@visulima/vis 1.0.0-alpha.5 → 1.0.0-alpha.7

package/dist/cache-directory.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Shared helpers for resolving the task runner's cache directory.
+ *
+ * Used by `vis run` (to configure the runner) and `vis cache` (to manage the
+ * cache from the outside) so both commands agree on:
+ *
+ * - the resolution order: `--cache-dir` flag > vis.config.ts
+ *   `taskRunnerOptions.cacheDirectory` > `{workspaceRoot}/.task-runner-cache`
+ * - relative-path normalization against `workspaceRoot`
+ * - containment checks (used to decide whether a destructive operation is
+ *   safe to perform without confirmation)
+ */
+/**
+ * Resolves the cache directory from CLI options and vis.config.ts.
+ *
+ * All paths returned from this helper are absolute — relative values are
+ * resolved against `workspaceRoot` so they refer to the same directory no
+ * matter what `process.cwd()` happens to be when the command runs.
+ *
+ * Precedence: `optionsCacheDir` > `configCacheDir` > `{workspaceRoot}/{@link DEFAULT_CACHE_DIRECTORY_NAME}`.
+ * @param workspaceRoot Absolute path to the workspace root directory.
+ * @param optionsCacheDir CLI `--cache-dir` value (may be relative or absolute). Takes highest priority.
+ * @param configCacheDir `taskRunnerOptions.cacheDirectory` from vis.config.ts (may be relative or absolute).
+ * @returns The resolved absolute path to the cache directory.
+ */
+declare const resolveCacheDirectory: (workspaceRoot: string, optionsCacheDir: string | undefined, configCacheDir: string | undefined) => string;
+/**
+ * Converts an arbitrary branch name into a filesystem-safe segment.
+ * Strips characters outside `[A-Za-z0-9_.-]`, collapses runs of
+ * disallowed characters into a single `-`, and trims leading/trailing
+ * dashes. Truncated to 64 chars so deep-nested branch names (`user/long/feat`)
+ * stay bounded.
+ */
+export declare const sanitizeBranchSegment: (branch: string) => string;
+/**
+ * Detects the current git branch by shelling out to `git rev-parse`.
+ * Returns `undefined` on detached HEAD, non-git workspaces, or when
+ * git is unavailable — callers fall back to the unscoped cache.
+ */
+export declare const detectGitBranch: (cwd: string) => string | undefined;
+/**
+ * Appends a branch-specific subdirectory to `cacheDirectory` when
+ * `enabled` is true and a branch can be detected. Keeps `main` and
+ * feature branches from thrashing each other's caches — different
+ * generated artefacts (schemas, `.d.ts` snapshots) cause oscillating
+ * invalidations when the same hash resolves to different contents.
+ *
+ * When `enabled === false` or the branch can't be detected, returns
+ * `cacheDirectory` unchanged. On detached HEAD or CI checkouts where
+ * `git rev-parse` resolves `HEAD`, the original path is used — this
+ * matches the behaviour of a non-git clone.
+ * @param cacheDirectory Resolved base cache directory.
+ * @param workspaceRoot Absolute path used to probe the branch.
+ * @param enabled When undefined, branch scoping is off. Set to `true`
+ * (or omit to keep current behaviour) to enable.
+ */
+export declare const applyBranchScope: (cacheDirectory: string, workspaceRoot: string, enabled: boolean | undefined) => string;
+/**
+ * Returns `true` when `cacheDirectory` sits inside `workspaceRoot`. Uses
+ * `relative()` instead of `startsWith()` so paths with a common string
+ * prefix but different parents (e.g. `/work` vs `/workspace`) are correctly
+ * distinguished.
+ *
+ * Callers use this to decide whether a `rm -rf` on the cache directory is
+ * safe without an extra confirmation prompt.
+ * @param cacheDirectory Absolute path to the cache directory.
+ * @param workspaceRoot Absolute path to the workspace root directory.
+ * @returns `true` when `cacheDirectory` is a proper descendant of `workspaceRoot`; `false` otherwise
+ * (including when the two paths are identical).
+ */
+declare const isCacheDirectoryInsideWorkspace: (cacheDirectory: string, workspaceRoot: string) => boolean;
+export { isCacheDirectoryInsideWorkspace, resolveCacheDirectory };
+export { DEFAULT_CACHE_DIRECTORY_NAME } from "@visulima/task-runner";

