@visulima/vis 1.0.0-alpha.4 → 1.0.0-alpha.40

package/dist/packem_shared/VisReleaseError-DMGRBTNO.js

@@ -0,0 +1 @@
+class i extends Error{code;hint;docsUrl;packageName;file;line;constructor(e){super(e.message,{cause:e.cause}),this.name="VisReleaseError",this.code=e.code,this.hint=e.hint,this.docsUrl=e.docsUrl,this.packageName=e.packageName,this.file=e.file,this.line=e.line}}const r=s=>new i(s);export{i as VisReleaseError,r as visReleaseError};

package/dist/packem_shared/_commonjsHelpers-B5Y90VFO.js

@@ -0,0 +1 @@
+var n=typeof globalThis<"u"?globalThis:typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{};function u(t){return t&&t.__esModule&&Object.prototype.hasOwnProperty.call(t,"default")?t.default:t}function l(t){if(Object.prototype.hasOwnProperty.call(t,"__esModule"))return t;var a=t.default;if(typeof a=="function"){var e=function o(){var r=!1;try{r=this instanceof o}catch{}return r?Reflect.construct(a,arguments,this.constructor):a.apply(this,arguments)};e.prototype=a.prototype}else e={};return Object.defineProperty(e,"__esModule",{value:!0}),Object.keys(t).forEach(function(o){var r=Object.getOwnPropertyDescriptor(t,o);Object.defineProperty(e,o,r.get?r:{enumerable:!0,get:function(){return t[o]}})}),e}export{l as a,n as c,u as g};

package/dist/packem_shared/advisories-DLeO5KMN.js

@@ -0,0 +1 @@
+import{createRequire as D}from"node:module";import{E as L}from"../packem_chunks/config.js";import{advisoriesQuery as M,NATIVE_BINDING_VERSION as f,advisoriesIngest as W,advisoriesStatus as E}from"#native";const R=D(import.meta.url),l=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,c=s=>{if(typeof l<"u"&&l.versions&&l.versions.node){const[e,t]=l.versions.node.split(".").map(Number);if(e>22||e===22&&t>=3||e===20&&t>=16)return l.getBuiltinModule(s)}return R(s)},{randomUUID:I}=c("node:crypto"),{existsSync:$,createWriteStream:T}=c("node:fs"),{mkdir:O,unlink:P,stat:U}=c("node:fs/promises"),{join:g,dirname:k}=c("node:path"),{Readable:x}=c("node:stream"),{pipeline:C}=c("node:stream/promises"),w=5;if(f!==w)throw new Error(`vis native binding ABI mismatch in advisories: expected ${w}, got ${f}. Rebuild via \`pnpm --filter @visulima/vis run build:native\` or reinstall the platform binding package.`);const Q="https://osv-vulnerabilities.storage.googleapis.com",j=new Set(["osv-vulnerabilities.storage.googleapis.com"]);class q extends Error{cause="DB_NOT_FOUND";constructor(e){super(`No local advisory DB at ${e}. Run 'vis advisories sync' first.`),this.name="AdvisoryDbNotFoundError"}}class p extends Error{cause="SOURCE_NOT_ALLOWED";constructor(e){super(`Advisory source host '${e}' is not in the built-in allowlist. Add it to \`security.audit.advisories.allowedHosts\` if intentional.`),this.name="AdvisorySourceNotAllowedError"}}class A extends Error{cause="SYNC_NETWORK";constructor(e,t){super(`Advisory sync failed for ${e}: ${t}. Check connectivity, proxy env vars, or --source.`),this.name="AdvisorySyncNetworkError"}}const y=s=>{const e=L("vis",{create:!0,cwd:s})??g(s,"node_modules",".cache","vis");return g(e,"advisories","db.sqlite")},B=(s,e)=>{let t;try{t=new URL(s)}catch{throw new p(s)}if(t.protocol!=="https:")throw new p(`${t.protocol}//${t.host}`);if(!new Set([...j,...e??[]]).has(t.host))throw new p(t.host);return t},J=async s=>{const e=s.dbPath??y(s.workspaceRoot);await O(k(e),{recursive:!0});const t=B(s.source,s.allowedHosts),d=new URL(`${s.ecosystem}/all.zip`,z(t.toString())),u=await V(e,s.ecosystem);let r=null;if(!s.force){const i=await b(d,{method:"HEAD"});if(i.ok&&(r=i.headers.get("etag"),r&&u&&r===u))return{advisoriesIngested:0,dbPath:e,durationMs:0,upToDate:!0}}const n=`${e}.${s.ecosystem}.${process.pid}.${I()}.zip.tmp`,o=await b(d,{method:"GET"});if(!o.ok||!o.body)throw new A(d.toString(),o.status);r||(r=o.headers.get("etag"));const v=o.headers.get("content-length"),a=v?Number.parseInt(v,10):null;let m=0;const _=T(n),h=x.fromWeb(o.body);s.onProgress&&a&&h.on("data",i=>{m+=i.byteLength,s.onProgress?.(m,a,"download")}),await C(h,_);try{const i=await W({dbPath:e,ecosystem:s.ecosystem,manifestEtag:r??void 0,zipPath:n},(S,N)=>s.onProgress?.(S,N,"ingest"));return{advisoriesIngested:i.advisoriesIngested,dbPath:e,durationMs:i.durationMs,upToDate:!1}}finally{await P(n).catch(()=>{})}},X=(s,e)=>{if(s.length===0)return new Map;const t=e.dbPath??y(e.workspaceRoot),d=e.ecosystem??"npm";if(!$(t))throw new q(t);const u=s.map(o=>({ecosystem:d,name:o.name,version:o.version})),r=M(t,u),n=new Map;for(const[o,v]of s.entries()){const a=r[o];!a||a.vulnerabilities.length===0||n.set(v.name,a.vulnerabilities.map(m=>H(m)))}return n},Z=async(s,e)=>{const t=e??y(s);return E(t)},V=async(s,e)=>{try{await U(s)}catch{return null}return E(s).ecosystems.find(t=>t.name===e)?.manifestEtag??null},H=s=>({aliases:s.aliases.length>0?s.aliases:void 0,cvssScore:s.cvssScore??void 0,fixedVersions:s.fixedVersions,id:s.id,severity:F(s.severity),summary:s.summary}),F=s=>{const e=s.toUpperCase();return e==="CRITICAL"||e==="HIGH"||e==="MODERATE"||e==="LOW"?e:"UNKNOWN"},z=s=>s.endsWith("/")?s:`${s}/`,b=async(s,e)=>{try{return await fetch(s,e)}catch(t){throw new A(s.toString(),t instanceof Error?t.message:String(t))}};export{q as A,Q as D,Z as g,X as q,y as r,J as s};

package/dist/packem_shared/affected-shas-cVnX8-zs.js

@@ -0,0 +1 @@
+import{createRequire as l}from"node:module";import{f as g,v as h}from"./index-BDmTbWX1.js";const E=l(import.meta.url),_=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,d=e=>{if(typeof _<"u"&&_.versions&&_.versions.node){const[s,t]=_.versions.node.split(".").map(Number);if(s>22||s===22&&t>=3||s===20&&t>=16)return _.getBuiltinModule(e)}return E(e)},{spawnSync:p}=d("node:child_process"),b="0000000000000000000000000000000000000000",A=e=>{if(g(e))try{const s=h(e);return JSON.parse(s)}catch{return}},I=(e,s)=>{const t=p("git",e,{cwd:s,encoding:"utf8"});if(!(t.error||typeof t.status!="number"||t.status!==0))return typeof t.stdout=="string"?t.stdout.trim():void 0},c=e=>typeof e=="string"&&e.length>0&&e!==b,f=(e,s,t)=>{const r=[],o=e.GITHUB_BASE_REF,i=e.GITHUB_SHA??"HEAD";if(o&&o.length>0)return r.push(`pull_request: $GITHUB_BASE_REF=${o}`),{base:`origin/${o}`,head:i,notes:r,provider:"github"};const a=e.GITHUB_EVENT_PATH,n=a?t(a):void 0;if(n){const u=typeof n.before=="string"?n.before:void 0;if(c(u))return r.push(`push: event.before=${u}`),{base:u,head:i,notes:r,provider:"github"}}return r.push(`fallback: origin/${s}`),{base:`origin/${s}`,head:i,notes:r,provider:"github"}},R=(e,s)=>{const t=[],r=e.CI_COMMIT_SHA??"HEAD";if(e.CI_PIPELINE_SOURCE==="merge_request_event"){const a=e.CI_MERGE_REQUEST_DIFF_BASE_SHA;if(c(a))return t.push(`merge_request: $CI_MERGE_REQUEST_DIFF_BASE_SHA=${a}`),{base:a,head:r,notes:t,provider:"gitlab"};const n=e.CI_MERGE_REQUEST_TARGET_BRANCH_NAME;if(n&&n.length>0)return t.push(`merge_request: $CI_MERGE_REQUEST_TARGET_BRANCH_NAME=${n}`),{base:`origin/${n}`,head:r,notes:t,provider:"gitlab"}}const o=e.CI_COMMIT_BEFORE_SHA;if(c(o))return t.push(`push: $CI_COMMIT_BEFORE_SHA=${o}`),{base:o,head:r,notes:t,provider:"gitlab"};const i=e.CI_DEFAULT_BRANCH??s;return t.push(`fallback: origin/${i}`),{base:`origin/${i}`,head:r,notes:t,provider:"gitlab"}},C=(e,s)=>{const t=[],r=e.BUILDKITE_COMMIT??"HEAD",o=e.BUILDKITE_PULL_REQUEST_BASE_BRANCH;return o&&o.length>0?(t.push(`pull_request: $BUILDKITE_PULL_REQUEST_BASE_BRANCH=${o}`),{base:`origin/${o}`,head:r,notes:t,provider:"buildkite"}):(t.push(`fallback: origin/${s} (buildkite has no canonical previous-build SHA env)`),{base:`origin/${s}`,head:r,notes:t,provider:"buildkite"})},v=(e,s)=>{const t=[],r=e.CIRCLE_SHA1??"HEAD",o=e.CIRCLE_PR_BASE_BRANCH;return o&&o.length>0?(t.push(`pull_request: $CIRCLE_PR_BASE_BRANCH=${o}`),{base:`origin/${o}`,head:r,notes:t,provider:"circleci"}):(t.push(`fallback: origin/${s} (circleci has no canonical previous-build SHA env)`),{base:`origin/${s}`,head:r,notes:t,provider:"circleci"})},T=(e,s,t)=>{const r=[],o=s(["merge-base","HEAD",`origin/${e}`],t);return o&&o.length>0?(r.push(`local: git merge-base HEAD origin/${e}=${o}`),{base:o,head:"HEAD",notes:r,provider:"local"}):(r.push(`local fallback: origin/${e} (no merge-base available)`),{base:`origin/${e}`,head:"HEAD",notes:r,provider:"local"})},$=e=>{const s=e?.env??process.env,t=e?.defaultBase??"main",r=e?.readEventPayload??A,o=e?.runGit??I,i=e?.workspaceRoot??process.cwd();return s.GITHUB_ACTIONS==="true"?f(s,t,r):s.GITLAB_CI==="true"?R(s,t):s.BUILDKITE==="true"?C(s,t):s.CIRCLECI==="true"?v(s,t):T(t,o,i)};export{$ as r};

