@visulima/vis 1.0.0-alpha.8 → 1.0.0-alpha.9

package/dist/security.d.ts

@@ -1,64 +0,0 @@
-/**
- * Supply chain security for package management commands.
- *
- * Ports pnpm's security features (minimumReleaseAge, trustPolicy,
- * allowBuilds, blockExoticSubdeps, strictDepBuilds) to work universally
- * across all package managers.
- *
- * Support matrix for build script enforcement:
- * - pnpm v10+: Native `allowBuilds` in pnpm-workspace.yaml (vis validates config)
- * - bun: Native `trustedDependencies` in package.json (vis validates config)
- * - npm: NO native allowlist. vis adds --ignore-scripts and runs approved scripts manually
- * - yarn: NO native allowlist. vis checks enableScripts in .yarnrc.yml
- */
-import type { VisConfig } from "./workspace.d.ts";
-type PackageManagerName = "bun" | "npm" | "pnpm" | "yarn";
-interface SecurityCheckResult {
-    errors: string[];
-    warnings: string[];
-}
-/**
- * Checks the vis config for recommended security settings.
- *
- * When `defineConfig()` or `loadVisConfig()` is used, secure defaults are already
- * merged. This function validates the *final* config (defaults + user overrides)
- * and flags remaining gaps — primarily `allowBuilds`, which must be user-supplied.
- */
-declare const checkSecurityConfig: (config: VisConfig, packageManager: string) => SecurityCheckResult;
-/**
- * Emits a single-line security summary warning before PM commands.
- * Skipped in CI unless VIS_SECURITY_WARNINGS=1.
- */
-declare const emitSecurityWarnings: (config: VisConfig, packageManager: string) => void;
-/**
- * Prints the full security audit report, including active settings and warnings.
- */
-declare const printSecurityReport: (config: VisConfig, packageManager: string) => void;
-/**
- * Reports which vis security settings would map to pnpm-workspace.yaml.
- */
-declare const previewPnpmSync: (config: VisConfig) => string[];
-/**
- * Scans node_modules for packages with install scripts that aren't approved.
- */
-declare const scanUnapprovedBuildScripts: (cwd: string, allowBuilds: Record<string, boolean>) => string[];
-interface EnforcementResult {
-    extraArgs: string[];
-    postInstallPackages: string[];
-    scriptsBlockedByDefault: boolean;
-    warnings: string[];
-}
-/**
- * Determines enforcement actions needed before install/add/update.
- */
-declare const enforceScriptSecurity: (pm: PackageManagerName, workspaceRoot: string, config: VisConfig) => EnforcementResult;
-/**
- * Syncs vis security.allowBuilds to native PM config format.
- */
-declare const syncAllowBuildsToNativeConfig: (pm: PackageManagerName, workspaceRoot: string, allowBuilds: Record<string, boolean>) => string[];
-/**
- * Runs postinstall scripts for approved packages after --ignore-scripts install.
- */
-declare const runApprovedScripts: (workspaceRoot: string, patterns: string[]) => void;
-export type { EnforcementResult, PackageManagerName, SecurityCheckResult };
-export { checkSecurityConfig, emitSecurityWarnings, enforceScriptSecurity, previewPnpmSync, printSecurityReport, runApprovedScripts, scanUnapprovedBuildScripts, syncAllowBuildsToNativeConfig, };

