@visulima/vis 1.0.0-alpha.21 → 1.0.0-alpha.22

package/index.d.ts

@@ -1,5 +1,39 @@
 /* auto-generated by NAPI-RS */
 /* eslint-disable */
+/**
+ * Opaque handle wrapping a decoded `BloomFilter`. JS calls back into
+ * `osv_bloom_probe` / `osv_bloom_probe_batch` with this handle. Arc so
+ * the same filter can fan out to multiple probe calls without copying
+ * the bitset.
+ */
+export declare class OsvBloomHandle {
+  /**
+   * `n` field from the filter header — entry count the upstream
+   * builder inserted. Exposed for `vis advisories bloom status`.
+   */
+  get entriesInserted(): number
+  /**
+   * `m` field — bit count. Returned as a decimal string so the full
+   * u64 round-trips without JS-Number precision loss; today's filter
+   * is ~3.1M bits but the wire format reserves 64-bit headroom.
+   */
+  get bitCountString(): string
+  /** `k` field — hash-function count per probe. */
+  get hashCount(): number
+  /**
+   * `built_at_unix_seconds` — UNIX seconds the upstream builder
+   * recorded, as a decimal string. JS reconstructs via
+   * `new Date(Number(s) * 1000)`. Use this in status output rather
+   * than the local fetch time.
+   */
+  get builtAtUnixSecondsString(): string
+  /**
+   * `format_version` — currently 1. Surfaced so JS can flag a
+   * version-mismatch warning without re-decoding.
+   */
+  get formatVersion(): number
+}
+
 export interface AddOptions {
   packages: Array<string>
   saveDev: boolean
@@ -219,6 +253,8 @@ export interface InstallOptions {
  *       `parse_shebang`, `all_known_tags`.
  *   4 — added offline advisories: `advisories_ingest`, `advisories_query`,
  *       `advisories_status`. Backed by bundled SQLite (rusqlite) + zip.
+ *   5 — added osv-bloom prefilter: `osv_bloom_decode`, `osv_bloom_probe`,
+ *       `osv_bloom_probe_batch`. Backed by `blake3` keyed-hash double-hashing.
  */
 export const NATIVE_BINDING_VERSION: number
 
@@ -239,6 +275,48 @@ export interface NativeVulnerabilityJs {
   cvssScore?: number
 }
 
+export interface OsvBloomBatchHit {
+  /**
+   * Index into the input batch array. Lets JS reconstruct which
+   * lockfile row triggered the hit without re-walking the inputs.
+   */
+  index: number
+  name: string
+  version: string
+}
+
+export interface OsvBloomBatchQuery {
+  name: string
+  version: string
+}
+
+/**
+ * Decode a v1 osv-bloom filter from `bytes` (the on-disk `filter.bin`).
+ * Returns an opaque handle; reuse it for every probe call until the
+ * JS-side cache invalidates.
+ */
+export declare function osvBloomDecode(bytes: Buffer): OsvBloomHandle
+
+/**
+ * Probe a single `(name, version)` pair. Returns `true` when the pair
+ * *might* be a known-malicious advisory — callers must escalate to an
+ * authoritative source for `(name, version)` confirmation.
+ *
+ * The version is encoded into a semver-major bucket per the upstream
+ * scheme; the wildcard bucket is also probed so advisories with
+ * unbounded ranges still match. Unparseable versions probe only the
+ * wildcard bucket.
+ */
+export declare function osvBloomProbe(handle: OsvBloomHandle, name: string, version: string): boolean
+
+/**
+ * Batch variant. Returns only the hits, with their original index — the
+ * expected hit rate is well under 1%, so allocating one bool per input
+ * (`Vec<bool>` of length N) would dominate the cost. Order of returned
+ * hits matches input order.
+ */
+export declare function osvBloomProbeBatch(handle: OsvBloomHandle, queries: Array<OsvBloomBatchQuery>): Array<OsvBloomBatchHit>
+
 export interface OutdatedOptions {
   packages: Array<string>
   long: boolean