package/dist/packem_shared/ai-analysis-BUeX2J2H.js

@@ -0,0 +1,68 @@
+import{createRequire as G}from"node:module";import{az as ee,aA as te,aB as re,h as ae,d as f,a5 as se,m as k,e as oe,aC as ne}from"../packem_chunks/bin.js";const K=G(import.meta.url),M=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,A=e=>{if(typeof M<"u"&&M.versions&&M.versions.node){const[a,t]=M.versions.node.split(".").map(Number);if(a>22||a===22&&t>=3||a===20&&t>=16)return M.getBuiltinModule(e)}return K(e)},{spawn:Y,execFileSync:N,execFile:X}=A("node:child_process"),{existsSync:_}=A("node:fs"),{platform:Z,homedir:P}=A("node:os"),{join:h}=A("node:path"),{promisify:Q}=A("node:util"),ie=/v?(\d+\.\d+\.\d+(?:-[\w.]+)?)/,ue=5e3,ce=1e4,de=3e5,le=4096,T=Z()==="win32",q=["amp","claude","codex","copilot","crush","cursor","droid","gemini","kimi","opencode","qwen"];class w extends Error{exitCode;durationMs;provider;stderr;stdout;timedOut;aborted;constructor(a,t){super(a),this.name="AiRunError",this.provider=t.provider,this.exitCode=t.exitCode??null,this.durationMs=t.durationMs,this.stdout=t.stdout??"",this.stderr=t.stderr??"",this.timedOut=t.timedOut??!1,this.aborted=t.aborted??!1}}const pe={alternateCommands:[],buildArgs:(e,{dangerous:a})=>{const t=["-x",e];return a&&t.push("--dangerously-allow-all"),t},command:"amp",defaultModel:"",envVariable:"AMP_PATH",supportsMaxTokens:!1,supportsModel:!1},me={alternateCommands:[],buildArgs:(e,{dangerous:a,model:t})=>{const r=[];return a&&r.push("--dangerously-skip-permissions"),t&&r.push("--model",t),r.push("--output-format","text","-p",e),r},command:"claude",defaultModel:"",envVariable:"CLAUDE_PATH",supportsMaxTokens:!1,supportsModel:!0},ge={alternateCommands:["openai-codex"],buildArgs:(e,{dangerous:a,model:t})=>{const r=["exec"];return t&&r.push("--model",t),a&&r.push("--dangerously-bypass-approvals-and-sandbox"),r.push(e),r},command:"codex",defaultModel:"",envVariable:"CODEX_PATH",supportsMaxTokens:!1,supportsModel:!0},he={alternateCommands:[],buildArgs:(e,{dangerous:a,model:t})=>{const r=["-p",e];return a&&r.push("--allow-all-tools"),t&&r.push("--model",t),r},command:"copilot",defaultModel:"",envVariable:"COPILOT_PATH",supportsMaxTokens:!1,supportsModel:!0},fe={alternateCommands:[],buildArgs:(e,{dangerous:a,model:t})=>{const r=["run"];return a&&r.push("--yolo"),t&&r.push("-m",t),r.push(e),r},command:"crush",defaultModel:"",envVariable:"CRUSH_PATH",supportsMaxTokens:!1,supportsModel:!0},ye={alternateCommands:["cursor"],buildArgs:(e,{dangerous:a,model:t})=>{const r=["-p"];return a&&r.push("--force"),r.push("--output-format","text"),t&&r.push("--model",t),r.push(e),r},command:"agent",defaultModel:"",envVariable:"CURSOR_PATH",supportsMaxTokens:!1,supportsModel:!0},ve={alternateCommands:[],buildArgs:(e,{dangerous:a,model:t})=>{const r=[e];return a&&r.push("--skip-permissions-unsafe"),r.push("-o","text"),t&&r.push("-m",t),r},command:"droid",defaultModel:"",envVariable:"DROID_PATH",supportsMaxTokens:!1,supportsModel:!0},be={alternateCommands:["gemini-cli"],buildArgs:(e,{dangerous:a,maxTokens:t,model:r})=>{const s=[];return a||s.push("--sandbox"),r&&s.push("--model",r),s.push("--max-output-tokens",String(t),"-p",e),s},command:"gemini",defaultModel:"gemini-2.5-pro",envVariable:"GEMINI_PATH",supportsMaxTokens:!0,supportsModel:!0},ke={alternateCommands:[],buildArgs:(e,{model:a})=>{const t=["--quiet","-p",e];return a&&t.push("-m",a),t},command:"kimi",defaultModel:"",envVariable:"KIMI_PATH",supportsMaxTokens:!1,supportsModel:!0},we={alternateCommands:[],buildArgs:(e,{model:a})=>{const t=["run",e];return a&&t.push("-m",a),t},command:"opencode",defaultModel:"",envVariable:"OPENCODE_PATH",supportsMaxTokens:!1,supportsModel:!0},Me={alternateCommands:["qwen-code"],buildArgs:(e,{dangerous:a,model:t})=>{const r=["-p",e];return a&&r.push("--yolo"),r.push("-o","text"),t&&r.push("-m",t),r},command:"qwen",defaultModel:"",envVariable:"QWEN_PATH",supportsMaxTokens:!1,supportsModel:!0};Q(X);const V={amp:pe,claude:me,codex:ge,copilot:he,crush:fe,cursor:ye,droid:ve,gemini:be,kimi:ke,opencode:we,qwen:Me},Ae=/\.(?:bat|cmd)$/i,D=e=>T&&Ae.test(e),L=e=>`"${e.replaceAll('"','""')}"`,O=e=>e==="~"||e.startsWith("~/")||T&&e.startsWith("~\\")?h(P(),e.slice(2)):e,Se=e=>{try{const a=N(T?"where":"which",[e],{encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:ue}).trim().split(`
+`)[0]?.trim();return a&&a.length>0?a:void 0}catch{return}},$e=e=>{const a=P();if(T){const t=process.env.APPDATA??"",r=process.env.LOCALAPPDATA??"",s=process.env.ProgramFiles??"";return[h(t,"npm",`${e}.cmd`),h(t,"npm",e),h(r,"Programs",e,`${e}.exe`),h(s,e,`${e}.exe`),h(a,".npm-global","bin",`${e}.cmd`)]}return[`/opt/homebrew/bin/${e}`,`/usr/local/bin/${e}`,h(a,".npm-global","bin",e),h(a,".local","bin",e),h(a,".cargo","bin",e)]},Te=e=>{try{const a=N(e,["--version"],{encoding:"utf8",shell:D(e),stdio:["pipe","pipe","pipe"],timeout:ce}),t=ie.exec(a);return t?t[1]:void 0}catch{return}},F=(e,a={})=>{const t=V[e],r={available:!1,name:e},s=a.version!==!1,o=i=>{if(s)return Te(i)},n=process.env[t.envVariable];if(n&&_(O(n))){const i=O(n);return{...r,available:!0,detectionMethod:"envvar",path:i,version:o(i)}}const c=[t.command,...t.alternateCommands];for(const i of c){const u=Se(i);if(u)return{...r,available:!0,detectionMethod:"which",path:u,version:o(u)}}for(const i of c)for(const u of $e(i))if(_(u))return{...r,available:!0,detectionMethod:"known-path",path:u,version:o(u)};return r},xe=(e={})=>q.map(a=>F(a,e)),Ce=(e={})=>xe(e).filter(a=>a.available),Ee=(e,a,t={})=>{const r=V[e],s=t.model??r.defaultModel,o=t.maxTokens!==void 0&&Number.isFinite(t.maxTokens)?t.maxTokens:le;return r.buildArgs(a,{dangerous:t.dangerous===!0,maxTokens:o,model:s})},Re=async(e,a,t={})=>{if(!e.available||!e.path)throw new w(`AI provider "${e.name}" is not available.`,{durationMs:0,provider:e.name});const r=Ee(e.name,a,t),s=t.timeoutMs!==void 0&&Number.isFinite(t.timeoutMs)?t.timeoutMs:de,o=e.path,n=D(o),c=Date.now();if(t.signal?.aborted)throw new w(`${e.name} CLI run was aborted.`,{aborted:!0,durationMs:0,provider:e.name});return new Promise((i,u)=>{const m={cwd:t.cwd,env:{...process.env,...t.env,FORCE_COLOR:"0",NO_COLOR:"1"},shell:n,stdio:["pipe","pipe","pipe"]},l=n?r.map(d=>L(d)):r,g=Y(n?L(o):o,l,m);g.stdin?.end();let y="",v="",b=!1,E,R,S;const x=()=>{clearTimeout(R),clearTimeout(E),S&&t.signal?.removeEventListener("abort",S)},J=()=>{g.kill("SIGKILL")},I=d=>{if(b)return;b=!0,g.kill("SIGTERM"),E=setTimeout(J,5e3),x();const p=Date.now()-c,W=d?new w(`${e.name} CLI run was aborted.`,{aborted:!0,durationMs:p,provider:e.name,stderr:v,stdout:y}):new w(`${e.name} CLI timed out after ${String(s)}ms`,{durationMs:p,provider:e.name,stderr:v,stdout:y,timedOut:!0});u(W)};R=setTimeout(I,s,!1),S=()=>{I(!0)},t.signal?.addEventListener("abort",S,{once:!0}),g.stdout?.on("data",d=>{const p=d.toString("utf8");y+=p,t.onStdout?.(p)}),g.stderr?.on("data",d=>{const p=d.toString("utf8");v+=p,t.onStderr?.(p)}),g.on("close",d=>{if(b)return;b=!0,x();const p=Date.now()-c;d===0?i({durationMs:p,exitCode:d,provider:e.name,stderr:v,stdout:y}):u(new w(`${e.name} CLI exited with code ${String(d)}: ${v||y}`,{durationMs:p,exitCode:d,provider:e.name,stderr:v,stdout:y}))}),g.on("error",d=>{b||(b=!0,x(),u(new w(`Failed to spawn ${e.name} CLI: ${d.message}`,{durationMs:Date.now()-c,provider:e.name,stderr:v,stdout:y})))})})},Ie=12e4,_e=2,Le=1e3,Oe=e=>new Promise(a=>{setTimeout(a,e)}),H=async(e,a,t=_e)=>{let r;for(let s=0;s<=t;s+=1)try{return(await Re(e,a,{timeoutMs:Ie})).stdout}catch(o){if(r=o instanceof Error?o:new Error(String(o)),r.message.includes("timed out"))throw r;if(s<t){const n=Le*2**s;await Oe(n)}}throw r??new Error("AI request failed after retries")},je={amp:30,claude:80,codex:60,copilot:50,crush:35,cursor:40,droid:20,gemini:100,kimi:25,opencode:35,qwen:30},Ne=e=>{if(e?.provider){if(!q.includes(e.provider))return;const r=F(e.provider);return r.available?r:void 0}const a=Ce();if(a.length===0)return;const t={...je,...e?.priority};return a.toSorted((r,s)=>(t[s.name]??0)-(t[r.name]??0))[0]},Pe=new Set(["defer","review","skip","update"]),qe=new Set(["critical","high","low","medium"]),Ve=new Set(["high","low","medium"]),De=50,C=30,Fe=e=>e.map(a=>{const t=a.vulnerabilities&&a.vulnerabilities.length>0?` [VULNERABILITIES: ${a.vulnerabilities.map(s=>`${s.severity} ${s.id}`).join(", ")}]`:"";let r="";if(a.socketReport){const s=Math.round(a.socketReport.score.overall*100),o=[`score:${String(s)}%`];if(a.socketReport.alerts.length>0){const n={};for(const i of a.socketReport.alerts)n[i.severity]=(n[i.severity]??0)+1;const c=Object.entries(n).map(([i,u])=>`${String(u)} ${i}`).join(", ");o.push(`alerts: ${c}`)}o.push(`supply-chain:${String(Math.round(a.socketReport.score.supplyChain*100))}%`),o.push(`quality:${String(Math.round(a.socketReport.score.quality*100))}%`),r=` [SOCKET.DEV: ${o.join(", ")}]`}return`- ${a.packageName}: ${a.currentRange} → ${a.newRange} (${a.updateType})${t}${r}`}).join(`
