@visulima/vis 1.0.0-alpha.42 → 1.0.0-alpha.43

package/dist/packem_chunks/orchestrator.js

@@ -1,39 +1,39 @@
-import{createRequire as De}from"node:module";import{u as x}from"../packem_shared/index-Cb4x6lWY.js";import{DEFAULT_CHANGES_DIR as q,DEFAULT_DEPENDENCY_BUMP_RULES as Oe,DEFAULT_CONFIG as Be}from"./DEFAULT_CLEAN_KEEP.js";import{VisReleaseError as R}from"../packem_shared/VisReleaseError-DMGRBTNO.js";import{e as Le,p as Te,c as xe}from"./registry.js";import{E as Ue}from"../packem_shared/public-api-WqUCiyIe.js";import{BUMP_LEVELS as le,maxBump as oe,bumpRank as Q,normaliseGroup as ge}from"../release/types.js";import Z from"./index.js";import{d as He,c as We}from"./detect.js";import{escapeMarkdown as Ye,assertValidPackageName as Je}from"./security.js";import{createShellRunner as J}from"./shell-runner.js";const Se=De(import.meta.url),W=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,pe=e=>{if(typeof W<"u"&&W.versions&&W.versions.node){const[a,t]=W.versions.node.split(".").map(Number);if(a>22||a===22&&t>=3||a===20&&t>=16)return W.getBuiltinModule(e)}return Se(e)},{readdir:Ve,readFile:Ee,writeFile:Fe,unlink:_e}=pe("node:fs/promises"),{resolve:X,sep:K,join:Ge}=pe("node:path"),{realpathSync:ze}=pe("node:fs"),qe=/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/,Xe=e=>{const a=qe.exec(e);return a?{body:(a[2]??"").trim(),frontmatter:a[1]??""}:null},Ke=/^(?:@[a-z0-9-]+\/)?[\w.-]+$/i,Qe=214,Ze=e=>e.length===0||e.length>Qe||e.startsWith(".")||e.startsWith("_")||e.startsWith("-")?!1:Ke.test(e),ie=e=>typeof e=="string"&&le.includes(e),ea=/^\s*(pr|commit|author)\s*:\s*(.+?)\s*$/i,aa=e=>{const a=e.split(/\r?\n/),t={};let n=0;for(const c of a){if(c.trim()===""){n+=1;continue}const d=ea.exec(c);if(!d)break;const[,l="",i=""]=d;switch(l.toLowerCase()){case"author":{t.author=i.startsWith("@")?i:`@${i}`;break}case"commit":{t.commit=i;break}case"pr":{const r=Number.parseInt(i,10);!Number.isNaN(r)&&r>0&&(t.pr=r);break}}n+=1}const s=a.slice(n).join(`
-`).trim();return{meta:Object.keys(t).length>0?t:void 0,remainder:s}},me=e=>typeof e=="object"&&e!==null&&!Array.isArray(e)&&"bump"in e,ta=(e,a,t)=>{if(!ie(a.bump))throw new R({code:"BUMP_FILE_INVALID",file:t,message:`Invalid bump level for "${e}": ${JSON.stringify(a.bump)}. Expected one of: ${le.join(", ")}`,packageName:e});const n={bump:a.bump,package:e};if(a.releaseAs!==void 0){if(typeof a.releaseAs!="string"||!/^\d+\.\d+\.\d+(?:[-+].*)?$/.test(a.releaseAs))throw new R({code:"BUMP_FILE_INVALID",file:t,message:`Invalid releaseAs for "${e}": ${JSON.stringify(a.releaseAs)}. Expected a semver string like "2.0.0" or "2.0.0-rc.1".`,packageName:e});n.releaseAs=a.releaseAs}if(a.cascade!==void 0){if(typeof a.cascade!="object"||a.cascade===null||Array.isArray(a.cascade))throw new R({code:"BUMP_FILE_INVALID",file:t,message:`Cascade block for "${e}" must be an object mapping package globs to bump levels.`,packageName:e});const s={};for(const[c,d]of Object.entries(a.cascade)){if(!ie(d))throw new R({code:"BUMP_FILE_INVALID",file:t,message:`Invalid cascade bump level for "${c}": ${JSON.stringify(d)}.`,packageName:e});s[c]=d}n.cascade=s}return n},ne=e=>e.replaceAll(/^.*[/\\]/g,"").replace(/\.md$/i,""),na=(e,a)=>{const t=Xe(e);if(!t)throw new R({code:"BUMP_FILE_INVALID",file:a,message:"Change file is missing YAML frontmatter (expected `---` delimiters)."});let n;try{n=Ue(t.frontmatter,{schema:"core",strict:!0})}catch(i){throw new R({cause:i,code:"BUMP_FILE_INVALID",file:a,message:`YAML parse failed: ${i.message}`})}if(n==null)return{body:t.body.trim(),id:ne(a),path:a,payload:{bumps:{}}};if(typeof n!="object"||Array.isArray(n))throw new R({code:"BUMP_FILE_INVALID",file:a,message:"Frontmatter must be a YAML object mapping package names to bump levels."});const s=Object.entries(n);if(s.length===0)return{body:t.body.trim(),id:ne(a),path:a,payload:{bumps:{}}};for(const[i]of s)if(!Ze(i))throw new R({code:"BUMP_FILE_INVALID",file:a,message:`Invalid package name: ${JSON.stringify(i)}.`,packageName:i});let c;if(s.length===1&&me(s[0][1])){const[i,r]=s[0];c=ta(i,r,a)}else{const i={};for(const[r,m]of s){if(me(m))throw new R({code:"BUMP_FILE_INVALID",file:a,message:`Mixed simple + nested entries are not allowed. Package "${r}" uses the nested shape but the file has multiple top-level entries.`,packageName:r});if(!ie(m))throw new R({code:"BUMP_FILE_INVALID",file:a,message:`Invalid bump level for "${r}": ${JSON.stringify(m)}. Expected one of: ${le.join(", ")}`,packageName:r});i[r]=m}c={bumps:i}}const{meta:d,remainder:l}=aa(t.body);return{body:l,id:ne(a),meta:d,path:a,payload:c}},Ya=(e,a)=>{let t;if("bumps"in e){const n=Object.entries(e.bumps).map(([s,c])=>`${se(s)}: ${c}`);t=n.length>0?n.join(`
-`):"{}"}else{const n=[`${se(e.package)}:`,`  bump: ${e.bump}`];if(e.releaseAs&&n.push(`  releaseAs: ${e.releaseAs}`),e.cascade){n.push("  cascade:");for(const[s,c]of Object.entries(e.cascade))n.push(`    ${se(s)}: ${c}`)}t=n.join(`
+import{createRequire as Se}from"node:module";import{u as x}from"../packem_shared/index-Cg0IHaFI.js";import{DEFAULT_CHANGES_DIR as X,DEFAULT_DEPENDENCY_BUMP_RULES as Le,DEFAULT_CONFIG as Be}from"./DEFAULT_CLEAN_KEEP.js";import{VisReleaseError as R}from"../packem_shared/VisReleaseError-DMGRBTNO.js";import{e as Te,p as xe,c as Ge}from"./registry.js";import{E as He}from"../packem_shared/public-api-WqUCiyIe.js";import{BUMP_LEVELS as le,maxBump as oe,bumpRank as K,normaliseGroup as ge}from"../release/types.js";import Q from"./index.js";import{d as We,c as Ye}from"./detect.js";import{escapeMarkdown as Je,assertValidPackageName as ze}from"./security.js";import{createShellRunner as z}from"./shell-runner.js";const Ve=Se(import.meta.url),W=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,pe=e=>{if(typeof W<"u"&&W.versions&&W.versions.node){const[a,t]=W.versions.node.split(".").map(Number);if(a>22||a===22&&t>=3||a===20&&t>=16)return W.getBuiltinModule(e)}return Ve(e)},{readdir:Ee,readFile:Fe,writeFile:_e,unlink:Oe}=pe("node:fs/promises"),{resolve:re,sep:Y,join:Ue}=pe("node:path"),{realpathSync:me}=pe("node:fs"),qe=/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/,Xe=e=>{const a=qe.exec(e);return a?{body:(a[2]??"").trim(),frontmatter:a[1]??""}:null},Ke=/^(?:@[a-z0-9-]+\/)?[\w.-]+$/i,Qe=214,Ze=e=>e.length===0||e.length>Qe||e.startsWith(".")||e.startsWith("_")||e.startsWith("-")?!1:Ke.test(e),ie=e=>typeof e=="string"&&le.includes(e),ea=/^\s*(pr|commit|author)\s*:\s*(.+?)\s*$/i,aa=e=>{const a=e.split(/\r?\n/),t={};let n=0;for(const c of a){if(c.trim()===""){n+=1;continue}const d=ea.exec(c);if(!d)break;const[,l="",o=""]=d;switch(l.toLowerCase()){case"author":{t.author=o.startsWith("@")?o:`@${o}`;break}case"commit":{t.commit=o;break}case"pr":{const r=Number.parseInt(o,10);!Number.isNaN(r)&&r>0&&(t.pr=r);break}}n+=1}const s=a.slice(n).join(`
+`).trim();return{meta:Object.keys(t).length>0?t:void 0,remainder:s}},ue=e=>typeof e=="object"&&e!==null&&!Array.isArray(e)&&"bump"in e,ta=(e,a,t)=>{if(!ie(a.bump))throw new R({code:"BUMP_FILE_INVALID",file:t,message:`Invalid bump level for "${e}": ${JSON.stringify(a.bump)}. Expected one of: ${le.join(", ")}`,packageName:e});const n={bump:a.bump,package:e};if(a.releaseAs!==void 0){if(typeof a.releaseAs!="string"||!/^\d+\.\d+\.\d+(?:[-+].*)?$/.test(a.releaseAs))throw new R({code:"BUMP_FILE_INVALID",file:t,message:`Invalid releaseAs for "${e}": ${JSON.stringify(a.releaseAs)}. Expected a semver string like "2.0.0" or "2.0.0-rc.1".`,packageName:e});n.releaseAs=a.releaseAs}if(a.cascade!==void 0){if(typeof a.cascade!="object"||a.cascade===null||Array.isArray(a.cascade))throw new R({code:"BUMP_FILE_INVALID",file:t,message:`Cascade block for "${e}" must be an object mapping package globs to bump levels.`,packageName:e});const s={};for(const[c,d]of Object.entries(a.cascade)){if(!ie(d))throw new R({code:"BUMP_FILE_INVALID",file:t,message:`Invalid cascade bump level for "${c}": ${JSON.stringify(d)}.`,packageName:e});s[c]=d}n.cascade=s}return n},te=e=>e.replaceAll(/^.*[/\\]/g,"").replace(/\.md$/i,""),na=(e,a)=>{const t=Xe(e);if(!t)throw new R({code:"BUMP_FILE_INVALID",file:a,message:"Change file is missing YAML frontmatter (expected `---` delimiters)."});let n;try{n=He(t.frontmatter,{schema:"core",strict:!0})}catch(o){throw new R({cause:o,code:"BUMP_FILE_INVALID",file:a,message:`YAML parse failed: ${o.message}`})}if(n==null)return{body:t.body.trim(),id:te(a),path:a,payload:{bumps:{}}};if(typeof n!="object"||Array.isArray(n))throw new R({code:"BUMP_FILE_INVALID",file:a,message:"Frontmatter must be a YAML object mapping package names to bump levels."});const s=Object.entries(n);if(s.length===0)return{body:t.body.trim(),id:te(a),path:a,payload:{bumps:{}}};for(const[o]of s)if(!Ze(o))throw new R({code:"BUMP_FILE_INVALID",file:a,message:`Invalid package name: ${JSON.stringify(o)}.`,packageName:o});let c;if(s.length===1&&ue(s[0][1])){const[o,r]=s[0];c=ta(o,r,a)}else{const o={};for(const[r,m]of s){if(ue(m))throw new R({code:"BUMP_FILE_INVALID",file:a,message:`Mixed simple + nested entries are not allowed. Package "${r}" uses the nested shape but the file has multiple top-level entries.`,packageName:r});if(!ie(m))throw new R({code:"BUMP_FILE_INVALID",file:a,message:`Invalid bump level for "${r}": ${JSON.stringify(m)}. Expected one of: ${le.join(", ")}`,packageName:r});o[r]=m}c={bumps:o}}const{meta:d,remainder:l}=aa(t.body);return{body:l,id:te(a),meta:d,path:a,payload:c}},Ya=(e,a)=>{let t;if("bumps"in e){const n=Object.entries(e.bumps).map(([s,c])=>`${ne(s)}: ${c}`);t=n.length>0?n.join(`
+`):"{}"}else{const n=[`${ne(e.package)}:`,`  bump: ${e.bump}`];if(e.releaseAs&&n.push(`  releaseAs: ${e.releaseAs}`),e.cascade){n.push("  cascade:");for(const[s,c]of Object.entries(e.cascade))n.push(`    ${ne(s)}: ${c}`)}t=n.join(`
 `)}return`---
 ${t}
 ---
 ${a.trim()===""?"":`${a.trim()}
-`}`},se=e=>/^[a-z0-9-]/.test(e)?e:`"${e}"`,sa=e=>{const a=new Map,t=s=>s==="major"?3:s==="minor"?2:s==="patch"?1:0,n=(s,c)=>{const d=a.get(s);(d===void 0||t(c)>t(d))&&a.set(s,c)};for(const s of e)if("bumps"in s.payload)for(const[c,d]of Object.entries(s.payload.bumps))n(c,d);else n(s.payload.package,s.payload.bump);return a},ue=(e,a)=>a.filter(t=>"bumps"in t.payload?Object.hasOwn(t.payload.bumps,e):t.payload.package===e),ra=new Set(["README.md","readme.md"]),oa=async e=>{const a=e.changesDir??q,t=X(e.cwd),n=X(e.cwd,a),s=n,c=t.endsWith(K)?t:`${t}${K}`;if(n!==t&&!n.startsWith(c))throw new R({code:"CONFIG_INVALID",message:`changesDir resolves outside the workspace: ${n} (workspace: ${t}). Set release.changesDir to a path inside the repo.`});const d=[];let l;try{l=await Ve(s)}catch(r){if(r.code==="ENOENT")return{files:[],warnings:[]};throw new R({cause:r,code:"CONFIG_INVALID",message:`Cannot read change-files directory ${s}: ${r.message}`})}const i=l.filter(r=>!ra.has(r)&&r.endsWith(".md"));return{files:await Promise.all(i.map(async r=>{const m=Ge(s,r),o=await Ee(m,"utf8");return na(o,m)})),warnings:d}},ia=(e,a)=>{if(!a)return;if(Object.hasOwn(a,e)){const n=Object.keys(a).filter(s=>s!==e&&he(s)&&Z(s,e));return fe(e,a[e],n)}const t=[];for(const[n]of Object.entries(a))he(n)&&Z(n,e)&&t.push(n);if(t.length>0){const[n,...s]=t;return fe(e,a[n],s)}},fe=(e,a,t=[])=>{let{tag:n}=a;return n==="branch-name"&&(n=ca(e)),{branch:e,mode:a.mode??"auto-publish",...t.length>0?{overlapping:t}:{},prerelease:a.prerelease,range:a.range,tag:n}},ca=e=>e.toLowerCase().replaceAll(/[^a-z0-9.-]/g,"-").replaceAll(/^-+|-+$/g,"")||"branch",pa=/[!()*+?@[\]{|}]/,he=e=>pa.test(e),la=async(e,a)=>{try{const t=await a.run("git",["rev-parse","--abbrev-ref","HEAD"],{cwd:e,silent:!0});if(t.exitCode!==0)return;const n=t.stdout.trim();return n==="HEAD"||n===""?void 0:n}catch{return}},da=["dependencies","devDependencies","peerDependencies","optionalDependencies"];class ga{dependents;dependenciesByPackage;packagesByName;constructor(a){this.dependents=new Map,this.dependenciesByPackage=new Map,this.packagesByName=new Map;for(const t of a){if(this.packagesByName.has(t.name))throw new R({code:"DUPLICATE_PACKAGE_NAME",message:`Duplicate package name "${t.name}" — found at ${this.packagesByName.get(t.name).dir} and ${t.dir}.`,packageName:t.name});this.packagesByName.set(t.name,t),this.dependents.set(t.name,[]),this.dependenciesByPackage.set(t.name,[])}for(const t of a)for(const n of da){const s=t.manifest[n];if(!(!s||typeof s!="object"))for(const[c,d]of Object.entries(s))this.packagesByName.has(c)&&(this.dependents.get(c).push({kind:n,name:t.name,range:d}),this.dependenciesByPackage.get(t.name).push({kind:n,name:c,range:d}))}}getPackage(a){return this.packagesByName.get(a)}allPackages(){return[...this.packagesByName.values()]}isInternal(a){return this.packagesByName.has(a)}getDependents(a){return this.dependents.get(a)??[]}getDependencies(a){return this.dependenciesByPackage.get(a)??[]}topologicalSort(a){const t=a?new Set(a):new Set(this.packagesByName.keys()),n=new Set,s=new Set,c=[],d=(l,i)=>{if(!n.has(l)){if(s.has(l)){const r=i.indexOf(l),m=r===-1?[...i,l]:[...i.slice(r),l];throw new R({code:"CYCLIC_DEPENDENCY",message:`Cyclic dependency detected: ${m.join(" → ")}`})}s.add(l);for(const r of this.getDependencies(l))t.has(r.name)&&r.kind!=="devDependencies"&&d(r.name,[...i,l]);s.delete(l),n.add(l),c.push(l)}};for(const l of t)d(l,[]);return c}get size(){return this.packagesByName.size}}const ma=/\{(name|version|previousVersion|date|repo|contributors)\}/g,ua=(e,a)=>e.replaceAll(ma,(t,n)=>a[n]??""),fa=(e,a={})=>{const t=new Set;for(const c of a.internalAuthors??[]){const d=c.trim().toLowerCase().replace(/^@/,"");d.length>0&&t.add(d)}const n=new Set,s=[];for(const c of e){const d=c.meta?.author;if(d)for(const l of d.split(",")){const i=l.trim();if(!i)continue;const r=i.replace(/^@/,"");if(r.length===0)continue;const m=r.toLowerCase();n.has(m)||t.has(m)||(n.add(m),s.push(Ye(i)))}}return s.length===0?"":s.map(c=>`- ${c}`).join(`
-`)},ee=e=>{const{current:a,prerelease:t}=e;let{bump:n}=e;if(!x.valid(a))throw new R({code:"CONFIG_INVALID",message:`Invalid current version: ${JSON.stringify(a)}`});const s=x.parse(a),c=s.prerelease[0],d=s.prerelease.length>0;if(s.major===0&&e.bumpMinorPreMajor&&(n==="major"&&(n="minor"),n==="minor"&&e.bumpPatchForMinorPreMajor&&(n="patch")),n==="none")return(c??void 0)===(t??void 0)?a:!d&&t?`${s.major}.${s.minor}.${s.patch}-${t}.0`:d&&!t?`${s.major}.${s.minor}.${s.patch}`:d&&t?`${s.major}.${s.minor}.${s.patch}-${t}.0`:a;if(d&&t&&c===t){const i=ha(s);if(we[n]<=we[i]){const o=x.inc(a,"prerelease",t);if(!o)throw new R({code:"CONFIG_INVALID",message:`semver.inc returned null for prerelease bump on ${a}`});return o}const r=`${s.major}.${s.minor}.${s.patch}`,m=x.inc(r,n);if(!m)throw new R({code:"CONFIG_INVALID",message:`semver.inc returned null for ${n} bump on ${r}`});return`${m}-${t}.0`}if(t){const i=`${s.major}.${s.minor}.${s.patch}`,r=x.inc(i,n);if(!r)throw new R({code:"CONFIG_INVALID",message:`semver.inc returned null for ${n} bump on ${i}`});return`${r}-${t}.0`}if(d){const i=`${s.major}.${s.minor}.${s.patch}`,r=x.inc(i,n);if(!r)throw new R({code:"CONFIG_INVALID",message:`semver.inc returned null for ${n} bump on ${i}`});return r}const l=x.inc(a,n);if(!l)throw new R({code:"CONFIG_INVALID",message:`semver.inc returned null for ${n} bump on ${a}`});return l},we={major:3,minor:2,patch:1},ha=e=>e.minor===0&&e.patch===0?"major":e.patch===0?"minor":"patch",wa=(e,a)=>{const t=ke(a);return t?x.satisfies(e,t,{includePrerelease:!0}):!0},ke=e=>{if(!e||e.startsWith("catalog:")||e==="*"||e==="workspace:*"||e==="workspace:^"||e==="workspace:~")return null;if(e.startsWith("workspace:")){const a=e.slice(10);return a==="*"||a==="^"||a==="~"?null:a}if(e.startsWith("npm:")){const a=e.lastIndexOf("@");return a>4?e.slice(a+1):null}return e},re=100,G=(e,a,t,n,{isCascadeBump:s=!1,isDependencyBump:c=!1,isGroupBump:d=!1,source:l}={})=>{const i=e.get(a);if(i){const r=i.type;return i.type=oe(i.type,t),i.reasons.add(n),c&&(i.isDependencyBump=!0),d&&(i.isGroupBump=!0),s&&(i.isCascadeBump=!0),l&&i.sources.set(l.name,{bumpType:l.bumpType,newVersion:l.newVersion}),i.type!==r}return e.set(a,{isCascadeBump:s,isDependencyBump:c,isGroupBump:d,name:a,proactiveSeen:!1,reasons:new Set([n]),sources:l?new Map([[l.name,{bumpType:l.bumpType,newVersion:l.newVersion}]]):new Map,type:t}),!0},ya=(e,a,t,n)=>{const s=t?.get(e)?.dependencyBumpRules?.[a];if(s!==void 0)return s;const c=n.dependencyBumpRules?.[a];return c!==void 0?c:Oe[a]??!1},ye=(e,a)=>Q(e)>=Q(a),be=(e,a)=>a==="match"?e:a,ba=(e,a)=>a===!0?!0:Array.isArray(a)?a.includes(e):!1,$a=10,va=(e,a,t,n,s,c,d)=>{let l=!1;for(const i of e.values()){const r=a.getPackage(i.name);if(!r)continue;const m=n.currentVersions?.get(i.name)??r.version,o=t.get(i.name)??ee({bump:i.type,bumpMinorPreMajor:n.bumpMinorPreMajor,bumpPatchForMinorPreMajor:n.bumpPatchForMinorPreMajor,current:m,prerelease:n.prerelease});t.set(i.name,o);for(const p of a.getDependents(i.name)){if(p.kind==="devDependencies"){if(!ba(i.name,c.bumpDevDependencies))continue;if(G(e,p.name,"patch","DEVDEPENDENCY_BUMPED",{isDependencyBump:!0,source:{bumpType:i.type,name:i.name,newVersion:o}})&&(l=!0,t.delete(p.name)),c.bumpDevDependencies===!0){let w=d.get(i.name);w||(w=new Set,d.set(i.name,w)),w.add(p.name)}continue}const h=ke(p.range);if(h===null||wa(o,h))continue;let u,k="DEPENDENCY_OUT_OF_RANGE";p.kind==="peerDependencies"?(u=i.type==="none"?"patch":i.type,k="PEER_DEP_MATCH",h.startsWith("^0.")&&u!=="patch"&&s.push(`^0.x peer dep "${i.name}" → "${p.name}" produced a ${u} bump. Consider widening the range manually.`)):u="patch",G(e,p.name,u,k,{isDependencyBump:!0,source:{bumpType:i.type,name:i.name,newVersion:o}})&&(l=!0,t.delete(p.name))}}return l},ka=(e,a,t)=>{let n=!1;for(const s of t.fixed??[]){const c=ge(s),d=ae(c.packages,a),l=d.filter(r=>e.has(r));if(l.length===0)continue;let i="none";for(const r of l)i=oe(i,e.get(r).type);for(const r of d)a.isInternal(r)&&G(e,r,i,"FIXED_GROUP",{isGroupBump:!0})&&(n=!0)}for(const s of t.linked??[]){const c=ge(s),d=ae(c.packages,a).filter(i=>e.has(i));if(d.length===0)continue;let l="none";for(const i of d)l=oe(l,e.get(i).type);for(const i of d)G(e,i,l,"LINKED_GROUP",{isGroupBump:!0})&&(n=!0)}return n},$e=new WeakMap,Pa=/[!()*+?@[\]{|}]/,ae=(e,a)=>{let t=$e.get(a);t||(t={allNames:a.allPackages().map(s=>s.name),matched:new Map},$e.set(a,t));const n=new Set;for(const s of e){if(!Pa.test(s)){n.add(s);continue}let c=t.matched.get(s);c||(c=t.allNames.filter(d=>Z(s,d)),t.matched.set(s,c));for(const d of c)n.add(d)}return[...n]},Ca=(e,a,t,n,s,c)=>{let d=!1;const l=n.updateInternalDependencies??"out-of-range",i=r=>{const m=c.get(r.name);if(m!==void 0)return m;const o=ee({bump:r.type,bumpMinorPreMajor:s.bumpMinorPreMajor,bumpPatchForMinorPreMajor:s.bumpPatchForMinorPreMajor,current:s.currentVersions?.get(r.name)??t.getPackage(r.name).version,prerelease:s.prerelease});return c.set(r.name,o),o};for(const r of a){if("bumps"in r.payload||!r.payload.cascade)continue;const m=e.get(r.payload.package);if(!m)continue;const o=c.get(m.name)??ee({bump:m.type,bumpMinorPreMajor:s.bumpMinorPreMajor,bumpPatchForMinorPreMajor:s.bumpPatchForMinorPreMajor,current:s.currentVersions?.get(m.name)??t.getPackage(m.name).version,prerelease:s.prerelease});c.set(m.name,o);for(const[p,h]of Object.entries(r.payload.cascade))for(const u of ae([p],t))t.isInternal(u)&&G(e,u,h,"CASCADE",{isCascadeBump:!0,source:{bumpType:m.type,name:m.name,newVersion:o}})&&(d=!0)}for(const r of e.values()){const m=s.perPackageConfig?.get(r.name)?.cascadeTo;if(m)for(const[o,p]of Object.entries(m)){if(!ye(r.type,p.trigger))continue;const h=be(r.type,p.bumpAs),u=i(r);for(const k of ae([o],t))t.isInternal(k)&&G(e,k,h,"CASCADE_TO",{isCascadeBump:!0,source:{bumpType:r.type,name:r.name,newVersion:u}})&&(d=!0)}}if(l==="out-of-range")return d;for(const r of e.values())if(!r.proactiveSeen&&!