package/index.js

@@ -81,8 +81,8 @@ function requireNative() {
       try {
         const binding = require('@visulima/vis-binding-android-arm64')
         const bindingPackageVersion = require('@visulima/vis-binding-android-arm64/package.json').version
-        if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -97,8 +97,8 @@ function requireNative() {
       try {
         const binding = require('@visulima/vis-binding-android-arm-eabi')
         const bindingPackageVersion = require('@visulima/vis-binding-android-arm-eabi/package.json').version
-        if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -118,8 +118,8 @@ function requireNative() {
       try {
         const binding = require('@visulima/vis-binding-win32-x64-gnu')
         const bindingPackageVersion = require('@visulima/vis-binding-win32-x64-gnu/package.json').version
-        if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -134,8 +134,8 @@ function requireNative() {
       try {
         const binding = require('@visulima/vis-binding-win32-x64-msvc')
         const bindingPackageVersion = require('@visulima/vis-binding-win32-x64-msvc/package.json').version
-        if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -151,8 +151,8 @@ function requireNative() {
       try {
         const binding = require('@visulima/vis-binding-win32-ia32-msvc')
         const bindingPackageVersion = require('@visulima/vis-binding-win32-ia32-msvc/package.json').version
-        if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -167,8 +167,8 @@ function requireNative() {
       try {
         const binding = require('@visulima/vis-binding-win32-arm64-msvc')
         const bindingPackageVersion = require('@visulima/vis-binding-win32-arm64-msvc/package.json').version
-        if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -186,8 +186,8 @@ function requireNative() {
     try {
       const binding = require('@visulima/vis-binding-darwin-universal')
       const bindingPackageVersion = require('@visulima/vis-binding-darwin-universal/package.json').version
-      if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-        throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+      if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+        throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
       }
       return binding
     } catch (e) {
@@ -202,8 +202,8 @@ function requireNative() {
       try {
         const binding = require('@visulima/vis-binding-darwin-x64')
         const bindingPackageVersion = require('@visulima/vis-binding-darwin-x64/package.json').version
-        if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -218,8 +218,8 @@ function requireNative() {
       try {
         const binding = require('@visulima/vis-binding-darwin-arm64')
         const bindingPackageVersion = require('@visulima/vis-binding-darwin-arm64/package.json').version
-        if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -238,8 +238,8 @@ function requireNative() {
       try {
         const binding = require('@visulima/vis-binding-freebsd-x64')
         const bindingPackageVersion = require('@visulima/vis-binding-freebsd-x64/package.json').version
-        if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -254,8 +254,8 @@ function requireNative() {
       try {
         const binding = require('@visulima/vis-binding-freebsd-arm64')
         const bindingPackageVersion = require('@visulima/vis-binding-freebsd-arm64/package.json').version
-        if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -275,8 +275,8 @@ function requireNative() {
         try {
           const binding = require('@visulima/vis-binding-linux-x64-musl')
           const bindingPackageVersion = require('@visulima/vis-binding-linux-x64-musl/package.json').version
-          if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -291,8 +291,8 @@ function requireNative() {
         try {
           const binding = require('@visulima/vis-binding-linux-x64-gnu')
           const bindingPackageVersion = require('@visulima/vis-binding-linux-x64-gnu/package.json').version
-          if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -309,8 +309,8 @@ function requireNative() {
         try {
           const binding = require('@visulima/vis-binding-linux-arm64-musl')
