@visulima/vis 1.0.0-alpha.20 → 1.0.0-alpha.22

package/CHANGELOG.md

@@ -1,3 +1,66 @@
+## @visulima/vis [1.0.0-alpha.22](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.21...@visulima/vis@1.0.0-alpha.22) (2026-05-19)
+
+### Features
+
+* **task-runner:** auto-capture outputs for compound build scripts ([e084434](https://github.com/visulima/visulima/commit/e0844344cf184177999a82b708299f08fbfd31ec))
+* **task-runner:** per-target hashMode "trace" opt-in ([#643](https://github.com/visulima/visulima/issues/643)) ([32353ff](https://github.com/visulima/visulima/commit/32353ff7a760ae9486e23cc4042fab46a2f2cc11))
+* **vis:** add composite s1ngularity supply-chain marshall ([44cdeaf](https://github.com/visulima/visulima/commit/44cdeafb58eefcef061ffaab6822d4628cb06b2c))
+* **vis:** add deprecation + package-age marshalls ([5547840](https://github.com/visulima/visulima/commit/5547840b5aef9689f4080c77c44d3884309b0601))
+* **vis:** add deps.dev as supply-chain security provider alongside Socket ([7f752d2](https://github.com/visulima/visulima/commit/7f752d250fa3c96d2ec01ca58bddf911586ea949))
+* **vis:** add lockfile supply-chain verification ([a8c741d](https://github.com/visulima/visulima/commit/a8c741d80b52b275cde11be188ab22c41a11f5f4))
+* **vis:** add migrate verify-graph equivalence verification ([697e2c0](https://github.com/visulima/visulima/commit/697e2c0888c596e4bcee0a12922db76937a29175))
+* **vis:** add Snyk security provider ([aba3571](https://github.com/visulima/visulima/commit/aba35710719d1325b311bf80d81a91c91e75aa1f))
+* **vis:** add write guard, watchman backend, vcs hints ([5127d79](https://github.com/visulima/visulima/commit/5127d79ad2aa523760517601f71fdf38571ca4d3))
+* **vis:** attested keyless-signed remote cache (Sigstore) ([4732610](https://github.com/visulima/visulima/commit/47326103a668ab99fcfc4e21f2c9efeaa5892944))
+* **vis:** default inferTargets on with guarded script enrichment ([29cabd1](https://github.com/visulima/visulima/commit/29cabd1763ce915cbfa6aaa85b1c29a020d72b01))
+* **vis:** harden bootstrap installers + add lint CI ([49ec0a2](https://github.com/visulima/visulima/commit/49ec0a25e76ab5865cd2a2dce49413311fcf389c))
+* **vis:** integrate aube package manager + offline OSV bloom prefilter ([9513e09](https://github.com/visulima/visulima/commit/9513e0930c6fbcdb00e42df2ab9c650194a35eb4))
+* **vis:** scan npm-shrinkwrap.json with precedence ([ae907f1](https://github.com/visulima/visulima/commit/ae907f18e560eed7c80c7738650330909a254148))
+* **vis:** security check on by default for update, add --no-security ([e8db4c8](https://github.com/visulima/visulima/commit/e8db4c88a4c64038ca00c46b2a63083fee224637))
+* **vis:** source-mapped, code-framed task failure rendering ([95b2343](https://github.com/visulima/visulima/commit/95b2343d7299ab8537c5a4ef0205ddeee9146c58))
+
+### Bug Fixes
+
+* **vis:** harden marshall pipeline and failure-render ANSI stripping ([22dc431](https://github.com/visulima/visulima/commit/22dc431ac3e841a2a342f297673b4d5f1a0a8a43))
+* **vis:** make write guard github/gitlab asymmetry explicit ([0202fd9](https://github.com/visulima/visulima/commit/0202fd99e920173cbbb5e9711bb2df9528d25e42))
+* **vis:** parse pnpm v11 multi-document lockfiles ([94024b6](https://github.com/visulima/visulima/commit/94024b65310ab70ef4a3d4fed93f4987203f4a57))
+* **vis:** version the packument cache so stale entries can't blind marshalls ([6741f55](https://github.com/visulima/visulima/commit/6741f551ed9c1a28a2184672ed644dd06344c93b))
+* **vis:** wire s1ngularity into the vis inspect dispatch ([0e355eb](https://github.com/visulima/visulima/commit/0e355eb44acfcf50caf09f7b0954038def735278))
+
+### Documentation
+
+* **vis:** add MARSHALL_DISABLE_S1NGULARITY to shell-alias guide ([fee4979](https://github.com/visulima/visulima/commit/fee4979338cd255ee5c4ff1e52e99e545695e4d7))
+* **vis:** document lockfile supply-chain verification ([05c338f](https://github.com/visulima/visulima/commit/05c338f55f7069ed59018e64be3d24016ab3fb66))
+* **vis:** document s1ngularity marshall in add/update/inspect ([6a14d5c](https://github.com/visulima/visulima/commit/6a14d5c190a6125817abe9c3e35afde87893228a))
+
+### Styles
+
+* **vis:** prettier/eslint conformance sweep ([dd200bd](https://github.com/visulima/visulima/commit/dd200bd84c022f5fd8819ce23bab2c1c4cace1ed))
+
+### Miscellaneous Chores
+
+* **vis:** remove competitive-analysis and priority-roadmap docs ([3116348](https://github.com/visulima/visulima/commit/3116348a5f76772ace9f285d136d352a815c3f0a))
+
+
+### Dependencies
+
+* **@visulima/error:** upgraded to 6.0.0-alpha.26
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.15
+* **@visulima/tui:** upgraded to 1.0.0-alpha.17
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.25
+* **@visulima/fs:** upgraded to 5.0.0-alpha.24
+* **@visulima/package:** upgraded to 5.0.0-alpha.23
+
+## @visulima/vis [1.0.0-alpha.21](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.20...@visulima/vis@1.0.0-alpha.21) (2026-05-16)
+
+
+### Dependencies
+
+* **@visulima/tui:** upgraded to 1.0.0-alpha.16
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.24
+* **@visulima/fs:** upgraded to 5.0.0-alpha.23
+* **@visulima/package:** upgraded to 5.0.0-alpha.22
+
 ## @visulima/vis [1.0.0-alpha.20](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.19...@visulima/vis@1.0.0-alpha.20) (2026-05-14)
 
