root||`.`,`package.json`),Ta=(e,t)=>le({config:e,manifestPath:wa(t)}),Ea=(e,t,n)=>{let r=e.pastoralist?.appendix||{},i=new Set(t.skipRemovalKeys||[]),a=new Set(Object.keys(n.overrides));return s(r,ya(e)).filter(e=>!i.has(e)&&a.has(ae([e])[0]))},Da=(e,t,n)=>{let r=ae(t),i=ie(n.overrides,r);return n.kind===`yaml`?Me(e,i,`pnpm`):ce(e,n,i)},Oa=(e,t)=>{let n=e.pastoralist?.security,r=Object.assign({},t,{root:t.root||`./`});return n?.excludePackages&&(r.excludePackages=n.excludePackages),n?.severityThreshold&&(r.severityThreshold=n.severityThreshold),r},ka=async(e,t,n)=>{let r=Object.assign({},Oa(e,n),{interactive:!1,requireCompleteScan:!0,scanFullDependencyInventory:!n.isTesting});return(await t.checkSecurity(e,r)).alerts},Aa=(e,t,n)=>Object.assign({},Oa(e,t),{depPaths:[],interactive:!1,refreshCache:!0,requireCompleteScan:!0,root:n,scanFullDependencyInventory:!t.isTesting,skipCacheWrite:!0}),ja=(e,t,n)=>{let r=async r=>{let i=Aa(e,n,r);return(await t.checkSecurity(e,i)).alerts};return n.isTesting?r(n.root||`./`):ee(e,n,r)},Ma=(e,t)=>{let n=new Set(t.map(e=>e.packageName));return e.filter(e=>{let[t]=ae([e]);return n.has(t)})},Na=e=>Array.from(new Set(e)),Pa=(e,t,n)=>t.length>e.length||Z(t)>Z(e)||n.length>0,Fa=(e,t=3)=>{let n=e.slice(0,t).join(`, `),r=e.length-t;return r<=0?n:`${n} (+${r} more)`},Ia=(e,t,n,r,i,a)=>{if(i.length>0)return`New vulnerabilities detected after removal: ${Fa(i)}.`;if(r>n)return`Risk score increased from ${n} to ${r} after removal.`;if(t.length>e.length)return`Alert count increased from ${e.length} to ${t.length} after removal.`;if(a.length!==0)return`Removed overrides still resolve to vulnerable packages: ${Fa(a)}.`},La=(e,t,n)=>{let r=Ca(t,n),i=Z(t),a=Z(n),o=Pa(t,n,r)?e:[],s=Ma(e,n),c=Na(o.concat(s)),l=new Set(c),u=e.filter(e=>!l.has(e)),d=c.length>0?`blocked`:`safe`,f=Ia(t,n,i,a,r,s);return{removableKeys:e,allowedKeys:u,blockedKeys:c,beforeAlertCount:t.length,afterAlertCount:n.length,beforeRiskScore:i,afterRiskScore:a,newVulnerabilityKeys:r,status:d,reason:f}},Ra=(e,t,n)=>{let r=n instanceof Error?n.message:String(n),i=Z(t);return{removableKeys:e,allowedKeys:[],blockedKeys:e,beforeAlertCount:t.length,afterAlertCount:t.length,beforeRiskScore:i,afterRiskScore:i,newVulnerabilityKeys:[],status:`blocked`,reason:`Post-removal security scan failed: ${r}`}},za=(e,t,n)=>{let r=e.blockedKeys.concat(t),i={key:t,reason:n||`Removal could not be verified.`},a=e.blockedReasons.concat(i);return Object.assign({},e,{blockedKeys:r,blockedReasons:a})},Ba=async(e,t,n)=>{let r=t.allowedKeys.concat(n),i=Da(e.config,r,e.source);try{let a=await ja(i,e.securityChecker,e.options),o=La([n],t.afterAlerts,a);return o.blockedKeys.length>0?za(t,n,o.reason):Object.assign({},t,{allowedKeys:r,afterAlerts:a})}catch(e){let r=Ra([n],t.afterAlerts,e);return za(t,n,r.reason)}},Va=(e,t)=>{let n={allowedKeys:[],blockedKeys:[],afterAlerts:e.beforeAlerts,blockedReasons:[]};return t.reduce(async(t,n)=>Ba(e,await t,n),Promise.resolve(n))},Ha=e=>{if(e.length!==0)return e.length===1?e[0].reason:e.map(({key:e,reason:t})=>`${e}: ${t}`).join(` `)},Ua=(e,t,n)=>{let r=Z(t),i=Z(n.afterAlerts),a=Ca(t,n.afterAlerts),o=n.blockedKeys.length>0?`blocked`:`safe`,s=Ha(n.blockedReasons);return{removableKeys:e,allowedKeys:n.allowedKeys,blockedKeys:n.blockedKeys,beforeAlertCount:t.length,afterAlertCount:n.afterAlerts.length,beforeRiskScore:r,afterRiskScore:i,newVulnerabilityKeys:a,status:o,reason:s}},Wa=async(e,t,n)=>{let r=Ta(e,n),i=Ea(e,n,r);if(i.length===0)return;let a=await ka(e,t,n),o=await Va({config:e,source:r,securityChecker:t,options:n,beforeAlerts:a},i);return Ua(i,a,o)},Ga=o({file:`program.ts`,isLogging:!1}),Ka=e=>e.root?e.root:e.path?Re(T(e.path)):`./`,qa=e=>{if(e===void 0)return;let t=typeof e==`number`,n=typeof e==`string`&&e.trim()!