@visulima/vis 1.0.0-alpha.42 → 1.0.0-alpha.44

package/CHANGELOG.md

@@ -1,3 +1,57 @@
+## @visulima/vis [1.0.0-alpha.44](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.43...@visulima/vis@1.0.0-alpha.44) (2026-06-23)
+
+### Features
+
+* **vis:** native Rust CLI front-end + nub-parity for x/run ([#697](https://github.com/visulima/visulima/issues/697)) ([88d505b](https://github.com/visulima/visulima/commit/88d505bef74f08a895849e41f26682e684aa67be))
+* **vis:** task-runner feedback fixes + CI hook skip ([#696](https://github.com/visulima/visulima/issues/696)) ([450412c](https://github.com/visulima/visulima/commit/450412cb92eee1397edaa46447128b1487d06369))
+
+### Bug Fixes
+
+* **vis:** group failed tasks in ci log output ([0fb8678](https://github.com/visulima/visulima/commit/0fb8678d9b66c6b587fb113310cfe9abce9aa6d0))
+* **vis:** unbreak full build — exclude variable-import modules from dynamic-import-vars ([#712](https://github.com/visulima/visulima/issues/712)) ([29d46eb](https://github.com/visulima/visulima/commit/29d46eb719de11ab8f09e5303748264607b04fe3)), closes [#697](https://github.com/visulima/visulima/issues/697) [#697](https://github.com/visulima/visulima/issues/697) [#697](https://github.com/visulima/visulima/issues/697) [#697](https://github.com/visulima/visulima/issues/697)
+* **vis:** wrap native crate-type array to satisfy toml lint rule ([9470654](https://github.com/visulima/visulima/commit/94706547342291197afb8babd5d2929ae9e0bb9b))
+
+### Documentation
+
+* **task-runner,vis:** add nub MIT attribution to ported native code ([9305f59](https://github.com/visulima/visulima/commit/9305f592da38dd13a179ef1af75fb0c8f5d84693))
+
+### Tests
+
+* **vis,task-runner:** address review on native benches ([f89dd33](https://github.com/visulima/visulima/commit/f89dd335d103744308a48568e49577d2019aca35))
+* **vis:** add criterion transpile bench + harness docs ([fb34159](https://github.com/visulima/visulima/commit/fb341597b498916afb398bfc1be66944f2967c98)), closes [nubjs/nub#17](https://github.com/nubjs/nub/issues/17)
+
+
+### Dependencies
+
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.25
+
+## @visulima/vis [1.0.0-alpha.43](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.42...@visulima/vis@1.0.0-alpha.43) (2026-06-20)
+
+### Features
+
+* **vis:** first-run info gate for visx/dlx ([53dd31e](https://github.com/visulima/visulima/commit/53dd31e39659d1281d8e94e174475e209bcb8b11))
+
+### Bug Fixes
+
+* **vis,secret-scanner:** windows absolute-path handling ([b1a3d67](https://github.com/visulima/visulima/commit/b1a3d673b3fe4f918c44b1cd33b62bf15d3687fc))
+* **vis:** address dlx first-run gate review comments ([6b833d1](https://github.com/visulima/visulima/commit/6b833d105f0827a3a41140e646d3b548509ccd2d))
+* **vis:** align native binding version check with package version ([4075bae](https://github.com/visulima/visulima/commit/4075bae7c37a4e34fc1416cba7bad1436e3f8090))
+* **vis:** expand windows 8.3 short names in workspace containment ([dbfe9b1](https://github.com/visulima/visulima/commit/dbfe9b152154b1f7526d7e0cbfd48cd0d94e6cc0))
+* **vis:** fix Windows-only release test failures ([158a6a3](https://github.com/visulima/visulima/commit/158a6a39a69d3a59bba9503c1fbcde19048378fc))
+* **vis:** harden dlx first-run gate per review ([a370a57](https://github.com/visulima/visulima/commit/a370a579c4df1f6852bd9591701ce85ff674401c))
+
+### Code Refactoring
+
+* **vis:** humanizer formatBytes + remaining dlx gate review nits ([7e1495b](https://github.com/visulima/visulima/commit/7e1495b9ca962d2e4b4adbabf2f150830a1d3bda))
+
+### Tests
+
+* **vis:** cover dlx gatherPackageInfo ([f998e0b](https://github.com/visulima/visulima/commit/f998e0b3bb66042aac60eff312e948ab6604b837))
+* **vis:** make 8.3 containment mock separator-agnostic ([c2cf820](https://github.com/visulima/visulima/commit/c2cf8208e43ad38f526b16f0546e5c45fddc94d6))
+* **vis:** make release path/shell-quote assertions OS-aware ([8280b28](https://github.com/visulima/visulima/commit/8280b288ccf63fe7181ace194c22390501d5e7b1))
+* **vis:** skip flaky windows-only release/staged suites with TODO ([c568088](https://github.com/visulima/visulima/commit/c5680882df82341ce2cca220972a09e1b030f2de))
+* **vis:** skip windows-deadlock release/commands suites ([1d48a62](https://github.com/visulima/visulima/commit/1d48a6272228629d95ec9620c6b7d0860a184cd3))
+
 ## @visulima/vis [1.0.0-alpha.42](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.41...@visulima/vis@1.0.0-alpha.42) (2026-06-19)
 
