since-dev 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Since.dev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,126 @@
-# Temporary Holding Version
+# since-dev
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Find the code in a repository that is about to stop working: AI model IDs with a shutdown date, runtimes past end of life, dependencies with security advisories or breaking releases. Every finding comes with its file and line, its date, its replacement and its source.
+
+```bash
+npx since-dev
+```
+
+Run it inside any repository. A public GitHub repository needs no sign-in and no setup.
+
+```
+  acme/shop  main@4f2c1d9  scanned just now
+  3 with a date   1 undated   214 dependencies and 96 files read
+  Read from GitHub (main), not your working tree.
+
+  20 days   claude-sonnet-4-5-20250929 on Claude API: retirement 2026-11-30
+            src/ai/client.ts:14  and 3 more   use claude-sonnet-5-5
+            https://platform.claude.com/docs/en/about-claude/model-deprecations
+
+  31 days   gpt-5 on OpenAI API: retirement 2026-12-11
+            src/ai/summarize.ts:8   use gpt-5.6-sol
+            https://developers.openai.com/api/docs/deprecations
+
+  passed    Node.js 20: end of life 2026-04-30
+            .github/workflows/ci.yml   use 24
+            https://endoflife.date/nodejs
+
+  Full report   https://since.dev/scan/acme/shop?utm_source=cli
+  Next          npx since-dev init   your coding agent checks before it writes
+```
+
+(An example for a made-up repository. The dates are the real ones as of November 10, 2026.)
+
+## Run it
+
+| With | Command |
+| --- | --- |
+| Node 18 or newer | `npx since-dev` |
+| uv | `uvx since-dev` |
+| pipx | `pipx run since-dev` |
+
+To keep it, `npm install -g since-dev` or `pip install since-dev` gives you the command `since`. The npm and PyPI packages are the same CLI: no dependencies in either, and one set of tests holds both to the same output, character for character.
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `since` | Checks the repository you are in. It reads the `origin` remote to know which one. |
+| `since <owner/repo>` | Checks any public GitHub repository. A GitHub URL works too. |
+| `since init` | Sets up your coding agent to check before it writes. See below. |
+| `since calendar` | What ends in the next 30 days: model retirements, runtime end of life, API removals. `--within 90d`, `--provider openai`. |
+| `since changed <package>` | Breaking changes and deprecations of a package. `--since 4.19.2` lists only what changed after that version, `--ecosystem pypi` picks the registry. Needs a key. |
+| `since check` | The same check for CI: exit 1 when a finding fails. See below. |
+| `since login`, `since logout` | Sign in for private repositories, and remove the stored key. |
+
+`--all` shows every finding (10 by default), `--json` prints the answer as JSON, `--within 30d` keeps only dates within that many days.
+
+Findings are listed with the next deadline first, then dates that have passed, then security advisories with no date, then the ones marked `review`: Since found the name in your code but could not prove the change reaches it.
+
+## Set up your coding agent
+
+Coding agents write the model IDs and versions that were current when they were trained. This makes yours check first:
+
+```bash
+npx since-dev init
+```
+
+It writes four files into the repository:
+
+| File | For |
+| --- | --- |
+| `.mcp.json` | Claude Code |
+| `.cursor/mcp.json` | Cursor |
+| `.vscode/mcp.json` | VS Code |
+| `AGENTS.md` | A short rule, between two markers, that tells any agent when to check |
+
+Commit them and everyone who clones the repository gets the same setup. No key goes in any file: the first tool call opens a sign-in in the browser.
+
+It only ever adds its own `since` entry. Other servers in those files stay as they are, a second run changes nothing, and a file it cannot read as plain JSON is left alone with the lines to add by hand. `--dry-run` shows what it would write.
+
+## What it sends
+
+- **A public GitHub repository:** only its name. Since reads the default branch from GitHub, so uncommitted work and other branches are not in the answer. It is free: 10 scans a day per address, and a scan is kept for an hour.
+- **A private repository, after `since login`:** if the repository is connected to your Since workspace and your plan includes it, the answer comes from there. Otherwise the CLI sends the manifests it finds in the folder (`package.json`, `requirements*.txt`, `pyproject.toml`, `go.mod`, `Cargo.toml`, `Gemfile`, `composer.json`, `pom.xml`, `build.gradle`, `*.csproj`), 10 at most unless you raise `--max-files`. Source files are never sent. Each manifest is one call to the API, which uses credits.
+- `--local` checks the manifests in the folder even when the repository is public, for work you have not pushed.
+
+## In CI
+
+```yaml
+- run: npx since-dev check --fail-on high
+  env:
+    SINCE_DEV_KEY: ${{ secrets.SINCE_DEV_KEY }}
+```
+
+With a key it checks the manifests of the checkout. Without one it reads the default branch of a public repository from GitHub, and says so.
+
+| Exit code | Meaning |
+| --- | --- |
+| 0 | Nothing proven at or above `--fail-on` (`low`, `medium`, `high` by default, `critical`, or `none`). |
+| 1 | At least one finding fails. A finding marked `review` never fails a run. |
+| 2 | Something for you to fix: a refused key, a bad option, no manifests. |
+
+If Since cannot be reached, or the free scans for the day are used up, the run passes with a note. An outage on our side never fails your build.
+
+On GitHub Actions, [since-dev/check](https://github.com/since-dev/check) does the same with annotations on the files and a table in the run summary.
+
+## Sign in
+
+```bash
+since login
+```
+
+It asks for your email, prints a link, and waits while you approve it in the browser. The key is stored in `~/.config/since/credentials.json`, readable only by you. Setting `SINCE_DEV_KEY` works as well and wins over the stored key. `since logout` removes the stored key.
+
+## Develop
+
+```bash
+node --test test.mjs
+python3 -m unittest test_cli
+```
+
+Each file in `fixtures/` is one run: the arguments, the folder, and the answers the API gives. `expected/` holds what that run prints, requests and writes. Both test suites replay every fixture and compare with the same expected file. After a change to the Node side, `UPDATE_EXPECTED=1 node --test test.mjs` rewrites the expected files: read the diff, then make the Python side match.
+
+## License
+
+MIT. The data comes from [Since.dev](https://since.dev): the [calendar](https://since.dev/calendar) of what ends when, and the [API](https://since.dev/docs) behind this CLI.

package/bin/since.mjs

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import { run } from "../src/cli.mjs"
+import { realIo } from "../src/io.mjs"
+
+// Node 18 warns that fetch is experimental on its first call. It works, and the warning would land in the middle of the output.
+const emitWarning = process.emitWarning
+process.emitWarning = (warning, ...rest) => {
+  const type = rest[0] && typeof rest[0] === "object" ? rest[0].type : rest[0]
+  if (type === "ExperimentalWarning") return
+  emitWarning.call(process, warning, ...rest)
+}
+
+run(process.argv.slice(2), realIo()).then(
+  (code) => {
+    process.exitCode = code
+  },
+  (error) => {
+    process.stderr.write(`since: ${error && error.message ? error.message : error}\n`)
+    process.exitCode = 1
+  },
+)

package/package.json

@@ -1,6 +1,16 @@
 {
   "name": "since-dev",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Find the code in a repository that is about to stop working: retired model IDs, runtimes past end of life, breaking dependency changes. Each with its date, its line and its replacement.",
+  "license": "MIT",
+  "author": "Nabil A <support@since.dev>",
+  "homepage": "https://since.dev",
+  "repository": { "type": "git", "url": "git+https://github.com/Since-dev/cli.git" },
+  "bugs": { "url": "https://github.com/Since-dev/cli/issues" },
+  "keywords": ["deprecation", "end-of-life", "breaking-changes", "dependencies", "ai-models", "mcp", "cli", "continuous-maintenance"],
+  "type": "module",
+  "bin": { "since": "bin/since.mjs", "since-dev": "bin/since.mjs" },
+  "files": ["bin", "src", "README.md", "LICENSE"],
+  "engines": { "node": ">=18" },
+  "scripts": { "test": "node --test test.mjs" }
+}

package/src/cli.mjs

@@ -0,0 +1,526 @@
+// The whole CLI: run(argv, io) returns the exit code. Everything it touches (network, files, clock, terminal) comes in
+// through io, so the tests replay it from fixtures, and since_dev/cli.py prints the same text from the same fixtures.
