@visulima/vis 1.0.0-alpha.37 → 1.0.0-alpha.39

package/dist/packem_shared/interface.d-B7VK2rcH.d.ts

@@ -0,0 +1,148 @@
+interface PackResult {
+  /** Whatever metadata the manager emitted (e.g. file list). Optional. */
+  raw?: unknown;
+  /** Absolute path to the produced `.tgz` file. */
+  tarball: string;
+}
+interface PackOptions {
+  /** Working directory of the package. */
+  cwd: string;
+  /** Output directory for the tarball. Default: cwd. */
+  destination?: string;
+  /** Override output filename — useful to normalise yarn's `package.tgz` default. */
+  filename?: string;
+}
+interface InstallLockfileOnlyOptions {
+  /** Workspace root (or any dir within the workspace). */
+  cwd: string;
+  /** Avoid emitting noise to stdout/stderr. */
+  silent?: boolean;
+}
+interface PublishOptions {
+  /** `public` or `restricted`. */
+  access?: "public" | "restricted";
+  /** Extra args passed through to the publisher. */
+  extraArgs?: string[];
+  /** 2FA token. */
+  otp?: string;
+  /** Provenance attestation (npm/pnpm/yarn only). */
+  provenance?: boolean;
+  /** Override registry URL. */
+  registry?: string;
+  /**
+  * Stage the publish for human review instead of going live. Requires
+  * npm CLI ≥ 11.15.0 and npmjs.com as the registry. Adapters that don't
+  * support staging silently fall through to a regular publish; the
+  * orchestrator's doctor + workflow text steer operators around this.
+  */
+  stage?: boolean;
+  /** npm dist-tag. */
+  tag?: string;
+  /** Path to the `.tgz` to publish. */
+  tarball: string;
+}
+interface PublishNativeOptions {
+  /** `public` or `restricted`. */
+  access?: "public" | "restricted";
+  /** Package directory — the manager packs + publishes from here. */
+  cwd: string;
+  /** Extra args passed through to the publisher. */
+  extraArgs?: string[];
+  /** 2FA token (managers that support it on their native publish path). */
+  otp?: string;
+  /** Provenance attestation (npm/pnpm/yarn only; bun ignores). */
+  provenance?: boolean;
+  /** Override registry URL. */
+  registry?: string;
+  /** npm dist-tag. */
+  tag?: string;
+}
+interface PublishResult {
+  /** Whether the registry rejected because the tarball was already there. */
+  alreadyPublished?: boolean;
+  /** Captured stdout/stderr for diagnostics. */
+  output?: string;
+  /** Whether the publish succeeded. False if "already published" was detected. */
+  published: boolean;
+  /**
+  * `npm stage publish` returns a stage id (uuid). Surfaced so the
+  * orchestrator can list it in the state file and so `vis release stage
+  * approve` can promote the wave atomically.
+  */
+  stageId?: string;
+  /**
+  * Path + hashes of the tarball that was published (or would have been, in
+  * dry-run). Set when the version-actions implementation can surface them;
+  * consumed by the orchestrator's release-asset attestation step.
+  */
+  tarball?: {
+    path: string;
+    sha256: string;
+    sha512: string;
+    size: number;
+  };
+}
+interface CommandRunner {
+  /** Spawn a child process. Returns combined stdout for downstream parsing. */
+  run: (command: string, args: ReadonlyArray<string>, options: {
+    cwd: string;
+    env?: NodeJS.ProcessEnv;
+    silent?: boolean;
+  }) => Promise<{
+    exitCode: number;
+    stderr: string;
+    stdout: string;
+  }>;
+}
+interface WorkspaceListEntry {
+  name: string;
+  /** Absolute directory of the package. */
+  path: string;
+  private: boolean;
+  version: string;
+}
+/**
+* Per-pm primitives: pack, install, publish, list workspaces, resolve
+* `catalog:` (only pnpm — others throw if asked).
+*
+* Implementations are stateless. Construct via `detectPackageManager(cwd)`.
+*/
+declare abstract class PackageManagerAdapter {
+  readonly runner: CommandRunner;
+  abstract readonly id: "npm" | "pnpm" | "yarn" | "bun";
+  abstract readonly minVersion: string;
+  constructor(runner: CommandRunner);
+  abstract pack(options: PackOptions): Promise<PackResult>;
+  abstract installLockfileOnly(options: InstallLockfileOnlyOptions): Promise<void>;
+  abstract listWorkspacePackages(cwd: string): Promise<WorkspaceListEntry[]>;
+  /**
+  * Publish a tarball. Default impl in the `npm` adapter — yarn/bun/pnpm
+  * may simply re-call `npm publish &lt;tarball>` per RFC §11.3 when the
+  * configured `publishStrategy` is `"npm-publish-tarball"` (default).
+  */
+  abstract publish(options: PublishOptions): Promise<PublishResult>;
+  /**
+  * Native publish: run the package manager's own `publish` command directly
+  * from the package directory (the manager packs + publishes itself), used
+  * when the project opts into `publish.publishStrategy: "native"`. The
+  * default LCD path is `publish` (an `npm publish` of a packed tarball).
+  * Each adapter overrides this with its own publish command + flag surface;
+  * the default throws so an adapter that genuinely can't publish natively
+  * fails loudly rather than silently no-opping.
+  *
+  * Caveat (RFC §11.3): native publish lets the manager resolve
+  * `workspace:`/`catalog:` itself. Only pnpm rewrites `catalog:` — on
+  * npm/yarn/bun the operator must set `catalogResolution: "in-place"` (or
+  * have no catalog refs) or the published tarball will carry literal
+  * `catalog:` specifiers.
+  */
+  publishNative(_options: PublishNativeOptions): Promise<PublishResult>;
+  /** Native pm version detection (e.g. `&lt;pm> --version`). */
+  abstract detectVersion(cwd: string): Promise<string | undefined>;
+  /**
+  * Read this manager's catalog block (only pnpm has them). Default impl
+  * returns `undefined` — adapters override to provide raw YAML/JSON.
+  */
+  readCatalogYaml(_cwd: string): Promise<string | undefined>;
+}
+export { CommandRunner as C, InstallLockfileOnlyOptions as I, PackageManagerAdapter as P, WorkspaceListEntry as W, PackOptions as a, PackResult as b, PublishNativeOptions as c, PublishOptions as d, PublishResult as e };

package/dist/packem_shared/interface.d-Cezzifoh.d.ts

@@ -0,0 +1,106 @@
+import { PlannedRelease, PerPackageReleaseConfig, WorkspacePackage, PackageManifest, VisReleaseConfig } from "../release/types.js";
+import { P as PackageManagerAdapter, e as PublishResult } from "./interface.d-B7VK2rcH.js";
+/**
+* Parsed `pnpm-workspace.yaml` catalogs.