 ### Features

package/LICENSE.md

@@ -8722,6 +8722,173 @@ Repository: git+https://github.com/visulima/visulima.git
 
 ---------------------------------------
 
+## @visulima/tsconfig
+License: MIT
+By: Daniel Bannert
+Repository: git+https://github.com/visulima/visulima.git
+
+> MIT License
+>
+> Copyright (c) 2026 visulima
+>
+> Permission is hereby granted, free of charge, to any person obtaining a copy
+> of this software and associated documentation files (the "Software"), to deal
+> in the Software without restriction, including without limitation the rights
+> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+> copies of the Software, and to permit persons to whom the Software is
+> furnished to do so, subject to the following conditions:
+>
+> The above copyright notice and this permission notice shall be included in all
+> copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+> SOFTWARE.
+>
+>
+>
+>
+>
+>
+> # Licenses of bundled types
+>
+> The published @visulima/tsconfig artifact additionally contains code with the following licenses:
+> (MIT OR CC0-1.0)
+>
+> # Bundled types:
+>
+> ## type-fest
+>
+> License: (MIT OR CC0-1.0)
+> By: Sindre Sorhus
+> Repository: sindresorhus/type-fest
+>
+> > Creative Commons Legal Code
+> >
+> > CC0 1.0 Universal
+> >
+> >     CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
+> >     LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
+> >     ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
+> >     INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
+> >     REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
+> >     PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
+> >     THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
+> >     HEREUNDER.
+> >
+> > Statement of Purpose
+> >
+> > The laws of most jurisdictions throughout the world automatically confer
+> > exclusive Copyright and Related Rights (defined below) upon the creator
+> > and subsequent owner(s) (each and all, an "owner") of an original work of
+> > authorship and/or a database (each, a "Work").
+> >
+> > Certain owners wish to permanently relinquish those rights to a Work for
+> > the purpose of contributing to a commons of creative, cultural and
+> > scientific works ("Commons") that the public can reliably and without fear
+> > of later claims of infringement build upon, modify, incorporate in other
+> > works, reuse and redistribute as freely as possible in any form whatsoever
+> > and for any purposes, including without limitation commercial purposes.
+> > These owners may contribute to the Commons to promote the ideal of a free
+> > culture and the further production of creative, cultural and scientific
+> > works, or to gain reputation or greater distribution for their Work in
+> > part through the use and efforts of others.
+> >
+> > For these and/or other purposes and motivations, and without any
+> > expectation of additional consideration or compensation, the person
+> > associating CC0 with a Work (the "Affirmer"), to the extent that he or she
+> > is an owner of Copyright and Related Rights in the Work, voluntarily
+> > elects to apply CC0 to the Work and publicly distribute the Work under its
+> > terms, with knowledge of his or her Copyright and Related Rights in the
+> > Work and the meaning and intended legal effect of CC0 on those rights.
+> >
+> > 1. Copyright and Related Rights. A Work made available under CC0 may be
+> >    protected by copyright and related or neighboring rights ("Copyright and
+> >    Related Rights"). Copyright and Related Rights include, but are not
+> >    limited to, the following:
+> >
+> > i. the right to reproduce, adapt, distribute, perform, display,
+> > communicate, and translate a Work;
+> > ii. moral rights retained by the original author(s) and/or performer(s);
+> > iii. publicity and privacy rights pertaining to a person's image or
+> > likeness depicted in a Work;
+> > iv. rights protecting against unfair competition in regards to a Work,
+> > subject to the limitations in paragraph 4(a), below;
+> > v. rights protecting the extraction, dissemination, use and reuse of data
+> > in a Work;
+> > vi. database rights (such as those arising under Directive 96/9/EC of the
+> > European Parliament and of the Council of 11 March 1996 on the legal
+> > protection of databases, and under any national implementation
+> > thereof, including any amended or successor version of such
+> > directive); and
+> > vii. other similar, equivalent or corresponding rights throughout the
+> > world based on applicable law or treaty, and any national
+> > implementations thereof.
+> >
+> > 2. Waiver. To the greatest extent permitted by, but not in contravention
+> >    of, applicable law, Affirmer hereby overtly, fully, permanently,
+> >    irrevocably and unconditionally waives, abandons, and surrenders all of
+> >    Affirmer's Copyright and Related Rights and associated claims and causes
+> >    of action, whether now known or unknown (including existing as well as
+> >    future claims and causes of action), in the Work (i) in all territories
+> >    worldwide, (ii) for the maximum duration provided by applicable law or
+> >    treaty (including future time extensions), (iii) in any current or future
+> >    medium and for any number of copies, and (iv) for any purpose whatsoever,
+> >    including without limitation commercial, advertising or promotional
+> >    purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
+> >    member of the public at large and to the detriment of Affirmer's heirs and
+> >    successors, fully intending that such Waiver shall not be subject to
+> >    revocation, rescission, cancellation, termination, or any other legal or
+> >    equitable action to disrupt the quiet enjoyment of the Work by the public
+> >    as contemplated by Affirmer's express Statement of Purpose.
+> > 3. Public License Fallback. Should any part of the Waiver for any reason
+> >    be judged legally invalid or ineffective under applicable law, then the
+> >    Waiver shall be preserved to the maximum extent permitted taking into
+> >    account Affirmer's express Statement of Purpose. In addition, to the
+> >    extent the Waiver is so judged Affirmer hereby grants to each affected
+> >    person a royalty-free, non transferable, non sublicensable, non exclusive,
+> >    irrevocable and unconditional license to exercise Affirmer's Copyright and
+> >    Related Rights in the Work (i) in all territories worldwide, (ii) for the
+> >    maximum duration provided by applicable law or treaty (including future
+> >    time extensions), (iii) in any current or future medium and for any number
+> >    of copies, and (iv) for any purpose whatsoever, including without
+> >    limitation commercial, advertising or promotional purposes (the
+> >    "License"). The License shall be deemed effective as of the date CC0 was
+> >    applied by Affirmer to the Work. Should any part of the License for any
+> >    reason be judged legally invalid or ineffective under applicable law, such
+> >    partial invalidity or ineffectiveness shall not invalidate the remainder
+> >    of the License, and in such case Affirmer hereby affirms that he or she
+> >    will not (i) exercise any of his or her remaining Copyright and Related
+> >    Rights in the Work or (ii) assert any associated claims and causes of
+> >    action with respect to the Work, in either case contrary to Affirmer's
+> >    express Statement of Purpose.
+> > 4. Limitations and Disclaimers.
+> >
+> > a. No trademark or patent rights held by Affirmer are waived, abandoned,
+> > surrendered, licensed or otherwise affected by this document.
+> > b. Affirmer offers the Work as-is and makes no representations or
+> > warranties of any kind concerning the Work, express, implied,
+> > statutory or otherwise, including without limitation warranties of
+> > title, merchantability, fitness for a particular purpose, non
+> > infringement, or the absence of latent or other defects, accuracy, or
+> > the present or absence of errors, whether or not discoverable, all to
+> > the greatest extent permissible under applicable law.
+> > c. Affirmer disclaims responsibility for clearing rights of other persons
+> > that may apply to the Work or any use thereof, including without
+> > limitation any person's Copyright and Related Rights in the Work.
+> > Further, Affirmer disclaims responsibility for obtaining any necessary
+> > consents, permissions or other rights required for any use of the
+> > Work.
+> > d. Affirmer understands and acknowledges that Creative Commons is not a
+> > party to this document and has no duty or obligation with respect to
+> > this CC0 or use of the Work.
+
+---------------------------------------
+
 ## @visulima/tui
 License: MIT
 By: Daniel Bannert
@@ -12165,6 +12332,66 @@ Repository: nodeca/js-yaml
 