==``,r=t||n?Number(e):NaN;if(Number.isFinite(r)&&r>=0)return r;throw Error(`--cache-ttl must be a non-negative number of seconds`)},Ja=(e,t,n,r)=>{let i=e.securityProvider??r??`osv`,a=qa(e.cacheTtl??t.cacheTtl),o=e.checkSecurity??n.enabled,s=e.forceSecurityRefactor??n.autoFix,c=e.securityProviderToken??n.securityProviderToken,l=e.interactive??n.interactive,u=e.hasWorkspaceSecurityChecks??n.hasWorkspaceSecurityChecks,d=e.strict??n.strict;return Object.assign({},t,{checkSecurity:o,forceSecurityRefactor:s,securityProvider:i,securityProviderToken:c,interactive:l,hasWorkspaceSecurityChecks:u,strict:d,cacheTtl:a})},Ya=e=>{let t=[[`cves`,e.cves?.length?e.cves:void 0],[`severity`,e.severity],[`description`,e.description],[`url`,e.url],[`vulnerableRange`,e.vulnerableRange],[`patchedVersion`,e.patchedVersion],[`sources`,e.sources]].filter(([,e])=>e!==void 0).reduce((e,[t,n])=>Object.assign({},e,{[t]:n}),{});return Object.assign({},{packageName:e.packageName,reason:e.ledgerReason??e.reason},t)},Xa=(e,t,n)=>new n({provider:e.securityProvider,forceRefactor:e.forceSecurityRefactor,interactive:e.interactive,token:e.securityProviderToken,debug:t,strict:e.strict,root:e.root,cacheDir:e.cacheDir,cacheTtl:e.cacheTtl,noCache:e.noCache,refreshCache:e.refreshCache}),Za=(e,t,n)=>new n({provider:e.securityProvider,forceRefactor:e.forceSecurityRefactor,interactive:e.interactive,token:e.securityProviderToken,debug:t,strict:e.strict,root:e.root,cacheTtl:e.cacheTtl}),Qa=(e,n,r=Ga)=>{let i=e?.pastoralist?.depPaths,a=n.checkSecurity||e?.pastoralist?.checkSecurity||!1;if($a(i,a))return r.debug(`Using depPaths configuration for security checks: ${i.join(`, `)}`,`determineSecurityScanPaths`),i;let o=t(e,n.root||`./`,r);return eo(i,o,a,n)?(r.debug(`Using workspace configuration for security checks: ${o.join(`, `)}`,`determineSecurityScanPaths`),o):[]},$a=(e,t)=>Array.isArray(e)&&t,eo=(e,t,n,r)=>to(e,t,n)||no(r,t.length>0),to=(e,t,n)=>e!==`workspace`&&e!==`workspaces`||t.length===0?!1:n,no=(e,t)=>(e.hasWorkspaceSecurityChecks||!1)&&t,ro=e=>t=>{e.update(t.message)},io=(e,t,n,r)=>Object.assign({},t,{depPaths:n,root:Ka(t),packageJsonPath:t.path,onProgress:ro(r),severityThreshold:e?.pastoralist?.security?.severityThreshold,excludePackages:e?.pastoralist?.security?.excludePackages}),ao=(e,t,n)=>({spinner:e,securityChecker:t,alerts:n.alerts,securityOverrides:n.overrides,updates:n.updates,packagesScanned:n.packagesScanned,bestCase:n.bestCase,userOwnedOverridesAdded:n.userOwnedOverridesAdded,skipped:!1}),oo=async(e,t,n,r,i,a)=>{let o=Xa(t,n,a.SecurityChecker),s=a.determineSecurityScanPaths(e,t,r),c=io(e,t,s,i),l=await o.checkSecurity(e,c);return ao(i,o,l)},so=async(e,t,n,r,i={createSpinner:P,SecurityChecker:je,determineSecurityScanPaths:Qa,green:y,yellow:f})=>{let a=i.createSpinner(va).start();try{return await oo(e,t,n,r,a,i)}catch(e){return co(e,a,t,n,i)}},co=(e,t,n,r,i)=>{if(e instanceof de)return t.warn(`${i.yellow(`pastoralist`)} ${e.message}`),{spinner:t,securityChecker:Za(n,r,i.SecurityChecker),alerts:[],securityOverrides:[],updates:[],packagesScanned:0,bestCase:void 0,userOwnedOverridesAdded:void 0,skipped:!0};let a=e instanceof Error?e.message:String(e);throw t.fail(`${i.yellow(`pastoralist`)} security check failed: ${a}`),e},lo=e=>({packageName:e.packageName,fromVersion:e.currentOverride,toVersion:e.newerVersion,reason:e.reason,severity:`medium`}),uo=(e,t)=>e.filter(e=>{let n=t[e.packageName];return typeof n==`string`&&n===e.toVersion}),fo=(e,t,n)=>{let r=t.generatePackageOverrides(e),i=uo(e,r),a=i.map(Ya);return i.length>0&&!n.dryRun&&t.applyAutoFix(i,n.path,n.config),{securityOverrides:r,securityOverrideDetails:a}},po=(e,t,n,r,i,a=[],o=!1)=>{let s=i.forceSecurityRefactor||i.interactive,c=e.length>0&&s,l=o?