(l==="minor"&&Q(r.type)<Q("minor"))){for(const m of t.getDependents(r.name)){const o=ya(m.name,m.kind,s.perPackageConfig,n);if(o===!1||!ye(r.type,o.trigger))continue;const p=be(r.type,o.bumpAs);if(p==="none")continue;const h=i(r);G(e,m.name,p,"DEPENDENCY_BUMPED",{isDependencyBump:!0,source:{bumpType:r.type,name:r.name,newVersion:h}})&&(d=!0)}r.proactiveSeen=!0}return d},Na=(e,a,t,n={})=>{const s=new Map,c=[],d=new Map;for(const[o,p]of sa(e).entries()){if(!a.isInternal(o)){c.push(`Change file references non-workspace package "${o}" — ignored.`);continue}p!=="none"&&G(s,o,p,"EXPLICIT")}for(const o of n.catalogConsumers??[]){if(!a.isInternal(o.packageName))continue;const p=`catalog:${o.catalog}/${o.dep}`;G(s,o.packageName,"patch","CATALOG_CHANGED",{isDependencyBump:!0,source:{bumpType:"patch",name:p,newVersion:o.newVersion??""}})}const l=new Map,i=o=>{const p=ue(o,e).map(u=>"releaseAs"in u.payload?{file:u.path,version:u.payload.releaseAs}:void 0).filter(u=>u!==void 0&&typeof u.version=="string"),h=new Set(p.map(u=>u.version));if(h.size>1)throw new R({code:"BUMP_FILE_INVALID",message:`Conflicting releaseAs values for ${o}: ${[...h].join(", ")}. Found in: ${p.map(u=>u.file).join(", ")}. Consolidate the change files to a single override.`,packageName:o});return p[0]?.version},r=new Map;for(const o of s.values()){if(o.type==="none")continue;const p=i(o.name);p&&(r.set(o.name,p),d.set(o.name,p))}for(let o=0;o<re;o+=1){const p=va(s,a,d,n,c,t,l),h=ka(s,a,t),u=Ca(s,e,a,t,n,d);if(!p&&!h&&!u)break;o===re-1&&c.push(`Release plan did not converge after ${re} iterations — releasing the current best plan. This usually indicates a config bug (cyclic cascade?).`)}for(const[o,p]of l){const h=p.size;h>$a&&c.push(`bumpDevDependencies: true triggered ${h} patch-cascades to distinct dependents from a single devdep bump (${o}). Consider scoping with the array form ['only', 'these', 'sources'].`)}const m=[];for(const o of s.values()){if(o.type==="none")continue;const p=a.getPackage(o.name);if(!p)continue;const h=ue(o.name,e),u=r.get(o.name),k=n.currentVersions?.get(o.name)??p.version,w=u??d.get(o.name)??ee({bump:o.type,bumpMinorPreMajor:n.bumpMinorPreMajor,bumpPatchForMinorPreMajor:n.bumpPatchForMinorPreMajor,current:k,prerelease:n.prerelease});m.push({changeFiles:h,isCascadeBump:o.isCascadeBump,isDependencyBump:o.isDependencyBump,isGroupBump:o.isGroupBump,name:o.name,newVersion:w,oldVersion:k,reasons:[...o.reasons],sources:[...o.sources.entries()].map(([$,b])=>({name:$,...b})),type:o.type})}return m.sort((o,p)=>o.name.localeCompare(p.name)),{consumedChangeFiles:e,releases:m,warnings:c}},Pe=async(e,a,t={})=>{const n=await e.listPackages(),s=[],c=new Map,d=new Map,l=o=>{try{return ze(X(o))}catch{return X(o)}},i=t.cwd===void 0?void 0:l(t.cwd),r=o=>o.replaceAll("\\","/"),m=[];for(const{manifest:o,manifestPath:p}of n){const h=ce(typeof o.name=="string"?o.name:"",o,a);if(o.napi!==void 0||h.versionActions==="native-addon"){const u=r(p.replace(/[/\\]package\.json$/i,""));m.push(`${u}/npm/`)}}for(const{manifest:o,manifestPath:p}of n){if(typeof o.name!="string"||o.name==="")continue;const h=r(p.replace(/[/\\]package\.json$/i,""));if(m.some(w=>h.startsWith(w)))continue;if(Je(o.name),d.has(o.name))throw new R({code:"DUPLICATE_PACKAGE_NAME",message:`Duplicate package name "${o.name}" — at ${d.get(o.name)} and ${p}.`,packageName:o.name});if(d.set(o.name,p),i!==void 0){const w=l(p),$=i.endsWith(K)?i:`${i}${K}`;if(w!==i&&!w.startsWith($))throw new R({code:"CONFIG_INVALID",message:`Package manifest is outside the workspace: ${p} (workspace: ${i}).`,packageName:o.name})}const u=ce(o.name,o,a);if(!Ce(o.name,o,u,a))continue;const k=p.replace(/[/\\]package\.json$/i,"");s.push({dir:k,manifest:o,manifestPath:p,name:o.name,private:o.private===!0,version:typeof o.version=="string"?o.version:"0.0.0"}),c.set(o.name,u)}return{packages:s,perPackageConfig:c}},ce=(e,a,t)=>{const n=t.packages?.[e]??{},s=a["vis-release"]??{};return{...n,...s}},Ce=(e,a,t,n)=>t.managed===!1?!1:t.managed===!0?!0:ve(e,n.ignore??[])?!1:ve(e,n.include??[])?!0:a.private===!0&&!(n.privatePackages?.version??!1)?!1:n.defaultManaged??!1,ve=(e,a)=>a.some(t=>Z(t,e)),Ne=(e,a)=>a.versionActions!==void 0?a.versionActions:e.manifest.napi!==void 0?"native-addon":e.private?"private":"npm",Ja=Object.defineProperty({__proto__:null,discoverPackages:Pe,isPackageManaged:Ce,mergePerPackageConfig:ce,resolveVersionActionsId:Ne},Symbol.toStringTag,{value:"Module"}),za=async(e={})=>{const a=e.cwd??process.cwd(),t=J(),n=await He(a),s=We(n,t),c=await s.detectVersion(a);if(c&&!Ia(c,s.minVersion))throw new R({code:"PM_VERSION_TOO_LOW",hint:`pnpm install -g ${s.id}@latest  (or your equivalent)`,message:`${s.id} version ${c} is below the required minimum ${s.minVersion}. Upgrade ${s.id} to enable release operations.`});let d={};try{const{loadVisConfig:A}=await import("../packem_shared/CONFIG_FILES-MsOntfYT.js"),C=await A(a);C.release&&(d=C.release)}catch(A){const{code:C}=A,g=A.message??"";if(!(C==="ENOENT"||C==="MODULE_NOT_FOUND"||/cannot find module/i.test(g)))throw A}const l=Aa(d,e.config??{});!l.acknowledgeUnstable&&process.env.VIS_RELEASE_SUPPRESS_UNSTABLE!=="1"&&process.stderr.write("[vis release] ⚠ This subsystem is flagged unstable. Set `release.acknowledgeUnstable: true` in vis.config.ts to suppress this warning. (RFC §21.2)\n");const i=e.channel??await la(a,t),r=i?ia(i,l.channels):void 0,m=await import("node:fs/promises"),o={listPackages:async()=>{const A=await s.listWorkspacePackages(a);return(await Promise.all(A.map(async C=>{const g=`${C.path}/package.json`;try{const y=await m.readFile(g,"utf8");return{manifest:JSON.parse(y),manifestPath:g}}catch{return}}))).filter(C=>C!==void 0)}},{packages:p,perPackageConfig:h}=await Pe(o,l,{cwd:a}),u=new ga(p),{files:k}=await oa({changesDir:l.changesDir,cwd:a}),{readPreMode:w}=await import("./pre-mode.js"),$=await w(a,l.changesDir??".vis/release");let b;$?.mode==="pre"?b=$.tag:$?.mode==="exit-pending"?b=void 0:b=r?.prerelease;const P=e.firstRelease===!0,{resolveCurrentVersionsForWorkspace:v}=await import("./version-resolver.js"),{versions:L,warnings:V}=await v(p,u,l,h,{cwd:a,firstRelease:P,pm:s,runner:t,skipRegistryLookup:e.skipRegistryLookup===!0}),T=[],N=[];if(l.detectCatalogChanges===!0)try{const{detectCatalogChanges:A,findCatalogConsumers:C,parseCatalogs:g}=await import("./catalog-detector.js"),y=await s.readCatalogYaml(a),j=g(y);let B;try{const _=await t.run("git",["show","HEAD~1:pnpm-workspace.yaml"],{cwd:a,silent:!0});_.exitCode===0&&(B=_.stdout)}catch{}const S=g(B),D=A(S,j).filter(_=>_.oldVersion!==void 0&&_.newVersion!==void 0);if(D.length>0){const _=C(p,j);for(const M of D){const I=_.get(M.catalog)?.get(M.dep)??[];for(const f of I)T.push({catalog:M.catalog,dep:M.dep,newVersion:M.newVersion,oldVersion:M.oldVersion,packageName:f.packageName})}T.length>0&&N.push(`Catalog change-detection: ${D.length} catalog dep(s) moved; ${T.length} consumer-package patch bump(s) tagged CATALOG_CHANGED.`)}}catch(A){N.push(`Catalog change-detection skipped: ${A.message}.`)}const E=Na(k,u,l,{bumpMinorPreMajor:l.bumpMinorPreMajor,bumpPatchForMinorPreMajor:l.bumpPatchForMinorPreMajor,catalogConsumers:T,currentVersions:L,perPackageConfig:h,prerelease:b});if(N.length>0&&E.warnings.push(...N),V.length>0&&E.warnings.push(...V),P&&E.warnings.push('First-release mode: currentVersionResolver forced to "disk", remote tag-collision checks skipped. Drop --first-release after the initial wave lands.'),$?.mode==="pre"&&E.warnings.push(`Pre-mode is ACTIVE (tag "${$.tag}"); every version produces a prerelease. Exit with \`vis release pre exit\` when ready to ship stable.`),$?.mode==="exit-pending"&&E.warnings.push(`Pre-mode is EXIT-PENDING (was "${$.tag}"); the next \`vis release version\` will consolidate the prerelease and delete pre.json.`),r?.overlapping&&r.overlapping.length>0&&E.warnings.push(`Branch "${i}" matches multiple channel patterns: "${r.branch}" (active) plus ${r.overlapping.map(A=>`"${A}"`).join(", ")}. Reorder channels in vis.config.ts if this is unintentional.`),e.projects&&e.projects.length>0){const{default:A}=await import("./index.js"),C=e.projects;E.releases=E.releases.filter(g=>C.some(y=>g.name===y||A(y,g.name)))}return{branch:i,channel:r?{mode:r.mode,prerelease:r.prerelease,tag:r.tag}:void 0,config:l,cwd:a,depGraph:u,firstRelease:P,packages:p,perPackageConfig:h,plan:E,pm:s,preMode:$}},Aa=(...e)=>{let a={...Be};for(const t of e)a={...a,...t};return a},Ia=(e,a)=>{const t=x.coerce(e)?.version??e;try{return x.gte(t,a)}catch{return!0}},Y=async(e,a,t)=>{if(!a||a.trim()==="")return;const n=J(),s=process.platform==="win32",c=s?"cmd":"sh",d=s?["/c",a]:["-c",a],l=await n.run(c,d,{cwd:e,silent:!1});if(l.exitCode!==0)throw new Error(`${t} failed (exit ${l.exitCode}): ${a}`)},Ae=async(e,a,t,n={})=>{const{findConflictingPendingStages:s,readStagedRegistry:c,removePendingStages:d,writeStagedRegistry:l}=await import("./staged-registry.js"),i=e.config.changesDir??q;let r=t??await c(e.cwd,i);if(r.pending.length===0)return;const m=new Map(e.plan.releases.map(w=>[w.name,w.newVersion])),o=[...m.keys()];let p=s(r,o).filter(w=>m.get(w.name)!==w.version);if(p.length===0)return;let h=[];if(!n.skipSelfHeal){const w=n.runner??J();h=(await Promise.all(p.map(async $=>{const b=await w.run("npm",["view",`${$.name}@${$.version}`,"dist.tarball","--silent"],{cwd:e.cwd,silent:!0});return b.exitCode===0&&b.stdout.trim().length>0?$.id:void 0}))).filter($=>$!==void 0)}if(h.length>0){if(r=d(r,h),n.persistSelfHeal!==!1)try{await l(e.cwd,i,r)}catch{}if(p=s(r,o).filter(w=>m.get(w.name)!==w.version),p.length===0)return}const u=p.map(w=>`  • ${w.name}@${w.version} — stage ${w.id} (${w.reason}, recorded ${w.stagedAt})`).join(`
-`),k=a==="version"?"version":"publish";throw new R({code:"STAGE_PENDING",hint:"Resolve via `vis release stage approve <id>` / `--all` or `vis release stage reject <id>`, commit the updated staged.json, then retry.",message:`Refusing to ${k} — ${p.length} package(s) have a pending stage from a prior wave:
-${u}`})},qa=async(e,a={})=>{if(e.plan.releases.length===0)return{changedFiles:[],deletedFiles:[],plan:e.plan};if(await Ae(e,"version",void 0,{persistSelfHeal:!1}),!a.dryRun&&e.config.preVersionCommand&&await Y(e.cwd,e.config.preVersionCommand,"preVersionCommand"),!a.dryRun&&e.config.groupPreVersionCommands){const{normaliseGroup:p}=await import("../release/types.js"),h=[...e.config.fixed??[],...e.config.linked??[]].map(k=>p(k)),{default:u}=await import("./index.js");for(const[k,w]of Object.entries(e.config.groupPreVersionCommands)){const $=Number.parseInt(k.replace(/^group-/,""),10),b=h[$];!b||!e.plan.releases.some(P=>b.packages.some(v=>P.name===v||u(v,P.name)))||await Y(e.cwd,w,`groupPreVersionCommand[${k}]`)}}const t=await import("node:fs/promises"),{readFileSync:n}=await import("node:fs"),{resolveFormatter:s}=await import("./resolveFormatter.js"),{resolveGroupChangelogRouting:c}=await import("./workspace.js"),d=await s(e.config.changelog,e.cwd),l=new Date().toISOString().slice(0,10),i=c(e.config,e.packages,e.cwd),r=await Le(e.plan,e.depGraph,{changelogPath:p=>i.get(p.name)??`${p.dir}/CHANGELOG.md`,readChangelog:p=>{try{return n(p,"utf8")}catch{return}},readManifest:p=>{try{return n(p,"utf8")}catch{return}},renderChangelogEntry:p=>d({changeFiles:p.changeFiles,date:l,release:p,target:"changelog"})}),m=[];{const{applyExtraFilesForRelease:p}=await import("./extra-files.js"),h=await Promise.all(e.plan.releases.map(async u=>{const k=e.depGraph.getPackage(u.name);if(!k)return{warnings:[],writes:[]};const w=e.perPackageConfig.get(u.name)?.extraFiles??[],$=e.config.publish?.extraFiles??[];return w.length===0&&$.length===0?{warnings:[],writes:[]}:p(e.cwd,k.dir,u.newVersion,u.name,$,w)}));for(const u of h){for(const k of u.writes)r.writes.push({content:k.content,path:k.path});m.push(...u.warnings)}m.length>0&&e.plan.warnings.push(...m)}if(a.dryRun)return{changedFiles:r.writes.map(p=>p.path),deletedFiles:r.deletions,plan:e.plan};await Promise.all([...r.writes.map(p=>Fe(p.path,p.content)),...r.deletions.map(async p=>{try{await _e(p)}catch{}})]);try{await e.pm.installLockfileOnly({cwd:e.cwd,silent:!0})}catch{}!a.dryRun&&e.config.formatChangedFiles&&await Ra(r.writes.map(p=>p.path),e.cwd);let o;if(a.commit){const{stageAndCommit:p}=await import("./git.js"),h=J(),u=["pnpm-lock.yaml","package-lock.json","yarn.lock","bun.lock","bun.lockb"],k=await import("node:path"),w=[];for(const b of u)try{await t.access(k.join(e.cwd,b)),w.push(k.join(e.cwd,b))}catch{}const $=e.config.aggregateRelease===!0||typeof e.config.aggregateRelease=="object"&&e.config.aggregateRelease.enabled;if(e.config.oneCommitPerPackage===!0&&!$&&e.plan.releases.length>0){const b=e.channel?.tag??e.branch??"main",P=r.writes.map(V=>V.path),v=new Set,{releases:L}=e.plan;for(let V=0;V<L.length;V+=1){const T=L[V],N=e.depGraph.getPackage(T.name),E=N?`${N.dir}${k.sep}`:void 0,A=E?P.filter(y=>y.startsWith(E)):[];for(const y of A)v.add(y);const C=V===L.length-1?[...P.filter(y=>!v.has(y)),...r.deletions,...w]:[],g=[...A,...C];g.length!==0&&(o=await p({cwd:e.cwd,runner:h},g,`release(${b}): ${T.name}@${T.newVersion} [skip ci]`,{author:e.config.gitUser}))}}else{const b=a.commitMessage??ja(e),P=[...r.writes.map(v=>v.path),...r.deletions,...w];o=await p({cwd:e.cwd,runner:h},P,b,{author:e.config.gitUser})}}if(!a.dryRun&&e.config.postVersionCommand&&await Y(e.cwd,e.config.postVersionCommand,"postVersionCommand"),!a.dryRun&&e.preMode?.mode==="exit-pending"){const{deletePreMode:p,preModeFilePath:h}=await import("./pre-mode.js"),u=e.config.changesDir??".vis/release";await p(e.cwd,u)&&e.plan.warnings.push(`Pre-mode exited: \`${h(e.cwd,u)}\` was deleted. Commit the deletion so the registry stays consistent across CI runs.`)}return{changedFiles:r.writes.map(p=>p.path),commitSha:o,deletedFiles:r.deletions,plan:e.plan}},Ra=async(e,a)=>{if(e.length===0)return;const{join:t}=await import("node:path");let n;try{const{createRequire:c}=await import("node:module"),{pathToFileURL:d}=await import("node:url"),l=c(t(a,"package.json"));n=await import(d(l.resolve("prettier")).href)}catch{return}const s=await import("node:fs/promises");for(const c of e)try{const d=await n.getFileInfo(c);if(d.ignored||!d.inferredParser)continue;const l=await s.readFile(c,"utf8"),i=await n.resolveConfig(c),r=await n.format(l,{...i,filepath:c});r!==l&&await s.writeFile(c,r)}catch{}},ja=e=>{const a=e.channel?.tag??e.branch??"main",{releases:t}=e.plan,n=t.length<=3?t.map(c=>`${c.name}@${c.newVersion}`).join(", "):`version ${t.length} packages`,s=t.map(c=>`- ${c.name}: ${c.oldVersion} → ${c.newVersion}`).join(`
+`}`},ne=e=>/^[a-z0-9-]/.test(e)?e:`"${e}"`,sa=e=>{const a=new Map,t=s=>s==="major"?3:s==="minor"?2:s==="patch"?1:0,n=(s,c)=>{const d=a.get(s);(d===void 0||t(c)>t(d))&&a.set(s,c)};for(const s of e)if("bumps"in s.payload)for(const[c,d]of Object.entries(s.payload.bumps))n(c,d);else n(s.payload.package,s.payload.bump);return a},fe=(e,a)=>a.filter(t=>"bumps"in t.payload?Object.hasOwn(t.payload.bumps,e):t.payload.package===e),ra=new Set(["README.md","readme.md"]),oa=async e=>{const a=e.changesDir??X,t=re(e.cwd),n=re(e.cwd,a),s=n,c=t.endsWith(Y)?t:`${t}${Y}`;if(n!==t&&!n.startsWith(c))throw new R({code:"CONFIG_INVALID",message:`changesDir resolves outside the workspace: ${n} (workspace: ${t}). Set release.changesDir to a path inside the repo.`});const d=[];let l;try{l=await Ee(s)}catch(r){if(r.code==="ENOENT")return{files:[],warnings:[]};throw new R({cause:r,code:"CONFIG_INVALID",message:`Cannot read change-files directory ${s}: ${r.message}`})}const o=l.filter(r=>!ra.has(r)&&r.endsWith(".md"));return{files:await Promise.all(o.map(async r=>{const m=Ue(s,r),i=await Fe(m,"utf8");return na(i,m)})),warnings:d}},ia=(e,a)=>{if(!a)return;if(Object.hasOwn(a,e)){const n=Object.keys(a).filter(s=>s!==e&&we(s)&&Q(s,e));return he(e,a[e],n)}const t=[];for(const[n]of Object.entries(a))we(n)&&Q(n,e)&&t.push(n);if(t.length>0){const[n,...s]=t;return he(e,a[n],s)}},he=(e,a,t=[])=>{let{tag:n}=a;return n==="branch-name"&&(n=ca(e)),{branch:e,mode:a.mode??"auto-publish",...t.length>0?{overlapping:t}:{},prerelease:a.prerelease,range:a.range,tag:n}},ca=e=>e.toLowerCase().replaceAll(/[^a-z0-9.-]/g,"-").replaceAll(/^-+|-+$/g,"")||"branch",pa=/[!()*+?@[\]{|}]/,we=e=>pa.test(e),la=async(e,a)=>{try{const t=await a.run("git",["rev-parse","--abbrev-ref","HEAD"],{cwd:e,silent:!0});if(t.exitCode!==0)return;const n=t.stdout.trim();return n==="HEAD"||n===""?void 0:n}catch{return}},da=["dependencies","devDependencies","peerDependencies","optionalDependencies"];class ga{dependents;dependenciesByPackage;packagesByName;constructor(a){this.dependents=new Map,this.dependenciesByPackage=new Map,this.packagesByName=new Map;for(const t of a){if(this.packagesByName.has(t.name))throw new R({code:"DUPLICATE_PACKAGE_NAME",message:`Duplicate package name "${t.name}" — found at ${this.packagesByName.get(t.name).dir} and ${t.dir}.`,packageName:t.name});this.packagesByName.set(t.name,t),this.dependents.set(t.name,[]),this.dependenciesByPackage.set(t.name,[])}for(const t of a)for(const n of da){const s=t.manifest[n];if(!(!s||typeof s!="object"))for(const[c,d]of Object.entries(s))this.packagesByName.has(c)&&(this.dependents.get(c).push({kind:n,name:t.name,range:d}),this.dependenciesByPackage.get(t.name).push({kind:n,name:c,range:d}))}}getPackage(a){return this.packagesByName.get(a)}allPackages(){return[...this.packagesByName.values()]}isInternal(a){return this.packagesByName.has(a)}getDependents(a){return this.dependents.get(a)??[]}getDependencies(a){return this.dependenciesByPackage.get(a)??[]}topologicalSort(a){const t=a?new Set(a):new Set(this.packagesByName.keys()),n=new Set,s=new Set,c=[],d=(l,o)=>{if(!n.has(l)){if(s.has(l)){const r=o.indexOf(l),m=r===-1?[...o,l]:[...o.slice(r),l];throw new R({code:"CYCLIC_DEPENDENCY",message:`Cyclic dependency detected: ${m.join(" → ")}`})}s.add(l);for(const r of this.getDependencies(l))t.has(r.name)&&r.kind!=="devDependencies"&&d(r.name,[...o,l]);s.delete(l),n.add(l),c.push(l)}};for(const l of t)d(l,[]);return c}get size(){return this.packagesByName.size}}const ma=/\{(name|version|previousVersion|date|repo|contributors)\}/g,ua=(e,a)=>e.replaceAll(ma,(t,n)=>a[n]??""),fa=(e,a={})=>{const t=new Set;for(const c of a.internalAuthors??[]){const d=c.trim().toLowerCase().replace(/^@/,"");d.length>0&&t.add(d)}const n=new Set,s=[];for(const c of e){const d=c.meta?.author;if(d)for(const l of d.split(",")){const o=l.trim();if(!o)continue;const r=o.replace(/^@/,"");if(r.length===0)continue;const m=r.toLowerCase();n.has(m)||t.has(m)||(n.add(m),s.push(Je(o)))}}return s.length===0?"":s.map(c=>`- ${c}`).join(`