package/dist/codeowners.d.ts

@@ -0,0 +1,30 @@
+import type { WorkspaceConfiguration } from "@visulima/task-runner";
+import type { CodeownersConfig } from "./workspace.d.ts";
+export type { CodeownersConfig } from "./workspace.d.ts";
+/**
+ * A single resolved CODEOWNERS line, pre-sorted by path. Kept as an
+ * object so callers can post-process (e.g. append sub-sections).
+ */
+export interface CodeownersLine {
+    /** Optional notification channel (added as a trailing comment). */
+    channel?: string;
+    /** Owner handles, space-separated by the writer. */
+    owners: string[];
+    /** Effective path glob (workspace-root-relative). */
+    path: string;
+    /** Source project name — used for `order-by=project-id` sorting. */
+    projectId?: string;
+}
+/**
+ * Computes CODEOWNERS lines from the workspace's projects and a
+ * workspace-level `codeowners` block. Returns lines in the requested
+ * order (default: `file-source`).
+ */
+export declare const buildCodeownersLines: (workspace: WorkspaceConfiguration, config: CodeownersConfig | undefined) => CodeownersLine[];
+/**
+ * Serialises {@link CodeownersLine}s to a valid CODEOWNERS file string.
+ * @param lines Resolved CODEOWNERS lines.
+ * @param _provider Reserved for future provider-specific formatting (e.g. Bitbucket syntax).
+ * @returns The full CODEOWNERS file content with header and trailing newline.
+ */
+export declare const renderCodeowners: (lines: CodeownersLine[], _provider?: CodeownersConfig["provider"]) => string;

package/dist/commands/action-graph.d.ts

@@ -0,0 +1,8 @@
+import type { Command } from "@visulima/cerebro";
+/**
+ * `vis action-graph <selector>` — shows the execution plan that would
+ * be produced by `vis run <selector>` without running anything. Matches
+ * moon's `moon action-graph`.
+ */
+declare const actionGraph: Command;
+export default actionGraph;

package/dist/commands/audit.d.ts

@@ -13,10 +13,10 @@ interface DuplicatePackage {
 }
 declare const scanInstalledPackages: (workspaceRoot: string) => InstalledPackage[];
 /**
- * Finds packages with multiple installed versions by parsing the lockfile
- * via `lockparse`. Passes `package.json` for accuracy (especially yarn).
+ * Finds packages with multiple installed versions by parsing the
+ * workspace lockfile via `@visulima/package`.
  */
-declare const findDuplicateDependencies: (workspaceRoot: string, pmName: string) => Promise<DuplicatePackage[]>;
+declare const findDuplicateDependencies: (workspaceRoot: string, pmName: string) => DuplicatePackage[];
 declare const audit: Command;
 export default audit;
 export type { DuplicatePackage, InstalledPackage };