[]:a,u=l.length>0&&s;if(!c&&!u)return r.stop(),{};let d=l.map(lo),f=t.concat(d),p=fo(f,n,i);return r.stop(),p},mo=()=>({hasSecurityIssues:!1,securityAlertCount:0,securityAlerts:[]}),ho=e=>{if(e)return{selectedState:e.selectedState,decisionId:e.decisionId,policyHash:e.policyHash,search:e.search,impact:e.impact,failedStates:e.failedStates}},go=(e,t=5)=>{let n=e.slice(0,t).join(`, `),r=e.length-t;return r<=0?n:`${n}, +${r} more`},_o=e=>{let t=e.allowedKeys.length,n=go(e.allowedKeys);return`Removal verification check found ${e.beforeAlertCount} -> ${e.afterAlertCount} vulnerabilities. Remove ${t} unused ${`override${t===1?``:`s`}`} (${n})?`},vo=async(e,t,n,r)=>{if(!t.removeUnused)return t;let i=await Wa(e,n,t);if(!i)return t;let a=await yo(i,t,r),o=t.skipRemovalKeys||[],s=Array.from(new Set(o.concat(a.blockedKeys))),c=Object.assign({},t,{removalVerification:a});return s.length===0?c:Object.assign({},c,{skipRemovalKeys:s})},yo=async(e,t,n)=>{let r=t.interactive===!0,i=e.allowedKeys.length>0;return!(r&&i)||await n.quickConfirm(_o(e),!1)?e:Object.assign({},e,{status:`declined`,allowedKeys:[],blockedKeys:e.removableKeys,reason:`User declined cleanup after reviewing the removal verification.`})},bo=(e,t,n)=>{if(e.skipped)return t;let r=n.handleSecurityResults(e.alerts,e.securityOverrides,e.securityChecker,e.spinner,t,e.updates,!!e.bestCase);return Object.assign({},t,r)},xo=(e,t)=>{let n=e?.userOwnedOverrides??[],r=Array.from(new Set(n.concat(t)));return Object.assign({},e,{userOwnedOverrides:r})},So=(e,t)=>{if(!e)return;let n=e.pastoralist??{},r=xo(n.bestCase,t),i=Object.assign({},n,{bestCase:r});return Object.assign({},e,{pastoralist:i})},Co=(e,t)=>{if(!t?.length)return e;let n=xo(e.bestCase,t),r=So(e.config,t),i=So(e.manifestConfig,t);return Object.assign({},e,{bestCase:n,config:r,manifestConfig:i})},wo=e=>({mergedOptions:e,securityResult:mo(),packagesScanned:0,bestCase:void 0}),To=async(e,t,n,r)=>{let i=Co(t,n.userOwnedOverridesAdded),a=Object.assign({},i,{securityAlerts:n.alerts}),o=await vo(e,a,n.securityChecker,r);return bo(n,o,r)},Eo=(e,t,n,r)=>{t.skipped||r||(ra(e,t.alerts,t.securityOverrides,n,t.packagesScanned),Zi(e,n.removalVerification))},Do=async(e,t,n,r,i,a,o)=>{r||e.startPhase(`scanning`,`Scanning packages`);let s=await o.runSecurityCheck(t,n,i,a),c=ke(s.alerts),l=await To(t,n,s,o);Eo(e,s,l,r);let u=ho(s.bestCase);return{mergedOptions:l,securityResult:c,packagesScanned:s.packagesScanned,bestCase:u}},Oo=(e,t,n,r,i,a,o)=>n.checkSecurity?Do(e,t,n,r,i,a,o):wo(n),ko=(e,t,n)=>e?(t.debug(`action:options:`,`action`,{options:n}),!0):!1,Ao=e=>{if(e===!0||e===`config`)return!0;if(!Array.isArray(e))return!1;let[t]=e;return t===`config`},jo=async(e,t,n,r={initCommand:Fi})=>{if(!Ao(e))return!1;let i=Array.isArray(n.securityProvider)?n.securityProvider[0]:n.securityProvider;return await r.initCommand({path:t.path,root:t.root,checkSecurity:n.checkSecurity,securityProvider:i,hasWorkspaceSecurityChecks:n.hasWorkspaceSecurityChecks}),!0},Mo=(e,t)=>{let r=!!