+`),$=`Respond ONLY with valid JSON in this exact structure:
+{
+  "summary": "Brief overall summary",
+  "recommendations": [
+    {
+      "package": "package-name",
+      "action": "update|skip|review|defer",
+      "reason": "explanation",
+      "riskLevel": "low|medium|high|critical",
+      "breakingChanges": ["change1"],
+      "effort": "low|medium|high"
+    }
+  ],
+  "warnings": ["warning1"]
+}`,He={compatibility:e=>`Analyze the compatibility of these package updates:
+
+${e}
+
+For each package:
+1. Check peer dependency compatibility
+2. Identify potential conflicts with other packages in the list
+3. Assess API compatibility between current and target versions
+4. Check for deprecated features being removed
+5. Evaluate Node.js version requirements
+
+${$}`,impact:e=>`Analyze the impact of updating these npm packages:
+
+${e}
+
+For each package, provide:
+1. Risk level (low/medium/high/critical)
+2. Recommended action (update/skip/review/defer)
+3. Reason for recommendation
+4. Known breaking changes (if any)
+5. Estimated migration effort (low/medium/high)
+
+${$}`,recommend:e=>`Provide smart recommendations for updating these packages:
+
+${e}
+
+Consider:
+1. Update priority based on security, features, and stability
+2. Grouping related packages for atomic updates
+3. Best practices for the specific package ecosystem
+4. Risk vs. benefit analysis
+5. Suggested update order
+6. If Socket.dev scores are provided, prioritize packages with low supply chain or quality scores
+
+${$}`,security:e=>`Analyze the security implications of these package updates:
+
+${e}
+
+For each package:
+1. Check if the update fixes known vulnerabilities (use the vulnerability data above)
+2. Assess if the new version introduces security risks
+3. Evaluate if this is a security-sensitive package (auth, crypto, session, etc.)
+4. Recommend urgency of the update based on vulnerability severity
+5. Flag any packages where skipping the update poses security risk
+6. If Socket.dev scores are provided, factor in supply chain and quality scores — low scores indicate higher risk
+
+${$}`},Be=new Set(["compatibility","impact","recommend","security"]),et=e=>Be.has(e)?e:"impact",B=(e,a="impact")=>{const t=Fe(e);return He[a](t)},Ue=/```(?:json)?\s*([\s\S]*?)```/,ze=/\{[\s\S]*\}/,Je=e=>{try{return JSON.parse(e)}catch{}const a=Ue.exec(e);if(a?.[1])try{return JSON.parse(a[1])}catch{}const t=ze.exec(e);if(t?.[0])try{return JSON.parse(t[0])}catch{}},We=e=>({action:Pe.has(e.action)?e.action:"review",breakingChanges:Array.isArray(e.breakingChanges)?e.breakingChanges:[],effort:Ve.has(e.effort)?e.effort:"medium",package:typeof e.package=="string"?e.package:"",reason:typeof e.reason=="string"?e.reason:"",riskLevel:qe.has(e.riskLevel)?e.riskLevel:"medium"}),U=(e,a,t)=>{const r=Je(e);if(!r||typeof r!="object")return{analysisType:t,provider:a,recommendations:[],summary:"Failed to parse AI response.",warnings:["AI response was not valid JSON."]};const s=r,o=Array.isArray(s.recommendations)?s.recommendations:[];return{analysisType:t,provider:a,recommendations:o.map(n=>We(n)),summary:typeof s.summary=="string"?s.summary:"",warnings:Array.isArray(s.warnings)?s.warnings:[]}},Ge={eslint:["ESLint 9.0: Flat config required","ESLint 8.0+: New rule formats"],next:["Next.js 13+: App router changes","Next.js 14+: Server components default"],react:["React 17 to 18: Concurrent features","React 18+: Strict mode changes"],typescript:["TypeScript 5.0: New decorators","TypeScript 4.7+: ESM changes"],vite:["Vite 5: Node.js 18+ required"],vue:["Vue 3: Composition API","Vue 3: Breaking template changes"],webpack:["Webpack 5: Node.js polyfills removed"]},Ke=new Set(["bcrypt","cors","crypto-js","express-session","helmet","jose","jsonwebtoken","node-forge","oauth","passport"]),j=(e,a)=>{const t=e.map(r=>{const s=r.vulnerabilities&&r.vulnerabilities.length>0,o=Ke.has(r.packageName),n=Ge[r.packageName]??[];let c="low",i="update",u="low",m="Patch/minor update, safe to apply.";return r.updateType==="major"?(c="high",i=n.length>0?"review":"update",u="medium",m=n.length>0?`Major update with known breaking changes: ${n[0]}`:"Major version update, review changelog before applying."):r.updateType==="minor"&&(c="medium",m="Minor update, generally safe."),s&&(c="high",i="update",m="Security update — current version has known vulnerabilities."),o&&r.updateType==="major"&&(i="review",m="Security-sensitive package with major update, careful review needed.",u="high"),{action:i,breakingChanges:n,effort:u,package:r.packageName,reason:m,riskLevel:c}});return{analysisType:a,provider:"rule-engine",recommendations:t,summary:`Rule-based ${a} analysis for ${String(e.length)} packages.`,warnings:["No AI provider available — using built-in rule engine."]}},Ye=async(e,a,t)=>{const r=B(a,t),s=await H(e,r);return U(s,e.name,t)},Xe=(e,a,t)=>{const r=[],s=[],o=[];for(const n of e)r.push(...n.recommendations),s.push(...n.warnings),n.summary&&o.push(n.summary);return{analysisType:t,provider:a,recommendations:r,summary:o.length===1?o[0]??"":`Analyzed ${String(r.length)} packages in ${String(e.length)} batches.`,warnings:[...new Set(s)]}},z={compatibility:"Compatibility",impact:"Impact",recommend:"Recommendations",security:"Security"},tt=e=>{const a=`${z[e.analysisType]??e.analysisType} Analysis (${e.provider})`,t=e.recommendations.flatMap(s=>{const o=[{action:s.action,effort:s.effort,package:s.package,reason:s.reason,risk:s.riskLevel}];return s.breakingChanges.length>0&&o.push({action:"",effort:"",package:"",reason:`Breaking: ${s.breakingChanges.join("; ")}`,risk:""}),o}),r=process.stdout.columns||80;return ae(f.createElement(se,{borderStyle:"round",flexDirection:"column",paddingLeft:1,paddingRight:1},f.createElement(k,{bold:!0},a),f.createElement(k,null,""),f.createElement(k,null,e.summary),f.createElement(k,null,""),f.createElement(oe,{borderStyle:"none",data:t}),...e.warnings.length>0?[f.createElement(k,null,""),...e.warnings.map((s,o)=>f.createElement(k,{dimColor:!0,key:String(o)},`  ${s}`))]:[]),{columns:r})},rt=async(e,a,t,r="impact")=>{const s=Ne(t);if(!s)return a.info(`No AI CLI tool found, using rule-based analysis.
+`),j(e,r);const o=ee(s.name,r,e),n=te(o);if(n)return a.info(`Using cached ${r} analysis from ${n.provider}.
+`),n;const c=z[r]??r;a.info(`Running ${c.toLowerCase()} analysis with ${s.name}...
+`);try{let i;if(e.length>De){a.info(`Splitting ${String(e.length)} packages into batches of ${String(C)}...
+`);const u=[];for(let l=0;l<e.length;l+=C)u.push(e.slice(l,l+C));const m=[];for(let l=0;l<u.length;l+=1){a.info(`  Batch ${String(l+1)}/${String(u.length)}...`);const g=u[l];g&&m.push(await Ye(s,g,r))}i=Xe(m,s.name,r)}else{const u=await H(s,B(e,r));i=U(u,s.name,r)}return re(o,i,ne(r,t?.cacheTtl)),i}catch(i){const u=i instanceof Error?i.message:String(i);return a.warn(`AI analysis failed (${u}), falling back to rule engine.
+`),j(e,r)}};export{et as K,xe as N,Ne as R,je as S,tt as W,rt as Z,Je as b,Re as h,H as r};