package/dist/selectors.d.ts

@@ -1,81 +0,0 @@
-import type { WorkspaceConfiguration } from "@visulima/task-runner";
-/**
- * Parsed form of a target selector.
- *
- * vis accepts moon-style target syntax alongside the simple `<target>`
- * and `--projects` form:
- *
- *   :build              → run `build` on every project
- *   ~:build             → run `build` on the project closest to cwd
- *   #frontend:build     → run `build` on every project tagged `frontend`
- *   my-pkg:build        → run `build` on the single project `my-pkg`
- *   build               → run `build` on every project (legacy form)
- */
-export interface ParsedSelector {
-    /** Selector kind — used by commands for richer diagnostics. */
-    kind: "all" | "closest" | "project" | "tag";
-    /** Projects the selector resolves to (before further filtering). */
-    projects?: string[];
-    /** The tag, when `kind === "tag"`. */
-    tag?: string;
-    /** The target name. */
-    target: string;
-}
-/**
- * Parses a target selector string into its component parts.
- * @param input Raw selector string (e.g. `:build`, `~:test`, `#tag:lint`, `pkg:build`, or bare `build`).
- * @returns The parsed selector, or `undefined` if `input` is empty.
- */
-export declare const parseTargetSelector: (input: string) => Omit<ParsedSelector, "projects"> | undefined;
-/**
- * Resolves a selector string against a workspace to produce a concrete
- * list of project names and the target to run.
- * @param input Raw selector string.
- * @param workspace The discovered workspace configuration.
- * @param cwd Current working directory (used for `~:` closest resolution).
- * @param workspaceRoot Absolute path to the workspace root.
- * @returns An object with `projects` (candidate names) and `target`.
- * @throws If the selector is invalid or `~:` finds no matching project.
- */
-export declare const resolveSelector: (input: string, workspace: WorkspaceConfiguration, cwd: string, workspaceRoot: string) => Promise<{
-    projects: string[];
-    target: string;
-}>;
-/**
- * A single parsed query clause. e.g. `language=typescript` or
- * `tag!=deprecated`.
- */
-interface QueryClause {
-    field: string;
-    op: "!=" | "=";
-    value: string;
-}
-/**
- * Parsed query — a list of clauses combined with either AND or OR.
- * Groups are not supported; all clauses are combined with the same
- * top-level operator.
- */
-interface ParsedQuery {
-    clauses: QueryClause[];
-    op: "&&" | "||";
-}
-/**
- * Parses a query string into a structured predicate.
- *
- * Grammar: `&lt;field>=&lt;value>` or `&lt;field>!=&lt;value>` clauses joined by
- * `&amp;&amp;` (all must match) or `||` (any must match). Mixing operators is
- * not supported and throws.
- * @param input Raw query string, e.g. `"language=typescript &amp;& tag=lib"`.
- * @returns The parsed query, or `undefined` if the input is empty.
- * @throws On mixed `&amp;&amp;` / `||` or malformed clauses.
- */
-export declare const parseQuery: (input: string) => ParsedQuery | undefined;
-/**
- * Filters project names by a query string.
- * @param projectNames Candidate project names to filter.
- * @param workspace The workspace configuration (projects must carry vis metadata).
- * @param query A query string, or `undefined` / empty to skip filtering.
- * @returns The subset of `projectNames` that match the query.
- */
-export declare const filterProjectsByQuery: (projectNames: string[], workspace: WorkspaceConfiguration, query: string | undefined) => string[];
-export {};

package/dist/shell-history.d.ts

@@ -1,16 +0,0 @@
-/**
- * Best-effort append of a command string to the user's shell history
- * file so bare `vis run` followed by an interactive pick shows up in
- * the terminal history — up-arrow then re-runs the resolved target.
- *
- * Detects the shell from `$SHELL`/`$ZDOTDIR` and writes in the
- * shell-specific format. Never throws; silently returns when:
- * - the platform is Windows (history formats vary by terminal host),
- * - no recognizable shell is detected,
- * - the history file can't be opened,
- * - `VIS_NO_SHELL_HISTORY` is set (escape hatch).
- *
- * Scoped intentionally to the interactive-picker path. Explicit
- * `vis run <target>` invocations already appear in history verbatim.
- */
-export declare const appendToShellHistory: (commandLine: string) => Promise<void>;