           const bindingPackageVersion = require('@visulima/vis-binding-linux-arm64-musl/package.json').version
-          if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -325,8 +325,8 @@ function requireNative() {
         try {
           const binding = require('@visulima/vis-binding-linux-arm64-gnu')
           const bindingPackageVersion = require('@visulima/vis-binding-linux-arm64-gnu/package.json').version
-          if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -343,8 +343,8 @@ function requireNative() {
         try {
           const binding = require('@visulima/vis-binding-linux-arm-musleabihf')
           const bindingPackageVersion = require('@visulima/vis-binding-linux-arm-musleabihf/package.json').version
-          if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -359,8 +359,8 @@ function requireNative() {
         try {
           const binding = require('@visulima/vis-binding-linux-arm-gnueabihf')
           const bindingPackageVersion = require('@visulima/vis-binding-linux-arm-gnueabihf/package.json').version
-          if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -377,8 +377,8 @@ function requireNative() {
         try {
           const binding = require('@visulima/vis-binding-linux-loong64-musl')
           const bindingPackageVersion = require('@visulima/vis-binding-linux-loong64-musl/package.json').version
-          if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -393,8 +393,8 @@ function requireNative() {
         try {
           const binding = require('@visulima/vis-binding-linux-loong64-gnu')
           const bindingPackageVersion = require('@visulima/vis-binding-linux-loong64-gnu/package.json').version
-          if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -411,8 +411,8 @@ function requireNative() {
         try {
           const binding = require('@visulima/vis-binding-linux-riscv64-musl')
           const bindingPackageVersion = require('@visulima/vis-binding-linux-riscv64-musl/package.json').version
-          if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -427,8 +427,8 @@ function requireNative() {
         try {
           const binding = require('@visulima/vis-binding-linux-riscv64-gnu')
           const bindingPackageVersion = require('@visulima/vis-binding-linux-riscv64-gnu/package.json').version
-          if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -444,8 +444,8 @@ function requireNative() {
       try {
         const binding = require('@visulima/vis-binding-linux-ppc64-gnu')
         const bindingPackageVersion = require('@visulima/vis-binding-linux-ppc64-gnu/package.json').version
-        if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -460,8 +460,8 @@ function requireNative() {
       try {
         const binding = require('@visulima/vis-binding-linux-s390x-gnu')
         const bindingPackageVersion = require('@visulima/vis-binding-linux-s390x-gnu/package.json').version
-        if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -480,8 +480,8 @@ function requireNative() {
       try {
         const binding = require('@visulima/vis-binding-openharmony-arm64')
         const bindingPackageVersion = require('@visulima/vis-binding-openharmony-arm64/package.json').version
-        if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -496,8 +496,8 @@ function requireNative() {
       try {
         const binding = require('@visulima/vis-binding-openharmony-x64')
         const bindingPackageVersion = require('@visulima/vis-binding-openharmony-x64/package.json').version
-        if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -512,8 +512,8 @@ function requireNative() {
       try {
         const binding = require('@visulima/vis-binding-openharmony-arm')
         const bindingPackageVersion = require('@visulima/vis-binding-openharmony-arm/package.json').version
-        if (bindingPackageVersion !== '1.0.0-alpha.19' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.21 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0-alpha.21' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0-alpha.22 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -579,7 +579,8 @@ if (!nativeBinding) {
   throw new Error(`Failed to load native binding`)
 }
 