+//
+// Exit codes: 0 done. `check`: 1 when a finding fails, 2 when the caller has something to fix, 0 when Since could not be
+// reached (an outage never fails a build). Every other command: 1 when it could not finish, 2 for a usage error.
+
+import { init } from "./init.mjs"
+import { MAX_CHARACTERS, checkBody, findManifests, parseRepo } from "./local.mjs"
+import * as text from "./render.mjs"
+
+export const VERSION = "0.1.0"
+const DEFAULT_API = "https://api.since.dev"
+const SITE = "https://since.dev"
+const APP = "https://app.since.dev"
+const COMMANDS = ["check", "calendar", "changed", "init", "login", "logout", "help", "version"]
+const SWITCHES = ["all", "json", "local", "dry-run", "no-color", "help", "version"]
+const OPTIONS = ["fail-on", "within", "provider", "ecosystem", "since", "email", "max-files"]
+const FAIL_ON = ["low", "medium", "high", "critical", "none"]
+const MAX_PAGES = 10
+const MAX_WAIT_MS = 60_000
+
+export function parseArgs(argv) {
+  const args = { command: null, positional: [], flags: {}, error: null }
+  for (let index = 0; index < argv.length; index++) {
+    const word = argv[index]
+    if (word === "-h") args.flags.help = true
+    else if (word === "-v") args.flags.version = true
+    else if (word.startsWith("--")) {
+      const equals = word.indexOf("=")
+      const name = equals < 0 ? word.slice(2) : word.slice(2, equals)
+      if (SWITCHES.includes(name) && equals < 0) args.flags[name] = true
+      else if (OPTIONS.includes(name)) {
+        const value = equals < 0 ? argv[++index] : word.slice(equals + 1)
+        if (value === undefined || value === "") {
+          args.error = `--${name} needs a value.`
+          return args
+        }
+        args.flags[name] = value
+      } else {
+        args.error = `Unknown option: ${word}`
+        return args
+      }
+    } else if (args.command === null && args.positional.length === 0 && COMMANDS.includes(word)) args.command = word
+    else args.positional.push(word)
+  }
+  return args
+}
+
+function help(p) {
+  const usage = [
+    ["", "check this repository (reads the origin remote)"],
+    [" <owner/repo>", "check a public GitHub repository"],
+    [" check", "the same for CI: exit 1 when a finding fails"],
+    [" calendar", "what ends in the next 30 days"],
+    [" changed <package>", "breaking changes and deprecations of a package"],
+    [" init", "set up your coding agent to check before it writes"],
+    [" login", "sign in, for private repositories"],
+    [" logout", "remove the stored key"],
+  ]
+  const options = [
+    ["--all", "show every finding"],
+    ["--json", "print the answer as JSON"],
+    ["--local", "check the manifests in this folder, not GitHub"],
+    ["--fail-on <level>", "check: low, medium, high (default), critical or none"],
+    ["--within <days>", "only dates within this many days, as 30d"],
+    ["--provider <name>", "calendar: one provider, as openai"],
+    ["--ecosystem <name>", "changed: the registry, as npm (default) or pypi"],
+    ["--since <version>", "changed: only what changed after this version"],
+    ["--email <address>", "login: the email to sign in with"],
+    ["--dry-run", "init: show what would be written"],
+    ["--max-files <n>", "how many manifests to check (default 10)"],
+    ["--no-color", "plain text"],
+  ]
+  const width = Math.max(...usage.map(([words]) => p.length + words.length)) + 3
+  const lines = [`since-dev ${VERSION}: what in this repository is about to stop working`, "", "Usage"]
+  for (const [words, what] of usage) lines.push(`  ${(p + words).padEnd(width)}${what}`)
+  lines.push("", "Options")
+  for (const [words, what] of options) lines.push(`  ${words.padEnd(21)}${what}`)
+  lines.push("", `Docs  ${SITE}/docs#cli`, "")
+  return lines.join("\n")
+}
+
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+const clamp = (value, low, high) => Math.min(high, Math.max(low, value))
+const wholeNumber = (value) => (typeof value === "number" && Number.isFinite(value) ? Math.trunc(value) : null)
+
+function readJson(content) {
+  if (content === null) return null
+  try {
+    const data = JSON.parse(content)
+    return isObject(data) ? data : null
+  } catch {
+    return null
+  }
+}
+
+function credentialsPath(io) {
+  if (io.platform === "win32" && io.env.APPDATA) return `${io.env.APPDATA}\\since\\credentials.json`
+  return `${io.env.XDG_CONFIG_HOME || `${io.home}/.config`}/since/credentials.json`
+}
+
+/** The key to call with: SINCE_DEV_KEY, or the one `login` stored. A stored key only ever goes to the API it came from. */
+function readKey(io, api) {
+  const fromEnv = String(io.env.SINCE_DEV_KEY ?? "").trim()
+  if (fromEnv) return { value: fromEnv, source: "env" }
+  const stored = readJson(io.readFile(credentialsPath(io)))
+  if (stored && typeof stored.api_key === "string" && stored.api_key && (stored.api || DEFAULT_API) === api) {
+    return { value: stored.api_key, source: "file" }
+  }
+  return null
+}
+
+function encodeQuery(query) {
+  return Object.entries(query)
+    .filter(([, value]) => value !== undefined && value !== null && value !== "")
+    .map(([name, value]) => `${name}=${encodeURIComponent(String(value))}`)
+    .join("&")
+}
+
+/** One request. status 0 means Since could not be reached; json is the answer when it is a JSON object. */
+async function call(ctx, method, path, { query, body, key } = {}) {
+  const search = query ? encodeQuery(query) : ""
+  const headers = { "User-Agent": `since-cli/${VERSION} (${ctx.io.runtime})`, Accept: "application/json" }
+  if (body !== undefined) headers["Content-Type"] = "application/json"
+  if (key) headers.Authorization = `Bearer ${key.value}`
+  let answer
+  try {
+    answer = await ctx.io.fetch({
+      method,
+      url: `${ctx.api}${path}${search ? `?${search}` : ""}`,
+      headers,
+      body: body === undefined ? null : JSON.stringify(body),
+    })
+  } catch {
+    return { status: 0, json: null, retryAfter: null }
+  }
+  const retryAfter = Number.parseInt(String(answer.retryAfter ?? ""), 10)
+  return { status: answer.status, json: readJson(answer.text ?? null), retryAfter: Number.isFinite(retryAfter) ? retryAfter : null }
+}
+
+const errorOf = (answer) => (answer.json && typeof answer.json.error === "string" ? answer.json.error : null)
+
+/** Say why a request did not answer, and return the exit code that goes with it. */
+function refuse(ctx, answer) {
+  const { io, p, check } = ctx
+  const message = answer.json && typeof answer.json.message === "string" ? answer.json.message : null
+  if (answer.status === 0 || answer.status >= 500) {
+    const what = errorOf(answer) === "busy" ? "Since is still busy." : "Since could not be reached."