 ---------------------------------------
 
+## json5
+License: MIT
+By: Aseem Kishore, Max Nanasy, Andrew Eisenberg, Jordan Tucker
+Repository: git+https://github.com/json5/json5.git
+
+> MIT License
+>
+> Copyright (c) 2012-2018 Aseem Kishore, and [others].
+>
+> Permission is hereby granted, free of charge, to any person obtaining a copy
+> of this software and associated documentation files (the "Software"), to deal
+> in the Software without restriction, including without limitation the rights
+> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+> copies of the Software, and to permit persons to whom the Software is
+> furnished to do so, subject to the following conditions:
+>
+> The above copyright notice and this permission notice shall be included in all
+> copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+> SOFTWARE.
+>
+> [others]: https://github.com/json5/json5/contributors
+
+---------------------------------------
+
+## jsonc-parser
+License: MIT
+By: Microsoft Corporation
+Repository: https://github.com/microsoft/node-jsonc-parser
+
+> The MIT License (MIT)
+>
+> Copyright (c) Microsoft
+>
+> Permission is hereby granted, free of charge, to any person obtaining a copy
+> of this software and associated documentation files (the "Software"), to deal
+> in the Software without restriction, including without limitation the rights
+> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+> copies of the Software, and to permit persons to whom the Software is
+> furnished to do so, subject to the following conditions:
+>
+> The above copyright notice and this permission notice shall be included in all
+> copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+> SOFTWARE.
+
+---------------------------------------
+
 ## jstoxml
 License: MIT
 By: David Calhoun
@@ -12353,6 +12580,35 @@ Repository: https://github.com/facebook/react.git
 
 ---------------------------------------
 
+## resolve-pkg-maps
+License: MIT
+By: Hiroki Osame
+Repository: privatenumber/resolve-pkg-maps
+
+> MIT License
+>
+> Copyright (c) Hiroki Osame <hiroki.osame@gmail.com>
+>
+> Permission is hereby granted, free of charge, to any person obtaining a copy
+> of this software and associated documentation files (the "Software"), to deal
+> in the Software without restriction, including without limitation the rights
+> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+> copies of the Software, and to permit persons to whom the Software is
+> furnished to do so, subject to the following conditions:
+>
+> The above copyright notice and this permission notice shall be included in all
+> copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+> SOFTWARE.
+
+---------------------------------------
+
 ## scheduler
 License: MIT
 Repository: https://github.com/facebook/react.git

