@visulima/vis 2.0.0 → 2.0.2

package/dist/packem_chunks/registry.js

@@ -1,36 +1,36 @@
-import{createRequire as Ne}from"node:module";import{VisReleaseError as l}from"../packem_shared/VisReleaseError-DMGRBTNO.js";import{VersionActions as N}from"../packem_shared/AfterAllProjectsVersioned-CAKI2nWf.js";import{E as Re}from"../packem_shared/public-api-WqUCiyIe.js";import{resolveCleanStripList as Me}from"./DEFAULT_CLEAN_KEEP.js";import{assertValidPackageName as F,resolveCustomCommands as W,interpolateCommand as J}from"./security.js";const _e=Ne(import.meta.url),x=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,V=t=>{if(typeof x<"u"&&x.versions&&x.versions.node){const[e,n]=x.versions.node.split(".").map(Number);if(e>22||e===22&&n>=3||e===20&&n>=16)return x.getBuiltinModule(t)}return _e(t)},{readFile:A,writeFile:O,rm:je,readdir:xe}=V("node:fs/promises"),{dirname:U,join:h}=V("node:path"),{fileURLToPath:Ve}=V("node:url"),{mkdtempSync:G,writeFileSync:Oe}=V("node:fs"),{tmpdir:B}=V("node:os"),Ee=["dependencies","devDependencies","peerDependencies","optionalDependencies"],fe=(t,e)=>{if(t.startsWith("catalog:")||t==="*"||t==="workspace:*"||t==="workspace:^"||t==="workspace:~")return t;if(t.startsWith("workspace:")){const n=t.slice(10);return`workspace:${L(n)}${e}`}if(t.startsWith("npm:")){const n=t.lastIndexOf("@");if(n<=4)return t;const r=t.slice(4,n),s=t.slice(n+1),a=L(s);return`npm:${r}@${a}${e}`}return`${L(t)}${e}`},De=/^([\^~=]|>=?|<=?)/,L=t=>{const e=De.exec(t);return e?e[1]??"^":"^"},Tt=async(t,e,n={})=>{const r=n.serializeManifest??Ge,s=n.changelogPath??We,a=n.renderChangelogEntry??Je,i=new Map(t.releases.map(p=>[p.name,p.newVersion])),o=await Promise.all(t.releases.map(async p=>{const m=e.getPackage(p.name);if(!m)return;const y=Fe(m.manifest,p.newVersion,i),b=n.readManifest?.(m.manifestPath),w=s(m);return{changelogEntry:await a(p),changelogPath:w,manifestWrite:{content:r(y,b),path:m.manifestPath}}})),c=[],d=new Map;for(const p of o){if(!p)continue;c.push(p.manifestWrite);const m=d.get(p.changelogPath);m?m.push(p.changelogEntry):d.set(p.changelogPath,[p.changelogEntry])}for(const[p,m]of d){const y=m.join(`
+import{createRequire as Ne}from"node:module";import{VisReleaseError as l}from"../packem_shared/VisReleaseError-DMGRBTNO.js";import{VersionActions as N}from"../packem_shared/AfterAllProjectsVersioned-CAKI2nWf.js";import{E as Me}from"../packem_shared/public-api-WqUCiyIe.js";import{resolveCleanStripList as Ee}from"./DEFAULT_CLEAN_KEEP.js";import{assertValidPackageName as F,resolveCustomCommands as W,interpolateCommand as J}from"./security.js";let _e;const je=t=>(_e??=Ne(import.meta.url))(t),x=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,V=t=>{if(typeof x<"u"&&x.versions&&x.versions.node){const[e,n]=x.versions.node.split(".").map(Number);if(e>22||e===22&&n>=3||e===20&&n>=16)return x.getBuiltinModule(t)}return je(t)},{readFile:A,writeFile:O,rm:xe,readdir:Ve}=V("node:fs/promises"),{dirname:U,join:h}=V("node:path"),{fileURLToPath:Oe}=V("node:url"),{mkdtempSync:G,writeFileSync:Re}=V("node:fs"),{tmpdir:B}=V("node:os"),De=["dependencies","devDependencies","peerDependencies","optionalDependencies"],fe=(t,e)=>{if(t.startsWith("catalog:")||t==="*"||t==="workspace:*"||t==="workspace:^"||t==="workspace:~")return t;if(t.startsWith("workspace:")){const n=t.slice(10);return`workspace:${L(n)}${e}`}if(t.startsWith("npm:")){const n=t.lastIndexOf("@");if(n<=4)return t;const r=t.slice(4,n),s=t.slice(n+1),a=L(s);return`npm:${r}@${a}${e}`}return`${L(t)}${e}`},Fe=/^([\^~=]|>=?|<=?)/,L=t=>{const e=Fe.exec(t);return e?e[1]??"^":"^"},Ut=async(t,e,n={})=>{const r=n.serializeManifest??Be,s=n.changelogPath??Je,a=n.renderChangelogEntry??He,i=new Map(t.releases.map(p=>[p.name,p.newVersion])),o=await Promise.all(t.releases.map(async p=>{const m=e.getPackage(p.name);if(!m)return;const y=Le(m.manifest,p.newVersion,i),b=n.readManifest?.(m.manifestPath),w=s(m);return{changelogEntry:await a(p),changelogPath:w,manifestWrite:{content:r(y,b),path:m.manifestPath}}})),c=[],d=new Map;for(const p of o){if(!p)continue;c.push(p.manifestWrite);const m=d.get(p.changelogPath);m?m.push(p.changelogEntry):d.set(p.changelogPath,[p.changelogEntry])}for(const[p,m]of d){const y=m.join(`
 
-`),b=n.readChangelog?.(p);c.push({content:Ue(y,b),path:p})}return{deletions:t.consumedChangeFiles.map(p=>p.path),writes:c}},Fe=(t,e,n)=>{const r={...t,version:e};for(const s of Ee){const a=t[s];if(!a||typeof a!="object")continue;const i={...a};let o=!1;for(const[c,d]of Object.entries(a)){const p=n.get(c);if(p===void 0)continue;const m=fe(d,p);m!==d&&(i[c]=m,o=!0)}o&&(r[s]=i)}return r},Le=/^# .+/,Te=/^## /m,Ue=(t,e)=>{const n=t.trim();if(!e||e.trim()==="")return`# Changelog
+`),b=n.readChangelog?.(p);c.push({content:Ge(y,b),path:p})}return{deletions:t.consumedChangeFiles.map(p=>p.path),writes:c}},Le=(t,e,n)=>{const r={...t,version:e};for(const s of De){const a=t[s];if(!a||typeof a!="object")continue;const i={...a};let o=!1;for(const[c,d]of Object.entries(a)){const p=n.get(c);if(p===void 0)continue;const m=fe(d,p);m!==d&&(i[c]=m,o=!0)}o&&(r[s]=i)}return r},Te=/^# .+/,Ue=/^## /m,Ge=(t,e)=>{const n=t.trim();if(!e||e.trim()==="")return`# Changelog
 
 ${n}
-`;const r=e.split(/\r?\n/);if(r[0]&&Le.test(r[0])){let s=1;for(;s<r.length&&!(r[s]??"").startsWith("## ");)s+=1;const a=r.slice(0,s),i=r.slice(s);return a.length>0&&a[a.length-1]!==""&&a.push(""),[...a,n,"",...i].join(`
+`;const r=e.split(/\r?\n/);if(r[0]&&Te.test(r[0])){let s=1;for(;s<r.length&&!(r[s]??"").startsWith("## ");)s+=1;const a=r.slice(0,s),i=r.slice(s);return a.length>0&&a[a.length-1]!==""&&a.push(""),[...a,n,"",...i].join(`
 `).replaceAll(/\n{3,}/g,`
 