package/dist/packem_shared/ai-fix-9Vzlp6XU.js

@@ -0,0 +1,43 @@
+import{createRequire as b}from"node:module";import{readLastRunSummary as O}from"@visulima/task-runner";import{a as T}from"./failure-log-CEWP3bP0.js";import{a8 as w,a9 as j,aa as k,z as C,A as D,ab as P,ac as F,ad as N}from"../packem_chunks/bin.js";import{A as y,B as v,m as R,y as B}from"./index-BDmTbWX1.js";import{R as E,r as M,b as q}from"./ai-analysis-BUeX2J2H.js";const $=b(import.meta.url),d=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,I=t=>{if(typeof d<"u"&&d.versions&&d.versions.node){const[e,a]=d.versions.node.split(".").map(Number);if(e>22||e===22&&a>=3||e===20&&a>=16)return d.getBuiltinModule(t)}return $(t)},{readFile:_,writeFile:A}=I("node:fs/promises"),H=32*1024,W=(t,e)=>{if(t.length<=e)return t;const a=t.slice(-e),o=t.length-a.length;return`[…${String(o)} bytes truncated from head…]
+${a}`},L=async(t,e)=>e===void 0?O(t,{dataDirectory:C(t)}):D(t,e),ut=async(t,e,a={})=>{const o=a.terminalOutputLimit??H,[s,n]=await Promise.all([T(t,e),L(t,a.runId)]),i=n?w(n,e):void 0;if(!s&&!i)return;let r,c;if(n&&i){const h=await j(t,n.id),p=h?w(h,e):void 0;r=k(i.hashDetails,p?.hashDetails),c=h?.id}const u=s?.terminalOutput??"";return{command:s?.command??void 0,cwd:s?.cwd??void 0,dependencies:i?.dependencies??[],duration:i?.duration,exitCode:s?.exitCode??i?.exitCode,hash:i?.hash??s?.hash,hashDetails:i?.hashDetails,hashDiff:r,previousRunId:c,project:i?.target.project,runId:n?.id??s?.runId,status:s?.status??(i?Y(i):void 0),target:i?.target.target,taskId:e,terminalOutput:W(u,o),terminalOutputCaptured:!!s,timestamp:s?.timestamp??i?.endTime??i?.startTime}},Y=t=>{if(t.exitCode!==void 0&&t.exitCode!==0)return"failure";switch(t.cacheStatus){case"HIT":return"local-cache";case"REMOTE_HIT":return"remote-cache";case"SKIPPED":return"skipped";default:return t.exitCode===0?"success":void 0}},J=3600*1e3,x=80,K=new Set(["high","low","medium"]),U=()=>`You are an expert software engineer helping fix a failing build/test/lint task.
+
+You will be given:
+- The terminal output (stdout/stderr) from the failed task.
+- Optional metadata: command, working directory, project, task hash, and a diff describing what changed in the task's hash inputs since the previous run that did not fail.
+
+Your job:
+1. Identify the root cause from the terminal output.
+2. Propose a minimal set of source-file patches that fix the cause.
+3. If you cannot determine a safe fix, set "cannotFix" with a clear, actionable explanation.
+
+Constraints:
+- Patches MUST be exact string replacements. The "oldString" must appear verbatim in the named file. Paths are relative to the working directory.
+- Each "oldString" must be unique within its file. Include surrounding context so the match is unambiguous.
+- Do NOT include unrelated cleanup, formatting changes, or speculative refactors.
+- If the failure is environmental (missing tool, network) or requires running commands, prefer "cannotFix" over a guess.
+- Keep "explanation" short (1-3 sentences). Reserve "reason" on each patch for why that specific edit fixes the cause.
+
+Respond ONLY with valid JSON in this exact structure:
+{
+  "explanation": "Brief root-cause analysis and what the fix does.",
+  "confidence": "low|medium|high",
+  "patches": [
+    {
+      "file": "path/relative/to/cwd.ts",
+      "oldString": "exact text to find",
+      "newString": "exact replacement text",
+      "reason": "why this change fixes it"
+    }
+  ],
+  "cannotFix": "optional — set when no safe patch can be proposed"
+}`,f=(t,e)=>{const a=[];if(e.added.length>0&&a.push(`  added: ${e.added.join(", ")}`),e.changed.length>0&&a.push(`  changed: ${e.changed.join(", ")}`),e.removed.length>0&&a.push(`  removed: ${e.removed.join(", ")}`),a.length!==0)return`- ${t}:
+${a.join(`
+`)}`},z=t=>{if(!t.hashDiff)return"No hash-diff available — there is no previous run to compare against.";const e=[];t.hashDiff.commandChanged&&e.push("- command line changed since previous run");const a=f("file inputs",t.hashDiff.nodes),o=f("implicit deps",t.hashDiff.implicitDeps),s=f("runtime/env",t.hashDiff.runtime);return a&&e.push(a),o&&e.push(o),s&&e.push(s),e.length===0?"No detectable changes between this run and the previous run.":e.join(`
+`)},G=t=>{const e=[`Task: ${t.taskId}`];return t.project&&e.push(`Project: ${t.project}`),t.target&&e.push(`Target: ${t.target}`),t.command&&e.push(`Command: ${t.command}`),t.cwd&&e.push(`CWD: ${t.cwd}`),t.exitCode!==void 0&&e.push(`Exit code: ${String(t.exitCode)}`),t.hash&&e.push(`Task hash: ${t.hash}`),e.push("","Hash-diff since previous run:",z(t),""),t.terminalOutputCaptured?e.push("Terminal output:","```",t.terminalOutput,"```"):e.push("Terminal output: <no failure log was captured for this task>",'Set "cannotFix" and tell the user to re-run with `vis run` so logs can be captured.'),e.join(`
+`)},V=t=>`${U()}
+
+${G(t)}`,Q=(t,e)=>{const a=Array.isArray(t.patches)?t.patches:[],o=[];for(const n of a)typeof n.file!="string"||n.file.length===0||typeof n.oldString!="string"||n.oldString.length===0||typeof n.newString=="string"&&o.push({file:n.file,newString:n.newString,oldString:n.oldString,reason:typeof n.reason=="string"&&n.reason.length>0?n.reason:void 0});const s=typeof t.cannotFix=="string"&&t.cannotFix.length>0?t.cannotFix:void 0;return{cannotFix:s,confidence:K.has(t.confidence)?t.confidence:"low",explanation:typeof t.explanation=="string"?t.explanation:"",patches:s?[]:o,provider:e}},X=(t,e)=>{const a=q(t);return!a||typeof a!="object"?{cannotFix:"AI response was not valid JSON.",confidence:"low",explanation:"Failed to parse AI response.",patches:[],provider:e}:Q(a,e)},Z=(t,e)=>N({cwd:e.cwd??null,flow:"ai-fix",hash:e.hash??null,provider:t,taskId:e.taskId,terminalOutput:e.terminalOutput,terminalOutputCaptured:e.terminalOutputCaptured}),ht=async(t,e,a={})=>{const o=E(a.config);if(!o){e.warn(`No AI provider available — install one of: claude, gemini, copilot, codex.
+`);return}const s=a.cache!==!1,n=Z(o.name,t);if(s){const i=P(n);if(i)return e.info(`Using cached fix proposal from ${i.provider}.
+`),i}e.info(`Generating fix proposal with ${o.name}...
+`);try{const i=await M(o,V(t)),r=X(i,o.name);return s&&r.patches.length>0&&!r.cannotFix&&F(n,r,J),r}catch(i){const r=i instanceof Error?i.message:String(i);e.warn(`AI fix proposal failed (${r}).
+`);return}},tt=(t,e,a)=>y(a)?v(a):v(R(e??t,a)),et=(t,e)=>{const a=B(t,e);return a===""?!0:!a.startsWith("..")&&!y(a)},at=(t,e,a)=>{const o=t.indexOf(e),s=Math.max(0,o-x),n=Math.min(t.length,o+e.length+x),i=t.slice(s,n);return{previewAfter:`${t.slice(s,o)}${a}${t.slice(o+e.length,n)}`,previewBefore:i}},dt=async(t,e,a,o={})=>{const s=o.dryRun===!0,n=new Map,i=[];for(const r of a.patches){const c=tt(t,e,r.file);if(!et(t,c)){i.push({absolutePath:c,patch:r,status:"outside-workspace"});continue}let u=n.get(c);if(u===void 0){try{u=await _(c,"utf8")}catch(l){const g=l.code;i.push({absolutePath:c,error:g==="ENOENT"?void 0:l.message,patch:r,status:g==="ENOENT"?"missing-file":"error"});continue}n.set(c,u)}const h=u.indexOf(r.oldString);if(h===-1){i.push({absolutePath:c,patch:r,status:"no-match"});continue}if(u.indexOf(r.oldString,h+r.oldString.length)!==-1){i.push({absolutePath:c,patch:r,status:"ambiguous-match"});continue}const{previewAfter:p,previewBefore:S}=at(u,r.oldString,r.newString),m=`${u.slice(0,h)}${r.newString}${u.slice(h+r.oldString.length)}`;if(!s)try{await A(c,m,"utf8")}catch(l){n.delete(c),i.push({absolutePath:c,error:l.message,patch:r,status:"error"});continue}n.set(c,m),i.push({absolutePath:c,patch:r,previewAfter:p,previewBefore:S,status:"applied"})}return i};export{ut as a,dt as b,tt as c,ht as r};