package/bin/resolve-binary.mjs

@@ -0,0 +1,85 @@
+// Platform resolution for the native `vis` CLI binary. Shared by the launcher
+// (`bin/vis.mjs`) and the integration tests so there is a single source of truth
+// for where the binary lives and how the platform -> binding-package target slug
+// is computed (mirroring the NAPI loader matrix in `index.js`).
+
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+
+const require = createRequire(import.meta.url);
+
+// Best-effort musl detection for Linux. Defaults to glibc on any uncertainty.
+const isMusl = () => {
+    const report = typeof process.report?.getReport === "function" ? process.report.getReport() : undefined;
+
+    if (report && Array.isArray(report.sharedObjects)) {
+        return report.sharedObjects.some((object) => object.includes("libc.musl-") || object.includes("ld-musl-"));
+    }
+
+    // Default to glibc on uncertainty (no report). musl is identified by the
+    // absence of glibcVersionRuntime; matches handler.ts's copy.
+    return report ? !report.header?.glibcVersionRuntime : false;
+};
+
+// Static platform+arch -> target slug table for the non-Linux targets (Linux is
+// libc-dependent, so it is resolved separately).
+const STATIC_TARGETS = {
+    "darwin:arm64": "darwin-arm64",
+    "darwin:x64": "darwin-x64",
+    "win32:arm64": "win32-arm64-msvc",
+    "win32:x64": "win32-x64-msvc",
+};
+
+// Compute the binding-package target slug for the current platform, or undefined
+// for platforms with no published binary.
+const nativeTarget = () => {
+    const { arch, platform } = process;
+
+    if (platform === "linux") {
+        const libc = isMusl() ? "musl" : "gnu";
+
+        if (arch === "arm64" || arch === "x64") {
+            return `linux-${arch}-${libc}`;
+        }
+
+        return undefined;
+    }
+
+    return STATIC_TARGETS[`${platform}:${arch}`];
+};
+
+// Resolve the platform-specific `vis` binary, or undefined if none is available
+// (e.g. the optional binding package was not installed for this platform).
+// Resolution order, most specific first:
+//   1. VIS_NATIVE_BIN env override (dev / CI / tests).
+//   2. A binary placed next to the package (local `build:native:cli` output).
+//   3. The matching `@visulima/vis-binding-<target>` optional dependency.
+const resolveNativeBinary = (packageRoot) => {
+    const override = process.env.VIS_NATIVE_BIN;
+
+    if (override && existsSync(override)) {
+        return override;
+    }
+
+    const exe = process.platform === "win32" ? "vis-native-cli.exe" : "vis-native-cli";
+    const local = join(packageRoot, exe);
+
+    if (existsSync(local)) {
+        return local;
+    }
+
+    const target = nativeTarget();
+
+    if (target === undefined) {
+        return undefined;
+    }
+
+    try {
+        return require.resolve(`@visulima/vis-binding-${target}/${exe}`);
+    } catch {
+        return undefined;
+    }
+};
+
+export { nativeTarget, resolveNativeBinary };

package/bin/vis.mjs

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+// Native front-end launcher for `vis`.
+//
+// This is the npm `bin` entry. Its only jobs are to (1) route the small set of
+// natively-implemented commands to the platform Rust binary, and (2) fall
+// through to the existing in-process Node CLI for everything else. The
+// fall-through path is byte-identical to running `dist/bin.js` directly, so the
+// launcher adds no extra Node boot for delegated commands — it `import()`s the
+// same entry in the same process.
+//
+// As commands are ported off Node, their names are added to NATIVE_COMMANDS and
+// the binary grows to handle them; the binary itself delegates anything it does
+// not implement back to `dist/bin.js` via the VIS_* contract.
+
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { constants } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+import { resolveNativeBinary } from "./resolve-binary.mjs";
+
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
+// VIS_FALLBACK_ENTRY lets tests (and the native binary's own delegation) point
+// the Node entry elsewhere; production resolves it next to the package.
+const fallbackEntry = process.env.VIS_FALLBACK_ENTRY ?? join(packageRoot, "dist", "bin.js");
+
+// Commands answered by the native binary. Every entry here MUST be handled by
+// the binary (natively or via its own Node delegation), with VERIFIED parity to
+// the Node behavior. Unknown commands never reach the binary — they take the
+// in-process path below, unchanged. NOTE: `-v` is cerebro's verbose flag (not
+// version), so it is deliberately absent.
+//
+// `exec` parity was verified empirically against cerebro: tool flags after the
+// command are forwarded to the tool on both the native path and the Node handler
+// (src/commands/exec/handler.ts), which was fixed to stop dropping them.
+const NATIVE_COMMANDS = new Set(["--version", "-V", "__native-info", "__pm-shim", "dedupe", "exec", "link", "outdated", "pm", "remove", "unlink", "why", "x"]);
+
+const command = process.argv[2] ?? "";
+
+if (NATIVE_COMMANDS.has(command)) {
+    const binary = resolveNativeBinary(packageRoot);
+
+    if (binary !== undefined) {
+        const { version } = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
+
+        const { error, signal, status } = spawnSync(binary, process.argv.slice(2), {
+            env: {
+                ...process.env,
+                VIS_FALLBACK_ENTRY: fallbackEntry,
+                VIS_NODE: process.execPath,
+                VIS_VERSION: version,
+            },
+            stdio: "inherit",
+        });
+
+        if (error) {
+            // Binary unusable (e.g. corrupt install) — fall through to Node.
+            process.env.VIS_NATIVE_BIN_FAILED = "1";
+        } else if (signal) {
+            // Signal-terminated: follow the shell convention (128 + signal number)
+            // so the exit code matches the binary's own delegation path.
+            process.exit(128 + (constants.signals[signal] ?? 1));
+        } else {
+            process.exit(status ?? 1);
+        }
+    }
+    // No binary for this platform: fall through to the Node CLI below.
+}
+
+// In-process Node CLI. Same module graph and behaviour as invoking dist/bin.js
+// directly — no extra process boot. fallbackEntry is an internally-resolved path
+// (never user input); pathToFileURL keeps the dynamic import valid on Windows.
+// eslint-disable-next-line no-unsanitized/method -- fallbackEntry is resolved internally, not from user input
+await import(pathToFileURL(fallbackEntry).href);

