@visulima/vis 1.0.0-alpha.1 → 1.0.0-alpha.11

package/dist/packem_chunks/handler29.js

@@ -0,0 +1,458 @@
+import { createRequire as __cjs_createRequire } from "node:module";
+
+const __cjs_require = __cjs_createRequire(import.meta.url);
+
+const __cjs_getProcess = typeof globalThis !== "undefined" && typeof globalThis.process !== "undefined" ? globalThis.process : process;
+
+const __cjs_getBuiltinModule = (module) => {
+    // Check if we're in Node.js and version supports getBuiltinModule
+    if (typeof __cjs_getProcess !== "undefined" && __cjs_getProcess.versions && __cjs_getProcess.versions.node) {
+        const [major, minor] = __cjs_getProcess.versions.node.split(".").map(Number);
+        // Node.js 20.16.0+ and 22.3.0+
+        if (major > 22 || (major === 22 && minor >= 3) || (major === 20 && minor >= 16)) {
+            return __cjs_getProcess.getBuiltinModule(module);
+        }
+    }
+    // Fallback to createRequire
+    return __cjs_require(module);
+};
+
+const {
+  createInterface
+} = __cjs_getBuiltinModule("node:readline");
+import { green, dim, red, yellow } from '@visulima/colorize';
+import { readJsonSync, writeJsonSync } from '@visulima/fs';
+import { findPackageManagerSync } from '@visulima/package';
+import { join } from '@visulima/path';
+import { coerce } from 'semver';
+import { r as resolveInstaller, F as runAdd, a as buildSocketOptions, p as pail, f as fetchSocketReports, d as discoverWorkspace, x as runInstall, t as findAcceptedRisk, G as formatReportSummary, H as scoreLabel, I as formatAcceptedRiskSnippet, J as getFullPackageName, j as scoreColor, D as DEFAULT_LOW_SCORE_THRESHOLD } from './bin.js';
+import { r as runTyposquatCheck } from '../packem_shared/typosquats-C-bCh3PX.js';
+import { r as readCatalogs } from '../packem_shared/catalog-BJTtyi-O.js';
+import { p as parsePackageArgument, t as toStringArray } from '../packem_shared/utils-CthVdBPS.js';
+
+const buildCatalogRef = (catalogName) => catalogName === "default" ? "catalog:" : `catalog:${catalogName}`;
+const labelForCatalog = (catalogName) => catalogName === "default" ? "default catalog" : `catalog "${catalogName}"`;
+const resolveFromCatalogs = (name, catalogs) => {
+  const matchedCatalogs = [];
+  for (const [key, deps] of catalogs) {
+    if (key.includes(":")) {
+      continue;
+    }
+    if (deps.has(name)) {
+      matchedCatalogs.push(key);
+    }
+  }
+  if (matchedCatalogs.length === 0) {
+    return void 0;
+  }
+  if (matchedCatalogs.length === 1) {
+    const [only] = matchedCatalogs;
+    return { source: labelForCatalog(only), spec: buildCatalogRef(only) };
+  }
+  const preferred = matchedCatalogs.find((c) => c === "default") ?? matchedCatalogs[0];
+  const others = matchedCatalogs.filter((c) => c !== preferred);
+  return {
+    candidates: [...matchedCatalogs],
+    conflict: true,
+    source: `${labelForCatalog(preferred)} (also in: ${others.map(labelForCatalog).join(", ")})`,
+    spec: buildCatalogRef(preferred)
+  };
+};
+const resolveFromSiblings = (name, catalogs) => {
+  const tally = /* @__PURE__ */ new Map();
+  for (const [key, deps] of catalogs) {
+    if (!key.includes(":")) {
+      continue;
+    }
+    const range = deps.get(name);
+    if (range !== void 0) {
+      tally.set(range, (tally.get(range) ?? 0) + 1);
+    }
+  }
+  if (tally.size === 0) {
+    return void 0;
+  }
+  const entries = [...tally.entries()];
+  const total = entries.reduce((a, [, count]) => a + count, 0);
+  if (entries.length === 1) {
+    const [[range]] = entries;
+    return {
+      source: `siblings (${String(total)} pkg${total === 1 ? "" : "s"} on ${range})`,
+      spec: range
+    };
+  }
+  const sorted = [...entries].sort((a, b) => b[1] - a[1]);
+  const [chosen, chosenCount] = sorted[0];
+  const others = sorted.slice(1).map(([range, count]) => `${range} (×${String(count)})`);
+  return {
+    candidates: sorted.map(([range]) => range),
+    conflict: true,
+    source: `siblings (most common: ${chosen} ×${String(chosenCount)}; conflicts: ${others.join(", ")})`,
+    spec: chosen
+  };
+};
+const conformToCatalog = (name, catalogs) => {
+  const fromCatalog = resolveFromCatalogs(name, catalogs);