package/dist/packem_shared/anolilab-text-CAM_E6uK.js

@@ -0,0 +1,13 @@
+const C=`<svg class="anolilab-logo" viewBox="0 0 354 71" xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false">
+<path d="M330.912 70.56C328.8 70.56 326.784 70.336 324.864 69.888C323.008 69.44 321.248 68.736 319.584 67.776C317.984 66.752 316.544 65.504 315.264 64.032L315.169 45.102C315.168 45.0121 315.168 44.9221 315.168 44.832L315.169 45.102C315.198 47.9463 315.677 50.6403 316.608 53.184C317.632 55.744 319.232 57.824 321.408 59.424C323.584 61.024 326.4 61.824 329.856 61.824C333.376 61.824 336.16 61.024 338.208 59.424C340.256 57.824 341.728 55.712 342.624 53.088C343.52 50.464 343.968 47.648 343.968 44.64C343.968 41.504 343.488 38.656 342.528 36.096C341.632 33.536 340.128 31.488 338.016 29.952C335.968 28.416 333.216 27.648 329.76 27.648C326.624 27.648 323.968 28.512 321.792 30.24C319.616 31.904 317.952 34.048 316.8 36.672L315 41H305.376V2.112H315.264V26.208C317.056 23.776 319.456 21.92 322.464 20.64C325.472 19.36 328.576 18.72 331.776 18.72C336.832 18.72 340.992 19.872 344.256 22.176C347.52 24.416 349.92 27.488 351.456 31.392C353.056 35.232 353.856 39.616 353.856 44.544C353.856 49.408 353.024 53.824 351.36 57.792C349.696 61.696 347.168 64.8 343.776 67.104C340.448 69.408 336.16 70.56 330.912 70.56Z"/>
+<path class="anolilab-accent" d="M305 70L315 42H324.686L315 70H305Z"/>
+<path d="M267.879 70.56C265.575 70.56 263.335 70.272 261.159 69.696C259.047 69.056 257.159 68.128 255.495 66.912C253.831 65.632 252.487 64.064 251.463 62.208C250.503 60.288 250.023 58.048 250.023 55.488C250.023 52.416 250.599 49.888 251.751 47.904C252.967 45.856 254.567 44.288 256.551 43.2C258.535 42.048 260.807 41.248 263.367 40.8C265.991 40.288 268.711 40.032 271.527 40.032H283.911C283.911 37.536 283.527 35.36 282.759 33.504C281.991 31.584 280.775 30.112 279.111 29.088C277.511 28 275.367 27.456 272.679 27.456C271.079 27.456 269.543 27.648 268.071 28.032C266.663 28.352 265.447 28.896 264.423 29.664C263.399 30.432 262.695 31.456 262.311 32.736H251.943C252.327 30.304 253.191 28.224 254.535 26.496C255.879 24.704 257.543 23.232 259.527 22.08C261.511 20.928 263.623 20.096 265.863 19.584C268.167 19.008 270.503 18.72 272.871 18.72C280.167 18.72 285.415 20.864 288.615 25.152C291.879 29.376 293.511 35.2 293.511 42.624V69.984H284.967L284.583 63.552C283.111 65.536 281.351 67.04 279.303 68.064C277.319 69.088 275.335 69.76 273.351 70.08C271.367 70.4 269.543 70.56 267.879 70.56ZM269.415 62.208C272.295 62.208 274.823 61.728 276.999 60.768C279.175 59.744 280.871 58.304 282.087 56.448C283.303 54.528 283.911 52.288 283.911 49.728V47.616H274.887C273.031 47.616 271.207 47.68 269.415 47.808C267.687 47.872 266.087 48.128 264.615 48.576C263.207 48.96 262.055 49.632 261.159 50.592C260.327 51.552 259.911 52.928 259.911 54.72C259.911 56.448 260.359 57.856 261.255 58.944C262.151 60.032 263.335 60.864 264.807 61.44C266.279 61.952 267.815 62.208 269.415 62.208Z"/>
+<path d="M229.328 41.0556V1.98401H239.328V41.0556H229.328Z"/>
+<path class="anolilab-accent" d="M229.314 70L239.314 42H249L239.314 70H229.314Z"/>
+<path d="M207.501 69.984V19.392H217.389V69.984H207.501ZM212.397 12.672C210.477 12.672 208.909 12.096 207.693 10.944C206.541 9.728 205.965 8.192 205.965 6.336C205.965 4.48 206.573 2.976 207.789 1.824C209.005 0.608 210.541 0 212.397 0C214.125 0 215.629 0.608 216.909 1.824C218.253 2.976 218.925 4.48 218.925 6.336C218.925 8.192 218.285 9.728 217.005 10.944C215.789 12.096 214.253 12.672 212.397 12.672Z"/>
+<path d="M185.376 69.984V2.112H195.264V69.984H185.376Z"/>
+<path d="M150.749 70.56C145.501 70.56 141.053 69.504 137.405 67.392C133.757 65.216 130.973 62.176 129.053 58.272C127.197 54.368 126.269 49.856 126.269 44.736C126.269 39.552 127.228 35.04 129.148 31.2C131.068 27.296 133.853 24.256 137.501 22.08C141.149 19.84 145.597 18.72 150.845 18.72C156.093 18.72 160.541 19.84 164.189 22.08C167.837 24.256 170.589 27.296 172.445 31.2C174.301 35.104 175.229 39.648 175.229 44.832C175.229 49.888 174.269 54.368 172.349 58.272C170.493 62.176 167.74 65.216 164.092 67.392C160.508 69.504 156.061 70.56 150.749 70.56ZM150.749 61.728C154.205 61.728 156.989 60.96 159.101 59.424C161.277 57.888 162.877 55.84 163.901 53.28C164.925 50.656 165.437 47.808 165.437 44.736C165.437 41.664 164.925 38.848 163.901 36.288C162.877 33.728 161.277 31.68 159.101 30.144C156.989 28.544 154.205 27.744 150.749 27.744C147.357 27.744 144.572 28.544 142.396 30.144C140.22 31.68 138.62 33.728 137.596 36.288C136.636 38.848 136.157 41.664 136.157 44.736C136.157 47.872 136.636 50.72 137.596 53.28C138.62 55.84 140.22 57.888 142.396 59.424C144.572 60.96 147.357 61.728 150.749 61.728Z"/>
+<path d="M71.001 69.984V19.392H80.409L80.889 26.496C82.169 24.64 83.705 23.168 85.497 22.08C87.289 20.928 89.209 20.096 91.257 19.584C93.305 19.008 95.289 18.72 97.209 18.72C102.073 18.72 105.881 19.776 108.633 21.888C111.449 23.936 113.433 26.72 114.585 30.24C115.801 33.696 116.409 37.632 116.409 42.048V69.984H106.425V44.064C106.425 42.016 106.297 40 106.041 38.016C105.785 36.032 105.241 34.272 104.409 32.736C103.641 31.136 102.521 29.888 101.049 28.992C99.577 28.032 97.593 27.552 95.097 27.552C92.025 27.552 89.433 28.384 87.321 30.048C85.209 31.712 83.609 33.952 82.521 36.768C81.433 39.584 80.889 42.752 80.889 46.272V69.984H71.001Z"/>
+<path d="M0 69.984L25.632 2.112H38.784L64.32 69.984H53.376L48.384 56.352H15.936L10.944 69.984H0ZM19.296 47.232H45.024L32.16 11.808L19.296 47.232Z"/>
+</svg>
+`;export{C as d};