-const { advisoriesIngest, advisoriesQuery, advisoriesStatus, allKnownTags, cleanWorkspace, detectPackageManager, execPmCommand, execPmCommandInteractive, NATIVE_BINDING_VERSION, parseShebang, resolveAdd, resolveDedupe, resolveDlx, resolveEditorconfigDefaults, resolveExec, resolveInstall, resolveLink, resolveOutdated, resolvePmCommand, resolveRemove, resolveUnlink, resolveWhy, sortPackageJsonString, sortPackageJsonStringWithOptions, tagsFromPath, tagsFromPaths, whichBin } = nativeBinding
+const { OsvBloomHandle, advisoriesIngest, advisoriesQuery, advisoriesStatus, allKnownTags, cleanWorkspace, detectPackageManager, execPmCommand, execPmCommandInteractive, NATIVE_BINDING_VERSION, osvBloomDecode, osvBloomProbe, osvBloomProbeBatch, parseShebang, resolveAdd, resolveDedupe, resolveDlx, resolveEditorconfigDefaults, resolveExec, resolveInstall, resolveLink, resolveOutdated, resolvePmCommand, resolveRemove, resolveUnlink, resolveWhy, sortPackageJsonString, sortPackageJsonStringWithOptions, tagsFromPath, tagsFromPaths, whichBin } = nativeBinding
+export { OsvBloomHandle }
 export { advisoriesIngest }
 export { advisoriesQuery }
 export { advisoriesStatus }
@@ -589,6 +590,9 @@ export { detectPackageManager }
 export { execPmCommand }
 export { execPmCommandInteractive }
 export { NATIVE_BINDING_VERSION }
+export { osvBloomDecode }
+export { osvBloomProbe }
+export { osvBloomProbeBatch }
 export { parseShebang }
 export { resolveAdd }
 export { resolveDedupe }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visulima/vis",
-  "version": "1.0.0-alpha.21",
+  "version": "1.0.0-alpha.22",
   "description": "A monorepo dev toolkit — task runner, remote caching, security scanning, git hooks, and AI agent integrations — powered by @visulima/task-runner",
   "keywords": [
     "build",
@@ -77,9 +77,11 @@
     "LICENSE.md"
   ],
   "dependencies": {
+    "@visulima/error": "6.0.0-alpha.26",
     "@visulima/secret-scanner": "1.0.0-alpha.3",
-    "@visulima/task-runner": "1.0.0-alpha.14",
-    "@visulima/tui": "1.0.0-alpha.16",
+    "@visulima/source-map": "3.0.0-alpha.9",
+    "@visulima/task-runner": "1.0.0-alpha.15",
+    "@visulima/tui": "1.0.0-alpha.17",
     "jiti": "^2.7.0",
     "module-replacements": "^2.11.0",
     "module-replacements-codemods": "^1.2.1",
@@ -89,7 +91,9 @@
   },
   "peerDependencies": {
     "@gitbeaker/rest": ">=43.8.0",
-    "@octokit/rest": ">=22.0.1"
+    "@octokit/rest": ">=22.0.1",
+    "fb-watchman": ">=2.0.0",
+    "sigstore": ">=3.0.0"
   },
   "peerDependenciesMeta": {
     "@gitbeaker/rest": {
@@ -97,17 +101,23 @@
     },
     "@octokit/rest": {
       "optional": true
+    },
+    "fb-watchman": {
+      "optional": true
+    },
+    "sigstore": {
+      "optional": true
     }
   },
   "optionalDependencies": {
-    "@visulima/vis-binding-darwin-arm64": "1.0.0-alpha.21",
-    "@visulima/vis-binding-linux-arm64-musl": "1.0.0-alpha.21",
-    "@visulima/vis-binding-linux-x64-gnu": "1.0.0-alpha.21",
-    "@visulima/vis-binding-linux-arm64-gnu": "1.0.0-alpha.21",
-    "@visulima/vis-binding-darwin-x64": "1.0.0-alpha.21",
-    "@visulima/vis-binding-win32-arm64-msvc": "1.0.0-alpha.21",
-    "@visulima/vis-binding-linux-x64-musl": "1.0.0-alpha.21",
-    "@visulima/vis-binding-win32-x64-msvc": "1.0.0-alpha.21"
+    "@visulima/vis-binding-darwin-arm64": "1.0.0-alpha.22",
+    "@visulima/vis-binding-linux-arm64-gnu": "1.0.0-alpha.22",
+    "@visulima/vis-binding-darwin-x64": "1.0.0-alpha.22",
+    "@visulima/vis-binding-linux-arm64-musl": "1.0.0-alpha.22",
+    "@visulima/vis-binding-linux-x64-gnu": "1.0.0-alpha.22",
+    "@visulima/vis-binding-linux-x64-musl": "1.0.0-alpha.22",
+    "@visulima/vis-binding-win32-arm64-msvc": "1.0.0-alpha.22",
+    "@visulima/vis-binding-win32-x64-msvc": "1.0.0-alpha.22"
   },
   "engines": {
     "node": "^22.14.0 || >=24.10.0"