package/dist/commands/cache.d.ts

@@ -0,0 +1,86 @@
+import type { Command } from "@visulima/cerebro";
+/**
+ * Shape returned by `collectCacheEntries`. Kept close to what `removeOldEntries`
+ * uses internally so we can render the list identically.
+ */
+interface CacheEntry {
+    hash: string;
+    mtimeMs: number;
+    path: string;
+    sizeBytes: number;
+}
+/**
+ * Reads the cache directory and returns one entry per cached task hash.
+ * Skips any file/directory starting with `.` (index files, temp dirs).
+ * @param cacheDirectory Absolute path to the cache root directory.
+ * @returns Array of cache entries sorted newest-first by modification time.
+ * Returns an empty array when the directory does not exist or is empty.
+ */
+declare const collectCacheEntries: (cacheDirectory: string) => Promise<CacheEntry[]>;
+/**
+ * Formats the difference between `now` and `mtimeMs` as a short age string:
+ * "3m", "2h", "4d". The caller passes a shared `now` so rows in the same
+ * listing use a consistent baseline.
+ * @param mtimeMs File modification time in milliseconds since epoch.
+ * @param now Reference timestamp in milliseconds since epoch. Defaults to `Date.now()`.
+ * @returns A compact age string such as `"5s"`, `"10m"`, `"2h"`, or `"3d"`.
+ */
+declare const formatAge: (mtimeMs: number, now?: number) => string;
+/**
+ * `list` subcommand — prints a table of cached task entries.
+ * @param cacheDirectory Absolute path to the cache directory to enumerate.
+ * @param format Output format: `"table"` for a human-readable table, `"json"` for machine-readable JSON.
+ * @param logger Console instance used for non-prefixed table rows.
+ * @returns Resolves when output has been written.
+ */
+declare const runList: (cacheDirectory: string, format: string, logger: Console) => Promise<void>;
+/**
+ * `clean` subcommand — removes the entire cache directory.
+ *
+ * Uses `Cache.clear()` when the directory is inside `workspaceRoot` so we
+ * match the task runner's own cleanup semantics. For custom `--cache-dir`
+ * paths that live outside the workspace we fall back to `rm -r`, but only
+ * after prompting for confirmation: users pointing at a shared location
+ * (e.g. `~/.cache/...`) shouldn't lose unrelated data without an opt-in.
+ * The prompt is skipped in non-TTY / CI contexts and when `--force` is set.
+ *
+ * Refuses outright when `cacheDirectory` resolves to the workspace root.
+ * @param cacheDirectory Absolute path to the cache directory to remove.
+ * @param workspaceRoot Absolute path to the workspace root (used for containment checks and `Cache` construction).
+ * @param options `dryRun` previews without deleting; `force` skips the out-of-workspace confirmation prompt.
+ * @returns Resolves when the operation completes (or is skipped / aborted).
+ */
+declare const runClean: (cacheDirectory: string, workspaceRoot: string, options: {
+    dryRun: boolean;
+    force: boolean;
+}) => Promise<void>;
+/**
+ * `prune` subcommand — removes stale entries (age + size) without nuking
+ * everything. Mirrors `Cache.removeOldEntries()` which the runner invokes
+ * automatically on each run.
+ *
+ * Both `--max-age-days` and `--max-size` are validated up-front so
+ * malformed values produce a friendly CLI error instead of a stack trace
+ * from inside `Cache`. The before/after count is a best-effort estimate —
+ * a concurrent `vis run` could skew it, but the cache state remains correct.
+ * @param cacheDirectory Absolute path to the cache directory to prune.
+ * @param workspaceRoot Absolute path to the workspace root (passed to the `Cache` constructor).
+ * @param options `maxCacheAgeDays` evicts entries older than N days; `maxCacheSize` (e.g. `"500MB"`)
+ * evicts oldest entries until the total size is under the limit.
+ * @returns Resolves when pruning completes or is skipped.
+ */
+declare const runPrune: (cacheDirectory: string, workspaceRoot: string, options: {
+    maxCacheAgeDays?: number;
+    maxCacheSize?: string;
+}) => Promise<void>;
+/**
+ * `size` subcommand — prints the cache directory's on-disk footprint without
+ * the per-entry table.
+ * @param cacheDirectory Absolute path to the cache directory to measure.
+ * @param format `"table"` for human-readable output, `"json"` for machine-readable JSON.
+ * @returns Resolves when output has been written.
+ */
+declare const runSize: (cacheDirectory: string, format: string) => Promise<void>;
+declare const cache: Command;
+export default cache;
+export { collectCacheEntries, formatAge, runClean, runList, runPrune, runSize };

package/dist/commands/ci.d.ts

@@ -0,0 +1,19 @@
+import type { Command } from "@visulima/cerebro";
+/**
+ * `vis ci` bundles the CI lifecycle in a single entry:
+ *
+ * 1. Install dependencies (respecting lockfile / frozen install).
+ * 2. Enforce project constraints (implicit, via the `run` command).
+ * 3. Determine affected projects since the base ref.
+ * 4. Run the requested targets on affected projects only.
+ *
+ * Meant to be invoked as a single command at the top of a CI job:
+ *
+ *   vis ci lint test build
+ *
+ * Compared to wiring these up by hand, this skips reinstalling when
+ * already installed, uses CI-safe defaults, and picks up the base ref
+ * from common CI provider environment variables.
+ */
+declare const ci: Command;
+export default ci;

package/dist/commands/docker.d.ts

@@ -0,0 +1,22 @@
+import type { Command } from "@visulima/cerebro";
+/**
+ * `vis docker scaffold` / `vis docker prune` — scaffolding and pruning
+ * helpers that mirror moon's `moon docker scaffold` and `moon docker prune`
+ * commands. Used inside Dockerfiles to keep install layers cache-friendly.
+ *
+ * Typical Dockerfile usage:
+ *
+ * ```dockerfile
+ * FROM node:22 AS deps
+ * WORKDIR /app
+ * COPY .vis/docker/workspace/ ./
+ * RUN pnpm install --frozen-lockfile
+ *
+ * FROM deps AS build
+ * COPY .vis/docker/sources/ ./
+ * RUN pnpm --filter my-app build
+ * RUN vis docker prune --context=.vis/docker
+ * ```
+ */
+declare const docker: Command;
+export default docker;