+`)},Z=e=>{const{current:a,prerelease:t}=e;let{bump:n}=e;if(!x.valid(a))throw new R({code:"CONFIG_INVALID",message:`Invalid current version: ${JSON.stringify(a)}`});const s=x.parse(a),c=s.prerelease[0],d=s.prerelease.length>0;if(s.major===0&&e.bumpMinorPreMajor&&(n==="major"&&(n="minor"),n==="minor"&&e.bumpPatchForMinorPreMajor&&(n="patch")),n==="none")return(c??void 0)===(t??void 0)?a:!d&&t?`${s.major}.${s.minor}.${s.patch}-${t}.0`:d&&!t?`${s.major}.${s.minor}.${s.patch}`:d&&t?`${s.major}.${s.minor}.${s.patch}-${t}.0`:a;if(d&&t&&c===t){const o=ha(s);if(ye[n]<=ye[o]){const i=x.inc(a,"prerelease",t);if(!i)throw new R({code:"CONFIG_INVALID",message:`semver.inc returned null for prerelease bump on ${a}`});return i}const r=`${s.major}.${s.minor}.${s.patch}`,m=x.inc(r,n);if(!m)throw new R({code:"CONFIG_INVALID",message:`semver.inc returned null for ${n} bump on ${r}`});return`${m}-${t}.0`}if(t){const o=`${s.major}.${s.minor}.${s.patch}`,r=x.inc(o,n);if(!r)throw new R({code:"CONFIG_INVALID",message:`semver.inc returned null for ${n} bump on ${o}`});return`${r}-${t}.0`}if(d){const o=`${s.major}.${s.minor}.${s.patch}`,r=x.inc(o,n);if(!r)throw new R({code:"CONFIG_INVALID",message:`semver.inc returned null for ${n} bump on ${o}`});return r}const l=x.inc(a,n);if(!l)throw new R({code:"CONFIG_INVALID",message:`semver.inc returned null for ${n} bump on ${a}`});return l},ye={major:3,minor:2,patch:1},ha=e=>e.minor===0&&e.patch===0?"major":e.patch===0?"minor":"patch",wa=(e,a)=>{const t=Pe(a);return t?x.satisfies(e,t,{includePrerelease:!0}):!0},Pe=e=>{if(!e||e.startsWith("catalog:")||e==="*"||e==="workspace:*"||e==="workspace:^"||e==="workspace:~")return null;if(e.startsWith("workspace:")){const a=e.slice(10);return a==="*"||a==="^"||a==="~"?null:a}if(e.startsWith("npm:")){const a=e.lastIndexOf("@");return a>4?e.slice(a+1):null}return e},se=100,G=(e,a,t,n,{isCascadeBump:s=!1,isDependencyBump:c=!1,isGroupBump:d=!1,source:l}={})=>{const o=e.get(a);if(o){const r=o.type;return o.type=oe(o.type,t),o.reasons.add(n),c&&(o.isDependencyBump=!0),d&&(o.isGroupBump=!0),s&&(o.isCascadeBump=!0),l&&o.sources.set(l.name,{bumpType:l.bumpType,newVersion:l.newVersion}),o.type!==r}return e.set(a,{isCascadeBump:s,isDependencyBump:c,isGroupBump:d,name:a,proactiveSeen:!1,reasons:new Set([n]),sources:l?new Map([[l.name,{bumpType:l.bumpType,newVersion:l.newVersion}]]):new Map,type:t}),!0},ya=(e,a,t,n)=>{const s=t?.get(e)?.dependencyBumpRules?.[a];if(s!==void 0)return s;const c=n.dependencyBumpRules?.[a];return c!==void 0?c:Le[a]??!1},be=(e,a)=>K(e)>=K(a),ve=(e,a)=>a==="match"?e:a,ba=(e,a)=>a===!0?!0:Array.isArray(a)?a.includes(e):!1,va=10,$a=(e,a,t,n,s,c,d)=>{let l=!1;for(const o of e.values()){const r=a.getPackage(o.name);if(!r)continue;const m=n.currentVersions?.get(o.name)??r.version,i=t.get(o.name)??Z({bump:o.type,bumpMinorPreMajor:n.bumpMinorPreMajor,bumpPatchForMinorPreMajor:n.bumpPatchForMinorPreMajor,current:m,prerelease:n.prerelease});t.set(o.name,i);for(const p of a.getDependents(o.name)){if(p.kind==="devDependencies"){if(!ba(o.name,c.bumpDevDependencies))continue;if(G(e,p.name,"patch","DEVDEPENDENCY_BUMPED",{isDependencyBump:!0,source:{bumpType:o.type,name:o.name,newVersion:i}})&&(l=!0,t.delete(p.name)),c.bumpDevDependencies===!0){let w=d.get(o.name);w||(w=new Set,d.set(o.name,w)),w.add(p.name)}continue}const h=Pe(p.range);if(h===null||wa(i,h))continue;let u,P="DEPENDENCY_OUT_OF_RANGE";p.kind==="peerDependencies"?(u=o.type==="none"?"patch":o.type,P="PEER_DEP_MATCH",h.startsWith("^0.")&&u!=="patch"&&s.push(`^0.x peer dep "${o.name}" → "${p.name}" produced a ${u} bump. Consider widening the range manually.`)):u="patch",G(e,p.name,u,P,{isDependencyBump:!0,source:{bumpType:o.type,name:o.name,newVersion:i}})&&(l=!0,t.delete(p.name))}}return l},ka=(e,a,t)=>{let n=!1;for(const s of t.fixed??[]){const c=ge(s),d=ee(c.packages,a),l=d.filter(r=>e.has(r));if(l.length===0)continue;let o="none";for(const r of l)o=oe(o,e.get(r).type);for(const r of d)a.isInternal(r)&&G(e,r,o,"FIXED_GROUP",{isGroupBump:!0})&&(n=!0)}for(const s of t.linked??[]){const c=ge(s),d=ee(c.packages,a).filter(o=>e.has(o));if(d.length===0)continue;let l="none";for(const o of d)l=oe(l,e.get(o).type);for(const o of d)G(e,o,l,"LINKED_GROUP",{isGroupBump:!0})&&(n=!0)}return n},$e=new WeakMap,Pa=/[!()*+?@[\]{|}]/,ee=(e,a)=>{let t=$e.get(a);t||(t={allNames:a.allPackages().map(s=>s.name),matched:new Map},$e.set(a,t));const n=new Set;for(const s of e){if(!Pa.test(s)){n.add(s);continue}let c=t.matched.get(s);c||(c=t.allNames.filter(d=>Q(s,d)),t.matched.set(s,c));for(const d of c)n.add(d)}return[...n]},Ca=(e,a,t,n,s,c)=>{let d=!1;const l=n.updateInternalDependencies??"out-of-range",o=r=>{const m=c.get(r.name);if(m!==void 0)return m;const i=Z({bump:r.type,bumpMinorPreMajor:s.bumpMinorPreMajor,bumpPatchForMinorPreMajor:s.bumpPatchForMinorPreMajor,current:s.currentVersions?.get(r.name)??t.getPackage(r.name).version,prerelease:s.prerelease});return c.set(r.name,i),i};for(const r of a){if("bumps"in r.payload||!r.payload.cascade)continue;const m=e.get(r.payload.package);if(!m)continue;const i=c.get(m.name)??Z({bump:m.type,bumpMinorPreMajor:s.bumpMinorPreMajor,bumpPatchForMinorPreMajor:s.bumpPatchForMinorPreMajor,current:s.currentVersions?.get(m.name)??t.getPackage(m.name).version,prerelease:s.prerelease});c.set(m.name,i);for(const[p,h]of Object.entries(r.payload.cascade))for(const u of ee([p],t))t.isInternal(u)&&G(e,u,h,"CASCADE",{isCascadeBump:!0,source:{bumpType:m.type,name:m.name,newVersion:i}})&&(d=!0)}for(const r of e.values()){const m=s.perPackageConfig?.get(r.name)?.cascadeTo;if(m)for(const[i,p]of Object.entries(m)){if(!be(r.type,p.trigger))continue;const h=ve(r.type,p.bumpAs),u=o(r);for(const P of ee([i],t))t.isInternal(P)&&G(e,P,h,"CASCADE_TO",{isCascadeBump:!0,source:{bumpType:r.type,name:r.name,newVersion:u}})&&(d=!0)}}if(l==="out-of-range")return d;for(const r of e.values())if(!r.proactiveSeen&&!(l==="minor"&&K(r.type)<K("minor"))){for(const m of t.getDependents(r.name)){const i=ya(m.name,m.kind,s.perPackageConfig,n);if(i===!1||!be(r.type,i.trigger))continue;const p=ve(r.type,i.bumpAs);if(p==="none")continue;const h=o(r);G(e,m.name,p,"DEPENDENCY_BUMPED",{isDependencyBump:!0,source:{bumpType:r.type,name:r.name,newVersion:h}})&&(d=!0)}r.proactiveSeen=!0}return d},Na=(e,a,t,n={})=>{const s=new Map,c=[],d=new Map;for(const[i,p]of sa(e).entries()){if(!a.isInternal(i)){c.push(`Change file references non-workspace package "${i}" — ignored.`);continue}p!=="none"&&G(s,i,p,"EXPLICIT")}for(const i of n.catalogConsumers??[]){if(!a.isInternal(i.packageName))continue;const p=`catalog:${i.catalog}/${i.dep}`;G(s,i.packageName,"patch","CATALOG_CHANGED",{isDependencyBump:!0,source:{bumpType:"patch",name:p,newVersion:i.newVersion??""}})}const l=new Map,o=i=>{const p=fe(i,e).map(u=>"releaseAs"in u.payload?{file:u.path,version:u.payload.releaseAs}:void 0).filter(u=>u!==void 0&&typeof u.version=="string"),h=new Set(p.map(u=>u.version));if(h.size>1)throw new R({code:"BUMP_FILE_INVALID",message:`Conflicting releaseAs values for ${i}: ${[...h].join(", ")}. Found in: ${p.map(u=>u.file).join(", ")}. Consolidate the change files to a single override.`,packageName:i});return p[0]?.version},r=new Map;for(const i of s.values()){if(i.type==="none")continue;const p=o(i.name);p&&(r.set(i.name,p),d.set(i.name,p))}for(let i=0;i<se;i+=1){const p=$a(s,a,d,n,c,t,l),h=ka(s,a,t),u=Ca(s,e,a,t,n,d);if(!p&&!h&&!u)break;i===se-1&&c.push(`Release plan did not converge after ${se} iterations — releasing the current best plan. This usually indicates a config bug (cyclic cascade?).`)}for(const[i,p]of l){const h=p.size;h>va&&c.push(`bumpDevDependencies: true triggered ${h} patch-cascades to distinct dependents from a single devdep bump (${i}). Consider scoping with the array form ['only', 'these', 'sources'].`)}const m=[];for(const i of s.values()){if(i.type==="none")continue;const p=a.getPackage(i.name);if(!p)continue;const h=fe(i.name,e),u=r.get(i.name),P=n.currentVersions?.get(i.name)??p.version,w=u??d.get(i.name)??Z({bump:i.type,bumpMinorPreMajor:n.bumpMinorPreMajor,bumpPatchForMinorPreMajor:n.bumpPatchForMinorPreMajor,current:P,prerelease:n.prerelease});m.push({changeFiles:h,isCascadeBump:i.isCascadeBump,isDependencyBump:i.isDependencyBump,isGroupBump:i.isGroupBump,name:i.name,newVersion:w,oldVersion:P,reasons:[...i.reasons],sources:[...i.sources.entries()].map(([$,y])=>({name:$,...y})),type:i.type})}return m.sort((i,p)=>i.name.localeCompare(p.name)),{consumedChangeFiles:e,releases:m,warnings:c}},Ce=async(e,a,t={})=>{const n=await e.listPackages(),s=[],c=new Map,d=new Map,l=i=>{const p=re(i);try{return me.native(p)}catch{try{return me(p)}catch{return p}}},o=t.cwd===void 0?void 0:l(t.cwd),r=i=>i.replaceAll("\\","/"),m=[];for(const{manifest:i,manifestPath:p}of n){const h=ce(typeof i.name=="string"?i.name:"",i,a);if(i.napi!==void 0||h.versionActions==="native-addon"){const u=r(p.replace(/[/\\]package\.json$/i,""));m.push(`${u}/npm/`)}}for(const{manifest:i,manifestPath:p}of n){if(typeof i.name!="string"||i.name==="")continue;const h=r(p.replace(/[/\\]package\.json$/i,""));if(m.some(w=>h.startsWith(w)))continue;if(ze(i.name),d.has(i.name))throw new R({code:"DUPLICATE_PACKAGE_NAME",message:`Duplicate package name "${i.name}" — at ${d.get(i.name)} and ${p}.`,packageName:i.name});if(d.set(i.name,p),o!==void 0){const w=l(p),$=o.endsWith(Y)?o:`${o}${Y}`,y=b=>Y==="\\"?b.toLowerCase():b,k=y(w);if(k!==y(o)&&!k.startsWith(y($)))throw new R({code:"CONFIG_INVALID",message:`Package manifest is outside the workspace: ${p} (workspace: ${o}).`,packageName:i.name})}const u=ce(i.name,i,a);if(!Ne(i.name,i,u,a))continue;const P=p.replace(/[/\\]package\.json$/i,"");s.push({dir:P,manifest:i,manifestPath:p,name:i.name,private:i.private===!0,version:typeof i.version=="string"?i.version:"0.0.0"}),c.set(i.name,u)}return{packages:s,perPackageConfig:c}},ce=(e,a,t)=>{const n=t.packages?.[e]??{},s=a["vis-release"]??{};return{...n,...s}},Ne=(e,a,t,n)=>t.managed===!1?!1:t.managed===!0?!0:ke(e,n.ignore??[])?!1:ke(e,n.include??[])?!0:a.private===!0&&!(n.privatePackages?.version??!1)?!1:n.defaultManaged??!1,ke=(e,a)=>a.some(t=>Q(t,e)),Ae=(e,a)=>a.versionActions!==void 0?a.versionActions:e.manifest.napi!==void 0?"native-addon":e.private?"private":"npm",Ja=Object.defineProperty({__proto__:null,discoverPackages:Ce,isPackageManaged:Ne,mergePerPackageConfig:ce,resolveVersionActionsId:Ae},Symbol.toStringTag,{value:"Module"}),za=async(e={})=>{const a=e.cwd??process.cwd(),t=z(),n=await We(a),s=Ye(n,t),c=await s.detectVersion(a);if(c&&!Ia(c,s.minVersion))throw new R({code:"PM_VERSION_TOO_LOW",hint:`pnpm install -g ${s.id}@latest  (or your equivalent)`,message:`${s.id} version ${c} is below the required minimum ${s.minVersion}. Upgrade ${s.id} to enable release operations.`});let d={};try{const{loadVisConfig:A}=await import("./CONFIG_FILES.js"),C=await A(a);C.release&&(d=C.release)}catch(A){const{code:C}=A,g=A.message??"";if(!(C==="ENOENT"||C==="MODULE_NOT_FOUND"||/cannot find module/i.test(g)))throw A}const l=Aa(d,e.config??{});!l.acknowledgeUnstable&&process.env.VIS_RELEASE_SUPPRESS_UNSTABLE!=="1"&&process.stderr.write("[vis release] ⚠ This subsystem is flagged unstable. Set `release.acknowledgeUnstable: true` in vis.config.ts to suppress this warning. (RFC §21.2)\n");const o=e.channel??await la(a,t),r=o?ia(o,l.channels):void 0,m=await import("node:fs/promises"),i={listPackages:async()=>{const A=await s.listWorkspacePackages(a);return(await Promise.all(A.map(async C=>{const g=`${C.path}/package.json`;try{const v=await m.readFile(g,"utf8");return{manifest:JSON.parse(v),manifestPath:g}}catch{return}}))).filter(C=>C!==void 0)}},{packages:p,perPackageConfig:h}=await Ce(i,l,{cwd:a}),u=new ga(p),{files:P}=await oa({changesDir:l.changesDir,cwd:a}),{readPreMode:w}=await import("./pre-mode.js"),$=await w(a,l.changesDir??".vis/release");let y;$?.mode==="pre"?y=$.tag:$?.mode==="exit-pending"?y=void 0:y=r?.prerelease;const k=e.firstRelease===!0,{resolveCurrentVersionsForWorkspace:b}=await import("./version-resolver.js"),{versions:B,warnings:V}=await b(p,u,l,h,{cwd:a,firstRelease:k,pm:s,runner:t,skipRegistryLookup:e.skipRegistryLookup===!0}),T=[],N=[];if(l.detectCatalogChanges===!0)try{const{detectCatalogChanges:A,findCatalogConsumers:C,parseCatalogs:g}=await import("./catalog-detector.js"),v=await s.readCatalogYaml(a),j=g(v);let L;try{const _=await t.run("git",["show","HEAD~1:pnpm-workspace.yaml"],{cwd:a,silent:!0});_.exitCode===0&&(L=_.stdout)}catch{}const S=g(L),D=A(S,j).filter(_=>_.oldVersion!==void 0&&_.newVersion!==void 0);if(D.length>0){const _=C(p,j);for(const M of D){const I=_.get(M.catalog)?.get(M.dep)??[];for(const f of I)T.push({catalog:M.catalog,dep:M.dep,newVersion:M.newVersion,oldVersion:M.oldVersion,packageName:f.packageName})}T.length>0&&N.push(`Catalog change-detection: ${D.length} catalog dep(s) moved; ${T.length} consumer-package patch bump(s) tagged CATALOG_CHANGED.`)}}catch(A){N.push(`Catalog change-detection skipped: ${A.message}.`)}const E=Na(P,u,l,{bumpMinorPreMajor:l.bumpMinorPreMajor,bumpPatchForMinorPreMajor:l.bumpPatchForMinorPreMajor,catalogConsumers:T,currentVersions:B,perPackageConfig:h,prerelease:y});if(N.length>0&&E.warnings.push(...N),V.length>0&&E.warnings.push(...V),k&&E.warnings.push('First-release mode: currentVersionResolver forced to "disk", remote tag-collision checks skipped. Drop --first-release after the initial wave lands.'),$?.mode==="pre"&&E.warnings.push(`Pre-mode is ACTIVE (tag "${$.tag}"); every version produces a prerelease. Exit with \`vis release pre exit\` when ready to ship stable.`),$?.mode==="exit-pending"&&E.warnings.push(`Pre-mode is EXIT-PENDING (was "${$.tag}"); the next \`vis release version\` will consolidate the prerelease and delete pre.json.`),r?.overlapping&&r.overlapping.length>0&&E.warnings.push(`Branch "${o}" matches multiple channel patterns: "${r.branch}" (active) plus ${r.overlapping.map(A=>`"${A}"`).join(", ")}. Reorder channels in vis.config.ts if this is unintentional.`),e.projects&&e.projects.length>0){const{default:A}=await import("./index.js"),C=e.projects;E.releases=E.releases.filter(g=>C.some(v=>g.name===v||A(v,g.name)))}return{branch:o,channel:r?{mode:r.mode,prerelease:r.prerelease,tag:r.tag}:void 0,config:l,cwd:a,depGraph:u,firstRelease:k,packages:p,perPackageConfig:h,plan:E,pm:s,preMode:$}},Aa=(...e)=>{let a={...Be};for(const t of e)a={...a,...t};return a},Ia=(e,a)=>{const t=x.coerce(e)?.version??e;try{return x.gte(t,a)}catch{return!0}},J=async(e,a,t)=>{if(!a||a.trim()==="")return;const n=z(),s=process.platform==="win32",c=s?"cmd":"sh",d=s?["/c",a]:["-c",a],l=await n.run(c,d,{cwd:e,silent:!1});if(l.exitCode!==0)throw new Error(`${t} failed (exit ${l.exitCode}): ${a}`)},Ie=async(e,a,t,n={})=>{const{findConflictingPendingStages:s,readStagedRegistry:c,removePendingStages:d,writeStagedRegistry:l}=await import("./staged-registry.js"),o=e.config.changesDir??X;let r=t??await c(e.cwd,o);if(r.pending.length===0)return;const m=new Map(e.plan.releases.map(w=>[w.name,w.newVersion])),i=[...m.keys()];let p=s(r,i).filter(w=>m.get(w.name)!==w.version);if(p.length===0)return;let h=[];if(!n.skipSelfHeal){const w=n.runner??z();h=(await Promise.all(p.map(async $=>{const y=await w.run("npm",["view",`${$.name}@${$.version}`,"dist.tarball","--silent"],{cwd:e.cwd,silent:!0});return y.exitCode===0&&y.stdout.trim().length>0?$.id:void 0}))).filter($=>$!==void 0)}if(h.length>0){if(r=d(r,h),n.persistSelfHeal!==!1)try{await l(e.cwd,o,r)}catch{}if(p=s(r,i).filter(w=>m.get(w.name)!==w.version),p.length===0)return}const u=p.map(w=>`  • ${w.name}@${w.version} — stage ${w.id} (${w.reason}, recorded ${w.stagedAt})`).join(`
+`),P=a==="version"?"version":"publish";throw new R({code:"STAGE_PENDING",hint:"Resolve via `vis release stage approve <id>` / `--all` or `vis release stage reject <id>`, commit the updated staged.json, then retry.",message:`Refusing to ${P} — ${p.length} package(s) have a pending stage from a prior wave:
+${u}`})},qa=async(e,a={})=>{if(e.plan.releases.length===0)return{changedFiles:[],deletedFiles:[],plan:e.plan};if(await Ie(e,"version",void 0,{persistSelfHeal:!1}),!a.dryRun&&e.config.preVersionCommand&&await J(e.cwd,e.config.preVersionCommand,"preVersionCommand"),!a.dryRun&&e.config.groupPreVersionCommands){const{normaliseGroup:p}=await import("../release/types.js"),h=[...e.config.fixed??[],...e.config.linked??[]].map(P=>p(P)),{default:u}=await import("./index.js");for(const[P,w]of Object.entries(e.config.groupPreVersionCommands)){const $=Number.parseInt(P.replace(/^group-/,""),10),y=h[$];!y||!e.plan.releases.some(k=>y.packages.some(b=>k.name===b||u(b,k.name)))||await J(e.cwd,w,`groupPreVersionCommand[${P}]`)}}const t=await import("node:fs/promises"),{readFileSync:n}=await import("node:fs"),{resolveFormatter:s}=await import("./resolveFormatter.js"),{resolveGroupChangelogRouting:c}=await import("./workspace.js"),d=await s(e.config.changelog,e.cwd),l=new Date().toISOString().slice(0,10),o=c(e.config,e.packages,e.cwd),r=await Te(e.plan,e.depGraph,{changelogPath:p=>o.get(p.name)??`${p.dir}/CHANGELOG.md`,readChangelog:p=>{try{return n(p,"utf8")}catch{return}},readManifest:p=>{try{return n(p,"utf8")}catch{return}},renderChangelogEntry:p=>d({changeFiles:p.changeFiles,date:l,release:p,target:"changelog"})}),m=[];{const{applyExtraFilesForRelease:p}=await import("./extra-files.js"),h=await Promise.all(e.plan.releases.map(async u=>{const P=e.depGraph.getPackage(u.name);if(!P)return{warnings:[],writes:[]};const w=e.perPackageConfig.get(u.name)?.extraFiles??[],$=e.config.publish?.extraFiles??[];return w.length===0&&$.length===0?{warnings:[],writes:[]}:p(e.cwd,P.dir,u.newVersion,u.name,$,w)}));for(const u of h){for(const P of u.writes)r.writes.push({content:P.content,path:P.path});m.push(...u.warnings)}m.length>0&&e.plan.warnings.push(...m)}if(a.dryRun)return{changedFiles:r.writes.map(p=>p.path),deletedFiles:r.deletions,plan:e.plan};await Promise.all([...r.writes.map(p=>_e(p.path,p.content)),...r.deletions.map(async p=>{try{await Oe(p)}catch{}})]);try{await e.pm.installLockfileOnly({cwd:e.cwd,silent:!0})}catch{}!a.dryRun&&e.config.formatChangedFiles&&await Ra(r.writes.map(p=>p.path),e.cwd);let i;if(a.commit){const{stageAndCommit:p}=await import("./git.js"),h=z(),u=["pnpm-lock.yaml","package-lock.json","yarn.lock","bun.lock","bun.lockb"],P=await import("node:path"),w=[];for(const y of u)try{await t.access(P.join(e.cwd,y)),w.push(P.join(e.cwd,y))}catch{}const $=e.config.aggregateRelease===!0||typeof e.config.aggregateRelease=="object"&&e.config.aggregateRelease.enabled;if(e.config.oneCommitPerPackage===!0&&!$&&e.plan.releases.length>0){const y=e.channel?.tag??e.branch??"main",k=r.writes.map(V=>V.path),b=new Set,{releases:B}=e.plan;for(let V=0;V<B.length;V+=1){const T=B[V],N=e.depGraph.getPackage(T.name),E=N?`${N.dir}${P.sep}`:void 0,A=E?k.filter(v=>v.startsWith(E)):[];for(const v of A)b.add(v);const C=V===B.length-1?[...k.filter(v=>!b.has(v)),...r.deletions,...w]:[],g=[...A,...C];g.length!==0&&(i=await p({cwd:e.cwd,runner:h},g,`release(${y}): ${T.name}@${T.newVersion} [skip ci]`,{author:e.config.gitUser}))}}else{const y=a.commitMessage??ja(e),k=[...r.writes.map(b=>b.path),...r.deletions,...w];i=await p({cwd:e.cwd,runner:h},k,y,{author:e.config.gitUser})}}if(!a.dryRun&&e.config.postVersionCommand&&await J(e.cwd,e.config.postVersionCommand,"postVersionCommand"),!a.dryRun&&e.preMode?.mode==="exit-pending"){const{deletePreMode:p,preModeFilePath:h}=await import("./pre-mode.js"),u=e.config.changesDir??".vis/release";await p(e.cwd,u)&&e.plan.warnings.push(`Pre-mode exited: \`${h(e.cwd,u)}\` was deleted. Commit the deletion so the registry stays consistent across CI runs.`)}return{changedFiles:r.writes.map(p=>p.path),commitSha:i,deletedFiles:r.deletions,plan:e.plan}},Ra=async(e,a)=>{if(e.length===0)return;const{join:t}=await import("node:path");let n;try{const{createRequire:c}=await import("node:module"),{pathToFileURL:d}=await import("node:url"),l=c(t(a,"package.json"));n=await import(d(l.resolve("prettier")).href)}catch{return}const s=await import("node:fs/promises");for(const c of e)try{const d=await n.getFileInfo(c);if(d.ignored||!d.inferredParser)continue;const l=await s.readFile(c,"utf8"),o=await n.resolveConfig(c),r=await n.format(l,{...o,filepath:c});r!==l&&await s.writeFile(c,r)}catch{}},ja=e=>{const a=e.channel?.tag??e.branch??"main",{releases:t}=e.plan,n=t.length<=3?t.map(c=>`${c.name}@${c.newVersion}`).join(", "):`version ${t.length} packages`,s=t.map(c=>`- ${c.name}: ${c.oldVersion} → ${c.newVersion}`).join(`
 `);return`release(${a}): ${n} [skip ci]
 