package/dist/bin.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/bin.js

@@ -1,2 +1 @@
-#!/usr/bin/env node
-import"./packem_shared/compile-cache-B_Vf_WxT.js";import"./packem_shared/bin-CnDBuLh3.js";
+import"./packem_shared/compile-cache-B_Vf_WxT.js";import"./packem_shared/bin-P6Q5tKrP.js";

package/dist/binx.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import{c as r,V as o,h as c,e as i,r as a}from"./packem_shared/index-CPhv-r4c.js";import{c as n}from"./packem_shared/compile-cache-B_Vf_WxT.js";process.argv.includes("--no-color")&&(process.env.NO_COLOR="1",process.env.FORCE_COLOR="0");process.argv.slice(2).some(s=>s==="--version"||s==="-v"||s==="-V")&&(process.stdout.write(`${r.version}
+import{c as r,V as o,h as c,e as i,r as a}from"./packem_shared/index-D7EZ612R.js";import{c as n}from"./packem_shared/compile-cache-B_Vf_WxT.js";process.argv.includes("--no-color")&&(process.env.NO_COLOR="1",process.env.FORCE_COLOR="0");process.argv.slice(2).some(s=>s==="--version"||s==="-v"||s==="-V")&&(process.stdout.write(`${r.version}
 `),process.exit(0));process.argv.splice(2,0,"dlx");n();const e=o("visx",{packageName:"visx",packageVersion:r.version}),p=process.argv.includes("--debug")||!!process.env.DEBUG;e.addPlugin(c({detailed:p,exitOnError:!1}));e.addCommand(i);a(e);

package/dist/config/index.js

@@ -1 +1 @@
-import{k as a,d as f,m as o,y as e,i as n,n as l,N as C,A as d,B as g,e as F}from"../packem_chunks/config.js";import{definePlugin as T}from"../packem_shared/definePlugin-DoUcoYSy.js";import{otelPlugin as t}from"../packem_shared/otelPlugin-DmKDBaPo.js";export{a as CONFIG_FILES,f as SECURITY_DEFAULTS,o as TASK_CONFIG_FILES,e as applyDefaults,n as defineConfig,T as definePlugin,l as defineTaskConfig,C as findVisConfigFile,d as findVisTaskConfigFile,g as loadVisConfig,F as loadVisTaskConfig,t as otelPlugin};
+import{CONFIG_FILES as o,SECURITY_DEFAULTS as e,TASK_CONFIG_FILES as n,applyDefaults as l,defineConfig as C,defineTaskConfig as g,findVisConfigFile as s,findVisTaskConfigFile as a,loadVisConfig as d,loadVisTaskConfig as F}from"../packem_chunks/CONFIG_FILES.js";import{definePlugin as T}from"../packem_shared/definePlugin-DoUcoYSy.js";import{otelPlugin as t}from"../packem_shared/otelPlugin-DmKDBaPo.js";export{o as CONFIG_FILES,e as SECURITY_DEFAULTS,n as TASK_CONFIG_FILES,l as applyDefaults,C as defineConfig,T as definePlugin,g as defineTaskConfig,s as findVisConfigFile,a as findVisTaskConfigFile,d as loadVisConfig,F as loadVisTaskConfig,t as otelPlugin};