(n||e.debug),i=e.outputFormat===`json`,a=e.quiet===!0,o=t.createLogger({file:`program.ts`,isLogging:r}),s=t.createTerminalGraph({quiet:a}),c=be(),{isTestingCLI:l=!1,init:u=!1,...d}=e;return{emptyResult:c,graph:s,init:u,isJsonOutput:i,isLogging:r,isQuietMode:a,isTestingCLI:l,log:o,rest:d}},No=e=>{let t=te({cacheDir:e.cacheDir,root:e.root});p(t)},Po=e=>(ue(e.emptyResult,e.isJsonOutput),e.emptyResult),Fo=async(e,t,n)=>{if(t.handleTestMode(n.isTestingCLI,n.log,e)||await t.handleInitMode(n.init,e,n.rest))return Po(n)},Io=e=>{!e.isJsonOutput&&!e.isQuietMode&&e.graph.banner()},Lo=(e,t,n,r)=>Oo(r.graph,e.config,t,r.isJsonOutput,!!r.isLogging,r.log,n),Ro=(e,t)=>{let n=t.getLedgerAddedDate();return Object.assign({},e,{addedDate:n})},zo=(e,t,n,r)=>{let i=r.update(t);return{updateContext:i,updateResultData:Te(i,e,n.dryRun||!1)}},Bo=async(e,t,n)=>{let r=await me(e,n.rest,t),i=await Lo(r,r.mergedOptions,t,n),a=Ro(i.mergedOptions,t),o=zo(r.config,a,e,t);return Object.assign({},r,{mergedOptions:a,securityPhase:i},o)},Vo=(e,t)=>Object.assign({},e.emptyResult,t.securityPhase.securityResult,t.updateResultData,{removalVerification:t.mergedOptions.removalVerification,bestCase:t.securityPhase.bestCase,metrics:t.updateContext.metrics}),Ho=(e,t,n,r)=>(r.summary&&!n.isJsonOutput&&_a(e),ue(e,n.isJsonOutput),n.isQuietMode&&e.hasSecurityIssues&&t.processExit(1),e),Uo=async(e,t,n)=>{t.isJsonOutput||await pa(t.graph,e.updateContext,e.updateResultData,e.securityPhase.securityResult,e.securityPhase.packagesScanned,e.mergedOptions,n)},Wo=async(e,t,n)=>{let r=await Bo(e,t,n);return await Uo(r,n,e),Ho(Vo(n,r),t,n,e)},Go=(e,t,n)=>{n.graph.stop();let r=ve(e);return n.isJsonOutput?ue(r,n.isJsonOutput):n.log.fail(r.errors[0]||`Action failed`),t.processExit(1),r},Ko={createLogger:o,handleTestMode:ko,handleInitMode:jo,resolveJSON:d,buildMergedOptions:Ja,runSecurityCheck:so,handleSecurityResults:po,createSpinner:P,green:y,quickConfirm:Kr,update:De,createTerminalGraph:Jn,getLedgerAddedDate:se,loadConfig:Ce,loadConfigWithSource:Ne,processExit:e=>process.exit(e)};async function qo(e={},t=Ko){No(e);let n=Mo(e,t),r=await Fo(e,t,n);if(r)return r;Io(n);try{return await Wo(e,t,n)}catch(e){return Go(e,t,n)}}const Jo={readFileSync:ze.readFileSync,writeFileSync:ze.writeFileSync,resolve:D},Yo=(e,t)=>t.resolve(Ie(e.path||`package.json`,e.root)),Xo=(e,t)=>JSON.parse(t.readFileSync(e,`utf8`)),Zo=e=>e?`${e} && pastoralist`:`pastoralist`,Qo=e=>{let t=e.scripts||{},n=Object.assign({},t,{postinstall:Zo(t.postinstall||``)});return Object.assign({},e,{scripts:n})},$o=(e,t,n)=>{n.writeFileSync(e,JSON.stringify(t,null,2)+`
+`)},es=(e,t,n=Jo)=>{if(e.setupHook!==!0)return!1;try{let r=Yo(e,n),i=Xo(r,n);return(i.scripts?.postinstall||``).includes(`pastoralist`)?(t.print(`postinstall hook already configured`),!0):e.dryRun?(t.print(`[DRY RUN] would add postinstall hook to package.json`),!0):($o(r,Qo(i),n),t.print(`added postinstall hook to package.json`),!0)}catch(e){let n=e instanceof Error?e.message:String(e);return t.fail(`Failed to setup hook: ${n}`),process.exitCode=1,!0}},Q=(e,t)=>{e.writeLine(``),e.writeLine(C(`◆ ${t}`))},$=(e,t)=>{e.writeLine(t)},ts=t=>{Q(t,`Colors and links`),$(t,`  ${y(`green`)} ${Se(`red`)} ${f(`yellow`)} ${re(`gold`)}`),$(t,`  ${r(`copper`)} ${C(`cyan`)} ${m(`gray`)}`),$(t,`  ${i()}`),$(t,`  ${a(`green to tan`)}`),$(t,`  ${e(`https://jeffry.in/pastoralist`,`documentation link`)}`)},ns=(e,t=S())=>{let n=t-2;Q(e,`Formatting`),$(e,v([y(`Boxed content`),`Aligned with visible-width support`],{title:`Box`,width:n}).join(`