-${s}`},Xa=async(e,a={})=>{const t={failed:[],published:[],skipped:[],tags:[],tagsPushed:!1},n=J();if(e.plan.releases.length===0)return t;if(!a.dryRun&&e.channel?.mode==="version-pr"){const{createRemoteClient:i,detectRemoteProvider:r}=await import("./detect2.js"),m=await r(e.cwd,n,e.config.provider),o=await i(m,{githubHost:e.config.githubHost,gitlabHost:e.config.gitlabHost,httpProxy:e.config.httpProxy}).detectRepoSlug(e.cwd,n),p=e.config.versionPr?.branch??"vis-release/version-packages";if(o)try{const h=await n.run("gh",["pr","list","--head",p,"--state","open","--json","number"],{cwd:e.cwd,silent:!0});if(h.exitCode===0&&h.stdout.trim()&&h.stdout.trim()!=="[]"){const u=JSON.parse(h.stdout);if(u[0])return t.failed.push({name:"_preflight",reason:`Open release PR #${u[0].number} exists. Merge or close it before publishing locally. (Override: --no-push then \`git push --tags\` manually.)`}),t}}catch{}}if(!a.dryRun&&e.config.prePublishCommand)try{await Y(e.cwd,e.config.prePublishCommand,"prePublishCommand")}catch(i){return t.failed.push({name:"_prePublishCommand",reason:i.message}),t}const s=e.config.changesDir??q,{acquireLock:c,releaseLock:d}=await import("./state.js");let l=!1;if(!a.dryRun)try{await c(e.cwd,s),l=!0}catch(i){return t.failed.push({name:"_lock",reason:i.message}),t}try{const{clearState:i,filterPlanByState:r,newState:m,readState:o,writeState:p}=await import("./state.js"),{readStagedRegistry:h,removePendingStages:u,upsertPendingStages:k,writeStagedRegistry:w}=await import("./staged-registry.js"),$=e.config.changesDir??q;let b=a.resume?await o(e.cwd,$):void 0,P=await h(e.cwd,$);await Ae(e,"publish",P,{runner:n}),P=await h(e.cwd,$);const v={pending:[...P.pending]};let{releases:L}=e.plan;b?L=r(L,b):(b=m(e.channel?.tag,e.plan.releases),a.dryRun||await p(e.cwd,$,b));const V=await e.pm.readCatalogYaml(e.cwd),T=Te(V),N=e.depGraph.topologicalSort(L.map(g=>g.name)),E=new Map(L.map(g=>[g.name,g])),A=new Set,C=new Map;for(const g of e.plan.releases){const y=e.depGraph.getPackage(g.name);y&&C.set(g.name,{...y.manifest,version:g.newVersion})}for(const g of N){const y=E.get(g);if(!y){t.skipped.push({name:g,reason:"topo-sort returned a name not in the release plan (internal bug)"});continue}const j=e.depGraph.getPackage(g);if(!j)continue;const B=[...new Set(e.depGraph.getDependencies(g).filter(f=>f.kind!=="devDependencies"&&A.has(f.name)).map(f=>f.name))];if(B.length>0){t.skipped.push({name:g,reason:`dependency-failed: not published because ${B.join(", ")} failed to publish (publishing would orphan this package's dependency range)`}),A.add(g);continue}const S=e.perPackageConfig.get(g)??{},D=Ne(j,S),_=a.publishActionsOverride??xe(D),M=a.tag??e.channel?.tag,I=P.pending.find(f=>f.name===g&&f.version===y.newVersion);try{const f=await _.publish({catalogs:T,cleanPackageJsonConfig:e.config.publish?.cleanPackageJson,dryRun:a.dryRun,otp:a.otp,perPackageConfig:S,pkg:j,pm:e.pm,provenance:Ea(e),registry:S.registry,release:y,resumeStageId:I?.id,tag:M,versionedManifestByName:C,workspaceConfig:e.config});if(f.published||f.alreadyPublished){const O=P.pending.filter(F=>F.name===g&&F.version===y.newVersion).map(F=>F.id);O.length>0&&(P=u(P,O))}if(f.published)t.published.push({name:g,stageId:f.stageId,tarball:f.tarball,version:y.newVersion}),b.published.push(`${g}@${y.newVersion}`);else if(f.alreadyPublished)t.skipped.push({name:g,reason:"already-published"}),b.published.push(`${g}@${y.newVersion}`);else if(t.skipped.push({name:g,reason:f.output??"skipped"}),f.stageId){const O=(f.output??"").startsWith("stage-rejected")?"rejected":"timeout";P=k(P,[{id:f.stageId,name:g,reason:O,stagedAt:new Date().toISOString(),tag:M??"latest",version:y.newVersion}])}a.dryRun||await p(e.cwd,$,b)}catch(f){t.failed.push({name:g,reason:f.message}),A.add(g)}}if(!a.dryRun&&!a.noTag&&t.published.length>0){const{createOrUpdateFloatingTag:g,createTag:y,defaultTagFor:j,pushTags:B,renderTagPattern:S}=await import("./git.js"),D=e.config.releaseTagPattern,_=e.channel?.tag,M=e.config.floatingMajorTag===!0,I=!!e.channel?.prerelease||!!e.preMode;for(const{name:f,version:O}of t.published){const F=e.perPackageConfig.get(f)?.releaseTagPattern??D,U=F?S(F,{channel:_,name:f,version:O}):j(f,O);try{await y({cwd:e.cwd,runner:n},U,`Release ${f}@${O}`,{signing:e.config.signing,skipRemoteCheck:e.firstRelease}),t.tags.push(U)}catch(H){e.firstRelease&&H instanceof R&&H.code==="TAG_COLLISION"?t.skipped.push({name:U,reason:"tag-creation: tag already exists (first-release — skipped)"}):t.skipped.push({name:U,reason:`tag-creation: ${H.message}`})}const z=e.depGraph.getPackage(f),Ie=e.perPackageConfig.get(f),Re=z?.manifest?.private===!0,je=Ie?.skipNpmPublish===!0;if(M&&!I&&!F?.includes("{major}")&&!Re&&!je){const H=O.split(/[-+]/,1)[0].split(".")[0];if(H!==void 0&&H!==""){const de=f.replace(/^@/,"").replaceAll("/","-");if(de!==""){const te=`${de}-v${H}`;try{await g({cwd:e.cwd,runner:n},te,{push:!a.noPush,signing:e.config.signing}),t.tags.push(te)}catch(Me){t.skipped.push({name:te,reason:`floating-major-tag: ${Me.message}`})}}}}}if(!a.noPush&&t.tags.length>0)try{await B({cwd:e.cwd,runner:n}),t.tagsPushed=!0}catch(f){t.tagsPushed=!1,t.failed.push({name:"_pushTags",reason:`git push --tags failed: ${f.message}. Retry with: git push --tags`})}b.tagged=[...t.tags],b.pushed=t.tagsPushed,a.dryRun||await p(e.cwd,$,b),t.failed.length===0&&t.published.length>0&&!a.dryRun&&await i(e.cwd,$)}if(!a.dryRun){const g=v.pending.length,y=P.pending.length,j=await w(e.cwd,$,P);if(j.changed){const{stageAndCommitFile:B}=await import("./git.js");let S;if(j.removed)S="chore(release): clear pending stage registry [skip ci]";else if(y>g){const D=y-g;S=`chore(release): record ${D} new pending stage${D===1?"":"s"} [skip ci]`}else if(y<g){const D=g-y;S=`chore(release): drain ${D} resolved stage${D===1?"":"s"} [skip ci]`}else S=`chore(release): update pending stage registry (${y} pending) [skip ci]`;try{await B({cwd:e.cwd,runner:n},j.path,S,{author:e.config.gitUser,push:!a.noPush,sign:e.config.gitSignCommits===!0})}catch(D){process.stderr.write(`[vis release] Warning: could not commit ${j.path}: ${D.message}
-`)}}}if(!a.dryRun&&t.published.length>0&&e.config.workspaceChangelog!==!1){const g=e.config.workspaceChangelog,y=typeof g=="object"?g:void 0,j=typeof e.config.aggregateRelease=="object"?e.config.aggregateRelease.enabled:e.config.aggregateRelease===!0;if(y!==void 0||j)try{const{writeWorkspaceChangelogWave:B}=await import("./workspace.js"),S=new Set(t.published.map(M=>M.name)),D=e.plan.releases.filter(M=>S.has(M.name)),_=await B({changelogConfig:e.config.changelog,cwd:e.cwd,workspaceChangelog:e.config.workspaceChangelog},D);if(_)try{const{stageAndCommitFile:M}=await import("./git.js");await M({cwd:e.cwd,runner:n},_,"chore(release): record wave [skip ci]",{author:e.config.gitUser,push:!a.noPush,sign:e.config.gitSignCommits===!0})}catch(M){process.stderr.write(`[vis release] Warning: could not commit workspace CHANGELOG.md: ${M.message}
-`)}}catch(B){process.stderr.write(`[vis release] Warning: could not write workspace CHANGELOG.md wave entry: ${B.message}
-`)}}if(!a.dryRun&&t.published.length>0&&t.tagsPushed){e.config.publish?.noRelease!==!0&&await Va(e,t,n);try{const{walkSuccessfulRelease:g}=await import("./success-walk.js"),{createRemoteClient:y,detectRemoteProvider:j}=await import("./detect2.js"),{resolveFormatter:B}=await import("./resolveFormatter.js"),S=await j(e.cwd,n,e.config.provider),D=y(S,{githubHost:e.config.githubHost,gitlabHost:e.config.gitlabHost,httpProxy:e.config.httpProxy}),_=await D.detectRepoSlug(e.cwd,n),M=await B(e.config.changelog,e.cwd),{recordRecentlyWalked:I}=await import("./staged-registry.js"),f=new Set([...b.walked??[],...(P.recentlyWalked??[]).map(F=>F.key)]),O={...t,published:t.published.filter(F=>!f.has(`${F.name}@${F.version}`))};if(O.published.length>0){const F=await g(e,O,n,{client:D,formatter:M,repo:_}),U=O.published.map(z=>`${z.name}@${z.version}`);b.walked=[...b.walked??[],...U],await p(e.cwd,$,b),P=I(P,U),F.warnings.length>0&&e.plan.warnings.push(...F.warnings)}}catch(g){e.plan.warnings.push(`successWalk: could not run post-release walk: ${g.message}`)}if(e.config.notifications)try{const{dispatchNotifications:g}=await import("./interface.js"),{createRemoteClient:y,detectRemoteProvider:j}=await import("./detect2.js"),B=await j(e.cwd,n,e.config.provider),S=await y(B,{githubHost:e.config.githubHost,gitlabHost:e.config.gitlabHost,httpProxy:e.config.httpProxy}).detectRepoSlug(e.cwd,n);let D;try{const I=`${e.cwd}/package.json`,f=await import("node:fs/promises");D=JSON.parse(await f.readFile(I,"utf8")).name}catch{}const _=new Set([...b.notified??[],...(P.recentlyNotified??[]).map(I=>I.key)]),M=t.published.filter(I=>!_.has(`${I.name}@${I.version}`));if(M.length>0){const I=await g(e.config.notifications,{channel:e.channel?.tag,completedAt:new Date().toISOString(),...D===void 0?{}:{monorepoName:D},published:M.map(f=>({name:f.name,tag:e.channel?.tag,...f.url===void 0?{}:{url:f.url},version:f.version})),...S===void 0?{}:{repo:S},skipped:t.skipped.map(f=>({name:f.name,reason:f.reason}))},{warn:f=>e.plan.warnings.push(f)});if(I.succeeded.length>0){const f=M.map(F=>`${F.name}@${F.version}`);b.notified=[...b.notified??[],...f],await p(e.cwd,$,b);const{recordRecentlyNotified:O}=await import("./staged-registry.js");P=O(P,f)}if(I.failed.length>0||I.succeeded.length>0){const f=I.succeeded.length+I.failed.length;if(I.failed.length>0){e.plan.warnings.push(`[notifications] dispatched ${I.succeeded.length}/${f} channels${I.succeeded.length>0?` (succeeded: ${I.succeeded.join(", ")})`:""}; ${I.failed.length} failed.`);for(const O of I.failed)e.plan.warnings.push(`[notifications:${O.id}] ${O.error}`)}}}}catch(g){e.plan.warnings.push(`notifications: dispatch failed: ${g.message}`)}if(!a.dryRun)try{const g=await w(e.cwd,$,P);if(g.changed){const{stageAndCommitFile:y}=await import("./git.js");try{await y({cwd:e.cwd,runner:n},g.path,"chore(release): record cross-runner notify/walk dedupe [skip ci]",{author:e.config.gitUser,push:!a.noPush,sign:e.config.gitSignCommits===!0})}catch(j){process.stderr.write(`[vis release] Warning: could not commit ${g.path} (notify/walk dedupe): ${j.message}
+${s}`},Xa=async(e,a={})=>{const t={failed:[],published:[],skipped:[],tags:[],tagsPushed:!1},n=z();if(e.plan.releases.length===0)return t;if(!a.dryRun&&e.channel?.mode==="version-pr"){const{createRemoteClient:o,detectRemoteProvider:r}=await import("./detect2.js"),m=await r(e.cwd,n,e.config.provider),i=await o(m,{githubHost:e.config.githubHost,gitlabHost:e.config.gitlabHost,httpProxy:e.config.httpProxy}).detectRepoSlug(e.cwd,n),p=e.config.versionPr?.branch??"vis-release/version-packages";if(i)try{const h=await n.run("gh",["pr","list","--head",p,"--state","open","--json","number"],{cwd:e.cwd,silent:!0});if(h.exitCode===0&&h.stdout.trim()&&h.stdout.trim()!=="[]"){const u=JSON.parse(h.stdout);if(u[0])return t.failed.push({name:"_preflight",reason:`Open release PR #${u[0].number} exists. Merge or close it before publishing locally. (Override: --no-push then \`git push --tags\` manually.)`}),t}}catch{}}if(!a.dryRun&&e.config.prePublishCommand)try{await J(e.cwd,e.config.prePublishCommand,"prePublishCommand")}catch(o){return t.failed.push({name:"_prePublishCommand",reason:o.message}),t}const s=e.config.changesDir??X,{acquireLock:c,releaseLock:d}=await import("./state.js");let l=!1;if(!a.dryRun)try{await c(e.cwd,s),l=!0}catch(o){return t.failed.push({name:"_lock",reason:o.message}),t}try{const{clearState:o,filterPlanByState:r,newState:m,readState:i,writeState:p}=await import("./state.js"),{readStagedRegistry:h,removePendingStages:u,upsertPendingStages:P,writeStagedRegistry:w}=await import("./staged-registry.js"),$=e.config.changesDir??X;let y=a.resume?await i(e.cwd,$):void 0,k=await h(e.cwd,$);await Ie(e,"publish",k,{runner:n}),k=await h(e.cwd,$);const b={pending:[...k.pending]};let{releases:B}=e.plan;y?B=r(B,y):(y=m(e.channel?.tag,e.plan.releases),a.dryRun||await p(e.cwd,$,y));const V=await e.pm.readCatalogYaml(e.cwd),T=xe(V),N=e.depGraph.topologicalSort(B.map(g=>g.name)),E=new Map(B.map(g=>[g.name,g])),A=new Set,C=new Map;for(const g of e.plan.releases){const v=e.depGraph.getPackage(g.name);v&&C.set(g.name,{...v.manifest,version:g.newVersion})}for(const g of N){const v=E.get(g);if(!v){t.skipped.push({name:g,reason:"topo-sort returned a name not in the release plan (internal bug)"});continue}const j=e.depGraph.getPackage(g);if(!j)continue;const L=[...new Set(e.depGraph.getDependencies(g).filter(f=>f.kind!=="devDependencies"&&A.has(f.name)).map(f=>f.name))];if(L.length>0){t.skipped.push({name:g,reason:`dependency-failed: not published because ${L.join(", ")} failed to publish (publishing would orphan this package's dependency range)`}),A.add(g);continue}const S=e.perPackageConfig.get(g)??{},D=Ae(j,S),_=a.publishActionsOverride??Ge(D),M=a.tag??e.channel?.tag,I=k.pending.find(f=>f.name===g&&f.version===v.newVersion);try{const f=await _.publish({catalogs:T,cleanPackageJsonConfig:e.config.publish?.cleanPackageJson,dryRun:a.dryRun,otp:a.otp,perPackageConfig:S,pkg:j,pm:e.pm,provenance:Ea(e),registry:S.registry,release:v,resumeStageId:I?.id,tag:M,versionedManifestByName:C,workspaceConfig:e.config});if(f.published||f.alreadyPublished){const O=k.pending.filter(F=>F.name===g&&F.version===v.newVersion).map(F=>F.id);O.length>0&&(k=u(k,O))}if(f.published)t.published.push({name:g,stageId:f.stageId,tarball:f.tarball,version:v.newVersion}),y.published.push(`${g}@${v.newVersion}`);else if(f.alreadyPublished)t.skipped.push({name:g,reason:"already-published"}),y.published.push(`${g}@${v.newVersion}`);else if(t.skipped.push({name:g,reason:f.output??"skipped"}),f.stageId){const O=(f.output??"").startsWith("stage-rejected")?"rejected":"timeout";k=P(k,[{id:f.stageId,name:g,reason:O,stagedAt:new Date().toISOString(),tag:M??"latest",version:v.newVersion}])}a.dryRun||await p(e.cwd,$,y)}catch(f){t.failed.push({name:g,reason:f.message}),A.add(g)}}if(!a.dryRun&&!a.noTag&&t.published.length>0){const{createOrUpdateFloatingTag:g,createTag:v,defaultTagFor:j,pushTags:L,renderTagPattern:S}=await import("./git.js"),D=e.config.releaseTagPattern,_=e.channel?.tag,M=e.config.floatingMajorTag===!0,I=!!e.channel?.prerelease||!!e.preMode;for(const{name:f,version:O}of t.published){const F=e.perPackageConfig.get(f)?.releaseTagPattern??D,U=F?S(F,{channel:_,name:f,version:O}):j(f,O);try{await v({cwd:e.cwd,runner:n},U,`Release ${f}@${O}`,{signing:e.config.signing,skipRemoteCheck:e.firstRelease}),t.tags.push(U)}catch(H){e.firstRelease&&H instanceof R&&H.code==="TAG_COLLISION"?t.skipped.push({name:U,reason:"tag-creation: tag already exists (first-release — skipped)"}):t.skipped.push({name:U,reason:`tag-creation: ${H.message}`})}const q=e.depGraph.getPackage(f),Re=e.perPackageConfig.get(f),je=q?.manifest?.private===!0,Me=Re?.skipNpmPublish===!0;if(M&&!I&&!F?.includes("{major}")&&!je&&!Me){const H=O.split(/[-+]/,1)[0].split(".")[0];if(H!==void 0&&H!==""){const de=f.replace(/^@/,"").replaceAll("/","-");if(de!==""){const ae=`${de}-v${H}`;try{await g({cwd:e.cwd,runner:n},ae,{push:!a.noPush,signing:e.config.signing}),t.tags.push(ae)}catch(De){t.skipped.push({name:ae,reason:`floating-major-tag: ${De.message}`})}}}}}if(!a.noPush&&t.tags.length>0)try{await L({cwd:e.cwd,runner:n}),t.tagsPushed=!0}catch(f){t.tagsPushed=!1,t.failed.push({name:"_pushTags",reason:`git push --tags failed: ${f.message}. Retry with: git push --tags`})}y.tagged=[...t.tags],y.pushed=t.tagsPushed,a.dryRun||await p(e.cwd,$,y),t.failed.length===0&&t.published.length>0&&!a.dryRun&&await o(e.cwd,$)}if(!a.dryRun){const g=b.pending.length,v=k.pending.length,j=await w(e.cwd,$,k);if(j.changed){const{stageAndCommitFile:L}=await import("./git.js");let S;if(j.removed)S="chore(release): clear pending stage registry [skip ci]";else if(v>g){const D=v-g;S=`chore(release): record ${D} new pending stage${D===1?"":"s"} [skip ci]`}else if(v<g){const D=g-v;S=`chore(release): drain ${D} resolved stage${D===1?"":"s"} [skip ci]`}else S=`chore(release): update pending stage registry (${v} pending) [skip ci]`;try{await L({cwd:e.cwd,runner:n},j.path,S,{author:e.config.gitUser,push:!a.noPush,sign:e.config.gitSignCommits===!0})}catch(D){process.stderr.write(`[vis release] Warning: could not commit ${j.path}: ${D.message}
+`)}}}if(!a.dryRun&&t.published.length>0&&e.config.workspaceChangelog!==!1){const g=e.config.workspaceChangelog,v=typeof g=="object"?g:void 0,j=typeof e.config.aggregateRelease=="object"?e.config.aggregateRelease.enabled:e.config.aggregateRelease===!0;if(v!==void 0||j)try{const{writeWorkspaceChangelogWave:L}=await import("./workspace.js"),S=new Set(t.published.map(M=>M.name)),D=e.plan.releases.filter(M=>S.has(M.name)),_=await L({changelogConfig:e.config.changelog,cwd:e.cwd,workspaceChangelog:e.config.workspaceChangelog},D);if(_)try{const{stageAndCommitFile:M}=await import("./git.js");await M({cwd:e.cwd,runner:n},_,"chore(release): record wave [skip ci]",{author:e.config.gitUser,push:!a.noPush,sign:e.config.gitSignCommits===!0})}catch(M){process.stderr.write(`[vis release] Warning: could not commit workspace CHANGELOG.md: ${M.message}
+`)}}catch(L){process.stderr.write(`[vis release] Warning: could not write workspace CHANGELOG.md wave entry: ${L.message}
+`)}}if(!a.dryRun&&t.published.length>0&&t.tagsPushed){e.config.publish?.noRelease!==!0&&await Va(e,t,n);try{const{walkSuccessfulRelease:g}=await import("./success-walk.js"),{createRemoteClient:v,detectRemoteProvider:j}=await import("./detect2.js"),{resolveFormatter:L}=await import("./resolveFormatter.js"),S=await j(e.cwd,n,e.config.provider),D=v(S,{githubHost:e.config.githubHost,gitlabHost:e.config.gitlabHost,httpProxy:e.config.httpProxy}),_=await D.detectRepoSlug(e.cwd,n),M=await L(e.config.changelog,e.cwd),{recordRecentlyWalked:I}=await import("./staged-registry.js"),f=new Set([...y.walked??[],...(k.recentlyWalked??[]).map(F=>F.key)]),O={...t,published:t.published.filter(F=>!f.has(`${F.name}@${F.version}`))};if(O.published.length>0){const F=await g(e,O,n,{client:D,formatter:M,repo:_}),U=O.published.map(q=>`${q.name}@${q.version}`);y.walked=[...y.walked??[],...U],await p(e.cwd,$,y),k=I(k,U),F.warnings.length>0&&e.plan.warnings.push(...F.warnings)}}catch(g){e.plan.warnings.push(`successWalk: could not run post-release walk: ${g.message}`)}if(e.config.notifications)try{const{dispatchNotifications:g}=await import("./interface.js"),{createRemoteClient:v,detectRemoteProvider:j}=await import("./detect2.js"),L=await j(e.cwd,n,e.config.provider),S=await v(L,{githubHost:e.config.githubHost,gitlabHost:e.config.gitlabHost,httpProxy:e.config.httpProxy}).detectRepoSlug(e.cwd,n);let D;try{const I=`${e.cwd}/package.json`,f=await import("node:fs/promises");D=JSON.parse(await f.readFile(I,"utf8")).name}catch{}const _=new Set([...y.notified??[],...(k.recentlyNotified??[]).map(I=>I.key)]),M=t.published.filter(I=>!_.has(`${I.name}@${I.version}`));if(M.length>0){const I=await g(e.config.notifications,{channel:e.channel?.tag,completedAt:new Date().toISOString(),...D===void 0?{}:{monorepoName:D},published:M.map(f=>({name:f.name,tag:e.channel?.tag,...f.url===void 0?{}:{url:f.url},version:f.version})),...S===void 0?{}:{repo:S},skipped:t.skipped.map(f=>({name:f.name,reason:f.reason}))},{warn:f=>e.plan.warnings.push(f)});if(I.succeeded.length>0){const f=M.map(F=>`${F.name}@${F.version}`);y.notified=[...y.notified??[],...f],await p(e.cwd,$,y);const{recordRecentlyNotified:O}=await import("./staged-registry.js");k=O(k,f)}if(I.failed.length>0||I.succeeded.length>0){const f=I.succeeded.length+I.failed.length;if(I.failed.length>0){e.plan.warnings.push(`[notifications] dispatched ${I.succeeded.length}/${f} channels${I.succeeded.length>0?` (succeeded: ${I.succeeded.join(", ")})`:""}; ${I.failed.length} failed.`);for(const O of I.failed)e.plan.warnings.push(`[notifications:${O.id}] ${O.error}`)}}}}catch(g){e.plan.warnings.push(`notifications: dispatch failed: ${g.message}`)}if(!a.dryRun)try{const g=await w(e.cwd,$,k);if(g.changed){const{stageAndCommitFile:v}=await import("./git.js");try{await v({cwd:e.cwd,runner:n},g.path,"chore(release): record cross-runner notify/walk dedupe [skip ci]",{author:e.config.gitUser,push:!a.noPush,sign:e.config.gitSignCommits===!0})}catch(j){process.stderr.write(`[vis release] Warning: could not commit ${g.path} (notify/walk dedupe): ${j.message}
 `)}}}catch(g){process.stderr.write(`[vis release] Warning: could not update cross-runner dedupe registry: ${g.message}
-`)}}if(!a.dryRun&&e.config.postPublishCommand)try{await Y(e.cwd,e.config.postPublishCommand,"postPublishCommand")}catch(g){t.failed.push({name:"_postPublishCommand",reason:g.message})}return t}finally{l&&await d(e.cwd,s)}},Ma=e=>e.length===0?"":`## Related releases
+`)}}if(!a.dryRun&&e.config.postPublishCommand)try{await J(e.cwd,e.config.postPublishCommand,"postPublishCommand")}catch(g){t.failed.push({name:"_postPublishCommand",reason:g.message})}return t}finally{l&&await d(e.cwd,s)}},Ma=e=>e.length===0?"":`## Related releases
 