package/dist/packem_chunks/CONFIG_FILES.js

@@ -0,0 +1,8 @@
+import{createRequire as G}from"node:module";import{E as O,m as P}from"../packem_shared/target-merge-DOm6h6tW.js";import{m as c,A as b,f as p,a as h,H as y,O as C}from"../packem_shared/index-CE6MsgcV.js";import{i as I}from"./ts-loader.js";import{otelPlugin as jt}from"../packem_shared/otelPlugin-DmKDBaPo.js";import{definePlugin as Tt}from"../packem_shared/definePlugin-DoUcoYSy.js";import{a as _}from"../packem_shared/readJsonSync-CvkZyKmL-ihoybKvs.js";const F=G(import.meta.url),d=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,k=t=>{if(typeof d<"u"&&d.versions&&d.versions.node){const[e,s]=d.versions.node.split(".").map(Number);if(e>22||e===22&&s>=3||e===20&&s>=16)return d.getBuiltinModule(t)}return F(t)},{createHash:T}=k("node:crypto"),{readdirSync:$,readFileSync:V}=k("node:fs"),{createRequire:N}=k("node:module");class l extends Error{chain;constructor(e,s,o){super(e,o),this.name=this.constructor.name,this.chain=s}}class K extends l{constructor(e,s){const o=[...s,`${e} (re-enters)`].join(" → ");super(`Config cycle: ${o}`,s)}}class E extends l{filePath;removedKeys;constructor(e,s,o){const r=[`${e} uses removed keys.`,""];for(const n of o){const a=n.location?` (at ${n.location})`:"";r.push(`  • ${n.name}${a} → renamed to \`${n.renamedTo}\``);for(const i of n.children??[])r.push(`        ↳ ${i.name} → renamed to \`${i.renamedTo}\``)}r.push("","Run `vis migrate self` to auto-rewrite the config (use --dry-run to preview)."),super(r.join(`
+`),s),this.filePath=e,this.removedKeys=o}}class j extends l{constructor(e,s,o){const r=o instanceof Error?o.message:String(o),n=s.length>0?`
+Chain: ${s.join(" → ")}`:"";super(`Failed to load ${e}: ${r}${n}`,s,{cause:o})}}const L=t=>t.join(" → ");class g extends l{constructor(e,s,o){const r=s.length>0?s[s.length-1]:"<unknown>",n=o.length>0?`
+Tried:
+  ${o.join(`
+  `)}`:"";super(`Cannot resolve "${e}" extended from ${r}.${n}
+Chain: ${L(s)}`,s)}}const q=t=>{const e=[];if(Object.hasOwn(t,"targetDefaults")&&e.push({name:"targetDefaults",renamedTo:"tasks"}),Object.hasOwn(t,"taskRunnerOptions")&&e.push({name:"taskRunnerOptions",renamedTo:"taskRunner"}),Object.hasOwn(t,"taskDefaults")){const{taskDefaults:s}=t,o=[];if(Array.isArray(s))for(const[r,n]of s.entries())n&&typeof n=="object"&&(Object.hasOwn(n,"scope")&&o.push({location:`taskDefaults[${r}].scope`,name:"scope",renamedTo:"match"}),Object.hasOwn(n,"targets")&&o.push({location:`taskDefaults[${r}].targets`,name:"targets",renamedTo:"tasks"}));e.push({children:o.length>0?o:void 0,name:"taskDefaults",renamedTo:"scopedTasks"})}else if(Array.isArray(t.scopedTasks))for(const[s,o]of t.scopedTasks.entries())o&&typeof o=="object"&&(Object.hasOwn(o,"scope")&&e.push({location:`scopedTasks[${s}].scope`,name:"scope",renamedTo:"match"}),Object.hasOwn(o,"targets")&&e.push({location:`scopedTasks[${s}].targets`,name:"targets",renamedTo:"tasks"}));return e},M=t=>Object.hasOwn(t,"targets")&&!Object.hasOwn(t,"tasks")?[{name:"targets",renamedTo:"tasks"}]:[],U=(t,e,s)=>{if(!s||typeof s!="object")return;const o=q(s);if(o.length>0)throw new E(t,e,o)},H=(t,e,s)=>{if(!s||typeof s!="object")return;const o=M(s);if(o.length>0)throw new E(t,e,o)},x=["vis.config.ts","vis.config.mts","vis.config.cts","vis.config.js","vis.config.mjs","vis.config.cjs"],W=new Set(x),S=["vis.task.ts","vis.task.mts","vis.task.cts","vis.task.js","vis.task.mjs","vis.task.cjs"],B=new Set(S),ht=2880,m={blockExoticSubdeps:!0,policies:{installScripts:{strict:!0},publisherChange:{ignoreAfter:43200,mode:"no-downgrade"}}},Y=t=>{if(!t)return{...m};const e=m.policies??{},s=t.policies??{},o={...e,...s};for(const r of Object.keys(e)){const n=e[r],a=s[r];n!==void 0&&a!==void 0&&(o[r]={...n,...a})}return{...m,...t,policies:o}},v=t=>({...t,security:Y(t.security),update:{security:!0,target:"minor",...t.update}}),z=t=>{let e;try{e=$(t)}catch{return}const s=new Set(e.filter(o=>W.has(o)));for(const o of x)if(s.has(o))return c(t,o)},J=t=>{let e;try{e=$(t)}catch{return}const s=new Set(e.filter(o=>B.has(o)));for(const o of S)if(s.has(o))return c(t,o)},A=t=>T("sha256").update(V(t)).digest("hex"),Q=t=>{const e=T("sha256"),s=[...t].sort();for(const o of s)e.update(o),e.update(":"),e.update(A(o)),e.update(`
+`);return e.digest("hex")},X=t=>{const e=c(t,"node_modules");if(p(e)){const o=c(e,".cache","vis");return h(o),c(o,"vis-config-cache.json")}const s=O("vis",{create:!0,cwd:t});return s?c(s,"vis-config-cache.json"):void 0},Z=(t,e)=>{if(p(t))try{const s=_(t);if(s.hash===e)return s.config}catch{}},tt=(t,e,s)=>{try{h(y(t)),C(t,{config:s,hash:e})}catch{}},et=t=>t===void 0?[]:Array.isArray(t)?t:[t],st=(t,e,s)=>{if(b(t))throw new g(t,[...s,e],["Absolute paths in `extends` are not supported. Use a relative path or an npm package name."]);const o=[];if(t.startsWith("./")||t.startsWith("../")){const r=y(e),n=c(r,t);if(o.push(n),p(n))return n;throw new g(t,[...s,e],o)}try{return N(e).resolve(t)}catch{throw o.push(`require.resolve("${t}") from ${e}`),new g(t,[...s,e],o)}},R=async(t,e)=>{let s;try{s=(await I(t)).default??{}}catch(o){throw new j(t,e,o)}try{return(typeof s=="function"?await s()??{}:s)??{}}catch(o){throw new j(t,e,o)}},ot=(t,e)=>{const s={...t,...e};if(t.tasks||e.tasks){const o=new Set([...Object.keys(t.tasks??{}),...Object.keys(e.tasks??{})]),r={};for(const n of o)r[n]=P(t.tasks?.[n],e.tasks?.[n]);s.tasks=r}if((t.scopedTasks||e.scopedTasks)&&(s.scopedTasks=[...t.scopedTasks??[],...e.scopedTasks??[]]),(t.fileGroups||e.fileGroups)&&(s.fileGroups={...t.fileGroups,...e.fileGroups}),(t.taskGroups||e.taskGroups)&&(s.taskGroups={...t.taskGroups,...e.taskGroups}),t.security||e.security){const o=t.security?.policies??{},r=e.security?.policies??{},n={...o,...r};for(const a of Object.keys(o)){const i=o[a],f=r[a];i!==void 0&&f!==void 0&&(n[a]={...i,...f})}s.security={...t.security,...e.security,acceptedRisks:{...t.security?.acceptedRisks,...e.security?.acceptedRisks},policies:n}}return(t.update||e.update)&&(s.update={...t.update,...e.update}),(t.taskRunner||e.taskRunner)&&(s.taskRunner={...t.taskRunner,...e.taskRunner}),delete s.extends,s},D=async(t,e,s,o,r)=>{if(s.has(t))throw new K(t,e);if(!o.has(t)){s.add(t);try{const n=await R(t,e);U(t,e,n);const a=et(n.extends);for(const i of a){const f=st(i,t,e);await D(f,[...e,t],s,o,r)}o.set(t,n),r.push(t)}finally{s.delete(t)}}},lt=async(t,e)=>{let s;if(e?.explicitConfigPath){const u=b(e.explicitConfigPath)?e.explicitConfigPath:c(t,e.explicitConfigPath);if(!p(u))throw new Error(`Cannot find config file at ${u}`);s=u}else s=z(t);if(!s)return v({});const o=new Set,r=new Map,n=[];await D(s,[],o,r,n);const a=Q(n),i=X(t);if(i){const u=Z(i,a);if(u)return u}let f={};for(const u of n)f=ot(f,r.get(u));const w=v(f);return i&&tt(i,a,w),w},nt=t=>t.replaceAll(/[^\w.-]+/g,"_"),rt=(t,e)=>{const s=c(t,"node_modules"),o=nt(e);if(p(s)){const n=c(s,".cache","vis","task-configs");return h(n),c(n,`${o}.json`)}const r=O("vis",{create:!0,cwd:t});return r?c(r,"task-configs",`${o}.json`):void 0},at=(t,e)=>{if(p(t))try{const s=_(t);if(s.hash===e)return s.config}catch{}},it=(t,e,s)=>{try{h(y(t)),C(t,{config:s,hash:e})}catch{}},gt=async(t,e,s)=>{const o=J(e);if(!o)return;const r=A(o),n=rt(t,s);if(n){const f=at(n,r);if(f)return f}const a=await R(o,[]);H(o,[],a);const i=a;return n&&it(n,r,i),i},mt=t=>t,kt=t=>t;export{x as CONFIG_FILES,ht as DEFAULT_MIN_RELEASE_AGE_MINUTES,m as SECURITY_DEFAULTS,S as TASK_CONFIG_FILES,v as applyDefaults,kt as defineConfig,Tt as definePlugin,mt as defineTaskConfig,z as findVisConfigFile,J as findVisTaskConfigFile,lt as loadVisConfig,gt as loadVisTaskConfig,jt as otelPlugin};