+`)),$(e,Pe(`─`,40)),$(e,xe(75)),$(e,ge(`Indented text`)),$(e,Ae(`Leading newline`)),$(e,_e(1,`Numbered item`));let r=C(`visible text`),i=we([{label:`Packages`,value:12},{label:`Security fixes`,value:3}]);$(e,`  terminal width: ${t}`),$(e,`  visible width: ${_(r)}`),$(e,`  padded: ${Ee(`left`,10)}`),$(e,`  truncated: ${ye(`long visible text`,12)}`),$(e,`  column widths: ${i.labelWidth}/${i.valueWidth}`)},rs=(e,t=S())=>{Q(e,`Prompts`),$(e,$n(`Apply the example fix`)),$(e,er(`Choose a package manager`,[{name:`npm`,value:`npm`},{name:`pnpm`,value:`pnpm`}],t)),$(e,tr()),$(e,nr(`Project name`,`pastoralist`)),$(e,U(1,`Configuration`,t)),$(e,rr(`Informational message`)),$(e,ir(`Successful message`)),$(e,ar(`Warning message`)),$(e,or(`Complete`,[`Inspect output`,`Keep building`],void 0,t))},is=e=>{Q(e,`Table`),$(e,_t([{label:`Packages scanned`,value:12,color:`cyan`},{label:`Security fixes`,value:3,color:`green`},{label:`Unused overrides`,value:1,color:`yellow`}],{title:`DX metrics`}))},as=e=>{Q(e,`Spinner`),P(`Loading dependency graph`,e).start().update(`Dependency graph loaded`).succeed(),P(`Example failure`,e).fail(),P(`Example information`,e).info(),P(`Example warning`,e).warn()},os=e=>{Q(e,`Shimmer`),$(e,`  ${F(`Shimmer frame`,.5)}`)},ss=async e=>{os(e),await Pt(`Animated shimmer`,30,e,`  `)},cs=e=>{Q(e,`Hint`),$(e,fe(`Hints can be rendered without changing the hint cache.`))},ls={severity:`high`,packageName:`demo-package`,currentVersion:`1.0.0`,title:`Example vulnerability`,cves:[`CVE-2026-0001`],fixAvailable:!0,patchedVersion:`1.0.1`,url:`https://osv.dev/`},us={packageName:`demo-package`,version:`1.0.1`,reason:`security`,dependents:{"styleguide-app":`demo-package@^1.0.0`},patches:[`1.0.0 -> 1.0.1`],isSecurityFix:!0,cves:[`CVE-2026-0001`]},ds={packageName:`demo-package`,fromVersion:`1.0.0`,toVersion:`1.0.1`,cves:[`CVE-2026-0001`],severity:`high`,reason:`Patched security release`},fs={packageName:`stale-package`,version:`1.0.0`,reason:`No longer required`},ps=e=>{e.startPhase(`scanning`,`Scanning dependencies`).progress(1,3,`package.json`).progress(3,3,`dependency tree`).item(`Dependency tree ready`).vulnerability(ls,!0).endPhase(`Scan complete`)},ms=e=>{e.startPhase(`resolving`,`Resolving overrides`).override(us).securityFix(ds).removedOverride(fs,!0).endPhase(`Resolution complete`)},hs=async e=>{let t=Jn({out:e});t.banner(),ps(t),ms(t),t.summary({"demo-package":`1.0.1`},[`Applied security fix`]).executiveSummary({vulnerabilitiesFixed:1,packagesProtected:1}).compactSummary({severityCritical:0,severityHigh:1,severityMedium:0,severityLow:0,overridesTracked:1,overridesRemoved:1,packagesScanned:12}).notice(`Terminal graph components are composable.`),t.stop().complete(`DX styleguide complete`),await t.waitForCompletion()},gs=async e=>{ts(e),ns(e),rs(e),is(e),as(e),await ss(e),cs(e),await hs(e)},_s=[{name:`Colors and links`,value:`colors`,description:`color and hyperlink helpers`},{name:`Formatting`,value:`formatting`,description:`boxes, dividers, and progress`},{name:`Interactive prompts`,value:`prompts`,description:`radio, checkbox, and input`},{name:`Tables`,value:`table`,description:`aligned metrics`},{name:`Spinners`,value:`spinner`,description:`success and status states`},{name:`Shimmer`,value:`shimmer`,description:`animated progress text`},{name:`Hints`,value:`hint`,description:`cached guidance rendering`},{name:`Terminal graph`,value:`graph`,description:`scan and resolution lifecycle`},{name:`Run all demos`,value:`all`,description:`render every non-interactive example`},{name:`Exit styleguide`,value:`exit`,description:`return to the shell`}],vs=[{name:`npm`,value:`npm`,description:`package manager available`},{name:`pnpm`,value:`pnpm`,description:`package manager available`,checked:!0},{name:`Yarn`,value:`yarn`,description:`package manager available`},{name:`Bun`,value:`bun`,description:`package manager available`,disabled:`not installed`}],ys=vs.filter(e=>!e.disabled),bs={select:Wr,checkbox:Gr,confirm:Kr,input:qr,list:Jr},xs=async(e,t)=>{Q(e,`Interactive prompts`);let n=await t.confirm(`Apply the example fix`,!0);$(e,m(`Confirmed: ${n?