+    io.err(`${what} Try again in a minute.${check ? " Nothing was checked, so this run passes." : ""}\n`)
+    return check ? 0 : 1
+  }
+  if (answer.status === 401) {
+    io.err(
+      ctx.key && ctx.key.source === "env"
+        ? `Since refused the key in SINCE_DEV_KEY. Create a new one at ${APP}/api-keys\n`
+        : `Since refused the stored key. Sign in again: ${p} login\n`,
+    )
+  } else if (answer.status === 429) {
+    const seconds = wholeNumber(answer.json ? answer.json.retryAfterSec : null) ?? answer.retryAfter
+    // A shared CI address runs out of free scans through no fault of the build, so a limit passes a check like an outage does.
+    io.err(`${message ?? "Too many requests."}${seconds ? ` Try again in ${text.wait(seconds)}.` : ""}${check ? " Nothing was checked, so this run passes." : ""}\n`)
+    return check ? 0 : 1
+  } else io.err(`${message ?? `Since answered ${answer.status}.`}\n`)
+  return check ? 2 : 1
+}
+
+/** The free scan of a public GitHub repository. A busy answer is waited out up to three times. */
+async function publicScan(ctx, fullName) {
+  for (let waits = 0; ; waits++) {
+    const answer = await call(ctx, "POST", "/v1/scan", { body: { repo: fullName } })
+    if (answer.status === 200 && answer.json && isObject(answer.json.repository)) return { result: answer.json }
+    if (answer.status === 503 && errorOf(answer) === "busy" && waits < 3) {
+      const seconds = clamp(answer.retryAfter ?? 20, 1, 60)
+      ctx.io.err(`Since is busy. Trying again in ${text.wait(seconds)}.\n`)
+      await ctx.io.sleep(seconds * 1000)
+      continue
+    }
+    return { answer }
+  }
+}
+
+/** One keyed check, whole: waits while a connected repository is still being read, then follows every page (pages are free). */
+async function checkAll(ctx, body) {
+  const started = ctx.io.now()
+  let answer = await call(ctx, "POST", "/v1/check", { body, key: ctx.key })
+  while (answer.status === 200 && answer.json && answer.json.scanning && Array.isArray(answer.json.findings) && !answer.json.findings.length) {
+    const seconds = clamp(wholeNumber(answer.json.scanning.retryAfterSec) ?? 10, 1, 30)
+    if (ctx.io.now() - started + seconds * 1000 > MAX_WAIT_MS) break
+    ctx.io.err(`Since is still reading this repository. Trying again in ${text.wait(seconds)}.\n`)
+    await ctx.io.sleep(seconds * 1000)
+    answer = await call(ctx, "POST", "/v1/check", { body, key: ctx.key })
+  }
+  if (answer.status !== 200 || !answer.json || !Array.isArray(answer.json.findings)) return answer
+  const whole = answer.json
+  for (let page = 1; page < MAX_PAGES && typeof whole.nextCursor === "string" && whole.nextCursor; page++) {
+    const next = await call(ctx, "POST", "/v1/check", { body: { ...body, cursor: whole.nextCursor }, key: ctx.key })
+    if (next.status !== 200 || !next.json || !Array.isArray(next.json.findings)) break
+    whole.findings = whole.findings.concat(next.json.findings)
+    whole.nextCursor = next.json.nextCursor ?? null
+  }
+  if (whole.nextCursor) whole.truncated = true
+  return answer
+}
+
+/** A repository connected to the caller's workspace, checked where Since already has its code. */
+async function connectedCheck(ctx, fullName) {
+  const repos = await call(ctx, "GET", "/v1/repos", { key: ctx.key })
+  if (repos.status !== 200 || !repos.json) return { exit: refuse(ctx, repos) }
+  const list = Array.isArray(repos.json.repos) ? repos.json.repos : []
+  const repo = list.find((entry) => String(entry.fullName).toLowerCase() === fullName.toLowerCase())
+  if (!repo) return {}
+  const answer = await checkAll(ctx, { repo: repo.id, detail: "summary" })
+  if (answer.status === 403 && errorOf(answer) === "impact_api_not_in_plan") return {}
+  if (answer.status !== 200 || !answer.json) return { exit: refuse(ctx, answer) }
+  return { answer: answer.json, repo }
+}
+
+/** The manifests in this folder, sent one by one as the GitHub Action sends them. */
+async function localCheck(ctx, noOrigin) {
+  const { io, p, check } = ctx
+  if (!ctx.key) {
+    io.err(
+      noOrigin
+        ? `This folder has no GitHub origin. Name a public repository, as ${p} owner/repo, or sign in to check the files here: ${p} login\n`
+        : `Checking the files in this folder needs a key. Sign in first: ${p} login\n`,
+    )
+    return check ? 2 : 1
+  }
+  const found = findManifests(io)
+  if (!found.length) {
+    io.err("No manifests in this folder (package.json, pyproject.toml, go.mod and the like).\n")
+    return check ? 2 : 1
+  }
+  const files = []
+  const notes = []
+  let last = null
+  if (found.length > ctx.maxFiles) {
+    notes.push(`${text.plural(found.length, "manifest")} found, the first ${ctx.maxFiles} checked (each one costs credits). Raise it with --max-files.`)
+  }
+  for (const file of found.slice(0, ctx.maxFiles)) {
+    const content = io.readFile(`${io.cwd}/${file}`)
+    if (content === null) notes.push(`${file}: could not be read.`)
+    else if (content.length > MAX_CHARACTERS) notes.push(`${file}: over ${text.num(MAX_CHARACTERS)} characters, not sent.`)
+    else {
+      const answer = await checkAll(ctx, checkBody(file, content))
+      if (answer.status === 200 && answer.json && Array.isArray(answer.json.findings)) files.push({ path: file, answer: answer.json })
+      else if (answer.status === 401 || answer.status === 402) return refuse(ctx, answer)
+      else {
+        last = answer
+        const message = answer.json && typeof answer.json.message === "string" ? answer.json.message : null
+        notes.push(`${file}: ${answer.status === 0 || answer.status >= 500 ? "Since could not be reached." : message ?? `Since answered ${answer.status}.`}`)
+      }
+    }
+  }
+  if (!files.length && last) return refuse(ctx, last)
+  return report(ctx, { kind: "local", files, notes })
+}
+
+/** Print what was found and return the exit code. */
+function report(ctx, data) {
+  const { io, args, p, c, check } = ctx
+  const all = Boolean(args.flags.all)
+  let items
+  if (data.kind === "scan") items = text.scanItems(Array.isArray(data.result.findings) ? data.result.findings : [])
+  else if (data.kind === "repo") items = text.checkItems(data.answer.findings, null, p)
+  else items = data.files.flatMap((file) => text.checkItems(file.answer.findings, file.path, p))
+  if (ctx.within !== null) items = items.filter((item) => item.daysLeft !== null && item.daysLeft <= ctx.within)
+  items = text.order(items)
+  const failing = check ? items.filter((item) => text.fails(item, ctx.failOn)) : []
+  const exit = failing.length ? 1 : 0
+  if (args.flags.json) {
+    const whole = data.kind === "scan" ? data.result : data.kind === "repo" ? data.answer : { files: data.files }
+    io.out(`${JSON.stringify(whole, null, 2)}\n`)
+    return exit
+  }
+
+  const lines = [""]
+  const notes = []
+  const footer = []
+  const counts = text.countsLine(items, ctx.within)
+  const more = `${p}${check ? " check" : ""}${args.positional.length ? ` ${args.positional[0]}` : ""} --all`
+  if (data.kind === "scan") {
+    const result = data.result
+    const repository = result.repository
+    const summary = isObject(result.summary) ? result.summary : {}
+    const sha = String(repository.headSha ?? "").slice(0, 7)
+    const branch = String(repository.defaultBranch ?? "")
+    const parsed = Date.parse(String(result.scannedAt ?? ""))
+    const scanned = text.ago(Number.isFinite(parsed) ? io.now() - parsed : null)
+    const head = [c.bold(String(repository.fullName)), sha ? `${branch}@${sha}` : branch, scanned ? `scanned ${scanned}` : ""]