+  if (fromCatalog) {
+    return fromCatalog;
+  }
+  return resolveFromSiblings(name, catalogs);
+};
+
+const resolveLatestVersions = async (packageNames, timeoutMs = 1e4) => {
+  const results = /* @__PURE__ */ new Map();
+  const controller = new AbortController();
+  const timeout = setTimeout(() => {
+    controller.abort();
+  }, timeoutMs);
+  try {
+    const fetches = packageNames.map(async (name) => {
+      try {
+        const response = await fetch(`https://registry.npmjs.org/${name}/latest`, {
+          headers: { Accept: "application/json" },
+          signal: controller.signal
+        });
+        if (response.ok) {
+          const data = await response.json();
+          if (data.version) {
+            results.set(name, data.version);
+          }
+        }
+      } catch {
+      }
+    });
+    await Promise.all(fetches);
+  } finally {
+    clearTimeout(timeout);
+  }
+  return results;
+};
+const displaySecurityReports = (reports, minimumScore, acceptedRisks) => {
+  const lowScorePackages = [];
+  for (const report of reports.values()) {
+    const { overall } = report.score;
+    const color = scoreColor(overall);
+    const pct = `${String(Math.round(overall * 100))}%`;
+    const alertCount = report.alerts.length;
+    const fullName = getFullPackageName(report);
+    const accepted = findAcceptedRisk(fullName, report.version, acceptedRisks);
+    const colorFunction = color === "red" ? red : color === "yellow" ? yellow : green;
+    if (accepted) {
+      pail.info(`  ${colorFunction(pct)} ${formatReportSummary(report)} ${dim(`[accepted: ${accepted.reason}]`)}`);
+    } else {
+      pail.info(`  ${colorFunction(pct)} ${formatReportSummary(report)}`);
+    }
+    if (alertCount > 0) {
+      const critHigh = report.alerts.filter((a) => a.severity === "critical" || a.severity === "high").length;
+      if (critHigh > 0) {
+        pail.warn(`    ${String(critHigh)} critical/high alert${critHigh === 1 ? "" : "s"}`);
+      }
+    }
+    if (overall < minimumScore && !accepted) {
+      lowScorePackages.push(report);
+    }
+  }
+  return lowScorePackages;
+};
+const confirmLowScorePackages = async (lowScorePackages, minimumScore) => {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const ask = (question) => new Promise((resolve) => {
+    rl.question(question, (answer2) => {
+      resolve(answer2.trim());
+    });
+  });
+  const pct = String(Math.round(minimumScore * 100));
+  pail.warn("");
+  pail.warn(`${String(lowScorePackages.length)} package${lowScorePackages.length === 1 ? "" : "s"} scored below the minimum threshold (${pct}%):`);
+  for (const report of lowScorePackages) {
+    const name = getFullPackageName(report);
+    const score = `${String(Math.round(report.score.overall * 100))}%`;
+    pail.warn(`  • ${name}@${report.version} — score: ${score} (${scoreLabel(report.score.overall)})`);
+  }
+  pail.warn("");
+  const answer = await ask("Continue adding these packages? [y/N] ");
+  if (answer.toLowerCase() !== "y" && answer.toLowerCase() !== "yes") {
+    rl.close();
+    return false;
+  }
+  const rememberAnswer = await ask("Remember this decision? (prints config snippet) [y/N] ");
+  rl.close();
+  if (rememberAnswer.toLowerCase() === "y" || rememberAnswer.toLowerCase() === "yes") {
+    pail.notice("");
+    pail.notice("Add the following to security.socket.acceptedRisks in vis.config.ts:");
+    pail.notice("");
+    for (const report of lowScorePackages) {
+      const fullName = getFullPackageName(report);
+      const snippet = formatAcceptedRiskSnippet(fullName, report.version, report.score.overall, "Reviewed and accepted");
+      pail.notice(snippet);
+    }
+    pail.notice("");
+  }
+  return true;
+};
+const runSocketPreCheck = async (packages, socketOptions, minimumScore, acceptedRisks) => {
+  const parsed = packages.map(parsePackageArgument);
+  const coercedSpecs = /* @__PURE__ */ new Map();
+  for (const p of parsed) {
+    if (p.versionSpec) {
+      const coerced = coerce(p.versionSpec);
+      if (coerced) {
+        coercedSpecs.set(p.name, coerced.version);
+      }
+    }
+  }
+  const needsResolution = parsed.filter((p) => !coercedSpecs.has(p.name)).map((p) => p.name);