-`)}return Te.test(e)?`${n}
+`)}return Ue.test(e)?`${n}
 
 ${e.trimStart()}`:`${n}
 
-${e.trimStart()}`},Ge=(t,e)=>{const n=Be(e);return`${JSON.stringify(t,null,n)}
-`},Be=t=>{if(!t)return 4;const e=/\n(\s+)"/.exec(t);if(!e)return 4;const n=(e[1]??"").length;return n===2||n===4?n:4},We=t=>`${t.dir}/CHANGELOG.md`,Je=t=>{const e=new Date().toISOString().slice(0,10),n=[`## ${t.newVersion}`,`<sub>${e}</sub>`,""];if(t.isCascadeBump||t.isGroupBump)for(const r of t.sources)n.push(`- Version bump from ${r.name}@${r.newVersion}`);else if(t.isDependencyBump&&t.changeFiles.length===0)for(const r of t.sources)r.newVersion===""?n.push(`- Removed dependency ${r.name}`):n.push(`- Updated dependency ${r.name}@${r.newVersion}`);else for(const r of t.changeFiles)for(const s of r.body.split(/\r?\n/)){if(s.trim()===""){n.push("");continue}n.push(s.startsWith("-")||s.startsWith("*")?s:`- ${s}`)}return n.join(`
-`)},He=["dependencies","devDependencies","peerDependencies","optionalDependencies"],Q={default:{},named:{}},Ke=t=>{if(!t)return Q;let e;try{e=Re(t,{schema:"core",strict:!0})}catch(s){throw new l({cause:s,code:"CONFIG_INVALID",message:`Failed to parse pnpm-workspace.yaml: ${s.message}`})}if(typeof e!="object"||e===null||Array.isArray(e))return Q;const n=e,r={default:{},named:{}};if(typeof n.catalog=="object"&&n.catalog!==null&&!Array.isArray(n.catalog))for(const[s,a]of Object.entries(n.catalog))typeof a=="string"&&(r.default[s]=a);if(typeof n.catalogs=="object"&&n.catalogs!==null&&!Array.isArray(n.catalogs))for(const[s,a]of Object.entries(n.catalogs)){if(typeof a!="object"||a===null||Array.isArray(a))continue;const i={};for(const[o,c]of Object.entries(a))typeof c=="string"&&(i[o]=c);r.named[s]=i}return r},we=(t,e,n)=>{if(!t.startsWith("catalog:"))return t;const r=t.slice(8),s=r===""?n.default:n.named[r];if(s)return s[e]},Y=(t,e)=>{const n={...t};for(const r of He){const s=t[r];if(!s||typeof s!="object")continue;const a={...s};for(const[i,o]of Object.entries(s)){if(!o.startsWith("catalog:"))continue;const c=we(o,i,e);if(c===void 0)throw new l({code:"CONFIG_INVALID",message:`Cannot resolve "${o}" for dependency "${i}" in package "${t.name}". Add it to pnpm-workspace.yaml's "catalog" or "catalogs" block.`,packageName:t.name});a[i]=c}n[r]=a}return n},Ut=Object.defineProperty({__proto__:null,parseCatalogs:Ke,resolveCatalogRef:we,rewriteCatalogRefs:Y},Symbol.toStringTag,{value:"Module"}),qe="ACTIONS_ID_TOKEN_REQUEST_URL",z=t=>{const e=!!t.env[qe],n=!!t.env[t.staticTokenVar],r=t.workspaceConfig?.publish?.preferStaticToken===!0;return e&&!(r&&n)?"oidc":n?"token":"missing"};let T;const Ye="https://github.com/visulima/visulima",ze=async()=>{try{let t=U(Ve(import.meta.url));for(let e=0;e<6;e+=1){const n=h(t,"package.json");try{const s=await A(n,"utf8"),a=JSON.parse(s);if(a.name==="@visulima/vis"&&typeof a.version=="string")return a.version}catch{}const r=U(t);if(r===t)break;t=r}}catch{}return"unknown"},Qe=async()=>(T!==void 0||(T=`vis-release/${await ze()} (+${Ye})`),T),X=new Map,Xe=async t=>{const e=X.get(t);if(e!==void 0)return e;try{const n=await import("./index4.js").then(s=>s.i),r=new n.ProxyAgent(t);return X.set(t,r),r}catch{return}},Ze=t=>t===301||t===302||t===303||t===307||t===308,et=(t,e)=>{try{const n=new URL(t),r=new URL(e);return n.host===r.host&&n.protocol===r.protocol}catch{return!1}},j=async(t,e={})=>{const n=e.maxRedirects??2,r={"User-Agent":await Qe(),...e.headers};e.headers?.["User-Agent"]&&(r["User-Agent"]=e.headers["User-Agent"]);let s=t,a=0;const i=e.httpProxy?await Xe(e.httpProxy):void 0;for(;;){let o;try{const p=e.fetchImpl??globalThis.fetch,m={headers:r,method:e.method??"GET",redirect:"manual"};i&&(m.dispatcher=i),o=await p(s,m)}catch{return{json:async()=>{},ok:!1,status:0,text:async()=>""}}if(!Ze(o.status))return{json:async()=>{try{return await o.json()}catch{return}},ok:o.ok,status:o.status,text:async()=>{try{return await o.text()}catch{return""}}};const c=o.headers.get("location")??o.headers.get("Location");if(!c||a>=n)return{json:async()=>{},ok:!1,status:0,text:async()=>""};let d;try{d=new URL(c,s).toString()}catch{return{json:async()=>{},ok:!1,status:0,text:async()=>""}}if(!et(t,d))return{json:async()=>{},ok:!1,status:0,text:async()=>""};s=d,a+=1}},tt="https://crates.io/api/v1/crates",nt="Cargo.toml",Z=async t=>{let e;try{e=await A(t,"utf8")}catch(o){throw new l({cause:o,code:"CONFIG_INVALID",file:t,message:`Failed to read Cargo.toml at ${t}: ${o.message}`})}const{parse:n}=await import("./index5.js");let r;try{r=n(e)}catch(o){throw new l({cause:o,code:"CONFIG_INVALID",file:t,message:`Failed to parse Cargo.toml at ${t}: ${o.message}`})}if(!r.package)throw new l({code:"CONFIG_INVALID",file:t,hint:"CargoVersionActions only supports publishable crates with a [package] table. For workspace roots, point per-package config at the member crate directory.",message:`Cargo.toml at ${t} has no [package] table.`});const{name:s}=r.package;if(typeof s!="string"||s.length===0)throw new l({code:"CONFIG_INVALID",file:t,message:`Cargo.toml at ${t} is missing [package].name.`});const a=r.package.version;let i;if(typeof a=="string"?i=a:a&&typeof a=="object"&&a.workspace===!0&&(i=r.workspace?.package?.version),typeof i!="string"||i.length===0)throw new l({code:"CONFIG_INVALID",file:t,hint:"Set [package].version explicitly, or — for workspace-inherited versions — ensure the root Cargo.toml carries [workspace.package].version and point per-package config at it.",message:`Cargo.toml at ${t} has no resolvable [package].version.`});return{name:s,version:i}},ee=async(t,e)=>{const n=`${tt}/${encodeURIComponent(t)}`;try{const r=await j(n,{headers:{Accept:"application/json"},httpProxy:e});if(r.status===404||!r.ok)return;const s=await r.json();return s?.crate?.max_stable_version??s?.crate?.max_version??void 0}catch{return}},rt=(t,e)=>z({env:t,staticTokenVar:"CARGO_REGISTRY_TOKEN",workspaceConfig:e})==="oidc",st=async(t,e)=>{const n=await t.run("cargo",["package","--list","--allow-dirty"],{cwd:e,silent:!0});return n.exitCode!==0?[]:n.stdout.split(/\r?\n/).map(r=>r.trim()).filter(r=>r.length>0)};class at extends N{id="cargo";async readPublishedVersion(e){const n=H(e.pkg);try{const{name:r}=await Z(n);return await ee(r)}catch{return}}async publish(e){if(e.dryRun)return{output:`[dry-run / cargo] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const n=H(e.pkg,e.perPackageConfig),r=ot(e.pkg,e.perPackageConfig),{name:s,version:a}=await Z(n);if(a!==e.release.newVersion)throw new l({code:"CONFIG_INVALID",file:n,hint:`Confirm the cargo() preset's crateDir points at the directory containing this Cargo.toml. Expected ${e.release.newVersion} on disk after the extra-files bump.`,message:`Cargo.toml version (${a}) does not match planned release version (${e.release.newVersion}) for ${e.pkg.name}.`,packageName:e.pkg.name});if(await ee(s,e.workspaceConfig?.httpProxy)===e.release.newVersion)return{alreadyPublished:!0,output:`[cargo] ${s}@${e.release.newVersion} already on crates.io`,published:!1};const i=rt(process.env,e.workspaceConfig);if(!i&&!process.env.CARGO_REGISTRY_TOKEN)throw new l({code:"AUTH_MISSING",hint:"Set CARGO_REGISTRY_TOKEN, or run from a GH-Actions job with `permissions: id-token: write` for OIDC trusted publishing.",message:`Cannot publish ${s}@${e.release.newVersion}: neither CARGO_REGISTRY_TOKEN nor OIDC trusted publishing is available.`,packageName:e.pkg.name});const o=e.workspaceConfig?.publish?.guards;if(o?.packSecretScan){const p=await st(e.pm.runner,r);if(p.length>0){const{runPackSecretScan:m}=await import("./publish-guards.js"),y=typeof o.packSecretScan=="object"?o.packSecretScan.ignore:void 0,b=await m({files:p,ignore:y,pkgDir:r});if(!b.passed){const{redactTokens:w}=await import("./security.js"),C=b.findings.map(_=>`  • [packSecretScan] ${w(_.message)}${_.hint?`
+${e.trimStart()}`},Be=(t,e)=>{const n=We(e);return`${JSON.stringify(t,null,n)}
+`},We=t=>{if(!t)return 4;const e=/\n(\s+)"/.exec(t);if(!e)return 4;const n=(e[1]??"").length;return n===2||n===4?n:4},Je=t=>`${t.dir}/CHANGELOG.md`,He=t=>{const e=new Date().toISOString().slice(0,10),n=[`## ${t.newVersion}`,`<sub>${e}</sub>`,""];if(t.isCascadeBump||t.isGroupBump)for(const r of t.sources)n.push(`- Version bump from ${r.name}@${r.newVersion}`);else if(t.isDependencyBump&&t.changeFiles.length===0)for(const r of t.sources)r.newVersion===""?n.push(`- Removed dependency ${r.name}`):n.push(`- Updated dependency ${r.name}@${r.newVersion}`);else for(const r of t.changeFiles)for(const s of r.body.split(/\r?\n/)){if(s.trim()===""){n.push("");continue}n.push(s.startsWith("-")||s.startsWith("*")?s:`- ${s}`)}return n.join(`
+`)},Ke=["dependencies","devDependencies","peerDependencies","optionalDependencies"],Q={default:{},named:{}},qe=t=>{if(!t)return Q;let e;try{e=Me(t,{schema:"core",strict:!0})}catch(s){throw new l({cause:s,code:"CONFIG_INVALID",message:`Failed to parse pnpm-workspace.yaml: ${s.message}`})}if(typeof e!="object"||e===null||Array.isArray(e))return Q;const n=e,r={default:{},named:{}};if(typeof n.catalog=="object"&&n.catalog!==null&&!Array.isArray(n.catalog))for(const[s,a]of Object.entries(n.catalog))typeof a=="string"&&(r.default[s]=a);if(typeof n.catalogs=="object"&&n.catalogs!==null&&!Array.isArray(n.catalogs))for(const[s,a]of Object.entries(n.catalogs)){if(typeof a!="object"||a===null||Array.isArray(a))continue;const i={};for(const[o,c]of Object.entries(a))typeof c=="string"&&(i[o]=c);r.named[s]=i}return r},we=(t,e,n)=>{if(!t.startsWith("catalog:"))return t;const r=t.slice(8),s=r===""?n.default:n.named[r];if(s)return s[e]},Y=(t,e)=>{const n={...t};for(const r of Ke){const s=t[r];if(!s||typeof s!="object")continue;const a={...s};for(const[i,o]of Object.entries(s)){if(!o.startsWith("catalog:"))continue;const c=we(o,i,e);if(c===void 0)throw new l({code:"CONFIG_INVALID",message:`Cannot resolve "${o}" for dependency "${i}" in package "${t.name}". Add it to pnpm-workspace.yaml's "catalog" or "catalogs" block.`,packageName:t.name});a[i]=c}n[r]=a}return n},Gt=Object.defineProperty({__proto__:null,parseCatalogs:qe,resolveCatalogRef:we,rewriteCatalogRefs:Y},Symbol.toStringTag,{value:"Module"}),Ye="ACTIONS_ID_TOKEN_REQUEST_URL",z=t=>{const e=!!t.env[Ye],n=!!t.env[t.staticTokenVar],r=t.workspaceConfig?.publish?.preferStaticToken===!0;return e&&!(r&&n)?"oidc":n?"token":"missing"};let T;const ze="https://github.com/visulima/visulima",Qe=async()=>{try{let t=U(Oe(import.meta.url));for(let e=0;e<6;e+=1){const n=h(t,"package.json");try{const s=await A(n,"utf8"),a=JSON.parse(s);if(a.name==="@visulima/vis"&&typeof a.version=="string")return a.version}catch{}const r=U(t);if(r===t)break;t=r}}catch{}return"unknown"},Xe=async()=>(T!==void 0||(T=`vis-release/${await Qe()} (+${ze})`),T),X=new Map,Ze=async t=>{const e=X.get(t);if(e!==void 0)return e;try{const n=await import("./index4.js").then(s=>s.i),r=new n.ProxyAgent(t);return X.set(t,r),r}catch{return}},et=t=>t===301||t===302||t===303||t===307||t===308,tt=(t,e)=>{try{const n=new URL(t),r=new URL(e);return n.host===r.host&&n.protocol===r.protocol}catch{return!1}},j=async(t,e={})=>{const n=e.maxRedirects??2,r={"User-Agent":await Xe(),...e.headers};e.headers?.["User-Agent"]&&(r["User-Agent"]=e.headers["User-Agent"]);let s=t,a=0;const i=e.httpProxy?await Ze(e.httpProxy):void 0;for(;;){let o;try{const p=e.fetchImpl??globalThis.fetch,m={headers:r,method:e.method??"GET",redirect:"manual"};i&&(m.dispatcher=i),o=await p(s,m)}catch{return{json:async()=>{},ok:!1,status:0,text:async()=>""}}if(!et(o.status))return{json:async()=>{try{return await o.json()}catch{return}},ok:o.ok,status:o.status,text:async()=>{try{return await o.text()}catch{return""}}};const c=o.headers.get("location")??o.headers.get("Location");if(!c||a>=n)return{json:async()=>{},ok:!1,status:0,text:async()=>""};let d;try{d=new URL(c,s).toString()}catch{return{json:async()=>{},ok:!1,status:0,text:async()=>""}}if(!tt(t,d))return{json:async()=>{},ok:!1,status:0,text:async()=>""};s=d,a+=1}},nt="https://crates.io/api/v1/crates",rt="Cargo.toml",Z=async t=>{let e;try{e=await A(t,"utf8")}catch(o){throw new l({cause:o,code:"CONFIG_INVALID",file:t,message:`Failed to read Cargo.toml at ${t}: ${o.message}`})}const{parse:n}=await import("./index5.js");let r;try{r=n(e)}catch(o){throw new l({cause:o,code:"CONFIG_INVALID",file:t,message:`Failed to parse Cargo.toml at ${t}: ${o.message}`})}if(!r.package)throw new l({code:"CONFIG_INVALID",file:t,hint:"CargoVersionActions only supports publishable crates with a [package] table. For workspace roots, point per-package config at the member crate directory.",message:`Cargo.toml at ${t} has no [package] table.`});const{name:s}=r.package;if(typeof s!="string"||s.length===0)throw new l({code:"CONFIG_INVALID",file:t,message:`Cargo.toml at ${t} is missing [package].name.`});const a=r.package.version;let i;if(typeof a=="string"?i=a:a&&typeof a=="object"&&a.workspace===!0&&(i=r.workspace?.package?.version),typeof i!="string"||i.length===0)throw new l({code:"CONFIG_INVALID",file:t,hint:"Set [package].version explicitly, or — for workspace-inherited versions — ensure the root Cargo.toml carries [workspace.package].version and point per-package config at it.",message:`Cargo.toml at ${t} has no resolvable [package].version.`});return{name:s,version:i}},ee=async(t,e)=>{const n=`${nt}/${encodeURIComponent(t)}`;try{const r=await j(n,{headers:{Accept:"application/json"},httpProxy:e});if(r.status===404||!r.ok)return;const s=await r.json();return s?.crate?.max_stable_version??s?.crate?.max_version??void 0}catch{return}},st=(t,e)=>z({env:t,staticTokenVar:"CARGO_REGISTRY_TOKEN",workspaceConfig:e})==="oidc",at=async(t,e)=>{const n=await t.run("cargo",["package","--list","--allow-dirty"],{cwd:e,silent:!0});return n.exitCode!==0?[]:n.stdout.split(/\r?\n/).map(r=>r.trim()).filter(r=>r.length>0)};class ot extends N{id="cargo";async readPublishedVersion(e){const n=H(e.pkg);try{const{name:r}=await Z(n);return await ee(r)}catch{return}}async publish(e){if(e.dryRun)return{output:`[dry-run / cargo] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const n=H(e.pkg,e.perPackageConfig),r=it(e.pkg,e.perPackageConfig),{name:s,version:a}=await Z(n);if(a!==e.release.newVersion)throw new l({code:"CONFIG_INVALID",file:n,hint:`Confirm the cargo() preset's crateDir points at the directory containing this Cargo.toml. Expected ${e.release.newVersion} on disk after the extra-files bump.`,message:`Cargo.toml version (${a}) does not match planned release version (${e.release.newVersion}) for ${e.pkg.name}.`,packageName:e.pkg.name});if(await ee(s,e.workspaceConfig?.httpProxy)===e.release.newVersion)return{alreadyPublished:!0,output:`[cargo] ${s}@${e.release.newVersion} already on crates.io`,published:!1};const i=st(process.env,e.workspaceConfig);if(!i&&!process.env.CARGO_REGISTRY_TOKEN)throw new l({code:"AUTH_MISSING",hint:"Set CARGO_REGISTRY_TOKEN, or run from a GH-Actions job with `permissions: id-token: write` for OIDC trusted publishing.",message:`Cannot publish ${s}@${e.release.newVersion}: neither CARGO_REGISTRY_TOKEN nor OIDC trusted publishing is available.`,packageName:e.pkg.name});const o=e.workspaceConfig?.publish?.guards;if(o?.packSecretScan){const p=await at(e.pm.runner,r);if(p.length>0){const{runPackSecretScan:m}=await import("./publish-guards.js"),y=typeof o.packSecretScan=="object"?o.packSecretScan.ignore:void 0,b=await m({files:p,ignore:y,pkgDir:r});if(!b.passed){const{redactTokens:w}=await import("./security.js"),C=b.findings.map(_=>`  • [packSecretScan] ${w(_.message)}${_.hint?`
       → ${w(_.hint)}`:""}`).join(`
 `);throw new l({code:"PUBLISH_FAILED",message:`Pre-publish secret scan failed for ${s}@${e.release.newVersion}:
-${C}`,packageName:e.pkg.name})}}}const c=["publish","--allow-dirty"];e.registry&&e.registry!=="https://crates.io"&&c.push("--registry",e.registry);const d=await e.pm.runner.run("cargo",c,{cwd:r,silent:!1});if(d.exitCode!==0)throw new l({code:"PUBLISH_FAILED",hint:"Inspect the cargo output above. Common causes: missing CARGO_REGISTRY_TOKEN, OIDC permission misconfigured, version already published, crates.io rate limit. Re-runs are safe — the published-version probe short-circuits subsequent runs.",message:`cargo publish failed for ${s}@${e.release.newVersion}: exit ${d.exitCode}. stderr: ${d.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});return{output:`[cargo] published ${s}@${e.release.newVersion}${i?" (trusted publishing)":""}`,published:!0}}}const H=(t,e)=>{const n=e?.cargoTomlPath??nt;return h(t.dir,n)},ot=(t,e)=>U(H(t,e)),it=["linux/amd64","linux/arm64"],ct=t=>{const e=t.indexOf("/");if(e===-1)return{registry:"docker.io",repository:`library/${t}`};const n=t.slice(0,e),r=t.slice(e+1);return n==="localhost"||n.includes(".")||n.includes(":")?{registry:n,repository:r}:r.includes("/")?{registry:"docker.io",repository:t}:{registry:"docker.io",repository:`${n}/${r}`}},te=(t,e)=>{const{registry:n,repository:r}=ct(t);return`https://${n==="docker.io"?"registry-1.docker.io":n}/v2/${r}/manifests/${encodeURIComponent(e)}`},ke=t=>{const e=t??{};return{buildContext:e.buildContext,containerBuildArgs:e.containerBuildArgs,containerImage:e.containerImage,containerPlatforms:e.containerPlatforms,containerSigning:e.containerSigning,containerSkipLatest:e.containerSkipLatest}},pt=(t,e)=>{const n=ke(t);if(typeof n.containerImage!="string"||n.containerImage.length===0)throw new l({code:"CONFIG_INVALID",hint:["Container packages must declare `containerImage` in their per-pkg release config:","",'    release.packages["<pkg>"] = container({','        image: "ghcr.io/scope/foo",','        platforms: ["linux/amd64", "linux/arm64"],','        signing: "cosign", // optional',"    })","",'Or set `versionActions: "container"` + `containerImage` directly.'].join(`
-`),message:`containerImage is required for versionActions: "container" on ${e}`,packageName:e});return{buildContext:n.buildContext,containerBuildArgs:n.containerBuildArgs,containerImage:n.containerImage,containerPlatforms:n.containerPlatforms,containerSigning:n.containerSigning,containerSkipLatest:n.containerSkipLatest}};class lt extends N{id="container";async readPublishedVersion(e){const n=ke(e.perPackageConfig);if(!n.containerImage)return;const r=e.pkg.version,s=te(n.containerImage,r);try{return(await j(s,{headers:{Accept:["application/vnd.oci.image.manifest.v1+json","application/vnd.oci.image.index.v1+json","application/vnd.docker.distribution.manifest.v2+json","application/vnd.docker.distribution.manifest.list.v2+json"].join(",")},httpProxy:e.workspaceConfig?.httpProxy,method:"HEAD"})).status===200?r:void 0}catch{return}}async publish(e){const n=pt(e.perPackageConfig,e.pkg.name);if(e.dryRun){const{command:a}=ne(e,n);return{output:`[dry-run / container] would run: ${a.join(" ")}`,published:!0}}try{const a=te(n.containerImage,e.release.newVersion);if((await j(a,{httpProxy:e.workspaceConfig?.httpProxy,method:"HEAD"})).status===200)return{alreadyPublished:!0,output:`[container] ${n.containerImage}:${e.release.newVersion} already published`,published:!1}}catch{}const{command:r}=ne(e,n),s=await e.pm.runner.run(r[0],r.slice(1),{cwd:e.pkg.dir,silent:!1});if(s.exitCode!==0)throw new l({code:"PUBLISH_FAILED",hint:["docker buildx build failed. Common causes:","  • Not authenticated to the registry — run `docker login <registry>` first.","    For ECR: `aws ecr get-login-password --region <r> | docker login --username AWS --password-stdin <account>.dkr.ecr.<r>.amazonaws.com`","    For GCR/GAR: `gcloud auth configure-docker <region>-docker.pkg.dev`","    For GHCR: `echo $GITHUB_TOKEN | docker login ghcr.io -u <user> --password-stdin`","  • Buildx not installed / configured — `docker buildx create --use` (one-time setup).","  • Multi-arch build needs QEMU registered — `docker run --privileged --rm tonistiigi/binfmt --install all`."].join(`