+*   - `default` is the top-level `catalog:` block (referenced as `catalog:` in deps).
+*   - `named` is the `catalogs:` map (referenced as `catalog:<name>`).
+*/
+interface Catalogs {
+  default: Record<string, string>;
+  named: Record<string, Record<string, string>>;
+}
+interface PublishContext {
+  /** Catalog blocks for `catalog:` rewriting. */
+  catalogs: Catalogs;
+  /** Strip non-publishable fields (`scripts`, `devDependencies`, etc.). */
+  cleanPackageJsonConfig?: boolean | {
+    keep?: string[];
+    strip?: string[];
+  };
+  /** Dry-run mode — perform no writes / no network calls. */
+  dryRun?: boolean;
+  /** OTP for 2FA-protected publishes. */
+  otp?: string;
+  /** Per-package config (incl. custom commands subject to trust gate). */
+  perPackageConfig?: PerPackageReleaseConfig;
+  /** Pre-bump source-tree manifest (read-only). */
+  pkg: WorkspacePackage;
+  /** Active package-manager adapter for this workspace. */
+  pm: PackageManagerAdapter;
+  /** Provenance attestation requested? (Skipped for managers that don't support it.) */
+  provenance?: boolean;
+  /** Resolved registry (per-pkg override or global). */
+  registry?: string;
+  /** The plan entry for this package (with the new version etc.). */
+  release: PlannedRelease;
+  /**
+  * When set, the tarball is already staged on the registry under this
+  * id; skip pack + publish and resume waiting on the existing decision.
+  * Carried by `vis release publish --resume` / re-runs after a timeout
+  * so we don't try to re-upload a version npm already has staged.
+  */
+  resumeStageId?: string;
+  /** Channel-derived dist-tag. */
+  tag?: string;
+  /** Map of every package being released this wave (for workspace: rewriting). */
+  versionedManifestByName: ReadonlyMap<string, PackageManifest>;
+  /** Workspace-wide config (for trust-gate evaluation, etc.). */
+  workspaceConfig?: VisReleaseConfig;
+}
+interface AfterAllVersionedContext {
+  /** Workspace root. */
+  cwd: string;
+  /** Active package-manager adapter. */
+  pm: PackageManagerAdapter;
+  /** All releases in this wave. */
+  releases: ReadonlyArray<PlannedRelease>;
+}
+interface AfterAllVersionedResult {
+  changedFiles: string[];
+  deletedFiles: string[];
+}
+/**
+* Per-package versioning + publishing contract.
+*
+* Concrete implementations are stateless. Construct one instance per
+* package per release wave; the orchestrator passes context per call.
+*/
+declare abstract class VersionActions {
+  /**
+  * Stable id for resolution (`"npm"`, `"native-addon"`, `"private"`,
+  * or a path for custom impls).
+  */
+  abstract readonly id: string;
+  /**
+  * Read the current published version of this package from the registry.
+  * Returns `undefined` for private packages or fresh packages never published.
+  *
+  * The optional `workspaceConfig` field threads workspace-level
+  * knobs (currently only `httpProxy`) so adapters can route registry
+  * probes through an enterprise proxy. Older adapters that ignore
+  * the field continue to work.
+  */
+  abstract readPublishedVersion(context: {
+    pkg: WorkspacePackage;
+    pm: PackageManagerAdapter;
+    workspaceConfig?: VisReleaseConfig;
+  }): Promise<string | undefined>;
+  /**
+  * Publish this package (and any sidecars). Implementations are responsible
+  * for: protocol resolution, catalog rewriting, clean-package-json,
+  * pack-then-publish via the active adapter.
+  */
+  abstract publish(context: PublishContext): Promise<PublishResult>;
+}
+/**
+* Optional companion hook — runs once per workspace after every package's
+* `bumpVersion` step has completed and before the prettier/commit phase.
+*
+* Used to update sidecar files that span packages (e.g. NAPI platform
+* `optionalDependencies` blocks, lockfile re-sync). Returned files are
+* auto-staged into the release commit.
+*/
+declare abstract class AfterAllProjectsVersioned {
+  abstract afterAllVersioned(context: AfterAllVersionedContext): Promise<AfterAllVersionedResult>;
+}
+export { AfterAllProjectsVersioned as A, PublishContext as P, VersionActions as V, AfterAllVersionedContext as a, AfterAllVersionedResult as b };

package/dist/packem_shared/{missing-package-json-41VUWFBY.js → missing-package-json-BfWUxTGv.js}

@@ -1 +1 @@
-import{f as a,m as h,B as o,I as f}from"./index-BDmTbWX1.js";import{l as d,m as $}from"../packem_chunks/bin.js";const g=/\/+$/,p=/node_modules/,u=/\.git/,k=/[$()+.?[\\\]^{|}]/g,S=/\/\*\*$|\/\*\/\*$/,W=(i,c)=>{const e=c.replace(g,"");if(e.startsWith("!"))return[];const n=[];if(e.endsWith("/*")){const s=e.slice(0,-2),t=o(i,s);if(!a(t))return[];for(const r of f(t,{includeFiles:!1,includeSymlinks:!1,maxDepth:1,skip:[p,u]}))r.path===t||r.name.startsWith(".")||n.push(h(s,r.name));return n}if(e.endsWith("/**")||e.endsWith("/*/*")){const s=e.replace(S,""),t=o(i,s);if(!a(t))return[];for(const r of f(t,{includeFiles:!1,includeSymlinks:!1,skip:[p,u]})){if(r.path===t)continue;const m=r.path.slice(t.length+1);n.push(`${s}/${m}`)}return n}if(!e.includes("/")&&e.includes("*")){const s=e.replaceAll(k,String.raw`\$&`).replaceAll("*",".*"),t=new RegExp(`^${s}$`);for(const r of f(i,{includeFiles:!1,includeSymlinks:!1,maxDepth:1,skip:[p,u]}))r.path!==i&&t.test(r.name)&&n.push(r.name);return n}const l=o(i,e);return a(l)&&n.push(e),n},y=i=>{const c=d(i)??$(i)??[],e=new Set,n=[];for(const l of c)for(const s of W(i,l))s==="."||e.has(s)||(e.add(s),a(h(i,s,"package.json"))||n.push({packageDir:s}));return n};export{y as l};