 ### ⚠ BREAKING CHANGES

package/LICENSE.md

@@ -685,14 +685,11 @@ Repository: git+https://github.com/visulima/visulima.git
 > >
 > >
 > > # Licenses of bundled types
-> >
 > > The published @visulima/command-line-args artifact additionally contains code with the following licenses:
 > > MIT
 > >
 > > # Bundled types:
-> >
 > > ## @visulima/error
-> >
 > > License: MIT
 > > By: Daniel Bannert
 > > Repository: git+https://github.com/visulima/visulima.git
@@ -720,40 +717,6 @@ Repository: git+https://github.com/visulima/visulima.git
 > > > SOFTWARE.
 > > >
 > > > 
-> >
-> > # Licenses of bundled dependencies
-> > The published @visulima/command-line-args artifact additionally contains code with the following licenses:
-> > MIT
-> >
-> > # Bundled dependencies:
-> > ## @visulima/error
-> > License: MIT
-> > By: Daniel Bannert
-> > Repository: git+https://github.com/visulima/visulima.git
-> >
-> > > MIT License
-> > >
-> > > Copyright (c) 2026 visulima
-> > >
-> > > Permission is hereby granted, free of charge, to any person obtaining a copy
-> > > of this software and associated documentation files (the "Software"), to deal
-> > > in the Software without restriction, including without limitation the rights
-> > > to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-> > > copies of the Software, and to permit persons to whom the Software is
-> > > furnished to do so, subject to the following conditions:
-> > >
-> > > The above copyright notice and this permission notice shall be included in all
-> > > copies or substantial portions of the Software.
-> > >
-> > > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-> > > IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-> > > FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-> > > AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-> > > LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-> > > OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-> > > SOFTWARE.
-> > >
-> > >
 > > >
 > > > # Licenses of bundled dependencies
 > > >
@@ -778,7 +741,7 @@ Repository: git+https://github.com/visulima/visulima.git
 > > > >
 > > > > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 > > >
-> > >
+> > > 
 > > >
 > > >
 > > >
@@ -804,34 +767,6 @@ Repository: git+https://github.com/visulima/visulima.git
 > > > > WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 > > > > See the License for the specific language governing permissions and
 > > > > limitations under the License.
-> >
-> >
-> >
-> > > # Licenses of bundled types
-> > >
-> > > The published @visulima/error artifact additionally contains code with the following licenses:
-> > > Apache-2.0
-> > >
-> > > # Bundled types:
-> > >
-> > > ## ai
-> > >
-> > > License: Apache-2.0
-> > > Repository: git+https://github.com/vercel/ai.git
-> > >
-> > > > Copyright 2023 Vercel, Inc.
-> > > >
-> > > > Licensed under the Apache License, Version 2.0 (the "License");
-> > > > you may not use this file except in compliance with the License.
-> > > > You may obtain a copy of the License at
-> > > >
-> > > >     http://www.apache.org/licenses/LICENSE-2.0
-> > > >
-> > > > Unless required by applicable law or agreed to in writing, software
-> > > > distributed under the License is distributed on an "AS IS" BASIS,
-> > > > WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-> > > > See the License for the specific language governing permissions and
-> > > > limitations under the License.
 >
 > ---------------------------------------
 >
@@ -1219,14 +1154,11 @@ Repository: git+https://github.com/visulima/visulima.git
 > >
 > >
 > > # Licenses of bundled types
-> >
 > > The published @visulima/command-line-args artifact additionally contains code with the following licenses:
 > > MIT
 > >
 > > # Bundled types:
-> >
 > > ## @visulima/error
-> >
 > > License: MIT
 > > By: Daniel Bannert
 > > Repository: git+https://github.com/visulima/visulima.git
@@ -1254,40 +1186,6 @@ Repository: git+https://github.com/visulima/visulima.git
 > > > SOFTWARE.
 > > >
 > > > 
-> >
-> > # Licenses of bundled dependencies
-> > The published @visulima/command-line-args artifact additionally contains code with the following licenses:
-> > MIT
-> >
-> > # Bundled dependencies:
-> > ## @visulima/error
-> > License: MIT
-> > By: Daniel Bannert
-> > Repository: git+https://github.com/visulima/visulima.git
-> >
-> > > MIT License
-> > >
-> > > Copyright (c) 2026 visulima
-> > >
-> > > Permission is hereby granted, free of charge, to any person obtaining a copy
-> > > of this software and associated documentation files (the "Software"), to deal
-> > > in the Software without restriction, including without limitation the rights
-> > > to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-> > > copies of the Software, and to permit persons to whom the Software is