+    lines.push(`  ${head.filter(Boolean).join("  ")}`)
+    const dependencies = wholeNumber(summary.dependencies) ?? 0
+    const files = wholeNumber(summary.files) ?? 0
+    lines.push(`  ${counts}   ${text.num(dependencies)} ${dependencies === 1 ? "dependency" : "dependencies"} and ${text.plural(files, "file")} read`)
+    if (data.fromTree) lines.push(c.dim(`  Read from GitHub (${branch}), not your working tree.`))
+    const coverage = isObject(result.coverage) && Array.isArray(result.coverage.notes) ? result.coverage.notes : []
+    for (const note of coverage) notes.push(String(note))
+    footer.push(`  ${"Full report".padEnd(14)}${SITE}/scan/${repository.fullName}?utm_source=cli`)
+  } else if (data.kind === "repo") {
+    lines.push(`  ${[c.bold(String(data.repo.fullName)), String(data.repo.defaultBranch ?? ""), "connected repository"].filter(Boolean).join("  ")}`)
+    lines.push(`  ${counts}   ${text.num(wholeNumber(data.answer.checkedCount) ?? 0)} checked`)
+    for (const note of text.answerNotes([data.answer])) notes.push(note)
+  } else {
+    const checked = data.files.reduce((sum, file) => sum + (wholeNumber(file.answer.checkedCount) ?? 0), 0)
+    lines.push(`  ${c.bold("This folder")}  ${text.plural(data.files.length, "manifest")} checked`)
+    lines.push(`  ${counts}   ${text.num(checked)} checked`)
+    for (const note of data.notes) notes.push(note)
+    for (const note of text.answerNotes(data.files.map((file) => file.answer))) notes.push(note)
+    notes.push(`Only manifests were checked. Connect the repository to check its code too: ${APP}?utm_source=cli`)
+  }
+  lines.push("")
+  for (const line of text.findingLines(items, all, c, more)) lines.push(line)
+  for (const note of notes) lines.push(`  ${note}`)
+  if (notes.length) lines.push("")
+  for (const line of footer) lines.push(line)
+  if (!check) lines.push(`  ${"Next".padEnd(14)}${p} init   your coding agent checks before it writes`)
+  else if (ctx.failOn !== "none") {
+    const level = ctx.failOn === "critical" ? "at critical" : `at ${ctx.failOn} or above`
+    lines.push(failing.length ? `  ${"Failed".padEnd(14)}${text.plural(failing.length, "finding")} ${level}` : `  ${"Passed".padEnd(14)}nothing ${level}`)
+  }
+  lines.push("")
+  io.out(lines.join("\n"))
+  return exit
+}
+
+/** `since`, `since <owner/repo>` and `since check`: find the repository, then the cheapest way to read it. */
+async function repoCommand(ctx) {
+  const { io, args, p, check } = ctx
+  const given = args.positional.length ? args.positional[0] : null
+  const fromTree = given === null
+  const repo = parseRepo(fromTree ? io.origin() : given)
+  const stop = check ? 2 : 1
+  if (!fromTree && !repo) {
+    io.err(`${given} is not a repository. Use owner/repo or a GitHub URL.\n`)
+    return 2
+  }
+  if (!fromTree && args.flags.local) {
+    io.err("--local checks the folder you are in, so it takes no repository name.\n")
+    return 2
+  }
+  // In CI with a key, and whenever --local asks: the checkout itself, not the default branch on GitHub.
+  if (fromTree && (args.flags.local || (check && ctx.key))) return localCheck(ctx, false)
+  if (!repo || repo.host !== "github.com") {
+    if (fromTree) return localCheck(ctx, true)
+    io.err(`${given} is not on GitHub. Run ${p} inside its folder to check its manifests.\n`)
+    return stop
+  }
+
+  const fullName = `${repo.owner}/${repo.name}`
+  // A first scan takes up to a minute, and a silent terminal reads as a hung one.
+  io.err(`Reading ${fullName} on GitHub. A first scan can take a minute.\n`)
+  const scan = await publicScan(ctx, fullName)
+  if (scan.result) return report(ctx, { kind: "scan", result: scan.result, fromTree })
+  // The free scan said no (not public, too big, or today's scans are used up): with a key there is still a way to answer
+  // for the folder you are in, so say why and take it. Without one, or when Since itself is down, this is the end.
+  const refusal = errorOf(scan.answer)
+  const down = scan.answer.status === 0 || scan.answer.status >= 500
+  if (refusal !== "not_found") {
+    if (down || !ctx.key || !fromTree) return refuse(ctx, scan.answer)
+    const why = scan.answer.json && typeof scan.answer.json.message === "string" ? `${scan.answer.json.message} ` : ""
+    io.err(`${why}Checking with your key instead.\n`)
+  }
+  if (!ctx.key) {
+    io.err(
+      fromTree
+        ? `${fullName} is not a public GitHub repository. For a private one, sign in and run this again: ${p} login\n`
+        : `GitHub serves no public repository named ${fullName}. For a private one, sign in first: ${p} login\n`,
+    )
+    return stop
+  }
+  const connected = await connectedCheck(ctx, fullName)
+  if (connected.answer) return report(ctx, { kind: "repo", answer: connected.answer, repo: connected.repo })
+  if (connected.exit !== undefined) return connected.exit
+  if (fromTree) return localCheck(ctx, false)
+  io.err(`${fullName} is private and Since cannot read it from here. Run ${p} inside its folder.\n`)
+  return stop
+}
+
+async function calendarCommand(ctx) {
+  const { io, args, p, c } = ctx
+  const within = ctx.within ?? 30
+  const provider = args.flags.provider ?? null
+  const answer = await call(ctx, "GET", "/v1/calendar", { query: { within: `${within}d`, provider, limit: args.flags.all ? 500 : 15 } })
+  if (answer.status !== 200 || !answer.json || !Array.isArray(answer.json.entries)) return refuse(ctx, answer)
+  if (args.flags.json) {
+    io.out(`${JSON.stringify(answer.json, null, 2)}\n`)
+    return 0
+  }
+  const entries = answer.json.entries
+  const lines = ["", `  ${c.bold(`Ending in the next ${text.plural(within, "day")}`)}${provider ? `  ${provider}` : ""}`, ""]
+  if (!entries.length) lines.push("  Nothing on the calendar in that time.")
+  for (const line of text.calendarLines(entries, SITE, c)) lines.push(line)
+  lines.push("")
+  if (answer.json.nextCursor) lines.push(`  ${"More".padEnd(14)}${p} calendar${provider ? ` --provider ${provider}` : ""} --all`)
+  lines.push(`  ${"Calendar".padEnd(14)}${SITE}/calendar?utm_source=cli`, "")
+  io.out(lines.join("\n"))
+  return 0
+}
+
+async function changedCommand(ctx) {
+  const { io, args, p, c } = ctx
+  const name = args.positional[0]
+  if (!ctx.key) {
+    io.err(`${p} changed needs a key. Sign in first: ${p} login\n`)
+    return 1
+  }
+  const ecosystem = args.flags.ecosystem ?? "npm"
+  const since = args.flags.since ?? null
+  const answer = await call(ctx, "GET", "/v1/changes", { query: { package: name, ecosystem, since, limit: args.flags.all ? 200 : 20 }, key: ctx.key })
+  if (answer.status !== 200 || !answer.json || !Array.isArray(answer.json.changes)) return refuse(ctx, answer)
+  if (args.flags.json) {
+    io.out(`${JSON.stringify(answer.json, null, 2)}\n`)
+    return 0
+  }
+  const changes = text.uniqueChanges(answer.json.changes)
+  const found = isObject(answer.json.package) ? answer.json.package : {}
+  const head = [c.bold(String(found.name ?? name)), String(found.ecosystem ?? ecosystem), found.latest ? `latest ${found.latest}` : ""]
+  const lines = ["", `  ${head.filter(Boolean).join("  ")}`]
+  lines.push(`  ${changes.length ? text.plural(changes.length, "change") : "No changes recorded"}${since ? ` since ${since}` : ""}${answer.json.nextCursor ? ", and more" : ""}`, "")
+  for (const line of text.changeLines(changes, c)) lines.push(line)
+  if (changes.length) lines.push("")
+  const notes = []
+  if (answer.json.reading) notes.push("Since is reading newer releases of this package now. Run this again in a few minutes to include them.")
