@visulima/vis 1.0.0-alpha.2 → 1.0.0-alpha.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (103) hide show
  1. package/CHANGELOG.md +136 -14
  2. package/LICENSE.md +27 -0
  3. package/README.md +15 -9
  4. package/dist/audit-config.d.ts +24 -0
  5. package/dist/bin.js +777 -70
  6. package/dist/catalog.d.ts +16 -8
  7. package/dist/commands/add.d.ts +3 -0
  8. package/dist/commands/approve-builds.d.ts +3 -0
  9. package/dist/commands/audit.d.ts +23 -0
  10. package/dist/commands/clean.d.ts +3 -0
  11. package/dist/commands/create/discovery.d.ts +42 -0
  12. package/dist/commands/create/index.d.ts +13 -0
  13. package/dist/commands/create/prompts.d.ts +31 -0
  14. package/dist/commands/create/random-name.d.ts +15 -0
  15. package/dist/commands/create/templates/builtin.d.ts +15 -0
  16. package/dist/commands/create/templates/generator.d.ts +14 -0
  17. package/dist/commands/create/templates/index.d.ts +13 -0
  18. package/dist/commands/create/templates/monorepo.d.ts +16 -0
  19. package/dist/commands/create/templates/remote.d.ts +41 -0
  20. package/dist/commands/create/templates/types.d.ts +46 -0
  21. package/dist/commands/create/utils.d.ts +42 -0
  22. package/dist/commands/dedupe.d.ts +3 -0
  23. package/dist/commands/devcontainer.d.ts +3 -0
  24. package/dist/commands/dlx.d.ts +3 -0
  25. package/dist/commands/doctor.d.ts +15 -0
  26. package/dist/commands/exec.d.ts +3 -0
  27. package/dist/commands/implode.d.ts +3 -0
  28. package/dist/commands/init.d.ts +14 -0
  29. package/dist/commands/install.d.ts +3 -0
  30. package/dist/commands/link.d.ts +3 -0
  31. package/dist/commands/optimize.d.ts +38 -0
  32. package/dist/commands/pm.d.ts +3 -0
  33. package/dist/commands/remove.d.ts +3 -0
  34. package/dist/commands/sort-package-json.d.ts +3 -0
  35. package/dist/commands/unlink.d.ts +3 -0
  36. package/dist/commands/upgrade.d.ts +3 -0
  37. package/dist/commands/why.d.ts +3 -0
  38. package/dist/config.d.ts +38 -11
  39. package/dist/config.js +1 -1
  40. package/dist/native-binding.d.ts +151 -0
  41. package/dist/output.d.ts +40 -0
  42. package/dist/overrides.d.ts +82 -0
  43. package/dist/plugins/config-loader.d.ts +3 -0
  44. package/dist/plugins/post-command.d.ts +3 -0
  45. package/dist/plugins/security-enforcement.d.ts +3 -0
  46. package/dist/pm-runner.d.ts +23 -0
  47. package/dist/security.d.ts +64 -0
  48. package/dist/socket-security.d.ts +129 -0
  49. package/dist/tips.d.ts +41 -0
  50. package/dist/tui/components/CheckProgressApp.d.ts +6 -0
  51. package/dist/tui/components/CommandSummary.d.ts +17 -0
  52. package/dist/tui/components/Header.d.ts +13 -0
  53. package/dist/tui/components/OutputPanel.d.ts +16 -0
  54. package/dist/tui/components/QuitDialog.d.ts +15 -0
  55. package/dist/tui/components/TaskListPanel.d.ts +19 -0
  56. package/dist/tui/components/TaskRow.d.ts +12 -0
  57. package/dist/tui/components/TaskStore.d.ts +80 -0
  58. package/dist/tui/components/VisTaskRunnerApp.d.ts +17 -0
  59. package/dist/tui/components/devcontainer/DevcontainerStore.d.ts +66 -0
  60. package/dist/tui/components/devcontainer/VisDevcontainerApp.d.ts +9 -0
  61. package/dist/tui/components/devcontainer/catalogs/extensions.d.ts +8 -0
  62. package/dist/tui/components/devcontainer/catalogs/features.d.ts +8 -0
  63. package/dist/tui/components/devcontainer/catalogs/filters.d.ts +4 -0
  64. package/dist/tui/components/devcontainer/catalogs/mount-suggestions.d.ts +19 -0
  65. package/dist/tui/components/devcontainer/catalogs/templates.d.ts +8 -0
  66. package/dist/tui/components/devcontainer/devcontainer-io.d.ts +14 -0
  67. package/dist/tui/components/devcontainer/sections/DockerComposeSection.d.ts +11 -0
  68. package/dist/tui/components/devcontainer/sections/EnvironmentSection.d.ts +16 -0
  69. package/dist/tui/components/devcontainer/sections/ExtensionsSection.d.ts +11 -0
  70. package/dist/tui/components/devcontainer/sections/FeaturesSection.d.ts +11 -0
  71. package/dist/tui/components/devcontainer/sections/GeneralSection.d.ts +12 -0
  72. package/dist/tui/components/devcontainer/sections/LifecycleSection.d.ts +13 -0
  73. package/dist/tui/components/devcontainer/sections/MountsSection.d.ts +16 -0
  74. package/dist/tui/components/devcontainer/sections/PortsSection.d.ts +10 -0