-> > > furnished to do so, subject to the following conditions:
-> > >
-> > > The above copyright notice and this permission notice shall be included in all
-> > > copies or substantial portions of the Software.
-> > >
-> > > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-> > > IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-> > > FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-> > > AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-> > > LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-> > > OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-> > > SOFTWARE.
-> > >
-> > >
 > > >
 > > > # Licenses of bundled dependencies
 > > >
@@ -1312,7 +1210,7 @@ Repository: git+https://github.com/visulima/visulima.git
 > > > >
 > > > > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 > > >
-> > >
+> > > 
 > > >
 > > >
 > > >
@@ -1338,34 +1236,6 @@ Repository: git+https://github.com/visulima/visulima.git
 > > > > WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 > > > > See the License for the specific language governing permissions and
 > > > > limitations under the License.
-> >
-> > 
-> >
-> > > # Licenses of bundled types
-> > >
-> > > The published @visulima/error artifact additionally contains code with the following licenses:
-> > > Apache-2.0
-> > >
-> > > # Bundled types:
-> > >
-> > > ## ai
-> > >
-> > > License: Apache-2.0
-> > > Repository: git+https://github.com/vercel/ai.git
-> > >
-> > > > Copyright 2023 Vercel, Inc.
-> > > >
-> > > > Licensed under the Apache License, Version 2.0 (the "License");
-> > > > you may not use this file except in compliance with the License.
-> > > > You may obtain a copy of the License at
-> > > >
-> > > >     http://www.apache.org/licenses/LICENSE-2.0
-> > > >
-> > > > Unless required by applicable law or agreed to in writing, software
-> > > > distributed under the License is distributed on an "AS IS" BASIS,
-> > > > WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-> > > > See the License for the specific language governing permissions and
-> > > > limitations under the License.
 >
 > ---------------------------------------
 >
@@ -3552,14 +3422,11 @@ Repository: git+https://github.com/visulima/visulima.git
 > >
 > >
 > > # Licenses of bundled types
-> >
 > > The published @visulima/string artifact additionally contains code with the following licenses:
 > > MIT
 > >
 > > # Bundled types:
-> >
 > > ## fastest-levenshtein
-> >
 > > License: MIT
 > > By: Kasper U. Weihe
 > > Repository: git+https://github.com/ka-weihe/fastest-levenshtein.git
@@ -3585,6 +3452,74 @@ Repository: git+https://github.com/visulima/visulima.git
 > > > LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 > > > OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 > > > SOFTWARE.
+> >
+> > ---------------------------------------
+> >
+> > ## get-east-asian-width
+> > License: MIT
+> > By: Sindre Sorhus
+> > Repository: sindresorhus/get-east-asian-width
+> >
+> > > MIT License
+> > >
+> > > Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+> > >
+> > > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+> > >
+> > > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+> > >
+> > > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+> >
+> > ---------------------------------------
+> >
+> > ## indent-string
+> > License: MIT
+> > By: Sindre Sorhus
+> > Repository: sindresorhus/indent-string
+> >
+> > > MIT License
+> > >
+> > > Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+> > >
+> > > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+> > >
+> > > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+> > >
+> > > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+> >
+> > ---------------------------------------
+> >
+> > ## redent
+> > License: MIT
+> > By: Sindre Sorhus
+> > Repository: sindresorhus/redent
+> >
+> > > MIT License
+> > >
+> > > Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+> > >
+> > > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+> > >
+> > > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+> > >
+> > > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+> >
+> > ---------------------------------------
+> >
+> > ## strip-indent
+> > License: MIT
+> > By: Sindre Sorhus
+> > Repository: sindresorhus/strip-indent
+> >
+> > > MIT License
+> > >
+> > > Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+> > >
+> > > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+> > >
+> > > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+> > >
+> > > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 >
 > ---------------------------------------
 >
@@ -5545,14 +5480,11 @@ Repository: git+https://github.com/visulima/visulima.git
 > >
 > >
 > > # Licenses of bundled types
-> >