-`),message:`docker buildx failed for ${e.pkg.name}@${e.release.newVersion}: exit ${s.exitCode}. stderr: ${s.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});if(n.containerSigning==="cosign"){const a=`${n.containerImage}:${e.release.newVersion}`,i=await e.pm.runner.run("cosign",["sign","--yes",a],{cwd:e.pkg.dir,silent:!1});if(i.exitCode!==0)throw new l({code:"PUBLISH_FAILED",hint:"cosign signing failed. For keyless cosign, ensure COSIGN_EXPERIMENTAL=1 (cosign <2.0) and the CI runner has the OIDC token (`id-token: write` permission on GH Actions).",message:`cosign sign failed for ${a}: exit ${i.exitCode}. stderr: ${i.stderr.trim().slice(0,500)}`,packageName:e.pkg.name})}return{output:`[container] published ${n.containerImage}:${e.release.newVersion}${n.containerSkipLatest?"":" + :latest"}${n.containerSigning==="cosign"?" (signed via cosign)":""}`,published:!0}}}const ne=(t,e)=>{if(!e.containerImage)throw new Error("buildBuildxCommand requires config.containerImage");const n=(e.containerPlatforms??it).join(","),r=`${e.containerImage}:${t.release.newVersion}`,s=`${e.containerImage}:latest`,a=e.buildContext??".",i=["docker","buildx","build","--platform",n,"-t",r];e.containerSkipLatest||i.push("-t",s);for(const[o,c]of Object.entries(e.containerBuildArgs??{}))i.push("--build-arg",`${o}=${c}`);return i.push("--label",`org.opencontainers.image.version=${t.release.newVersion}`),i.push("--label",`org.opencontainers.image.title=${t.pkg.name}`),i.push("--push",a),{command:i}},ut="https://jsr.io",dt=/^@[a-z0-9-]+\/[a-z0-9-]+$/i,re=async t=>{let e;try{e=await A(t,"utf8")}catch(r){throw new l({cause:r,code:"CONFIG_INVALID",file:t,message:`Failed to read JSR manifest at ${t}: ${r.message}`})}let n;try{n=JSON.parse(e)}catch(r){throw new l({cause:r,code:"CONFIG_INVALID",file:t,message:`Failed to parse JSR manifest at ${t}: ${r.message}`})}if(typeof n.name!="string"||n.name.length===0)throw new l({code:"CONFIG_INVALID",file:t,hint:"JSR manifests must declare a `name` field with the `@scope/name` form.",message:`JSR manifest at ${t} is missing the \`name\` field.`});if(!dt.test(n.name))throw new l({code:"CONFIG_INVALID",file:t,hint:"JSR requires every package to publish under `@scope/name`. Add the `@scope/` prefix and lowercase the name (a-z, 0-9, hyphen).",message:`JSR manifest at ${t} declares an invalid \`name\`: "${n.name}". JSR requires the @scope/name form.`});if(typeof n.version!="string"||n.version.length===0)throw new l({code:"CONFIG_INVALID",file:t,hint:"Add a `version` literal to the JSR manifest, or wire the `jsr()` preset so vis bumps it for you.",message:`JSR manifest at ${t} is missing the \`version\` field.`});return{name:n.name,version:n.version}},se=async(t,e)=>{const n=`${ut}/${t}/meta.json`;try{const r=await j(n,{headers:{Accept:"application/json"},httpProxy:e});if(r.status===404||!r.ok)return;const s=await r.json();return typeof s?.latest=="string"?s.latest:void 0}catch{return}},mt=(t,e)=>z({env:t,staticTokenVar:"JSR_API_KEY",workspaceConfig:e})==="oidc",ae=(t,e)=>{const n=e?.jsrConfigPath??"jsr.json";return h(t.dir,n)};class gt extends N{id="jsr";async readPublishedVersion(e){const n=ae(e.pkg,e.perPackageConfig);try{const{name:r}=await re(n);return await se(r,e.workspaceConfig?.httpProxy)}catch{return}}async publish(e){if(e.dryRun)return{output:`[dry-run / jsr] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const n=ae(e.pkg,e.perPackageConfig),{name:r,version:s}=await re(n);if(s!==e.release.newVersion)throw new l({code:"CONFIG_INVALID",file:n,hint:`Confirm the jsr() preset's manifestPath points at the JSR config file the extra-files rule rewrites. Expected ${e.release.newVersion} on disk after the bump.`,message:`JSR manifest version (${s}) does not match planned release version (${e.release.newVersion}) for ${e.pkg.name}.`,packageName:e.pkg.name});if(await se(r,e.workspaceConfig?.httpProxy)===e.release.newVersion)return{alreadyPublished:!0,output:`[jsr] ${r}@${e.release.newVersion} already on jsr.io`,published:!1};const a=mt(process.env,e.workspaceConfig);if(!a&&!process.env.JSR_API_KEY)throw new l({code:"AUTH_MISSING",hint:"Set JSR_API_KEY for static-token auth, or run from a GH-Actions job with `permissions: id-token: write` so ACTIONS_ID_TOKEN_REQUEST_URL is exposed for OIDC trusted publishing.",message:`Cannot publish ${r}@${e.release.newVersion}: neither JSR_API_KEY nor OIDC trusted publishing is available.`,packageName:e.pkg.name});const i=["jsr","publish","--allow-dirty"],o=e.perPackageConfig?.jsrConfigPath;o!==void 0&&o!=="jsr.json"&&i.push("--config",o);for(const d of e.perPackageConfig?.jsrPublishArgs??[])i.push(d);const c=await e.pm.runner.run("npx",i,{cwd:e.pkg.dir,silent:!1});if(c.exitCode!==0)throw new l({code:"PUBLISH_FAILED",hint:"Inspect the jsr CLI output above. Common causes: invalid JSR_API_KEY, OIDC permission misconfigured, version already published, slow-mode rate limit. Re-runs are safe — the published-version probe short-circuits subsequent runs.",message:`jsr publish failed for ${r}@${e.release.newVersion}: exit ${c.exitCode}. stderr: ${c.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});return{output:`[jsr] published ${r}@${e.release.newVersion}${a?" (trusted publishing)":""}`,published:!0}}}const ht=/<!--[\s\S]*?-->/g,ft=/<project\b[^>]*>([\s\S]*)/i,oe=/<version>\s*([^<]+?)\s*<\/version>/i,ie=/<groupId>\s*([^<]+?)\s*<\/groupId>/i,ce=/<artifactId>\s*([^<]+?)\s*<\/artifactId>/i,wt=/<modules\b[^>]*>[\s\S]*?<module\b/i,pe=t=>{const e=t.replaceAll(ht,""),n=ft.exec(e)?.[1]??e,r=n.replaceAll(/<parent\b[\s\S]*?<\/parent>/gi,"").replaceAll(/<dependencyManagement\b[\s\S]*?<\/dependencyManagement>/gi,"").replaceAll(/<dependencies\b[\s\S]*?<\/dependencies>/gi,"").replaceAll(/<build\b[\s\S]*?<\/build>/gi,"").replaceAll(/<profiles\b[\s\S]*?<\/profiles>/gi,"").replaceAll(/<pluginRepositories\b[\s\S]*?<\/pluginRepositories>/gi,"").replaceAll(/<repositories\b[\s\S]*?<\/repositories>/gi,""),s=oe.exec(r)??oe.exec(n),a=ie.exec(r)??ie.exec(n),i=ce.exec(r)??ce.exec(n),o=wt.test(n);return{artifactId:i?.[1],groupId:a?.[1],hasModules:o,version:s?.[1]}},kt=t=>{const e=/<latest>\s*([^<]+?)\s*<\/latest>/i.exec(t);if(e?.[1])return e[1];const n=/<versions>([\s\S]*?)<\/versions>/i.exec(t);return n?[...n[1].matchAll(/<version>\s*([^<]+?)\s*<\/version>/gi)].map(r=>r[1]).at(-1):void 0},bt=(t,e)=>{const n=t.split(".").map(s=>encodeURIComponent(s)).join("/"),r=encodeURIComponent(e);return`https://repo1.maven.org/maven2/${n}/${r}/maven-metadata.xml`},yt=["Native Maven publishing isn't implemented yet. Drop to the generic shell path:","",'  release.packages["<your-pkg>"] = {','      ...pomXml({ pomDir: "jvm/sdk" }),','      versionActions: "shell",','      publishCommand: "mvn -B -ntp deploy",','      checkPublished: "",',"  }","","Configure either `central-publishing-maven-plugin` (recommended for","Sonatype Central Portal) or `nexus-staging-maven-plugin` (legacy OSSRH)","in your pom.xml, plus credentials in ~/.m2/settings.xml.","","Maven Central does not (yet) support OIDC trusted publishing —","static credentials are required. See docs/guides/release-maven.mdx","for the full setup walkthrough."].join(`
-`);class $t extends N{id="maven";warnedMultiModule=new WeakSet;warnIfMultiModule(e,n){!n.hasModules||this.warnedMultiModule.has(e)||(this.warnedMultiModule.add(e),process.stderr.write(`[vis release] ⚠ ${e.name} (${n.groupId??"?"}:${n.artifactId??"?"}) is a multi-module Maven project (<modules> present). vis treats it as a single artifact for version-read + already-published checks. For proper reactor handling, use \`versionActions: "shell"\` with \`mvn -B -ntp deploy\`.
-`))}async readPublishedVersion(e){const n=e.perPackageConfig??{},r=h(e.pkg.dir,n.pomPath??"pom.xml");let s;try{s=await A(r,"utf8")}catch{return}const a=pe(s);if(this.warnIfMultiModule(e.pkg,a),!a.groupId||!a.artifactId||n.mavenMetadataUrl==="")return;const i=n.mavenMetadataUrl??bt(a.groupId,a.artifactId);try{const o=await j(i,{headers:{Accept:"text/xml,application/xml;q=0.9,*/*;q=0.8"},httpProxy:e.workspaceConfig?.httpProxy});if(o.status===404||!o.ok)return;const c=await o.text();return kt(c)}catch{return}}async publish(e){const n=e.perPackageConfig??{},r=h(e.pkg.dir,n.pomPath??"pom.xml");let s;try{const o=await A(r,"utf8");s=pe(o)}catch{s=void 0}const a=s?.groupId&&s?.artifactId?`${s.groupId}:${s.artifactId}`:e.pkg.name;if(e.dryRun)return{output:`[dry-run / maven] would publish ${e.pkg.name}@${e.release.newVersion} (${a}) (native publish not yet implemented — would use shell path)`,published:!0};const i=`Failing artifact: ${a}
+${C}`,packageName:e.pkg.name})}}}const c=["publish","--allow-dirty"];e.registry&&e.registry!=="https://crates.io"&&c.push("--registry",e.registry);const d=await e.pm.runner.run("cargo",c,{cwd:r,silent:!1});if(d.exitCode!==0)throw new l({code:"PUBLISH_FAILED",hint:"Inspect the cargo output above. Common causes: missing CARGO_REGISTRY_TOKEN, OIDC permission misconfigured, version already published, crates.io rate limit. Re-runs are safe — the published-version probe short-circuits subsequent runs.",message:`cargo publish failed for ${s}@${e.release.newVersion}: exit ${d.exitCode}. stderr: ${d.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});return{output:`[cargo] published ${s}@${e.release.newVersion}${i?" (trusted publishing)":""}`,published:!0}}}const H=(t,e)=>{const n=e?.cargoTomlPath??rt;return h(t.dir,n)},it=(t,e)=>U(H(t,e)),ct=["linux/amd64","linux/arm64"],pt=t=>{const e=t.indexOf("/");if(e===-1)return{registry:"docker.io",repository:`library/${t}`};const n=t.slice(0,e),r=t.slice(e+1);return n==="localhost"||n.includes(".")||n.includes(":")?{registry:n,repository:r}:r.includes("/")?{registry:"docker.io",repository:t}:{registry:"docker.io",repository:`${n}/${r}`}},te=(t,e)=>{const{registry:n,repository:r}=pt(t);return`https://${n==="docker.io"?"registry-1.docker.io":n}/v2/${r}/manifests/${encodeURIComponent(e)}`},ke=t=>{const e=t??{};return{buildContext:e.buildContext,containerBuildArgs:e.containerBuildArgs,containerImage:e.containerImage,containerPlatforms:e.containerPlatforms,containerSigning:e.containerSigning,containerSkipLatest:e.containerSkipLatest}},lt=(t,e)=>{const n=ke(t);if(typeof n.containerImage!="string"||n.containerImage.length===0)throw new l({code:"CONFIG_INVALID",hint:["Container packages must declare `containerImage` in their per-pkg release config:","",'    release.packages["<pkg>"] = container({','        image: "ghcr.io/scope/foo",','        platforms: ["linux/amd64", "linux/arm64"],','        signing: "cosign", // optional',"    })","",'Or set `versionActions: "container"` + `containerImage` directly.'].join(`
+`),message:`containerImage is required for versionActions: "container" on ${e}`,packageName:e});return{buildContext:n.buildContext,containerBuildArgs:n.containerBuildArgs,containerImage:n.containerImage,containerPlatforms:n.containerPlatforms,containerSigning:n.containerSigning,containerSkipLatest:n.containerSkipLatest}};class ut extends N{id="container";async readPublishedVersion(e){const n=ke(e.perPackageConfig);if(!n.containerImage)return;const r=e.pkg.version,s=te(n.containerImage,r);try{return(await j(s,{headers:{Accept:["application/vnd.oci.image.manifest.v1+json","application/vnd.oci.image.index.v1+json","application/vnd.docker.distribution.manifest.v2+json","application/vnd.docker.distribution.manifest.list.v2+json"].join(",")},httpProxy:e.workspaceConfig?.httpProxy,method:"HEAD"})).status===200?r:void 0}catch{return}}async publish(e){const n=lt(e.perPackageConfig,e.pkg.name);if(e.dryRun){const{command:a}=ne(e,n);return{output:`[dry-run / container] would run: ${a.join(" ")}`,published:!0}}try{const a=te(n.containerImage,e.release.newVersion);if((await j(a,{httpProxy:e.workspaceConfig?.httpProxy,method:"HEAD"})).status===200)return{alreadyPublished:!0,output:`[container] ${n.containerImage}:${e.release.newVersion} already published`,published:!1}}catch{}const{command:r}=ne(e,n),s=await e.pm.runner.run(r[0],r.slice(1),{cwd:e.pkg.dir,silent:!1});if(s.exitCode!==0)throw new l({code:"PUBLISH_FAILED",hint:["docker buildx build failed. Common causes:","  • Not authenticated to the registry — run `docker login <registry>` first.","    For ECR: `aws ecr get-login-password --region <r> | docker login --username AWS --password-stdin <account>.dkr.ecr.<r>.amazonaws.com`","    For GCR/GAR: `gcloud auth configure-docker <region>-docker.pkg.dev`","    For GHCR: `echo $GITHUB_TOKEN | docker login ghcr.io -u <user> --password-stdin`","  • Buildx not installed / configured — `docker buildx create --use` (one-time setup).","  • Multi-arch build needs QEMU registered — `docker run --privileged --rm tonistiigi/binfmt --install all`."].join(`
+`),message:`docker buildx failed for ${e.pkg.name}@${e.release.newVersion}: exit ${s.exitCode}. stderr: ${s.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});if(n.containerSigning==="cosign"){const a=`${n.containerImage}:${e.release.newVersion}`,i=await e.pm.runner.run("cosign",["sign","--yes",a],{cwd:e.pkg.dir,silent:!1});if(i.exitCode!==0)throw new l({code:"PUBLISH_FAILED",hint:"cosign signing failed. For keyless cosign, ensure COSIGN_EXPERIMENTAL=1 (cosign <2.0) and the CI runner has the OIDC token (`id-token: write` permission on GH Actions).",message:`cosign sign failed for ${a}: exit ${i.exitCode}. stderr: ${i.stderr.trim().slice(0,500)}`,packageName:e.pkg.name})}return{output:`[container] published ${n.containerImage}:${e.release.newVersion}${n.containerSkipLatest?"":" + :latest"}${n.containerSigning==="cosign"?" (signed via cosign)":""}`,published:!0}}}const ne=(t,e)=>{if(!e.containerImage)throw new Error("buildBuildxCommand requires config.containerImage");const n=(e.containerPlatforms??ct).join(","),r=`${e.containerImage}:${t.release.newVersion}`,s=`${e.containerImage}:latest`,a=e.buildContext??".",i=["docker","buildx","build","--platform",n,"-t",r];e.containerSkipLatest||i.push("-t",s);for(const[o,c]of Object.entries(e.containerBuildArgs??{}))i.push("--build-arg",`${o}=${c}`);return i.push("--label",`org.opencontainers.image.version=${t.release.newVersion}`),i.push("--label",`org.opencontainers.image.title=${t.pkg.name}`),i.push("--push",a),{command:i}},dt="https://jsr.io",mt=/^@[a-z0-9-]+\/[a-z0-9-]+$/i,re=async t=>{let e;try{e=await A(t,"utf8")}catch(r){throw new l({cause:r,code:"CONFIG_INVALID",file:t,message:`Failed to read JSR manifest at ${t}: ${r.message}`})}let n;try{n=JSON.parse(e)}catch(r){throw new l({cause:r,code:"CONFIG_INVALID",file:t,message:`Failed to parse JSR manifest at ${t}: ${r.message}`})}if(typeof n.name!="string"||n.name.length===0)throw new l({code:"CONFIG_INVALID",file:t,hint:"JSR manifests must declare a `name` field with the `@scope/name` form.",message:`JSR manifest at ${t} is missing the \`name\` field.`});if(!mt.test(n.name))throw new l({code:"CONFIG_INVALID",file:t,hint:"JSR requires every package to publish under `@scope/name`. Add the `@scope/` prefix and lowercase the name (a-z, 0-9, hyphen).",message:`JSR manifest at ${t} declares an invalid \`name\`: "${n.name}". JSR requires the @scope/name form.`});if(typeof n.version!="string"||n.version.length===0)throw new l({code:"CONFIG_INVALID",file:t,hint:"Add a `version` literal to the JSR manifest, or wire the `jsr()` preset so vis bumps it for you.",message:`JSR manifest at ${t} is missing the \`version\` field.`});return{name:n.name,version:n.version}},se=async(t,e)=>{const n=`${dt}/${t}/meta.json`;try{const r=await j(n,{headers:{Accept:"application/json"},httpProxy:e});if(r.status===404||!r.ok)return;const s=await r.json();return typeof s?.latest=="string"?s.latest:void 0}catch{return}},gt=(t,e)=>z({env:t,staticTokenVar:"JSR_API_KEY",workspaceConfig:e})==="oidc",ae=(t,e)=>{const n=e?.jsrConfigPath??"jsr.json";return h(t.dir,n)};class ht extends N{id="jsr";async readPublishedVersion(e){const n=ae(e.pkg,e.perPackageConfig);try{const{name:r}=await re(n);return await se(r,e.workspaceConfig?.httpProxy)}catch{return}}async publish(e){if(e.dryRun)return{output:`[dry-run / jsr] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const n=ae(e.pkg,e.perPackageConfig),{name:r,version:s}=await re(n);if(s!==e.release.newVersion)throw new l({code:"CONFIG_INVALID",file:n,hint:`Confirm the jsr() preset's manifestPath points at the JSR config file the extra-files rule rewrites. Expected ${e.release.newVersion} on disk after the bump.`,message:`JSR manifest version (${s}) does not match planned release version (${e.release.newVersion}) for ${e.pkg.name}.`,packageName:e.pkg.name});if(await se(r,e.workspaceConfig?.httpProxy)===e.release.newVersion)return{alreadyPublished:!0,output:`[jsr] ${r}@${e.release.newVersion} already on jsr.io`,published:!1};const a=gt(process.env,e.workspaceConfig);if(!a&&!process.env.JSR_API_KEY)throw new l({code:"AUTH_MISSING",hint:"Set JSR_API_KEY for static-token auth, or run from a GH-Actions job with `permissions: id-token: write` so ACTIONS_ID_TOKEN_REQUEST_URL is exposed for OIDC trusted publishing.",message:`Cannot publish ${r}@${e.release.newVersion}: neither JSR_API_KEY nor OIDC trusted publishing is available.`,packageName:e.pkg.name});const i=["jsr","publish","--allow-dirty"],o=e.perPackageConfig?.jsrConfigPath;o!==void 0&&o!=="jsr.json"&&i.push("--config",o);for(const d of e.perPackageConfig?.jsrPublishArgs??[])i.push(d);const c=await e.pm.runner.run("npx",i,{cwd:e.pkg.dir,silent:!1});if(c.exitCode!==0)throw new l({code:"PUBLISH_FAILED",hint:"Inspect the jsr CLI output above. Common causes: invalid JSR_API_KEY, OIDC permission misconfigured, version already published, slow-mode rate limit. Re-runs are safe — the published-version probe short-circuits subsequent runs.",message:`jsr publish failed for ${r}@${e.release.newVersion}: exit ${c.exitCode}. stderr: ${c.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});return{output:`[jsr] published ${r}@${e.release.newVersion}${a?" (trusted publishing)":""}`,published:!0}}}const ft=/<!--[\s\S]*?-->/g,wt=/<project\b[^>]*>([\s\S]*)/i,oe=/<version>\s*([^<]+?)\s*<\/version>/i,ie=/<groupId>\s*([^<]+?)\s*<\/groupId>/i,ce=/<artifactId>\s*([^<]+?)\s*<\/artifactId>/i,kt=/<modules\b[^>]*>[\s\S]*?<module\b/i,pe=t=>{const e=t.replaceAll(ft,""),n=wt.exec(e)?.[1]??e,r=n.replaceAll(/<parent\b[\s\S]*?<\/parent>/gi,"").replaceAll(/<dependencyManagement\b[\s\S]*?<\/dependencyManagement>/gi,"").replaceAll(/<dependencies\b[\s\S]*?<\/dependencies>/gi,"").replaceAll(/<build\b[\s\S]*?<\/build>/gi,"").replaceAll(/<profiles\b[\s\S]*?<\/profiles>/gi,"").replaceAll(/<pluginRepositories\b[\s\S]*?<\/pluginRepositories>/gi,"").replaceAll(/<repositories\b[\s\S]*?<\/repositories>/gi,""),s=oe.exec(r)??oe.exec(n),a=ie.exec(r)??ie.exec(n),i=ce.exec(r)??ce.exec(n),o=kt.test(n);return{artifactId:i?.[1],groupId:a?.[1],hasModules:o,version:s?.[1]}},bt=t=>{const e=/<latest>\s*([^<]+?)\s*<\/latest>/i.exec(t);if(e?.[1])return e[1];const n=/<versions>([\s\S]*?)<\/versions>/i.exec(t);return n?[...n[1].matchAll(/<version>\s*([^<]+?)\s*<\/version>/gi)].map(r=>r[1]).at(-1):void 0},yt=(t,e)=>{const n=t.split(".").map(s=>encodeURIComponent(s)).join("/"),r=encodeURIComponent(e);return`https://repo1.maven.org/maven2/${n}/${r}/maven-metadata.xml`},$t=["Native Maven publishing isn't implemented yet. Drop to the generic shell path:","",'  release.packages["<your-pkg>"] = {','      ...pomXml({ pomDir: "jvm/sdk" }),','      versionActions: "shell",','      publishCommand: "mvn -B -ntp deploy",','      checkPublished: "",',"  }","","Configure either `central-publishing-maven-plugin` (recommended for","Sonatype Central Portal) or `nexus-staging-maven-plugin` (legacy OSSRH)","in your pom.xml, plus credentials in ~/.m2/settings.xml.","","Maven Central does not (yet) support OIDC trusted publishing —","static credentials are required. See docs/guides/release-maven.mdx","for the full setup walkthrough."].join(`
+`);class vt extends N{id="maven";warnedMultiModule=new WeakSet;warnIfMultiModule(e,n){!n.hasModules||this.warnedMultiModule.has(e)||(this.warnedMultiModule.add(e),process.stderr.write(`[vis release] ⚠ ${e.name} (${n.groupId??"?"}:${n.artifactId??"?"}) is a multi-module Maven project (<modules> present). vis treats it as a single artifact for version-read + already-published checks. For proper reactor handling, use \`versionActions: "shell"\` with \`mvn -B -ntp deploy\`.
+`))}async readPublishedVersion(e){const n=e.perPackageConfig??{},r=h(e.pkg.dir,n.pomPath??"pom.xml");let s;try{s=await A(r,"utf8")}catch{return}const a=pe(s);if(this.warnIfMultiModule(e.pkg,a),!a.groupId||!a.artifactId||n.mavenMetadataUrl==="")return;const i=n.mavenMetadataUrl??yt(a.groupId,a.artifactId);try{const o=await j(i,{headers:{Accept:"text/xml,application/xml;q=0.9,*/*;q=0.8"},httpProxy:e.workspaceConfig?.httpProxy});if(o.status===404||!o.ok)return;const c=await o.text();return bt(c)}catch{return}}async publish(e){const n=e.perPackageConfig??{},r=h(e.pkg.dir,n.pomPath??"pom.xml");let s;try{const o=await A(r,"utf8");s=pe(o)}catch{s=void 0}const a=s?.groupId&&s?.artifactId?`${s.groupId}:${s.artifactId}`:e.pkg.name;if(e.dryRun)return{output:`[dry-run / maven] would publish ${e.pkg.name}@${e.release.newVersion} (${a}) (native publish not yet implemented — would use shell path)`,published:!0};const i=`Failing artifact: ${a}
 Pom: ${r}
 