 ${e.map(a=>`- [${a.name}](${a.url})`).join(`
 `)}`,Da=(e,a,t)=>{if(!a||!a.header&&!a.footer)return e;const n=c=>ua(c,{contributors:t.contributors??"",date:t.date,name:t.name,previousVersion:t.previousVersion,repo:t.repo,version:t.version}).replaceAll(/\n{3,}/g,`
 
 `).replace(/\s+$/,""),s=[];if(a.header){const c=n(a.header);c.length>0&&s.push(c)}if(s.push(e),a.footer){const c=n(a.footer);c.length>0&&s.push(c)}return s.join(`
 
-`)},Sa=e=>{if(!Array.isArray(e))return;const[a,t]=e;if(a!=="github"||typeof t!="object"||t===null)return;const{internalAuthors:n}=t;if(Array.isArray(n))return n.filter(s=>typeof s=="string")},Va=async(e,a,t)=>{const{createRemoteClient:n,detectRemoteProvider:s}=await import("./detect2.js"),c=await s(e.cwd,t,e.config.provider),d=n(c,{githubHost:e.config.githubHost,gitlabHost:e.config.gitlabHost,httpProxy:e.config.httpProxy}),l=await d.detectRepoSlug(e.cwd,t);if(!l)return;const i=typeof e.config.aggregateRelease=="object"?e.config.aggregateRelease:{enabled:e.config.aggregateRelease===!0},r=e.config.publish?.draftRelease===!0,m=e.config.publish?.discussionCategory,o=e.config.publish?.addReleases;if(i.enabled){const v=new Date().toISOString().slice(0,10),L=(i.title??"Release {date}").replaceAll("{date}",v),V=`release-${v}`,T=a.published.map(N=>`- \`${N.name}\` → ${N.version}`).join(`
-`);try{const N=await d.createRelease(t,{body:T,cwd:e.cwd,discussionCategory:m,draft:r,repo:l,tag:V,title:L});if(N?.url)for(const E of a.published)E.url=N.url}catch{}return}const{defaultTagFor:p,renderTagPattern:h}=await import("./git.js"),u=e.config.releaseTagPattern,k=e.channel?.tag,w=e.config.publish?.releaseAssets??{},$=new Date().toISOString().slice(0,10),b=Sa(e.config.changelog),P=fa(e.plan.consumedChangeFiles??[],{internalAuthors:b});for(const v of a.published){const L=e.perPackageConfig.get(v.name)?.releaseTagPattern??u,V=L?h(L,{channel:k,name:v.name,version:v.version}):p(v.name,v.version),T=v.version.includes("-");let N=`Release of ${v.name}@${v.version}.`;if(v.stageId&&(N=`${N}
+`)},Sa=e=>{if(!Array.isArray(e))return;const[a,t]=e;if(a!=="github"||typeof t!="object"||t===null)return;const{internalAuthors:n}=t;if(Array.isArray(n))return n.filter(s=>typeof s=="string")},Va=async(e,a,t)=>{const{createRemoteClient:n,detectRemoteProvider:s}=await import("./detect2.js"),c=await s(e.cwd,t,e.config.provider),d=n(c,{githubHost:e.config.githubHost,gitlabHost:e.config.gitlabHost,httpProxy:e.config.httpProxy}),l=await d.detectRepoSlug(e.cwd,t);if(!l)return;const o=typeof e.config.aggregateRelease=="object"?e.config.aggregateRelease:{enabled:e.config.aggregateRelease===!0},r=e.config.publish?.draftRelease===!0,m=e.config.publish?.discussionCategory,i=e.config.publish?.addReleases;if(o.enabled){const b=new Date().toISOString().slice(0,10),B=(o.title??"Release {date}").replaceAll("{date}",b),V=`release-${b}`,T=a.published.map(N=>`- \`${N.name}\` → ${N.version}`).join(`
+`);try{const N=await d.createRelease(t,{body:T,cwd:e.cwd,discussionCategory:m,draft:r,repo:l,tag:V,title:B});if(N?.url)for(const E of a.published)E.url=N.url}catch{}return}const{defaultTagFor:p,renderTagPattern:h}=await import("./git.js"),u=e.config.releaseTagPattern,P=e.channel?.tag,w=e.config.publish?.releaseAssets??{},$=new Date().toISOString().slice(0,10),y=Sa(e.config.changelog),k=fa(e.plan.consumedChangeFiles??[],{internalAuthors:y});for(const b of a.published){const B=e.perPackageConfig.get(b.name)?.releaseTagPattern??u,V=B?h(B,{channel:P,name:b.name,version:b.version}):p(b.name,b.version),T=b.version.includes("-");let N=`Release of ${b.name}@${b.version}.`;if(b.stageId&&(N=`${N}
 
-> ⏳ **Staged — not yet installable.** Approve via \`vis release stage approve ${v.stageId}\` or the npmjs.com web UI.`),w.stampHashes&&v.tarball&&(N=`${N}
+> ⏳ **Staged — not yet installable.** Approve via \`vis release stage approve ${b.stageId}\` or the npmjs.com web UI.`),w.stampHashes&&b.tarball&&(N=`${N}
 
 ### Tarball integrity
 
-- size: \`${v.tarball.size}\` bytes
-- sha256: \`${v.tarball.sha256}\`
-- sha512: \`${v.tarball.sha512}\``),o!==void 0&&o!==!1)try{const C=V.lastIndexOf("@"),g=C>0?V.slice(0,C+1):"",y=await d.listRecentReleases(t,{cwd:e.cwd,excludeTag:V,limit:5,repo:l,tagPrefix:g}),j=Ma(y);j&&(N=o==="top"?`${j}
+- size: \`${b.tarball.size}\` bytes
+- sha256: \`${b.tarball.sha256}\`
+- sha512: \`${b.tarball.sha512}\``),i!==void 0&&i!==!1)try{const C=V.lastIndexOf("@"),g=C>0?V.slice(0,C+1):"",v=await d.listRecentReleases(t,{cwd:e.cwd,excludeTag:V,limit:5,repo:l,tagPrefix:g}),j=Ma(v);j&&(N=i==="top"?`${j}
 
 ${N}`:`${N}
 
-${j}`)}catch{}const{releaseNoteTemplate:E}=e.config;if(E){const C=e.plan.releases.find(g=>g.name===v.name)?.oldVersion??"";N=Da(N,E,{contributors:P,date:$,name:v.name,previousVersion:C,repo:l,version:v.version})}const A=[];w.uploadTarball&&v.tarball&&A.push(v.tarball.path);try{const C=await d.createRelease(t,{assets:A.length>0?A:void 0,body:N,cwd:e.cwd,discussionCategory:m,draft:r,prerelease:T,repo:l,tag:V,title:`${v.name} v${v.version}`});C?.url&&(v.url=C.url)}catch(C){console.warn(`createRelease failed for ${v.name}@${v.version} (tag ${V}): ${C.message}`)}}},Ea=e=>(e.config.publish?.publishArgs??[]).includes("--provenance")&&e.pm.id!=="bun";export{qa as a,za as b,oa as c,sa as d,Ya as f,Xa as p,Ne as r,Ja as w};
+${j}`)}catch{}const{releaseNoteTemplate:E}=e.config;if(E){const C=e.plan.releases.find(g=>g.name===b.name)?.oldVersion??"";N=Da(N,E,{contributors:k,date:$,name:b.name,previousVersion:C,repo:l,version:b.version})}const A=[];w.uploadTarball&&b.tarball&&A.push(b.tarball.path);try{const C=await d.createRelease(t,{assets:A.length>0?A:void 0,body:N,cwd:e.cwd,discussionCategory:m,draft:r,prerelease:T,repo:l,tag:V,title:`${b.name} v${b.version}`});C?.url&&(b.url=C.url)}catch(C){console.warn(`createRelease failed for ${b.name}@${b.version} (tag ${V}): ${C.message}`)}}},Ea=e=>(e.config.publish?.publishArgs??[]).includes("--provenance")&&e.pm.id!=="bun";export{qa as a,za as b,oa as c,sa as d,Ya as f,Xa as p,Ae as r,Ja as w};

package/dist/packem_chunks/prune.js

@@ -1,3 +1,3 @@
-import{p as o}from"./cli-main.js";import{r as d}from"../packem_shared/advisories-aiDtubZQ.js";const f=async({fs:c,logger:u,options:e,workspaceRoot:s})=>{if(!s)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const r=e.db??d(s),t=e.format==="json";if(!e.force){o.warn(`Prune is destructive. Will remove: ${r}`),o.info("Re-run with --force to proceed."),t&&process.stdout.write(`${JSON.stringify({dbPath:r,reason:"needs --force",removed:!1})}
+import{p as o}from"./cli-main.js";import{r as d}from"../packem_shared/advisories-CefYKEPe.js";const f=async({fs:c,logger:u,options:e,workspaceRoot:s})=>{if(!s)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const r=e.db??d(s),t=e.format==="json";if(!e.force){o.warn(`Prune is destructive. Will remove: ${r}`),o.info("Re-run with --force to proceed."),t&&process.stdout.write(`${JSON.stringify({dbPath:r,reason:"needs --force",removed:!1})}
 `);return}const a=[r,`${r}-wal`,`${r}-shm`,`${r}-journal`],i=[];for(const n of a)try{await c.rm(n,{force:!0}),i.push(n)}catch{}if(t){process.stdout.write(`${JSON.stringify({dbPath:r,files:i,removed:!0})}
 `);return}o.success(`Removed ${r}.`)},w=f;export{w as advisoriesPruneExecute};

package/dist/packem_chunks/run.js

@@ -1 +1 @@
-import{p as e,C as n,J as p}from"./cli-main.js";const w=({options:o,visConfig:l,workspaceRoot:r})=>{const i=r??process.cwd(),a=l?.security?.policies?.installScripts?.allow??{},s=Object.entries(a).filter(([,t])=>t).map(([t])=>t);s.length===0&&!o.rootOnly&&(e.warn("No approved packages in security.policies.installScripts.allow — nothing to run."),!o.withRoot)||(o.rootOnly||n(i,s),(o.withRoot||o.rootOnly)&&p(i))};export{w as default};
+import{p as n,A as a,R as p}from"./cli-main.js";const w=({options:o,visConfig:l,workspaceRoot:r})=>{const i=r??process.cwd(),e=l?.security?.policies?.installScripts?.allow??{},s=Object.entries(e).filter(([,t])=>t).map(([t])=>t);s.length===0&&!o.rootOnly&&(n.warn("No approved packages in security.policies.installScripts.allow — nothing to run."),!o.withRoot)||(o.rootOnly||a(i,s),(o.withRoot||o.rootOnly)&&p(i))};export{w as default};

package/dist/packem_chunks/status.js

@@ -1,2 +1,2 @@
-import{s as d,E as i,I as y}from"../packem_shared/index.server-J83sowC4.js";import{p as a}from"./cli-main.js";import{r as l,g as h}from"../packem_shared/advisories-aiDtubZQ.js";const p=r=>{if(r===0)return"0 B";const n=["B","KB","MB","GB"],t=Math.min(Math.floor(Math.log(r)/Math.log(1024)),n.length-1),o=r/1024**t;return`${o.toFixed(o<10&&t>0?1:0)} ${n[t]}`},v=r=>{if(!r)return"never";const n=Date.parse(r);if(Number.isNaN(n))return r;const t=Date.now()-n;if(t<0)return r;const o=Math.floor(t/6e4);if(o<1)return"just now";if(o<60)return`${o}m ago`;const s=Math.floor(o/60);return s<24?`${s}h ago`:`${Math.floor(s/24)}d ago`},g=async({logger:r,options:n,workspaceRoot:t})=>{if(!t)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const o=n.db??l(t),s=await h(t,o);if(n.format==="json"){process.stdout.write(`${JSON.stringify({dbPath:o,ecosystems:s.ecosystems.map(e=>({advisoryCount:e.advisoryCount,lastSyncIso:e.lastSyncIso,manifestEtag:e.manifestEtag??null,name:e.name})),exists:s.exists,schemaVersion:s.schemaVersion,sizeBytes:s.sizeBytes},void 0,2)}
+import{s as d,E as i,I as y}from"../packem_shared/index.server-J83sowC4.js";import{p as a}from"./cli-main.js";import{r as l,g as h}from"../packem_shared/advisories-CefYKEPe.js";const p=r=>{if(r===0)return"0 B";const n=["B","KB","MB","GB"],t=Math.min(Math.floor(Math.log(r)/Math.log(1024)),n.length-1),o=r/1024**t;return`${o.toFixed(o<10&&t>0?1:0)} ${n[t]}`},v=r=>{if(!r)return"never";const n=Date.parse(r);if(Number.isNaN(n))return r;const t=Date.now()-n;if(t<0)return r;const o=Math.floor(t/6e4);if(o<1)return"just now";if(o<60)return`${o}m ago`;const s=Math.floor(o/60);return s<24?`${s}h ago`:`${Math.floor(s/24)}d ago`},g=async({logger:r,options:n,workspaceRoot:t})=>{if(!t)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const o=n.db??l(t),s=await h(t,o);if(n.format==="json"){process.stdout.write(`${JSON.stringify({dbPath:o,ecosystems:s.ecosystems.map(e=>({advisoryCount:e.advisoryCount,lastSyncIso:e.lastSyncIso,manifestEtag:e.manifestEtag??null,name:e.name})),exists:s.exists,schemaVersion:s.schemaVersion,sizeBytes:s.sizeBytes},void 0,2)}
 `);return}if(a.info(`DB: ${o}`),!s.exists){a.warn(`No advisory DB yet. Run ${d("vis advisories sync")} to populate.`);return}if(a.info(`Schema: v${s.schemaVersion}   Size: ${p(s.sizeBytes)}`),s.ecosystems.length===0){a.warn("DB exists but contains no ecosystems. Run `vis advisories sync`.");return}a.info(""),a.info("Ecosystem    Advisories   Last sync           ETag"),a.info(i("──────────   ──────────   ─────────────────   ──────"));for(const e of s.ecosystems){const c=e.name.padEnd(10),f=e.advisoryCount.toLocaleString().padStart(10),m=`${e.lastSyncIso||"never"} (${v(e.lastSyncIso)})`.padEnd(19),u=e.manifestEtag??i("—");a.info(`${y(c)}   ${f}   ${m}   ${u}`)}},S=g;export{S as advisoriesStatusExecute};

package/dist/packem_chunks/sync.js

@@ -1,2 +1,2 @@
-import{E as g}from"../packem_shared/index.server-J83sowC4.js";import{p as c}from"./cli-main.js";import{s as $}from"../packem_shared/scan-progress-CN9ONR0y.js";import{s as w,D as v}from"../packem_shared/advisories-aiDtubZQ.js";const S=t=>t?.security?.audit?.advisories??{},D=t=>t?t.split(",").map(r=>r.trim()).filter(r=>r.length>0):["npm"],b=async({logger:t,options:r,visConfig:h,workspaceRoot:d})=>{if(!d)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const l=r.format==="json",u=S(h),m=r.source??u.source??v,p=D(r.ecosystem),y=p.map(s=>({id:s,label:`Sync ${s} advisories`})),n=$(y,{live:!l}),i=[];try{for(const s of p){n.start(s);const o=Date.now();try{const e=await w({allowedHosts:u.allowedHosts,dbPath:r.db,ecosystem:s,force:!!r.force,source:m,workspaceRoot:d});i.push({ecosystem:s,result:e}),e.upToDate?n.finish(s,"ok",`up to date · ${f(Date.now()-o)}`):n.finish(s,"ok",`${e.advisoriesIngested.toLocaleString()} advisories · ${f(e.durationMs)}`)}catch(e){const a=e instanceof Error?e.message:String(e);i.push({ecosystem:s,error:a}),n.finish(s,"error",a)}}}finally{n.stop()}if(l){const s={ecosystems:i.map(o=>({advisoriesIngested:o.result?.advisoriesIngested??0,dbPath:o.result?.dbPath??null,durationMs:o.result?.durationMs??0,ecosystem:o.ecosystem,error:o.error??null,upToDate:o.result?.upToDate??!1})),source:m};process.stdout.write(`${JSON.stringify(s,void 0,2)}
+import{E as g}from"../packem_shared/index.server-J83sowC4.js";import{p as c}from"./cli-main.js";import{s as $}from"../packem_shared/scan-progress-RTMsE3Z4.js";import{s as w,D as v}from"../packem_shared/advisories-CefYKEPe.js";const S=t=>t?.security?.audit?.advisories??{},D=t=>t?t.split(",").map(r=>r.trim()).filter(r=>r.length>0):["npm"],b=async({logger:t,options:r,visConfig:h,workspaceRoot:d})=>{if(!d)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const l=r.format==="json",u=S(h),m=r.source??u.source??v,p=D(r.ecosystem),y=p.map(s=>({id:s,label:`Sync ${s} advisories`})),n=$(y,{live:!l}),i=[];try{for(const s of p){n.start(s);const o=Date.now();try{const e=await w({allowedHosts:u.allowedHosts,dbPath:r.db,ecosystem:s,force:!!r.force,source:m,workspaceRoot:d});i.push({ecosystem:s,result:e}),e.upToDate?n.finish(s,"ok",`up to date · ${f(Date.now()-o)}`):n.finish(s,"ok",`${e.advisoriesIngested.toLocaleString()} advisories · ${f(e.durationMs)}`)}catch(e){const a=e instanceof Error?e.message:String(e);i.push({ecosystem:s,error:a}),n.finish(s,"error",a)}}}finally{n.stop()}if(l){const s={ecosystems:i.map(o=>({advisoriesIngested:o.result?.advisoriesIngested??0,dbPath:o.result?.dbPath??null,durationMs:o.result?.durationMs??0,ecosystem:o.ecosystem,error:o.error??null,upToDate:o.result?.upToDate??!1})),source:m};process.stdout.write(`${JSON.stringify(s,void 0,2)}
 `)}else{const s=i.filter(a=>a.error),o=i.filter(a=>a.result),e=o[0];e?.result?.dbPath&&c.info(g(`DB: ${e.result.dbPath}`)),s.length===0?c.success(`Synced ${o.length} ecosystem${o.length===1?"":"s"}.`):c.error(`${s.length} ecosystem${s.length===1?"":"s"} failed to sync.`)}i.some(s=>s.error)&&(process.exitCode=1)},f=t=>t>=1e3?`${(t/1e3).toFixed(1)}s`:`${Math.round(t)}ms`,R=b;export{R as advisoriesSyncExecute};

package/dist/packem_chunks/sync2.js

@@ -1,2 +1,2 @@
-import{p as e}from"./cli-main.js";import{w as u}from"../packem_shared/pm-runner-Dws_Bw1y.js";import{O as g}from"../packem_shared/native-config-sync-4K9wWTj5.js";import{S as l}from"../packem_shared/min-release-age-pUAqTiv3.js";const y=new Set(["bun","npm","pnpm","yarn"]),k=({options:r,visConfig:c,workspaceRoot:f})=>{const s=f??process.cwd(),n=u(s);if(!y.has(n.name)){e.warn(`Package manager '${n.name}' has no native security config to sync.`);return}if(!c?.security){e.warn("vis.config has no `security` block — nothing to sync.");return}const t=c.security.policies??{},a=Object.fromEntries(Object.entries(t.installScripts?.allow??{}).filter(([,o])=>o)),m=t.firstSeen?.minutes,p=t.firstSeen?.exclude??[],i=[];if(Object.keys(a).length>0&&!r.skipAllowBuilds&&i.push(...g(n.name,s,a)),r.skipMinReleaseAge||i.push(...l(n.name,s,m,p)),i.length===0){e.success("Nothing to sync — vis.config and native PM config are aligned.");return}e.info(`Syncing vis.config security settings to ${n.name} native config…
+import{p as e}from"./cli-main.js";import{w as u}from"../packem_shared/pm-runner-CIH0wPh-.js";import{O as g}from"../packem_shared/native-config-sync-4K9wWTj5.js";import{S as l}from"../packem_shared/min-release-age-B23Mr7NO.js";const y=new Set(["bun","npm","pnpm","yarn"]),k=({options:r,visConfig:c,workspaceRoot:f})=>{const s=f??process.cwd(),n=u(s);if(!y.has(n.name)){e.warn(`Package manager '${n.name}' has no native security config to sync.`);return}if(!c?.security){e.warn("vis.config has no `security` block — nothing to sync.");return}const t=c.security.policies??{},a=Object.fromEntries(Object.entries(t.installScripts?.allow??{}).filter(([,o])=>o)),m=t.firstSeen?.minutes,p=t.firstSeen?.exclude??[],i=[];if(Object.keys(a).length>0&&!r.skipAllowBuilds&&i.push(...g(n.name,s,a)),r.skipMinReleaseAge||i.push(...l(n.name,s,m,p)),i.length===0){e.success("Nothing to sync — vis.config and native PM config are aligned.");return}e.info(`Syncing vis.config security settings to ${n.name} native config…
 `);for(const o of i)e.success(`  ${o}`)};export{k as default};

package/dist/packem_chunks/tripwire.js

@@ -1,2 +1,2 @@
-import{createRequire as m}from"node:module";import{m as d,f as p,T as v}from"../packem_shared/index-OQZQyN5R.js";import{p as e}from"./cli-main.js";import{w as $}from"../packem_shared/pm-runner-Dws_Bw1y.js";import{a as u}from"../packem_shared/readJsonSync-CvkZyKmL-CY7PZob_.js";const g=m(import.meta.url),c=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,w=o=>{if(typeof c<"u"&&c.versions&&c.versions.node){const[t,s]=c.versions.node.split(".").map(Number);if(t>22||t===22&&s>=3||t===20&&s>=16)return c.getBuiltinModule(o)}return g(o)},{spawnSync:y}=w("node:child_process"),n="@lavamoat/preinstall-always-fail",l=o=>{const t=d(o,"package.json");if(!p(t))return"no-package-json";try{const s=u(t);if(s.devDependencies?.[n]||s.dependencies?.[n])return"installed"}catch{}return"missing"},h=o=>{const t=d(o,"package.json");if(!p(t))return!1;try{const s=u(t);let i=!1;const a=r=>!r||!(n in r)?r:(i=!0,Object.fromEntries(Object.entries(r).filter(([f])=>f!==n)));return s.devDependencies=a(s.devDependencies),s.dependencies=a(s.dependencies),i&&v(t,`${JSON.stringify(s,null,2)}
+import{createRequire as m}from"node:module";import{m as d,f as p,T as v}from"../packem_shared/index-OQZQyN5R.js";import{p as e}from"./cli-main.js";import{w as $}from"../packem_shared/pm-runner-CIH0wPh-.js";import{a as u}from"../packem_shared/readJsonSync-CvkZyKmL-CY7PZob_.js";const g=m(import.meta.url),c=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,w=o=>{if(typeof c<"u"&&c.versions&&c.versions.node){const[t,s]=c.versions.node.split(".").map(Number);if(t>22||t===22&&s>=3||t===20&&s>=16)return c.getBuiltinModule(o)}return g(o)},{spawnSync:y}=w("node:child_process"),n="@lavamoat/preinstall-always-fail",l=o=>{const t=d(o,"package.json");if(!p(t))return"no-package-json";try{const s=u(t);if(s.devDependencies?.[n]||s.dependencies?.[n])return"installed"}catch{}return"missing"},h=o=>{const t=d(o,"package.json");if(!p(t))return!1;try{const s=u(t);let i=!1;const a=r=>!r||!(n in r)?r:(i=!0,Object.fromEntries(Object.entries(r).filter(([f])=>f!==n)));return s.devDependencies=a(s.devDependencies),s.dependencies=a(s.dependencies),i&&v(t,`${JSON.stringify(s,null,2)}
 `),i}catch{return!1}},D=({options:o,workspaceRoot:t})=>{const s=t??process.cwd();if(o.status){switch(l(s)){case"installed":{e.success(`Preinstall tripwire is installed (${n}).`),e.info("Removing 'ignore-scripts=true' will cause future installs to fail loudly.");break}case"missing":{e.warn("Preinstall tripwire is not installed."),e.info(`Run 'vis security tripwire' to add ${n} as a devDependency.`);break}default:e.error("No package.json found at the workspace root."),process.exitCode=1}return}if(o.remove){h(s)?e.success(`Removed ${n} from package.json. Run your PM's install to clean node_modules.`):e.info(`${n} was not present in package.json.`);return}if(l(s)==="installed"){e.info(`${n} is already installed.`);return}const i=$(s),a={bun:["add","-d",n],npm:["install","--save-dev",n],pnpm:["add","-D","-w",n],yarn:["add","-D",n]}[i.name];if(!a){e.error(`Cannot install tripwire — unsupported package manager '${i.name}'.`),process.exitCode=1;return}e.info(`Installing ${n} via ${i.name}…`);const r=y(i.name,a,{cwd:s,stdio:"inherit"});if(r.error){e.error(`Failed to install tripwire: ${r.error.message}`),process.exitCode=1;return}if(r.signal!==null){e.error(`${i.name} was terminated by signal ${r.signal}`),process.exitCode=1;return}if(r.status!==0){e.error(`${i.name} exited with code ${String(r.status)}`),process.exitCode=r.status??1;return}e.success(`Installed ${n} as a devDependency.`),e.notice(""),e.notice("How the tripwire works:"),e.notice(`  ${n} declares a preinstall script that always fails.`),e.notice("  When 'ignore-scripts=true' is set (.npmrc / bunfig.toml / .yarnrc.yml),"),e.notice("  the script is skipped and installs succeed normally. If someone deletes"),e.notice("  that setting, the next install fails — loudly — instead of silently"),e.notice("  running every dependency's lifecycle scripts.")};export{D as default};