  75. package/dist/tui/components/devcontainer/sections/PreviewPanel.d.ts +11 -0
  76. package/dist/tui/components/devcontainer/types.d.ts +53 -0
  77. package/dist/tui/components/devcontainer/validate.d.ts +16 -0
  78. package/dist/tui/components/graph/GraphStore.d.ts +42 -0
  79. package/dist/tui/components/graph/ProjectDetailPanel.d.ts +10 -0
  80. package/dist/tui/components/graph/ProjectListPanel.d.ts +20 -0
  81. package/dist/tui/components/graph/VisGraphApp.d.ts +8 -0
  82. package/dist/tui/components/optimize/OptimizeDetailPanel.d.ts +9 -0
  83. package/dist/tui/components/optimize/OptimizeListPanel.d.ts +16 -0
  84. package/dist/tui/components/optimize/OptimizeStore.d.ts +50 -0
  85. package/dist/tui/components/optimize/VisOptimizeApp.d.ts +8 -0
  86. package/dist/tui/components/optimize/constants.d.ts +7 -0
  87. package/dist/tui/components/update/PackageDetailPanel.d.ts +12 -0
  88. package/dist/tui/components/update/PackageListPanel.d.ts +18 -0
  89. package/dist/tui/components/update/UpdateStore.d.ts +62 -0
  90. package/dist/tui/components/update/VisUpdateApp.d.ts +11 -0
  91. package/dist/tui/dynamic-life-cycle.d.ts +21 -0
  92. package/dist/tui/formatting-utils.d.ts +17 -0
  93. package/dist/tui/pretty-time.d.ts +8 -0
  94. package/dist/tui/static-life-cycle.d.ts +22 -0
  95. package/dist/tui/status-utils.d.ts +20 -0
  96. package/dist/tui/symbols.d.ts +7 -0
  97. package/dist/tui/types.d.ts +11 -0
  98. package/dist/typosquats.d.ts +70 -0
  99. package/dist/upgrade-check.d.ts +30 -0
  100. package/dist/utils.d.ts +22 -0
  101. package/dist/workspace.d.ts +262 -5
  102. package/index.js +600 -0
  103. package/package.json +34 -11
@@ -0,0 +1,151 @@
1
+ /**
2
+ * Native bindings for vis PM operations.
3
+ *
4
+ * The native addon (Rust via napi-rs) provides:
5
+ * - Fast package manager detection (lockfile scanning)
6
+ * - Zero-overhead command resolution across pnpm/npm/yarn/bun
7
+ * - Native process execution via Rust std::process::Command
8
+ * - Binary lookup via `which`
9
+ *
10
+ * Falls back to pure TypeScript implementations when the native
11
+ * addon is not available (not compiled, wrong platform, etc.).
12
+ *
13
+ * Build with: napi build --platform --release --manifest-path native/Cargo.toml --output-dir .
14
+ */
15
+ interface DetectedPackageManager {
16
+ isWorkspace: boolean;
17
+ name: string;
18
+ /** Version from packageManager field, or undefined if unknown */
19
+ version?: string;
20
+ }
21
+ interface ResolvedCommand {
22
+ args: string[];
23
+ bin: string;
24
+ warnings: string[];
25
+ }
26
+ interface ExecResult {
27
+ code: number;
28
+ stderr: string;
29
+ stdout: string;
30
+ }
31
+ interface InstallOptions {
32
+ dev: boolean;
33
+ filter: string[];
34
+ force: boolean;
35
+ frozenLockfile: boolean;
36
+ ignoreScripts: boolean;
37
+ lockfileOnly: boolean;
38
+ noOptional: boolean;
39
+ offline: boolean;
40
+ prod: boolean;
41
+ recursive: boolean;
42
+ silent: boolean;
43
+ workspaceRoot: boolean;
44
+ }
45
+ interface AddOptions {
46
+ exact: boolean;
47
+ filter: string[];
48
+ global: boolean;
49
+ optional: boolean;
50
+ packages: string[];
51
+ peer: boolean;
52
+ saveDev: boolean;
53
+ workspace: boolean;
54
+ workspaceRoot: boolean;
55
+ }
56
+ interface RemoveOptions {
57
+ filter: string[];
58
+ global: boolean;
59
+ packages: string[];
60
+ recursive: boolean;
61
+ saveDev: boolean;
62
+ workspaceRoot: boolean;
63
+ }
64
+ interface WhyOptions {
65
+ /** Uses Option<i32> in Rust - pass undefined for no depth limit (not null!) */
66
+ depth?: number;
67
+ dev: boolean;
68
+ filter: string[];
69
+ global: boolean;
70
+ json: boolean;
71
+ long: boolean;
72
+ noOptional: boolean;
73
+ packages: string[];
74
+ parseable: boolean;
75
+ prod: boolean;
76
+ recursive: boolean;
77
+ }
78
+ interface OutdatedOptions {
79
+ compatible: boolean;
80
+ dev: boolean;
81
+ filter: string[];
82
+ format: string;
83
+ global: boolean;
84
+ long: boolean;
85
+ noOptional: boolean;
86
+ packages: string[];
87
+ prod: boolean;
88
+ recursive: boolean;
89
+ workspaceRoot: boolean;
90
+ }
91
+ interface DlxOptions {
92
+ additionalPackages: string[];
93
+ args: string[];
94
+ package: string;