-${yt}`;throw new l({code:"CONFIG_INVALID",hint:i,message:`Native Maven publishing is not implemented for ${e.pkg.name}@${e.release.newVersion} (${a}). Use \`versionActions: "shell"\` with \`mvn deploy\` until the Sonatype Central Portal client lands.`,packageName:e.pkg.name})}}const be=(t,e)=>{if(e===!1)return{...t};const n=new Set(Me(e)),r={name:t.name,version:t.version};for(const[s,a]of Object.entries(t))n.has(s)||(r[s]=a);return r},ye="https://registry.npmjs.org/",vt="npm:registry.npmjs.org",le=async t=>{const e=h(t,"npm");try{return(await xe(e,{withFileTypes:!0})).filter(n=>n.isDirectory()).map(n=>n.name)}catch{return[]}},It=async t=>{const e=t.ACTIONS_ID_TOKEN_REQUEST_URL,n=t.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(!e||!n)return;const r=`${e}${e.includes("?")?"&":"?"}audience=${encodeURIComponent(vt)}`,s=await fetch(r,{headers:{Authorization:`Bearer ${n}`}});if(!s.ok)return;const a=await s.json().catch(()=>({}));return typeof a.value=="string"?a.value:void 0},Ct=async(t,e)=>{const n=await fetch(`${ye}-/npm/v1/oidc/token/exchange/package/${encodeURIComponent(t)}`,{headers:{Authorization:`Bearer ${e}`},method:"POST"});if(!n.ok)return;const r=await n.json().catch(()=>({}));return typeof r.token=="string"?r.token:void 0},ue=async(t,e,n)=>{if(e){const s=await Ct(t,e);if(s)return{source:"oidc",token:s}}const r=n.NPM_TOKEN;if(r)return{source:"NPM_TOKEN",token:r};throw new l({code:"AUTH_MISSING",message:`Cannot publish ${t}: OIDC exchange did not succeed and NPM_TOKEN is not set.`,packageName:t})},de=(t,e)=>{Oe(t,`//registry.npmjs.org/:_authToken=${e}
+${$t}`;throw new l({code:"CONFIG_INVALID",hint:i,message:`Native Maven publishing is not implemented for ${e.pkg.name}@${e.release.newVersion} (${a}). Use \`versionActions: "shell"\` with \`mvn deploy\` until the Sonatype Central Portal client lands.`,packageName:e.pkg.name})}}const be=(t,e)=>{if(e===!1)return{...t};const n=new Set(Ee(e)),r={name:t.name,version:t.version};for(const[s,a]of Object.entries(t))n.has(s)||(r[s]=a);return r},ye="https://registry.npmjs.org/",It="npm:registry.npmjs.org",le=async t=>{const e=h(t,"npm");try{return(await Ve(e,{withFileTypes:!0})).filter(n=>n.isDirectory()).map(n=>n.name)}catch{return[]}},Ct=async t=>{const e=t.ACTIONS_ID_TOKEN_REQUEST_URL,n=t.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(!e||!n)return;const r=`${e}${e.includes("?")?"&":"?"}audience=${encodeURIComponent(It)}`,s=await fetch(r,{headers:{Authorization:`Bearer ${n}`}});if(!s.ok)return;const a=await s.json().catch(()=>({}));return typeof a.value=="string"?a.value:void 0},Pt=async(t,e)=>{const n=await fetch(`${ye}-/npm/v1/oidc/token/exchange/package/${encodeURIComponent(t)}`,{headers:{Authorization:`Bearer ${e}`},method:"POST"});if(!n.ok)return;const r=await n.json().catch(()=>({}));return typeof r.token=="string"?r.token:void 0},ue=async(t,e,n)=>{if(e){const s=await Pt(t,e);if(s)return{source:"oidc",token:s}}const r=n.NPM_TOKEN;if(r)return{source:"NPM_TOKEN",token:r};throw new l({code:"AUTH_MISSING",message:`Cannot publish ${t}: OIDC exchange did not succeed and NPM_TOKEN is not set.`,packageName:t})},de=(t,e)=>{Re(t,`//registry.npmjs.org/:_authToken=${e}
 registry=${ye}
-`)};class Pt extends N{id="native-addon";async readPublishedVersion(e){try{F(e.pkg.name);const{execFileSync:n}=await import("node:child_process");return n("npm",["view",e.pkg.name,"version"],{stdio:["ignore","pipe","ignore"]}).toString().trim()||void 0}catch{return}}async publish(e){if(e.dryRun){const c=await le(e.pkg.dir);return{output:`[dry-run] would publish ${e.pkg.name}@${e.release.newVersion} + ${c.length} platform package(s)`,published:!0}}const n=await le(e.pkg.dir);if(n.length===0){const{NpmVersionActions:c}=await Promise.resolve().then(()=>_t);return new c().publish(e)}const{env:r}=process,s=await It(r),a=e.release.newVersion,i=new Map,o=[];try{await Promise.all(n.map(async g=>{const u=h(e.pkg.dir,"npm",g,"package.json"),f=await A(u,"utf8");i.set(u,f);const $=JSON.parse(f);$.version=a,await O(u,`${JSON.stringify($,null,4)}
+`)};class St extends N{id="native-addon";async readPublishedVersion(e){try{F(e.pkg.name);const{execFileSync:n}=await import("node:child_process");return n("npm",["view",e.pkg.name,"version"],{stdio:["ignore","pipe","ignore"]}).toString().trim()||void 0}catch{return}}async publish(e){if(e.dryRun){const c=await le(e.pkg.dir);return{output:`[dry-run] would publish ${e.pkg.name}@${e.release.newVersion} + ${c.length} platform package(s)`,published:!0}}const n=await le(e.pkg.dir);if(n.length===0){const{NpmVersionActions:c}=await Promise.resolve().then(()=>jt);return new c().publish(e)}const{env:r}=process,s=await Ct(r),a=e.release.newVersion,i=new Map,o=[];try{await Promise.all(n.map(async g=>{const u=h(e.pkg.dir,"npm",g,"package.json"),f=await A(u,"utf8");i.set(u,f);const $=JSON.parse(f);$.version=a,await O(u,`${JSON.stringify($,null,4)}
 `)}));const{execFileSync:c}=await import("node:child_process"),d=await Promise.all(n.map(async g=>{const u=h(e.pkg.dir,"npm",g),f=h(u,"package.json"),$=await A(f,"utf8"),k=JSON.parse($);F(k.name);const P=await ue(k.name,s,r),v=G(h(B(),"vis-release-napi-"));o.push(v);const S=h(v,".npmrc");return de(S,P.token),{manifest:k,npmrcPath:S,platform:g,platformDir:u}})),p=e.workspaceConfig?.publish?.guards;if(p&&Object.values(p).some(g=>g!==void 0&&g!==!1&&g!=="off")){const{runPublishGuards:g}=await import("./publish-guards.js");for(const{manifest:u,platformDir:f}of d){const $=c("npm",["pack","--dry-run","--json"],{cwd:f,stdio:["ignore","pipe","ignore"]}).toString();let k=[];try{k=JSON.parse($)[0]?.files?.map(v=>v.path)??[]}catch{}const P=await g({config:p,manifest:u,packFiles:k,pkgDir:f,runner:e.pm.runner,sourceManifest:u});if(P.blockers.length>0){const v=P.blockers.flatMap(S=>S.findings.map(D=>`  • [${S.gate}] ${D.message}${D.hint?`
       → ${D.hint}`:""}`)).join(`
 `);throw new l({code:"PUBLISH_FAILED",message:`Pre-publish guards failed for ${u.name}@${a} (platform package):
 ${v}`,packageName:u.name})}}}const m=e.tag??"latest",y=(g,u)=>{const f=["publish",g,"--tag",m,"--access","public","--userconfig",u];return e.provenance&&f.push("--provenance"),f};for(const{manifest:g,npmrcPath:u,platformDir:f}of d)try{c("npm",y(f,u),{env:{...r,NPM_CONFIG_USERCONFIG:u},stdio:"inherit"})}catch($){const k=$.message;if(!k.includes("EPUBLISHCONFLICT")&&!k.includes("cannot publish over"))throw new l({cause:$,code:"PUBLISH_FAILED",message:`Failed to publish platform package ${g.name}@${a}: ${k}`,packageName:g.name})}const b=e.versionedManifestByName.get(e.pkg.name)??e.pkg.manifest,w={...b},C={...b.optionalDependencies};for(const{manifest:g}of d)Object.hasOwn(C,g.name)&&(C[g.name]=a);w.optionalDependencies=C;const _=Y(w,e.catalogs),I=be(_,e.cleanPackageJsonConfig),E=await A(e.pkg.manifestPath,"utf8");try{await O(e.pkg.manifestPath,`${JSON.stringify(I,null,4)}
-`),F(e.pkg.name);const g=await ue(e.pkg.name,s,r),u=G(h(B(),"vis-release-napi-parent-"));o.push(u);const f=h(u,".npmrc");de(f,g.token);const $=c("npm",["pack","--pack-destination",u,"--json"],{cwd:e.pkg.dir,env:r,stdio:["ignore","pipe","ignore"]}).toString();let k;try{const v=JSON.parse($);v[0]?.filename&&(k=h(u,v[0].filename))}catch{}const P=["publish",k??e.pkg.dir,"--tag",m,"--access","public","--userconfig",f];if(e.provenance&&P.push("--provenance"),c("npm",P,{env:{...r,NPM_CONFIG_USERCONFIG:f},stdio:"inherit"}),k){const{hashTarball:v}=await import("./publish-guards.js");return{published:!0,tarball:await v(k)}}return{published:!0}}finally{await O(e.pkg.manifestPath,E)}}finally{for(const[c,d]of i)try{await O(c,d)}catch{}for(const c of o)try{await je(c,{force:!0,recursive:!0})}catch{}}}}const St=async(t,e)=>{const{extractPackFilesFromRaw:n}=await import("./publish-guards.js"),r=n(e.raw);if(r!==void 0)return r;const s=await t.pm.runner.run("npm",["pack","--dry-run","--json"],{cwd:t.pkg.dir,silent:!0});if(s.exitCode!==0)return[];try{return n(JSON.parse(s.stdout))??[]}catch{return[]}},me=1800*1e3,ge=15*1e3,he=t=>{if(t===!0)return{enabled:!0,pollIntervalMs:ge,timeoutMs:me};if(t&&typeof t=="object"){const e=t;return{enabled:!0,pollIntervalMs:e.pollIntervalMs??ge,timeoutMs:e.timeoutMs??me}}return{enabled:!1,pollIntervalMs:0,timeoutMs:0}};class $e extends N{id="npm";async readPublishedVersion(e){try{const n=await e.pm.runner.run("npm",["view",e.pkg.name,"version","--silent"],{cwd:e.pkg.dir,silent:!0});return n.exitCode!==0?void 0:n.stdout.trim()||void 0}catch{return}}async publish(e){if(e.dryRun)return{output:`[dry-run] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};if(e.resumeStageId){const d=he(e.workspaceConfig?.publish?.stage);if(!d.enabled)throw new l({code:"CONFIG_INVALID",message:`Cannot resume stage ${e.resumeStageId} for ${e.pkg.name}@${e.release.newVersion}: publish.stage is now disabled. Resolve the stage manually via \`vis release stage approve|reject ${e.resumeStageId}\`.`,packageName:e.pkg.name});return this.resumeStagedPublish(e,d)}const n=e.perPackageConfig&&e.workspaceConfig?W(e.pkg.name,e.perPackageConfig,e.workspaceConfig):{};if(n.buildCommand){const d=J(n.buildCommand,{name:e.pkg.name,version:e.release.newVersion}),p=await e.pm.runner.run(process.platform==="win32"?"cmd":"sh",process.platform==="win32"?["/c",d]:["-c",d],{cwd:e.pkg.dir,silent:!1});if(p.exitCode!==0)throw new Error(`buildCommand failed for ${e.pkg.name}: exit ${p.exitCode}`)}const r=e.versionedManifestByName.get(e.pkg.name)??e.pkg.manifest,s=Nt(r,e.versionedManifestByName),a=Y(s,e.catalogs),i=be(a,e.cleanPackageJsonConfig),o=await import("node:fs/promises"),c=await o.readFile(e.pkg.manifestPath,"utf8");try{if(await o.writeFile(e.pkg.manifestPath,`${JSON.stringify(i,null,4)}
-`),n.publishCommand){const p={name:e.pkg.name,version:e.release.newVersion},m=Array.isArray(n.publishCommand)?n.publishCommand:[n.publishCommand];for(const y of m){const b=J(y,p),w=await e.pm.runner.run(process.platform==="win32"?"cmd":"sh",process.platform==="win32"?["/c",b]:["-c",b],{cwd:e.pkg.dir,silent:!1});if(w.exitCode!==0)throw new Error(`publishCommand failed for ${e.pkg.name}: exit ${w.exitCode}`)}return{output:`[custom] published ${e.pkg.name}@${e.release.newVersion}`,published:!0}}const d=G(h(B(),"vis-release-pack-"));try{const p=await e.pm.pack({cwd:e.pkg.dir,destination:d}),m=e.workspaceConfig?.publish?.guards;if(m&&Object.values(m).some(u=>u!==void 0&&u!==!1&&u!=="off")){const{runPublishGuards:u}=await import("./publish-guards.js"),f=await St(e,p),$=await u({config:m,manifest:i,packFiles:f,pkgDir:e.pkg.dir,runner:e.pm.runner,sourceManifest:e.pkg.manifest});if($.blockers.length>0){const{redactTokens:k}=await import("./security.js"),P=$.blockers.flatMap(v=>v.findings.map(S=>`  • [${v.gate}] ${k(S.message)}${S.hint?`
+`),F(e.pkg.name);const g=await ue(e.pkg.name,s,r),u=G(h(B(),"vis-release-napi-parent-"));o.push(u);const f=h(u,".npmrc");de(f,g.token);const $=c("npm",["pack","--pack-destination",u,"--json"],{cwd:e.pkg.dir,env:r,stdio:["ignore","pipe","ignore"]}).toString();let k;try{const v=JSON.parse($);v[0]?.filename&&(k=h(u,v[0].filename))}catch{}const P=["publish",k??e.pkg.dir,"--tag",m,"--access","public","--userconfig",f];if(e.provenance&&P.push("--provenance"),c("npm",P,{env:{...r,NPM_CONFIG_USERCONFIG:f},stdio:"inherit"}),k){const{hashTarball:v}=await import("./publish-guards.js");return{published:!0,tarball:await v(k)}}return{published:!0}}finally{await O(e.pkg.manifestPath,E)}}finally{for(const[c,d]of i)try{await O(c,d)}catch{}for(const c of o)try{await xe(c,{force:!0,recursive:!0})}catch{}}}}const At=async(t,e)=>{const{extractPackFilesFromRaw:n}=await import("./publish-guards.js"),r=n(e.raw);if(r!==void 0)return r;const s=await t.pm.runner.run("npm",["pack","--dry-run","--json"],{cwd:t.pkg.dir,silent:!0});if(s.exitCode!==0)return[];try{return n(JSON.parse(s.stdout))??[]}catch{return[]}},me=1800*1e3,ge=15*1e3,he=t=>{if(t===!0)return{enabled:!0,pollIntervalMs:ge,timeoutMs:me};if(t&&typeof t=="object"){const e=t;return{enabled:!0,pollIntervalMs:e.pollIntervalMs??ge,timeoutMs:e.timeoutMs??me}}return{enabled:!1,pollIntervalMs:0,timeoutMs:0}};class $e extends N{id="npm";async readPublishedVersion(e){try{const n=await e.pm.runner.run("npm",["view",e.pkg.name,"version","--silent"],{cwd:e.pkg.dir,silent:!0});return n.exitCode!==0?void 0:n.stdout.trim()||void 0}catch{return}}async publish(e){if(e.dryRun)return{output:`[dry-run] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};if(e.resumeStageId){const d=he(e.workspaceConfig?.publish?.stage);if(!d.enabled)throw new l({code:"CONFIG_INVALID",message:`Cannot resume stage ${e.resumeStageId} for ${e.pkg.name}@${e.release.newVersion}: publish.stage is now disabled. Resolve the stage manually via \`vis release stage approve|reject ${e.resumeStageId}\`.`,packageName:e.pkg.name});return this.resumeStagedPublish(e,d)}const n=e.perPackageConfig&&e.workspaceConfig?W(e.pkg.name,e.perPackageConfig,e.workspaceConfig):{};if(n.buildCommand){const d=J(n.buildCommand,{name:e.pkg.name,version:e.release.newVersion}),p=await e.pm.runner.run(process.platform==="win32"?"cmd":"sh",process.platform==="win32"?["/c",d]:["-c",d],{cwd:e.pkg.dir,silent:!1});if(p.exitCode!==0)throw new Error(`buildCommand failed for ${e.pkg.name}: exit ${p.exitCode}`)}const r=e.versionedManifestByName.get(e.pkg.name)??e.pkg.manifest,s=_t(r,e.versionedManifestByName),a=Y(s,e.catalogs),i=be(a,e.cleanPackageJsonConfig),o=await import("node:fs/promises"),c=await o.readFile(e.pkg.manifestPath,"utf8");try{if(await o.writeFile(e.pkg.manifestPath,`${JSON.stringify(i,null,4)}
+`),n.publishCommand){const p={name:e.pkg.name,version:e.release.newVersion},m=Array.isArray(n.publishCommand)?n.publishCommand:[n.publishCommand];for(const y of m){const b=J(y,p),w=await e.pm.runner.run(process.platform==="win32"?"cmd":"sh",process.platform==="win32"?["/c",b]:["-c",b],{cwd:e.pkg.dir,silent:!1});if(w.exitCode!==0)throw new Error(`publishCommand failed for ${e.pkg.name}: exit ${w.exitCode}`)}return{output:`[custom] published ${e.pkg.name}@${e.release.newVersion}`,published:!0}}const d=G(h(B(),"vis-release-pack-"));try{const p=await e.pm.pack({cwd:e.pkg.dir,destination:d}),m=e.workspaceConfig?.publish?.guards;if(m&&Object.values(m).some(u=>u!==void 0&&u!==!1&&u!=="off")){const{runPublishGuards:u}=await import("./publish-guards.js"),f=await At(e,p),$=await u({config:m,manifest:i,packFiles:f,pkgDir:e.pkg.dir,runner:e.pm.runner,sourceManifest:e.pkg.manifest});if($.blockers.length>0){const{redactTokens:k}=await import("./security.js"),P=$.blockers.flatMap(v=>v.findings.map(S=>`  • [${v.gate}] ${k(S.message)}${S.hint?`
       → ${k(S.hint)}`:""}`)).join(`
 `);throw new l({code:"PUBLISH_FAILED",message:`Pre-publish guards failed for ${e.pkg.name}@${e.release.newVersion}:
 ${P}`,packageName:e.pkg.name})}}const{hashTarball:y}=await import("./publish-guards.js"),b=await y(p.tarball);if((e.workspaceConfig?.publish?.publishStrategy??"npm-publish-tarball")==="native"){const u=e.pm.id;return e.provenance&&u==="bun"&&process.stderr.write(`[vis release] ⚠ publishStrategy "native": bun has no --provenance/OIDC support; ${e.pkg.name}@${e.release.newVersion} publishes without provenance.
@@ -45,4 +45,4 @@ ${P}`,packageName:e.pkg.name})}}const{hashTarball:y}=await import("./publish-gua
 `)},packageName:e.pkg.name,pollIntervalMs:n.pollIntervalMs,runner:e.pm.runner,stageId:r,timeoutMs:n.timeoutMs,version:e.release.newVersion});return i==="approved"?(process.stderr.write(`[vis release] ✓ ${e.pkg.name}@${e.release.newVersion} approved + promoted on resume (${Math.round((Date.now()-s)/1e3)}s).
 `),{output:`[resumed] published ${e.pkg.name}@${e.release.newVersion}`,published:!0}):i==="rejected"?(process.stdout.write(`::warning::Stage rejected on resume for ${e.pkg.name}@${e.release.newVersion} (id ${r}).
 `),{alreadyPublished:!1,output:`stage-rejected: ${r}`,published:!1,stageId:r}):(process.stdout.write(`::warning::Stage timeout on resume for ${e.pkg.name}@${e.release.newVersion} (id ${r}) after ${Math.round(n.timeoutMs/6e4)}m.