package/dist/socket-security.d.ts

@@ -1,129 +0,0 @@
-/**
- * Socket.dev security helpers for package security intelligence.
- *
- * Ported from @vltpkg/security-archive and adapted to use the Socket.dev
- * public API for fetching package security scores, alerts, and report data.
- * Uses a file-based cache (following the ai-cache.ts pattern) with a 1-hour TTL.
- * @see https://socket.dev
- * @see https://github.com/vltpkg/vltpkg/tree/main/src/security-archive
- */
-declare const DEFAULT_LOW_SCORE_THRESHOLD = 0.4;
-/** Extra properties attached to a package alert. */
-interface PackageAlertProps {
-    cveId?: `CVE-${string}`;
-    cwes?: {
-        id: `CWE-${string}`;
-    }[];
-    lastPublish: string;
-}
-/** A known security alert for a given package. */
-interface PackageAlert {
-    category: string;
-    key: string;
-    props?: PackageAlertProps;
-    severity: "critical" | "high" | "low" | "medium";
-    type: string;
-}
-/** Security scores for a given package (each 0–1). */
-interface PackageScore {
-    /** Score factors relating to package licensing. */
-    license: number;
-    /** Score factors relating to package maintenance. */
-    maintenance: number;
-    /** Average of all score factors. */
-    overall: number;
-    /** Score factors relating to code quality. */
-    quality: number;
-    /** Score factors relating to supply chain security. */
-    supplyChain: number;
-    /** Score factors relating to package vulnerabilities. */
-    vulnerability: number;
-}
-/** Full report data for a single package from Socket.dev. */
-interface PackageReportData {
-    alerts: PackageAlert[];
-    author: string[];
-    id: string;
-    license: string;
-    name: string;
-    namespace?: `@${string}`;
-    score: PackageScore;
-    size: number;
-    type: "npm";
-    version: string;
-}
-/** Configuration options for the Socket.dev security client. */
-interface SocketSecurityOptions {
-    /** Custom API token. Required — set via VIS_SOCKET_TOKEN env var or config. */
-    apiToken?: string;
-    /** Cache TTL in milliseconds. Defaults to 1 hour. */
-    cacheTtlMs?: number;
-    /** Minimum overall score (0–1) below which packages are flagged. Defaults to 0.4. */
-    minimumScore?: number;
-    /** Request timeout in milliseconds. Defaults to 15 seconds. */
-    timeoutMs?: number;
-}
-declare const isPackageReportData: (o: unknown) => o is PackageReportData;
-declare const calculateOverallScore: (score: Omit<PackageScore, "overall">) => number;
-/**
- * Fetches security report data from the Socket.dev API for the given packages.
- * Batches requests to stay within API limits.
- * @param packages Array of { name, version } to look up.
- * @param options Optional configuration.
- * @returns Map of "name@version" to PackageReportData.
- */
-declare const fetchSocketReports: (packages: {
-    name: string;
-    version: string;
-}[], options?: SocketSecurityOptions) => Promise<Map<string, PackageReportData>>;
-/** Returns the full package name including namespace scope if present. */
-declare const getFullPackageName: (report: Pick<PackageReportData, "name" | "namespace">) => string;
-/** Maps a 0–1 score to a human-readable label. */
-declare const scoreLabel: (score: number) => string;
-/** Maps a 0–1 score to a color name for terminal output. */
-declare const scoreColor: (score: number) => "green" | "red" | "yellow";
-/** Formats a PackageReportData into a compact one-line summary string. */
-declare const formatReportSummary: (report: PackageReportData) => string;
-/** Formats a detailed multi-line report for a single package. */
-declare const formatReportDetailed: (report: PackageReportData) => string;
-/**
- * Formats a security summary for a list of packages.
- * Suitable for displaying after install/update commands.
- */
-declare const formatSecurityOverview: (reports: Map<string, PackageReportData>) => string;
-declare const clearSocketCache: () => number;
-/** Socket.dev config shape as it appears in VisConfig.security.socket. */
-interface SocketConfigLike {
-    apiToken?: string;
-    cacheTtlMs?: number;
-    enabled?: boolean;
-    minimumScore?: number;
-    timeoutMs?: number;
-}
-/**
- * Builds SocketSecurityOptions from the VisConfig socket config section.
- * Returns undefined if Socket.dev is not enabled or no API token is available.
- */
-declare const buildSocketOptions: (socketConfig: SocketConfigLike | undefined) => SocketSecurityOptions | undefined;
-/** A persisted "accepted risk" entry from the vis config. */
-interface AcceptedRisk {
-    /** ISO 8601 timestamp when the risk was accepted. */
-    acceptedAt: string;
-    /** The overall Socket.dev score at the time of acceptance. */
-    acceptedScore: number;
-    /** User-provided reason for accepting the risk. */
-    reason: string;
-}
-/**
- * Checks if a package has an accepted risk entry.
- * Matches by exact name@version, unversioned name, or trailing glob patterns.
- * Returns the matching AcceptedRisk if found, undefined otherwise.
- */
-declare const findAcceptedRisk: (packageName: string, version: string, acceptedRisks: Record<string, AcceptedRisk> | undefined) => AcceptedRisk | undefined;
-/**
- * Formats a config snippet for the user to paste into vis.config.ts
- * to persist an accepted risk decision.
- */
-declare const formatAcceptedRiskSnippet: (packageName: string, _version: string, score: number, reason: string) => string;
-export type { AcceptedRisk, PackageAlert, PackageAlertProps, PackageReportData, PackageScore, SocketSecurityOptions };
-export { buildSocketOptions, calculateOverallScore, clearSocketCache, DEFAULT_LOW_SCORE_THRESHOLD, fetchSocketReports, findAcceptedRisk, formatAcceptedRiskSnippet, formatReportDetailed, formatReportSummary, formatSecurityOverview, getFullPackageName, isPackageReportData, scoreColor, scoreLabel, };