+  for (const note of notes) lines.push(`  ${note}`)
+  if (notes.length) lines.push("")
+  if (answer.json.nextCursor) lines.push(`  ${"More".padEnd(14)}${p} changed ${name}${since ? ` --since ${since}` : ""}${ecosystem !== "npm" ? ` --ecosystem ${ecosystem}` : ""} --all`, "")
+  io.out(lines.join("\n"))
+  return 0
+}
+
+/** Sign in without a password: Since emails nothing here, the person approves the link in a browser and the key comes back. */
+async function loginCommand(ctx) {
+  const { io, args, p } = ctx
+  let email = String(args.flags.email ?? "").trim()
+  if (!email && io.tty) email = String(await io.prompt("Email: ")).trim()
+  if (!email) {
+    io.err(`Give the email to sign in with: ${p} login --email you@example.com\n`)
+    return 2
+  }
+  const start = await call(ctx, "POST", "/v1/agent/register", { body: { email, client_name: "since-cli" } })
+  const setup = start.json && isObject(start.json.setup) ? start.json.setup : null
+  if (start.status !== 200 || !setup || typeof start.json.claim_token !== "string") return refuse(ctx, start)
+  const link = String(setup.verification_uri_complete ?? setup.verification_uri)
+  // The approval page shows an eight-character code in two halves: print it the way the person will see it there.
+  const code = String(setup.user_code ?? "")
+  io.out(`\n  Open this link to approve the sign-in:\n    ${link}\n  Code: ${code.length === 8 ? `${code.slice(0, 4)}-${code.slice(4)}` : code}\n\n`)
+  if (io.tty) io.open(link)
+  let interval = clamp(wholeNumber(setup.interval) ?? 5, 1, 60)
+  const deadline = io.now() + clamp(wholeNumber(setup.expires_in) ?? 900, 30, 3600) * 1000
+  while (io.now() + interval * 1000 <= deadline) {
+    await io.sleep(interval * 1000)
+    const answer = await call(ctx, "POST", "/v1/agent/token", { body: { claim_token: start.json.claim_token } })
+    if (answer.status === 200 && answer.json && typeof answer.json.api_key === "string") {
+      const file = credentialsPath(io)
+      const stored = { api: ctx.api, api_key: answer.json.api_key, key_name: answer.json.key_name ?? null, key_prefix: answer.json.key_prefix ?? null }
+      io.writeFile(file, `${JSON.stringify(stored, null, 2)}\n`, 0o600)
+      io.out(`  Signed in. The key is stored in ${file}\n\n`)
+      return 0
+    }
+    const code = errorOf(answer)
+    if (code === "slow_down") interval += 5
+    else if (code === "expired_token") break
+    else if (code === "access_denied") {
+      io.err("The sign-in was declined.\n")
+      return 1
+    } else if (code !== "authorization_pending" && answer.status !== 0 && answer.status < 500) return refuse(ctx, answer)
+  }
+  io.err(`The link expired before it was approved. Run ${p} login again.\n`)
+  return 1
+}
+
+function logoutCommand(ctx) {
+  const { io } = ctx
+  const removed = io.remove(credentialsPath(io))
+  io.out(removed ? `Signed out. The key is gone from this computer; delete it for good at ${APP}/api-keys\n` : "No stored key.\n")
+  return 0
+}
+
+export async function run(argv, io) {
+  const args = parseArgs(argv)
+  const p = io.program
+  const usage = (message) => {
+    io.err(`${message}\nRun ${p} --help for the commands.\n`)
+    return 2
+  }
+  if (args.error) return usage(args.error)
+  if (args.flags.version || args.command === "version") {
+    io.out(`since-dev ${VERSION}\n`)
+    return 0
+  }
+  if (args.flags.help || args.command === "help") {
+    io.out(help(p))
+    return 0
+  }
+  const command = args.command
+  const words = args.positional
+  if (command === "changed") {
+    if (words.length !== 1) return usage(words.length ? `Too many words: ${words[1]}` : `${p} changed needs a package name, as ${p} changed react`)
+  } else if (command === null || command === "check") {
+    if (words.length > 1) return usage(`Too many words: ${words[1]}`)
+    if (command === null && words.length === 1 && !words[0].includes("/")) return usage(`Unknown command: ${words[0]}`)
+  } else if (words.length) return usage(`Too many words: ${words[0]}`)
+
+  const failOn = args.flags["fail-on"] ?? "high"
+  if (!FAIL_ON.includes(failOn)) return usage("--fail-on takes low, medium, high, critical or none.")
+  let within = null
+  if (args.flags.within !== undefined) {
+    if (!/^\d{1,4}d?$/.test(args.flags.within) || Number.parseInt(args.flags.within, 10) < 1) return usage("--within takes a number of days, as 30d.")
+    within = Number.parseInt(args.flags.within, 10)
+  }
+  let maxFiles = 10
+  if (args.flags["max-files"] !== undefined) {
+    if (!/^\d{1,3}$/.test(args.flags["max-files"]) || Number.parseInt(args.flags["max-files"], 10) < 1) return usage("--max-files takes a number from 1 to 999.")
+    maxFiles = Number.parseInt(args.flags["max-files"], 10)
+  }
+
+  const api = String(io.env.SINCE_API_URL || DEFAULT_API).replace(/\/+$/, "")
+  const color = Boolean(io.tty) && !args.flags["no-color"] && !io.env.NO_COLOR && io.env.TERM !== "dumb"
+  const ctx = { io, args, p, api, c: text.palette(color), check: command === "check", key: readKey(io, api), failOn, within, maxFiles }
+  if (command === "calendar") return calendarCommand(ctx)
+  if (command === "changed") return changedCommand(ctx)
+  if (command === "init") return init(io, p, Boolean(args.flags["dry-run"]))
+  if (command === "login") return loginCommand(ctx)
+  if (command === "logout") return logoutCommand(ctx)
+  return repoCommand(ctx)
+}

package/src/init.mjs

@@ -0,0 +1,102 @@
+// `since init`: the files that put Since in front of a coding agent, written into the repository so a clone carries them.
+// It adds its own entry and nothing else: other servers stay as they are, and a file it cannot read as JSON is left alone.
+
+export const MCP_URL = "https://api.since.dev/mcp"
+export const TARGETS = [
+  { file: ".mcp.json", key: "mcpServers", entry: { type: "http", url: MCP_URL }, what: "Claude Code" },
+  { file: ".cursor/mcp.json", key: "mcpServers", entry: { url: MCP_URL }, what: "Cursor" },
+  { file: ".vscode/mcp.json", key: "servers", entry: { type: "http", url: MCP_URL }, what: "VS Code" },
+]
+export const RULE_FILE = "AGENTS.md"
+export const START = "<!-- since:start -->"
+export const END = "<!-- since:end -->"
+// The rule every listing ships (distribution/cursor/rules/since.mdc); a test holds the two to the same words.