-`),{alreadyPublished:!1,output:`stage-timeout: ${r}`,published:!1,stageId:r})}}const At=["dependencies","devDependencies","peerDependencies","optionalDependencies"],Nt=(t,e)=>{const n={...t};for(const r of At){const s=t[r];if(!s||typeof s!="object")continue;const a={...s};for(const[i,o]of Object.entries(s)){if(!o.startsWith("workspace:"))continue;const c=e.get(i);c&&(a[i]=fe(o.slice(10)==="*"?"*":o,c.version),a[i].startsWith("workspace:")&&(a[i]=a[i].slice(10)))}n[r]=a}return n},_t=Object.defineProperty({__proto__:null,NpmVersionActions:$e},Symbol.toStringTag,{value:"Module"});class jt extends N{id="private";async readPublishedVersion(e){}async publish(e){return{output:`[private] skipped publish for ${e.pkg.name}@${e.release.newVersion}`,published:!1}}}const ve=t=>`https://pypi.org/pypi/${encodeURIComponent(t.toLowerCase())}/json`,xt=(t,e)=>e?.uvLockPath?h(t.dir,e.uvLockPath):h(t.dir,"uv.lock"),Vt=async(t,e)=>{let n;try{n=await M(t)}catch{return"no-root-pyproject"}if(n===void 0)return"no-root-pyproject";const r=n.tool?.uv?.workspace?.members;if(!Array.isArray(r)||r.length===0)return"no-workspace";const s=e.replace(/^\.\//,"").replaceAll("\\","/");for(const a of r){if(typeof a!="string")continue;const i=a.replace(/^\.\//,"").replaceAll("\\","/");if(i===s)return"member";if(i.endsWith("/*")){const o=i.slice(0,-2);if(s.startsWith(`${o}/`)&&!s.slice(o.length+1).includes("/"))return"member"}if(i.endsWith("/**")){const o=i.slice(0,-3);if(s===o||s.startsWith(`${o}/`))return"member"}}return"missing"},M=async t=>{const e=h(t,"pyproject.toml");let n;try{n=await A(e,"utf8")}catch(s){const{code:a}=s;if(a==="ENOENT")return;throw new l({cause:s,code:"BUMP_FILE_INVALID",file:e,message:`Failed to read ${e}: ${s.message}`})}const{parse:r}=await import("./index5.js");try{return r(n)}catch(s){throw new l({cause:s,code:"BUMP_FILE_INVALID",file:e,message:`Failed to parse ${e}: ${s.message}`})}},Ie=async(t,e)=>{try{return(await t.run("uv",["--version"],{cwd:e,silent:!0})).exitCode===0}catch{return!1}},Ce=t=>{const e=t?.["build-system"]?.["build-backend"];return e?e.startsWith("hatchling")?"hatch":e.startsWith("poetry.core")||e.startsWith("poetry_core")?"poetry":e.startsWith("pdm.backend")||e.startsWith("pdm_backend")?"pdm":e.startsWith("setuptools")?"setuptools":e.startsWith("uv_build")||e.startsWith("uv.build")?"uv":"unknown":"unknown"},Pe=(t,e)=>t==="uv"||t==="unknown"&&e?{backend:t,buildCommand:{args:["build"],binary:"uv"},hasUv:e,publishCommand:{args:["publish"],binary:"uv"}}:{backend:t,buildCommand:{args:["-m","build"],binary:"python"},hasUv:e,publishCommand:{args:["upload","dist/*"],binary:"twine"}},Se=(t,e)=>z({env:t,staticTokenVar:"TWINE_PASSWORD",workspaceConfig:e}),K=async(t,e)=>{try{const n=await j(ve(t),{headers:{Accept:"application/json"},httpProxy:e});return n.status===404||!n.ok?void 0:(await n.json())?.info?.version}catch{return}},q=(t,e)=>e?.pythonProjectDir?h(t.dir,e.pythonProjectDir):t.dir;class Ae extends N{id="python";async readPublishedVersion(e){const n=q(e.pkg,e.perPackageConfig),r=(await M(n).catch(()=>{}))?.project?.name??e.pkg.name.replace(/^@[^/]+\//,"");return K(r)}async publish(e){if(e.dryRun)return{output:`[dry-run / python] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const n=e.perPackageConfig??{},r=q(e.pkg,n),s=await M(r);if(s?.project?.dynamic?.includes("version"))throw new l({code:"CONFIG_INVALID",file:h(r,"pyproject.toml"),hint:"Dynamic versioning isn't supported by PythonVersionActions yet; use versionActions: 'shell' with your build backend's version-bump tool (e.g. `hatch version` or `poetry version` for non-vcs setups).",message:`${e.pkg.name}: pyproject.toml declares dynamic = ["version", ...]; PythonVersionActions requires a static [project] version.`,packageName:e.pkg.name});if(s?.project?.version&&s.project.version!==e.release.newVersion)throw new l({code:"BUMP_FILE_INVALID",file:h(r,"pyproject.toml"),hint:`Ensure the pyproject() preset is wired up for this package so the version literal in [project] is bumped before publish. Expected ${e.release.newVersion}, found ${s.project.version}.`,message:`${e.pkg.name}: pyproject.toml version ${s.project.version} differs from planned ${e.release.newVersion}.`,packageName:e.pkg.name});const a=s?.project?.name??e.pkg.name.replace(/^@[^/]+\//,"");if(await K(a,e.workspaceConfig?.httpProxy)===e.release.newVersion)return{alreadyPublished:!0,output:`[python] ${a}@${e.release.newVersion} already on PyPI`,published:!1};const i=await Ie(e.pm.runner,e.pkg.dir),o=Ce(s),c=Pe(o,i),d=Se(process.env,e.workspaceConfig);if(d==="missing")throw new l({code:"AUTH_MISSING",hint:["Set TWINE_PASSWORD to a PyPI API token (`TWINE_USERNAME=__token__` is injected automatically), OR","configure trusted publishing on PyPI and grant the workflow `permissions: id-token: write` so ACTIONS_ID_TOKEN_REQUEST_URL is exposed.","See https://docs.pypi.org/trusted-publishers/"].join(" "),message:`${e.pkg.name}: no PyPI credentials detected (neither TWINE_PASSWORD nor OIDC trusted-publishing env).`,packageName:e.pkg.name});const p=await e.pm.runner.run(c.buildCommand.binary,c.buildCommand.args,{cwd:r,silent:!1});if(p.exitCode!==0)throw new l({code:"PUBLISH_FAILED",hint:`Inspect the ${c.buildCommand.binary} ${c.buildCommand.args.join(" ")} output above. Common causes: missing ${c.backend==="uv"?"uv":"build/setuptools/wheel"} dependency, broken pyproject.toml, source files missing from \`include\`.`,message:`${e.pkg.name}: build failed (${c.buildCommand.binary} ${c.buildCommand.args.join(" ")}): exit ${p.exitCode}. stderr: ${p.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});const m={...process.env};d==="token"&&!m.TWINE_USERNAME&&(m.TWINE_USERNAME="__token__");const y=await e.pm.runner.run(c.publishCommand.binary,c.publishCommand.args,{cwd:r,env:m,silent:!1});if(y.exitCode!==0)throw new l({code:"PUBLISH_FAILED",hint:`Inspect the ${c.publishCommand.binary} output above. Common causes: invalid API token, version already published (this should have been caught by readPublishedVersion — file a vis bug), 2FA required without a token.`,message:`${e.pkg.name}: publish failed (${c.publishCommand.binary} ${c.publishCommand.args.join(" ")}): exit ${y.exitCode}. stderr: ${y.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});return{output:`[python/${c.backend}${c.hasUv?"+uv":""}] published ${a}@${e.release.newVersion}`,published:!0}}}const Gt=Object.defineProperty({__proto__:null,PYPI_PROJECT_URL:ve,PythonVersionActions:Ae,checkUvWorkspaceMembership:Vt,detectAuthMode:Se,detectBackend:Ce,detectUv:Ie,fetchPyPiVersion:K,readPyProject:M,resolveBuildEnv:Pe,resolveProjectDir:q,resolveUvLockPath:xt},Symbol.toStringTag,{value:"Module"}),R=async(t,e,n,r)=>{const s=J(n,r),a=process.platform==="win32",i=a?"cmd":"sh",o=a?["/c",s]:["-c",s];return t.run(i,o,{cwd:e,silent:!1})};class Ot extends N{id="shell";async readPublishedVersion(e){const n=e.perPackageConfig??{},{workspaceConfig:r}=e;if(!r)return;const s=W(e.pkg.name,n,r);if(!s.checkPublished)return;const a=await R(e.pm.runner,e.pkg.dir,s.checkPublished,{name:e.pkg.name,version:e.pkg.version});if(a.exitCode!==0)return;const i=a.stdout.trim();return/\b\d+\.\d+\.\d+(?:[-+][\w.+-]+)?\b/.exec(i)?.[0]}async publish(e){if(e.dryRun)return{output:`[dry-run / shell] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const{workspaceConfig:n}=e,r=e.perPackageConfig??{};if(!n)throw new l({code:"CONFIG_INVALID",message:`Shell publish actions for ${e.pkg.name} require a workspace config (release.allowCustomCommands gate).`,packageName:e.pkg.name});const s=W(e.pkg.name,r,n);if(!s.publishCommand)throw new l({code:"CONFIG_INVALID",hint:`Set release.allowCustomCommands (workspace-wide boolean or an allow-list including "${e.pkg.name}") and configure release.packages["${e.pkg.name}"].publishCommand.`,message:`Shell publish actions for ${e.pkg.name} require a publishCommand AND the trust gate to permit it.`,packageName:e.pkg.name});const a={name:e.pkg.name,registry:e.registry,tag:e.tag,version:e.release.newVersion};if(s.checkPublished){const o=await R(e.pm.runner,e.pkg.dir,s.checkPublished,a);if(o.exitCode===0&&/\b\d+\.\d+\.\d+(?:[-+][\w.+-]+)?\b/.exec(o.stdout.trim())?.[0]===e.release.newVersion)return{alreadyPublished:!0,output:`[shell] ${e.pkg.name}@${e.release.newVersion} already on the registry`,published:!1}}if(s.buildCommand){const o=await R(e.pm.runner,e.pkg.dir,s.buildCommand,a);if(o.exitCode!==0)throw new l({code:"PUBLISH_FAILED",message:`buildCommand failed for ${e.pkg.name}: exit ${o.exitCode}. stderr: ${o.stderr.trim().slice(0,500)}`,packageName:e.pkg.name})}const i=Array.isArray(s.publishCommand)?s.publishCommand:[s.publishCommand];for(const o of i){const c=await R(e.pm.runner,e.pkg.dir,o,a);if(c.exitCode!==0)throw new l({code:"PUBLISH_FAILED",hint:"Inspect the publishCommand output above. Common causes: missing auth token, registry unreachable, version already published (re-run safe — `checkPublished` short-circuits subsequent runs).",message:`publishCommand failed for ${e.pkg.name}@${e.release.newVersion}: exit ${c.exitCode}. stderr: ${c.stderr.trim().slice(0,500)}`,packageName:e.pkg.name})}return{output:`[shell] published ${e.pkg.name}@${e.release.newVersion}`,published:!0}}}const Bt=t=>{switch(t){case"cargo":return new at;case"container":return new lt;case"jsr":return new gt;case"maven":return new $t;case"native-addon":return new Pt;case"private":return new jt;case"python":return new Ae;case"shell":return new Ot;default:return new $e}};export{be as a,fe as b,Bt as c,Ue as d,Tt as e,Ut as f,Gt as g,Ke as p,Y as r};
+`),{alreadyPublished:!1,output:`stage-timeout: ${r}`,published:!1,stageId:r})}}const Nt=["dependencies","devDependencies","peerDependencies","optionalDependencies"],_t=(t,e)=>{const n={...t};for(const r of Nt){const s=t[r];if(!s||typeof s!="object")continue;const a={...s};for(const[i,o]of Object.entries(s)){if(!o.startsWith("workspace:"))continue;const c=e.get(i);c&&(a[i]=fe(o.slice(10)==="*"?"*":o,c.version),a[i].startsWith("workspace:")&&(a[i]=a[i].slice(10)))}n[r]=a}return n},jt=Object.defineProperty({__proto__:null,NpmVersionActions:$e},Symbol.toStringTag,{value:"Module"});class xt extends N{id="private";async readPublishedVersion(e){}async publish(e){return{output:`[private] skipped publish for ${e.pkg.name}@${e.release.newVersion}`,published:!1}}}const ve=t=>`https://pypi.org/pypi/${encodeURIComponent(t.toLowerCase())}/json`,Vt=(t,e)=>e?.uvLockPath?h(t.dir,e.uvLockPath):h(t.dir,"uv.lock"),Ot=async(t,e)=>{let n;try{n=await M(t)}catch{return"no-root-pyproject"}if(n===void 0)return"no-root-pyproject";const r=n.tool?.uv?.workspace?.members;if(!Array.isArray(r)||r.length===0)return"no-workspace";const s=e.replace(/^\.\//,"").replaceAll("\\","/");for(const a of r){if(typeof a!="string")continue;const i=a.replace(/^\.\//,"").replaceAll("\\","/");if(i===s)return"member";if(i.endsWith("/*")){const o=i.slice(0,-2);if(s.startsWith(`${o}/`)&&!s.slice(o.length+1).includes("/"))return"member"}if(i.endsWith("/**")){const o=i.slice(0,-3);if(s===o||s.startsWith(`${o}/`))return"member"}}return"missing"},M=async t=>{const e=h(t,"pyproject.toml");let n;try{n=await A(e,"utf8")}catch(s){const{code:a}=s;if(a==="ENOENT")return;throw new l({cause:s,code:"BUMP_FILE_INVALID",file:e,message:`Failed to read ${e}: ${s.message}`})}const{parse:r}=await import("./index5.js");try{return r(n)}catch(s){throw new l({cause:s,code:"BUMP_FILE_INVALID",file:e,message:`Failed to parse ${e}: ${s.message}`})}},Ie=async(t,e)=>{try{return(await t.run("uv",["--version"],{cwd:e,silent:!0})).exitCode===0}catch{return!1}},Ce=t=>{const e=t?.["build-system"]?.["build-backend"];return e?e.startsWith("hatchling")?"hatch":e.startsWith("poetry.core")||e.startsWith("poetry_core")?"poetry":e.startsWith("pdm.backend")||e.startsWith("pdm_backend")?"pdm":e.startsWith("setuptools")?"setuptools":e.startsWith("uv_build")||e.startsWith("uv.build")?"uv":"unknown":"unknown"},Pe=(t,e)=>t==="uv"||t==="unknown"&&e?{backend:t,buildCommand:{args:["build"],binary:"uv"},hasUv:e,publishCommand:{args:["publish"],binary:"uv"}}:{backend:t,buildCommand:{args:["-m","build"],binary:"python"},hasUv:e,publishCommand:{args:["upload","dist/*"],binary:"twine"}},Se=(t,e)=>z({env:t,staticTokenVar:"TWINE_PASSWORD",workspaceConfig:e}),K=async(t,e)=>{try{const n=await j(ve(t),{headers:{Accept:"application/json"},httpProxy:e});return n.status===404||!n.ok?void 0:(await n.json())?.info?.version}catch{return}},q=(t,e)=>e?.pythonProjectDir?h(t.dir,e.pythonProjectDir):t.dir;class Ae extends N{id="python";async readPublishedVersion(e){const n=q(e.pkg,e.perPackageConfig),r=(await M(n).catch(()=>{}))?.project?.name??e.pkg.name.replace(/^@[^/]+\//,"");return K(r)}async publish(e){if(e.dryRun)return{output:`[dry-run / python] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const n=e.perPackageConfig??{},r=q(e.pkg,n),s=await M(r);if(s?.project?.dynamic?.includes("version"))throw new l({code:"CONFIG_INVALID",file:h(r,"pyproject.toml"),hint:"Dynamic versioning isn't supported by PythonVersionActions yet; use versionActions: 'shell' with your build backend's version-bump tool (e.g. `hatch version` or `poetry version` for non-vcs setups).",message:`${e.pkg.name}: pyproject.toml declares dynamic = ["version", ...]; PythonVersionActions requires a static [project] version.`,packageName:e.pkg.name});if(s?.project?.version&&s.project.version!==e.release.newVersion)throw new l({code:"BUMP_FILE_INVALID",file:h(r,"pyproject.toml"),hint:`Ensure the pyproject() preset is wired up for this package so the version literal in [project] is bumped before publish. Expected ${e.release.newVersion}, found ${s.project.version}.`,message:`${e.pkg.name}: pyproject.toml version ${s.project.version} differs from planned ${e.release.newVersion}.`,packageName:e.pkg.name});const a=s?.project?.name??e.pkg.name.replace(/^@[^/]+\//,"");if(await K(a,e.workspaceConfig?.httpProxy)===e.release.newVersion)return{alreadyPublished:!0,output:`[python] ${a}@${e.release.newVersion} already on PyPI`,published:!1};const i=await Ie(e.pm.runner,e.pkg.dir),o=Ce(s),c=Pe(o,i),d=Se(process.env,e.workspaceConfig);if(d==="missing")throw new l({code:"AUTH_MISSING",hint:["Set TWINE_PASSWORD to a PyPI API token (`TWINE_USERNAME=__token__` is injected automatically), OR","configure trusted publishing on PyPI and grant the workflow `permissions: id-token: write` so ACTIONS_ID_TOKEN_REQUEST_URL is exposed.","See https://docs.pypi.org/trusted-publishers/"].join(" "),message:`${e.pkg.name}: no PyPI credentials detected (neither TWINE_PASSWORD nor OIDC trusted-publishing env).`,packageName:e.pkg.name});const p=await e.pm.runner.run(c.buildCommand.binary,c.buildCommand.args,{cwd:r,silent:!1});if(p.exitCode!==0)throw new l({code:"PUBLISH_FAILED",hint:`Inspect the ${c.buildCommand.binary} ${c.buildCommand.args.join(" ")} output above. Common causes: missing ${c.backend==="uv"?"uv":"build/setuptools/wheel"} dependency, broken pyproject.toml, source files missing from \`include\`.`,message:`${e.pkg.name}: build failed (${c.buildCommand.binary} ${c.buildCommand.args.join(" ")}): exit ${p.exitCode}. stderr: ${p.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});const m={...process.env};d==="token"&&!m.TWINE_USERNAME&&(m.TWINE_USERNAME="__token__");const y=await e.pm.runner.run(c.publishCommand.binary,c.publishCommand.args,{cwd:r,env:m,silent:!1});if(y.exitCode!==0)throw new l({code:"PUBLISH_FAILED",hint:`Inspect the ${c.publishCommand.binary} output above. Common causes: invalid API token, version already published (this should have been caught by readPublishedVersion — file a vis bug), 2FA required without a token.`,message:`${e.pkg.name}: publish failed (${c.publishCommand.binary} ${c.publishCommand.args.join(" ")}): exit ${y.exitCode}. stderr: ${y.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});return{output:`[python/${c.backend}${c.hasUv?"+uv":""}] published ${a}@${e.release.newVersion}`,published:!0}}}const Bt=Object.defineProperty({__proto__:null,PYPI_PROJECT_URL:ve,PythonVersionActions:Ae,checkUvWorkspaceMembership:Ot,detectAuthMode:Se,detectBackend:Ce,detectUv:Ie,fetchPyPiVersion:K,readPyProject:M,resolveBuildEnv:Pe,resolveProjectDir:q,resolveUvLockPath:Vt},Symbol.toStringTag,{value:"Module"}),R=async(t,e,n,r)=>{const s=J(n,r),a=process.platform==="win32",i=a?"cmd":"sh",o=a?["/c",s]:["-c",s];return t.run(i,o,{cwd:e,silent:!1})};class Rt extends N{id="shell";async readPublishedVersion(e){const n=e.perPackageConfig??{},{workspaceConfig:r}=e;if(!r)return;const s=W(e.pkg.name,n,r);if(!s.checkPublished)return;const a=await R(e.pm.runner,e.pkg.dir,s.checkPublished,{name:e.pkg.name,version:e.pkg.version});if(a.exitCode!==0)return;const i=a.stdout.trim();return/\b\d+\.\d+\.\d+(?:[-+][\w.+-]+)?\b/.exec(i)?.[0]}async publish(e){if(e.dryRun)return{output:`[dry-run / shell] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const{workspaceConfig:n}=e,r=e.perPackageConfig??{};if(!n)throw new l({code:"CONFIG_INVALID",message:`Shell publish actions for ${e.pkg.name} require a workspace config (release.allowCustomCommands gate).`,packageName:e.pkg.name});const s=W(e.pkg.name,r,n);if(!s.publishCommand)throw new l({code:"CONFIG_INVALID",hint:`Set release.allowCustomCommands (workspace-wide boolean or an allow-list including "${e.pkg.name}") and configure release.packages["${e.pkg.name}"].publishCommand.`,message:`Shell publish actions for ${e.pkg.name} require a publishCommand AND the trust gate to permit it.`,packageName:e.pkg.name});const a={name:e.pkg.name,registry:e.registry,tag:e.tag,version:e.release.newVersion};if(s.checkPublished){const o=await R(e.pm.runner,e.pkg.dir,s.checkPublished,a);if(o.exitCode===0&&/\b\d+\.\d+\.\d+(?:[-+][\w.+-]+)?\b/.exec(o.stdout.trim())?.[0]===e.release.newVersion)return{alreadyPublished:!0,output:`[shell] ${e.pkg.name}@${e.release.newVersion} already on the registry`,published:!1}}if(s.buildCommand){const o=await R(e.pm.runner,e.pkg.dir,s.buildCommand,a);if(o.exitCode!==0)throw new l({code:"PUBLISH_FAILED",message:`buildCommand failed for ${e.pkg.name}: exit ${o.exitCode}. stderr: ${o.stderr.trim().slice(0,500)}`,packageName:e.pkg.name})}const i=Array.isArray(s.publishCommand)?s.publishCommand:[s.publishCommand];for(const o of i){const c=await R(e.pm.runner,e.pkg.dir,o,a);if(c.exitCode!==0)throw new l({code:"PUBLISH_FAILED",hint:"Inspect the publishCommand output above. Common causes: missing auth token, registry unreachable, version already published (re-run safe — `checkPublished` short-circuits subsequent runs).",message:`publishCommand failed for ${e.pkg.name}@${e.release.newVersion}: exit ${c.exitCode}. stderr: ${c.stderr.trim().slice(0,500)}`,packageName:e.pkg.name})}return{output:`[shell] published ${e.pkg.name}@${e.release.newVersion}`,published:!0}}}const Wt=t=>{switch(t){case"cargo":return new ot;case"container":return new ut;case"jsr":return new ht;case"maven":return new vt;case"native-addon":return new St;case"private":return new xt;case"python":return new Ae;case"shell":return new Rt;default:return new $e}};export{be as a,fe as b,Wt as c,Ge as d,Ut as e,Gt as f,Bt as g,qe as p,Y as r};