package/schemas/project.schema.json

@@ -70,6 +70,10 @@
             ],
             "description": "Project type — `library`, `application`, `service`, or `tool`.\n\n- `library` — reusable code consumed by other workspace projects.\n- `application` — end-user-facing build target (web app, mobile app).\n- `service` — long-running HTTP / worker process deployed independently.\n- `tool` — CLI or developer tooling shipped as an executable."
         },
+        "restricted": {
+            "type": "boolean",
+            "description": "Marks the project as write-restricted. Consumed by `vis sync codeowners --write-guard` to scope the generated Write Guard workflow to this project's paths."
+        },
         "sourceRoot": {
             "type": "string",
             "description": "Source root, used for display and language inference."
@@ -166,6 +170,10 @@
                     "type": "string",
                     "description": "The command to run (alternative to executor)"
                 },
+                "concurrencyGroup": {
+                    "type": "string",
+                    "description": "Workspace-level concurrency group this target opts into. The scheduler caps the *combined* in-flight count of every task whose target carries the same group name to the value declared in  {@link  TaskRunnerOptions.concurrencyGroups } . Use this when several targets share an external resource (a single Postgres, a developer's Docker daemon, an account-wide deploy lock) so the cap follows the resource, not any single target name.\n\nTargets that name a group not declared in `concurrencyGroups` run uncapped — a typo shouldn't deadlock the graph. Caps don't apply to tasks marked `always: true`; those run in a separate finalisation phase outside the scheduler."
+                },
                 "configurations": {
                     "type": "object",
                     "additionalProperties": {
@@ -174,10 +182,6 @@
                     },
                     "description": "Named configurations (e.g., \"production\", \"development\")"
                 },
-                "concurrencyGroup": {
-                    "type": "string",
-                    "description": "Workspace-level concurrency group this target opts into. The scheduler caps the *combined* in-flight count of every task whose target carries the same group name to the value declared in  {@link  TaskRunnerOptions.concurrencyGroups } . Use this when several targets share an external resource (a single Postgres, a developer's Docker daemon, an account-wide deploy lock) so the cap follows the resource, not any single target name.\n\nTargets that name a group not declared in `concurrencyGroups` run uncapped — a typo shouldn't deadlock the graph. Caps don't apply to tasks marked `always: true`; those run in a separate finalisation phase outside the scheduler."
-                },
                 "dependsOn": {
                     "type": "array",
                     "items": {
@@ -233,6 +237,14 @@
                     "type": "string",
                     "description": "The executor/command to run"
                 },
+                "hashMode": {
+                    "type": "string",
+                    "enum": [
+                        "declared",
+                        "trace"
+                    ],
+                    "description": "How this target's cache key is derived.\n\n- `\"declared\"` (default): the Nx-style path — the hash is built   up-front from explicitly declared `inputs` (plus named/global   inputs and the lockfile). Deterministic and portable across   machines: two runners with the same workspace state produce the   same key regardless of OS or syscall surface.\n- `\"trace\"`: the task is run under the file-access tracker   (strace on Linux, an fs preload shim elsewhere) and the cache   key is derived from the files it actually *read* during   execution — no `inputs` declaration required. Mirrors the   shipped `{ auto: true }` output capture, but for the input   side. Use for compound or opaque commands whose real input set   is impractical to enumerate.\n\nOpt-in per target precisely because trace mode trades reproducibility for convenience: the observed read set can differ across runners with different syscall surfaces (a static binary on a host without strace records nothing), so a trace key is **not** guaranteed portable between machines. Leave targets on `\"declared\"` whenever the input set can reasonably be listed.\n\nEquivalent to flipping  {@link  TaskRunnerOptions.autoFingerprint }  on for this one target while every other target stays declared."
+                },
                 "inputs": {
                     "type": "array",
                     "items": {
@@ -333,14 +345,32 @@
                 },
                 "maxConcurrent": {
                     "type": "number",
-                    "description": "Maximum number of in-flight instances of this target across the whole graph. When set, the scheduler refuses to start an additional task whose `target.target` equals this target's name once the running count reaches `maxConcurrent`. Independent of `--parallel`: the global cap still bounds total in-flight tasks, and `maxConcurrent` further bounds the per-target subset.\n\nUse for tests/deploys that share an external resource (DB, port, mock server). Set to `1` to serialize. Values `<= 0` are ignored.\n\nIf multiple projects declare different values for the same target name, the runner uses the smallest declared cap. Caps don't apply to tasks marked `always: true`; those run in a separate finalisation phase outside the scheduler."
+                    "description": "Maximum number of in-flight instances of this target across the whole graph. When set, the scheduler refuses to start an additional task whose `target.target` equals this target's name once the running count reaches `maxConcurrent`. Independent of `--parallel`: the global cap still bounds total in-flight tasks, and `maxConcurrent` further bounds the per-target subset.\n\nUse for tests/deploys that share an external resource (DB, port, mock server). Set to `1` to serialize. Values `&lt;= 0` are ignored.\n\nIf multiple projects declare different values for the same target name, the runner uses the smallest declared cap. Caps don't apply to tasks marked `always: true`; those run in a separate finalisation phase outside the scheduler."
                 },
                 "outputs": {
                     "type": "array",
                     "items": {
-                        "type": "string"
+                        "anyOf": [
+                            {
+                                "type": "string"
+                            },
+                            {
+                                "type": "object",
+                                "properties": {
+                                    "auto": {
+                                        "type": "boolean",
+                                        "const": true
+                                    }
+                                },
+                                "required": [
+                                    "auto"
+                                ],
+                                "additionalProperties": false
+                            }
+                        ],
+                        "description": "A single entry in a task's `outputs` list.\n\n- `string` — a literal path *or* a glob pattern relative to the   workspace root. Prefix with `!` to exclude files the positive   patterns would otherwise include (e.g. `\"!dist/cache/**\"`).\n- `{ auto: true }` — use whatever files the task actually wrote   during execution (resolved from the file-access tracker). Lets   authors who don't know their exact output layout cache results   without listing every path. Silently behaves as \"no outputs\" when   tracking isn't active for this task."
                     },
-                    "description": "Output patterns produced by this target"
+                    "description": "Output patterns produced by this target. Each entry is a literal path, a glob (`\"dist/**\"`), a negative glob (`\"!dist/cache/**\"`), or `{ auto: true }` to cache whatever files the task actually wrote during execution (resolved from the file-access tracker). `{ auto: true }` lets a build script cache zero-config without the author enumerating its output layout; it contributes nothing — and the runner declines to seed the cache — when write tracking isn't available for the task, so a hit can never restore a missing artifact."
                 },
                 "parallelism": {
                     "type": "boolean",