package/dist/staged/cli-parse.d.ts

@@ -1,18 +0,0 @@
-/**
- * Small helpers shared between the CLI command and the programmatic
- * surface when a value has to be coerced from a string (CLI flag, env
- * variable, config file). Kept free of runtime deps so it can be unit
- * tested in isolation.
- */
-/** Env var read as the concurrency fallback when `--concurrent` isn't passed. */
-export declare const CONCURRENT_ENV_VAR = "VIS_STAGED_CONCURRENT";
-/**
- * Parses a stringified concurrency value. Accepts the same shapes as the
- * `--concurrent` CLI flag:
- *
- * - `"true"` or an empty string → `true` (unbounded, capped internally at CPU count)
- * - `"false"` → `false` (serial)
- * - an integer string → the parsed number
- * - anything else (including NaN) → `true`, matching the CLI-flag fallback
- */
-export declare const parseConcurrent: (value: string) => boolean | number;

package/dist/staged/config.d.ts

@@ -1,14 +0,0 @@
-import type { RunOptions, StagedConfig, StagedTask } from "./types.d.ts";
-/**
- * Resolves the user's staged config. We deliberately do NOT auto-discover
- * external `.lintstagedrc*` / `.vis-staged.*` files at runtime — that
- * keeps the config surface to a single place (`vis.config.ts`) and means
- * there's no ambiguity about which file drives a run.
- *
- * Users migrating from lint-staged or nano-staged go through
- * `vis migrate lint-staged` / `vis migrate nano-staged`, which inline
- * the old config into `vis.config.ts` and remove the external files.
- */
-export declare const resolveConfig: (options: RunOptions) => Promise<StagedConfig>;
-/** Validates that a resolved config has the right shape. */
-export declare const validateConfig: (config: unknown) => Record<string, StagedTask>;

package/dist/staged/errors/apply-empty-commit-error.d.ts

@@ -1,4 +0,0 @@
-import { StagedError } from "./staged-error.d.ts";
-/** Post-task commit would be empty and `--allow-empty` was not set. */
-export declare class ApplyEmptyCommitError extends StagedError {
-}

package/dist/staged/errors/config-error.d.ts

@@ -1,4 +0,0 @@
-import { StagedError } from "./staged-error.d.ts";
-/** Configuration was missing, malformed, or resolved to an unsupported shape. */
-export declare class ConfigError extends StagedError {
-}