 > > The published @visulima/string artifact additionally contains code with the following licenses:
 > > MIT
 > >
 > > # Bundled types:
-> >
 > > ## fastest-levenshtein
-> >
 > > License: MIT
 > > By: Kasper U. Weihe
 > > Repository: git+https://github.com/ka-weihe/fastest-levenshtein.git
@@ -5578,6 +5510,74 @@ Repository: git+https://github.com/visulima/visulima.git
 > > > LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 > > > OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 > > > SOFTWARE.
+> >
+> > ---------------------------------------
+> >
+> > ## get-east-asian-width
+> > License: MIT
+> > By: Sindre Sorhus
+> > Repository: sindresorhus/get-east-asian-width
+> >
+> > > MIT License
+> > >
+> > > Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+> > >
+> > > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+> > >
+> > > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+> > >
+> > > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+> >
+> > ---------------------------------------
+> >
+> > ## indent-string
+> > License: MIT
+> > By: Sindre Sorhus
+> > Repository: sindresorhus/indent-string
+> >
+> > > MIT License
+> > >
+> > > Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+> > >
+> > > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+> > >
+> > > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+> > >
+> > > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+> >
+> > ---------------------------------------
+> >
+> > ## redent
+> > License: MIT
+> > By: Sindre Sorhus
+> > Repository: sindresorhus/redent
+> >
+> > > MIT License
+> > >
+> > > Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+> > >
+> > > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+> > >
+> > > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+> > >
+> > > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+> >
+> > ---------------------------------------
+> >
+> > ## strip-indent
+> > License: MIT
+> > By: Sindre Sorhus
+> > Repository: sindresorhus/strip-indent
+> >
+> > > MIT License
+> > >
+> > > Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+> > >
+> > > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+> > >
+> > > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+> > >
+> > > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 >
 > ---------------------------------------
 >
@@ -6142,14 +6142,11 @@ Repository: git+https://github.com/visulima/visulima.git
 > >
 > >
 > > # Licenses of bundled types
-> >
 > > The published @visulima/string artifact additionally contains code with the following licenses:
 > > MIT
 > >
 > > # Bundled types:
-> >
 > > ## fastest-levenshtein
-> >
 > > License: MIT
 > > By: Kasper U. Weihe
 > > Repository: git+https://github.com/ka-weihe/fastest-levenshtein.git
@@ -6175,6 +6172,74 @@ Repository: git+https://github.com/visulima/visulima.git
 > > > LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 > > > OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 > > > SOFTWARE.
+> >
+> > ---------------------------------------
+> >
+> > ## get-east-asian-width
+> > License: MIT
+> > By: Sindre Sorhus
+> > Repository: sindresorhus/get-east-asian-width
+> >
+> > > MIT License
+> > >
+> > > Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+> > >
+> > > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+> > >
+> > > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+> > >
+> > > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+> >
+> > ---------------------------------------
+> >
+> > ## indent-string
+> > License: MIT
+> > By: Sindre Sorhus
+> > Repository: sindresorhus/indent-string
+> >
+> > > MIT License
+> > >
+> > > Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+> > >
+> > > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+> > >
+> > > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+> > >
+> > > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+> >
+> > ---------------------------------------
+> >
+> > ## redent
+> > License: MIT
+> > By: Sindre Sorhus
+> > Repository: sindresorhus/redent
+> >
+> > > MIT License
+> > >
+> > > Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+> > >
+> > > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+> > >
+> > > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+> > >
+> > > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+> >
+> > ---------------------------------------
+> >
+> > ## strip-indent
+> > License: MIT
+> > By: Sindre Sorhus
+> > Repository: sindresorhus/strip-indent
+> >
+> > > MIT License
+> > >
+> > > Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+> > >
+> > > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+> > >
+> > > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+> > >
+> > > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---------------------------------------
 