package/dist/commands/generate.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `vis generate <template>` — in-repo scaffolding command.
+ *
+ * Discovers templates from `.vis/templates/`, `.moon/templates/`, and
+ * `vis.config.ts` `generator.templates`, then runs the selected
+ * template through prompts → produce → write.
+ */
+import type { Command } from "@visulima/cerebro";
+declare const generate: Command;
+export default generate;

package/dist/commands/ignore-helpers.d.ts

@@ -0,0 +1,157 @@
+/**
+ * Pure helpers for `vis ignore`. Split from `ignore.ts` so tests can
+ * exercise them without pulling in `@visulima/task-runner`, which
+ * otherwise drags the whole run-graph module through ESM evaluation.
+ */
+/** Commit-message tokens that unconditionally skip the build. */
+declare const SKIP_TOKENS: readonly ["[skip ci]", "[ci skip]", "[no ci]", "[vis skip]", "[nx skip]"];
+/** Commit-message tokens that unconditionally force the build. */
+declare const FORCE_TOKENS: readonly ["[vis deploy]", "[nx deploy]"];
+/**
+ * Token prefixes accepted for per-project commit-message gating. `vis` is
+ * the canonical form; `nx` is kept so teams migrating from `nx-ignore`
+ * don't have to rewrite their commit automation.
+ */
+declare const PER_PROJECT_TOKEN_PREFIXES: readonly ["vis", "nx"];
+/**
+ * CI-provider environment variables carrying the previously deployed SHA,
+ * probed in priority order. Only providers that *actually* invoke a custom
+ * ignore script (Vercel, Netlify) or that we commonly wrap manually in a
+ * preflight CI step (GitHub Actions, GitLab CI) are listed here.
+ *
+ * Cloudflare Pages / Render / Amplify are intentionally absent: they have
+ * no custom-command hook, so shipping env detection for them would only
+ * create the illusion of support.
+ */
+declare const CI_BASE_SHA_ENV_VARS: readonly ["CACHED_COMMIT_REF", "VERCEL_GIT_PREVIOUS_SHA", "GITHUB_BASE_REF", "CI_COMMIT_BEFORE_SHA"];
+/** Machine-readable reason codes for the ignore decision. */
+type IgnoreReason = "commit-force-deploy" | "commit-skip" | "missing-project-argument" | "no-changes" | "project-affected" | "project-not-affected" | "project-unknown" | "workspace-error";
+/**
+ * Structured decision record emitted on stdout in `--json` mode and
+ * rendered as human text otherwise.
+ */
+interface IgnoreDecision {
+    /** "build" continues the deployment, "skip" cancels it. */
+    action: "build" | "skip";
+    /** The affected-project list, when the comparison actually ran. */
+    affectedProjects?: string[];
+    /** Base ref used for the affected comparison, if any. */
+    base?: string;
+    /** Head ref used for the affected comparison, if any. */
+    head?: string;
+    /** Human-readable reason message. */
+    message: string;
+    /** The project the decision applies to. */
+    project: string;
+    /** Stable reason code for scripting / analytics. */
+    reason: IgnoreReason;
+}
+/** Extra fields that decisions from the affected-detection path carry. */
+type DecisionExtras = Partial<Pick<IgnoreDecision, "affectedProjects" | "base" | "head">>;
+/**
+ * Returns the first non-empty value from the CI env var priority list,
+ * or `undefined` if nothing is set. Reads from `env` (defaults to
+ * `process.env`) so tests can inject fixtures without clobbering globals.
+ * @param env Environment dictionary to probe. Defaults to `process.env`.
+ * @returns The resolved base SHA (trimmed) or `undefined` if no known CI env var is set.
+ */
+declare const resolveCiBaseSha: (env?: NodeJS.ProcessEnv) => string | undefined;
+/**
+ * Throws if the given string contains characters outside the safe git-ref
+ * alphabet or begins with a dash. Mirrors the validation used by
+ * task-runner's affected logic and additionally rejects leading dashes to
+ * prevent `git` option injection when the ref is passed as a positional
+ * argument to `execFile("git", [...])`.
+ * @param ref The git ref to validate (e.g. `"HEAD"`, `"main"`, `"abc123"`).
+ * @throws {Error} If `ref` does not match `GIT_REF_RE`. Returns `void` on success.
+ */
+declare const validateGitRef: (ref: string) => void;
+/**
+ * Returns `true` if `ref` resolves to a commit object in the given repo.
+ * Used to detect unreachable base refs (e.g. Vercel's shallow clone) so
+ * we can silently fall back to `HEAD~1`.
+ * @param cwd Absolute path to the git repository's working directory.