package/dist/packem_shared/api.d-BPftyU9r.d.ts

@@ -0,0 +1,27 @@
+import { ChangeFile, PlannedRelease } from "../release/types.js";
+type ChangelogTarget = "changelog" | "github-release";
+interface ChangelogContext {
+  /** All change files contributing to this release (may be empty for pure dep bumps). */
+  changeFiles: ChangeFile[];
+  /** ISO date string `YYYY-MM-DD`. */
+  date: string;
+  /** The release entry being rendered. */
+  release: PlannedRelease;
+  /** Where the rendered output is going — formatters may strip the version heading for `github-release`. */
+  target: ChangelogTarget;
+}
+/** Function signature for changelog formatters. */
+type ChangelogFormatter = (context: ChangelogContext) => string | Promise<string>;
+/** Factory shape — formatters can be exported as `defineFormatter` calls or default-exported functions. */
+type ChangelogFormatterModule = {
+  default?: ChangelogFormatter;
+} | ChangelogFormatter;
+/** Recognised inline-metadata keys in change-file bodies. */
+interface ChangeFileMeta {
+  author?: string;
+  commit?: string;
+  pr?: number;
+}
+/** Helper for custom formatters that wrap the default behaviour. */
+declare const defineFormatter: (formatter: ChangelogFormatter) => ChangelogFormatter;
+export { ChangelogFormatter as C, ChangeFileMeta as a, ChangelogContext as b, ChangelogFormatterModule as c, ChangelogTarget as d, defineFormatter as e };

package/dist/packem_shared/build-scripts-CCCi8U66.js

@@ -0,0 +1 @@
+import{createRequire as j}from"node:module";import{m as h,f as y}from"./index-BDmTbWX1.js";import{a as q}from"../packem_chunks/config.js";const $=j(import.meta.url),g=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,k=e=>{if(typeof g<"u"&&g.versions&&g.versions.node){const[s,n]=g.versions.node.split(".").map(Number);if(s>22||s===22&&n>=3||s===20&&n>=16)return g.getBuiltinModule(e)}return $(e)},{readdirSync:_,statSync:M}=k("node:fs"),w=["preinstall","install","postinstall","prepare"],x=e=>{const s=h(e,"node_modules");if(!y(s))return[];const n=new Map,o=(l,p="")=>{let u;try{u=_(l)}catch{return}for(const r of u){const i=h(l,r);if(r.startsWith("@")){o(i,`${r}/`);continue}if(r===".pnpm"&&p===""){let f;try{f=_(i)}catch{continue}for(const a of f){const c=h(i,a,"node_modules");y(c)&&o(c)}continue}if(r.startsWith("."))continue;const m=p+r,t=h(i,"package.json");try{if(!M(i).isDirectory()||!y(t))continue;const f=q(t),a=f.scripts??{},c=w.filter(v=>a[v]);!a.preinstall&&!a.install&&!a.postinstall&&y(h(i,"binding.gyp"))&&c.push("install (binding.gyp)"),c.length>0&&!n.has(m)&&n.set(m,{directory:i,hooks:c,name:m,version:typeof f.version=="string"?f.version:void 0});const d=h(i,"node_modules");y(d)&&o(d)}catch{}}};return o(s),[...n.values()]},W=e=>{const s=e.startsWith("@"),n=e.indexOf("@",s?1:0);return n===-1?{name:e}:{name:e.slice(0,n),version:e.slice(n+1)}},B=(e,s,n)=>{for(const[o,l]of Object.entries(s)){if(!l)continue;if(o.endsWith("@*")){if(o.slice(0,-2)===e.name)return!0;continue}if(o.endsWith("*")){if(e.name.startsWith(o.slice(0,-1)))return!0;continue}const{name:p,version:u}=W(o);if(p===e.name&&(!n||u===void 0||e.version===u))return!0}return!1},O=(e,s,n={})=>{const o=n.pinVersions===!0,l=x(e),p=[],u=[],r=new Map(l.map(t=>[t.name,t]));for(const t of l)B(t,s,o)?u.push(t):p.push(t);const i=[],m=[];for(const[t,f]of Object.entries(s)){if(!f)continue;if(t.endsWith("@*")){const v=t.slice(0,-2);r.has(v)||i.push(t);continue}if(t.endsWith("*")){const v=t.slice(0,-1);[...r.keys()].some(b=>b.startsWith(v))||i.push(t);continue}const{name:a,version:c}=W(t),d=r.get(a);if(!d){i.push(t);continue}o&&c!==void 0&&c!=="*"&&d.version&&d.version!==c&&m.push({from:t,to:`${a}@${d.version}`})}return{excess:i,installed:u,unapproved:p,versionDrift:m}},S=(e,s)=>O(e,s).unapproved.map(n=>`${n.name} (${n.hooks.join(", ")})`);export{O as W,S as w};

package/dist/packem_shared/createAdapter-bU4DIP3F.js

@@ -0,0 +1 @@
+import{c as r,d as t}from"../packem_chunks/detect.js";export{r as createAdapter,t as detectPackageManager};

package/dist/packem_shared/createVersionActions-BK43SNDH.js

@@ -0,0 +1 @@
+import{c as r}from"../packem_chunks/registry.js";export{r as createVersionActions};