package/README.md

@@ -74,7 +74,7 @@
 
 - **`vis catalog check / update`** — pnpm + bun workspace catalog management
 - **`vis secrets`** — Rust-native secret scanning (gitleaks detection engine)
-- **`vis audit`** — OSV.dev vulnerability scanning
+- **`vis audit`** — OSV.dev vulnerability scanning with pluggable supply-chain providers ([Socket.dev](https://socket.dev) and [Google deps.dev](https://deps.dev), merged when both are enabled)
 - **`vis docker scaffold`** — lockfile pruning for pnpm / npm / yarn classic + berry / bun, matching turbo's killer Docker-cache feature
 - **`vis hook install / migrate`** — git hooks (husky migration supported)
 - **`vis staged`** — built-in `lint-staged` replacement, no peer dependency
@@ -84,7 +84,7 @@
 ### Toolchain & runtime
 
 - **Pluggable installer** — defaults to the lockfile-detected PM (pnpm/npm/yarn/bun); auto-uses [aube](https://github.com/endevco/aube) when on `PATH`, with a single switch (`install.backend` / `--installer` / `--no-aube`) to pin or bypass it
-- **Cold-start one-liner** — `curl -fsSL https://visulima.com/install.sh | bash` (Linux/macOS/WSL) or PowerShell equivalent installs a version manager, Node LTS, and `vis`
+- **Cold-start one-liner** — `curl -fsSL https://visulima.com/install.sh | bash` (Linux/macOS/WSL) or PowerShell equivalent installs the latest Node LTS (or a version manager on request) and `vis`
 - **`vis toolchain`** — delegates to proto / mise / fnm / volta
 - **Built on Cerebro** — robust CLI with built-in help, version, and shell completion
 
@@ -106,7 +106,7 @@ pnpm add @visulima/vis
 
 ### Cold start (no Node? no manager?)
 
-One-liner bootstrap that installs a version manager, Node LTS, and `vis` in one go.
+One-liner bootstrap that installs Node and `vis` in one go. When no Node is found it installs the latest Node LTS directly by default (OS package manager, falling back to the official nodejs.org build); a version manager (proto / fnm / mise / volta) is offered as an opt-in alternative. Pin a specific major with `VIS_NODE_MAJOR`.
 