package/dist/packem_chunks/bloom-status.js

@@ -1,2 +1,2 @@
-import{s as c,E as n,I as f}from"../packem_shared/index.server-J83sowC4.js";import{p as i}from"./cli-main.js";import{g as l}from"../packem_shared/osv-bloom-OuTfu_LE.js";const a=t=>{if(!t)return"never";const r=Date.parse(t);if(Number.isNaN(r))return t;const e=Date.now()-r;if(e<0)return t;const o=Math.floor(e/6e4);if(o<1)return"just now";if(o<60)return`${o}m ago`;const s=Math.floor(o/60);return s<24?`${s}h ago`:`${Math.floor(s/24)}d ago`},m=t=>t<1024?`${t} B`:t<1024*1024?`${(t/1024).toFixed(1)} KB`:`${(t/(1024*1024)).toFixed(1)} MB`,u=async({options:t,workspaceRoot:r})=>{if(!r)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const e=await l(r,t.cacheDir);if(t.format==="json"){process.stdout.write(`${JSON.stringify(e,void 0,2)}
+import{s as c,E as n,I as f}from"../packem_shared/index.server-J83sowC4.js";import{p as i}from"./cli-main.js";import{g as l}from"../packem_shared/osv-bloom-BsQ-aFiM.js";const a=t=>{if(!t)return"never";const r=Date.parse(t);if(Number.isNaN(r))return t;const e=Date.now()-r;if(e<0)return t;const o=Math.floor(e/6e4);if(o<1)return"just now";if(o<60)return`${o}m ago`;const s=Math.floor(o/60);return s<24?`${s}h ago`:`${Math.floor(s/24)}d ago`},m=t=>t<1024?`${t} B`:t<1024*1024?`${(t/1024).toFixed(1)} KB`:`${(t/(1024*1024)).toFixed(1)} MB`,u=async({options:t,workspaceRoot:r})=>{if(!r)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const e=await l(r,t.cacheDir);if(t.format==="json"){process.stdout.write(`${JSON.stringify(e,void 0,2)}
 `);return}if(i.info(`Cache: ${e.cacheDir}`),!e.present){i.warn(`No osv-bloom filter yet. Run ${c("vis advisories bloom sync")} to populate.`);return}if(e.manifest){const{manifest:o}=e;i.info(`Built:  ${o.builtAtRfc3339} (${a(o.builtAtRfc3339)})`),i.info(`Fetch:  ${e.fetchedAtIso??n("—")} (${a(e.fetchedAtIso)})`),i.info(`Filter: ${f(m(o.bloomByteLen))}   m=${o.bloomMBits.toLocaleString()} bits   k=${String(o.bloomKHashes)}`),i.info(`Set:    ${o.entryCount.toLocaleString()} entries from ${o.advisoryCount.toLocaleString()} advisories (target FPR ${o.targetFpr})`),i.info(n(`Digest: ${o.setDigestSha256}`))}else i.warn("filter.bin present but manifest.json missing — `vis advisories bloom sync` will rewrite the cache.")},h=u;export{h as advisoriesBloomStatusExecute};