+export const RULE = [
+  "When you change a dependency version, a manifest or lockfile, an AI model ID, a runtime version, a Docker base image or a CI runner label, check it with the Since.dev MCP tools first:",
+  "",
+  "- `check_code` with the manifest, lockfile, model ID or `surface` (`runtime:<product>@<version>`) reports what is affected, on which line, the days left and the replacement.",
+  "- `whats_changed` with the package and `since` set to the current version lists every breaking change and deprecation between that version and today, each with its source.",
+  "",
+  "Treat `needs_review` and `unknown` as not settled, never as safe. Use the replacement the answer names. `fix_code` opens a fix pull request for a connected repository, and the editor asks before it runs.",
+].join("\n")
+export const BLOCK = `${START}\n## Since.dev\n\n${RULE}\n${END}`
+
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+
+function sameEntry(have, want) {
+  if (!isObject(have)) return false
+  const keys = Object.keys(want)
+  return Object.keys(have).length === keys.length && keys.every((key) => have[key] === want[key])
+}
+
+/** The indent a JSON file already uses: its first indented line decides, two spaces when there is none. */
+function indentOf(text) {
+  const match = /^([ \t]+)\S/m.exec(text)
+  if (!match) return 2
+  return match[1].includes("\t") ? "\t" : match[1].length
+}
+
+/** A config file with the Since entry in it. status: new, updated, same, or skipped when the file is not plain JSON. */
+export function mergeConfig(text, key, entry) {
+  if (text === null || text.trim() === "") return { status: "new", text: `${JSON.stringify({ [key]: { since: entry } }, null, 2)}\n` }
+  let data
+  try {
+    data = JSON.parse(text)
+  } catch {
+    return { status: "skipped", text }
+  }
+  if (!isObject(data) || (data[key] !== undefined && !isObject(data[key]))) return { status: "skipped", text }
+  if (data[key] !== undefined && sameEntry(data[key].since, entry)) return { status: "same", text }
+  if (data[key] === undefined) data[key] = {}
+  data[key].since = entry
+  return { status: "updated", text: `${JSON.stringify(data, null, indentOf(text))}\n` }
+}
+
+/** AGENTS.md with the rule between its two markers: replaced when the markers are there, added at the end when they are not. */
+export function mergeRule(text) {
+  if (text === null || text.trim() === "") return { status: "new", text: `${BLOCK}\n` }
+  const start = text.indexOf(START)
+  const end = start < 0 ? -1 : text.indexOf(END, start)
+  if (start < 0 || end < 0) return { status: "updated", text: `${text.replace(/\n+$/, "")}\n\n${BLOCK}\n` }
+  const next = text.slice(0, start) + BLOCK + text.slice(end + END.length)
+  return next === text ? { status: "same", text } : { status: "updated", text: next }
+}
+
+const WORDS = {
+  new: ["Wrote", "Would write"],
+  updated: ["Updated", "Would update"],
+  same: ["Unchanged", "Unchanged"],
+  skipped: ["Skipped", "Skipped"],
+}
+
+export function init(io, program, dryRun) {
+  const root = io.root()
+  const lines = [""]
+  const skipped = []
+  let changed = 0
+  const rows = TARGETS.map((target) => ({ ...target, result: mergeConfig(io.readFile(`${root}/${target.file}`), target.key, target.entry) }))
+  rows.push({ file: RULE_FILE, what: "the rule every coding agent reads", result: mergeRule(io.readFile(`${root}/${RULE_FILE}`)) })
+  for (const row of rows) {
+    const { status, text } = row.result
+    if (status === "new" || status === "updated") {
+      changed += 1
+      if (!dryRun) io.writeFile(`${root}/${row.file}`, text, null)
+    }
+    if (status === "skipped") skipped.push(row)
+    lines.push(`  ${WORDS[status][dryRun ? 1 : 0].padEnd(14)}${row.file.padEnd(20)}${row.what}`)
+  }
+  lines.push("")
+  for (const row of skipped) {
+    lines.push(`  ${row.file} is not plain JSON, so it was left alone. Add this under "${row.key}" by hand:`)
+    lines.push(`    "since": ${JSON.stringify(row.entry)}`)
+    lines.push("")
+  }
+  if (dryRun) lines.push(changed ? `  Nothing was written. Run ${program} init to write ${changed === 1 ? "it" : "them"}.` : "  Everything is already set up.")
+  else if (changed) {
+    lines.push("  Commit these files: everyone who clones this repository gets the same setup.")
+    lines.push("  The first tool call opens a sign-in in the browser. No key goes in any file.")
+  } else lines.push("  Everything is already set up.")
+  lines.push("")
+  io.out(lines.join("\n"))
+  return 0
+}

package/src/io.mjs

@@ -0,0 +1,87 @@
+// The real world behind the CLI: the network, the folder, git, the terminal. The tests swap all of it for a fixture.
+
+import { execFileSync, spawn } from "node:child_process"
+import { chmodSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs"
+import { homedir } from "node:os"
+import path from "node:path"
+import { createInterface } from "node:readline"
+
+function git(cwd, args) {
+  try {
+    return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null
+  } catch {
+    return null
+  }
+}
+
+export function realIo() {
+  const cwd = process.cwd()
+  return {
+    runtime: "node",
+    // Run through npx there is no `since` on the PATH, so the hints name the command that works again.
+    program: /[\\/]_npx[\\/]/.test(process.argv[1] ?? "") ? "npx since-dev" : "since",
+    env: process.env,
+    cwd,
+    home: homedir(),
+    platform: process.platform,
+    tty: Boolean(process.stdout.isTTY),
+    out: (text) => void process.stdout.write(text),
+    err: (text) => void process.stderr.write(text),
+    now: () => Date.now(),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    async fetch({ method, url, headers, body }) {
+      // The API never redirects, so a redirect is never followed: a key goes to the host it was meant for and nowhere else.
+      const response = await fetch(url, { method, headers, body: body ?? undefined, redirect: "manual", signal: AbortSignal.timeout(120_000) })
+      return { status: response.status, retryAfter: response.headers.get("retry-after"), text: await response.text() }
+    },
+    origin: () => git(cwd, ["remote", "get-url", "origin"]),
+    root: () => git(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd,
+    open(url) {
+      if (process.env.CI) return
+      const [command, args] =
+        process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]]
+      try {
+        const child = spawn(command, args, { stdio: "ignore", detached: true })
+        child.on("error", () => {})
+        child.unref()
+      } catch {
+        // No browser to open: the link is printed, which is enough.
+      }
+    },
+    prompt(question) {
+      const terminal = createInterface({ input: process.stdin, output: process.stderr })
+      return new Promise((resolve) => terminal.question(question, (answer) => (terminal.close(), resolve(answer))))
+    },
+    readFile(file) {
+      try {
+        return readFileSync(file, "utf8")
+      } catch {
+        return null
+      }
+    },
+    /** mode is null for a file of the repository, or the permission bits for a private one (its folder is made private too). */
+    writeFile(file, text, mode) {
+      mkdirSync(path.dirname(file), mode === null ? { recursive: true } : { recursive: true, mode: 0o700 })
+      writeFileSync(file, text, mode === null ? {} : { mode })
+      if (mode !== null) chmodSync(file, mode)
+    },
+    remove(file) {
+      try {
+        rmSync(file)
+        return true
+      } catch {
+        return false
+      }
+    },
+    /** A folder's entries by name; a link is never followed into a folder. */
+    list(folder) {
+      try {
+        return readdirSync(folder, { withFileTypes: true })
+          .map((entry) => ({ name: entry.name, dir: entry.isDirectory() }))
+          .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))
+      } catch {
+        return []
+      }
+    },
+  }
+}

package/src/local.mjs

@@ -0,0 +1,66 @@
+// What the CLI reads from the folder it runs in: which repository this is, and which manifests to send.
+// The manifest rules are the GitHub Action's (distribution/action/index.mjs): the same names, the same folders skipped.