 **Linux / macOS / WSL** (bash):
 
@@ -164,7 +164,7 @@ Resolution precedence (highest first):
 1. `--installer <name>` CLI flag — `auto`, `aube`, `pnpm`, `npm`, `yarn`, or `bun` (or `--no-aube` to force the lockfile-detected PM for a single run; `--no-aube` wins over every other source).
 2. `VIS_INSTALLER` environment variable — same accepted values as the flag.
 3. `install.backend` in `vis.config.ts` — same accepted values; the team-wide pin.
-4. Auto-detect — `aube` when it's on `PATH`, otherwise the lockfile-detected PM (`pnpm-lock.yaml` → pnpm, `package-lock.json` → npm, `yarn.lock` → yarn, `bun.lockb` → bun).
+4. Auto-detect — `aube` when it's on `PATH` or `aube-lock.yaml` is present, otherwise the lockfile-detected PM (`pnpm-lock.yaml` → pnpm, `package-lock.json` → npm, `yarn.lock` → yarn, `bun.lockb` → bun).
 
 Each step is consulted in order; the first one that resolves to a concrete backend wins. Picking an explicit value (`pnpm`, `npm`, …) at any level always beats the auto-detect step below it, so you can override the team default for a single shell session via `VIS_INSTALLER=pnpm vis install` without touching the config file.
 
@@ -185,6 +185,21 @@ Aube reuses pnpm/npm/yarn/bun lockfile formats but its serialized output isn't b
 
 Aube already skips dependency lifecycle scripts by default. `--ignore-scripts` is a no-op under aube (`vis install` warns when you pass it). To opt specific packages back in, run `aube approve-builds` — the inverse direction from the pnpm/npm `--ignore-scripts` model.
 
+### Audit delegation
+
+When aube is the active installer, `vis audit` delegates to `aube audit` so a single, consistent vulnerability scan runs regardless of entry point. Resolution mirrors the installer chain:
+
+1. `--backend <name>` CLI flag — `auto`, `aube`, or `vis`.
+2. `VIS_AUDIT_BACKEND` env var.
+3. `security.audit.backend` in `vis.config.ts`.
+4. Defaults to `auto` — delegates only when `install.backend` (or `VIS_INSTALLER`) resolves to aube AND `aube` is on `PATH`.
+
+Vis-only features (`--report`, `--fix-transitive`, `--usage`, `--policies`, `--format sarif|csaf|cyclonedx-vex`, `--ecosystem` beyond npm) print a warning and are dropped when delegating; pass `--backend vis` to force the built-in OSV/Socket scanner.
+
+### Doctor visibility
+
+When aube is the installer, `vis doctor` surfaces aube's effective hardening posture (`paranoid`, `trustPolicy`, `blockExoticSubdeps`, `jailBuilds`, `strictDepBuilds`, `minimumReleaseAge`, `allowBuilds`) alongside the existing vis `security.policies.*` findings, reading from `aube-workspace.yaml` (or falling back to `pnpm-workspace.yaml`). Aube's defaults are already hardened, so most entries render as `ok` — the section turns into a positive confirmation rather than a wall of warnings.
+
 ## Commands
 
 | Command                 | Alias  | Description                                                          |
@@ -420,6 +435,8 @@ If you would like to help take a look at the [list of issues](https://github.com
 | [Syncpack](https://github.com/JamieMason/syncpack)         | `vis migrate syncpack`    | Workspace dependency policy |
 | [Sherif](https://github.com/QuiiBz/sherif)                 | `vis migrate sherif`      | Monorepo linter             |
 
+After migrating a task runner, run `vis migrate verify-graph` to prove the migration preserved the task graph and cache-key surface — it diffs the original `turbo` / `nx` / `moon` config against the generated `vis.config.*` across six axes (target set, `dependsOn`, `inputs`, `outputs`, `env`, `cache`) and exits non-zero on any dropped task or narrowed cache key, so it can gate CI.
+
 ## Made with ❤️ at Anolilab
 
 This is an open source project and will always remain free to use. If you think it's cool, please star it 🌟. [Anolilab](https://www.anolilab.com/open-source) is a Development and AI Studio. Contact us at [hello@anolilab.com](mailto:hello@anolilab.com) if you need any help with these technologies or just want to say hi!