+import{f as a,m as h,B as l,I as f}from"./index-BDmTbWX1.js";import{e as d,t as $}from"../packem_chunks/bin.js";const g=/\/+$/,p=/node_modules/,u=/\.git/,k=/[$()+.?[\\\]^{|}]/g,S=/\/\*\*$|\/\*\/\*$/,W=(i,c)=>{const e=c.replace(g,"");if(e.startsWith("!"))return[];const n=[];if(e.endsWith("/*")){const s=e.slice(0,-2),t=l(i,s);if(!a(t))return[];for(const r of f(t,{includeFiles:!1,includeSymlinks:!1,maxDepth:1,skip:[p,u]}))r.path===t||r.name.startsWith(".")||n.push(h(s,r.name));return n}if(e.endsWith("/**")||e.endsWith("/*/*")){const s=e.replace(S,""),t=l(i,s);if(!a(t))return[];for(const r of f(t,{includeFiles:!1,includeSymlinks:!1,skip:[p,u]})){if(r.path===t)continue;const m=r.path.slice(t.length+1);n.push(`${s}/${m}`)}return n}if(!e.includes("/")&&e.includes("*")){const s=e.replaceAll(k,String.raw`\$&`).replaceAll("*",".*"),t=new RegExp(`^${s}$`);for(const r of f(i,{includeFiles:!1,includeSymlinks:!1,maxDepth:1,skip:[p,u]}))r.path!==i&&t.test(r.name)&&n.push(r.name);return n}const o=l(i,e);return a(o)&&n.push(e),n},y=i=>{const c=d(i)??$(i)??[],e=new Set,n=[];for(const o of c)for(const s of W(i,o))s==="."||e.has(s)||(e.add(s),a(h(i,s,"package.json"))||n.push({packageDir:s}));return n};export{y as l};

package/dist/packem_shared/{native-config-sync-BKAZ0NIs.js → native-config-sync-BEkJW7g3.js}

@@ -1,7 +1,7 @@
-import{m as c,v as f,T as i,f as y}from"./index-BDmTbWX1.js";import{r as O,u as C}from"../packem_chunks/bin.js";import{a as D}from"../packem_chunks/config.js";const N=(E,p,o)=>{const s=[],$=Object.entries(o).filter(([,n])=>n).map(([n])=>n);switch(E){case"bun":{const n=c(p,"package.json");if(y(n))try{const e=D(n);e.trustedDependencies=$,i(n,`${JSON.stringify(e,null,2)}
-`),s.push(`Updated package.json trustedDependencies with ${$.length} packages`)}catch(e){s.push(`Failed to update package.json: ${e instanceof Error?e.message:String(e)}`)}break}case"npm":{const n=c(p,".npmrc");let e=y(n)?f(n):"";/^\s*ignore-scripts\s*=\s*true\s*$/m.test(e)?s.push(".npmrc already has ignore-scripts=true"):(e=`${e.trimEnd()}
+import{m as c,v as f,T as i,f as y}from"./index-BDmTbWX1.js";import"./public-api-WqUCiyIe.js";import{n as O,u as C}from"../packem_chunks/bin.js";import{a as D}from"../packem_chunks/config.js";const W=(E,a,o)=>{const s=[],$=Object.entries(o).filter(([,n])=>n).map(([n])=>n);switch(E){case"bun":{const n=c(a,"package.json");if(y(n))try{const e=D(n);e.trustedDependencies=$,i(n,`${JSON.stringify(e,null,2)}
+`),s.push(`Updated package.json trustedDependencies with ${$.length} packages`)}catch(e){s.push(`Failed to update package.json: ${e instanceof Error?e.message:String(e)}`)}break}case"npm":{const n=c(a,".npmrc");let e=y(n)?f(n):"";/^\s*ignore-scripts\s*=\s*true\s*$/m.test(e)?s.push(".npmrc already has ignore-scripts=true"):(e=`${e.trimEnd()}
 ignore-scripts=true
-`,i(n,e),s.push("Added ignore-scripts=true to .npmrc"));break}case"pnpm":{const n=c(p,"pnpm-workspace.yaml");if(!y(n)){s.push("pnpm-workspace.yaml not found. Cannot sync allowBuilds.");break}let e={},m=[];try{const t=C(n);e=t?.allowBuilds??{},m=Array.isArray(t?.onlyBuiltDependencies)?t.onlyBuiltDependencies:[]}catch{}const g={...e,...o},j=Object.keys(o).filter(t=>e[t]!==o[t]).length,d=$.toSorted((t,a)=>t.localeCompare(a)),k=[...new Set([...m,...d])].toSorted((t,a)=>t.localeCompare(a)),b=d.filter(t=>!m.includes(t)).length;if(j===0&&b===0)s.push(`All ${String(Object.keys(o).length)} allowBuilds entries already present in pnpm-workspace.yaml.`);else{const t=Object.keys(g).sort(),a=l=>l.startsWith("@")||l.includes("/")||/[:#\s]/.test(l),h=l=>a(l)?`'${l.replaceAll("'","''")}'`:l,u=`allowBuilds:
+`,i(n,e),s.push("Added ignore-scripts=true to .npmrc"));break}case"pnpm":{const n=c(a,"pnpm-workspace.yaml");if(!y(n)){s.push("pnpm-workspace.yaml not found. Cannot sync allowBuilds.");break}let e={},m=[];try{const t=C(n);e=t?.allowBuilds??{},m=Array.isArray(t?.onlyBuiltDependencies)?t.onlyBuiltDependencies:[]}catch{}const g={...e,...o},j=Object.keys(o).filter(t=>e[t]!==o[t]).length,d=$.toSorted((t,p)=>t.localeCompare(p)),k=[...new Set([...m,...d])].toSorted((t,p)=>t.localeCompare(p)),b=d.filter(t=>!m.includes(t)).length;if(j===0&&b===0)s.push(`All ${String(Object.keys(o).length)} allowBuilds entries already present in pnpm-workspace.yaml.`);else{const t=Object.keys(g).sort(),p=l=>l.startsWith("@")||l.includes("/")||/[:#\s]/.test(l),h=l=>p(l)?`'${l.replaceAll("'","''")}'`:l,u=`allowBuilds:
 ${t.map(l=>`  ${h(l)}: ${String(g[l])}`).join(`
 `)}
 `;let r=f(n);r.endsWith(`
@@ -9,13 +9,13 @@ ${t.map(l=>`  ${h(l)}: ${String(g[l])}`).join(`