package/dist/packem_shared/cyclonedx-kYozDyxp.js

@@ -0,0 +1,4 @@
+import{createRequire as ie}from"node:module";import{m as E,v as ue}from"./index-BDmTbWX1.js";import{r as le}from"./docker-BMLrNtWm.js";import{a as oe}from"../packem_chunks/config.js";import{e as fe}from"./license-t5KnNX6v.js";import{D as de}from"../packem_chunks/bin.js";import"./public-api-WqUCiyIe.js";import{p as he}from"./index-CgcF6_wo.js";const ae=ie(import.meta.url),P=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,se=e=>{if(typeof P<"u"&&P.versions&&P.versions.node){const[n,t]=P.versions.node.split(".").map(Number);if(n>22||n===22&&t>=3||n===20&&t>=16)return P.getBuiltinModule(e)}return ae(e)},{randomUUID:pe}=se("node:crypto"),{readdirSync:me}=se("node:fs"),X=e=>e.replaceAll(/[^\w.~-]/g,n=>`%${(n.codePointAt(0)??0).toString(16).toUpperCase().padStart(2,"0")}`),C=(e,n)=>{const t=e.toLowerCase();if(t.startsWith("@")){const s=t.indexOf("/");if(s>0){const r=t.slice(0,s),p=t.slice(s+1);return`pkg:npm/${X(r)}/${X(p)}@${X(n)}`}}return`pkg:npm/${X(t)}@${X(n)}`},m={ARRAY:"array",BOOLEAN:"boolean",DATE:"date",FUNCTION:"function",JSTOXML_OBJECT:"jstoxml-object",NULL:"null",NUMBER:"number",OBJECT:"object",STRING:"string"},_e=[m.STRING,m.NUMBER,m.BOOLEAN],ge='<?xml version="1.0" encoding="UTF-8"?>',ee=["_selfCloseTag","_attrs"],ye=(e="",n=0)=>e.repeat(n),Y=e=>Array.isArray(e)&&m.ARRAY||typeof e===m.OBJECT&&e!==null&&e._name&&m.JSTOXML_OBJECT||e instanceof Date&&m.DATE||e===null&&m.NULL||typeof e,re=e=>e.startsWith("<![CDATA["),ce=(e="",n={},t)=>{let s=e;if(typeof e===m.STRING){if(re(e))return e;const r=new RegExp(`(${Object.keys(n).join("|")})(?!(\\w|#)*;)`,"g");s=String(e).replace(r,(p,h)=>n[h]||"")}return typeof t=="function"?t(s):s},be=(e={},n,t,s)=>(Array.isArray(e)?e:Object.entries(e).map(([r,p])=>({[r]:p}))).reduce((r,p)=>{const h=Object.keys(p)[0],_=p[h];if(typeof t===m.FUNCTION&&t(h,_))return r;const y=n?ce(_,n):_,$=!s&&y===!0?"":`="${y}"`;return r.push(`${h}${$}`),r},[]),$e=(e={},n,t,s)=>{const r=be(e,n,t,s);return r.length===0?"":` ${r.join(" ")}`},Oe=(e={})=>Object.keys(e).map(n=>({_name:n,_content:e[n]})),ve=e=>_e.includes(Y(e)),je=e=>!e.match("<"),ke=({header:e,isOutputStart:n})=>e&&n?typeof e===m.BOOLEAN?ge:e:"",ne={"<":"&lt;",">":"&gt;","&":"&amp;",'"':"&quot;"},U=(e={},n={})=>{const{depth:t=0,indent:s,_isFirstItem:r,_isOutputStart:p=!0,header:h,attributeReplacements:_={},attributeFilter:y,attributeExplicitTrue:$=!1,contentReplacements:F={},contentMap:M,selfCloseTags:B=!0}=n,J=typeof _=="boolean"&&!_?{}:{...ne,..._},G=typeof F=="boolean"&&!F?{}:{...ne,...F},D=typeof s=="string",k=ye(s,t),W=Y(e),L=ke({header:h,isOutputStart:p}),N=p&&!L&&r&&t===0,R=D&&!N?`
+`:"";let b="";switch(W){case m.JSTOXML_OBJECT:{const{_name:f,_content:u}=e;if(u===null&&typeof M!="function"){b=`${R}${k}${f}`;break}if(Array.isArray(u)&&u.every(ve))return u.map(j=>U({_name:f,_content:j},{...n,depth:t,_isOutputStart:!1})).join("");if(ee.includes(f))break;const g=U(u,{...n,depth:t+1,_isOutputStart:N}),w=Y(g),O=je(g),v=re(g),x=`${R}${k}`;if(f==="_comment"){b+=`${x}<!-- ${u} -->`;break}const H=w==="undefined"||g==="",c=B,o=e._selfCloseTag,a=typeof o===m.BOOLEAN?H&&o:H&&c,i=a?"/":"",l=$e(e._attrs,J,y,$),d=`<${f}${l}${i}>`,T=D&&!O&&!v?`
+${k}`:"",S=a?"":`${g}${T}</${f}>`;b+=`${x}${d}${S}`;break}case m.OBJECT:{const f=Object.keys(e);b=f.map((u,g)=>{const w={...n,_isFirstItem:g===0,_isLastItem:g+1===f.length,_isOutputStart:N},O={_name:u};if(Y(e[u])===m.OBJECT&&(ee.forEach(v=>{const x=e[u][v];typeof x<"u"&&(O[v]=x,delete e[u][v])}),typeof e[u]._content<"u"&&Object.keys(e[u]).length>1)){const v=Object.assign({},e[u]);delete v._content,O._content=[...Oe(v),e[u]._content]}return typeof O._content>"u"&&(O._content=e[u]),U(O,w)},n).join("");break}case m.FUNCTION:{const f=e(n);b=U(f,n);break}case m.ARRAY:{b=e.map((f,u)=>{const g={...n,_isFirstItem:u===0,_isLastItem:u+1===e.length,_isOutputStart:N};return U(f,g)}).join("");break}default:{b=ce(e,G,M);break}}return`${L}${b}`},Q=e=>{try{return oe(e)}catch{return}},Te=e=>{if(e.length===0||e.includes("..")||e.startsWith(".")||e.includes("\0")||e.includes("\\"))return!1;if(e.startsWith("@")){const n=e.indexOf("/");return n>1&&!e.includes("/",n+1)}return!e.includes("/")},Se=e=>e.length>0&&!e.includes("/")&&!e.includes("\\")&&!e.includes("..")&&!e.includes("\0"),Ae=(e,n,t)=>{const s=`${n.replaceAll("/","+")}@${t}`,r=E(e,"node_modules",".pnpm"),p=Q(E(r,s,"node_modules",n,"package.json"));if(p)return p;let h;try{h=me(r)}catch{return}const _=`${s}_`;for(const y of h){if(!y.startsWith(_))continue;const $=Q(E(r,y,"node_modules",n,"package.json"));if($)return $}},we=(e,n,t)=>{const s=Q(E(e,"node_modules",n,"package.json"));return s?.version===t?s:void 0},xe=(e,n,t)=>{if(!(!Te(n)||!Se(t)))return Ae(e,n,t)??we(e,n,t)},De={sha256:"SHA-256",sha384:"SHA-384",sha512:"SHA-512"},Ne={sha256:64,sha384:96,sha512:128},Re=e=>{const n={name:e.name,version:e.version},{integrity:t}=e;return t&&t.hex.length===Ne[t.algorithm]&&(n.hash={alg:De[t.algorithm],content:t.hex}),e.dependencies&&(n.dependencies=e.dependencies),e.peerDependencies&&(n.peerDependencies=e.peerDependencies),e.optionalDependencies&&(n.optionalDependencies=e.optionalDependencies),n},Ce=[{file:"pnpm-lock.yaml",type:"pnpm"},{file:"npm-shrinkwrap.json",type:"npm"},{file:"package-lock.json",type:"npm"},{file:"yarn.lock",type:"yarn"},{file:"bun.lock",type:"bun"}],Ee=e=>{for(const{file:n,type:t}of Ce){let s;try{s=ue(E(e,n))}catch{continue}const r=new Map;for(const p of de(s,t))r.set(`${p.name}@${p.version}`,Re(p));return{packages:r,type:t}}},Me=e=>{const n=e.indexOf(":");return n<=0?e:e.slice(0,n)==="npm"?e.slice(n+1):e},V=(e,n,t)=>{const s=t.get(e);if(!s||s.size===0)return;if(s.has(n))return n;const r=Me(n);if(r!==n&&s.has(r))return r;const p=[...s];return he.maxSatisfying(p,r,{includePrerelease:!0})||p[0]},Be="1.7",Le="CycloneDX",Ie="http://cyclonedx.org/schema/bom-1.7.schema.json",Ue="@visulima/vis",te=e=>{try{return oe(e)}catch{return}},Fe=e=>{if(e){if(typeof e=="string")return e;if(typeof e=="object"&&e.name)return e.email?`${e.name} <${e.email}>`:e.name}},Je=e=>{if(e)return typeof e=="string"?e:e.url},qe=e=>{if(e)return typeof e=="string"?e:e.url},Pe=e=>{const n=[];e.homepage&&n.push({type:"website",url:e.homepage});const t=Je(e.repository);t&&n.push({type:"vcs",url:t});const s=qe(e.bugs);return s&&n.push({type:"issue-tracker",url:s}),n.length>0?n:void 0},Xe=e=>e==="application"||e==="service"||e==="tool"?"application":"library",K=(e,n)=>{if(!n)return;n.description&&(e.description=n.description);const t=Fe(n.author);t&&(e.author=t);const s=fe(n);s&&(e.licenses=s);const r=Pe(n);r&&(e.externalReferences=r)},tn=e=>{const{focus:n,generatorVersion:t,includeDev:s=!1,now:r=new Date,projectGraph:p,serialNumber:h,workspace:_,workspaceRoot:y}=e,$=n&&n.length>0?[...le(n,p)].sort():Object.keys(_.projects).sort(),F=new Set($),M=new Map;for(const c of $){const o=_.projects[c];o&&M.set(c,te(E(y,o.root,"package.json")))}const B=[],J=new Map;for(const c of $){const o=_.projects[c];if(!o)continue;const a=M.get(c),i=a?.version??"0.0.0",l=C(c,i);J.set(c,l);const d={"bom-ref":l,name:c,purl:l,type:Xe(o.projectType),version:i};K(d,a),B.push(d)}const G=Ee(y),D=new Map,k=new Map;if(G)for(const c of G.packages.values()){D.set(`${c.name}@${c.version}`,c);let o=k.get(c.name);o||(o=new Set,k.set(c.name,o)),o.add(c.version)}const W=[],L=[],N=new Map;for(const c of $){const o=M.get(c);if(!o)continue;const a=[o.dependencies,o.peerDependencies];s&&a.push(o.devDependencies);const i=new Set,l=(d,T)=>{if(T)for(const[S,j]of Object.entries(T)){if(F.has(S)){const I=J.get(S);I&&i.add(I);continue}const A=V(S,j,k);A&&(i.add(C(S,A)),d.push(`${S}@${A}`))}};for(const d of a)l(W,d);l(L,o.optionalDependencies),N.set(c,i)}const R=new Map,b=new Map,f=(c,o)=>{const a=[...c];for(;a.length>0;){const i=a.pop(),l=R.get(i);if(l==="required"||l==="optional"&&o==="optional")continue;R.set(i,o);const d=D.get(i);if(!d)continue;const T=b.get(i)??new Set,S=[d.dependencies,d.peerDependencies];for(const j of S)if(j)for(const[A,I]of Object.entries(j))for(const q of I){const z=V(A,q,k);z&&(T.add(C(A,z)),a.push(`${A}@${z}`))}if(d.optionalDependencies)for(const[j,A]of Object.entries(d.optionalDependencies))for(const I of A){const q=V(j,I,k);q&&(T.add(C(j,q)),L.push(`${j}@${q}`))}T.size>0&&b.set(i,T)}};f(W,"required"),f(L,"optional");const u=[],g=[...R.keys()].sort();for(const c of g){const o=D.get(c);if(!o)continue;const a=C(o.name,o.version),i={"bom-ref":a,name:o.name,purl:a,scope:R.get(c)??"required",type:"library",version:o.version};o.hash&&(i.hashes=[o.hash]),K(i,xe(y,o.name,o.version)),u.push(i)}const w=[];for(const[c,o]of N){const a=J.get(c);if(!a)continue;const i=[...o].sort();w.push(i.length>0?{dependsOn:i,ref:a}:{ref:a})}for(const c of g){const o=D.get(c);if(!o)continue;const a=C(o.name,o.version),i=b.get(c),l=i?[...i].sort():[];w.push(l.length>0?{dependsOn:l,ref:a}:{ref:a})}w.sort((c,o)=>c.ref.localeCompare(o.ref));const O=te(E(y,"package.json")),v=(()=>{if(n?.length===1){const l=B.find(d=>d.name===n[0]);if(l)return{"bom-ref":l["bom-ref"],name:l.name,purl:l.purl,type:l.type,version:l.version}}const c=O?.name??"workspace",o=O?.version??"0.0.0",a=C(c,o),i={"bom-ref":a,name:c,purl:a,type:"application",version:o};return K(i,O),i})(),x=v["bom-ref"],H=x?B.filter(c=>c["bom-ref"]!==x):B;return{$schema:Ie,bomFormat:Le,components:[...H,...u],dependencies:w,metadata:{component:v,lifecycles:[{phase:"build"}],timestamp:r.toISOString(),tools:{components:[{name:Ue,type:"application",...t?{version:t}:{}}]}},serialNumber:h??`urn:uuid:${pe()}`,specVersion:Be,version:1}},sn=e=>{const n={version:e.version??1,xmlns:"http://cyclonedx.org/schema/bom/1.7"};e.serialNumber&&(n.serialNumber=e.serialNumber);const t=[];return e.metadata&&t.push(Ge(e.metadata)),e.components&&e.components.length>0&&t.push({_content:e.components.map(s=>Z(s)),_name:"components"}),e.dependencies&&e.dependencies.length>0&&t.push({_content:e.dependencies.map(s=>He(s)),_name:"dependencies"}),`${U({_attrs:n,_content:t,_name:"bom"},{header:!0,indent:"  ",selfCloseTags:!0})}
+`},Ge=e=>{const n=[];return e.timestamp&&n.push({timestamp:e.timestamp}),e.lifecycles&&e.lifecycles.length>0&&n.push({_content:e.lifecycles.map(t=>{const s=[];return t.phase&&s.push({phase:t.phase}),t.name&&s.push({name:t.name}),t.description&&s.push({description:t.description}),{_content:s,_name:"lifecycle"}}),_name:"lifecycles"}),e.tools?.components&&n.push({_content:[{_content:e.tools.components.map(t=>Z(t)),_name:"components"}],_name:"tools"}),e.component&&n.push(Z(e.component)),{_content:n,_name:"metadata"}},Z=e=>{const n={type:e.type};e["bom-ref"]&&(n["bom-ref"]=e["bom-ref"]);const t=[];e.group&&t.push({group:e.group}),t.push({name:e.name}),e.version&&t.push({version:e.version}),e.description&&t.push({description:e.description}),e.author&&t.push({author:e.author}),e.hashes&&e.hashes.length>0&&t.push({_content:e.hashes.map(r=>({_attrs:{alg:r.alg},_content:r.content,_name:"hash"})),_name:"hashes"});const s=We(e.licenses);return s&&t.push(s),e.purl&&t.push({purl:e.purl}),e.scope&&t.push({scope:e.scope}),e.externalReferences&&e.externalReferences.length>0&&t.push({_content:e.externalReferences.map(r=>({_attrs:{type:r.type},_content:[{url:r.url}],_name:"reference"})),_name:"externalReferences"}),{_attrs:n,_content:t,_name:"component"}},We=e=>{if(!e||e.length===0)return;const n=[];for(const t of e){if("expression"in t){n.push({expression:t.expression});continue}const s=[];"id"in t.license&&t.license.id?s.push({id:t.license.id}):"name"in t.license&&t.license.name&&s.push({name:t.license.name}),n.push({_content:s,_name:"license"})}return{_content:n,_name:"licenses"}},He=e=>e.dependsOn&&e.dependsOn.length>0?{_attrs:{ref:e.ref},_content:e.dependsOn.map(n=>({_attrs:{ref:n},_name:"dependency"})),_name:"dependency"}:{_attrs:{ref:e.ref},_name:"dependency"};export{tn as b,sn as s,C as t};