95
+ shellMode: boolean;
96
+ silent: boolean;
97
+ }
98
+ interface ExecOptions {
99
+ args: string[];
100
+ command: string;
101
+ filter: string[];
102
+ parallel: boolean;
103
+ recursive: boolean;
104
+ reverse: boolean;
105
+ shellMode: boolean;
106
+ workspaceRoot: boolean;
107
+ }
108
+ interface CleanResult {
109
+ errors: string[];
110
+ lockfilesRemoved: string[];
111
+ removed: string[];
112
+ }
113
+ interface SortPackageJsonOptions {
114
+ /** Enable formatted output with newlines (default: true) */
115
+ pretty?: boolean;
116
+ /** Alphabetize script commands (default: false) */
117
+ sort_scripts?: boolean;
118
+ }
119
+ interface NativeBindings {
120
+ cleanWorkspace: (root: string, removeLockfile: boolean) => CleanResult;
121
+ detectPackageManager: (cwd: string) => DetectedPackageManager;
122
+ execPmCommand: (bin: string, args: string[], cwd: string) => ExecResult;
123
+ execPmCommandInteractive: (bin: string, args: string[], cwd: string) => number;
124
+ resolveAdd: (pm: string, version: string, options: AddOptions) => ResolvedCommand;
125
+ resolveDedupe: (pm: string, version: string, check: boolean) => ResolvedCommand;
126
+ resolveDlx: (pm: string, version: string, options: DlxOptions) => ResolvedCommand;
127
+ resolveExec: (pm: string, version: string, options: ExecOptions) => ResolvedCommand;
128
+ resolveInstall: (pm: string, version: string, options: InstallOptions) => ResolvedCommand;
129
+ resolveLink: (pm: string, target: string | null) => ResolvedCommand;
130
+ resolveOutdated: (pm: string, version: string, options: OutdatedOptions) => ResolvedCommand;
131
+ resolvePmCommand: (pm: string, version: string, subcommand: string, extraArgs: string[]) => ResolvedCommand;
132
+ resolveRemove: (pm: string, version: string, options: RemoveOptions) => ResolvedCommand;
133
+ resolveUnlink: (pm: string, version: string, packages: string[], recursive: boolean) => ResolvedCommand;
134
+ resolveWhy: (pm: string, version: string, options: WhyOptions) => ResolvedCommand;
135
+ sortPackageJsonString: (contents: string) => string;
136
+ sortPackageJsonStringWithOptions: (contents: string, options: SortPackageJsonOptions) => string;
137
+ whichBin: (name: string) => string | null;
138
+ }
139
+ /**
140
+ * Attempts to load the native addon. Returns undefined if unavailable.
141
+ * The result is cached after the first attempt.
142
+ *
143
+ * Uses createRequire because the napi-generated index.js is CJS.
144
+ */
145
+ declare const loadNativeBindings: () => NativeBindings | undefined;
146
+ /**
147
+ * Returns true if the native addon is loaded and available.
148
+ */
149
+ declare const isNativeAvailable: () => boolean;
150
+ export type { AddOptions, CleanResult, DetectedPackageManager, DlxOptions, ExecOptions, ExecResult, InstallOptions, NativeBindings, OutdatedOptions, RemoveOptions, ResolvedCommand, SortPackageJsonOptions, WhyOptions, };
151
+ export { isNativeAvailable, loadNativeBindings };
@@ -0,0 +1,40 @@
1
+ declare const bold: (s: string) => string;
2
+ declare const dim: (s: string) => string;
3
+ declare const red: (s: string) => string;
4
+ declare const green: (s: string) => string;
5
+ declare const yellow: (s: string) => string;
6
+ declare const cyan: (s: string) => string;
7
+ declare const SYMBOLS: {
8
+ readonly arrow: string;
9
+ readonly dash: string;
10
+ readonly failure: string;
11
+ readonly success: string;
12
+ readonly warning: string;
13
+ };
14
+ /** Informational message with blue bold `info:` prefix */
15
+ declare const info: (message: string) => void;
16
+ /** Warning with yellow bold `warn:` prefix */
17
+ declare const warn: (message: string) => void;
18
+ /** Error with red bold `error:` prefix */
19
+ declare const error: (message: string) => void;
20
+ /** Supplementary information with gray bold `note:` prefix */
21
+ declare const note: (message: string) => void;
22
+ /** Success line with green checkmark */
23
+ declare const success: (message: string) => void;
24
+ /** Failure line with red X */
25
+ declare const failure: (message: string) => void;
26
+ /**
27
+ * Creates a clickable terminal hyperlink using `@visulima/ansi` OSC 8
28
+ * implementation. Falls back to "text (url)" when not in a TTY.