package/dist/packem_chunks/resolveFormatter.js

@@ -1,9 +1,9 @@
-import{createRequire as V}from"node:module";import{createShellRunner as G}from"./shell-runner.js";const _=V(import.meta.url),y=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,j=e=>{if(typeof y<"u"&&y.versions&&y.versions.node){const[n,s]=y.versions.node.split(".").map(Number);if(n>22||n===22&&s>=3||n===20&&s>=16)return y.getBuiltinModule(e)}return _(e)},{pathToFileURL:k}=j("node:url"),S=[{section:"Breaking Changes",type:"breaking"},{section:"Features",type:"feat"},{section:"Bug Fixes",type:"fix"},{section:"Performance Improvements",type:"perf"},{section:"Reverts",type:"revert"},{section:"Documentation",type:"docs"},{hidden:!0,section:"Styles",type:"style"},{hidden:!0,section:"Code Refactoring",type:"refactor"},{hidden:!0,section:"Tests",type:"test"},{hidden:!0,section:"Build System",type:"build"},{hidden:!0,section:"Continuous Integration",type:"ci"},{hidden:!0,section:"Miscellaneous Chores",type:"chore"}],W=/^(?<type>[a-z]+)(?:\([^)]+\))?!?:\s+/,E=/^(?:[\p{Emoji_Presentation}\p{Extended_Pictographic}]|:\w+:)\s+/u,D=e=>{const n=e.replace(E,""),s=W.exec(n);if(s?.groups?.type)return n.includes("!:")&&n.split("!:")[0]?.match(/^[a-z]+(?:\([^)]+\))?$/)?"breaking":s.groups.type},P=e=>`(${e.startsWith("@")?e:`@${e}`})`,T=(e,n)=>{for(const s of n){const o=s.line.startsWith("-")||s.line.startsWith("*")?s.line:`- ${s.line}`;e.push(`${o}${s.suffix}`)}},z=(e,n,s)=>{const o=new Map;for(const t of n){const c=t.type??"other",i=o.get(c)??[];i.push({line:t.line,suffix:t.suffix}),o.set(c,i)}for(const t of s){const c=o.get(t.type);if(t.hidden){o.delete(t.type);continue}if(!(!c||c.length===0)){e.push(`### ${t.section}`),e.push("");for(const i of c){const u=i.line.startsWith("-")||i.line.startsWith("*")?i.line:`- ${i.line}`;e.push(`${u}${i.suffix}`)}e.push(""),o.delete(t.type)}}if(!s.some(t=>t.type==="other"&&t.hidden)&&o.size>0){e.push("### Miscellaneous"),e.push("");for(const t of o.values())for(const c of t){const i=c.line.startsWith("-")||c.line.startsWith("*")?c.line:`- ${c.line}`;e.push(`${i}${c.suffix}`)}}},B=(e={})=>n=>{const{changeFiles:s,date:o,release:t,target:c}=n,i=[];c!=="github-release"&&(i.push(`## ${t.newVersion}`),i.push(`<sub>${o}</sub>`),i.push(""));const u=[];for(const r of s){const a=r.body.trim();if(!a)continue;const p=e.authorCredit?r.meta?.author:void 0,h=p?` ${P(p)}`:"";for(const d of a.split(/\r?\n/)){const m=d.trim();m&&u.push({line:m,suffix:h,type:D(m)})}}const f=e.sections===void 0?void 0:e.sections.length===0?S:e.sections;if(f?z(i,u,f):T(i,u),t.isCascadeBump||t.isGroupBump)for(const r of t.sources){const a=t.isCascadeBump?"Cascade from":"Group bump with";i.push(`- ${a} ${r.name}@${r.newVersion}`)}else if(t.isDependencyBump&&s.length===0)for(const r of t.sources)r.newVersion===""?i.push(`- Removed dependency ${r.name}`):i.push(`- Updated dependency ${r.name}@${r.newVersion}`);return i.join(`
+import{createRequire as _}from"node:module";import{createShellRunner as S}from"./shell-runner.js";let V;const j=e=>(V??=_(import.meta.url))(e),y=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,k=e=>{if(typeof y<"u"&&y.versions&&y.versions.node){const[n,s]=y.versions.node.split(".").map(Number);if(n>22||n===22&&s>=3||n===20&&s>=16)return y.getBuiltinModule(e)}return j(e)},{pathToFileURL:G}=k("node:url"),W=[{section:"Breaking Changes",type:"breaking"},{section:"Features",type:"feat"},{section:"Bug Fixes",type:"fix"},{section:"Performance Improvements",type:"perf"},{section:"Reverts",type:"revert"},{section:"Documentation",type:"docs"},{hidden:!0,section:"Styles",type:"style"},{hidden:!0,section:"Code Refactoring",type:"refactor"},{hidden:!0,section:"Tests",type:"test"},{hidden:!0,section:"Build System",type:"build"},{hidden:!0,section:"Continuous Integration",type:"ci"},{hidden:!0,section:"Miscellaneous Chores",type:"chore"}],E=/^(?<type>[a-z]+)(?:\([^)]+\))?!?:\s+/,D=/^(?:[\p{Emoji_Presentation}\p{Extended_Pictographic}]|:\w+:)\s+/u,P=e=>{const n=e.replace(D,""),s=E.exec(n);if(s?.groups?.type)return n.includes("!:")&&n.split("!:")[0]?.match(/^[a-z]+(?:\([^)]+\))?$/)?"breaking":s.groups.type},T=e=>`(${e.startsWith("@")?e:`@${e}`})`,z=(e,n)=>{for(const s of n){const o=s.line.startsWith("-")||s.line.startsWith("*")?s.line:`- ${s.line}`;e.push(`${o}${s.suffix}`)}},L=(e,n,s)=>{const o=new Map;for(const t of n){const c=t.type??"other",i=o.get(c)??[];i.push({line:t.line,suffix:t.suffix}),o.set(c,i)}for(const t of s){const c=o.get(t.type);if(t.hidden){o.delete(t.type);continue}if(!(!c||c.length===0)){e.push(`### ${t.section}`),e.push("");for(const i of c){const u=i.line.startsWith("-")||i.line.startsWith("*")?i.line:`- ${i.line}`;e.push(`${u}${i.suffix}`)}e.push(""),o.delete(t.type)}}if(!s.some(t=>t.type==="other"&&t.hidden)&&o.size>0){e.push("### Miscellaneous"),e.push("");for(const t of o.values())for(const c of t){const i=c.line.startsWith("-")||c.line.startsWith("*")?c.line:`- ${c.line}`;e.push(`${i}${c.suffix}`)}}},B=(e={})=>n=>{const{changeFiles:s,date:o,release:t,target:c}=n,i=[];c!=="github-release"&&(i.push(`## ${t.newVersion}`),i.push(`<sub>${o}</sub>`),i.push(""));const u=[];for(const r of s){const a=r.body.trim();if(!a)continue;const p=e.authorCredit?r.meta?.author:void 0,h=p?` ${T(p)}`:"";for(const d of a.split(/\r?\n/)){const m=d.trim();m&&u.push({line:m,suffix:h,type:P(m)})}}const f=e.sections===void 0?void 0:e.sections.length===0?W:e.sections;if(f?L(i,u,f):z(i,u),t.isCascadeBump||t.isGroupBump)for(const r of t.sources){const a=t.isCascadeBump?"Cascade from":"Group bump with";i.push(`- ${a} ${r.name}@${r.newVersion}`)}else if(t.isDependencyBump&&s.length===0)for(const r of t.sources)r.newVersion===""?i.push(`- Removed dependency ${r.name}`):i.push(`- Updated dependency ${r.name}@${r.newVersion}`);return i.join(`
 `).replaceAll(/\n{3,}/g,`
 
-`).trim()},L=B(),N={includeCommitLink:!0,internalAuthors:[],thankContributors:!0},I=async(e,n,s)=>{if(e)return e;const{createRemoteClient:o,detectRemoteProvider:t}=await import("./detect2.js"),c=await t(s,n,void 0);return o(c).detectRepoSlug(s,n)},M=async(e,n,s)=>{const o=await e.run("git",["log","--diff-filter=A","--pretty=format:%aN%n%aE","--",s],{cwd:n,silent:!0});return o.exitCode!==0?void 0:o.stdout.split(`
-`)[0]?.trim()||void 0},U=(e,n)=>n?e.replaceAll(/(?<!\[)#(\d+)/g,(s,o)=>`[#${o}](https://github.com/${n}/issues/${o})`):e,x=(e={})=>{const n={...N,...e},s=e.runner??G();let o;return async t=>{const{changeFiles:c,date:i,release:u,target:f}=t,r=[],a=new Set,p=process.cwd();o||(o=I(e.repo,s,p));const h=await o;f!=="github-release"&&(r.push(`## ${u.newVersion}`),r.push(`<sub>${i}</sub>`),r.push(""));for(const d of c){const m=d.body.trim(),l=d.meta??{},$=l.author??await M(s,p,d.path);$&&n.thankContributors&&!n.internalAuthors.includes($.replace(/^@/,""))&&a.add($.startsWith("@")?$:`@${$}`);const g=[];if(l.pr&&h?g.push(`[#${l.pr}](https://github.com/${h}/pull/${l.pr})`):l.pr&&g.push(`#${l.pr}`),l.commit&&n.includeCommitLink&&h){const b=l.commit.slice(0,7);g.push(`[\`${b}\`](https://github.com/${h}/commit/${l.commit})`)}const w=g.length>0?` (${g.join(", ")})`:"";if(m)for(const b of m.split(/\r?\n/)){const C=b.trim();if(!C)continue;const v=U(C,h);C.startsWith("-")||C.startsWith("*")?r.push(`${v}${w}`):r.push(`- ${v}${w}`)}}if(u.isCascadeBump||u.isGroupBump)for(const d of u.sources){const m=u.isCascadeBump?"Cascade from":"Group bump with";r.push(`- ${m} ${d.name}@${d.newVersion}`)}else if(u.isDependencyBump&&c.length===0)for(const d of u.sources)d.newVersion===""?r.push(`- Removed dependency ${d.name}`):r.push(`- Updated dependency ${d.name}@${d.newVersion}`);return n.thankContributors&&a.size>0&&(r.push(""),r.push(`Thanks ${[...a].join(", ")}!`)),r.join(`
-`)}},F=["Added","Changed","Deprecated","Removed","Fixed","Security"],q=e=>{const n=e.toLowerCase();return F.find(s=>s.toLowerCase()===n)},K={add:"Added",bugfix:"Fixed",change:"Changed",changed:"Changed",chore:"Changed",deprecate:"Deprecated",deprecated:"Deprecated",feat:"Added",feature:"Added",fix:"Fixed",perf:"Changed",refactor:"Changed",remove:"Removed",removed:"Removed",sec:"Security",security:"Security"},H=/^\s*\[(added|changed|deprecated|removed|fixed|security)\]\s*:?\s*(.*)$/i,J=e=>e.replace(/^[-*]\s+/,"").trim(),O=e=>{const n=/^([a-z]+)(?:\([^)]+\))?!?\s*:\s*(.*)$/i.exec(e.trim());if(!n)return;const s=n[1].toLowerCase(),o=K[s];if(o)return{rest:n[2].trim(),section:o}},Q=e=>e==="major"?"Changed":e==="minor"?"Added":"Fixed",A=(e,n)=>/\bBREAKING(?:\s+CHANGE)?\b/.test(e)||/^\s*[a-z]+(?:\([^)]+\))?!\s*:/i.test(e)||n==="major",X=(e,n,s,o)=>{const t=J(e);if(!t)return;const c=H.exec(t);if(c){const u=q(c[1]);if(u){s[u].push(`- ${c[2].trim()}`);return}}const i=O(t);if(i){A(t,n)&&o.push(`- ${i.rest||t}`),s[i.section].push(`- ${i.rest||t}`);return}A(t,n)&&o.push(`- ${t}`),s[Q(n)].push(`- ${t}`)},Y=(e,n,s,o,t)=>{if(n)return`${n}/compare/${o}...${t}`;if(e)return`https://github.com/${e}/compare/${o}...${t}`},R=(e={})=>n=>{const{changeFiles:s,date:o,release:t,target:c}=n,i={Added:[],Changed:[],Deprecated:[],Fixed:[],Removed:[],Security:[]},u=[],f=t.type;for(const a of s)for(const p of a.body.trim().split(/\r?\n/))p.trim()&&X(p,f,i,u);if(t.isCascadeBump||t.isGroupBump)for(const a of t.sources){const p=t.isCascadeBump?"Cascade from":"Group bump with";i.Changed.push(`- ${p} \`${a.name}\`@${a.newVersion}`)}else if(t.isDependencyBump&&s.length===0)for(const a of t.sources)a.newVersion===""?i.Removed.push(`- Removed dependency \`${a.name}\``):i.Changed.push(`- Updated dependency \`${a.name}\`@${a.newVersion}`);const r=[];if(c!=="github-release"&&(r.push(`## [${t.newVersion}] - ${o}`),r.push("")),u.length>0){r.push("### ⚠ BREAKING CHANGES"),r.push("");for(const a of u)r.push(a);r.push("")}for(const a of F){const p=i[a];if(p.length!==0){r.push(`### ${a}`),r.push("");for(const h of p)r.push(h);r.push("")}}if(c!=="github-release"){const a=`${t.name}@${t.oldVersion}`,p=`${t.name}@${t.newVersion}`,h=Y(e.repo,e.compareUrlPrefix,t.name,a,p);h&&r.push(`[${t.newVersion}]: ${h}`)}return r.join(`
+`).trim()},N=B(),I={includeCommitLink:!0,internalAuthors:[],thankContributors:!0},M=async(e,n,s)=>{if(e)return e;const{createRemoteClient:o,detectRemoteProvider:t}=await import("./detect2.js"),c=await t(s,n,void 0);return o(c).detectRepoSlug(s,n)},U=async(e,n,s)=>{const o=await e.run("git",["log","--diff-filter=A","--pretty=format:%aN%n%aE","--",s],{cwd:n,silent:!0});return o.exitCode!==0?void 0:o.stdout.split(`
+`)[0]?.trim()||void 0},q=(e,n)=>n?e.replaceAll(/(?<!\[)#(\d+)/g,(s,o)=>`[#${o}](https://github.com/${n}/issues/${o})`):e,x=(e={})=>{const n={...I,...e},s=e.runner??S();let o;return async t=>{const{changeFiles:c,date:i,release:u,target:f}=t,r=[],a=new Set,p=process.cwd();o||(o=M(e.repo,s,p));const h=await o;f!=="github-release"&&(r.push(`## ${u.newVersion}`),r.push(`<sub>${i}</sub>`),r.push(""));for(const d of c){const m=d.body.trim(),l=d.meta??{},$=l.author??await U(s,p,d.path);$&&n.thankContributors&&!n.internalAuthors.includes($.replace(/^@/,""))&&a.add($.startsWith("@")?$:`@${$}`);const g=[];if(l.pr&&h?g.push(`[#${l.pr}](https://github.com/${h}/pull/${l.pr})`):l.pr&&g.push(`#${l.pr}`),l.commit&&n.includeCommitLink&&h){const b=l.commit.slice(0,7);g.push(`[\`${b}\`](https://github.com/${h}/commit/${l.commit})`)}const w=g.length>0?` (${g.join(", ")})`:"";if(m)for(const b of m.split(/\r?\n/)){const C=b.trim();if(!C)continue;const v=q(C,h);C.startsWith("-")||C.startsWith("*")?r.push(`${v}${w}`):r.push(`- ${v}${w}`)}}if(u.isCascadeBump||u.isGroupBump)for(const d of u.sources){const m=u.isCascadeBump?"Cascade from":"Group bump with";r.push(`- ${m} ${d.name}@${d.newVersion}`)}else if(u.isDependencyBump&&c.length===0)for(const d of u.sources)d.newVersion===""?r.push(`- Removed dependency ${d.name}`):r.push(`- Updated dependency ${d.name}@${d.newVersion}`);return n.thankContributors&&a.size>0&&(r.push(""),r.push(`Thanks ${[...a].join(", ")}!`)),r.join(`
+`)}},F=["Added","Changed","Deprecated","Removed","Fixed","Security"],K=e=>{const n=e.toLowerCase();return F.find(s=>s.toLowerCase()===n)},H={add:"Added",bugfix:"Fixed",change:"Changed",changed:"Changed",chore:"Changed",deprecate:"Deprecated",deprecated:"Deprecated",feat:"Added",feature:"Added",fix:"Fixed",perf:"Changed",refactor:"Changed",remove:"Removed",removed:"Removed",sec:"Security",security:"Security"},J=/^\s*\[(added|changed|deprecated|removed|fixed|security)\]\s*:?\s*(.*)$/i,O=e=>e.replace(/^[-*]\s+/,"").trim(),Q=e=>{const n=/^([a-z]+)(?:\([^)]+\))?!?\s*:\s*(.*)$/i.exec(e.trim());if(!n)return;const s=n[1].toLowerCase(),o=H[s];if(o)return{rest:n[2].trim(),section:o}},X=e=>e==="major"?"Changed":e==="minor"?"Added":"Fixed",A=(e,n)=>/\bBREAKING(?:\s+CHANGE)?\b/.test(e)||/^\s*[a-z]+(?:\([^)]+\))?!\s*:/i.test(e)||n==="major",Y=(e,n,s,o)=>{const t=O(e);if(!t)return;const c=J.exec(t);if(c){const u=K(c[1]);if(u){s[u].push(`- ${c[2].trim()}`);return}}const i=Q(t);if(i){A(t,n)&&o.push(`- ${i.rest||t}`),s[i.section].push(`- ${i.rest||t}`);return}A(t,n)&&o.push(`- ${t}`),s[X(n)].push(`- ${t}`)},Z=(e,n,s,o,t)=>{if(n)return`${n}/compare/${o}...${t}`;if(e)return`https://github.com/${e}/compare/${o}...${t}`},R=(e={})=>n=>{const{changeFiles:s,date:o,release:t,target:c}=n,i={Added:[],Changed:[],Deprecated:[],Fixed:[],Removed:[],Security:[]},u=[],f=t.type;for(const a of s)for(const p of a.body.trim().split(/\r?\n/))p.trim()&&Y(p,f,i,u);if(t.isCascadeBump||t.isGroupBump)for(const a of t.sources){const p=t.isCascadeBump?"Cascade from":"Group bump with";i.Changed.push(`- ${p} \`${a.name}\`@${a.newVersion}`)}else if(t.isDependencyBump&&s.length===0)for(const a of t.sources)a.newVersion===""?i.Removed.push(`- Removed dependency \`${a.name}\``):i.Changed.push(`- Updated dependency \`${a.name}\`@${a.newVersion}`);const r=[];if(c!=="github-release"&&(r.push(`## [${t.newVersion}] - ${o}`),r.push("")),u.length>0){r.push("### ⚠ BREAKING CHANGES"),r.push("");for(const a of u)r.push(a);r.push("")}for(const a of F){const p=i[a];if(p.length!==0){r.push(`### ${a}`),r.push("");for(const h of p)r.push(h);r.push("")}}if(c!=="github-release"){const a=`${t.name}@${t.oldVersion}`,p=`${t.name}@${t.newVersion}`,h=Z(e.repo,e.compareUrlPrefix,t.name,a,p);h&&r.push(`[${t.newVersion}]: ${h}`)}return r.join(`
 `).replaceAll(/\n{3,}/g,`
 
-`).trimEnd()},te=async(e,n)=>{if(e===!1)return()=>"";if(e===void 0||e==="default")return L;if(e==="github")return x();if(e==="keep-a-changelog"||e==="keepachangelog")return R();let s,o={};if(Array.isArray(e)?[s,o={}]=e:s=e,s==="default")return B(o);if(s==="github")return x(o);if(s==="keep-a-changelog"||s==="keepachangelog")return R(o);const t=s.startsWith(".")?`${n}/${s}`:s,c=k(t).href,{dynamicEsmImport:i}=await import("./dynamic-import.js"),u=await i(c),f=typeof u=="function"?u:u.default;if(typeof f!="function")throw new TypeError(`Custom changelog formatter at ${s} did not export a default function or a callable module.`);if(Array.isArray(e))try{const r=f(o);if(typeof r=="function")return r}catch{}return f};export{te as resolveFormatter};
+`).trimEnd()},se=async(e,n)=>{if(e===!1)return()=>"";if(e===void 0||e==="default")return N;if(e==="github")return x();if(e==="keep-a-changelog"||e==="keepachangelog")return R();let s,o={};if(Array.isArray(e)?[s,o={}]=e:s=e,s==="default")return B(o);if(s==="github")return x(o);if(s==="keep-a-changelog"||s==="keepachangelog")return R(o);const t=s.startsWith(".")?`${n}/${s}`:s,c=G(t).href,{dynamicEsmImport:i}=await import("./dynamic-import.js"),u=await i(c),f=typeof u=="function"?u:u.default;if(typeof f!="function")throw new TypeError(`Custom changelog formatter at ${s} did not export a default function or a callable module.`);if(Array.isArray(e))try{const r=f(o);if(typeof r=="function")return r}catch{}return f};export{se as resolveFormatter};

package/dist/packem_chunks/shell-runner.js

@@ -1 +1 @@
-import{k as c}from"../packem_shared/main-B3juSU5z.js";import{redactTokens as o}from"./security.js";const h=()=>({run:async(s,t,r)=>{try{const e=await c(s,[...t],{nodeOptions:{cwd:r.cwd,env:{...process.env,COREPACK_ENABLE_DOWNLOAD_PROMPT:"0",...r.env},stdio:r.silent?["ignore","pipe","pipe"]:"inherit"},throwOnError:!1});return{exitCode:typeof e.exitCode=="number"?e.exitCode:-1,stderr:o(e.stderr??""),stdout:o(e.stdout??"")}}catch(e){return{exitCode:-1,stderr:o(e.message),stdout:""}}}}),f=()=>new a;class a{handlers=[];on(t,r,e){this.handlers.push({argsPrefix:r,command:t,respond:e})}async run(t,r,e){for(const n of this.handlers)if(!(n.command!==t||r.length<n.argsPrefix.length)&&n.argsPrefix.every((d,i)=>d===r[i]))return n.respond(e.cwd);return{exitCode:0,stderr:"",stdout:""}}}export{a as MockRunner,f as createMockRunner,h as createShellRunner};
+import{k as c}from"../packem_shared/main-D_cam4hv.js";import{redactTokens as o}from"./security.js";const h=()=>({run:async(s,t,r)=>{try{const e=await c(s,[...t],{nodeOptions:{cwd:r.cwd,env:{...process.env,COREPACK_ENABLE_DOWNLOAD_PROMPT:"0",...r.env},stdio:r.silent?["ignore","pipe","pipe"]:"inherit"},throwOnError:!1});return{exitCode:typeof e.exitCode=="number"?e.exitCode:-1,stderr:o(e.stderr??""),stdout:o(e.stdout??"")}}catch(e){return{exitCode:-1,stderr:o(e.message),stdout:""}}}}),f=()=>new a;class a{handlers=[];on(t,r,e){this.handlers.push({argsPrefix:r,command:t,respond:e})}async run(t,r,e){for(const n of this.handlers)if(!(n.command!==t||r.length<n.argsPrefix.length)&&n.argsPrefix.every((d,i)=>d===r[i]))return n.respond(e.cwd);return{exitCode:0,stderr:"",stdout:""}}}export{a as MockRunner,f as createMockRunner,h as createShellRunner};