+
+export const PATTERNS = [
+  "**/package.json",
+  "**/requirements*.txt",
+  "**/pyproject.toml",
+  "**/go.mod",
+  "**/Cargo.toml",
+  "**/Gemfile",
+  "**/composer.json",
+  "**/pom.xml",
+  "**/build.gradle",
+  "**/build.gradle.kts",
+  "**/*.csproj",
+]
+const LOCKFILES = new Set([
+  "package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock",
+  "poetry.lock", "Pipfile.lock", "uv.lock", "Cargo.lock", "Gemfile.lock", "composer.lock",
+  "packages.lock.json", "gradle.lockfile",
+])
+const SKIP = new Set([".git", "node_modules", "vendor", "dist", "build", ".venv", "venv", "target", ".next", "__pycache__"])
+export const MAX_CHARACTERS = 500_000
+
+/** owner and name from "owner/repo", a GitHub URL or a git remote; null for anything else. A bare "owner/repo" means GitHub. */
+export function parseRepo(text) {
+  const value = String(text ?? "").trim()
+  if (!value) return null
+  const short = /^([A-Za-z0-9_-][A-Za-z0-9_.-]*)\/([A-Za-z0-9_.-]+)$/.exec(value)
+  if (short) return { host: "github.com", owner: short[1], name: short[2].replace(/\.git$/, "") }
+  const remote =
+    /^(?:https?:\/\/|ssh:\/\/|git:\/\/)?(?:[^@\/]+@)?([A-Za-z0-9.-]+\.[A-Za-z]+)(?::\d+)?[:\/]([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?(?:\/.*)?$/.exec(value)
+  if (!remote) return null
+  return { host: remote[1].toLowerCase(), owner: remote[2], name: remote[3] }
+}
+
+export function patternRegExp(pattern) {
+  const source = pattern
+    .replace(/^\.\//, "")
+    .split(/(\*\*\/|\*)/)
+    .map((part) => (part === "**/" ? "(?:.*/)?" : part === "*" ? "[^/]*" : part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")))
+    .join("")
+  return new RegExp(`^${source}$`)
+}
+
+/** The manifests under the folder, nearest the top first, then by name. */
+export function findManifests(io) {
+  const patterns = PATTERNS.map(patternRegExp)
+  const found = []
+  const walk = (folder) => {
+    for (const entry of io.list(folder ? `${io.cwd}/${folder}` : io.cwd)) {
+      const relative = folder ? `${folder}/${entry.name}` : entry.name
+      if (entry.dir) {
+        if (!SKIP.has(entry.name)) walk(relative)
+      } else if (patterns.some((pattern) => pattern.test(relative))) found.push(relative)
+    }
+  }
+  walk("")
+  const depth = (file) => file.split("/").length
+  return found.sort((a, b) => depth(a) - depth(b) || (a < b ? -1 : a > b ? 1 : 0))
+}
+
+export function checkBody(file, content) {
+  const name = file.split("/").pop()
+  return { [LOCKFILES.has(name) ? "lockfile" : "manifest"]: { path: file, content }, detail: "summary" }
+}

package/src/render.mjs

@@ -0,0 +1,257 @@
+// Text only: every function here turns an API answer into lines. No network, no files, no clock.
+// since_dev/render.py is the same code in Python, and the shared fixtures hold both to the same output.
+
+export const SEVERITIES = ["low", "medium", "high", "critical"]
+const PAD = " ".repeat(12)
+const SHOWN = 10
+
+export function palette(on) {
+  const paint = (code) => (text) => (on ? `\x1b[${code}m${text}\x1b[0m` : text)
+  return { bold: paint(1), dim: paint(2), red: paint(31), yellow: paint(33), plain: (text) => text }
+}
+
+export const num = (value) => String(value).replace(/\B(?=(\d{3})+(?!\d))/g, ",")
+export const plural = (count, word) => `${num(count)} ${word}${count === 1 ? "" : "s"}`
+
+/** How long to wait, in words: seconds under a minute and a half, then minutes, then hours, rounded up. */
+export function wait(seconds) {
+  if (seconds < 90) return plural(Math.max(1, seconds), "second")
+  if (seconds < 5400) return plural(Math.ceil(seconds / 60), "minute")
+  return plural(Math.ceil(seconds / 3600), "hour")
+}
+
+/** How long ago, from milliseconds; "" when the time is not known. */
+export function ago(ms) {
+  if (ms === null || !Number.isFinite(ms)) return ""
+  const minutes = Math.floor(ms / 60000)
+  if (minutes < 1) return "just now"
+  if (minutes < 60) return `${minutes} min ago`
+  const hours = Math.floor(minutes / 60)
+  if (hours < 48) return `${plural(hours, "hour")} ago`
+  return `${plural(Math.floor(hours / 24), "day")} ago`
+}
+
+const placeOf = (path, line) => (typeof line === "number" && line > 0 ? `${path}:${line}` : String(path))
+
+/** A public scan's findings, as the rows the CLI prints. */
+export function scanItems(findings) {
+  return findings.map((finding) => {
+    const where = Array.isArray(finding.where) ? finding.where.filter((place) => place && place.path) : []
+    const source = finding.source && typeof finding.source === "object" ? finding.source.url : null
+    return {
+      title: String(finding.title ?? ""),
+      review: finding.state === "needs_review",
+      severity: finding.severity,
+      daysLeft: typeof finding.daysLeft === "number" ? finding.daysLeft : null,
+      place: where.length ? placeOf(where[0].path, where[0].line) : null,
+      extra: Math.max(0, where.length - 1) + (typeof finding.more === "number" ? finding.more : 0),
+      replacement: finding.replacement || null,
+      source: source || null,
+    }
+  })
+}
+
+/** Many undated findings about one dependency at one place, as one row: the count, the worst severity, and how to list them. */
+function mergeRows(group, program) {
+  const proven = group.members.filter((row) => !row.review)
+  const pool = proven.length ? proven : group.members
+  let severity = pool[0].severity
+  for (const row of pool) if (SEVERITIES.indexOf(row.severity) > SEVERITIES.indexOf(severity)) severity = row.severity
+  const tally = [...SEVERITIES].reverse().map((level) => [level, group.members.filter((row) => row.severity === level).length]).filter(([, count]) => count)
+  const unrated = group.members.length - tally.reduce((sum, [, count]) => sum + count, 0)
+  if (unrated) tally.push(["unrated", unrated])
+  const breakdown = tally.length > 1 ? ` (${tally.map(([level, count]) => `${num(count)} ${level}`).join(", ")})` : ""
+  const since = group.version ? ` --since ${group.version}` : ""
+  const registry = group.ecosystem && group.ecosystem !== "npm" ? ` --ecosystem ${group.ecosystem}` : ""
+  return {
+    title: `${group.subject}: ${num(group.members.length)} changes between this version and the latest${breakdown}`,
+    review: !proven.length,
+    severity,
+    daysLeft: null,
+    place: group.members[0].place,
+    extra: 0,
+    replacement: null,
+    source: null,
+    hint: group.isPackage && group.name ? `${program} changed ${group.name}${since}${registry}` : null,
+  }
+}
+
+/**
+ * A keyed check's findings as the same rows. They carry no title, so one is built from the name, the version and the reason.
+ * A manifest check answers with every recorded change between the pinned version and the latest, hundreds for an old pin:
+ * the undated ones about one dependency at one place become one row, and `since changed` lists them.