 `);const S=/^allowBuilds:[ \t]*\n(?:[ \t]{2}[^\n]*\n)*/m;if(r=S.test(r)?r.replace(S,u):`${r.trimEnd()}
 
 ${u}`,k.length>0){const l=`onlyBuiltDependencies:
-${k.map(B=>`  - ${a(B)?`'${B.replaceAll("'","''")}'`:B}`).join(`
+${k.map(B=>`  - ${p(B)?`'${B.replaceAll("'","''")}'`:B}`).join(`
 `)}
 `,A=/^onlyBuiltDependencies:[ \t]*\n(?:[ \t]{2}[^\n]*\n)*/m;r=A.test(r)?r.replace(A,l):`${r.trimEnd()}
 
-${l}`}i(n,r),s.push(`Updated pnpm-workspace.yaml allowBuilds (${String(j)} new, ${String(t.length)} total)`),b>0&&s.push(`Updated pnpm-workspace.yaml onlyBuiltDependencies (${String(b)} new, ${String(k.length)} total)`)}const w=c(p,"package.json");if(y(w)&&d.length>0)try{const t=D(w),a=Array.isArray(t.pnpm?.onlyBuiltDependencies)?t.pnpm.onlyBuiltDependencies:[],h=[...new Set([...a,...d])].toSorted((r,S)=>r.localeCompare(S)),u=d.filter(r=>!a.includes(r)).length;u>0&&(t.pnpm={...t.pnpm,onlyBuiltDependencies:h},i(w,`${JSON.stringify(t,null,2)}
-`),s.push(`Updated package.json pnpm.onlyBuiltDependencies (${String(u)} new, ${String(h.length)} total)`))}catch(t){s.push(`Failed to update package.json pnpm.onlyBuiltDependencies: ${t instanceof Error?t.message:String(t)}`)}break}case"yarn":{if(O(p)){const n=c(p,".yarnrc.yml");let e=f(n);const m=/^\s*enableScripts\s*:/m.test(e),g=/^\s*enableScripts\s*:\s*false\s*$/m.test(e);m?g?s.push(".yarnrc.yml already has enableScripts: false"):(e=e.replace(/^\s*enableScripts\s*:.+$/m,"enableScripts: false"),i(n,e),s.push("Changed enableScripts to false in .yarnrc.yml")):(e=`${e.trimEnd()}
+${l}`}i(n,r),s.push(`Updated pnpm-workspace.yaml allowBuilds (${String(j)} new, ${String(t.length)} total)`),b>0&&s.push(`Updated pnpm-workspace.yaml onlyBuiltDependencies (${String(b)} new, ${String(k.length)} total)`)}const w=c(a,"package.json");if(y(w)&&d.length>0)try{const t=D(w),p=Array.isArray(t.pnpm?.onlyBuiltDependencies)?t.pnpm.onlyBuiltDependencies:[],h=[...new Set([...p,...d])].toSorted((r,S)=>r.localeCompare(S)),u=d.filter(r=>!p.includes(r)).length;u>0&&(t.pnpm={...t.pnpm,onlyBuiltDependencies:h},i(w,`${JSON.stringify(t,null,2)}
+`),s.push(`Updated package.json pnpm.onlyBuiltDependencies (${String(u)} new, ${String(h.length)} total)`))}catch(t){s.push(`Failed to update package.json pnpm.onlyBuiltDependencies: ${t instanceof Error?t.message:String(t)}`)}break}case"yarn":{if(O(a)){const n=c(a,".yarnrc.yml");let e=f(n);const m=/^\s*enableScripts\s*:/m.test(e),g=/^\s*enableScripts\s*:\s*false\s*$/m.test(e);m?g?s.push(".yarnrc.yml already has enableScripts: false"):(e=e.replace(/^\s*enableScripts\s*:.+$/m,"enableScripts: false"),i(n,e),s.push("Changed enableScripts to false in .yarnrc.yml")):(e=`${e.trimEnd()}
 enableScripts: false
-`,i(n,e),s.push("Added enableScripts: false to .yarnrc.yml"))}else{const n=c(p,".npmrc");let e=y(n)?f(n):"";/^\s*ignore-scripts\s*=\s*true\s*$/m.test(e)?s.push(".npmrc already has ignore-scripts=true"):(e=`${e.trimEnd()}
+`,i(n,e),s.push("Added enableScripts: false to .yarnrc.yml"))}else{const n=c(a,".npmrc");let e=y(n)?f(n):"";/^\s*ignore-scripts\s*=\s*true\s*$/m.test(e)?s.push(".npmrc already has ignore-scripts=true"):(e=`${e.trimEnd()}
 ignore-scripts=true
-`,i(n,e),s.push("Added ignore-scripts=true to .npmrc (yarn classic lacks enableScripts)"))}break}}return s};export{N as O};
+`,i(n,e),s.push("Added ignore-scripts=true to .npmrc (yarn classic lacks enableScripts)"))}break}}return s};export{W as O};

package/dist/packem_shared/pm-runner-OGResYrA.js

@@ -0,0 +1 @@
+import{createRequire as L}from"node:module";import{f as R,m as $,H as S,j as x,v as N}from"./index-BDmTbWX1.js";import{s as y}from"./index-CgcF6_wo.js";import{detectPackageManager as J,resolveAdd as z,resolveRemove as H,resolveDlx as F,whichBin as V,resolveInstall as Y,execPmCommandInteractive as G,resolveDedupe as K,resolveWhy as Q,resolveLink as X,resolveUnlink as Z,resolveExec as ee,resolvePmCommand as ne}from"#native";const T=L(import.meta.url),b=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,U=e=>{if(typeof b<"u"&&b.versions&&b.versions.node){const[n,s]=b.versions.node.split(".").map(Number);if(n>22||n===22&&s>=3||n===20&&s>=16)return b.getBuiltinModule(e)}return T(e)},{spawn:q,spawnSync:B}=U("node:child_process"),h=(e,n,s,r)=>{for(const a of n)e.push("--filter",a);s&&e.push("--recursive"),r&&e.push("--workspace-root")},se=e=>{const n=[],s=[];return h(n,e.filter,e.recursive,e.workspaceRoot),e.silent&&n.push("--silent"),e.frozenLockfile&&n.push("--frozen-lockfile"),n.push("install"),e.dev&&n.push("--dev"),e.prod&&n.push("--prod"),e.force&&n.push("--force"),e.ignoreScripts&&n.push("--ignore-scripts"),e.lockfileOnly&&n.push("--lockfile-only"),e.noOptional&&n.push("--no-optional"),e.offline&&n.push("--offline"),{args:n,bin:"aube",warnings:s}},re=e=>{const n=[],s=[];return h(n,e.filter,!1,!1),n.push("add"),e.saveDev&&n.push("--save-dev"),e.exact&&n.push("--save-exact"),e.global&&n.push("--global"),e.optional&&n.push("--save-optional"),e.peer&&n.push("--save-peer"),e.workspace&&s.push("aube has no flag for the `workspace:` protocol; it auto-detects local workspace members during add. Ignoring --workspace."),e.workspaceRoot&&n.push("--workspace"),n.push(...e.packages),{args:n,bin:"aube",warnings:s}},ae=e=>{const n=[];return h(n,e.filter,e.recursive,!1),n.push("remove"),e.saveDev&&n.push("--save-dev"),e.global&&n.push("--global"),e.workspaceRoot&&n.push("--workspace"),n.push(...e.packages),{args:n,bin:"aube",warnings:[]}},oe=e=>{const n=["dedupe"];return e&&n.push("--check"),{args:n,bin:"aube",warnings:[]}},ie=e=>{const n=[],s=[];h(n,e.filter,e.recursive,!1),n.push("why"),e.dev&&n.push("--dev"),e.prod&&n.push("--prod"),e.json&&n.push("--json"),e.long&&n.push("--long"),e.parseable&&n.push("--parseable"),e.depth!