+ * @param ref The git ref to probe. Should already be validated by `validateGitRef` to avoid `git` option injection.
+ * @returns `true` if the ref resolves to a commit, `false` otherwise (including when `git` itself fails or is unavailable).
+ */
+declare const isRefReachable: (cwd: string, ref: string) => Promise<boolean>;
+/**
+ * Reads the subject+body of the most recent commit. Returns an empty
+ * string on any failure — the caller treats missing messages as "no
+ * keywords present" rather than erroring out.
+ * @param cwd Absolute path to the git repository's working directory.
+ * @returns The raw commit message (subject + body), or `""` on failure.
+ */
+declare const readLastCommitMessage: (cwd: string) => Promise<string>;
+/**
+ * Returns `true` if the commit message contains a per-project token of
+ * the form `[&lt;prefix> &lt;verb> &lt;project>]` for any of the supported
+ * prefixes (`vis` or the legacy `nx`).
+ * @param message Raw commit message to scan.
+ * @param verb The action verb embedded in the token (`"skip"` or `"deploy"`).
+ * @param project The project name the token is scoped to.
+ * @returns `true` on the first matching token, `false` otherwise.
+ */
+declare const matchesPerProjectToken: (message: string, verb: "deploy" | "skip", project: string) => boolean;
+/**
+ * Returns `true` if the commit message contains any skip token,
+ * including the per-project form `[vis skip &lt;project>]`. Accepts both
+ * `vis` and legacy `nx` tokens so users migrating from nx-ignore don't
+ * need to rewrite their commit automation.
+ * @param message Raw commit message to scan.
+ * @param project The project whose per-project tokens should also match.
+ * @returns `true` if any skip token is present, `false` otherwise.
+ */
+declare const commitHasSkipMessage: (message: string, project: string) => boolean;
+/**
+ * Returns `true` if the commit message contains any force-deploy token,
+ * including the per-project form `[vis deploy &lt;project>]`.
+ * @param message Raw commit message to scan.
+ * @param project The project whose per-project tokens should also match.
+ * @returns `true` if any force-deploy token is present, `false` otherwise.
+ */
+declare const commitHasForceDeployMessage: (message: string, project: string) => boolean;
+/**
+ * Builds a `"build"` decision record. Factory helper that collapses the
+ * otherwise-repetitive object literals in `ignore.ts`.
+ * @param project The project the decision applies to.
+ * @param reason Stable reason code.
+ * @param message Human-readable message.
+ * @param extra Optional base/head/affectedProjects when available.
+ * @returns A fully-populated `IgnoreDecision` with `action: "build"`.
+ */
+declare const decideBuild: (project: string, reason: IgnoreReason, message: string, extra?: DecisionExtras) => IgnoreDecision;
+/**
+ * Builds a `"skip"` decision record. Companion to `decideBuild`.
+ * @param project The project the decision applies to.
+ * @param reason Stable reason code.
+ * @param message Human-readable message.
+ * @param extra Optional base/head/affectedProjects when available.
+ * @returns A fully-populated `IgnoreDecision` with `action: "skip"`.
+ */
+declare const decideSkip: (project: string, reason: IgnoreReason, message: string, extra?: DecisionExtras) => IgnoreDecision;
+/**
+ * Renders a decision as a single human-readable line. Pure formatter;
+ * doesn't print anything itself.
+ * @param decision The decision to format.
+ * @returns A one-line string with an emoji prefix and the message.
+ */
+declare const formatDecisionLine: (decision: IgnoreDecision) => string;
+/**
+ * Maps a decision to its process exit code, honoring
+ * `--exit-zero-on-build` for users who want normal exit semantics.
+ *
+ *   Default:
+ *     skip  → 0 (platform cancels)
+ *     build → 1 (platform continues)
+ *
+ *   With --exit-zero-on-build:
+ *     skip  → 0
+ *     build → 0
+ * @param decision The decision to map.
+ * @param exitZeroOnBuild If `true`, builds exit with `0` instead of `1`.
+ * @returns The literal exit code (`0` or `1`).
+ */
+declare const exitCodeFor: (decision: IgnoreDecision, exitZeroOnBuild: boolean) => 0 | 1;
+export type { IgnoreDecision, IgnoreReason };
+export { CI_BASE_SHA_ENV_VARS, commitHasForceDeployMessage, commitHasSkipMessage, decideBuild, decideSkip, exitCodeFor, FORCE_TOKENS, formatDecisionLine, isRefReachable, matchesPerProjectToken, PER_PROJECT_TOKEN_PREFIXES, readLastCommitMessage, resolveCiBaseSha, SKIP_TOKENS, validateGitRef, };