`yes`:`no`}`));let r=await t.input(`Project name`,`pastoralist`);$(e,m(`Input: ${r||`empty`}`));let i=await t.list(`Choose a package manager`,ys);$(e,m(`List: ${i||`none`}`));let a=await t.checkbox(`Choose package managers`,vs);$(e,m(`Selected: ${a.join(`, `)||`none`}`)),rs(e)},Ss=async(e,t,n)=>{if(e===`prompts`)return await xs(t,n);if(e===`all`)return await gs(t);if(e===`colors`)return ts(t);if(e===`formatting`)return ns(t);if(e===`table`)return is(t);if(e===`spinner`)return as(t);if(e===`shimmer`)return await ss(t);if(e===`hint`)return cs(t);if(e===`graph`)return await hs(t)},Cs=async(e=Oe(),t=bs)=>{$(e,`${i()} ${C(`DX styleguide`)}`),$(e,m(`A live tour of Pastoralist's terminal UI components.`));try{for(;;){let n=await t.select(`Choose a component demo`,_s);if(n===`exit`||(await Ss(n,e,t),!await t.confirm(`Return to the styleguide menu?`,!0)))return}}catch(t){if(!(t instanceof Error&&t.name===`PromptCancelled`))throw t;$(e,m(`Styleguide closed.`))}},ws=[`config`,`agent-skill`],Ts=[`doctor`,`init`,`onboard`,`onboarding`],Es=(e,t)=>{let n=e instanceof Error?e.message:String(e);t.fail(`Error: ${n}`),lt(t.print),process.exitCode=1},Ds=(e,t)=>{try{return ct(e)}catch(e){Es(e,t);return}},Os=(e,t)=>!!(t.help||e.includes(`-h`)||e.includes(`--help`)),ks=(e,t)=>!!(t.version||e.includes(`-v`)||e.includes(`--version`)),As=e=>!e||Ts.some(t=>t===e),js=e=>e===`onboard`||e===`onboarding`,Ms=(e,t)=>t.onboard===!0||js(e),Ns=e=>ws.includes(e),Ps=e=>e===!0?[]:typeof e==`string`?[e]:Array.isArray(e)?e:[],Fs=e=>{let[t,...n]=e;if(!t)return{type:`config`,args:[]};if(Ns(t))return{type:t,args:n};throw Error(`Unknown init type: ${t}. Expected config or agent-skill.`)},Is=(e,t,n)=>Fs(e===`init`?t:Ps(n)),Ls=(e,t)=>e===`init`||t!==void 0&&t!==!1,Rs=e=>{if(!E(e))return;let t=JSON.parse(Be(e,`utf8`));if(typeof t.version==`string`)return t.version},zs=()=>He(Ue(import.meta.url)),Bs=()=>{let e=zs(),t=[D(e,`../package.json`),D(e,`../../package.json`)].map(Rs).find(e=>e!==void 0);if(!t)throw Error(`Unable to read package version`);return t},Vs=()=>{let e=zs(),t=[D(e,`scripts/setup/setup.sh`),D(e,`../scripts/setup/setup.sh`),D(e,`../../scripts/setup/setup.sh`)].find(E);if(!t)throw Error(`Unable to find scripts/setup/setup.sh`);return t},Hs=(e,t=[])=>{let n=Vs(),r=e.dryRun?[`--dry-run`]:[];return[n,`skill`].concat(r,t)},Us=e=>Array.isArray(e.securityProvider)?e.securityProvider[0]:e.securityProvider,Ws=async(e,t)=>{let n=Object.assign({},e,{securityProvider:Us(e)});await t.initCommand(n)},Gs=async(e,t,n)=>{let r=Object.assign({},e,{dryRun:!0,summary:!0});r.outputFormat!==`json`&&n(`Pastoralist doctor runs in dry-run mode and will not modify package.json.`),await t.action(r)},Ks=(e,t)=>!1,qs=(e,t=[])=>{if(Ks(e,t))return;let n=Hs(e,t),r=e.root||process.cwd(),i=We(`sh`,n,{cwd:r,stdio:`inherit`});if(i.error)throw i.error;i.status!