29
+ */
30
+ declare const link: (text: string, url: string) => string;
31
+ /**
32
+ * Sets the VIS_VERSION environment variable for child processes.
33
+ */
34
+ declare const injectVersion: () => void;
35
+ /**
36
+ * Set the terminal window title using OSC 0 escape sequence.
37
+ * No-op when stdout is not a TTY, running in CI, or TERM=dumb.
38
+ */
39
+ declare const setTerminalTitle: (title: string) => void;
40
+ export { bold, cyan, dim, error, failure, green, info, injectVersion, link, note, red, setTerminalTitle, success, SYMBOLS, warn, yellow };
@@ -0,0 +1,82 @@
1
+ /**
2
+ * Package manager override and resolution management.
3
+ *
4
+ * Handles the correct override location for each package manager:
5
+ * - **pnpm v10+**: top-level `overrides` in `pnpm-workspace.yaml`
6
+ * - **pnpm v9-**: `pnpm.overrides` in `package.json`
7
+ * - **npm**: `overrides` in `package.json` (uses `$<name>` references
8
+ * for direct dependencies to avoid EOVERRIDE errors)
9
+ * - **yarn / bun**: `resolutions` in `package.json`
10
+ *
11
+ * All overrides are root-level — no PM supports per-workspace overrides.
12
+ * @see https://pnpm.io/settings — pnpm v10+ workspace settings
13
+ * @see https://docs.npmjs.com/cli/v10/configuring-npm/package-json#overrides
14
+ * @see https://yarnpkg.com/configuration/manifest#resolutions
15
+ * @see https://bun.sh/docs/pm/overrides
16
+ */
17
+ /** Supported package manager names. */
18
+ type PackageManagerName = "bun" | "npm" | "pnpm" | "yarn";
19
+ /** Package manager identity with version for PM-specific behavior. */
20
+ interface PmInfo {
21
+ name: PackageManagerName;
22
+ version: string;
23
+ }
24
+ /** A single override entry mapping an original package to its replacement spec. */
25
+ interface OverrideEntry {
26
+ /** The original package name being overridden (e.g., `"is-regex"`). */
27
+ original: string;
28
+ /** The npm alias spec (e.g., `"npm:@socketregistry/is-regex@^1"`). */
29
+ spec: string;
30
+ }
31
+ /** Result of reading existing overrides from the project. */
32
+ interface OverridesResult {
33
+ /** Current overrides — values may be strings or nested objects (npm supports nested overrides). */
34
+ overrides: Record<string, string | Record<string, string>>;
35
+ /** The file where overrides are stored. */
36
+ source: "package.json" | "pnpm-workspace.yaml";
37
+ }
38
+ /** Result of applying override entries. */
39
+ interface ApplyOverridesResult {
40
+ /** Package names that were newly added. */
41
+ added: string[];
42
+ /** Package names whose specs were changed. */
43
+ updated: string[];
44
+ }
45
+ /**
46
+ * Reads existing overrides for the detected package manager, choosing
47
+ * `pnpm-workspace.yaml` for pnpm v10+ and `package.json` for everything else.
48
+ */
49
+ declare const readOverrides: (workspaceRoot: string, pkgJson: Record<string, unknown>, pm: PmInfo) => OverridesResult;
50
+ /**
51
+ * Applies override entries to the correct config file for the package manager.
52
+ *
53
+ * For npm, direct dependencies use `$&lt;name>` reference syntax to avoid
54
+ * npm's EOVERRIDE error when an override conflicts with a direct dep range.
55
+ * @param workspaceRoot Absolute path to the workspace root directory.
56
+ * @param pkgJsonPath Absolute path to the root `package.json`.
57
+ * @param entries Override entries to apply.
58
+ * @param pm Package manager name and version.
59
+ * @returns Lists of added and updated package names.
60
+ */
61
+ declare const applyOverrides: (workspaceRoot: string, pkgJsonPath: string, entries: OverrideEntry[], pm: PmInfo) => ApplyOverridesResult;
62
+ /**
63
+ * Reads the lockfile text for a workspace root.
64
+ *
65
+ * Returns the raw text content for regex-based package name scanning.
66
+ * Falls back to an empty string if the lockfile is missing or unreadable.
67
+ * @param workspaceRoot Absolute path to the workspace root.
68
+ * @param pm Package manager name (determines lockfile name).
69
+ */
70
+ declare const readLockfileText: (workspaceRoot: string, pm: PackageManagerName) => string;
71
+ /**
72
+ * Checks if a package name appears in the lockfile text using PM-specific string patterns.
73
+ *
74
+ * This avoids parsing the entire lockfile — a single `string.includes()` is
75
+ * sufficient for presence checks.
76
+ * @param lockText Raw lockfile content.
77
+ * @param packageName Package name to search for.
78
+ * @param pm Package manager name (determines the search pattern).