==void 0&&s.push("aube why does not accept --depth; ignoring."),e.noOptional&&s.push("aube why does not accept --no-optional; ignoring."),e.global&&s.push("aube why does not accept --global; ignoring.");const[r,...a]=e.packages;return r===void 0?s.push("aube why requires a package name; none provided."):(a.length>0&&s.push("aube why takes a single package; using the first."),n.push(r)),{args:n,bin:"aube",warnings:s}},te=e=>{const n=[];e.silent&&n.push("--silent"),n.push("dlx");for(const s of e.additionalPackages)n.push("--package",s);return e.shellMode&&n.push("--shell-mode"),n.push(e.package),n.push(...e.args),{args:n,bin:"aube",warnings:[]}},pe=e=>{const n=[];return h(n,e.filter,e.recursive,e.workspaceRoot),n.push("exec"),e.parallel&&n.push("--parallel"),e.reverse&&n.push("--reverse"),e.shellMode&&n.push("--shell-mode"),n.push(e.command),n.push(...e.args),{args:n,bin:"aube",warnings:[]}},ue=e=>{const n=["link"];return e!==null&&n.push(e),{args:n,bin:"aube",warnings:[]}},ce=(e,n)=>{const s=[],r=[];return n&&s.push("--recursive"),s.push("unlink"),e.length>1&&r.push("aube unlink takes a single package; using the first."),e.length>0&&s.push(e[0]),{args:s,bin:"aube",warnings:r}},le=e=>{const n=["view","--",e.package],s=[],[r,...a]=e.fields;return r!==void 0?(a.length>0&&s.push("aube view only supports a single field; using the first."),e.json&&s.push("aube view does not support --json with a field selector; printing the field without --json."),n.push(r)):e.json&&n.push("--json"),{args:n,bin:"aube",warnings:s}},Le=e=>{const n=[],s=[];return h(n,e.filters,e.recursive,e.workspaceRoot),n.push("update"),e.dev&&n.push("--dev"),e.prod&&n.push("--prod"),e.global&&n.push("--global"),e.interactive&&n.push("--interactive"),e.latest&&n.push("--latest"),e.noOptional&&n.push("--no-optional"),e.noSave&&n.push("--no-save"),n.push(...e.packages),{args:n,bin:"aube",warnings:s}},ge=new Set(["fund","ping","search","token"]),de=(e,n)=>ge.has(e)?{args:[e,...n],bin:"npm",warnings:[`'${e}' is not natively supported by aube. Delegating to npm.`]}:{args:[e,...n],bin:"aube",warnings:[]},k=256*1024,he=e=>{const n=e?{...process.env,...e}:{...process.env};return process.stderr.isTTY&&n.FORCE_COLOR===void 0&&n.NO_COLOR===void 0&&(n.FORCE_COLOR="1"),n},_=e=>e!==""&&!/[\s"&()<>^|%!]/u.test(e)?e:`"${e.replaceAll(/(\\*)"/gu,String.raw`$1$1\"`).replace(/(\\+)$/u,"$1$1").replaceAll(/[&()<>^|%!]/gu,String.raw`^$&`)}"`,fe=async(e,n,s)=>new Promise((r,a)=>{const o=process.platform==="win32",i=q(o?_(e):e,o?n.map(t=>_(t)):[...n],{cwd:s.cwd,env:he(s.env),shell:o,stdio:["inherit","pipe","pipe"],windowsHide:!0});let u=[],l=0;const g=t=>{if(u.push(t),l+=t.length,!(l<=k)){for(;u.length>1&&l-u[0].length>k;)l-=u.shift().length;if(u.length===1&&l>k){const d=u[0];u[0]=d.subarray(d.length-k),l=k}}},m=()=>Buffer.concat(u).toString("utf8");i.stdout?.on("data",t=>{process.stdout.write(t),g(t)}),i.stderr?.on("data",t=>{process.stderr.write(t),g(t)}),i.on("error",a),i.on("close",t=>{const d=m();u=[],r({code:t??1,output:d})})}),w=e=>{const n=y.coerce(e);return n?y.gte(n,"11.0.0"):!1},c=e=>e.name==="yarn"&&!e.version.startsWith("1."),j=e=>e.name==="yarn"&&e.version.startsWith("1."),me=e=>e[0]==="rm"?["remove",...e.slice(1)]:e,be=(e,n,s)=>{switch(n){case"audit":return c(e)?{args:["npm","audit",...s],bin:"yarn",kind:"rewrite"}:{kind:"passthrough"};case"config":{if(c(e)){const[r,...a]=s;return r==="delete"?{args:["config","unset",...a],bin:"yarn",kind:"rewrite",warning:"yarn berry uses `config unset`, not `config delete`."}:{kind:"passthrough"}}return e.name==="bun"?{kind:"skip",warning:"bun has no `config` CLI. Edit bunfig.toml or .npmrc directly."}:e.name==="deno"?{kind:"skip",warning:"deno has no registry-config CLI. Edit deno.json directly."}:{kind:"passthrough"}}case"dist-tag":return j(e)?{args:["tag",...s],bin:"yarn",kind:"rewrite",warning:"yarn 1 has no `dist-tag`; using `yarn tag`."}:c(e)?{args:["npm","tag",...me(s)],bin:"yarn",kind:"rewrite"}:e.name==="bun"||e.name==="deno"?{kind:"skip",warning:`${e.name} has no \`dist-tag\`. Use \`npm dist-tag\` instead.`}:{kind:"passthrough"};case"login":case"logout":return c(e)?{args:["npm",n,...s],bin:"yarn",kind:"rewrite"}:e.name==="bun"?{args:[n,...s],bin:"npm",kind:"rewrite",warning:`bun has no \`${n}\`; falling back to \`npm ${n}\` (writes ~/.npmrc, which bun reads).