+  const resolvedVersions = needsResolution.length > 0 ? await resolveLatestVersions(needsResolution) : /* @__PURE__ */ new Map();
+  const lookupPackages = [];
+  for (const p of parsed) {
+    const version = coercedSpecs.get(p.name) ?? resolvedVersions.get(p.name);
+    if (version) {
+      lookupPackages.push({ name: p.name, version });
+    }
+  }
+  if (lookupPackages.length === 0) {
+    return true;
+  }
+  pail.info("");
+  pail.info("Socket.dev security check:");
+  const reports = await fetchSocketReports(lookupPackages, socketOptions);
+  if (reports.size === 0) {
+    pail.info("  Could not fetch security data. Proceeding.");
+    return true;
+  }
+  const lowScorePackages = displaySecurityReports(reports, minimumScore, acceptedRisks);
+  if (lowScorePackages.length === 0) {
+    pail.info("");
+    return true;
+  }
+  if (!process.stdin.isTTY) {
+    pail.warn(
+      `Aborting: ${String(lowScorePackages.length)} package${lowScorePackages.length === 1 ? "" : "s"} below minimum score. Use --no-socket-check to skip.`
+    );
+    return false;
+  }
+  return confirmLowScorePackages(lowScorePackages, minimumScore);
+};
+const SIBLING_SECTIONS = ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"];
+const pickDepSection = (options) => {
+  if (options.savePeer) {
+    return "peerDependencies";
+  }
+  if (options.saveOptional) {
+    return "optionalDependencies";
+  }
+  if (options.saveDev) {
+    return "devDependencies";
+  }
+  return "dependencies";
+};
+const applyExactPrefix = (spec, exact) => {
+  if (spec.startsWith("catalog:")) {
+    return spec;
+  }
+  if (!exact) {
+    return spec;
+  }
+  return spec.replace(/^[\^~]/, "");
+};
+const planConformedSpecs = async (packages, catalogs) => {
+  const slots = [];
+  for (const argument of packages) {
+    const { name, versionSpec } = parsePackageArgument(argument);
+    if (!name) {
+      continue;
+    }
+    if (versionSpec !== void 0) {
+      slots.push({ explicit: versionSpec, name });
+      continue;
+    }
+    const conformed = conformToCatalog(name, catalogs);
+    if (conformed) {
+      if (conformed.conflict) {
+        pail.warn(`${name}: ambiguous constraint — picking ${conformed.spec} (${conformed.source}). Pass ${name}@<version> to override.`);
+      }
+      slots.push({ entry: { name, source: conformed.source, spec: conformed.spec }, kind: "resolved", name });
+      continue;
+    }
+    slots.push({ kind: "missing", name });
+  }
+  const missingNames = slots.filter((s) => "kind" in s && s.kind === "missing").map((s) => s.name);
+  const latest = missingNames.length > 0 ? await resolveLatestVersions(missingNames) : /* @__PURE__ */ new Map();
+  return slots.map((slot) => {
+    if ("explicit" in slot) {
+      return { name: slot.name, source: "explicit", spec: slot.explicit };
+    }
+    if (slot.kind === "resolved") {
+      return slot.entry;
+    }
+    const version = latest.get(slot.name);
+    if (version === void 0) {
+      throw new Error(`--to: cannot resolve a version for "${slot.name}" (not in any catalog or sibling, and registry lookup failed). Pass ${slot.name}@<version> explicitly.`);
+    }
+    const spec = `^${version}`;
+    pail.info(`${slot.name}: no existing constraint — using registry latest (${spec}). Add to a catalog to share this version across workspace packages.`);
+    return { name: slot.name, source: "registry latest", spec };
+  });
+};
+const applyPlannedSpecsToPackageJson = (pkgJson, planned, section, exact) => {
+  for (const { name, spec } of planned) {
+    const finalSpec = applyExactPrefix(spec, exact);
+    for (const otherSection of SIBLING_SECTIONS) {
+      if (otherSection === section) {
+        continue;
+      }
+      const block2 = pkgJson[otherSection];
+      if (block2?.[name] !== void 0) {
+        delete block2[name];
+        if (Object.keys(block2).length === 0) {
+          delete pkgJson[otherSection];
+        }
+      }
+    }
+    let block = pkgJson[section];
+    if (block === void 0) {
+      block = {};
+      pkgJson[section] = block;
+    }
+    block[name] = finalSpec;
+  }
+};
+const applyConformedAdd = async ({