+ */
+export function checkItems(findings, fallbackPath, program) {
+  const rows = []
+  const groups = new Map()
+  for (const finding of findings) {
+    const surface = finding.surface && typeof finding.surface === "object" ? finding.surface : {}
+    const name = String(surface.name || "")
+    const version = finding.version || null
+    const subject = [name, version].filter(Boolean).join(" ")
+    const reason = String(finding.reason ?? "").trim()
+    const where = Array.isArray(finding.where) ? finding.where.filter((place) => place && place.file) : []
+    const first = where.length ? placeOf(where[0].file, where[0].line) : fallbackPath
+    const source = finding.source && typeof finding.source === "object" ? finding.source.url : finding.source
+    const row = {
+      title: name && reason.toLowerCase().includes(name.toLowerCase()) ? reason : [subject, reason].filter(Boolean).join(": "),
+      review: finding.state === "needs_review",
+      severity: finding.severity,
+      daysLeft: typeof finding.daysLeft === "number" ? finding.daysLeft : null,
+      place: first || null,
+      extra: Math.max(0, (typeof finding.placeCount === "number" ? finding.placeCount : where.length) - 1),
+      replacement: finding.replacement || null,
+      source: typeof source === "string" && source ? source : null,
+      hint: null,
+    }
+    if (row.daysLeft !== null) {
+      rows.push(row)
+      continue
+    }
+    const key = `${surface.key || name}|${version || ""}|${row.place || ""}`
+    const group = groups.get(key)
+    if (group) group.members.push(row)
+    else {
+      const created = { members: [row], subject, name, version, isPackage: surface.kind === "package", ecosystem: surface.ecosystem || null }
+      groups.set(key, created)
+      rows.push(created)
+    }
+  }
+  return rows.map((row) => (row.members ? (row.members.length === 1 ? row.members[0] : mergeRows(row, program)) : row))
+}
+
+/** Dated findings first (the next deadline, then the ones already passed, newest first), then undated, then the ones to review. */
+export function order(items) {
+  const group = (item) => (item.review ? 2 : item.daysLeft === null ? 1 : 0)
+  const within = (item) => (group(item) !== 0 ? 0 : item.daysLeft >= 0 ? item.daysLeft : 100000 - item.daysLeft)
+  return items
+    .map((item, index) => ({ item, index }))
+    .sort((a, b) => group(a.item) - group(b.item) || within(a.item) - within(b.item) || a.index - b.index)
+    .map((entry) => entry.item)
+}
+
+/** The CI rule, the same as the GitHub Action's: proven, and at or above the severity asked for. */
+export function fails(item, failOn) {
+  const threshold = SEVERITIES.indexOf(failOn)
+  return threshold >= 0 && !item.review && SEVERITIES.indexOf(item.severity) >= threshold
+}
+
+export function dayLabel(daysLeft) {
+  if (daysLeft < 0) return "passed"
+  if (daysLeft === 0) return "today"
+  return daysLeft === 1 ? "1 day" : `${num(daysLeft)} days`
+}
+
+function label(item) {
+  if (item.review) return "review"
+  if (item.daysLeft === null) return SEVERITIES.includes(item.severity) ? item.severity : "no date"
+  return dayLabel(item.daysLeft)
+}
+
+function dayTone(daysLeft, c) {
+  return daysLeft <= 30 ? c.red : daysLeft <= 90 ? c.yellow : c.plain
+}
+
+function tone(item, c) {
+  if (item.review) return c.dim
+  if (item.daysLeft === null) return item.severity === "critical" || item.severity === "high" ? c.yellow : c.plain
+  return dayTone(item.daysLeft, c)
+}
+
+/** "3 with a date   2 undated   1 to review", without the counts that are zero. */
+export function countsLine(items, within) {
+  const dated = items.filter((item) => !item.review && item.daysLeft !== null).length
+  const undated = items.filter((item) => !item.review && item.daysLeft === null).length
+  const review = items.filter((item) => item.review).length
+  const parts = []
+  if (dated) parts.push(`${num(dated)} with a date`)
+  if (undated) parts.push(`${num(undated)} undated`)
+  if (review) parts.push(`${num(review)} to review`)
+  if (parts.length) return parts.join("   ")
+  return within === null ? "No findings" : `Nothing dated within ${plural(within, "day")}`
+}
+
+/** The findings, three lines each: when and what, where and the replacement, the source. */
+export function findingLines(items, all, c, moreHint) {
+  const lines = []
+  const shown = all ? items : items.slice(0, SHOWN)
+  for (const item of shown) {
+    lines.push(`  ${tone(item, c)(label(item).padEnd(10))}${item.title}`)
+    const place = item.place ? item.place + (item.extra ? `  and ${num(item.extra)} more` : "") : null
+    const detail = [place, item.replacement ? `use ${item.replacement}` : null, item.hint ? `list them: ${item.hint}` : null].filter(Boolean).join("   ")
+    if (detail) lines.push(c.dim(PAD + detail))
+    if (item.source) lines.push(c.dim(PAD + item.source))
+    lines.push("")
+  }
+  if (items.length > shown.length) lines.push(`  and ${num(items.length - shown.length)} more   ${moreHint}`, "")
+  return lines
+}
+
+/** What keyed answers say about their own gaps: still being read, cut short, or names that did not resolve. */
+export function answerNotes(answers) {
+  const notes = []
+  let scanning = 0
+  let reading = false
+  let releases = 0
+  let truncated = false
+  const unresolved = []
+  for (const answer of answers) {
+    if (answer.scanning) scanning = Math.max(scanning, Number(answer.scanning.retryAfterSec) || 60)
+    if (answer.reading) {
+      reading = true
+      releases += Number(answer.reading.releases) || 0
+    }
+    if (answer.truncated) truncated = true
+    for (const entry of Array.isArray(answer.unresolved) ? answer.unresolved : []) unresolved.push(entry)
+  }
+  if (scanning) notes.push(`Since is still reading this repository. Run this again in ${wait(scanning)}.`)
+  if (reading) {
+    const what = releases ? plural(releases, "newer release") : "newer releases"
+    notes.push(`Since is reading ${what} now. Run this again in a few minutes to include them.`)
+  }
+  if (truncated) notes.push("The answer was cut short: there are more findings than one answer holds.")
+  if (unresolved.length) {
+    const names = unresolved.slice(0, 3).map((entry) => String(entry.name)).join(", ")
+    notes.push(`Not fully checked yet: ${names}${unresolved.length > 3 ? ` and ${num(unresolved.length - 3)} more` : ""}. --json says why.`)
+  }
+  return notes
+}
+
+/** One line per calendar entry, with its replacement and its page under it. */
+export function calendarLines(entries, site, c) {
+  const lines = []
+  for (const entry of entries) {
+    const days = typeof entry.daysLeft === "number" ? entry.daysLeft : null
+    const when = days === null ? "no date" : dayLabel(days)
+    const paint = days === null ? c.plain : dayTone(days, c)
+    lines.push(`  ${paint(when.padEnd(10))}${entry.title}`)
+    const link = typeof entry.path === "string" && entry.path.startsWith("/") ? `${site}${entry.path}?utm_source=cli` : null
+    const detail = [entry.replacement ? `use ${entry.replacement}` : null, link].filter(Boolean).join("   ")
+    if (detail) lines.push(c.dim(PAD + detail))
+  }
+  return lines
+}
+
+/** One line per change of a package, with the version, the date and the source under it. */
+export function uniqueChanges(changes) {
+  // One change can be recorded once per function it touches, with the same words: say it once.
+  const seen = new Set()
+  return changes.filter((change) => {
+    const key = `${change.kind}|${change.title}|${change.introducedIn || change.removedIn}`
+    if (seen.has(key)) return false
+    seen.add(key)
+    return true
+  })
+}
+
+export function changeLines(changes, c) {
+  const lines = []
+  for (const change of changes) {
+    const version = change.introducedIn || change.removedIn
+    lines.push(`  ${String(change.kind ?? "").replace(/_/g, " ").padEnd(19)}${change.title}`)
+    const evidence = Array.isArray(change.evidence) && change.evidence.length ? change.evidence[0].url : null
+    const detail = [version ? `in ${version}` : null, change.effectiveDate || null, evidence || null].filter(Boolean).join("   ")
+    if (detail) lines.push(c.dim(" ".repeat(21) + detail))
+  }
+  return lines
+}