==0&&(process.exitCode=i.status??1)},Js=e=>{let t=e[0];if(t)throw Error(`Unexpected init config argument: ${t}`)},Ys=async(e,t,n,r)=>{let i=Is(e,t,n.init);if(i.type===`agent-skill`){await r.setupAgentSkill(n,i.args);return}Js(i.args),await Ws(n,r)},Xs={initCommand:Fi,action:qo,showOnboarding:ui,setupAgentSkill:qs,styleguide:Cs},Zs=async(e=process.argv,t=Xs)=>{let n=o({file:`program.ts`,isLogging:!1}),r=Ds(e,n);if(!r)return;let i=r.options;if(Os(e,i)){lt(n.print);return}if(ks(e,i)){n.print(Bs());return}if(!As(r.command)){Es(Error(`Unknown command: ${r.command}`),n);return}if(i.styleguide){await(t.styleguide||Cs)();return}if(Ms(r.command,i)){t.showOnboarding();return}if(!es(i,n)){if(Ls(r.command,i.init)){try{await Ys(r.command,r.commandArgs,i,t)}catch(e){Es(e,n)}return}if(r.command===`doctor`)return Gs(i,t,n.print);await t.action(i)}};export{Zs as run};

package/dist/core/security/index.d.ts

@@ -49,6 +49,7 @@ export declare class SecurityChecker {
     private extractPackagesForScan;
     private resolveFullDependencyInventory;
     private resolveVersionScanPackages;
+    private resolveDeclaredVersionPackages;
     private resolveConfiguredPackageRoot;
     private resolvePackageRoot;
     private hasCompleteBestCaseInventory;
@@ -62,6 +63,7 @@ export declare class SecurityChecker {
     private logProviderAlerts;
     private fetchProviderAlerts;
     private createProviderRequests;
+    private fetchProviderPackages;
     private normalizeProviderResult;
     private resolveVulnerablePackages;
     private reportVulnerabilityAnalysis;

package/dist/dx/hint.d.ts

@@ -1,3 +1,4 @@
 import type { Output } from "./output";
 export declare function clearHintCache(): void;
+export declare const renderHint: (text: string, width?: number) => string;
 export declare function showHint(hintId: string, text: string, ttlMs?: number, out?: Output): void;

package/dist/dx/index.d.ts

@@ -7,6 +7,6 @@ export { hideCursor, showCursor, clearLine, renderFrame, stopInterval, updateSta
 export type { SpinnerState, Spinner, TerminalGraphState, TerminalGraph, TerminalPhase, } from "./types";
 export { shimmerFrame, playShimmer } from "./shimmer";
 export { createTerminalGraph } from "./terminal-graph";
-export { showHint, clearHintCache } from "./hint";
+export { showHint, renderHint, clearHintCache } from "./hint";
 export { green, red, yellow, gold, copper, cyan, gray, gradientPastoralist, gradientGreenTan, link, } from "./colors";
 export { formatConfirmPrompt, formatChoiceList, formatChoicePrompt, formatInputPrompt, formatStepHeader, formatInfo, formatSuccess, formatWarning, formatCompletion, } from "./prompts";

package/dist/dx/prompts.d.ts

@@ -1,10 +1,10 @@
 import type { PromptChoiceOption } from "./types";
 export declare function formatConfirmPrompt(message: string, defaultValue?: boolean): string;
-export declare function formatChoiceList(message: string, choices: PromptChoiceOption[]): string;
+export declare function formatChoiceList(message: string, choices: PromptChoiceOption[], terminalWidth?: number): string;
 export declare function formatChoicePrompt(): string;
 export declare function formatInputPrompt(message: string, defaultValue?: string): string;
-export declare function formatStepHeader(stepNumber: number, title: string): string;
+export declare function formatStepHeader(stepNumber: number, title: string, terminalWidth?: number): string;
 export declare function formatInfo(message: string): string;
 export declare function formatSuccess(message: string): string;
 export declare function formatWarning(message: string): string;
-export declare function formatCompletion(title: string, steps: string[], shimmerTitle?: string): string;
+export declare function formatCompletion(title: string, steps: string[], shimmerTitle?: string, terminalWidth?: number): string;