package/dist/commands/ignore.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `vis ignore <project>` — CI build gating for deployment platforms.
+ *
+ * Exits with inverted codes so it can be wired directly into Vercel's
+ * "Ignored Build Step" field or Netlify's `ignore` command:
+ *
+ *   exit 0 → platform cancels the build (project is NOT affected)
+ *   exit 1 → platform continues the build (project IS affected)
+ *
+ * Inspired by `nx-ignore` from nrwl/nx-labs, but reuses vis's own
+ * `getAffectedProjects` so it doesn't need to bootstrap a parallel
+ * Nx installation on the deploy runner. Pure helpers live in
+ * `./ignore-helpers` for test isolation.
+ */
+import type { Command } from "@visulima/cerebro";
+declare const ignore: Command;
+export default ignore;

package/dist/commands/info.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "@visulima/cerebro";
+declare const info: Command;
+export default info;

package/dist/commands/list.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "@visulima/cerebro";
+declare const list: Command;
+export default list;

package/dist/commands/migrate/backup.d.ts

@@ -0,0 +1,8 @@
+import type { MigrationReport } from "./types.d.ts";
+/**
+ * Create a `.bak` sibling alongside `path` before we mutate/delete it. We only
+ * back up on first touch — subsequent writes to the same file in a single
+ * migration run don't clobber the original snapshot. When `report` is provided
+ * the backup path is recorded for the migration summary.
+ */
+export declare const backupFile: (path: string, report?: MigrationReport) => void;

package/dist/commands/migrate/constants.d.ts

@@ -2,11 +2,15 @@ declare const LINT_STAGED_JSON_CONFIG_FILES: readonly [".lintstagedrc.json", ".l
 declare const LINT_STAGED_OTHER_CONFIG_FILES: readonly [".lintstagedrc.yaml", ".lintstagedrc.yml", ".lintstagedrc.mjs", "lint-staged.config.mjs", ".lintstagedrc.cjs", "lint-staged.config.cjs", ".lintstagedrc.js", "lint-staged.config.js", ".lintstagedrc.ts", "lint-staged.config.ts", ".lintstagedrc.mts", "lint-staged.config.mts", ".lintstagedrc.cts", "lint-staged.config.cts"];
 declare const LINT_STAGED_ALL_CONFIG_FILES: ReadonlyArray<string>;
 declare const STALE_LINT_STAGED_PATTERNS: ReadonlyArray<RegExp>;
-declare const REPLACED_PACKAGES: readonly ["husky", "lint-staged"];
+declare const NANO_STAGED_JSON_CONFIG_FILES: readonly [".nano-staged.json", ".nanostagedrc"];
+declare const NANO_STAGED_OTHER_CONFIG_FILES: readonly [".nano-staged.mjs", ".nano-staged.cjs", ".nano-staged.js", "nano-staged.config.mjs", "nano-staged.config.cjs", "nano-staged.config.js", "nano-staged.config.mts", "nano-staged.config.cts", "nano-staged.config.ts"];
+declare const NANO_STAGED_ALL_CONFIG_FILES: ReadonlyArray<string>;
+declare const STALE_NANO_STAGED_PATTERNS: ReadonlyArray<RegExp>;
+declare const REPLACED_PACKAGES: readonly ["husky", "lint-staged", "nano-staged"];
 declare const HUSKY_SCRIPT_PATTERNS: ReadonlyArray<RegExp>;
 /**
  * Remove husky references from a single script value.
  * Returns the cleaned script, or undefined if the entire script should be removed.
  */
 declare const cleanHuskyFromScript: (scriptValue: string) => string | undefined;
-export { cleanHuskyFromScript, HUSKY_SCRIPT_PATTERNS, LINT_STAGED_ALL_CONFIG_FILES, LINT_STAGED_JSON_CONFIG_FILES, LINT_STAGED_OTHER_CONFIG_FILES, REPLACED_PACKAGES, STALE_LINT_STAGED_PATTERNS, };
+export { cleanHuskyFromScript, HUSKY_SCRIPT_PATTERNS, LINT_STAGED_ALL_CONFIG_FILES, LINT_STAGED_JSON_CONFIG_FILES, LINT_STAGED_OTHER_CONFIG_FILES, NANO_STAGED_ALL_CONFIG_FILES, NANO_STAGED_JSON_CONFIG_FILES, NANO_STAGED_OTHER_CONFIG_FILES, REPLACED_PACKAGES, STALE_LINT_STAGED_PATTERNS, STALE_NANO_STAGED_PATTERNS, };