+  ignoreScripts,
+  logger,
+  options,
+  packages,
+  pm,
+  target,
+  visConfig,
+  workspaceRoot
+}) => {
+  const { workspace } = discoverWorkspace(workspaceRoot, visConfig ?? {});
+  const project = workspace.projects[target];
+  if (!project) {
+    const available = Object.keys(workspace.projects).sort();
+    throw new Error(
+      `--to: workspace package "${target}" not found. Available: ${available.length > 0 ? available.slice(0, 10).join(", ") : "(none)"}${available.length > 10 ? `, ... (${String(available.length - 10)} more)` : ""}.`
+    );
+  }
+  const targetPkgPath = join(workspaceRoot, project.root, "package.json");
+  const { packageManager } = findPackageManagerSync(workspaceRoot);
+  const catalogs = readCatalogs(workspaceRoot, packageManager);
+  const section = pickDepSection(options);
+  const exact = options.exact ?? false;
+  const planned = await planConformedSpecs(packages, catalogs);
+  if (planned.length === 0) {
+    return 0;
+  }
+  const pkgJson = readJsonSync(targetPkgPath);
+  applyPlannedSpecsToPackageJson(pkgJson, planned, section, exact);
+  writeJsonSync(targetPkgPath, pkgJson, { detectIndent: true, overwrite: true });
+  for (const entry of planned) {
+    const finalSpec = applyExactPrefix(entry.spec, exact);
+    pail.info(`${green("+")} ${entry.name}@${finalSpec} → ${target}/${section} (${dim(entry.source)})`);
+  }
+  return runInstall(
+    pm,
+    {
+      dev: false,
+      filter: [],
+      force: false,
+      frozenLockfile: false,
+      ignoreScripts,
+      lockfileOnly: false,
+      noOptional: false,
+      offline: false,
+      prod: false,
+      recursive: false,
+      silent: false,
+      workspaceRoot: false
+    },
+    workspaceRoot,
+    logger
+  );
+};
+const execute = async ({ argument, logger, options, visConfig, workspaceRoot: wsRoot }) => {
+  let packages = argument;
+  if (!packages || packages.length === 0) {
+    throw new Error("No packages specified. Usage: vis add <packages...>");
+  }
+  if (!options.noTyposquatCheck) {
+    const parsed = packages.map((p) => parsePackageArgument(p));
+    const result = await runTyposquatCheck(
+      parsed.map((p) => p.name),
+      visConfig?.security?.typosquatAllowlist
+    );
+    if (!result.ok) {
+      process.exitCode = 1;
+      return;
+    }
+    packages = parsed.map((p, i) => {
+      const corrected = result.packages[i];
+      if (corrected !== p.name) {
+        return p.versionSpec ? `${corrected}@${p.versionSpec}` : corrected ?? "";
+      }
+      return packages[i] ?? "";
+    });
+  }
+  if (!options.noSocketCheck) {
+    const socketOptions = buildSocketOptions(visConfig?.security?.socket);
+    if (socketOptions) {
+      const minimumScore = socketOptions.minimumScore ?? DEFAULT_LOW_SCORE_THRESHOLD;
+      const shouldContinue = await runSocketPreCheck(packages, socketOptions, minimumScore, visConfig?.security?.socket?.acceptedRisks);
+      if (!shouldContinue) {
+        process.exitCode = 1;
+        return;
+      }
+    }
+  }
+  const cwd = process.cwd();
+  const pm = resolveInstaller(wsRoot ?? cwd, { configBackend: visConfig?.install?.backend });
+  const ignoreScripts = !options.runScripts;
+  if (options.to) {
+    if (options.global || options.workspaceRoot) {
+      throw new Error("--to is incompatible with --global / --workspace-root.");
+    }
+    if (options.filter && toStringArray(options.filter).length > 0) {
+      throw new Error("--to and --filter are mutually exclusive — --to already targets one package.");
+    }
+    if (!wsRoot) {
+      throw new Error("--to requires a monorepo workspace. Run from inside a pnpm/bun/yarn/npm workspace.");
+    }
+    const code2 = await applyConformedAdd({
+      ignoreScripts,
+      logger,
+      options,
+      packages,
+      pm,
+      target: options.to,
+      visConfig,
+      workspaceRoot: wsRoot
+    });
+    if (code2 !== 0) {
+      process.exitCode = code2;
+    }
+    return;
+  }
+  const code = runAdd(
+    pm,
+    {
+      exact: options.exact || false,
+      filter: toStringArray(options.filter),
+      global: options.global || false,
+      optional: options.saveOptional || false,