package/dist/index.js

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-import{$ as e,A as t,C as n,D as r,E as i,F as a,G as o,I as s,J as c,K as l,L as u,M as d,N as f,O as p,Q as m,S as h,St as g,T as _,X as v,Y as y,Z as b,b as x,d as S,et as C,f as w,i as T,it as E,j as D,k as O,l as k,n as A,nt as j,o as M,q as N,r as P,rt as F,s as I,t as L,tt as R,u as z,w as B,x as V,z as H}from"./security-C6XkraQc.js";import{realpathSync as U}from"fs";import{fileURLToPath as W}from"url";if(W(import.meta.url)===(e=>{if(!e)return``;try{return U(e)}catch{return``}})(process.argv[1])||process.argv[1]?.endsWith(`/pastoralist`)||process.argv[1]?.endsWith(`\\pastoralist`)){let{run:e}=await import(`./cli-GG9_l2eA.js`);await e(process.argv)}export{L as SecurityChecker,R as applyOverridesToConfig,v as applyOverridesToSourceConfig,B as attachPatchesToAppendix,a as checkMonorepoOverrides,s as cleanupUnusedOverrides,I as clearConfigCache,r as clearDependencyTreeCache,x as constructAppendix,P as createBestCaseReason,o as defineOverride,j as detectPackageManager,_ as detectPatches,p as findPackageJsonFiles,V as findRemovableAppendixItems,u as findUnusedOverrides,i as findUnusedPatches,O as forceClearCache,t as getCacheStats,F as getExistingOverrideField,E as getOverrideFieldForPackageManager,l as getOverridesByType,D as jsonCache,k as loadConfig,z as loadConfigWithSource,S as loadExternalConfig,g as logger,w as mergeConfigs,H as mergeOverridePaths,A as optimizeBestCasePortfolio,e as parsePnpmWorkspaceOverrides,h as processAndWritePackageJSON,T as resolveBestCasePolicy,d as resolveJSON,b as resolveOverrideSource,N as resolveOverrides,c as resolveOverridesFromSource,M as update,n as updateAppendix,y as updateOverrides,f as updatePackageJSON,C as updatePnpmWorkspaceOverrides,m as writeOverrideSource};
+import{$ as e,A as t,C as n,D as r,E as i,F as a,Ft as o,G as s,I as c,J as l,K as u,L as d,M as f,N as p,O as m,Q as h,S as g,T as _,X as v,Y as y,Z as b,b as x,d as S,et as C,f as w,i as T,it as E,j as D,k as O,l as k,n as A,nt as j,o as M,q as N,r as P,rt as F,s as I,t as L,tt as R,u as z,w as B,x as V,z as H}from"./security-DHkg09kQ.js";import{realpathSync as U}from"fs";import{fileURLToPath as W}from"url";if(W(import.meta.url)===(e=>{if(!e)return``;try{return U(e)}catch{return``}})(process.argv[1])||process.argv[1]?.endsWith(`/pastoralist`)||process.argv[1]?.endsWith(`\\pastoralist`)){let{run:e}=await import(`./cli-fpqli-oN.js`);await e(process.argv)}export{L as SecurityChecker,R as applyOverridesToConfig,v as applyOverridesToSourceConfig,B as attachPatchesToAppendix,a as checkMonorepoOverrides,c as cleanupUnusedOverrides,I as clearConfigCache,r as clearDependencyTreeCache,x as constructAppendix,P as createBestCaseReason,s as defineOverride,j as detectPackageManager,_ as detectPatches,m as findPackageJsonFiles,V as findRemovableAppendixItems,d as findUnusedOverrides,i as findUnusedPatches,O as forceClearCache,t as getCacheStats,F as getExistingOverrideField,E as getOverrideFieldForPackageManager,u as getOverridesByType,D as jsonCache,k as loadConfig,z as loadConfigWithSource,S as loadExternalConfig,o as logger,w as mergeConfigs,H as mergeOverridePaths,A as optimizeBestCasePortfolio,e as parsePnpmWorkspaceOverrides,g as processAndWritePackageJSON,T as resolveBestCasePolicy,f as resolveJSON,b as resolveOverrideSource,N as resolveOverrides,l as resolveOverridesFromSource,M as update,n as updateAppendix,y as updateOverrides,p as updatePackageJSON,C as updatePnpmWorkspaceOverrides,h as writeOverrideSource};