package/dist/packem_chunks/bloom-sync.js

@@ -1,2 +1,2 @@
-import{E as m}from"../packem_shared/index.server-J83sowC4.js";import{p as i}from"./cli-main.js";import{s as p}from"../packem_shared/scan-progress-CN9ONR0y.js";import{s as d,D}from"../packem_shared/osv-bloom-OuTfu_LE.js";const b=o=>o?.security?.audit?.advisories?.bloom??{},u=o=>o>=1e3?`${(o/1e3).toFixed(1)}s`:`${Math.round(o)}ms`,y=o=>o<1024?`${o} B`:o<1024*1024?`${(o/1024).toFixed(1)} KB`:`${(o/(1024*1024)).toFixed(1)} MB`,h=async({options:o,visConfig:f,workspaceRoot:a})=>{if(!a)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const n=o.format==="json",c=b(f),l=o.source??c.source??D,s=p([{id:"bloom",label:"Sync osv-bloom prefilter"}],{live:!n});let e,t;try{s.start("bloom");const r=Date.now();e=await d({allowedHosts:c.allowedHosts,cacheDir:o.cacheDir,force:!!o.force,source:l,workspaceRoot:a}),e.upToDate?s.finish("bloom","ok",`up to date · ${u(Date.now()-r)}`):s.finish("bloom","ok",`${e.manifest.entryCount.toLocaleString()} entries · ${y(e.bytesOnDisk)} · ${u(e.durationMs)}`)}catch(r){t=r instanceof Error?r.message:String(r),s.finish("bloom","error",t)}finally{s.stop()}n?process.stdout.write(`${JSON.stringify({bytesOnDisk:e?.bytesOnDisk??0,cacheDir:e?.cacheDir??null,durationMs:e?.durationMs??0,error:t??null,manifest:e?.manifest??null,source:l,upToDate:e?.upToDate??!1},void 0,2)}
+import{E as m}from"../packem_shared/index.server-J83sowC4.js";import{p as i}from"./cli-main.js";import{s as p}from"../packem_shared/scan-progress-D4yywI6P.js";import{s as d,D}from"../packem_shared/osv-bloom-BsQ-aFiM.js";const b=o=>o?.security?.audit?.advisories?.bloom??{},u=o=>o>=1e3?`${(o/1e3).toFixed(1)}s`:`${Math.round(o)}ms`,y=o=>o<1024?`${o} B`:o<1024*1024?`${(o/1024).toFixed(1)} KB`:`${(o/(1024*1024)).toFixed(1)} MB`,h=async({options:o,visConfig:f,workspaceRoot:a})=>{if(!a)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const n=o.format==="json",c=b(f),l=o.source??c.source??D,s=p([{id:"bloom",label:"Sync osv-bloom prefilter"}],{live:!n});let e,t;try{s.start("bloom");const r=Date.now();e=await d({allowedHosts:c.allowedHosts,cacheDir:o.cacheDir,force:!!o.force,source:l,workspaceRoot:a}),e.upToDate?s.finish("bloom","ok",`up to date · ${u(Date.now()-r)}`):s.finish("bloom","ok",`${e.manifest.entryCount.toLocaleString()} entries · ${y(e.bytesOnDisk)} · ${u(e.durationMs)}`)}catch(r){t=r instanceof Error?r.message:String(r),s.finish("bloom","error",t)}finally{s.stop()}n?process.stdout.write(`${JSON.stringify({bytesOnDisk:e?.bytesOnDisk??0,cacheDir:e?.cacheDir??null,durationMs:e?.durationMs??0,error:t??null,manifest:e?.manifest??null,source:l,upToDate:e?.upToDate??!1},void 0,2)}
 `):e&&(i.info(m(`Cache: ${e.cacheDir}`)),i.info(m(`Built: ${e.manifest.builtAtRfc3339}`)),t||i.success(e.upToDate?"osv-bloom prefilter up to date.":"osv-bloom prefilter synced.")),t&&(process.exitCode=1)},O=h;export{O as advisoriesBloomSyncExecute};