package/dist/commands/migrate/gitleaks.d.ts

@@ -0,0 +1,29 @@
+import type { MigrateLogger, MigrationReport } from "./types.d.ts";
+interface GitleaksUpstreamFinding {
+    Author?: string;
+    Commit?: string;
+    Date?: string;
+    Description?: string;
+    Email?: string;
+    EndColumn?: number;
+    EndLine?: number;
+    Entropy?: number;
+    File?: string;
+    Fingerprint?: string;
+    Match?: string;
+    Message?: string;
+    RuleID?: string;
+    Secret?: string;
+    StartColumn?: number;
+    StartLine?: number;
+    Tags?: string[];
+}
+declare const detectGitleaksConfig: (root: string) => string | undefined;
+declare const detectGitleaksIgnore: (root: string) => string | undefined;
+declare const detectGitleaksBaseline: (root: string) => string | undefined;
+declare const convertBaseline: (upstream: GitleaksUpstreamFinding[]) => unknown[];
+declare const migrateGitleaks: (root: string, options: {
+    dryRun: boolean;
+    silent?: boolean;
+}, logger: MigrateLogger, report: MigrationReport) => boolean;
+export { convertBaseline, detectGitleaksBaseline, detectGitleaksConfig, detectGitleaksIgnore, migrateGitleaks };

package/dist/commands/migrate/json.d.ts

@@ -1,3 +1,4 @@
+import type { MigrationReport } from "./types.d.ts";
 /**
  * Reads and parses a JSON file. Returns undefined if the file doesn't exist or isn't valid JSON.
  */
@@ -14,7 +15,8 @@ declare const detectJsonIndent: (content: string) => number;
  * Edits a JSON file in place using a mutator function.
  * The mutator receives the parsed data and should return the modified data,
  * or undefined to skip writing. Returns true if the file was modified.
- * Preserves the original indentation style.
+ * Preserves the original indentation style. When `report` is provided, a
+ * `.bak` snapshot is taken before the write.
  */
-declare const editJsonFile: <T>(filePath: string, mutator: (data: T) => T | undefined) => boolean;
+declare const editJsonFile: <T>(filePath: string, mutator: (data: T) => T | undefined, report?: MigrationReport) => boolean;
 export { detectJsonIndent, editJsonFile, isJsonFile, readJsonFile };

package/dist/commands/migrate/kingfisher.d.ts

@@ -0,0 +1,14 @@
+import type { MigrateLogger, MigrationReport } from "./types.d.ts";
+interface KingfisherBaselineRecord {
+    filepath: string;
+    fingerprint: string;
+    linenum: number;
+}
+declare const detectKingfisherBaseline: (root: string) => string | undefined;
+declare const detectKingfisherRules: (root: string) => string | undefined;
+declare const parseKingfisherBaseline: (text: string) => KingfisherBaselineRecord[];
+declare const migrateKingfisher: (root: string, options: {
+    dryRun: boolean;
+    silent?: boolean;
+}, logger: MigrateLogger, report: MigrationReport) => boolean;
+export { detectKingfisherBaseline, detectKingfisherRules, migrateKingfisher, parseKingfisherBaseline };