package/dist/packem_chunks/verify-lockfile.js

@@ -1,2 +1,2 @@
-import{D as b,p}from"./cli-main.js";import{w}from"../packem_shared/pm-runner-Dws_Bw1y.js";import{r as y,l as $,L as v}from"../packem_shared/dependency-scan-B0HV_qeB.js";import{v as C,m,f as S}from"../packem_shared/index-OQZQyN5R.js";import"../packem_shared/public-api-WqUCiyIe.js";import{e as x}from"../packem_shared/index-BKFEWXU_.js";const M=e=>{const s=e.trim();return s===""?!1:/^(?:git\+|git:\/\/|git@|ssh:\/\/)/i.test(s)||/^(?:github|gitlab|bitbucket|gist):/i.test(s)||/^[\w.-]+\/[\w.-]+(?:#.+)?$/.test(s)&&!s.includes("@")?!0:/^https?:\/\//i.test(s)},L=(e,s)=>{for(const t of s)if(t===e||t.endsWith("*")&&e.startsWith(t.slice(0,-1)))return!0;return!1},D=(e,s,t={})=>{const o=y(e,s);if(!o)return[];let i;try{i=C(m(e,o.file))}catch{return[]}const n=b(i,o.type);if(n.length===0)return[];const c=t.allow??[],l=[],f=new Set;for(const r of n){const a=`${r.name}@${r.version}`;for(const d of[r.dependencies,r.optionalDependencies])if(d){for(const[u,h]of Object.entries(d))if(!L(u,c))for(const k of h){if(!M(k))continue;const g=`${a}->${u}@${k}`;f.has(g)||(f.add(g),l.push({declaredBy:a,packageName:u,source:k}))}}}return l.sort((r,a)=>r.packageName.localeCompare(a.packageName)||r.declaredBy.localeCompare(a.declaredBy))},E=new Set(["firstSeen","publisherChange"]),N=e=>e.severity==="block"&&e.acceptedRisk===void 0,R=e=>{const s=e.security?.policies?.firstSeen?.minutes,t=typeof s=="number"&&s>0,o=e.security?.policies?.publisherChange?.mode==="no-downgrade",i=e.security?.blockExoticSubdeps===!0;return t||o||i},V=async e=>{const{offline:s=!1,packageManager:t,visConfig:o,workspaceRoot:i}=e,n=Date.now();if(!R(o))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!1,status:"skipped"};const c=y(i,t);if(!c||!S(m(i,c.file)))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!0,status:"fail"};const l=$(i,t,{includeDev:!0}),f=l.length,r=await x({offline:s,packageManager:t,packages:l,workspaceRoot:i},"install",{enabledPolicies:new Set(E),visConfig:o}),a=o.security?.blockExoticSubdeps===!0?D(i,t,{allow:o.security.exoticSubdepsAllow}):[],d=r.some(u=>N(u))||a.length>0;return{decisions:r,durationMs:Date.now()-n,entryCount:f,exoticViolations:a,lockfileMissing:!1,status:d?"fail":"pass"}},B=e=>e<1e3?`${String(e)}ms`:`${(e/1e3).toFixed(1)}s`,P=e=>{if(e.status==="skipped")return["– Lockfile supply-chain verification skipped (no firstSeen / publisherChange / blockExoticSubdeps policy configured)"];if(e.lockfileMissing)return["✗ Lockfile supply-chain verification failed — no lockfile found, the resolved closure cannot be attested"];const s=`(${String(e.entryCount)} ${e.entryCount===1?"entry":"entries"}, ${B(e.durationMs)})`;if(e.status==="pass")return[`✓ Lockfile passes supply-chain policies ${s}`];const t=[`✗ Lockfile failed supply-chain policy check ${s}`];for(const o of e.decisions)o.severity==="block"&&o.acceptedRisk===void 0&&t.push(`  [${o.policy}] ${o.reason}`);for(const o of e.exoticViolations)t.push(`  [blockExoticSubdeps] ${o.packageName} pulled from exotic source by ${o.declaredBy}: ${o.source}`);return t},J=async({options:e,visConfig:s,workspaceRoot:t})=>{const o=t??process.cwd(),i=w(o);if(!v[i.name]){p.warn(`Package manager '${i.name}' has no lockfile vis can verify.`);return}const n=await V({offline:!!e.offline,packageManager:i.name,visConfig:s??{},workspaceRoot:o});if(e.json){process.stdout.write(`${JSON.stringify(n,void 0,2)}
+import{D as b,p}from"./cli-main.js";import{w}from"../packem_shared/pm-runner-CIH0wPh-.js";import{r as y,l as $,L as v}from"../packem_shared/dependency-scan-DEv-scN6.js";import{v as C,m,f as S}from"../packem_shared/index-OQZQyN5R.js";import"../packem_shared/public-api-WqUCiyIe.js";import{e as x}from"../packem_shared/index-CkZnT2Fe.js";const M=e=>{const s=e.trim();return s===""?!1:/^(?:git\+|git:\/\/|git@|ssh:\/\/)/i.test(s)||/^(?:github|gitlab|bitbucket|gist):/i.test(s)||/^[\w.-]+\/[\w.-]+(?:#.+)?$/.test(s)&&!s.includes("@")?!0:/^https?:\/\//i.test(s)},L=(e,s)=>{for(const t of s)if(t===e||t.endsWith("*")&&e.startsWith(t.slice(0,-1)))return!0;return!1},D=(e,s,t={})=>{const o=y(e,s);if(!o)return[];let i;try{i=C(m(e,o.file))}catch{return[]}const n=b(i,o.type);if(n.length===0)return[];const c=t.allow??[],l=[],f=new Set;for(const r of n){const a=`${r.name}@${r.version}`;for(const d of[r.dependencies,r.optionalDependencies])if(d){for(const[u,h]of Object.entries(d))if(!L(u,c))for(const k of h){if(!M(k))continue;const g=`${a}->${u}@${k}`;f.has(g)||(f.add(g),l.push({declaredBy:a,packageName:u,source:k}))}}}return l.sort((r,a)=>r.packageName.localeCompare(a.packageName)||r.declaredBy.localeCompare(a.declaredBy))},E=new Set(["firstSeen","publisherChange"]),N=e=>e.severity==="block"&&e.acceptedRisk===void 0,R=e=>{const s=e.security?.policies?.firstSeen?.minutes,t=typeof s=="number"&&s>0,o=e.security?.policies?.publisherChange?.mode==="no-downgrade",i=e.security?.blockExoticSubdeps===!0;return t||o||i},V=async e=>{const{offline:s=!1,packageManager:t,visConfig:o,workspaceRoot:i}=e,n=Date.now();if(!R(o))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!1,status:"skipped"};const c=y(i,t);if(!c||!S(m(i,c.file)))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!0,status:"fail"};const l=$(i,t,{includeDev:!0}),f=l.length,r=await x({offline:s,packageManager:t,packages:l,workspaceRoot:i},"install",{enabledPolicies:new Set(E),visConfig:o}),a=o.security?.blockExoticSubdeps===!0?D(i,t,{allow:o.security.exoticSubdepsAllow}):[],d=r.some(u=>N(u))||a.length>0;return{decisions:r,durationMs:Date.now()-n,entryCount:f,exoticViolations:a,lockfileMissing:!1,status:d?"fail":"pass"}},B=e=>e<1e3?`${String(e)}ms`:`${(e/1e3).toFixed(1)}s`,P=e=>{if(e.status==="skipped")return["– Lockfile supply-chain verification skipped (no firstSeen / publisherChange / blockExoticSubdeps policy configured)"];if(e.lockfileMissing)return["✗ Lockfile supply-chain verification failed — no lockfile found, the resolved closure cannot be attested"];const s=`(${String(e.entryCount)} ${e.entryCount===1?"entry":"entries"}, ${B(e.durationMs)})`;if(e.status==="pass")return[`✓ Lockfile passes supply-chain policies ${s}`];const t=[`✗ Lockfile failed supply-chain policy check ${s}`];for(const o of e.decisions)o.severity==="block"&&o.acceptedRisk===void 0&&t.push(`  [${o.policy}] ${o.reason}`);for(const o of e.exoticViolations)t.push(`  [blockExoticSubdeps] ${o.packageName} pulled from exotic source by ${o.declaredBy}: ${o.source}`);return t},J=async({options:e,visConfig:s,workspaceRoot:t})=>{const o=t??process.cwd(),i=w(o);if(!v[i.name]){p.warn(`Package manager '${i.name}' has no lockfile vis can verify.`);return}const n=await V({offline:!!e.offline,packageManager:i.name,visConfig:s??{},workspaceRoot:o});if(e.json){process.stdout.write(`${JSON.stringify(n,void 0,2)}
 `),n.status==="fail"&&(process.exitCode=1);return}const[c,...l]=P(n);if(n.status==="skipped"){p.info(c);return}if(n.status==="pass"){p.success(c);return}p.error(c);for(const f of l)p.error(f);process.exitCode=1};export{J as default};

package/dist/packem_chunks/version-resolver.js

@@ -1,2 +1,2 @@
-import{u}from"../packem_shared/index-Cb4x6lWY.js";import{c as $}from"./registry.js";import{r as w}from"./orchestrator.js";import{defaultTagFor as T,renderTagPattern as E}from"./git.js";const R=e=>{let t=0;const i=[],r=()=>{if(t>=e)return;const s=i.shift();s&&(t+=1,s())};return async s=>new Promise((c,a)=>{const m=()=>{t-=1,r()},d=()=>{s().then(c,a).finally(m)};i.push(d),r()})},b=4,p=new Map,h=(e,t)=>{const i=m=>m.replaceAll(/[$()*+.?[\\\]^{|}]/g,String.raw`\$&`);let r="^",s=0;const c=/\{(name|unscopedName|version|major|minor|patch|date|channel)\}/g;let a;for(;(a=c.exec(e))!==null;){switch(r+=i(e.slice(s,a.index)),a[1]){case"name":{r+=i(t.name);break}case"unscopedName":{r+=i(t.name.replace(/^@[^/]+\//,""));break}case"version":{r+=String.raw`(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)`;break}default:r+="[^/]+"}s=a.index+a[0].length}return r+=`${i(e.slice(s))}$`,new RegExp(r)},y=async(e,t,i,r)=>{if(t==="disk")return{resolvedFrom:"disk",version:e.version};if(t==="registry"){const l=w(e,r.perPackageConfig??{}),n=await $(l).readPublishedVersion({pkg:e,pm:r.pm,workspaceConfig:r.workspaceConfig});return n&&u.valid(n)?{resolvedFrom:"registry",version:n}:{fallbackReason:n===void 0?`registry returned no version for ${e.name} (likely a 404 / not-yet-published); falling back to manifest version ${e.version}.`:`registry returned an invalid semver "${n}" for ${e.name}; falling back to manifest version ${e.version}.`,resolvedFrom:"disk",version:e.version}}const s=r.perPackageConfig?.releaseTagPattern??r.workspaceConfig?.releaseTagPattern??"{name}@{version}",c=s.replaceAll(/\{(name|unscopedName|version|major|minor|patch|date|channel)\}/g,(l,n)=>n==="name"?e.name:n==="unscopedName"?e.name.replace(/^@[^/]+\//,""):"*"),a=await r.runner.run("git",["tag","--list",c,"--sort=-v:refname"],{cwd:r.cwd,silent:!0});if(a.exitCode!==0)return{fallbackReason:`git tag --list ${c} failed (exit ${a.exitCode}); falling back to manifest version ${e.version}.`,resolvedFrom:"disk",version:e.version};const m=a.stdout.split(`
+import{u}from"../packem_shared/index-Cg0IHaFI.js";import{c as $}from"./registry.js";import{r as w}from"./orchestrator.js";import{defaultTagFor as T,renderTagPattern as E}from"./git.js";const R=e=>{let t=0;const i=[],r=()=>{if(t>=e)return;const s=i.shift();s&&(t+=1,s())};return async s=>new Promise((c,a)=>{const m=()=>{t-=1,r()},d=()=>{s().then(c,a).finally(m)};i.push(d),r()})},b=4,p=new Map,h=(e,t)=>{const i=m=>m.replaceAll(/[$()*+.?[\\\]^{|}]/g,String.raw`\$&`);let r="^",s=0;const c=/\{(name|unscopedName|version|major|minor|patch|date|channel)\}/g;let a;for(;(a=c.exec(e))!==null;){switch(r+=i(e.slice(s,a.index)),a[1]){case"name":{r+=i(t.name);break}case"unscopedName":{r+=i(t.name.replace(/^@[^/]+\//,""));break}case"version":{r+=String.raw`(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)`;break}default:r+="[^/]+"}s=a.index+a[0].length}return r+=`${i(e.slice(s))}$`,new RegExp(r)},y=async(e,t,i,r)=>{if(t==="disk")return{resolvedFrom:"disk",version:e.version};if(t==="registry"){const l=w(e,r.perPackageConfig??{}),n=await $(l).readPublishedVersion({pkg:e,pm:r.pm,workspaceConfig:r.workspaceConfig});return n&&u.valid(n)?{resolvedFrom:"registry",version:n}:{fallbackReason:n===void 0?`registry returned no version for ${e.name} (likely a 404 / not-yet-published); falling back to manifest version ${e.version}.`:`registry returned an invalid semver "${n}" for ${e.name}; falling back to manifest version ${e.version}.`,resolvedFrom:"disk",version:e.version}}const s=r.perPackageConfig?.releaseTagPattern??r.workspaceConfig?.releaseTagPattern??"{name}@{version}",c=s.replaceAll(/\{(name|unscopedName|version|major|minor|patch|date|channel)\}/g,(l,n)=>n==="name"?e.name:n==="unscopedName"?e.name.replace(/^@[^/]+\//,""):"*"),a=await r.runner.run("git",["tag","--list",c,"--sort=-v:refname"],{cwd:r.cwd,silent:!0});if(a.exitCode!==0)return{fallbackReason:`git tag --list ${c} failed (exit ${a.exitCode}); falling back to manifest version ${e.version}.`,resolvedFrom:"disk",version:e.version};const m=a.stdout.split(`
 `).map(l=>l.trim()).filter(Boolean);if(m.length===0)return{fallbackReason:`no git tag matched pattern "${s}" for ${e.name}; falling back to manifest version ${e.version}. (Pass --first-release to bootstrap.)`,resolvedFrom:"disk",version:e.version};const d=h(s,e),o=[];for(const l of m){const n=d.exec(l);n?.[1]&&u.valid(n[1])&&o.push(n[1])}return o.length===0?{fallbackReason:`git tag pattern "${s}" matched tags but none yielded a valid semver for ${e.name}; falling back to manifest version ${e.version}.`,resolvedFrom:"disk",version:e.version}:(o.sort(u.rcompare),{resolvedFrom:"git-tag",version:o[0]})},C=(e,t,i)=>i?"disk":t?.currentVersionResolver??e?.currentVersionResolver??"disk",V=async(e,t,i,r,s)=>{const c=new Map,a=[],m=R(b),d=await Promise.all(e.map(async o=>m(async()=>{const l=r.get(o.name),n=C(i,l,s.firstRelease),g=s.skipRegistryLookup?"disk":n,v=`${o.name}@${g}@${o.version}`,k=p.get(v);if(k)return{mode:g,pkg:o,result:await k};const f=y(o,g,t,{...s,perPackageConfig:l,workspaceConfig:i});return p.set(v,f),f.catch(()=>{p.get(v)===f&&p.delete(v)}),{mode:g,pkg:o,result:await f}})));for(const{mode:o,pkg:l,result:n}of d)c.set(l.name,n.version),n.fallbackReason&&o!=="disk"&&a.push(`currentVersionResolver (${o}): ${n.fallbackReason}`);return{versions:c,warnings:a}};export{b as REGISTRY_LOOKUP_CONCURRENCY,h as compileReleaseTagRegex,T as defaultTagFor,E as renderTagPattern,y as resolveCurrentVersion,V as resolveCurrentVersionsForWorkspace,C as resolveModeForPackage};

package/dist/packem_shared/{advisories-aiDtubZQ.js → advisories-CefYKEPe.js}

@@ -1 +1 @@
-import{createRequire as D}from"node:module";import{E as L}from"../packem_chunks/config.js";import{advisoriesQuery as M,advisoriesIngest as W,advisoriesStatus as E,NATIVE_BINDING_VERSION as f}from"#native";const R=D(import.meta.url),l=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,c=s=>{if(typeof l<"u"&&l.versions&&l.versions.node){const[e,t]=l.versions.node.split(".").map(Number);if(e>22||e===22&&t>=3||e===20&&t>=16)return l.getBuiltinModule(s)}return R(s)},{randomUUID:I}=c("node:crypto"),{existsSync:$,createWriteStream:T}=c("node:fs"),{mkdir:O,unlink:P,stat:U}=c("node:fs/promises"),{join:g,dirname:k}=c("node:path"),{Readable:x}=c("node:stream"),{pipeline:C}=c("node:stream/promises"),w=6;if(f!==w)throw new Error(`vis native binding ABI mismatch in advisories: expected ${w}, got ${f}. Rebuild via \`pnpm --filter @visulima/vis run build:native\` or reinstall the platform binding package.`);const Q="https://osv-vulnerabilities.storage.googleapis.com",j=new Set(["osv-vulnerabilities.storage.googleapis.com"]);class q extends Error{cause="DB_NOT_FOUND";constructor(e){super(`No local advisory DB at ${e}. Run 'vis advisories sync' first.`),this.name="AdvisoryDbNotFoundError"}}class p extends Error{cause="SOURCE_NOT_ALLOWED";constructor(e){super(`Advisory source host '${e}' is not in the built-in allowlist. Add it to \`security.audit.advisories.allowedHosts\` if intentional.`),this.name="AdvisorySourceNotAllowedError"}}class A extends Error{cause="SYNC_NETWORK";constructor(e,t){super(`Advisory sync failed for ${e}: ${t}. Check connectivity, proxy env vars, or --source.`),this.name="AdvisorySyncNetworkError"}}const y=s=>{const e=L("vis",{create:!0,cwd:s})??g(s,"node_modules",".cache","vis");return g(e,"advisories","db.sqlite")},B=(s,e)=>{let t;try{t=new URL(s)}catch{throw new p(s)}if(t.protocol!=="https:")throw new p(`${t.protocol}//${t.host}`);if(!new Set([...j,...e??[]]).has(t.host))throw new p(t.host);return t},J=async s=>{const e=s.dbPath??y(s.workspaceRoot);await O(k(e),{recursive:!0});const t=B(s.source,s.allowedHosts),d=new URL(`${s.ecosystem}/all.zip`,z(t.toString())),u=await V(e,s.ecosystem);let r=null;if(!s.force){const i=await b(d,{method:"HEAD"});if(i.ok&&(r=i.headers.get("etag"),r&&u&&r===u))return{advisoriesIngested:0,dbPath:e,durationMs:0,upToDate:!0}}const n=`${e}.${s.ecosystem}.${process.pid}.${I()}.zip.tmp`,o=await b(d,{method:"GET"});if(!o.ok||!o.body)throw new A(d.toString(),o.status);r||(r=o.headers.get("etag"));const v=o.headers.get("content-length"),a=v?Number.parseInt(v,10):null;let m=0;const _=T(n),h=x.fromWeb(o.body);s.onProgress&&a&&h.on("data",i=>{m+=i.byteLength,s.onProgress?.(m,a,"download")}),await C(h,_);try{const i=await W({dbPath:e,ecosystem:s.ecosystem,manifestEtag:r??void 0,zipPath:n},(S,N)=>s.onProgress?.(S,N,"ingest"));return{advisoriesIngested:i.advisoriesIngested,dbPath:e,durationMs:i.durationMs,upToDate:!1}}finally{await P(n).catch(()=>{})}},X=(s,e)=>{if(s.length===0)return new Map;const t=e.dbPath??y(e.workspaceRoot),d=e.ecosystem??"npm";if(!$(t))throw new q(t);const u=s.map(o=>({ecosystem:d,name:o.name,version:o.version})),r=M(t,u),n=new Map;for(const[o,v]of s.entries()){const a=r[o];!a||a.vulnerabilities.length===0||n.set(v.name,a.vulnerabilities.map(m=>H(m)))}return n},Z=async(s,e)=>{const t=e??y(s);return E(t)},V=async(s,e)=>{try{await U(s)}catch{return null}return E(s).ecosystems.find(t=>t.name===e)?.manifestEtag??null},H=s=>({aliases:s.aliases.length>0?s.aliases:void 0,cvssScore:s.cvssScore??void 0,fixedVersions:s.fixedVersions,id:s.id,severity:F(s.severity),summary:s.summary}),F=s=>{const e=s.toUpperCase();return e==="CRITICAL"||e==="HIGH"||e==="MODERATE"||e==="LOW"?e:"UNKNOWN"},z=s=>s.endsWith("/")?s:`${s}/`,b=async(s,e)=>{try{return await fetch(s,e)}catch(t){throw new A(s.toString(),t instanceof Error?t.message:String(t))}};export{q as A,Q as D,Z as g,X as q,y as r,J as s};
+import{createRequire as D}from"node:module";import{E as L}from"./target-merge-DOm6h6tW.js";import{advisoriesQuery as M,advisoriesIngest as W,advisoriesStatus as E,NATIVE_BINDING_VERSION as f}from"#native";const R=D(import.meta.url),l=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,c=s=>{if(typeof l<"u"&&l.versions&&l.versions.node){const[e,t]=l.versions.node.split(".").map(Number);if(e>22||e===22&&t>=3||e===20&&t>=16)return l.getBuiltinModule(s)}return R(s)},{randomUUID:I}=c("node:crypto"),{existsSync:$,createWriteStream:T}=c("node:fs"),{mkdir:O,unlink:P,stat:U}=c("node:fs/promises"),{join:g,dirname:k}=c("node:path"),{Readable:x}=c("node:stream"),{pipeline:C}=c("node:stream/promises"),w=6;if(f!==w)throw new Error(`vis native binding ABI mismatch in advisories: expected ${w}, got ${f}. Rebuild via \`pnpm --filter @visulima/vis run build:native\` or reinstall the platform binding package.`);const Q="https://osv-vulnerabilities.storage.googleapis.com",j=new Set(["osv-vulnerabilities.storage.googleapis.com"]);class q extends Error{cause="DB_NOT_FOUND";constructor(e){super(`No local advisory DB at ${e}. Run 'vis advisories sync' first.`),this.name="AdvisoryDbNotFoundError"}}class p extends Error{cause="SOURCE_NOT_ALLOWED";constructor(e){super(`Advisory source host '${e}' is not in the built-in allowlist. Add it to \`security.audit.advisories.allowedHosts\` if intentional.`),this.name="AdvisorySourceNotAllowedError"}}class A extends Error{cause="SYNC_NETWORK";constructor(e,t){super(`Advisory sync failed for ${e}: ${t}. Check connectivity, proxy env vars, or --source.`),this.name="AdvisorySyncNetworkError"}}const y=s=>{const e=L("vis",{create:!0,cwd:s})??g(s,"node_modules",".cache","vis");return g(e,"advisories","db.sqlite")},B=(s,e)=>{let t;try{t=new URL(s)}catch{throw new p(s)}if(t.protocol!=="https:")throw new p(`${t.protocol}//${t.host}`);if(!new Set([...j,...e??[]]).has(t.host))throw new p(t.host);return t},J=async s=>{const e=s.dbPath??y(s.workspaceRoot);await O(k(e),{recursive:!0});const t=B(s.source,s.allowedHosts),d=new URL(`${s.ecosystem}/all.zip`,z(t.toString())),u=await V(e,s.ecosystem);let r=null;if(!s.force){const i=await b(d,{method:"HEAD"});if(i.ok&&(r=i.headers.get("etag"),r&&u&&r===u))return{advisoriesIngested:0,dbPath:e,durationMs:0,upToDate:!0}}const n=`${e}.${s.ecosystem}.${process.pid}.${I()}.zip.tmp`,o=await b(d,{method:"GET"});if(!o.ok||!o.body)throw new A(d.toString(),o.status);r||(r=o.headers.get("etag"));const v=o.headers.get("content-length"),a=v?Number.parseInt(v,10):null;let m=0;const _=T(n),h=x.fromWeb(o.body);s.onProgress&&a&&h.on("data",i=>{m+=i.byteLength,s.onProgress?.(m,a,"download")}),await C(h,_);try{const i=await W({dbPath:e,ecosystem:s.ecosystem,manifestEtag:r??void 0,zipPath:n},(S,N)=>s.onProgress?.(S,N,"ingest"));return{advisoriesIngested:i.advisoriesIngested,dbPath:e,durationMs:i.durationMs,upToDate:!1}}finally{await P(n).catch(()=>{})}},X=(s,e)=>{if(s.length===0)return new Map;const t=e.dbPath??y(e.workspaceRoot),d=e.ecosystem??"npm";if(!$(t))throw new q(t);const u=s.map(o=>({ecosystem:d,name:o.name,version:o.version})),r=M(t,u),n=new Map;for(const[o,v]of s.entries()){const a=r[o];!a||a.vulnerabilities.length===0||n.set(v.name,a.vulnerabilities.map(m=>H(m)))}return n},Z=async(s,e)=>{const t=e??y(s);return E(t)},V=async(s,e)=>{try{await U(s)}catch{return null}return E(s).ecosystems.find(t=>t.name===e)?.manifestEtag??null},H=s=>({aliases:s.aliases.length>0?s.aliases:void 0,cvssScore:s.cvssScore??void 0,fixedVersions:s.fixedVersions,id:s.id,severity:F(s.severity),summary:s.summary}),F=s=>{const e=s.toUpperCase();return e==="CRITICAL"||e==="HIGH"||e==="MODERATE"||e==="LOW"?e:"UNKNOWN"},z=s=>s.endsWith("/")?s:`${s}/`,b=async(s,e)=>{try{return await fetch(s,e)}catch(t){throw new A(s.toString(),t instanceof Error?t.message:String(t))}};export{q as A,Q as D,Z as g,X as q,y as r,J as s};