79
+ */
80
+ declare const lockfileContainsPackage: (lockText: string, packageName: string, pm: PackageManagerName) => boolean;
81
+ export type { ApplyOverridesResult, OverrideEntry, OverridesResult, PackageManagerName, PmInfo };
82
+ export { applyOverrides, lockfileContainsPackage, readLockfileText, readOverrides };
@@ -0,0 +1,3 @@
1
+ import type { Plugin } from "@visulima/cerebro";
2
+ declare const configLoaderPlugin: Plugin;
3
+ export default configLoaderPlugin;
@@ -0,0 +1,3 @@
1
+ import type { Plugin } from "@visulima/cerebro";
2
+ declare const postCommandPlugin: (upgradeCheckCallback?: () => void) => Plugin;
3
+ export default postCommandPlugin;
@@ -0,0 +1,3 @@
1
+ import type { Plugin } from "@visulima/cerebro";
2
+ declare const securityEnforcementPlugin: Plugin;
3
+ export default securityEnforcementPlugin;
@@ -0,0 +1,23 @@
1
+ /**
2
+ * Shared helper for executing package manager commands via native Rust bindings.
3
+ * Falls back to JS-based detection when native bindings are unavailable.
4
+ */
5
+ import type { AddOptions, DlxOptions, ExecOptions, InstallOptions, OutdatedOptions, RemoveOptions, WhyOptions } from "./native-binding.d.ts";
6
+ interface PmInfo {
7
+ name: "bun" | "npm" | "pnpm" | "yarn";
8
+ version: string;
9
+ }
10
+ declare const detectPm: (cwd: string) => PmInfo;
11
+ declare const runInstall: (pm: PmInfo, options: InstallOptions, cwd: string, logger: Console) => number;
12
+ declare const runAdd: (pm: PmInfo, options: AddOptions, cwd: string, logger: Console) => number;
13
+ declare const runRemove: (pm: PmInfo, options: RemoveOptions, cwd: string, logger: Console) => number;
14
+ declare const runDedupe: (pm: PmInfo, check: boolean, cwd: string, logger: Console) => number;
15
+ declare const runWhy: (pm: PmInfo, options: WhyOptions, cwd: string, logger: Console) => number;
16
+ declare const runOutdated: (pm: PmInfo, options: OutdatedOptions, cwd: string, logger: Console) => number;
17
+ declare const runLink: (pm: PmInfo, target: string | null, cwd: string, logger: Console) => number;
18
+ declare const runUnlink: (pm: PmInfo, packages: string[], recursive: boolean, cwd: string, logger: Console) => number;
19
+ declare const runDlx: (pm: PmInfo, options: DlxOptions, cwd: string, logger: Console) => number;
20
+ declare const runExec: (pm: PmInfo, options: ExecOptions, cwd: string, logger: Console) => number;
21
+ declare const runPmSubcommand: (pm: PmInfo, subcommand: string, args: string[], cwd: string, logger: Console) => number;
22
+ export type { PmInfo };
23
+ export { detectPm, runAdd, runDedupe, runDlx, runExec, runInstall, runLink, runOutdated, runPmSubcommand, runRemove, runUnlink, runWhy };
@@ -0,0 +1,64 @@
1
+ /**
2
+ * Supply chain security for package management commands.
3
+ *
4
+ * Ports pnpm's security features (minimumReleaseAge, trustPolicy,
5
+ * allowBuilds, blockExoticSubdeps, strictDepBuilds) to work universally
6
+ * across all package managers.
7
+ *
8
+ * Support matrix for build script enforcement:
9
+ * - pnpm v10+: Native `allowBuilds` in pnpm-workspace.yaml (vis validates config)
10
+ * - bun: Native `trustedDependencies` in package.json (vis validates config)
11
+ * - npm: NO native allowlist. vis adds --ignore-scripts and runs approved scripts manually
12
+ * - yarn: NO native allowlist. vis checks enableScripts in .yarnrc.yml
13
+ */
14
+ import type { VisConfig } from "./workspace.d.ts";
15
+ type PackageManagerName = "bun" | "npm" | "pnpm" | "yarn";
16
+ interface SecurityCheckResult {
17
+ errors: string[];
18
+ warnings: string[];
19
+ }
20
+ /**
21
+ * Checks the vis config for recommended security settings.
22
+ *
23
+ * When `defineConfig()` or `loadVisConfig()` is used, secure defaults are already
24
+ * merged. This function validates the *final* config (defaults + user overrides)
25
+ * and flags remaining gaps — primarily `allowBuilds`, which must be user-supplied.
26
+ */
27
+ declare const checkSecurityConfig: (config: VisConfig, packageManager: string) => SecurityCheckResult;
28
+ /**
29
+ * Emits a single-line security summary warning before PM commands.
30
+ * Skipped in CI unless VIS_SECURITY_WARNINGS=1.
31
+ */
32
+ declare const emitSecurityWarnings: (config: VisConfig, packageManager: string) => void;
33
+ /**
34
+ * Prints the full security audit report, including active settings and warnings.
35
+ */
36
+ declare const printSecurityReport: (config: VisConfig, packageManager: string) => void;
37
+ /**
38
+ * Reports which vis security settings would map to pnpm-workspace.yaml.