package/dist/commands/migrate/moon.d.ts

@@ -0,0 +1,5 @@
+import type { MigrateLogger, MigrationReport } from "./types.d.ts";
+export declare const migrateMoon: (workspaceRoot: string, options: {
+    copyTemplates?: boolean;
+    dryRun?: boolean;
+}, logger: MigrateLogger, report: MigrationReport) => void;

package/dist/commands/migrate/nano-staged.d.ts

@@ -0,0 +1,30 @@
+import type { MigrationReport } from "./types.d.ts";
+interface MigrateLogger {
+    info: (message: string) => void;
+    warn: (message: string) => void;
+}
+declare const hasStandaloneNanoStagedConfig: (root: string) => boolean;
+declare const hasUnsupportedNanoStagedConfig: (root: string) => boolean;
+declare const hasStagedConfigInVisConfig: (root: string) => boolean;
+declare const detectNanoStagedConfig: (root: string) => string | undefined;
+declare const extractNanoStagedFromPackageJson: (root: string) => Record<string, string | string[]> | undefined;
+declare const parseNanoStagedJsonFile: (filePath: string) => Record<string, string | string[]> | undefined;
+declare const generateStagedConfigSnippet: (config: Record<string, string | string[]>) => string;
+declare const insertStagedIntoVisConfig: (root: string, config: Record<string, string | string[]>, logger: MigrateLogger) => boolean;
+declare const removeNanoStagedFromPackageJson: (root: string) => {
+    configRemoved: boolean;
+    dependencyRemoved: boolean;
+};
+declare const removeNanoStagedConfigFiles: (root: string, report: MigrationReport) => void;
+declare const rewritePreCommitHook: (root: string, hooksDirectory: string) => boolean;
+/**
+ * Migrates nano-staged configuration to the `staged` block in `vis.config.ts`.
+ * Mirrors the lint-staged migrator: detects configs from package.json or
+ * standalone `.nano-staged.*` files, inlines the mapping, then cleans up
+ * the source, dev-dependency entry, and pre-commit hook invocations.
+ */
+declare const migrateNanoStaged: (root: string, options: {
+    dryRun: boolean;
+    silent?: boolean;
+}, logger: MigrateLogger, report: MigrationReport) => boolean;
+export { detectNanoStagedConfig, extractNanoStagedFromPackageJson, generateStagedConfigSnippet, hasStagedConfigInVisConfig, hasStandaloneNanoStagedConfig, hasUnsupportedNanoStagedConfig, insertStagedIntoVisConfig, migrateNanoStaged, parseNanoStagedJsonFile, removeNanoStagedConfigFiles, removeNanoStagedFromPackageJson, rewritePreCommitHook, };

package/dist/commands/migrate/nx.d.ts

@@ -0,0 +1,12 @@
+import type { MigrateLogger, MigrationReport } from "./types.d.ts";
+/**
+ * Translates an `nx.json` into a `vis.config.ts`. Per-project
+ * `project.json` files are left untouched — vis reads them natively.
+ * @param workspaceRoot Absolute workspace root path.
+ * @param options Migration options.
+ * @param logger Logger for user feedback.
+ * @param report Migration report to append manual steps and warnings.
+ */
+export declare const migrateNx: (workspaceRoot: string, options: {
+    dryRun?: boolean;
+}, logger: MigrateLogger, report: MigrationReport) => void;

package/dist/commands/migrate/prompt.d.ts

@@ -0,0 +1,2 @@
+/** Prompt the user on stdin; returns true on y/yes (empty defaults to yes). */
+export declare const confirm: (question: string) => Promise<boolean>;

package/dist/commands/migrate/secretlint.d.ts

@@ -0,0 +1,14 @@
+import type { MigrateLogger, MigrationReport } from "./types.d.ts";
+declare const detectSecretlintConfig: (root: string) => string | undefined;
+declare const detectSecretlintIgnore: (root: string) => string | undefined;
+/**
+ * Extract the set of rule / preset IDs from a secretlint config. Only parses
+ * JSON-style configs confidently; for .js/.mjs/.cjs we warn and leave the file
+ * for the user to inspect.
+ */
+declare const extractRuleIds: (root: string, file: string, report: MigrationReport) => string[];
+declare const migrateSecretlint: (root: string, options: {
+    dryRun: boolean;
+    silent?: boolean;
+}, logger: MigrateLogger, report: MigrationReport) => boolean;
+export { detectSecretlintConfig, detectSecretlintIgnore, extractRuleIds, migrateSecretlint };