package/dist/packem_shared/{ai-analysis-CubpCxZJ.js → ai-analysis-Co-b15d_.js}

@@ -1,5 +1,5 @@
-import{createRequire as G}from"node:module";import{aw as ee,ax as te,ay as re,h as ae,d as f,a2 as se,m as k,e as oe,az as ne}from"../packem_chunks/cli-main.js";import"./bin-CnDBuLh3.js";const K=G(import.meta.url),M=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,S=e=>{if(typeof M<"u"&&M.versions&&M.versions.node){const[a,t]=M.versions.node.split(".").map(Number);if(a>22||a===22&&t>=3||a===20&&t>=16)return M.getBuiltinModule(e)}return K(e)},{spawn:Y,execFileSync:N,execFile:X}=S("node:child_process"),{existsSync:_}=S("node:fs"),{platform:Z,homedir:P}=S("node:os"),{join:h}=S("node:path"),{promisify:Q}=S("node:util"),ie=/v?(\d+\.\d+\.\d+(?:-[\w.]+)?)/,ue=5e3,ce=1e4,de=3e5,le=4096,T=Z()==="win32",q=["amp","claude","codex","copilot","crush","cursor","droid","gemini","kimi","opencode","qwen"];class w extends Error{exitCode;durationMs;provider;stderr;stdout;timedOut;aborted;constructor(a,t){super(a),this.name="AiRunError",this.provider=t.provider,this.exitCode=t.exitCode??null,this.durationMs=t.durationMs,this.stdout=t.stdout??"",this.stderr=t.stderr??"",this.timedOut=t.timedOut??!1,this.aborted=t.aborted??!1}}const pe={alternateCommands:[],buildArgs:(e,{dangerous:a})=>{const t=["-x",e];return a&&t.push("--dangerously-allow-all"),t},command:"amp",defaultModel:"",envVariable:"AMP_PATH",supportsMaxTokens:!1,supportsModel:!1},me={alternateCommands:[],buildArgs:(e,{dangerous:a,model:t})=>{const r=[];return a&&r.push("--dangerously-skip-permissions"),t&&r.push("--model",t),r.push("--output-format","text","-p",e),r},command:"claude",defaultModel:"",envVariable:"CLAUDE_PATH",supportsMaxTokens:!1,supportsModel:!0},ge={alternateCommands:["openai-codex"],buildArgs:(e,{dangerous:a,model:t})=>{const r=["exec"];return t&&r.push("--model",t),a&&r.push("--dangerously-bypass-approvals-and-sandbox"),r.push(e),r},command:"codex",defaultModel:"",envVariable:"CODEX_PATH",supportsMaxTokens:!1,supportsModel:!0},he={alternateCommands:[],buildArgs:(e,{dangerous:a,model:t})=>{const r=["-p",e];return a&&r.push("--allow-all-tools"),t&&r.push("--model",t),r},command:"copilot",defaultModel:"",envVariable:"COPILOT_PATH",supportsMaxTokens:!1,supportsModel:!0},fe={alternateCommands:[],buildArgs:(e,{dangerous:a,model:t})=>{const r=["run"];return a&&r.push("--yolo"),t&&r.push("-m",t),r.push(e),r},command:"crush",defaultModel:"",envVariable:"CRUSH_PATH",supportsMaxTokens:!1,supportsModel:!0},ye={alternateCommands:["cursor"],buildArgs:(e,{dangerous:a,model:t})=>{const r=["-p"];return a&&r.push("--force"),r.push("--output-format","text"),t&&r.push("--model",t),r.push(e),r},command:"agent",defaultModel:"",envVariable:"CURSOR_PATH",supportsMaxTokens:!1,supportsModel:!0},ve={alternateCommands:[],buildArgs:(e,{dangerous:a,model:t})=>{const r=[e];return a&&r.push("--skip-permissions-unsafe"),r.push("-o","text"),t&&r.push("-m",t),r},command:"droid",defaultModel:"",envVariable:"DROID_PATH",supportsMaxTokens:!1,supportsModel:!0},be={alternateCommands:["gemini-cli"],buildArgs:(e,{dangerous:a,maxTokens:t,model:r})=>{const s=[];return a||s.push("--sandbox"),r&&s.push("--model",r),s.push("--max-output-tokens",String(t),"-p",e),s},command:"gemini",defaultModel:"gemini-2.5-pro",envVariable:"GEMINI_PATH",supportsMaxTokens:!0,supportsModel:!0},ke={alternateCommands:[],buildArgs:(e,{model:a})=>{const t=["--quiet","-p",e];return a&&t.push("-m",a),t},command:"kimi",defaultModel:"",envVariable:"KIMI_PATH",supportsMaxTokens:!1,supportsModel:!0},we={alternateCommands:[],buildArgs:(e,{model:a})=>{const t=["run",e];return a&&t.push("-m",a),t},command:"opencode",defaultModel:"",envVariable:"OPENCODE_PATH",supportsMaxTokens:!1,supportsModel:!0},Me={alternateCommands:["qwen-code"],buildArgs:(e,{dangerous:a,model:t})=>{const r=["-p",e];return a&&r.push("--yolo"),r.push("-o","text"),t&&r.push("-m",t),r},command:"qwen",defaultModel:"",envVariable:"QWEN_PATH",supportsMaxTokens:!1,supportsModel:!0};Q(X);const V={amp:pe,claude:me,codex:ge,copilot:he,crush:fe,cursor:ye,droid:ve,gemini:be,kimi:ke,opencode:we,qwen:Me},Se=/\.(?:bat|cmd)$/i,D=e=>T&&Se.test(e),L=e=>`"${e.replaceAll('"','""')}"`,O=e=>e==="~"||e.startsWith("~/")||T&&e.startsWith("~\\")?h(P(),e.slice(2)):e,Ae=e=>{try{const a=N(T?"where":"which",[e],{encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:ue}).trim().split(`
-`)[0]?.trim();return a&&a.length>0?a:void 0}catch{return}},$e=e=>{const a=P();if(T){const t=process.env.APPDATA??"",r=process.env.LOCALAPPDATA??"",s=process.env.ProgramFiles??"";return[h(t,"npm",`${e}.cmd`),h(t,"npm",e),h(r,"Programs",e,`${e}.exe`),h(s,e,`${e}.exe`),h(a,".npm-global","bin",`${e}.cmd`)]}return[`/opt/homebrew/bin/${e}`,`/usr/local/bin/${e}`,h(a,".npm-global","bin",e),h(a,".local","bin",e),h(a,".cargo","bin",e)]},Te=e=>{try{const a=N(e,["--version"],{encoding:"utf8",shell:D(e),stdio:["pipe","pipe","pipe"],timeout:ce}),t=ie.exec(a);return t?t[1]:void 0}catch{return}},F=(e,a={})=>{const t=V[e],r={available:!1,name:e},s=a.version!==!1,o=i=>{if(s)return Te(i)},n=process.env[t.envVariable];if(n&&_(O(n))){const i=O(n);return{...r,available:!0,detectionMethod:"envvar",path:i,version:o(i)}}const c=[t.command,...t.alternateCommands];for(const i of c){const u=Ae(i);if(u)return{...r,available:!0,detectionMethod:"which",path:u,version:o(u)}}for(const i of c)for(const u of $e(i))if(_(u))return{...r,available:!0,detectionMethod:"known-path",path:u,version:o(u)};return r},xe=(e={})=>q.map(a=>F(a,e)),Ce=(e={})=>xe(e).filter(a=>a.available),Ee=(e,a,t={})=>{const r=V[e],s=t.model??r.defaultModel,o=t.maxTokens!==void 0&&Number.isFinite(t.maxTokens)?t.maxTokens:le;return r.buildArgs(a,{dangerous:t.dangerous===!0,maxTokens:o,model:s})},Re=async(e,a,t={})=>{if(!e.available||!e.path)throw new w(`AI provider "${e.name}" is not available.`,{durationMs:0,provider:e.name});const r=Ee(e.name,a,t),s=t.timeoutMs!==void 0&&Number.isFinite(t.timeoutMs)?t.timeoutMs:de,o=e.path,n=D(o),c=Date.now();if(t.signal?.aborted)throw new w(`${e.name} CLI run was aborted.`,{aborted:!0,durationMs:0,provider:e.name});return new Promise((i,u)=>{const m={cwd:t.cwd,env:{...process.env,...t.env,FORCE_COLOR:"0",NO_COLOR:"1"},shell:n,stdio:["pipe","pipe","pipe"]},l=n?r.map(d=>L(d)):r,g=Y(n?L(o):o,l,m);g.stdin?.end();let y="",v="",b=!1,E,R,A;const x=()=>{clearTimeout(R),clearTimeout(E),A&&t.signal?.removeEventListener("abort",A)},J=()=>{g.kill("SIGKILL")},I=d=>{if(b)return;b=!0,g.kill("SIGTERM"),E=setTimeout(J,5e3),x();const p=Date.now()-c,W=d?new w(`${e.name} CLI run was aborted.`,{aborted:!0,durationMs:p,provider:e.name,stderr:v,stdout:y}):new w(`${e.name} CLI timed out after ${String(s)}ms`,{durationMs:p,provider:e.name,stderr:v,stdout:y,timedOut:!0});u(W)};R=setTimeout(I,s,!1),A=()=>{I(!0)},t.signal?.addEventListener("abort",A,{once:!0}),g.stdout?.on("data",d=>{const p=d.toString("utf8");y+=p,t.onStdout?.(p)}),g.stderr?.on("data",d=>{const p=d.toString("utf8");v+=p,t.onStderr?.(p)}),g.on("close",d=>{if(b)return;b=!0,x();const p=Date.now()-c;d===0?i({durationMs:p,exitCode:d,provider:e.name,stderr:v,stdout:y}):u(new w(`${e.name} CLI exited with code ${String(d)}: ${v||y}`,{durationMs:p,exitCode:d,provider:e.name,stderr:v,stdout:y}))}),g.on("error",d=>{b||(b=!0,x(),u(new w(`Failed to spawn ${e.name} CLI: ${d.message}`,{durationMs:Date.now()-c,provider:e.name,stderr:v,stdout:y})))})})},Ie=12e4,_e=2,Le=1e3,Oe=e=>new Promise(a=>{setTimeout(a,e)}),H=async(e,a,t=_e)=>{let r;for(let s=0;s<=t;s+=1)try{return(await Re(e,a,{timeoutMs:Ie})).stdout}catch(o){if(r=o instanceof Error?o:new Error(String(o)),r.message.includes("timed out"))throw r;if(s<t){const n=Le*2**s;await Oe(n)}}throw r??new Error("AI request failed after retries")},je={amp:30,claude:80,codex:60,copilot:50,crush:35,cursor:40,droid:20,gemini:100,kimi:25,opencode:35,qwen:30},Ne=e=>{if(e?.provider){if(!q.includes(e.provider))return;const r=F(e.provider);return r.available?r:void 0}const a=Ce();if(a.length===0)return;const t={...je,...e?.priority};return a.toSorted((r,s)=>(t[s.name]??0)-(t[r.name]??0))[0]},Pe=new Set(["defer","review","skip","update"]),qe=new Set(["critical","high","low","medium"]),Ve=new Set(["high","low","medium"]),De=50,C=30,Fe=e=>e.map(a=>{const t=a.vulnerabilities&&a.vulnerabilities.length>0?` [VULNERABILITIES: ${a.vulnerabilities.map(s=>`${s.severity} ${s.id}`).join(", ")}]`:"";let r="";if(a.socketReport){const s=Math.round(a.socketReport.score.overall*100),o=[`score:${String(s)}%`];if(a.socketReport.alerts.length>0){const n={};for(const i of a.socketReport.alerts)n[i.severity]=(n[i.severity]??0)+1;const c=Object.entries(n).map(([i,u])=>`${String(u)} ${i}`).join(", ");o.push(`alerts: ${c}`)}o.push(`supply-chain:${String(Math.round(a.socketReport.score.supplyChain*100))}%`),o.push(`quality:${String(Math.round(a.socketReport.score.quality*100))}%`),r=` [SOCKET.DEV: ${o.join(", ")}]`}return`- ${a.packageName}: ${a.currentRange} → ${a.newRange} (${a.updateType})${t}${r}`}).join(`
+import{createRequire as K}from"node:module";import{h as ee,c as f,n as te,i as k,d as re}from"../packem_chunks/catalog.js";import"./env-XJzocuUP.js";import"./window-ops-DDePlWLV.js";import{K as ae,M as se,Q as oe,T as ne}from"../packem_chunks/cli-main.js";const G=K(import.meta.url),M=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,S=e=>{if(typeof M<"u"&&M.versions&&M.versions.node){const[a,t]=M.versions.node.split(".").map(Number);if(a>22||a===22&&t>=3||a===20&&t>=16)return M.getBuiltinModule(e)}return G(e)},{spawn:Y,execFileSync:N,execFile:Q}=S("node:child_process"),{existsSync:_}=S("node:fs"),{platform:X,homedir:P}=S("node:os"),{join:h}=S("node:path"),{promisify:Z}=S("node:util"),ie=/v?(\d+\.\d+\.\d+(?:-[\w.]+)?)/,ue=5e3,ce=1e4,de=3e5,le=4096,T=X()==="win32",q=["amp","claude","codex","copilot","crush","cursor","droid","gemini","kimi","opencode","qwen"];class w extends Error{exitCode;durationMs;provider;stderr;stdout;timedOut;aborted;constructor(a,t){super(a),this.name="AiRunError",this.provider=t.provider,this.exitCode=t.exitCode??null,this.durationMs=t.durationMs,this.stdout=t.stdout??"",this.stderr=t.stderr??"",this.timedOut=t.timedOut??!1,this.aborted=t.aborted??!1}}const pe={alternateCommands:[],buildArgs:(e,{dangerous:a})=>{const t=["-x",e];return a&&t.push("--dangerously-allow-all"),t},command:"amp",defaultModel:"",envVariable:"AMP_PATH",supportsMaxTokens:!1,supportsModel:!1},me={alternateCommands:[],buildArgs:(e,{dangerous:a,model:t})=>{const r=[];return a&&r.push("--dangerously-skip-permissions"),t&&r.push("--model",t),r.push("--output-format","text","-p",e),r},command:"claude",defaultModel:"",envVariable:"CLAUDE_PATH",supportsMaxTokens:!1,supportsModel:!0},ge={alternateCommands:["openai-codex"],buildArgs:(e,{dangerous:a,model:t})=>{const r=["exec"];return t&&r.push("--model",t),a&&r.push("--dangerously-bypass-approvals-and-sandbox"),r.push(e),r},command:"codex",defaultModel:"",envVariable:"CODEX_PATH",supportsMaxTokens:!1,supportsModel:!0},he={alternateCommands:[],buildArgs:(e,{dangerous:a,model:t})=>{const r=["-p",e];return a&&r.push("--allow-all-tools"),t&&r.push("--model",t),r},command:"copilot",defaultModel:"",envVariable:"COPILOT_PATH",supportsMaxTokens:!1,supportsModel:!0},fe={alternateCommands:[],buildArgs:(e,{dangerous:a,model:t})=>{const r=["run"];return a&&r.push("--yolo"),t&&r.push("-m",t),r.push(e),r},command:"crush",defaultModel:"",envVariable:"CRUSH_PATH",supportsMaxTokens:!1,supportsModel:!0},ye={alternateCommands:["cursor"],buildArgs:(e,{dangerous:a,model:t})=>{const r=["-p"];return a&&r.push("--force"),r.push("--output-format","text"),t&&r.push("--model",t),r.push(e),r},command:"agent",defaultModel:"",envVariable:"CURSOR_PATH",supportsMaxTokens:!1,supportsModel:!0},ve={alternateCommands:[],buildArgs:(e,{dangerous:a,model:t})=>{const r=[e];return a&&r.push("--skip-permissions-unsafe"),r.push("-o","text"),t&&r.push("-m",t),r},command:"droid",defaultModel:"",envVariable:"DROID_PATH",supportsMaxTokens:!1,supportsModel:!0},be={alternateCommands:["gemini-cli"],buildArgs:(e,{dangerous:a,maxTokens:t,model:r})=>{const s=[];return a||s.push("--sandbox"),r&&s.push("--model",r),s.push("--max-output-tokens",String(t),"-p",e),s},command:"gemini",defaultModel:"gemini-2.5-pro",envVariable:"GEMINI_PATH",supportsMaxTokens:!0,supportsModel:!0},ke={alternateCommands:[],buildArgs:(e,{model:a})=>{const t=["--quiet","-p",e];return a&&t.push("-m",a),t},command:"kimi",defaultModel:"",envVariable:"KIMI_PATH",supportsMaxTokens:!1,supportsModel:!0},we={alternateCommands:[],buildArgs:(e,{model:a})=>{const t=["run",e];return a&&t.push("-m",a),t},command:"opencode",defaultModel:"",envVariable:"OPENCODE_PATH",supportsMaxTokens:!1,supportsModel:!0},Me={alternateCommands:["qwen-code"],buildArgs:(e,{dangerous:a,model:t})=>{const r=["-p",e];return a&&r.push("--yolo"),r.push("-o","text"),t&&r.push("-m",t),r},command:"qwen",defaultModel:"",envVariable:"QWEN_PATH",supportsMaxTokens:!1,supportsModel:!0};Z(Q);const V={amp:pe,claude:me,codex:ge,copilot:he,crush:fe,cursor:ye,droid:ve,gemini:be,kimi:ke,opencode:we,qwen:Me},Se=/\.(?:bat|cmd)$/i,D=e=>T&&Se.test(e),L=e=>`"${e.replaceAll('"','""')}"`,O=e=>e==="~"||e.startsWith("~/")||T&&e.startsWith("~\\")?h(P(),e.slice(2)):e,Ae=e=>{try{const a=N(T?"where":"which",[e],{encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:ue}).trim().split(`
+`)[0]?.trim();return a&&a.length>0?a:void 0}catch{return}},$e=e=>{const a=P();if(T){const t=process.env.APPDATA??"",r=process.env.LOCALAPPDATA??"",s=process.env.ProgramFiles??"";return[h(t,"npm",`${e}.cmd`),h(t,"npm",e),h(r,"Programs",e,`${e}.exe`),h(s,e,`${e}.exe`),h(a,".npm-global","bin",`${e}.cmd`)]}return[`/opt/homebrew/bin/${e}`,`/usr/local/bin/${e}`,h(a,".npm-global","bin",e),h(a,".local","bin",e),h(a,".cargo","bin",e)]},Te=e=>{try{const a=N(e,["--version"],{encoding:"utf8",shell:D(e),stdio:["pipe","pipe","pipe"],timeout:ce}),t=ie.exec(a);return t?t[1]:void 0}catch{return}},F=(e,a={})=>{const t=V[e],r={available:!1,name:e},s=a.version!==!1,o=i=>{if(s)return Te(i)},n=process.env[t.envVariable];if(n&&_(O(n))){const i=O(n);return{...r,available:!0,detectionMethod:"envvar",path:i,version:o(i)}}const c=[t.command,...t.alternateCommands];for(const i of c){const u=Ae(i);if(u)return{...r,available:!0,detectionMethod:"which",path:u,version:o(u)}}for(const i of c)for(const u of $e(i))if(_(u))return{...r,available:!0,detectionMethod:"known-path",path:u,version:o(u)};return r},xe=(e={})=>q.map(a=>F(a,e)),Ce=(e={})=>xe(e).filter(a=>a.available),Ee=(e,a,t={})=>{const r=V[e],s=t.model??r.defaultModel,o=t.maxTokens!==void 0&&Number.isFinite(t.maxTokens)?t.maxTokens:le;return r.buildArgs(a,{dangerous:t.dangerous===!0,maxTokens:o,model:s})},Re=async(e,a,t={})=>{if(!e.available||!e.path)throw new w(`AI provider "${e.name}" is not available.`,{durationMs:0,provider:e.name});const r=Ee(e.name,a,t),s=t.timeoutMs!==void 0&&Number.isFinite(t.timeoutMs)?t.timeoutMs:de,o=e.path,n=D(o),c=Date.now();if(t.signal?.aborted)throw new w(`${e.name} CLI run was aborted.`,{aborted:!0,durationMs:0,provider:e.name});return new Promise((i,u)=>{const m={cwd:t.cwd,env:{...process.env,...t.env,FORCE_COLOR:"0",NO_COLOR:"1"},shell:n,stdio:["pipe","pipe","pipe"]},l=n?r.map(d=>L(d)):r,g=Y(n?L(o):o,l,m);g.stdin?.end();let y="",v="",b=!1,E,R,A;const x=()=>{clearTimeout(R),clearTimeout(E),A&&t.signal?.removeEventListener("abort",A)},z=()=>{g.kill("SIGKILL")},I=d=>{if(b)return;b=!0,g.kill("SIGTERM"),E=setTimeout(z,5e3),x();const p=Date.now()-c,W=d?new w(`${e.name} CLI run was aborted.`,{aborted:!0,durationMs:p,provider:e.name,stderr:v,stdout:y}):new w(`${e.name} CLI timed out after ${String(s)}ms`,{durationMs:p,provider:e.name,stderr:v,stdout:y,timedOut:!0});u(W)};R=setTimeout(I,s,!1),A=()=>{I(!0)},t.signal?.addEventListener("abort",A,{once:!0}),g.stdout?.on("data",d=>{const p=d.toString("utf8");y+=p,t.onStdout?.(p)}),g.stderr?.on("data",d=>{const p=d.toString("utf8");v+=p,t.onStderr?.(p)}),g.on("close",d=>{if(b)return;b=!0,x();const p=Date.now()-c;d===0?i({durationMs:p,exitCode:d,provider:e.name,stderr:v,stdout:y}):u(new w(`${e.name} CLI exited with code ${String(d)}: ${v||y}`,{durationMs:p,exitCode:d,provider:e.name,stderr:v,stdout:y}))}),g.on("error",d=>{b||(b=!0,x(),u(new w(`Failed to spawn ${e.name} CLI: ${d.message}`,{durationMs:Date.now()-c,provider:e.name,stderr:v,stdout:y})))})})},Ie=12e4,_e=2,Le=1e3,Oe=e=>new Promise(a=>{setTimeout(a,e)}),H=async(e,a,t=_e)=>{let r;for(let s=0;s<=t;s+=1)try{return(await Re(e,a,{timeoutMs:Ie})).stdout}catch(o){if(r=o instanceof Error?o:new Error(String(o)),r.message.includes("timed out"))throw r;if(s<t){const n=Le*2**s;await Oe(n)}}throw r??new Error("AI request failed after retries")},je={amp:30,claude:80,codex:60,copilot:50,crush:35,cursor:40,droid:20,gemini:100,kimi:25,opencode:35,qwen:30},Ne=e=>{if(e?.provider){if(!q.includes(e.provider))return;const r=F(e.provider);return r.available?r:void 0}const a=Ce();if(a.length===0)return;const t={...je,...e?.priority};return a.toSorted((r,s)=>(t[s.name]??0)-(t[r.name]??0))[0]},Pe=new Set(["defer","review","skip","update"]),qe=new Set(["critical","high","low","medium"]),Ve=new Set(["high","low","medium"]),De=50,C=30,Fe=e=>e.map(a=>{const t=a.vulnerabilities&&a.vulnerabilities.length>0?` [VULNERABILITIES: ${a.vulnerabilities.map(s=>`${s.severity} ${s.id}`).join(", ")}]`:"";let r="";if(a.socketReport){const s=Math.round(a.socketReport.score.overall*100),o=[`score:${String(s)}%`];if(a.socketReport.alerts.length>0){const n={};for(const i of a.socketReport.alerts)n[i.severity]=(n[i.severity]??0)+1;const c=Object.entries(n).map(([i,u])=>`${String(u)} ${i}`).join(", ");o.push(`alerts: ${c}`)}o.push(`supply-chain:${String(Math.round(a.socketReport.score.supplyChain*100))}%`),o.push(`quality:${String(Math.round(a.socketReport.score.quality*100))}%`),r=` [SOCKET.DEV: ${o.join(", ")}]`}return`- ${a.packageName}: ${a.currentRange} → ${a.newRange} (${a.updateType})${t}${r}`}).join(`
 `),$=`Respond ONLY with valid JSON in this exact structure:
 {
   "summary": "Brief overall summary",
@@ -60,9 +60,9 @@ For each package:
 5. Flag any packages where skipping the update poses security risk
 6. If Socket.dev scores are provided, factor in supply chain and quality scores — low scores indicate higher risk
 