+      packages,
+      peer: options.savePeer || false,
+      saveDev: options.saveDev || false,
+      workspace: options.workspace || false,
+      workspaceRoot: options.workspaceRoot || false
+    },
+    cwd,
+    logger,
+    { ignoreScripts }
+  );
+  if (code !== 0) {
+    process.exitCode = code;
+  }
+};
+
+export { execute as default };

package/dist/packem_chunks/handler3.js

@@ -0,0 +1,95 @@
+import { findPackageManagerSync } from '@visulima/package';
+import { v as validateAnalysisType, r as runAiAnalysis, f as formatAiAnalysis } from '../packem_shared/ai-analysis-CHeB1joD.js';
+import { f as fetchSocketReports, a as buildSocketOptions } from './bin.js';
+import { r as readCatalogs, f as fetchPackageVersions, p as parseVersion, a as fetchVulnerabilities, g as getUpdateType, e as extractPrefix } from '../packem_shared/catalog-BJTtyi-O.js';
+
+const VERSION_PREFIX_REGEX = /^[\^~>=<]+/;
+const execute = async ({ argument, logger, options, visConfig, workspaceRoot: wsRoot }) => {
+  if (!wsRoot) {
+    throw new Error("Could not determine workspace root. Run this command inside a monorepo.");
+  }
+  const positionalArguments = argument;
+  const packageName = positionalArguments[0];
+  if (!packageName) {
+    throw new Error("Package name is required. Usage: vis analyze <package> [version]");
+  }
+  const targetVersionArgument = positionalArguments[1];
+  const { packageManager } = findPackageManagerSync(wsRoot);
+  let currentRange;
+  let catalogName = "default";
+  const catalogs = readCatalogs(wsRoot, packageManager);
+  for (const [name, deps] of catalogs) {
+    const range = deps.get(packageName);
+    if (range) {
+      currentRange = range;
+      catalogName = name;
+      break;
+    }
+  }
+  if (!currentRange) {
+    throw new Error(`Package "${packageName}" not found in any catalog or package.json. Make sure it exists in your workspace dependencies.`);
+  }
+  let targetVersion;
+  if (targetVersionArgument) {
+    targetVersion = targetVersionArgument;
+  } else {
+    logger.info(`Fetching latest version for ${packageName}...
+`);
+    const info = await fetchPackageVersions(packageName);
+    if (!info.latest) {
+      throw new Error(`Could not determine latest version for "${packageName}".`);
+    }
+    targetVersion = info.latest;
+  }
+  const current = parseVersion(currentRange);
+  const target = parseVersion(targetVersion);
+  if (!current || !target) {
+    throw new Error(`Could not parse versions: current="${currentRange}", target="${targetVersion}".`);
+  }
+  const updateType = getUpdateType(current, target);
+  if (updateType === "none") {
+    logger.info(`${packageName} is already at ${targetVersion}. Nothing to analyze.`);
+    return;
+  }
+  const prefix = extractPrefix(currentRange);
+  const entry = {
+    catalogName,
+    currentRange,
+    newRange: `${prefix}${targetVersion}`,
+    packageName,
+    targetVersion,
+    updateType
+  };
+  const analysisType = validateAnalysisType(options.aiType ?? "impact");
+  if (analysisType === "security" || options.security) {
+    logger.info("Checking for known vulnerabilities...\n");
+    const version = currentRange.replace(VERSION_PREFIX_REGEX, "");
+    const vulnMap = await fetchVulnerabilities([{ name: packageName, version }]);
+    const vulns = vulnMap.get(packageName);
+    if (vulns && vulns.length > 0) {
+      entry.vulnerabilities = vulns;
+    }
+    const socketOptions = buildSocketOptions(visConfig?.security?.socket);
+    if (socketOptions) {
+      const reports = await fetchSocketReports([{ name: packageName, version }], socketOptions);
+      const report = reports.get(`${packageName}@${version}`);
+      if (report) {
+        entry.socketReport = {
+          alerts: report.alerts,
+          license: report.license,
+          score: report.score
+        };
+      }
+    }
+  }
+  const result = await runAiAnalysis([entry], logger, visConfig?.ai, analysisType);
+  const format = options.format ?? "table";
+  if (format === "json") {
+    process.stdout.write(`${JSON.stringify(result, void 0, 2)}
+`);
+  } else {
+    logger.info(formatAiAnalysis(result));
+  }
+};
+
+export { execute as default };