package/dist/staged/errors/get-backup-stash-error.d.ts

@@ -1,4 +0,0 @@
-import { StagedError } from "./staged-error.d.ts";
-/** The backup stash could not be located during cleanup/revert. */
-export declare class GetBackupStashError extends StagedError {
-}

package/dist/staged/errors/git-error.d.ts

@@ -1,6 +0,0 @@
-import { StagedError } from "./staged-error.d.ts";
-/** A git subprocess failed. Holds the stderr tail for surface-level reporting. */
-export declare class GitError extends StagedError {
-    readonly stderr?: string;
-    constructor(message: string, stderr?: string, options?: ErrorOptions);
-}

package/dist/staged/errors/index.d.ts

@@ -1,12 +0,0 @@
-/**
- * Typed error classes surfaced by the staged workflow. Consumers can
- * switch on `instanceof` to distinguish setup failures from task/git
- * failures. Error names mirror lint-staged's where behavior overlaps.
- */
-export { ApplyEmptyCommitError } from "./apply-empty-commit-error.d.ts";
-export { ConfigError } from "./config-error.d.ts";
-export { GetBackupStashError } from "./get-backup-stash-error.d.ts";
-export { GitError } from "./git-error.d.ts";
-export { RestoreOriginalStateError } from "./restore-original-state-error.d.ts";
-export { StagedError } from "./staged-error.d.ts";
-export { TaskError } from "./task-error.d.ts";

package/dist/staged/errors/restore-original-state-error.d.ts

@@ -1,4 +0,0 @@
-import { StagedError } from "./staged-error.d.ts";
-/** Restoring the working tree from the backup stash failed. */
-export declare class RestoreOriginalStateError extends StagedError {
-}

package/dist/staged/errors/staged-error.d.ts

@@ -1,8 +0,0 @@
-/**
- * Base class for all staged-workflow errors. Consumers switch on
- * `instanceof StagedError` to distinguish our failures from arbitrary
- * task exceptions.
- */
-export declare class StagedError extends Error {
-    constructor(message: string, options?: ErrorOptions);
-}

package/dist/staged/errors/task-error.d.ts

@@ -1,6 +0,0 @@
-import { StagedError } from "./staged-error.d.ts";
-/** A user-provided task exited non-zero or threw. */
-export declare class TaskError extends StagedError {
-    readonly commandTitle: string;
-    constructor(commandTitle: string, message: string, options?: ErrorOptions);
-}