39
+ */
40
+ declare const previewPnpmSync: (config: VisConfig) => string[];
41
+ /**
42
+ * Scans node_modules for packages with install scripts that aren't approved.
43
+ */
44
+ declare const scanUnapprovedBuildScripts: (cwd: string, allowBuilds: Record<string, boolean>) => string[];
45
+ interface EnforcementResult {
46
+ extraArgs: string[];
47
+ postInstallPackages: string[];
48
+ scriptsBlockedByDefault: boolean;
49
+ warnings: string[];
50
+ }
51
+ /**
52
+ * Determines enforcement actions needed before install/add/update.
53
+ */
54
+ declare const enforceScriptSecurity: (pm: PackageManagerName, workspaceRoot: string, config: VisConfig) => EnforcementResult;
55
+ /**
56
+ * Syncs vis security.allowBuilds to native PM config format.
57
+ */
58
+ declare const syncAllowBuildsToNativeConfig: (pm: PackageManagerName, workspaceRoot: string, allowBuilds: Record<string, boolean>) => string[];
59
+ /**
60
+ * Runs postinstall scripts for approved packages after --ignore-scripts install.
61
+ */
62
+ declare const runApprovedScripts: (workspaceRoot: string, patterns: string[]) => void;
63
+ export type { EnforcementResult, PackageManagerName, SecurityCheckResult };
64
+ export { checkSecurityConfig, emitSecurityWarnings, enforceScriptSecurity, previewPnpmSync, printSecurityReport, runApprovedScripts, scanUnapprovedBuildScripts, syncAllowBuildsToNativeConfig, };
@@ -0,0 +1,129 @@
1
+ /**
2
+ * Socket.dev security helpers for package security intelligence.
3
+ *
4
+ * Ported from @vltpkg/security-archive and adapted to use the Socket.dev
5
+ * public API for fetching package security scores, alerts, and report data.
6
+ * Uses a file-based cache (following the ai-cache.ts pattern) with a 1-hour TTL.
7
+ * @see https://socket.dev
8
+ * @see https://github.com/vltpkg/vltpkg/tree/main/src/security-archive
9
+ */
10
+ declare const DEFAULT_LOW_SCORE_THRESHOLD = 0.4;
11
+ /** Extra properties attached to a package alert. */
12
+ interface PackageAlertProps {
13
+ cveId?: `CVE-${string}`;
14
+ cwes?: {
15
+ id: `CWE-${string}`;
16
+ }[];
17
+ lastPublish: string;
18
+ }
19
+ /** A known security alert for a given package. */
20
+ interface PackageAlert {
21
+ category: string;
22
+ key: string;
23
+ props?: PackageAlertProps;
24
+ severity: "critical" | "high" | "low" | "medium";
25
+ type: string;
26
+ }
27
+ /** Security scores for a given package (each 0–1). */
28
+ interface PackageScore {
29
+ /** Score factors relating to package licensing. */
30
+ license: number;
31
+ /** Score factors relating to package maintenance. */
32
+ maintenance: number;
33
+ /** Average of all score factors. */
34
+ overall: number;
35
+ /** Score factors relating to code quality. */
36
+ quality: number;
37
+ /** Score factors relating to supply chain security. */
38
+ supplyChain: number;
39
+ /** Score factors relating to package vulnerabilities. */
40
+ vulnerability: number;
41
+ }
42
+ /** Full report data for a single package from Socket.dev. */
43
+ interface PackageReportData {
44
+ alerts: PackageAlert[];
45
+ author: string[];
46
+ id: string;
47
+ license: string;
48
+ name: string;
49
+ namespace?: `@${string}`;
50
+ score: PackageScore;
51
+ size: number;
52
+ type: "npm";
53
+ version: string;
54
+ }
55
+ /** Configuration options for the Socket.dev security client. */
56
+ interface SocketSecurityOptions {
57
+ /** Custom API token. Required — set via VIS_SOCKET_TOKEN env var or config. */
58
+ apiToken?: string;
59
+ /** Cache TTL in milliseconds. Defaults to 1 hour. */
60
+ cacheTtlMs?: number;
61
+ /** Minimum overall score (0–1) below which packages are flagged. Defaults to 0.4. */
62
+ minimumScore?: number;
63
+ /** Request timeout in milliseconds. Defaults to 15 seconds. */
64
+ timeoutMs?: number;
65
+ }
66
+ declare const isPackageReportData: (o: unknown) => o is PackageReportData;
67
+ declare const calculateOverallScore: (score: Omit<PackageScore, "overall">) => number;
68
+ /**
69
+ * Fetches security report data from the Socket.dev API for the given packages.
70
+ * Batches requests to stay within API limits.
71
+ * @param packages Array of { name, version } to look up.
72
+ * @param options Optional configuration.
73
+ * @returns Map of "name@version" to PackageReportData.