package/dist/packem_shared/defineFormatter-D5dCp6Kv.js

@@ -0,0 +1 @@
+const t=e=>e;export{t as defineFormatter};

package/dist/packem_shared/definePlugin-DoUcoYSy.js

@@ -0,0 +1 @@
+const n=e=>e;export{n as definePlugin};

package/dist/packem_shared/dependency-scan-DnTgYleU.js

@@ -0,0 +1 @@
+import{v as u,m as l,f as g}from"./index-BDmTbWX1.js";import{D as d,i as D,W as v}from"../packem_chunks/bin.js";import"./public-api-WqUCiyIe.js";const w={bun:{file:"bun.lock",type:"bun"},npm:{aliases:["npm-shrinkwrap.json"],file:"package-lock.json",type:"npm"},pnpm:{file:"pnpm-lock.yaml",type:"pnpm"},yarn:{file:"yarn.lock",type:"yarn"}},j=o=>{const t=w[o];return t?[...t.aliases??[],t.file].map(e=>({file:e,type:t.type})):[]},m=(o,t)=>{const e=j(t);if(e.length!==0)return e.find(r=>g(l(o,r.file)))??e[e.length-1]},k=o=>{try{return JSON.parse(u(o))}catch{return}},y=o=>{const t=[],e=k(l(o,"package.json"));e&&t.push(e);const r=D(o);let c;if(r?c=r:e?.workspaces&&(Array.isArray(e.workspaces)?c=e.workspaces:e.workspaces.packages&&(c=e.workspaces.packages)),!c)return t;const a=v(o,c);for(const s of a){const n=k(l(o,s,"package.json"));n&&t.push(n)}return t},b=(o,t)=>{const e=new Set,r=[],c=new Map;for(const s of t){const n=c.get(s.name);n?n.push(s):c.set(s.name,[s])}const a=s=>{if(s)for(const n of Object.keys(s))e.has(n)||(e.add(n),r.push(n))};for(const s of y(o))a(s.dependencies),a(s.peerDependencies),a(s.optionalDependencies);for(;r.length>0;){const s=r.shift(),n=c.get(s);if(n){for(const i of n)for(const p of[i.dependencies,i.peerDependencies,i.optionalDependencies])if(p)for(const f of Object.keys(p))e.has(f)||(e.add(f),r.push(f))}}return e},$=(o,t,e={})=>{const r=m(o,t);if(!r)return[];let c;try{c=u(l(o,r.file))}catch{return[]}const a=d(c,r.type);if(a.length===0)return[];const s=e.includeDev??!0?void 0:b(o,a),n=new Set,i=[];for(const p of a){if(s&&!s.has(p.name))continue;const f=`${p.name}@${p.version}`;n.has(f)||(n.add(f),i.push({isDev:!1,name:p.name,version:p.version}))}return i},A=(o,t)=>{const e=m(o,t);if(!e)return[];let r;try{r=u(l(o,e.file))}catch{return[]}const c=d(r,e.type);if(c.length===0)return[];const a=new Map;for(const n of c)a.has(n.name)||a.set(n.name,new Set),a.get(n.name).add(n.version);const s=[];for(const[n,i]of a)i.size<=1||s.push({name:n,versions:[...i]});return s.sort((n,i)=>n.name.localeCompare(i.name))},E=(o,t)=>{const e=m(o,t);if(!e)return;let r;try{r=u(l(o,e.file))}catch{return}const c=d(r,e.type);if(c.length===0)return;const a=[],s=new Set;for(const n of y(o))for(const i of[n.dependencies,n.devDependencies,n.peerDependencies,n.optionalDependencies])if(i)for(const[p,f]of Object.entries(i)){const h=`${p}@${f}`;s.has(h)||(s.add(h),a.push({name:p,version:f}))}return{entries:c,roots:a}};export{w as L,E as a,A as f,$ as l,m as r};