`}:e.name==="deno"?{kind:"skip",warning:`deno has no \`${n}\`. JSR uses browser OAuth via \`deno publish\`.`}:{kind:"passthrough"};case"owner":return e.name==="pnpm"&&w(e.version)?{args:["owner",...s],bin:"npm",kind:"rewrite",warning:"pnpm 11 removed `owner`; falling back to `npm owner`."}:c(e)?{args:["owner",...s],bin:"npm",kind:"rewrite",warning:"yarn berry has no `owner` (not in `yarn npm`); falling back to `npm owner`."}:e.name==="bun"?{args:["owner",...s],bin:"npm",kind:"rewrite",warning:"bun has no `owner`; falling back to `npm owner`."}:e.name==="deno"?{kind:"skip",warning:"deno has no `owner`. JSR uses scope-member roles via the web UI."}:{kind:"passthrough"};case"ping":return e.name==="pnpm"&&w(e.version)?{args:["ping",...s],bin:"npm",kind:"rewrite",warning:"pnpm 11 removed `ping`; falling back to `npm ping`."}:{kind:"passthrough"};case"plugin":return c(e)?{kind:"passthrough"}:{kind:"skip",warning:`${e.name} does not support yarn-style plugins. Skipping (no-op).`};case"prune":return j(e)?{kind:"skip",warning:"yarn 1 has no `prune`. Use `yarn install --production` for a prod-only tree."}:c(e)?{kind:"skip",warning:"yarn berry has no `prune`. Use `yarn workspaces focus --production` instead."}:e.name==="bun"||e.name==="deno"?{kind:"skip",warning:`${e.name} has no \`prune\`. Pruning happens automatically on install.`}:{kind:"passthrough"};case"publish":return c(e)?{args:["npm","publish",...s],bin:"yarn",kind:"rewrite"}:{kind:"passthrough"};case"rebuild":return j(e)?{kind:"skip",warning:"yarn 1 has no `rebuild`. Re-install instead."}:e.name==="bun"?{kind:"skip",warning:"bun has no `rebuild`. Use `bun install --force` instead."}:e.name==="deno"?{kind:"skip",warning:"deno has no `rebuild`."}:{kind:"passthrough"};case"search":return e.name==="pnpm"&&w(e.version)?{args:["search",...s],bin:"npm",kind:"rewrite",warning:"pnpm 11 removed `search`; falling back to `npm search`."}:{kind:"passthrough"};case"token":return e.name==="pnpm"&&w(e.version)?{args:["token",...s],bin:"npm",kind:"rewrite",warning:"pnpm 11 removed `token`; falling back to `npm token`."}:{kind:"passthrough"};case"whoami":return e.name==="pnpm"&&w(e.version)?{args:["whoami",...s],bin:"npm",kind:"rewrite",warning:"pnpm 11 removed `whoami`; falling back to `npm whoami`."}:c(e)?{args:["npm","whoami",...s],bin:"yarn",kind:"rewrite"}:e.name==="bun"?{args:["pm","whoami",...s],bin:"bun",kind:"rewrite"}:e.name==="deno"?{kind:"skip",warning:"deno has no `whoami`. JSR uses browser auth."}:{kind:"passthrough"};default:return{kind:"passthrough"}}},O=e=>V(e)!==null,ke=e=>{const n=[["pnpm-lock.yaml","pnpm"],["yarn.lock","yarn"],["package-lock.json","npm"],["npm-shrinkwrap.json","npm"],["bun.lock","bun"],["bun.lockb","bun"],["deno.lock","deno"]];let s=e;for(;;){for(const[a,o]of n)if(R($(s,a)))return o;const r=S(s);if(r===s||x(s).root===s)return;s=r}},Te=(e,n)=>{if(n.name!=="aube")return;const s=ke(e);if(s!==void 0)return`Resolved installer is aube but the workspace has a ${s} lockfile. Aube reads and writes ${s}'s lockfile format in place, but its byte output may differ subtly — expect a one-time churn diff on the first install, and ongoing drift if your team mixes tools on the same lockfile. To pin the choice across the team, set \`install.backend\` in vis.config; to bypass aube for this run, pass --no-aube.`},C=e=>{if(R(e))try{return JSON.parse(N(e,{buffer:!1}))}catch{return}},we=e=>{let n=e;for(;;){const s=$(n,"package.json"),r=C(s);if(r&&typeof r.packageManager=="string"&&r.packageManager.length>0)return r.packageManager;const a=S(n);if(a===n||x(n).root===n)return;n=a}},E=new Set(["npm","pnpm","yarn"]),W=(e,n,s)=>s===!1||!E.has(n)||!O("corepack")?!1:s===!0?!0:we(e)!==void 0,Ue=(e,n)=>{const s=n.backend,r=process.env.VIS_INSTALLER,a=s??r??n.configBackend,o=n.configCorepack??"auto";if(a&&a!=="auto"){if(a==="aube"&&!O("aube"))throw new Error('install.backend is set to "aube" but the `aube` binary is not on PATH. Install it via `npm i -g @endevco/aube`, `mise use -g aube`, or `brew install endevco/tap/aube`.');return{name:a,useCorepack:W(e,a,o),version:"latest"}}if(O("aube"))return{name:"aube",useCorepack:!1,version:"latest"};const i=ve(e);return{...i,useCorepack:W(e,i.name,o)}},ve=e=>{if(!R(e))throw new Error(`Could not detect package manager in ${e}. Directory does not exist.`);const n=J(e);return{name:n.name,version:n.version||"latest"}},M=(e,n)=>n.useCorepack!==!0||!E.has(n.name)||e.bin==="corepack"||e.bin!==n.name?e:{...e,args:[n.name,...e.args],bin:"corepack"},ye=(e,n,s)=>{if(s===void 0)return G(e.bin,e.args,n);const r=B(e.bin,e.args,{cwd:n,env:{...process.env,...s},stdio:"inherit"});if(r.error)throw r.error;return r.status??1},p=(e,n,s,r,a={})=>{const o=M(n,e);for(const i of o.warnings)r.warn(`warning: ${i}`);return a.dry?(r.log(`[dry-run] ${o.bin} ${o.args.join(" ")}`),0):ye(o,s,a.env)},f=(e,n,s,r,a={})=>p(e,n(),s,r,a),$e=(e,n)=>n==="aube"||n==="deno"?e:{...e,args:[...e.args,"--prefer-offline"]},je=(e,n,s)=>n!