74
+ */
75
+ declare const fetchSocketReports: (packages: {
76
+ name: string;
77
+ version: string;
78
+ }[], options?: SocketSecurityOptions) => Promise<Map<string, PackageReportData>>;
79
+ /** Returns the full package name including namespace scope if present. */
80
+ declare const getFullPackageName: (report: Pick<PackageReportData, "name" | "namespace">) => string;
81
+ /** Maps a 0–1 score to a human-readable label. */
82
+ declare const scoreLabel: (score: number) => string;
83
+ /** Maps a 0–1 score to a color name for terminal output. */
84
+ declare const scoreColor: (score: number) => "green" | "red" | "yellow";
85
+ /** Formats a PackageReportData into a compact one-line summary string. */
86
+ declare const formatReportSummary: (report: PackageReportData) => string;
87
+ /** Formats a detailed multi-line report for a single package. */
88
+ declare const formatReportDetailed: (report: PackageReportData) => string;
89
+ /**
90
+ * Formats a security summary for a list of packages.
91
+ * Suitable for displaying after install/update commands.
92
+ */
93
+ declare const formatSecurityOverview: (reports: Map<string, PackageReportData>) => string;
94
+ declare const clearSocketCache: () => number;
95
+ /** Socket.dev config shape as it appears in VisConfig.security.socket. */
96
+ interface SocketConfigLike {
97
+ apiToken?: string;
98
+ cacheTtlMs?: number;
99
+ enabled?: boolean;
100
+ minimumScore?: number;
101
+ timeoutMs?: number;
102
+ }
103
+ /**
104
+ * Builds SocketSecurityOptions from the VisConfig socket config section.
105
+ * Returns undefined if Socket.dev is not enabled or no API token is available.
106
+ */
107
+ declare const buildSocketOptions: (socketConfig: SocketConfigLike | undefined) => SocketSecurityOptions | undefined;
108
+ /** A persisted "accepted risk" entry from the vis config. */
109
+ interface AcceptedRisk {
110
+ /** ISO 8601 timestamp when the risk was accepted. */
111
+ acceptedAt: string;
112
+ /** The overall Socket.dev score at the time of acceptance. */
113
+ acceptedScore: number;
114
+ /** User-provided reason for accepting the risk. */
115
+ reason: string;
116
+ }
117
+ /**
118
+ * Checks if a package has an accepted risk entry.
119
+ * Matches by exact name@version, unversioned name, or trailing glob patterns.
120
+ * Returns the matching AcceptedRisk if found, undefined otherwise.
121
+ */
122
+ declare const findAcceptedRisk: (packageName: string, version: string, acceptedRisks: Record<string, AcceptedRisk> | undefined) => AcceptedRisk | undefined;
123
+ /**
124
+ * Formats a config snippet for the user to paste into vis.config.ts
125
+ * to persist an accepted risk decision.
126
+ */
127
+ declare const formatAcceptedRiskSnippet: (packageName: string, _version: string, score: number, reason: string) => string;
128
+ export type { AcceptedRisk, PackageAlert, PackageAlertProps, PackageReportData, PackageScore, SocketSecurityOptions };
129
+ export { buildSocketOptions, calculateOverallScore, clearSocketCache, DEFAULT_LOW_SCORE_THRESHOLD, fetchSocketReports, findAcceptedRisk, formatAcceptedRiskSnippet, formatReportDetailed, formatReportSummary, formatSecurityOverview, getFullPackageName, isPackageReportData, scoreColor, scoreLabel, };
package/dist/tips.d.ts ADDED
@@ -0,0 +1,41 @@
1
+ /**
2
+ * CLI tips system - displays contextual hints after command execution.
3
+ *
4
+ * Features (per vite-plus RFC):
5
+ * - Probabilistic frequency control with per-tip cooldowns
6
+ * - Contextual matching based on command, args, and success state
7
+ * - Rate-limited globally (max 1 tip per 5 minutes)
8
+ * - Per-tip cooldown tracking (each tip has its own cooldown)
9
+ * - Suppressed in CI/test environments
10
+ * - Dimmed styling to avoid being intrusive
11
+ */
12
+ interface TipContext {
13
+ args: string[];
14
+ command: string;
15
+ hasVisConfig?: boolean;
16
+ success: boolean;
17
+ }
18
+ interface Tip {
19
+ /** Per-tip cooldown in milliseconds. Default: GLOBAL_COOLDOWN_MS */
20
+ cooldownMs?: number;
21
+ /** Unique identifier for per-tip cooldown tracking */
22
+ id: string;
23
+ matches: (context: TipContext) => boolean;
24
+ message: (context: TipContext) => string;
25
+ /** Probability of showing when matched (0.0 - 1.0). Default: 1.0 */
26
+ probability?: number;
27
+ }
28
+ declare const tips: Tip[];
29
+ /**
30
+ * Show a contextual tip if rate-limits allow and a tip matches.