package/dist/staged/git/diff.d.ts

@@ -1,76 +0,0 @@
-declare const DEFAULT_DIFF_FILTER = "ACMR";
-/**
- * Lists paths staged as "intent to add" (`git add -N`). These entries crash
- * `git stash create` with `Entry 'path' not uptodate. Cannot merge.`
- * We detect them via `git diff-files --raw`, which emits an all-zero new sha
- * with status `A` for intent-to-add entries (regular worktree-vs-index diffs
- * show a real blob sha for unstaged edits).
- *
- * The caller temporarily unstages them before the backup stash runs, and
- * restores the intent-to-add state in cleanup. See lint-staged issue #990.
- */
-export declare const getIntentToAddPaths: (cwd: string) => Promise<string[]>;
-/**
- * Lists untracked, non-ignored files in the working tree. Used by
- * `--autoStage` to pick up files a task created during the run.
- */
-export declare const getUntrackedFiles: (cwd: string) => Promise<string[]>;
-/** Removes the listed paths from the index (`git rm --cached`), leaving the on-disk content alone. */
-export declare const removeFromIndex: (paths: ReadonlyArray<string>, options: {
-    readonly cwd: string;
-}) => Promise<void>;
-/**
- * Lists files captured by the current diff — by default, staged files
- * matching the `ACMR` filter. When `diff` is set the range overrides
- * `--staged` (matching lint-staged's `--diff` CLI flag).
- */
-export declare const getFiles: (options: {
-    readonly cwd: string;
-    readonly diff?: string;
-    readonly diffFilter?: string;
-    readonly workTree?: string;
-}) => Promise<string[]>;
-/**
- * Captures the unstaged delta for a list of paths as a git patch. The
- * resulting buffer can be re-applied with `git apply` after tasks run.
- * Returns `null` when there are no unstaged changes for any of the paths.
- *
- * Splits `paths` into batches to stay under `ARG_MAX` on large staged
- * sets. Patch fragments from each batch concatenate cleanly because
- * every fragment starts with its own `diff --git` header.
- *
- * Appends a trailing newline when git's stdout doesn't end in one —
- * `git apply` rejects patches without a final newline as "corrupt patch
- * at line N" even with `--recount --unidiff-zero`.
- */
-export declare const capturePatch: (paths: ReadonlyArray<string>, options: {
-    readonly cwd: string;
-}) => Promise<Buffer | null>;
-/**
- * Returns the worktree-relative paths that have both staged and unstaged modifications.
- *
- * `git status --porcelain=v1 -z` uses NUL record separators and splits rename/copy entries
- * across two records: the status+new-path record, then a second record holding the old path.
- * We walk the records, consuming the trailing old-path record for R/C statuses so they
- * don't leak into the next iteration as a malformed status line.
- */
-export declare const getPartiallyStagedFiles: (cwd: string) => Promise<string[]>;
-/**
- * Restores working-tree content for the given paths from the index.
- * Uses `--pathspec-from-file` with NUL-separated stdin so huge lists
- * don't blow past `ARG_MAX`.
- */
-export declare const checkoutPaths: (paths: ReadonlyArray<string>, options: {
-    readonly cwd: string;
-}) => Promise<void>;
-/**
- * Refreshes the index against the working tree. Runs `git update-index --again`
- * first (lint-staged v17 behaviour — improves compatibility when the original
- * commit used a pathspec instead of an explicit `git add`), then falls back
- * to `git add -u` against the originally-staged paths to handle deletions
- * that `update-index --again` can't express.
- */
-export declare const updateIndexAgain: (paths: ReadonlyArray<string>, options: {
-    readonly cwd: string;
-}) => Promise<void>;
-export { DEFAULT_DIFF_FILTER };

package/dist/staged/git/exec.d.ts

@@ -1,43 +0,0 @@
-export interface GitExecOptions {
-    readonly cwd: string;
-    /** Environment overrides merged on top of `process.env`. */
-    readonly env?: Record<string, string>;
-    /** Pipe stdin as a Buffer (used for `git apply`). */
-    readonly input?: Buffer | string;
-    /** Ignore non-zero exit codes; useful for `rev-parse` checks. */
-    readonly lenient?: boolean;
-}
-export interface GitExecResult {
-    readonly exitCode: number;
-    readonly stderr: string;
-    readonly stdout: string;
-}
-/** Runs `git` with the given args. Throws `GitError` on non-zero unless `lenient`. */
-export declare const git: (args: ReadonlyArray<string>, options: GitExecOptions) => Promise<GitExecResult>;
-/** Convenience: returns trimmed stdout from a successful git invocation. */
-export declare const gitOut: (args: ReadonlyArray<string>, options: GitExecOptions) => Promise<string>;
-/** Returns true if `cwd` is inside a git working tree. */
-export declare const isGitRepo: (cwd: string) => Promise<boolean>;
-/** Returns the absolute path to the repository's `.git` directory. */
-export declare const getGitDirectory: (cwd: string) => Promise<string>;
-/** Returns the absolute path to the working-tree root. */
-export declare const getWorkTree: (cwd: string) => Promise<string>;
-/** Returns the current index tree sha (via `git write-tree`). */
-export declare const writeIndexTree: (cwd: string) => Promise<string>;
-/** Returns the tree sha for `HEAD`. Empty string when there is no commit yet. */
-export declare const headTreeSha: (cwd: string) => Promise<string>;
-/** Minimum git version required by the staged workflow — matches lint-staged v17. */
-export declare const MIN_GIT_VERSION: {
-    readonly major: 2;
-    readonly minor: 32;
-};
-/**
- * Parses `git --version` output (e.g. `git version 2.45.1.windows.2`) into a
- * `{ major, minor }` tuple. Returns `null` when the shape isn't recognised.
- */
-export declare const parseGitVersion: (output: string) => {
-    major: number;
-    minor: number;
-} | null;
-/** Throws `GitError` when the installed git is older than {@link MIN_GIT_VERSION}. */
-export declare const assertGitVersion: (cwd: string) => Promise<void>;