=="yarn"||s.startsWith("1.")||!e.args.includes("--immutable")||e.args.includes("--immutable-cache")?e:{...e,args:[...e.args,"--immutable-cache"]},P=(e,n,s)=>{let r=e.name==="aube"?se(n):Y(e.name,e.version,{...n,silent:n.silent||s.silent===!0});return s.preferOffline&&(r=$e(r,e.name)),s.ciMode&&(r=je(r,e.name,e.version)),r},qe=(e,n,s,r,a={})=>{const o=P(e,n,a);return D(e,o,s,r,{dry:a.dry,env:a.env})},Be=async(e,n,s,r,a={})=>{const o=M(P(e,n,a),e);for(const i of o.warnings)r.warn(`warning: ${i}`);return a.dry?(r.log(`[dry-run] ${o.bin} ${o.args.join(" ")}`),{code:0,output:""}):fe(o.bin,o.args,{cwd:s,env:a.env?{...process.env,...a.env}:process.env})},I=(e,n)=>{const s=n==="deno"?"--quiet":"--silent";return{...e,args:[...e.args,s]}},Oe=(e,n)=>n==="yarn"||n==="aube"?null:{...e,args:[...e.args,"--dry-run"]},D=(e,n,s,r,a)=>{if(a.dry!==!0)return p(e,n,s,r,a);const o=Oe(n,e.name);return o===null?p(e,n,s,r,a):p(e,o,s,r,{env:a.env})},Re=(e,n)=>n==="aube"?{...e,args:[...e.args,"--ignore-scripts"]}:n==="deno"?e:{...e,args:[...e.args,"--ignore-scripts"]},Se=(e,n,s,r,a={})=>{let o=e.name==="aube"?re(n):z(e.name,e.version,n);a.ignoreScripts&&(o=Re(o,e.name)),a.silent&&(o=I(o,e.name));const i=D(e,o,s,r,{dry:a.dry,env:a.env});return i===0&&a.autoInstallPeers&&_e(e,n,s,r,a),i},xe=e=>{if(e.startsWith("@")){const s=e.indexOf("/");if(s===-1)return e;const r=e.indexOf("@",s);return r===-1?e:e.slice(0,r)}const n=e.indexOf("@");return n===-1?e:e.slice(0,n)},Ce=(e,n)=>{let s=e;for(;;){const r=$(s,"node_modules",n,"package.json"),a=C(r);if(a)return a;const o=S(s);if(o===s||x(s).root===s)return;s=o}},De=e=>{const n=C($(e,"package.json")),s=new Set;if(!n)return s;for(const r of["dependencies","devDependencies","peerDependencies","optionalDependencies"]){const a=n[r];if(a)for(const o of Object.keys(a))s.add(o)}return s},_e=(e,n,s,r,a)=>{if(e.name==="deno")return;const o=De(s),i=new Map;for(const g of n.packages){const m=xe(g),t=Ce(s,m);if(!t?.peerDependencies)continue;const d=t.peerDependenciesMeta??{};for(const[v,A]of Object.entries(t.peerDependencies))d[v]?.optional||o.has(v)||i.has(v)||i.set(v,A)}if(i.size===0)return;const u=[...i.entries()].map(([g,m])=>`${g}@${m}`);r.log(`auto-installing peer dependencies: ${u.join(", ")}`);const l={exact:!1,filter:n.filter,global:!1,optional:!1,packages:u,peer:!1,saveDev:n.saveDev,workspace:!1,workspaceRoot:n.workspaceRoot};Se(e,l,s,r,{ignoreScripts:a.ignoreScripts})},Ne=(e,n,s,r,a={})=>{let o=e.name==="aube"?ae(n):H(e.name,e.version,n);return a.silent&&(o=I(o,e.name)),D(e,o,s,r,{dry:a.dry,env:a.env})},Je=(e,n,s,r,a={})=>e.name==="aube"?p(e,oe(n),s,r,a):f(e,()=>K(e.name,e.version,n),s,r,a),ze=(e,n,s,r,a={})=>e.name==="aube"?p(e,ie(n),s,r,a):f(e,()=>Q(e.name,e.version,n),s,r,a),We=(e,n)=>{if(e.name==="aube")return le(n);const s=[],r=[],a=e.name;switch(e.name){case"bun":{const o=y.coerce(e.version);o&&y.lt(o,"1.3.0")&&r.push(`bun ${e.version} does not support \`bun pm view\` (added in bun 1.3). Upgrade bun, or run \`npm view ${n.package}\` instead.`),s.push("pm","view","--",n.package,...n.fields),n.json&&s.push("--json");break}case"deno":{const o=n.package.startsWith("npm:")||n.package.startsWith("jsr:")||n.package.startsWith("https://")||n.package.startsWith("http://")||n.package.startsWith("file:")?n.package:`npm:${n.package}`;s.push("info","--",o),n.json&&s.push("--json"),n.fields.length>0&&r.push("deno info does not accept field selectors; ignoring.");break}case"npm":case"pnpm":{s.push("view","--",n.package,...n.fields),n.json&&s.push("--json");break}case"yarn":{if(e.version.startsWith("1.")){s.push("info","--",n.package);const[o,...i]=n.fields;o!==void 0&&(i.length>0&&r.push("yarn v1 only supports querying one field at a time; using the first."),s.push(o)),n.json&&s.push("--json")}else s.push("npm","info","--",n.package),n.fields.length>0&&r.push("yarn berry does not support field arguments to 'npm info'; ignoring."),n.json&&s.push("--json");break}default:{const o=e.name;throw new Error(`Unsupported package manager: ${o}`)}}return{args:s,bin:a,warnings:r}},He=(e,n,s,r,a={})=>p(e,We(e,n),s,r,a),Fe=(e,n,s,r,a={})=>e.name==="aube"?p(e,ue(n),s,r,a):f(e,()=>X(e.name,e.version,n),s,r,a),Ve=(e,n,s,r,a,o={})=>e.name==="aube"?p(e,ce(n,s),r,a,o):f(e,()=>Z(e.name,e.version,n,s),r,a,o),Ee=(e,n,s)=>{if(e.args.includes("--offline")||e.args.includes("--cached-only"))return e;const r=(a,o)=>{const i=[...e.args];return i.splice(o,0,a),{...e,args:i}};switch(n){case"aube":case"pnpm":return r("--offline",1);case"bun":return{...e,warnings:[...e.warnings,"bun x does not support --offline. Pre-install the package via `vis install` so bun x resolves from the local cache."]};case"deno":return r("--cached-only",1);case"npm":return r("--offline",1);case"yarn":return s.startsWith("1.")?r("--offline",0):{...e,warnings:[...e.warnings,"yarn berry has no --offline flag for dlx. Configure `enableNetwork: false` in .yarnrc.yml or set `enableMirror: true` for offline-first behavior."]};default:{const a=n;return{...e,warnings:[...e.warnings,`applyDlxOffline: unsupported pm ${String(a)}`]}}}},Ye=(e,n,s,r,a={})=>{let o=e.name==="aube"?te(n):F(e.name,e.version,n);return a.offline&&(o=Ee(o,e.name,e.version)),p(e,o,s,r,{dry:a.dry,env:a.env})},Ge=(e,n,s,r,a={})=>e.name==="aube"?p(e,pe(n),s,r,a):f(e,()=>ee(e.name,e.version,n),s,r,a),Ke=(e,n,s,r,a,o={})=>{if(e.name==="aube")return p(e,de(n,s),r,a,o);const i=be(e,n,s);return i.kind==="skip"?(a.warn(`warning: ${i.warning}`),0):i.kind==="rewrite"?p(e,{args:i.args,bin:i.bin,warnings:i.warning?[i.warning]:[]},r,a,o):f(e,()=>ne(e.name,e.version,n,s),r,a,o)};export{Ye as $,Ke as B,Ne as D,ze as E,Ue as I,Se as M,He as P,qe as R,Ve as S,Ge as W,Be as h,Fe as j,Te as p,fe as s,Le as v,ve as w,Je as x};