31
+ *
32
+ * Flow:
33
+ * 1. Check environment (skip in CI/test)
34
+ * 2. Check global cooldown (max 1 tip per 5 minutes)
35
+ * 3. Find matching tips, filter by per-tip cooldowns
36
+ * 4. Apply probability filter
37
+ * 5. Show the first surviving tip, update state
38
+ */
39
+ declare const showTip: (context: TipContext) => void;
40
+ export type { Tip, TipContext };
41
+ export { showTip, tips };
@@ -0,0 +1,6 @@
1
+ import React from "react";
2
+ export interface CheckProgressProps {
3
+ readonly current: number;
4
+ readonly total: number;
5
+ }
6
+ export default function CheckProgressApp({ current, total }: CheckProgressProps): React.ReactElement;
@@ -0,0 +1,17 @@
1
+ import type { Task } from "@visulima/task-runner";
2
+ interface CommandSummaryProps {
3
+ cached: number;
4
+ failed: number;
5
+ failedIds: string[];
6
+ projectNames: string[];
7
+ skippedIds?: string[];
8
+ succeeded: number;
9
+ targets: string[];
10
+ tasks: Task[];
11
+ took: string;
12
+ }
13
+ /**
14
+ * Final summary block rendered after all tasks complete.
15
+ */
16
+ declare const CommandSummary: ({ cached, failed, failedIds, projectNames, skippedIds, succeeded, targets, tasks, took }: CommandSummaryProps) => React.JSX.Element;
17
+ export default CommandSummary;
@@ -0,0 +1,13 @@
1
+ import type { ReactNode } from "react";
2
+ interface HeaderProps {
3
+ children?: ReactNode;
4
+ title: string;
5
+ variant: "error" | "info" | "success";
6
+ }
7
+ /**
8
+ * Renders the VIS badge + status dot + title header line.
9
+ *
10
+ * ` VIS ` ● Running targets build for 3 projects
11
+ */
12
+ declare const Header: ({ children, title, variant }: HeaderProps) => React.JSX.Element;
13
+ export default Header;
@@ -0,0 +1,16 @@
1
+ import type { TaskRowData } from "./TaskRow.d.ts";
2
+ interface OutputPanelProps {
3
+ /** Duration in ms (for top-right border display). */
4
+ duration?: number;
5
+ focused: boolean;
6
+ /** Whether interactive input mode is active (keystrokes forwarded to PTY). */
7
+ interactiveMode?: boolean;
8
+ output: string;
9
+ scrollRef?: React.RefObject<import("@visulima/tui").ScrollViewRef>;
10
+ /** Whether to show "&lt;enter> full screen" hint in bottom border. */
11
+ showFullscreenHint?: boolean;
12
+ status: TaskRowData["status"] | undefined;
13
+ taskId: string | null;
14
+ }
15
+ declare const OutputPanel: ({ duration, focused, interactiveMode, output, scrollRef, showFullscreenHint, status, taskId }: OutputPanelProps) => React.JSX.Element;
16
+ export default OutputPanel;
@@ -0,0 +1,15 @@
1
+ interface QuitDialogProps {
2
+ /** Countdown seconds. 0 = no auto-exit. */
3
+ readonly autoExitSeconds: number;
4
+ /** Called when the user cancels (any key except q). */
5
+ readonly onCancel: () => void;
6
+ /** Whether the dialog is visible. */
7
+ readonly visible: boolean;
8
+ }
9
+ /**
10
+ * Reusable quit confirmation dialog with countdown timer.
11
+ * Shows a countdown, then auto-exits. Any key cancels the countdown.
12
+ * Press q to exit immediately.
13
+ */
14
+ declare const QuitDialog: ({ autoExitSeconds, onCancel, visible }: QuitDialogProps) => React.JSX.Element | null;
15
+ export default QuitDialog;
@@ -0,0 +1,19 @@
1
+ import type { ScrollViewRef } from "@visulima/tui";
2
+ import type { TaskRowData } from "./TaskRow.d.ts";
3
+ interface TaskListPanelProps {
4
+ /** Hide Cache + Duration columns (used in split view where output panel shows them). */
5
+ compact?: boolean;
6
+ filterActive: boolean;
7
+ filterText: string;
8
+ focused: boolean;
9
+ headerStatus: "error" | "running" | "success";
10
+ /** Number of parallel task slots to display at the bottom. */
11
+ parallelSlots?: number;
12
+ pinnedTaskIds: [string | null, string | null];
13
+ rows: TaskRowData[];
14
+ scrollRef: React.RefObject<ScrollViewRef>;
15
+ selectedIndex: number;
16
+ title: string;
17
+ }
18
+ declare const TaskListPanel: ({ compact, filterActive, filterText, focused, headerStatus, parallelSlots, pinnedTaskIds, rows, scrollRef, selectedIndex, title, }: TaskListPanelProps) => React.JSX.Element;
19
+ export default TaskListPanel;
@@ -0,0 +1,12 @@
1
+ import type { TaskStatus } from "@visulima/task-runner";
2
+ export interface TaskRowData {
3
+ duration?: number;
4
+ elapsed?: number;
5
+ status: "pending" | "running" | TaskStatus;
6
+ taskId: string;
7
+ }
8
+ interface TaskRowProps {
9
+ row: TaskRowData;
10
+ }
11
+ declare const TaskRow: ({ row }: TaskRowProps) => React.JSX.Element;
12
+ export default TaskRow;