package/dist/staged/git/index.d.ts

@@ -1,77 +0,0 @@
-import type { RunOptions } from "../types.d.ts";
-/**
- * Encapsulates the full git side-effect sequence around task execution:
- * take a backup stash, hide unstaged deltas, run tasks, re-stage fixes,
- * reapply hidden deltas, and revert on failure. Mirrors lint-staged's
- * GitWorkflow state machine with equivalent flag behavior.
- */
-export declare class GitWorkflow {
-    stagedFiles: string[];
-    partiallyStaged: string[];
-    workTree: string;
-    gitDir: string;
-    /** Index tree sha captured at the end of `prepare()`, before tasks run. */
-    preTaskIndexTree: string;
-    /** Index tree sha captured at the end of `applyModifications()`, after tasks' in-place edits are staged. */
-    postTaskIndexTree: string;
-    /** HEAD tree sha captured in `prepare()` — used to detect empty-after-revert commits. */
-    headTree: string;
-    /** Becomes true after a successful `revert()` so the caller can skip the unstaged-patch re-apply that would duplicate the restored deltas. */
-    revertApplied: boolean;
-    /** Emitted by `prepare()` when we skip the backup stash but still have partially-staged files — the caller can surface this to the user. */
-    warnings: string[];
-    private readonly cwd;
-    private readonly options;
-    private patch;
-    private backupStashSha;
-    private merge;
-    private readonly shouldStash;
-    private readonly shouldHidePartial;
-    private readonly shouldHideUnstaged;
-    private readonly shouldHideAll;
-    /** Sha of the hide-all push stash (if `--hide-all` is set), tracked separately from the create+store backup. */
-    private hideAllStashSha;
-    /** Paths that were `git add -N`'d (intent-to-add) — removed from the index before stashing, restored after. */
-    private intentToAddPaths;
-    /** Untracked files observed at the end of `prepare()`. Diffed post-run to detect task-created files for `--autoStage`. */
-    private preTaskUntracked;
-    constructor(options: RunOptions);
-    prepare(): Promise<void>;
-    /**
-     * Refreshes the index against the working tree, so task edits
-     * (including deletions of already-tracked files) are re-staged.
-     * Uses `git update-index --again` for parity with lint-staged v17,
-     * which behaves correctly when the original commit used a pathspec.
-     */
-    applyModifications({ autoStage }?: {
-        readonly autoStage?: boolean;
-    }): Promise<void>;
-    /** True when tasks modified at least one staged file's content (index tree changed). */
-    indexTreeChanged(): boolean;
-    /** True when the post-task index tree matches HEAD — i.e. tasks reverted every staged change. */
-    postTaskIndexMatchesHead(): boolean;
-    /**
-     * Re-applies the hidden unstaged patch. Falls back to 3-way on conflict.
-     * Skips silently when `revert()` already restored the working tree from the backup stash,
-     * since the stash already carries those deltas and re-applying would duplicate them.
-     * When `--hide-all` is active this is also a no-op — the `popHideAllStash()` call in
-     * `cleanup()` handles restore for that mode.
-     */
-    restoreUnstagedChanges(): Promise<void>;
-    /** Restores index + working tree from the backup stash and drops it. */
-    revert(): Promise<void>;
-    /**
-     * On success, drops the backup stash and pops the hide-all stash (if any).
-     * On failure without --revert, leaves the backup stash in place so the
-     * user can recover manually.
-     */
-    cleanup(success: boolean): Promise<void>;
-    /**
-     * Returns a user-facing hint that points at the backup stash when
-     * tasks failed and we kept it around (no --revert).
-     */
-    recoveryHint(): string | null;
-    private hideUnstagedChanges;
-    private snapshotMergeState;
-    private restoreMergeState;
-}