package/dist/packem_shared/provenance-_CJjMKwu.js

@@ -0,0 +1 @@
+import{createRequire as w}from"node:module";import{s as l}from"./index-CgcF6_wo.js";import{f as T,a as R,m as p}from"./index-BDmTbWX1.js";import{g as A,l as M}from"../packem_chunks/bin.js";import{a as P}from"../packem_chunks/config.js";const k=w(import.meta.url),u=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,_=t=>{if(typeof u<"u"&&u.versions&&u.versions.node){const[e,s]=u.versions.node.split(".").map(Number);if(e>22||e===22&&s>=3||e===20&&s>=16)return u.getBuiltinModule(t)}return k(t)},{rmSync:f,writeFileSync:j}=_("node:fs"),U=8,$=async(t,e,s)=>{if(t.length===0)return[];const o=Math.max(1,Math.min(e,t.length)),a=Array.from({length:t.length});let r=0;const i=async()=>{for(;r<t.length;){const n=r;r+=1;const c=t[n];a[n]=await s(c,n)}};return await Promise.all(Array.from({length:o},()=>i())),a},g=2,C=1800*1e3,S=15e3,v=()=>p(A(),"packuments"),y=t=>p(v(),`${encodeURIComponent(t)}.json`),D=t=>{const e=y(t);if(T(e))try{const s=P(e);if(s.cacheVersion!==g){f(e,{force:!0});return}if(Date.now()-s.createdAt>s.ttlMs){f(e,{force:!0});return}return s.packument}catch{f(e,{force:!0});return}},N=(t,e,s)=>{R(v());const o={cacheVersion:g,createdAt:Date.now(),packument:e,ttlMs:s};j(y(t),JSON.stringify(o),"utf8")},O=t=>{const e={},s=t.versions??{};for(const[a,r]of Object.entries(s)){const i=r.dist,n={version:a};if(r._npmUser!==void 0&&(n._npmUser=r._npmUser),r.maintainers!==void 0&&(n.maintainers=r.maintainers),r.bin!==void 0&&(n.bin=r.bin),i!==void 0){const c={};i.signatures!==void 0&&(c.signatures=i.signatures),i.attestations!==void 0&&(c.attestations=i.attestations),typeof i.integrity=="string"&&(c.integrity=i.integrity),typeof i.tarball=="string"&&(c.tarball=i.tarball),n.dist=c}r.repository!==void 0&&(n.repository=r.repository),r.license!==void 0&&(n.license=r.license),typeof r.readme=="string"&&(n.readme=r.readme),typeof r.readmeFilename=="string"&&(n.readmeFilename=r.readmeFilename),typeof r.private=="boolean"&&(n.private=r.private),typeof r.deprecated=="string"&&(n.deprecated=r.deprecated),r.scripts!==void 0&&typeof r.scripts=="object"&&(n.scripts=r.scripts),e[a]=n}const o={name:typeof t.name=="string"?t.name:"",versions:e};return t["dist-tags"]!==void 0&&(o["dist-tags"]=t["dist-tags"]),t.time!==void 0&&(o.time=t.time),typeof t.readme=="string"&&(o.readme=t.readme),o},E=t=>{const e={Accept:"application/json"};return t!==void 0&&t!==""&&(e.Authorization=`Bearer ${t}`),e},F=async(t,e)=>{if(e.registryUrl!==void 0)return{authToken:e.authToken,url:e.registryUrl};if(e.workspaceRoot!==void 0){const{getRegistryForPackage:s,loadNpmrc:o}=await import("../packem_chunks/bin.js").then(n=>n.bx),a=o(e.workspaceRoot),{token:r,url:i}=s(t,a);return{authToken:e.authToken??r,url:i}}return{authToken:e.authToken,url:"https://registry.npmjs.org"}},V=async(t,e={})=>{const s=e.cacheTtlMs??C,o=D(t);if(o!==void 0)return o;const a=await F(t,e),r=`${a.url.endsWith("/")?a.url.slice(0,-1):a.url}/${t.replace("/","%2f")}`,i=new AbortController,n=setTimeout(()=>{i.abort()},S),c=()=>{i.abort()};e.signal?.addEventListener("abort",c,{once:!0});try{const d=await fetch(r,{headers:E(a.authToken),signal:i.signal});if(d.status===404)return;if(!d.ok)throw new Error(`Registry returned ${String(d.status)} for ${t}`);const b=await d.json(),m=O(b);return N(t,m,s),m}finally{clearTimeout(n),e.signal?.removeEventListener("abort",c)}},H=(t,e)=>{const s=Object.keys(t.versions);if(s.length===0)return;if(e===void 0||e===""||e==="latest")return t["dist-tags"]?.latest??s.at(-1);const o=t["dist-tags"]?.[e];return o!==void 0?o:Object.hasOwn(t.versions,e)?e:l.maxSatisfying(s,e)??void 0},h=(t,e)=>t.versions[e]?.dist?.attestations?.provenance!==void 0,x=(t,e)=>l.valid(e)?Object.keys(t.versions).filter(s=>l.valid(s)!==null&&l.lt(s,e)).filter(s=>l.satisfies(s,"*",{includePrerelease:!1})).filter(s=>h(t,s)).sort((s,o)=>l.lt(s,o)?1:-1)[0]:void 0,I=async(t,e={})=>{if(M("provenance"))return[];const s=new Set(e.allowlist),o=e.concurrency??U;return(await $(t,o,async({name:a,version:r})=>{if(s.has(a))return;const i=await V(a,{workspaceRoot:e.workspaceRoot});if(i===void 0||h(i,r))return;const n=x(i,r);if(n!==void 0)return{packageName:a,priorVersionWithProvenance:n,version:r}})).filter(a=>a!==void 0)};export{U as D,H as a,x as f,V as g,$ as m,I as r};