package/dist/packem_chunks/snapshot.js

@@ -1,2 +1,2 @@
-import{createRequire as O}from"node:module";import{DEFAULT_CHANGES_DIR as G}from"./DEFAULT_CLEAN_KEEP.js";import{p as $,r as Q,a as X,b as Y}from"./registry.js";import{getCurrentSha as z,getShortSha as K}from"./git.js";import{N as Z}from"./detect.js";const J=O(import.meta.url),u=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,U=s=>{if(typeof u<"u"&&u.versions&&u.versions.node){const[e,r]=u.versions.node.split(".").map(Number);if(e>22||e===22&&r>=3||e===20&&r>=16)return u.getBuiltinModule(s)}return J(s)},{readFile:W,writeFile:N}=U("node:fs/promises"),ee=(s,e)=>s.replaceAll("{tag}",e.tag).replaceAll("{sha}",e.sha).replaceAll("{shortSha}",e.shortSha).replaceAll("{branch}",e.branch??"").replaceAll("{pr}",e.pr??"").replaceAll("{timestamp}",e.timestamp),ce=async s=>{const{context:e,dryRun:r=!1,registry:g,tag:n}=s,{createShellRunner:c}=await import("./shell-runner.js"),o=s.runner??c(),l=await z({cwd:e.cwd,runner:o}),i=await K({cwd:e.cwd,runner:o});if(!l||!i)throw new Error("Could not resolve git HEAD. Snapshot requires a git workspace.");const w=e.config.snapshot?.versionTemplate??"0.0.0-{tag}-{shortSha}",A=new Date().toISOString().replaceAll(/[:.]/g,"").slice(0,14),m=e.config.snapshot?.tags??[],p=await o.run("git",["rev-parse","--abbrev-ref","HEAD"],{cwd:e.cwd,silent:!0}).then(t=>t.exitCode===0?t.stdout.trim():void 0).catch(()=>{}),S=process.env.VIS_PR_NUMBER??process.env.PR_NUMBER,R=[n];for(const t of m){let a;switch(t){case"branch":{a=p&&p!=="HEAD"?p:void 0;break}case"pr":{a=S?`pr-${S}`:void 0;break}case"sha":{a=l;break}case"short-sha":{a=i;break}default:a=void 0}a&&a!==n&&!R.includes(a)&&R.push(a)}let f=e.packages;if(s.filter){const{default:t}=await import("./index.js"),a=s.filter.split(",").map(h=>h.trim()).filter(Boolean);f=f.filter(h=>a.some(y=>h.name===y||t(y,h.name)))}f=f.filter(t=>!t.private);const d=ee(w,{branch:p&&p!=="HEAD"?p:void 0,pr:S,sha:l,shortSha:i,tag:n,timestamp:A}),P=new Map;for(const t of f)P.set(t.name,{...t.manifest,version:d});const F=$(await e.pm.readCatalogYaml(e.cwd)),H=new Z(o),b=[],v=[],k=[],j=e.config.changesDir??G,{acquireLock:T,releaseLock:q}=await import("./state.js");let C=!1;if(!r)try{await T(e.cwd,j),C=!0}catch(t){return k.push({name:"_lock",reason:t.message}),{failed:k,published:b,skipped:v,snapshotVersion:d,tag:n}}try{for(const t of f){const a=ae(t,P),h=Q(a,F),y=X(h,e.config.publish?.cleanPackageJson);if(r){b.push({name:t.name,version:d});continue}let D;try{D=await W(t.manifestPath,"utf8"),await N(t.manifestPath,`${JSON.stringify(y,null,4)}
-`);const{mkdtempSync:E}=await import("node:fs"),{tmpdir:x}=await import("node:os"),{join:B}=await import("node:path"),M=E(B(x(),"vis-snapshot-")),V=await e.pm.pack({cwd:t.dir,destination:M});let _;for(const I of R){const L=await H.publish({access:"public",extraArgs:["--no-git-checks"],registry:g,tag:I,tarball:V.tarball});_??=L}_?.published?b.push({name:t.name,version:d}):_?.alreadyPublished?v.push({name:t.name,reason:"already-published"}):v.push({name:t.name,reason:_?.output??"unknown"})}catch(E){k.push({name:t.name,reason:E.message})}finally{if(D!==void 0)try{await N(t.manifestPath,D)}catch{}}}}finally{C&&await q(e.cwd,j)}return{failed:k,published:b,skipped:v,snapshotVersion:d,tag:n}},te=["dependencies","devDependencies","peerDependencies","optionalDependencies"],ae=(s,e)=>{const r=e.get(s.name)??s.manifest,g={...r};for(const n of te){const c=r[n];if(!c||typeof c!="object")continue;const o={...c};for(const[l,i]of Object.entries(c)){const w=e.get(l);if(w&&i.startsWith("workspace:")){const A=i.slice(10),m=Y(A==="*"?"*":i,w.version);o[l]=m.startsWith("workspace:")?m.slice(10):m}}g[n]=o}return g};export{ce as runSnapshot};
+import{createRequire as O}from"node:module";import{DEFAULT_CHANGES_DIR as $}from"./DEFAULT_CLEAN_KEEP.js";import{p as Q,r as X,a as Y,b as z}from"./registry.js";import{getCurrentSha as K,getShortSha as Z}from"./git.js";import{N as ee}from"./detect.js";let J;const U=a=>(J??=O(import.meta.url))(a),u=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,W=a=>{if(typeof u<"u"&&u.versions&&u.versions.node){const[e,r]=u.versions.node.split(".").map(Number);if(e>22||e===22&&r>=3||e===20&&r>=16)return u.getBuiltinModule(a)}return U(a)},{readFile:G,writeFile:N}=W("node:fs/promises"),te=(a,e)=>a.replaceAll("{tag}",e.tag).replaceAll("{sha}",e.sha).replaceAll("{shortSha}",e.shortSha).replaceAll("{branch}",e.branch??"").replaceAll("{pr}",e.pr??"").replaceAll("{timestamp}",e.timestamp),le=async a=>{const{context:e,dryRun:r=!1,registry:g,tag:n}=a,{createShellRunner:c}=await import("./shell-runner.js"),o=a.runner??c(),l=await K({cwd:e.cwd,runner:o}),i=await Z({cwd:e.cwd,runner:o});if(!l||!i)throw new Error("Could not resolve git HEAD. Snapshot requires a git workspace.");const w=e.config.snapshot?.versionTemplate??"0.0.0-{tag}-{shortSha}",A=new Date().toISOString().replaceAll(/[:.]/g,"").slice(0,14),m=e.config.snapshot?.tags??[],p=await o.run("git",["rev-parse","--abbrev-ref","HEAD"],{cwd:e.cwd,silent:!0}).then(t=>t.exitCode===0?t.stdout.trim():void 0).catch(()=>{}),S=process.env.VIS_PR_NUMBER??process.env.PR_NUMBER,R=[n];for(const t of m){let s;switch(t){case"branch":{s=p&&p!=="HEAD"?p:void 0;break}case"pr":{s=S?`pr-${S}`:void 0;break}case"sha":{s=l;break}case"short-sha":{s=i;break}default:s=void 0}s&&s!==n&&!R.includes(s)&&R.push(s)}let h=e.packages;if(a.filter){const{default:t}=await import("./index.js"),s=a.filter.split(",").map(f=>f.trim()).filter(Boolean);h=h.filter(f=>s.some(k=>f.name===k||t(k,f.name)))}h=h.filter(t=>!t.private);const d=te(w,{branch:p&&p!=="HEAD"?p:void 0,pr:S,sha:l,shortSha:i,tag:n,timestamp:A}),P=new Map;for(const t of h)P.set(t.name,{...t.manifest,version:d});const q=Q(await e.pm.readCatalogYaml(e.cwd)),F=new ee(o),b=[],v=[],_=[],j=e.config.changesDir??$,{acquireLock:H,releaseLock:T}=await import("./state.js");let C=!1;if(!r)try{await H(e.cwd,j),C=!0}catch(t){return _.push({name:"_lock",reason:t.message}),{failed:_,published:b,skipped:v,snapshotVersion:d,tag:n}}try{for(const t of h){const s=se(t,P),f=X(s,q),k=Y(f,e.config.publish?.cleanPackageJson);if(r){b.push({name:t.name,version:d});continue}let D;try{D=await G(t.manifestPath,"utf8"),await N(t.manifestPath,`${JSON.stringify(k,null,4)}
+`);const{mkdtempSync:E}=await import("node:fs"),{tmpdir:x}=await import("node:os"),{join:B}=await import("node:path"),M=E(B(x(),"vis-snapshot-")),V=await e.pm.pack({cwd:t.dir,destination:M});let y;for(const I of R){const L=await F.publish({access:"public",extraArgs:["--no-git-checks"],registry:g,tag:I,tarball:V.tarball});y??=L}y?.published?b.push({name:t.name,version:d}):y?.alreadyPublished?v.push({name:t.name,reason:"already-published"}):v.push({name:t.name,reason:y?.output??"unknown"})}catch(E){_.push({name:t.name,reason:E.message})}finally{if(D!==void 0)try{await N(t.manifestPath,D)}catch{}}}}finally{C&&await T(e.cwd,j)}return{failed:_,published:b,skipped:v,snapshotVersion:d,tag:n}},ae=["dependencies","devDependencies","peerDependencies","optionalDependencies"],se=(a,e)=>{const r=e.get(a.name)??a.manifest,g={...r};for(const n of ae){const c=r[n];if(!c||typeof c!="object")continue;const o={...c};for(const[l,i]of Object.entries(c)){const w=e.get(l);if(w&&i.startsWith("workspace:")){const A=i.slice(10),m=z(A==="*"?"*":i,w.version);o[l]=m.startsWith("workspace:")?m.slice(10):m}}g[n]=o}return g};export{le as runSnapshot};

package/dist/packem_chunks/stage-publisher.js

@@ -1 +1 @@
-import{createRequire as n}from"node:module";import{VisReleaseError as d}from"../packem_shared/VisReleaseError-DMGRBTNO.js";const a=n(import.meta.url),o=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,c=e=>{if(typeof o<"u"&&o.versions&&o.versions.node){const[t,s]=o.versions.node.split(".").map(Number);if(t>22||t===22&&s>=3||t===20&&s>=16)return o.getBuiltinModule(e)}return a(e)},{setTimeout:u}=c("node:timers/promises"),f=async e=>{const t=Date.now(),s=r=>{const i=r.trim();if(!i)return!1;try{return typeof JSON.parse(i).id=="string"}catch{return!1}};for(;Date.now()-t<e.timeoutMs;){const r=await e.runner.run("npm",["stage","view",e.stageId,"--json"],{cwd:e.cwd,silent:!0});if(!(r.exitCode===0&&s(r.stdout))){const i=await e.runner.run("npm",["view",`${e.packageName}@${e.version}`,"dist.tarball","--silent"],{cwd:e.cwd,silent:!0});return i.exitCode===0&&i.stdout.trim()?"approved":"rejected"}e.onProgress?.(Date.now()-t),await u(e.pollIntervalMs)}return"timeout"},m=(e,t=process.env)=>{const s=e==="restricted",r=!!t.ACTIONS_ID_TOKEN_REQUEST_URL&&!t.NPM_TOKEN;if(s&&r)throw new d({code:"CONFIG_INVALID",hint:"Either set publish.stage: false, or fall back to NPM_TOKEN authentication (export NPM_TOKEN; trusted publishing on restricted packages is tracked for a future release).",message:"publish.stage with OIDC trusted publishing is not supported for restricted-access packages in v1."})};export{m as refuseRestrictedOidc,f as waitForStageDecision};
+import{createRequire as n}from"node:module";import{VisReleaseError as l}from"../packem_shared/VisReleaseError-DMGRBTNO.js";let a;const c=e=>(a??=n(import.meta.url))(e),o=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,u=e=>{if(typeof o<"u"&&o.versions&&o.versions.node){const[t,s]=o.versions.node.split(".").map(Number);if(t>22||t===22&&s>=3||t===20&&s>=16)return o.getBuiltinModule(e)}return c(e)},{setTimeout:d}=u("node:timers/promises"),_=async e=>{const t=Date.now(),s=r=>{const i=r.trim();if(!i)return!1;try{return typeof JSON.parse(i).id=="string"}catch{return!1}};for(;Date.now()-t<e.timeoutMs;){const r=await e.runner.run("npm",["stage","view",e.stageId,"--json"],{cwd:e.cwd,silent:!0});if(!(r.exitCode===0&&s(r.stdout))){const i=await e.runner.run("npm",["view",`${e.packageName}@${e.version}`,"dist.tarball","--silent"],{cwd:e.cwd,silent:!0});return i.exitCode===0&&i.stdout.trim()?"approved":"rejected"}e.onProgress?.(Date.now()-t),await d(e.pollIntervalMs)}return"timeout"},m=(e,t=process.env)=>{const s=e==="restricted",r=!!t.ACTIONS_ID_TOKEN_REQUEST_URL&&!t.NPM_TOKEN;if(s&&r)throw new l({code:"CONFIG_INVALID",hint:"Either set publish.stage: false, or fall back to NPM_TOKEN authentication (export NPM_TOKEN; trusted publishing on restricted packages is tracked for a future release).",message:"publish.stage with OIDC trusted publishing is not supported for restricted-access packages in v1."})};export{m as refuseRestrictedOidc,_ as waitForStageDecision};

package/dist/packem_chunks/staged-registry.js

@@ -1,2 +1,2 @@
-import{createRequire as S}from"node:module";import{VisReleaseError as l}from"../packem_shared/VisReleaseError-DMGRBTNO.js";const w=S(import.meta.url),o=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,p=e=>{if(typeof o<"u"&&o.versions&&o.versions.node){const[n,r]=o.versions.node.split(".").map(Number);if(n>22||n===22&&r>=3||n===20&&r>=16)return o.getBuiltinModule(e)}return w(e)},{readFile:h,unlink:v,mkdir:_,writeFile:N}=p("node:fs/promises"),{dirname:k,join:O}=p("node:path"),y=(e,n)=>O(e,n,"staged.json"),R=()=>({pending:[],recentlyNotified:[],recentlyWalked:[],updatedAt:new Date().toISOString(),version:1}),c=100,T=720*60*60*1e3,u=(e,n=Date.now())=>{if(!e||e.length===0)return[];const r=n-T,t=e.filter(i=>{const a=Date.parse(i.at);return Number.isFinite(a)&&a>=r});return t.length<=c?t:[...t].sort((i,a)=>Date.parse(a.at)-Date.parse(i.at)).slice(0,c)},P=async(e,n)=>{const r=y(e,n);let t;try{t=await h(r,"utf8")}catch(a){if(a.code==="ENOENT")return R();throw new l({cause:a,code:"STATE_FILE_CORRUPT",message:`Failed to read staged registry at ${r}: ${a.message}`})}let i;try{i=JSON.parse(t)}catch(a){throw new l({cause:a,code:"STATE_FILE_CORRUPT",message:`Staged registry at ${r} is not valid JSON: ${a.message}. Remove the file or fix it manually.`})}if(i.version!==1)throw new l({code:"STATE_FILE_CORRUPT",message:`Staged registry at ${r} reports unknown version ${i.version}. Upgrade vis or remove the file.`});if(!Array.isArray(i.pending))throw new l({code:"STATE_FILE_CORRUPT",message:`Staged registry at ${r} is missing the "pending" array.`});return i},F=async(e,n,r)=>{const t=y(e,n);let i;try{const d=await h(t,"utf8");i=JSON.parse(d)}catch{i=void 0}const a=u(r.recentlyNotified),s=u(r.recentlyWalked),g={...r,recentlyNotified:a,recentlyWalked:s};if(g.pending.length===0&&a.length===0&&s.length===0){if(i===void 0)return{changed:!1,path:t,removed:!1};try{await v(t)}catch(d){if(d.code!=="ENOENT")throw d}return{changed:!0,path:t,removed:!0}}if(i&&E(i,g))return{changed:!1,path:t,removed:!1};await _(k(t),{recursive:!0});const m=`${JSON.stringify({...g,updatedAt:new Date().toISOString()},null,2)}
-`;return await N(t,m),{changed:!0,path:t,removed:!1}},W=(e,n,r=new Date().toISOString())=>{if(n.length===0)return e;const t=e.recentlyNotified??[],i=new Set(t.map(s=>s.key)),a=n.filter(s=>!i.has(s)).map(s=>({at:r,key:s}));return a.length===0?e:{...e,recentlyNotified:[...t,...a],updatedAt:r}},$=(e,n,r=new Date().toISOString())=>{if(n.length===0)return e;const t=e.recentlyWalked??[],i=new Set(t.map(s=>s.key)),a=n.filter(s=>!i.has(s)).map(s=>({at:r,key:s}));return a.length===0?e:{...e,recentlyWalked:[...t,...a],updatedAt:r}},j=(e,n)=>{if(n.length===0)return e;const r=new Map(e.pending.map(t=>[t.id,t]));for(const t of n)r.set(t.id,t);return{...e,pending:[...r.values()],updatedAt:new Date().toISOString()}},C=(e,n)=>{if(n.length===0||e.pending.length===0)return e;const r=new Set(n),t=e.pending.filter(i=>!r.has(i.id));return t.length===e.pending.length?e:{...e,pending:t,updatedAt:new Date().toISOString()}},b=(e,n)=>{if(e.pending.length===0||n.length===0)return[];const r=new Set(n);return e.pending.filter(t=>r.has(t.name))},f=(e,n)=>{const r=e??[],t=n??[];if(r.length!==t.length)return!1;if(r.length===0)return!0;const i=new Map(r.map(a=>[a.key,a]));for(const a of t)if(i.get(a.key)?.at!==a.at)return!1;return!0},E=(e,n)=>A(e.pending,n.pending)&&f(e.recentlyNotified,n.recentlyNotified)&&f(e.recentlyWalked,n.recentlyWalked),A=(e,n)=>{if(e.length!==n.length)return!1;if(e.length===0)return!0;const r=new Map(e.map(t=>[t.id,t]));for(const t of n){const i=r.get(t.id);if(!i||i.name!==t.name||i.version!==t.version||i.reason!==t.reason||(i.tag??"latest")!==(t.tag??"latest"))return!1}return!0};export{b as findConflictingPendingStages,A as pendingSetsEqual,u as pruneOldEntries,P as readStagedRegistry,W as recordRecentlyNotified,$ as recordRecentlyWalked,E as registryContentsEqual,C as removePendingStages,y as stagedRegistryPath,j as upsertPendingStages,F as writeStagedRegistry};
+import{createRequire as S}from"node:module";import{VisReleaseError as l}from"../packem_shared/VisReleaseError-DMGRBTNO.js";let w;const _=e=>(w??=S(import.meta.url))(e),o=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,p=e=>{if(typeof o<"u"&&o.versions&&o.versions.node){const[n,r]=o.versions.node.split(".").map(Number);if(n>22||n===22&&r>=3||n===20&&r>=16)return o.getBuiltinModule(e)}return _(e)},{readFile:h,unlink:v,mkdir:N,writeFile:R}=p("node:fs/promises"),{dirname:k,join:O}=p("node:path"),y=(e,n)=>O(e,n,"staged.json"),T=()=>({pending:[],recentlyNotified:[],recentlyWalked:[],updatedAt:new Date().toISOString(),version:1}),c=100,E=720*60*60*1e3,u=(e,n=Date.now())=>{if(!e||e.length===0)return[];const r=n-E,t=e.filter(i=>{const a=Date.parse(i.at);return Number.isFinite(a)&&a>=r});return t.length<=c?t:[...t].sort((i,a)=>Date.parse(a.at)-Date.parse(i.at)).slice(0,c)},j=async(e,n)=>{const r=y(e,n);let t;try{t=await h(r,"utf8")}catch(a){if(a.code==="ENOENT")return T();throw new l({cause:a,code:"STATE_FILE_CORRUPT",message:`Failed to read staged registry at ${r}: ${a.message}`})}let i;try{i=JSON.parse(t)}catch(a){throw new l({cause:a,code:"STATE_FILE_CORRUPT",message:`Staged registry at ${r} is not valid JSON: ${a.message}. Remove the file or fix it manually.`})}if(i.version!==1)throw new l({code:"STATE_FILE_CORRUPT",message:`Staged registry at ${r} reports unknown version ${i.version}. Upgrade vis or remove the file.`});if(!Array.isArray(i.pending))throw new l({code:"STATE_FILE_CORRUPT",message:`Staged registry at ${r} is missing the "pending" array.`});return i},F=async(e,n,r)=>{const t=y(e,n);let i;try{const d=await h(t,"utf8");i=JSON.parse(d)}catch{i=void 0}const a=u(r.recentlyNotified),s=u(r.recentlyWalked),g={...r,recentlyNotified:a,recentlyWalked:s};if(g.pending.length===0&&a.length===0&&s.length===0){if(i===void 0)return{changed:!1,path:t,removed:!1};try{await v(t)}catch(d){if(d.code!=="ENOENT")throw d}return{changed:!0,path:t,removed:!0}}if(i&&A(i,g))return{changed:!1,path:t,removed:!1};await N(k(t),{recursive:!0});const m=`${JSON.stringify({...g,updatedAt:new Date().toISOString()},null,2)}
+`;return await R(t,m),{changed:!0,path:t,removed:!1}},W=(e,n,r=new Date().toISOString())=>{if(n.length===0)return e;const t=e.recentlyNotified??[],i=new Set(t.map(s=>s.key)),a=n.filter(s=>!i.has(s)).map(s=>({at:r,key:s}));return a.length===0?e:{...e,recentlyNotified:[...t,...a],updatedAt:r}},$=(e,n,r=new Date().toISOString())=>{if(n.length===0)return e;const t=e.recentlyWalked??[],i=new Set(t.map(s=>s.key)),a=n.filter(s=>!i.has(s)).map(s=>({at:r,key:s}));return a.length===0?e:{...e,recentlyWalked:[...t,...a],updatedAt:r}},q=(e,n)=>{if(n.length===0)return e;const r=new Map(e.pending.map(t=>[t.id,t]));for(const t of n)r.set(t.id,t);return{...e,pending:[...r.values()],updatedAt:new Date().toISOString()}},C=(e,n)=>{if(n.length===0||e.pending.length===0)return e;const r=new Set(n),t=e.pending.filter(i=>!r.has(i.id));return t.length===e.pending.length?e:{...e,pending:t,updatedAt:new Date().toISOString()}},b=(e,n)=>{if(e.pending.length===0||n.length===0)return[];const r=new Set(n);return e.pending.filter(t=>r.has(t.name))},f=(e,n)=>{const r=e??[],t=n??[];if(r.length!==t.length)return!1;if(r.length===0)return!0;const i=new Map(r.map(a=>[a.key,a]));for(const a of t)if(i.get(a.key)?.at!==a.at)return!1;return!0},A=(e,n)=>D(e.pending,n.pending)&&f(e.recentlyNotified,n.recentlyNotified)&&f(e.recentlyWalked,n.recentlyWalked),D=(e,n)=>{if(e.length!==n.length)return!1;if(e.length===0)return!0;const r=new Map(e.map(t=>[t.id,t]));for(const t of n){const i=r.get(t.id);if(!i||i.name!==t.name||i.version!==t.version||i.reason!==t.reason||(i.tag??"latest")!==(t.tag??"latest"))return!1}return!0};export{b as findConflictingPendingStages,D as pendingSetsEqual,u as pruneOldEntries,j as readStagedRegistry,W as recordRecentlyNotified,$ as recordRecentlyWalked,A as registryContentsEqual,C as removePendingStages,y as stagedRegistryPath,q as upsertPendingStages,F as writeStagedRegistry};