package/dist/staged/git/stash.d.ts

@@ -1,37 +0,0 @@
-/** Message prefix stored on the stash entry. A per-process suffix is appended at creation time so concurrent `vis staged` invocations don't collide. */
-declare const STASH_MESSAGE_PREFIX = "vis_staged_automatic_backup";
-/**
- * Creates and stores a hidden backup stash. Uses `git stash create +
- * store` instead of `git stash push` so the working tree and index are
- * left untouched — pushing would mutate the worktree, which breaks
- * concurrent editors and file watchers.
- *
- * Returns the stash commit sha, or `null` when there is nothing to
- * stash (e.g. a fresh repo with only an initial commit).
- */
-export declare const createBackupStash: (cwd: string) => Promise<string | null>;
-/**
- * Stashes every unstaged change and untracked file on top of the index,
- * leaving only staged content in the working tree. Unlike
- * {@link createBackupStash}, this uses `git stash push --include-untracked`
- * because `git stash create` cannot capture untracked files.
- *
- * Returns the stash commit sha so the caller can drop or apply it later.
- */
-export declare const createHideAllStash: (cwd: string) => Promise<string | null>;
-/** Drops the stash entry that resolves to `sha`, if one is present. */
-export declare const dropBackupStash: (cwd: string, sha: string | null) => Promise<void>;
-/**
- * Restores the working tree and index from the backup stash. Used by
- * the revert path when tasks failed and we need to leave the repo in
- * its pre-task state.
- */
-export declare const applyBackupStash: (cwd: string, sha: string | null) => Promise<void>;
-/**
- * Pops the hide-all stash back onto the working tree — restoring
- * previously-hidden unstaged edits and untracked files. The index is
- * left untouched so task-driven edits that we already re-staged
- * survive the restore.
- */
-export declare const popHideAllStash: (cwd: string, sha: string | null) => Promise<void>;
-export { STASH_MESSAGE_PREFIX };

package/dist/staged/index.d.ts

@@ -1,13 +0,0 @@
-import type { RunOptions, RunResult } from "./types.d.ts";
-/**
- * Runs staged tasks end-to-end: backup, hide unstaged, match files,
- * execute commands, re-stage fixes, reapply unstaged deltas, cleanup.
- * Returns `{ success, ranTasks, failedCommands }`.
- *
- * Throws on setup-level failures (no git repo, invalid config). Task
- * failures are reported via the return value when `continueOnError` is
- * enabled, otherwise they end the run with `success: false`.
- */
-export declare const runStaged: (options?: RunOptions) => Promise<RunResult>;
-export { ApplyEmptyCommitError, ConfigError, GetBackupStashError, GitError, RestoreOriginalStateError, StagedError, TaskError } from "./index.d.ts";
-export type { RunOptions, RunResult, StagedConfig } from "./types.d.ts";

package/dist/staged/match.d.ts

@@ -1,12 +0,0 @@
-export interface MatchOptions {
-    readonly caseInsensitive?: boolean;
-}
-export declare const matchFiles: (pattern: string, files: ReadonlyArray<string>, cwd: string, options?: MatchOptions) => string[];
-/**
- * Filters a staged file list against a top-level ignore list. A file is
- * dropped when any of the ignore patterns matches — basename-style for
- * patterns without a path separator, path-style relative to `cwd`
- * otherwise. Mirrors the `matchFiles` semantics (including `caseInsensitive`)
- * so users don't have to think twice about the ignore syntax.
- */
-export declare const applyIgnore: (files: ReadonlyArray<string>, ignore: ReadonlyArray<string> | undefined, cwd: string, options?: MatchOptions) => string[];