-${$}`},Be=new Set(["compatibility","impact","recommend","security"]),tt=e=>Be.has(e)?e:"impact",B=(e,a="impact")=>{const t=Fe(e);return He[a](t)},Ue=/```(?:json)?\s*([\s\S]*?)```/,ze=/\{[\s\S]*\}/,Je=e=>{try{return JSON.parse(e)}catch{}const a=Ue.exec(e);if(a?.[1])try{return JSON.parse(a[1])}catch{}const t=ze.exec(e);if(t?.[0])try{return JSON.parse(t[0])}catch{}},We=e=>({action:Pe.has(e.action)?e.action:"review",breakingChanges:Array.isArray(e.breakingChanges)?e.breakingChanges:[],effort:Ve.has(e.effort)?e.effort:"medium",package:typeof e.package=="string"?e.package:"",reason:typeof e.reason=="string"?e.reason:"",riskLevel:qe.has(e.riskLevel)?e.riskLevel:"medium"}),U=(e,a,t)=>{const r=Je(e);if(!r||typeof r!="object")return{analysisType:t,provider:a,recommendations:[],summary:"Failed to parse AI response.",warnings:["AI response was not valid JSON."]};const s=r,o=Array.isArray(s.recommendations)?s.recommendations:[];return{analysisType:t,provider:a,recommendations:o.map(n=>We(n)),summary:typeof s.summary=="string"?s.summary:"",warnings:Array.isArray(s.warnings)?s.warnings:[]}},Ge={eslint:["ESLint 9.0: Flat config required","ESLint 8.0+: New rule formats"],next:["Next.js 13+: App router changes","Next.js 14+: Server components default"],react:["React 17 to 18: Concurrent features","React 18+: Strict mode changes"],typescript:["TypeScript 5.0: New decorators","TypeScript 4.7+: ESM changes"],vite:["Vite 5: Node.js 18+ required"],vue:["Vue 3: Composition API","Vue 3: Breaking template changes"],webpack:["Webpack 5: Node.js polyfills removed"]},Ke=new Set(["bcrypt","cors","crypto-js","express-session","helmet","jose","jsonwebtoken","node-forge","oauth","passport"]),j=(e,a)=>{const t=e.map(r=>{const s=r.vulnerabilities&&r.vulnerabilities.length>0,o=Ke.has(r.packageName),n=Ge[r.packageName]??[];let c="low",i="update",u="low",m="Patch/minor update, safe to apply.";return r.updateType==="major"?(c="high",i=n.length>0?"review":"update",u="medium",m=n.length>0?`Major update with known breaking changes: ${n[0]}`:"Major version update, review changelog before applying."):r.updateType==="minor"&&(c="medium",m="Minor update, generally safe."),s&&(c="high",i="update",m="Security update — current version has known vulnerabilities."),o&&r.updateType==="major"&&(i="review",m="Security-sensitive package with major update, careful review needed.",u="high"),{action:i,breakingChanges:n,effort:u,package:r.packageName,reason:m,riskLevel:c}});return{analysisType:a,provider:"rule-engine",recommendations:t,summary:`Rule-based ${a} analysis for ${String(e.length)} packages.`,warnings:["No AI provider available — using built-in rule engine."]}},Ye=async(e,a,t)=>{const r=B(a,t),s=await H(e,r);return U(s,e.name,t)},Xe=(e,a,t)=>{const r=[],s=[],o=[];for(const n of e)r.push(...n.recommendations),s.push(...n.warnings),n.summary&&o.push(n.summary);return{analysisType:t,provider:a,recommendations:r,summary:o.length===1?o[0]??"":`Analyzed ${String(r.length)} packages in ${String(e.length)} batches.`,warnings:[...new Set(s)]}},z={compatibility:"Compatibility",impact:"Impact",recommend:"Recommendations",security:"Security"},rt=e=>{const a=`${z[e.analysisType]??e.analysisType} Analysis (${e.provider})`,t=e.recommendations.flatMap(s=>{const o=[{action:s.action,effort:s.effort,package:s.package,reason:s.reason,risk:s.riskLevel}];return s.breakingChanges.length>0&&o.push({action:"",effort:"",package:"",reason:`Breaking: ${s.breakingChanges.join("; ")}`,risk:""}),o}),r=process.stdout.columns||80;return ae(f.createElement(se,{borderStyle:"round",flexDirection:"column",paddingLeft:1,paddingRight:1},f.createElement(k,{bold:!0},a),f.createElement(k,null,""),f.createElement(k,null,e.summary),f.createElement(k,null,""),f.createElement(oe,{borderStyle:"none",data:t}),...e.warnings.length>0?[f.createElement(k,null,""),...e.warnings.map((s,o)=>f.createElement(k,{dimColor:!0,key:String(o)},`  ${s}`))]:[]),{columns:r})},at=async(e,a,t,r="impact")=>{const s=Ne(t);if(!s)return a.info(`No AI CLI tool found, using rule-based analysis.
-`),j(e,r);const o=ee(s.name,r,e),n=te(o);if(n)return a.info(`Using cached ${r} analysis from ${n.provider}.
-`),n;const c=z[r]??r;a.info(`Running ${c.toLowerCase()} analysis with ${s.name}...
+${$}`},Be=new Set(["compatibility","impact","recommend","security"]),at=e=>Be.has(e)?e:"impact",B=(e,a="impact")=>{const t=Fe(e);return He[a](t)},Ue=/```(?:json)?\s*([\s\S]*?)```/,Je=/\{[\s\S]*\}/,ze=e=>{try{return JSON.parse(e)}catch{}const a=Ue.exec(e);if(a?.[1])try{return JSON.parse(a[1])}catch{}const t=Je.exec(e);if(t?.[0])try{return JSON.parse(t[0])}catch{}},We=e=>({action:Pe.has(e.action)?e.action:"review",breakingChanges:Array.isArray(e.breakingChanges)?e.breakingChanges:[],effort:Ve.has(e.effort)?e.effort:"medium",package:typeof e.package=="string"?e.package:"",reason:typeof e.reason=="string"?e.reason:"",riskLevel:qe.has(e.riskLevel)?e.riskLevel:"medium"}),U=(e,a,t)=>{const r=ze(e);if(!r||typeof r!="object")return{analysisType:t,provider:a,recommendations:[],summary:"Failed to parse AI response.",warnings:["AI response was not valid JSON."]};const s=r,o=Array.isArray(s.recommendations)?s.recommendations:[];return{analysisType:t,provider:a,recommendations:o.map(n=>We(n)),summary:typeof s.summary=="string"?s.summary:"",warnings:Array.isArray(s.warnings)?s.warnings:[]}},Ke={eslint:["ESLint 9.0: Flat config required","ESLint 8.0+: New rule formats"],next:["Next.js 13+: App router changes","Next.js 14+: Server components default"],react:["React 17 to 18: Concurrent features","React 18+: Strict mode changes"],typescript:["TypeScript 5.0: New decorators","TypeScript 4.7+: ESM changes"],vite:["Vite 5: Node.js 18+ required"],vue:["Vue 3: Composition API","Vue 3: Breaking template changes"],webpack:["Webpack 5: Node.js polyfills removed"]},Ge=new Set(["bcrypt","cors","crypto-js","express-session","helmet","jose","jsonwebtoken","node-forge","oauth","passport"]),j=(e,a)=>{const t=e.map(r=>{const s=r.vulnerabilities&&r.vulnerabilities.length>0,o=Ge.has(r.packageName),n=Ke[r.packageName]??[];let c="low",i="update",u="low",m="Patch/minor update, safe to apply.";return r.updateType==="major"?(c="high",i=n.length>0?"review":"update",u="medium",m=n.length>0?`Major update with known breaking changes: ${n[0]}`:"Major version update, review changelog before applying."):r.updateType==="minor"&&(c="medium",m="Minor update, generally safe."),s&&(c="high",i="update",m="Security update — current version has known vulnerabilities."),o&&r.updateType==="major"&&(i="review",m="Security-sensitive package with major update, careful review needed.",u="high"),{action:i,breakingChanges:n,effort:u,package:r.packageName,reason:m,riskLevel:c}});return{analysisType:a,provider:"rule-engine",recommendations:t,summary:`Rule-based ${a} analysis for ${String(e.length)} packages.`,warnings:["No AI provider available — using built-in rule engine."]}},Ye=async(e,a,t)=>{const r=B(a,t),s=await H(e,r);return U(s,e.name,t)},Qe=(e,a,t)=>{const r=[],s=[],o=[];for(const n of e)r.push(...n.recommendations),s.push(...n.warnings),n.summary&&o.push(n.summary);return{analysisType:t,provider:a,recommendations:r,summary:o.length===1?o[0]??"":`Analyzed ${String(r.length)} packages in ${String(e.length)} batches.`,warnings:[...new Set(s)]}},J={compatibility:"Compatibility",impact:"Impact",recommend:"Recommendations",security:"Security"},st=e=>{const a=`${J[e.analysisType]??e.analysisType} Analysis (${e.provider})`,t=e.recommendations.flatMap(s=>{const o=[{action:s.action,effort:s.effort,package:s.package,reason:s.reason,risk:s.riskLevel}];return s.breakingChanges.length>0&&o.push({action:"",effort:"",package:"",reason:`Breaking: ${s.breakingChanges.join("; ")}`,risk:""}),o}),r=process.stdout.columns||80;return ee(f.createElement(te,{borderStyle:"round",flexDirection:"column",paddingLeft:1,paddingRight:1},f.createElement(k,{bold:!0},a),f.createElement(k,null,""),f.createElement(k,null,e.summary),f.createElement(k,null,""),f.createElement(re,{borderStyle:"none",data:t}),...e.warnings.length>0?[f.createElement(k,null,""),...e.warnings.map((s,o)=>f.createElement(k,{dimColor:!0,key:String(o)},`  ${s}`))]:[]),{columns:r})},ot=async(e,a,t,r="impact")=>{const s=Ne(t);if(!s)return a.info(`No AI CLI tool found, using rule-based analysis.
+`),j(e,r);const o=ae(s.name,r,e),n=se(o);if(n)return a.info(`Using cached ${r} analysis from ${n.provider}.
+`),n;const c=J[r]??r;a.info(`Running ${c.toLowerCase()} analysis with ${s.name}...
 `);try{let i;if(e.length>De){a.info(`Splitting ${String(e.length)} packages into batches of ${String(C)}...
-`);const u=[];for(let l=0;l<e.length;l+=C)u.push(e.slice(l,l+C));const m=[];for(let l=0;l<u.length;l+=1){a.info(`  Batch ${String(l+1)}/${String(u.length)}...`);const g=u[l];g&&m.push(await Ye(s,g,r))}i=Xe(m,s.name,r)}else{const u=await H(s,B(e,r));i=U(u,s.name,r)}return re(o,i,ne(r,t?.cacheTtl)),i}catch(i){const u=i instanceof Error?i.message:String(i);return a.warn(`AI analysis failed (${u}), falling back to rule engine.
-`),j(e,r)}};export{tt as K,xe as N,Ne as R,je as S,rt as W,at as Z,Je as b,Re as h,H as r};
+`);const u=[];for(let l=0;l<e.length;l+=C)u.push(e.slice(l,l+C));const m=[];for(let l=0;l<u.length;l+=1){a.info(`  Batch ${String(l+1)}/${String(u.length)}...`);const g=u[l];g&&m.push(await Ye(s,g,r))}i=Qe(m,s.name,r)}else{const u=await H(s,B(e,r));i=U(u,s.name,r)}return oe(o,i,ne(r,t?.cacheTtl)),i}catch(i){const u=i instanceof Error?i.message:String(i);return a.warn(`AI analysis failed (${u}), falling back to rule engine.
+`),j(e,r)}};export{at as K,xe as N,Ne as R,je as S,st as W,ot as Z,ze as b,Re as h,H as r};

package/dist/packem_shared/{ai-fix-Btd5AnSr.js → ai-fix-DnJDgPN-.js}

@@ -1,5 +1,5 @@
-import{createRequire as b}from"node:module";import{readLastRunSummary as O}from"@visulima/task-runner";import{a as T}from"./failure-log-C7r6UZLP.js";import{a5 as w,a6 as j,a7 as k,y as C,z as D,a8 as P,a9 as F,aa as N}from"../packem_chunks/cli-main.js";import{A as y,B as v,m as A,y as B}from"./index-OQZQyN5R.js";import{R as E,r as M,b as q}from"./ai-analysis-CubpCxZJ.js";const $=b(import.meta.url),d=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,I=t=>{if(typeof d<"u"&&d.versions&&d.versions.node){const[e,a]=d.versions.node.split(".").map(Number);if(e>22||e===22&&a>=3||e===20&&a>=16)return d.getBuiltinModule(t)}return $(t)},{readFile:_,writeFile:R}=I("node:fs/promises"),H=32*1024,W=(t,e)=>{if(t.length<=e)return t;const a=t.slice(-e),o=t.length-a.length;return`[…${String(o)} bytes truncated from head…]
-${a}`},L=async(t,e)=>e===void 0?O(t,{dataDirectory:C(t)}):D(t,e),ut=async(t,e,a={})=>{const o=a.terminalOutputLimit??H,[s,n]=await Promise.all([T(t,e),L(t,a.runId)]),i=n?w(n,e):void 0;if(!s&&!i)return;let r,c;if(n&&i){const h=await j(t,n.id),p=h?w(h,e):void 0;r=k(i.hashDetails,p?.hashDetails),c=h?.id}const u=s?.terminalOutput??"";return{command:s?.command??void 0,cwd:s?.cwd??void 0,dependencies:i?.dependencies??[],duration:i?.duration,exitCode:s?.exitCode??i?.exitCode,hash:i?.hash??s?.hash,hashDetails:i?.hashDetails,hashDiff:r,previousRunId:c,project:i?.target.project,runId:n?.id??s?.runId,status:s?.status??(i?Y(i):void 0),target:i?.target.target,taskId:e,terminalOutput:W(u,o),terminalOutputCaptured:!!s,timestamp:s?.timestamp??i?.endTime??i?.startTime}},Y=t=>{if(t.exitCode!==void 0&&t.exitCode!==0)return"failure";switch(t.cacheStatus){case"HIT":return"local-cache";case"REMOTE_HIT":return"remote-cache";case"SKIPPED":return"skipped";default:return t.exitCode===0?"success":void 0}},J=3600*1e3,x=80,K=new Set(["high","low","medium"]),U=()=>`You are an expert software engineer helping fix a failing build/test/lint task.
+import{createRequire as b}from"node:module";import{readLastRunSummary as O}from"@visulima/task-runner";import{a as T}from"./failure-log-Sp1j-5qo.js";import{c as w,d as j,e as k,r as C,O as D,B as P,N as F}from"../packem_chunks/cli-main.js";import{c as N}from"./env-XJzocuUP.js";import{A as y,B as v,m as R,y as A}from"./index-OQZQyN5R.js";import{R as E,r as M,b as q}from"./ai-analysis-Co-b15d_.js";const $=b(import.meta.url),d=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,I=t=>{if(typeof d<"u"&&d.versions&&d.versions.node){const[e,a]=d.versions.node.split(".").map(Number);if(e>22||e===22&&a>=3||e===20&&a>=16)return d.getBuiltinModule(t)}return $(t)},{readFile:_,writeFile:B}=I("node:fs/promises"),H=32*1024,W=(t,e)=>{if(t.length<=e)return t;const a=t.slice(-e),o=t.length-a.length;return`[…${String(o)} bytes truncated from head…]
+${a}`},L=async(t,e)=>e===void 0?O(t,{dataDirectory:N(t)}):C(t,e),ht=async(t,e,a={})=>{const o=a.terminalOutputLimit??H,[s,n]=await Promise.all([T(t,e),L(t,a.runId)]),i=n?w(n,e):void 0;if(!s&&!i)return;let r,c;if(n&&i){const h=await j(t,n.id),p=h?w(h,e):void 0;r=k(i.hashDetails,p?.hashDetails),c=h?.id}const u=s?.terminalOutput??"";return{command:s?.command??void 0,cwd:s?.cwd??void 0,dependencies:i?.dependencies??[],duration:i?.duration,exitCode:s?.exitCode??i?.exitCode,hash:i?.hash??s?.hash,hashDetails:i?.hashDetails,hashDiff:r,previousRunId:c,project:i?.target.project,runId:n?.id??s?.runId,status:s?.status??(i?Y(i):void 0),target:i?.target.target,taskId:e,terminalOutput:W(u,o),terminalOutputCaptured:!!s,timestamp:s?.timestamp??i?.endTime??i?.startTime}},Y=t=>{if(t.exitCode!==void 0&&t.exitCode!==0)return"failure";switch(t.cacheStatus){case"HIT":return"local-cache";case"REMOTE_HIT":return"remote-cache";case"SKIPPED":return"skipped";default:return t.exitCode===0?"success":void 0}},J=3600*1e3,x=80,K=new Set(["high","low","medium"]),U=()=>`You are an expert software engineer helping fix a failing build/test/lint task.
 
 You will be given:
 - The terminal output (stdout/stderr) from the failed task.
@@ -32,12 +32,12 @@ Respond ONLY with valid JSON in this exact structure:
   "cannotFix": "optional — set when no safe patch can be proposed"
 }`,f=(t,e)=>{const a=[];if(e.added.length>0&&a.push(`  added: ${e.added.join(", ")}`),e.changed.length>0&&a.push(`  changed: ${e.changed.join(", ")}`),e.removed.length>0&&a.push(`  removed: ${e.removed.join(", ")}`),a.length!==0)return`- ${t}:
 ${a.join(`
-`)}`},z=t=>{if(!t.hashDiff)return"No hash-diff available — there is no previous run to compare against.";const e=[];t.hashDiff.commandChanged&&e.push("- command line changed since previous run");const a=f("file inputs",t.hashDiff.nodes),o=f("implicit deps",t.hashDiff.implicitDeps),s=f("runtime/env",t.hashDiff.runtime);return a&&e.push(a),o&&e.push(o),s&&e.push(s),e.length===0?"No detectable changes between this run and the previous run.":e.join(`
-`)},G=t=>{const e=[`Task: ${t.taskId}`];return t.project&&e.push(`Project: ${t.project}`),t.target&&e.push(`Target: ${t.target}`),t.command&&e.push(`Command: ${t.command}`),t.cwd&&e.push(`CWD: ${t.cwd}`),t.exitCode!==void 0&&e.push(`Exit code: ${String(t.exitCode)}`),t.hash&&e.push(`Task hash: ${t.hash}`),e.push("","Hash-diff since previous run:",z(t),""),t.terminalOutputCaptured?e.push("Terminal output:","```",t.terminalOutput,"```"):e.push("Terminal output: <no failure log was captured for this task>",'Set "cannotFix" and tell the user to re-run with `vis run` so logs can be captured.'),e.join(`
-`)},V=t=>`${U()}
+`)}`},G=t=>{if(!t.hashDiff)return"No hash-diff available — there is no previous run to compare against.";const e=[];t.hashDiff.commandChanged&&e.push("- command line changed since previous run");const a=f("file inputs",t.hashDiff.nodes),o=f("implicit deps",t.hashDiff.implicitDeps),s=f("runtime/env",t.hashDiff.runtime);return a&&e.push(a),o&&e.push(o),s&&e.push(s),e.length===0?"No detectable changes between this run and the previous run.":e.join(`
+`)},V=t=>{const e=[`Task: ${t.taskId}`];return t.project&&e.push(`Project: ${t.project}`),t.target&&e.push(`Target: ${t.target}`),t.command&&e.push(`Command: ${t.command}`),t.cwd&&e.push(`CWD: ${t.cwd}`),t.exitCode!==void 0&&e.push(`Exit code: ${String(t.exitCode)}`),t.hash&&e.push(`Task hash: ${t.hash}`),e.push("","Hash-diff since previous run:",G(t),""),t.terminalOutputCaptured?e.push("Terminal output:","```",t.terminalOutput,"```"):e.push("Terminal output: <no failure log was captured for this task>",'Set "cannotFix" and tell the user to re-run with `vis run` so logs can be captured.'),e.join(`
+`)},z=t=>`${U()}
 
-${G(t)}`,Q=(t,e)=>{const a=Array.isArray(t.patches)?t.patches:[],o=[];for(const n of a)typeof n.file!="string"||n.file.length===0||typeof n.oldString!="string"||n.oldString.length===0||typeof n.newString=="string"&&o.push({file:n.file,newString:n.newString,oldString:n.oldString,reason:typeof n.reason=="string"&&n.reason.length>0?n.reason:void 0});const s=typeof t.cannotFix=="string"&&t.cannotFix.length>0?t.cannotFix:void 0;return{cannotFix:s,confidence:K.has(t.confidence)?t.confidence:"low",explanation:typeof t.explanation=="string"?t.explanation:"",patches:s?[]:o,provider:e}},X=(t,e)=>{const a=q(t);return!a||typeof a!="object"?{cannotFix:"AI response was not valid JSON.",confidence:"low",explanation:"Failed to parse AI response.",patches:[],provider:e}:Q(a,e)},Z=(t,e)=>N({cwd:e.cwd??null,flow:"ai-fix",hash:e.hash??null,provider:t,taskId:e.taskId,terminalOutput:e.terminalOutput,terminalOutputCaptured:e.terminalOutputCaptured}),ht=async(t,e,a={})=>{const o=E(a.config);if(!o){e.warn(`No AI provider available — install one of: claude, gemini, copilot, codex.
-`);return}const s=a.cache!==!1,n=Z(o.name,t);if(s){const i=P(n);if(i)return e.info(`Using cached fix proposal from ${i.provider}.
+${V(t)}`,Q=(t,e)=>{const a=Array.isArray(t.patches)?t.patches:[],o=[];for(const n of a)typeof n.file!="string"||n.file.length===0||typeof n.oldString!="string"||n.oldString.length===0||typeof n.newString=="string"&&o.push({file:n.file,newString:n.newString,oldString:n.oldString,reason:typeof n.reason=="string"&&n.reason.length>0?n.reason:void 0});const s=typeof t.cannotFix=="string"&&t.cannotFix.length>0?t.cannotFix:void 0;return{cannotFix:s,confidence:K.has(t.confidence)?t.confidence:"low",explanation:typeof t.explanation=="string"?t.explanation:"",patches:s?[]:o,provider:e}},X=(t,e)=>{const a=q(t);return!a||typeof a!="object"?{cannotFix:"AI response was not valid JSON.",confidence:"low",explanation:"Failed to parse AI response.",patches:[],provider:e}:Q(a,e)},Z=(t,e)=>F({cwd:e.cwd??null,flow:"ai-fix",hash:e.hash??null,provider:t,taskId:e.taskId,terminalOutput:e.terminalOutput,terminalOutputCaptured:e.terminalOutputCaptured}),dt=async(t,e,a={})=>{const o=E(a.config);if(!o){e.warn(`No AI provider available — install one of: claude, gemini, copilot, codex.
+`);return}const s=a.cache!==!1,n=Z(o.name,t);if(s){const i=D(n);if(i)return e.info(`Using cached fix proposal from ${i.provider}.
 `),i}e.info(`Generating fix proposal with ${o.name}...
-`);try{const i=await M(o,V(t)),r=X(i,o.name);return s&&r.patches.length>0&&!r.cannotFix&&F(n,r,J),r}catch(i){const r=i instanceof Error?i.message:String(i);e.warn(`AI fix proposal failed (${r}).
-`);return}},tt=(t,e,a)=>y(a)?v(a):v(A(e??t,a)),et=(t,e)=>{const a=B(t,e);return a===""?!0:!a.startsWith("..")&&!y(a)},at=(t,e,a)=>{const o=t.indexOf(e),s=Math.max(0,o-x),n=Math.min(t.length,o+e.length+x),i=t.slice(s,n);return{previewAfter:`${t.slice(s,o)}${a}${t.slice(o+e.length,n)}`,previewBefore:i}},dt=async(t,e,a,o={})=>{const s=o.dryRun===!0,n=new Map,i=[];for(const r of a.patches){const c=tt(t,e,r.file);if(!et(t,c)){i.push({absolutePath:c,patch:r,status:"outside-workspace"});continue}let u=n.get(c);if(u===void 0){try{u=await _(c,"utf8")}catch(l){const g=l.code;i.push({absolutePath:c,error:g==="ENOENT"?void 0:l.message,patch:r,status:g==="ENOENT"?"missing-file":"error"});continue}n.set(c,u)}const h=u.indexOf(r.oldString);if(h===-1){i.push({absolutePath:c,patch:r,status:"no-match"});continue}if(u.indexOf(r.oldString,h+r.oldString.length)!==-1){i.push({absolutePath:c,patch:r,status:"ambiguous-match"});continue}const{previewAfter:p,previewBefore:S}=at(u,r.oldString,r.newString),m=`${u.slice(0,h)}${r.newString}${u.slice(h+r.oldString.length)}`;if(!s)try{await R(c,m,"utf8")}catch(l){n.delete(c),i.push({absolutePath:c,error:l.message,patch:r,status:"error"});continue}n.set(c,m),i.push({absolutePath:c,patch:r,previewAfter:p,previewBefore:S,status:"applied"})}return i};export{ut as a,dt as b,tt as c,ht as r};
+`);try{const i=await M(o,z(t)),r=X(i,o.name);return s&&r.patches.length>0&&!r.cannotFix&&P(n,r,J),r}catch(i){const r=i instanceof Error?i.message:String(i);e.warn(`AI fix proposal failed (${r}).
+`);return}},tt=(t,e,a)=>y(a)?v(a):v(R(e??t,a)),et=(t,e)=>{const a=A(t,e);return a===""?!0:!a.startsWith("..")&&!y(a)},at=(t,e,a)=>{const o=t.indexOf(e),s=Math.max(0,o-x),n=Math.min(t.length,o+e.length+x),i=t.slice(s,n);return{previewAfter:`${t.slice(s,o)}${a}${t.slice(o+e.length,n)}`,previewBefore:i}},lt=async(t,e,a,o={})=>{const s=o.dryRun===!0,n=new Map,i=[];for(const r of a.patches){const c=tt(t,e,r.file);if(!et(t,c)){i.push({absolutePath:c,patch:r,status:"outside-workspace"});continue}let u=n.get(c);if(u===void 0){try{u=await _(c,"utf8")}catch(l){const g=l.code;i.push({absolutePath:c,error:g==="ENOENT"?void 0:l.message,patch:r,status:g==="ENOENT"?"missing-file":"error"});continue}n.set(c,u)}const h=u.indexOf(r.oldString);if(h===-1){i.push({absolutePath:c,patch:r,status:"no-match"});continue}if(u.indexOf(r.oldString,h+r.oldString.length)!==-1){i.push({absolutePath:c,patch:r,status:"ambiguous-match"});continue}const{previewAfter:p,previewBefore:S}=at(u,r.oldString,r.newString),m=`${u.slice(0,h)}${r.newString}${u.slice(h+r.oldString.length)}`;if(!s)try{await B(c,m,"utf8")}catch(l){n.delete(c),i.push({absolutePath:c,error:l.message,patch:r,status:"error"});continue}n.set(c,m),i.push({absolutePath:c,patch:r,previewAfter:p,previewBefore:S,status:"applied"})}return i};export{ht as a,lt as b,tt as c,dt as r};

package/dist/packem_shared/bin-DDq2oszw.js

@@ -0,0 +1 @@
+import{createRequire as g}from"node:module";import{c as b}from"./compile-cache-B_Vf_WxT.js";import{i as T,h as y,t as R,p as m,c as w}from"./runtime-process-Dmz0vCJy-DUwTvH1J.js";import"./window-ops-DDePlWLV.js";import"./index.server-J83sowC4.js";import"./index-OQZQyN5R.js";import{I as O}from"./index-B0EsgdzO.js";import{a as I}from"./readJsonSync-CvkZyKmL-CY7PZob_.js";const _=g(import.meta.url),r=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,x=e=>{if(typeof r<"u"&&r.versions&&r.versions.node){const[s,o]=r.versions.node.split(".").map(Number);if(s>22||s===22&&o>=3||s===20&&o>=16)return r.getBuiltinModule(e)}return _(e)},{createRequire:S}=x("node:module"),M=S(import.meta.url),t=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,f=e=>{if(typeof t<"u"&&t.versions&&t.versions.node){const[s,o]=t.versions.node.split(".").map(Number);if(s>22||s===22&&o>=3||s===20&&o>=16)return t.getBuiltinModule(e)}return M(e)},{execFileSync:N}=f("node:child_process"),{totalmem:$}=f("node:os"),j=/--max-old-space-size=(\d+)/,V=/--max-semi-space-size=(\d+)/,E=e=>Math.floor($()/1024/1024*e),q=e=>e<=512?4:e<=1024?8:e<=2048?16:e<=4096?32:e<=8192?64:Math.floor(Math.log2(e))*8,d=(e,s)=>{for(const o of s){const n=e.exec(o);if(n)return Number.parseInt(n[1],10)}},z=e=>{const o=[...w()],n=[...T()],a=d(j,o),p=d(V,o);if(a!==void 0&&p!==void 0)return;const l=a??E(.75),v=p??q(l),c=[];if(a===void 0&&c.push(`--max-old-space-size=${String(l)}`),p===void 0&&c.push(`--max-semi-space-size=${String(v)}`),c.length!==0)try{N(y(),[...c,...o,...n.slice(1)],{env:R(),stdio:"inherit"}),m(0)}catch(h){const u=h.status;m(typeof u=="number"?u:1)}},C=()=>{if(process.env.VIS_VERSION)return process.env.VIS_VERSION;try{const e=new URL("../../package.json",import.meta.url);return I(e).version}catch{return"0.0.0"}},B=()=>{process.env.VIS_VERSION=C()},G=e=>{!process.stdout.isTTY||O||process.env.TERM==="dumb"||process.stdout.write(`\x1B]0;${e}\x07`)},L=new Set(["","--help","--version","-h","-v","completion","dlx","exec","x"]),i=process.argv[2]??"";!L.has(i)&&!process.argv.includes("--help")&&!process.argv.includes("-h")&&z();process.argv.includes("--no-color")&&(process.env.NO_COLOR="1",process.env.FORCE_COLOR="0");B();b();(async()=>{if(i==="__pm-shim"){const{dispatchShim:s}=await import("../packem_chunks/dispatch.js");s(process.argv[3]??"",process.argv.slice(4));return}if(i==="x"){const{runLeanX:s}=await import("../packem_chunks/lean.js");await s(process.argv.slice(3));return}if(i==="exec"||i==="dlx"){const{runExecCli:s}=await import("../packem_chunks/cli-exec.js");await s();return}const{runCli:e}=await import("../packem_chunks/cli-main.js").then(s=>s.ar);await e()})();export{G as s};