package/dist/packem_chunks/state.js

@@ -1,3 +1,3 @@
-import{createRequire as S}from"node:module";import{VisReleaseError as i}from"../packem_shared/VisReleaseError-DMGRBTNO.js";const E=S(import.meta.url),c=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,u=e=>{if(typeof c<"u"&&c.versions&&c.versions.node){const[t,a]=c.versions.node.split(".").map(Number);if(t>22||t===22&&a>=3||t===20&&a>=16)return c.getBuiltinModule(e)}return E(e)},{constants:d}=u("node:fs"),{mkdir:p,readFile:m,unlink:f,open:R,writeFile:O}=u("node:fs/promises"),{platform:$,hostname:w}=u("node:os"),{dirname:y,join:_}=u("node:path"),k=".state.json",v="publish-lock.json",l=(e,t,a=!1)=>_(e,t,a?v:k),P=async(e,t,a=!1)=>{try{const s=await m(l(e,t,a),"utf8"),o=JSON.parse(s);if(o.version!==1)throw new i({code:"STATE_FILE_CORRUPT",message:`Unknown state file version: ${o.version}. Delete ${l(e,t,a)} to start fresh.`});return o}catch(s){if(s.code==="ENOENT")return;throw s instanceof i?s:new i({cause:s,code:"STATE_FILE_CORRUPT",message:`Failed to read state file: ${s.message}`})}},b=async(e,t,a,s=!1)=>{const o=l(e,t,s);await p(y(o),{recursive:!0}),await O(o,`${JSON.stringify(a,null,2)}
-`)},C=async(e,t,a=!1)=>{try{await f(l(e,t,a))}catch(s){if(s.code!=="ENOENT")throw new i({cause:s,code:"STATE_FILE_CORRUPT",message:`Could not clear state file at ${l(e,t,a)}: ${s.message}. Remove it manually before the next run.`})}},I=(e,t)=>({applied:[],channel:e,notified:[],plan:[...t],published:[],pushed:!1,startedAt:new Date().toISOString(),tagged:[],version:1,walked:[]}),j=(e,t)=>{const a=new Set(t.published);return e.filter(s=>!a.has(`${s.name}@${s.newVersion}`))},F=3600*1e3,T=(e,t)=>_(e,t,".lock"),A=e=>{try{return process.kill(e,0),!0}catch{return!1}},q=async(e,t)=>{const a=T(e,t);await p(y(a),{recursive:!0});const s={acquiredAt:new Date().toISOString(),hostname:w(),pid:process.pid,platform:$()},o=`${JSON.stringify(s,null,2)}
-`,h=async()=>{try{const r=await R(a,d.O_WRONLY|d.O_CREAT|d.O_EXCL,384);try{await r.writeFile(o)}finally{await r.close()}return!0}catch(r){if(r.code==="EEXIST")return!1;throw r}};if(await h())return a;let n;try{n=JSON.parse(await m(a,"utf8"))}catch{}if(n){const r=Date.now()-new Date(n.acquiredAt).getTime();if((!n.hostname||n.hostname===w())&&A(n.pid)&&r<F){const g=n.hostname?`${n.hostname}:${n.pid}`:`PID ${n.pid}`;throw new i({code:"STATE_FILE_CORRUPT",message:`Release lock held by ${g} (acquired ${Math.round(r/1e3)}s ago). Wait for the other run, or remove ${a} if you're sure it's stale.`})}}try{await f(a)}catch{}if(await h())return a;throw new i({code:"STATE_FILE_CORRUPT",message:`Could not acquire release lock at ${a} after clearing a stale entry. Another process took it. Retry in a few seconds.`})},D=async(e,t)=>{try{await f(T(e,t))}catch{}};export{q as acquireLock,C as clearState,j as filterPlanByState,T as lockFilePath,I as newState,P as readState,D as releaseLock,l as stateFilePath,b as writeState};
+import{createRequire as S}from"node:module";import{VisReleaseError as i}from"../packem_shared/VisReleaseError-DMGRBTNO.js";let R;const E=e=>(R??=S(import.meta.url))(e),c=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,u=e=>{if(typeof c<"u"&&c.versions&&c.versions.node){const[t,a]=c.versions.node.split(".").map(Number);if(t>22||t===22&&a>=3||t===20&&a>=16)return c.getBuiltinModule(e)}return E(e)},{constants:d}=u("node:fs"),{mkdir:p,readFile:m,unlink:f,open:O,writeFile:$}=u("node:fs/promises"),{platform:k,hostname:w}=u("node:os"),{dirname:_,join:y}=u("node:path"),v=".state.json",F="publish-lock.json",l=(e,t,a=!1)=>y(e,t,a?F:v),b=async(e,t,a=!1)=>{try{const s=await m(l(e,t,a),"utf8"),n=JSON.parse(s);if(n.version!==1)throw new i({code:"STATE_FILE_CORRUPT",message:`Unknown state file version: ${n.version}. Delete ${l(e,t,a)} to start fresh.`});return n}catch(s){if(s.code==="ENOENT")return;throw s instanceof i?s:new i({cause:s,code:"STATE_FILE_CORRUPT",message:`Failed to read state file: ${s.message}`})}},j=async(e,t,a,s=!1)=>{const n=l(e,t,s);await p(_(n),{recursive:!0}),await $(n,`${JSON.stringify(a,null,2)}
+`)},q=async(e,t,a=!1)=>{try{await f(l(e,t,a))}catch(s){if(s.code!=="ENOENT")throw new i({cause:s,code:"STATE_FILE_CORRUPT",message:`Could not clear state file at ${l(e,t,a)}: ${s.message}. Remove it manually before the next run.`})}},C=(e,t)=>({applied:[],channel:e,notified:[],plan:[...t],published:[],pushed:!1,startedAt:new Date().toISOString(),tagged:[],version:1,walked:[]}),I=(e,t)=>{const a=new Set(t.published);return e.filter(s=>!a.has(`${s.name}@${s.newVersion}`))},A=3600*1e3,T=(e,t)=>y(e,t,".lock"),L=e=>{try{return process.kill(e,0),!0}catch{return!1}},D=async(e,t)=>{const a=T(e,t);await p(_(a),{recursive:!0});const s={acquiredAt:new Date().toISOString(),hostname:w(),pid:process.pid,platform:k()},n=`${JSON.stringify(s,null,2)}
+`,h=async()=>{try{const o=await O(a,d.O_WRONLY|d.O_CREAT|d.O_EXCL,384);try{await o.writeFile(n)}finally{await o.close()}return!0}catch(o){if(o.code==="EEXIST")return!1;throw o}};if(await h())return a;let r;try{r=JSON.parse(await m(a,"utf8"))}catch{}if(r){const o=Date.now()-new Date(r.acquiredAt).getTime();if((!r.hostname||r.hostname===w())&&L(r.pid)&&o<A){const g=r.hostname?`${r.hostname}:${r.pid}`:`PID ${r.pid}`;throw new i({code:"STATE_FILE_CORRUPT",message:`Release lock held by ${g} (acquired ${Math.round(o/1e3)}s ago). Wait for the other run, or remove ${a} if you're sure it's stale.`})}}try{await f(a)}catch{}if(await h())return a;throw new i({code:"STATE_FILE_CORRUPT",message:`Could not acquire release lock at ${a} after clearing a stale entry. Another process took it. Retry in a few seconds.`})},U=async(e,t)=>{try{await f(T(e,t))}catch{}};export{D as acquireLock,q as clearState,I as filterPlanByState,T as lockFilePath,C as newState,b as readState,U as releaseLock,l as stateFilePath,j as writeState};

package/dist/packem_chunks/status.js

@@ -1,2 +1,2 @@
-import{s as d,E as i,I as y}from"../packem_shared/index.server-qvZ-cy29.js";import{p as a}from"./cli-main.js";import{r as l,g as h}from"../packem_shared/advisories-B76fBVL-.js";const p=r=>{if(r===0)return"0 B";const n=["B","KB","MB","GB"],t=Math.min(Math.floor(Math.log(r)/Math.log(1024)),n.length-1),o=r/1024**t;return`${o.toFixed(o<10&&t>0?1:0)} ${n[t]}`},v=r=>{if(!r)return"never";const n=Date.parse(r);if(Number.isNaN(n))return r;const t=Date.now()-n;if(t<0)return r;const o=Math.floor(t/6e4);if(o<1)return"just now";if(o<60)return`${o}m ago`;const s=Math.floor(o/60);return s<24?`${s}h ago`:`${Math.floor(s/24)}d ago`},g=async({logger:r,options:n,workspaceRoot:t})=>{if(!t)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const o=n.db??l(t),s=await h(t,o);if(n.format==="json"){process.stdout.write(`${JSON.stringify({dbPath:o,ecosystems:s.ecosystems.map(e=>({advisoryCount:e.advisoryCount,lastSyncIso:e.lastSyncIso,manifestEtag:e.manifestEtag??null,name:e.name})),exists:s.exists,schemaVersion:s.schemaVersion,sizeBytes:s.sizeBytes},void 0,2)}
+import{s as d,E as i,I as y}from"../packem_shared/index.server-CusjRLCh.js";import{p as a}from"./cli-main.js";import{r as l,g as h}from"../packem_shared/advisories-CCBGdU8U.js";const p=r=>{if(r===0)return"0 B";const n=["B","KB","MB","GB"],t=Math.min(Math.floor(Math.log(r)/Math.log(1024)),n.length-1),o=r/1024**t;return`${o.toFixed(o<10&&t>0?1:0)} ${n[t]}`},v=r=>{if(!r)return"never";const n=Date.parse(r);if(Number.isNaN(n))return r;const t=Date.now()-n;if(t<0)return r;const o=Math.floor(t/6e4);if(o<1)return"just now";if(o<60)return`${o}m ago`;const s=Math.floor(o/60);return s<24?`${s}h ago`:`${Math.floor(s/24)}d ago`},g=async({logger:r,options:n,workspaceRoot:t})=>{if(!t)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const o=n.db??l(t),s=await h(t,o);if(n.format==="json"){process.stdout.write(`${JSON.stringify({dbPath:o,ecosystems:s.ecosystems.map(e=>({advisoryCount:e.advisoryCount,lastSyncIso:e.lastSyncIso,manifestEtag:e.manifestEtag??null,name:e.name})),exists:s.exists,schemaVersion:s.schemaVersion,sizeBytes:s.sizeBytes},void 0,2)}
 `);return}if(a.info(`DB: ${o}`),!s.exists){a.warn(`No advisory DB yet. Run ${d("vis advisories sync")} to populate.`);return}if(a.info(`Schema: v${s.schemaVersion}   Size: ${p(s.sizeBytes)}`),s.ecosystems.length===0){a.warn("DB exists but contains no ecosystems. Run `vis advisories sync`.");return}a.info(""),a.info("Ecosystem    Advisories   Last sync           ETag"),a.info(i("──────────   ──────────   ─────────────────   ──────"));for(const e of s.ecosystems){const c=e.name.padEnd(10),f=e.advisoryCount.toLocaleString().padStart(10),m=`${e.lastSyncIso||"never"} (${v(e.lastSyncIso)})`.padEnd(19),u=e.manifestEtag??i("—");a.info(`${y(c)}   ${f}   ${m}   ${u}`)}},S=g;export{S as advisoriesStatusExecute};

package/dist/packem_chunks/sync.js

@@ -1,2 +1,2 @@
-import{E as g}from"../packem_shared/index.server-qvZ-cy29.js";import{p as c}from"./cli-main.js";import{s as $}from"../packem_shared/scan-progress-DQ9qIGzr.js";import{s as w,D as v}from"../packem_shared/advisories-B76fBVL-.js";const S=t=>t?.security?.audit?.advisories??{},D=t=>t?t.split(",").map(r=>r.trim()).filter(r=>r.length>0):["npm"],b=async({logger:t,options:r,visConfig:h,workspaceRoot:d})=>{if(!d)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const l=r.format==="json",u=S(h),m=r.source??u.source??v,p=D(r.ecosystem),y=p.map(s=>({id:s,label:`Sync ${s} advisories`})),n=$(y,{live:!l}),i=[];try{for(const s of p){n.start(s);const o=Date.now();try{const e=await w({allowedHosts:u.allowedHosts,dbPath:r.db,ecosystem:s,force:!!r.force,source:m,workspaceRoot:d});i.push({ecosystem:s,result:e}),e.upToDate?n.finish(s,"ok",`up to date · ${f(Date.now()-o)}`):n.finish(s,"ok",`${e.advisoriesIngested.toLocaleString()} advisories · ${f(e.durationMs)}`)}catch(e){const a=e instanceof Error?e.message:String(e);i.push({ecosystem:s,error:a}),n.finish(s,"error",a)}}}finally{n.stop()}if(l){const s={ecosystems:i.map(o=>({advisoriesIngested:o.result?.advisoriesIngested??0,dbPath:o.result?.dbPath??null,durationMs:o.result?.durationMs??0,ecosystem:o.ecosystem,error:o.error??null,upToDate:o.result?.upToDate??!1})),source:m};process.stdout.write(`${JSON.stringify(s,void 0,2)}
+import{E as g}from"../packem_shared/index.server-CusjRLCh.js";import{p as c}from"./cli-main.js";import{s as $}from"../packem_shared/scan-progress-q-N2JtIp.js";import{s as w,D as v}from"../packem_shared/advisories-CCBGdU8U.js";const S=t=>t?.security?.audit?.advisories??{},D=t=>t?t.split(",").map(r=>r.trim()).filter(r=>r.length>0):["npm"],b=async({logger:t,options:r,visConfig:h,workspaceRoot:d})=>{if(!d)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const l=r.format==="json",u=S(h),m=r.source??u.source??v,p=D(r.ecosystem),y=p.map(s=>({id:s,label:`Sync ${s} advisories`})),n=$(y,{live:!l}),i=[];try{for(const s of p){n.start(s);const o=Date.now();try{const e=await w({allowedHosts:u.allowedHosts,dbPath:r.db,ecosystem:s,force:!!r.force,source:m,workspaceRoot:d});i.push({ecosystem:s,result:e}),e.upToDate?n.finish(s,"ok",`up to date · ${f(Date.now()-o)}`):n.finish(s,"ok",`${e.advisoriesIngested.toLocaleString()} advisories · ${f(e.durationMs)}`)}catch(e){const a=e instanceof Error?e.message:String(e);i.push({ecosystem:s,error:a}),n.finish(s,"error",a)}}}finally{n.stop()}if(l){const s={ecosystems:i.map(o=>({advisoriesIngested:o.result?.advisoriesIngested??0,dbPath:o.result?.dbPath??null,durationMs:o.result?.durationMs??0,ecosystem:o.ecosystem,error:o.error??null,upToDate:o.result?.upToDate??!1})),source:m};process.stdout.write(`${JSON.stringify(s,void 0,2)}
 `)}else{const s=i.filter(a=>a.error),o=i.filter(a=>a.result),e=o[0];e?.result?.dbPath&&c.info(g(`DB: ${e.result.dbPath}`)),s.length===0?c.success(`Synced ${o.length} ecosystem${o.length===1?"":"s"}.`):c.error(`${s.length} ecosystem${s.length===1?"":"s"} failed to sync.`)}i.some(s=>s.error)&&(process.exitCode=1)},f=t=>t>=1e3?`${(t/1e3).toFixed(1)}s`:`${Math.round(t)}ms`,R=b;export{R as advisoriesSyncExecute};

package/dist/packem_chunks/sync2.js

@@ -1,2 +1,2 @@
-import{p as e}from"./cli-main.js";import{A as u}from"../packem_shared/pm-runner-CfyxALPK.js";import{O as g}from"../packem_shared/native-config-sync-DDKjAy0i.js";import{S as l}from"../packem_shared/min-release-age-hK604veF.js";const y=new Set(["bun","npm","pnpm","yarn"]),k=({options:r,visConfig:c,workspaceRoot:f})=>{const s=f??process.cwd(),n=u(s);if(!y.has(n.name)){e.warn(`Package manager '${n.name}' has no native security config to sync.`);return}if(!c?.security){e.warn("vis.config has no `security` block — nothing to sync.");return}const t=c.security.policies??{},a=Object.fromEntries(Object.entries(t.installScripts?.allow??{}).filter(([,o])=>o)),m=t.firstSeen?.minutes,p=t.firstSeen?.exclude??[],i=[];if(Object.keys(a).length>0&&!r.skipAllowBuilds&&i.push(...g(n.name,s,a)),r.skipMinReleaseAge||i.push(...l(n.name,s,m,p)),i.length===0){e.success("Nothing to sync — vis.config and native PM config are aligned.");return}e.info(`Syncing vis.config security settings to ${n.name} native config…
+import{p as e}from"./cli-main.js";import{A as u}from"../packem_shared/pm-runner-C6eTANt1.js";import{O as g}from"../packem_shared/native-config-sync-Ds1FtcrM.js";import{S as l}from"../packem_shared/min-release-age-OaYpLwux.js";const y=new Set(["bun","npm","pnpm","yarn"]),k=({options:r,visConfig:c,workspaceRoot:f})=>{const s=f??process.cwd(),n=u(s);if(!y.has(n.name)){e.warn(`Package manager '${n.name}' has no native security config to sync.`);return}if(!c?.security){e.warn("vis.config has no `security` block — nothing to sync.");return}const t=c.security.policies??{},a=Object.fromEntries(Object.entries(t.installScripts?.allow??{}).filter(([,o])=>o)),m=t.firstSeen?.minutes,p=t.firstSeen?.exclude??[],i=[];if(Object.keys(a).length>0&&!r.skipAllowBuilds&&i.push(...g(n.name,s,a)),r.skipMinReleaseAge||i.push(...l(n.name,s,m,p)),i.length===0){e.success("Nothing to sync — vis.config and native PM config are aligned.");return}e.info(`Syncing vis.config security settings to ${n.name} native config…
 `);for(const o of i)e.success(`  ${o}`)};export{k as default};