@visulima/vis 3.0.0 → 3.0.1

package/dist/packem_chunks/publish-guards.js

@@ -1 +1 @@
-import{createRequire as _}from"node:module";let v;const j=t=>(v??=_(import.meta.url))(t),d=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,g=t=>{if(typeof d<"u"&&d.versions&&d.versions.node){const[e,s]=d.versions.node.split(".").map(Number);if(e>22||e===22&&s>=3||e===20&&s>=16)return d.getBuiltinModule(t)}return j(t)},{createHash:S}=g("node:crypto"),{createReadStream:P}=g("node:fs"),{lstat:A,realpath:D,stat:R}=g("node:fs/promises"),{resolve:h,isAbsolute:E,join:x,sep:k}=g("node:path"),m=(t,e)=>{const s=h(t),i=h(e),r=s.endsWith(k)?s:`${s}${k}`;return i===s||i.startsWith(r)},G=t=>{const e=Array.isArray(t)?t[0]:t;if(e===null||typeof e!="object")return;const{files:s}=e;if(!Array.isArray(s))return;const i=[];for(const r of s)r&&typeof r.path=="string"&&i.push(r.path);return i},T=["**/*.test.*","**/__tests__/**","**/__fixtures__/**"],q=async t=>{const e=[];let s;try{({scanFiles:s}=await import("@visulima/secret-scanner"))}catch{return{findings:[{hint:"pnpm add -D @visulima/secret-scanner, or set publish.guards.packSecretScan: false.",id:"packSecretScan:dep-missing",message:"publish.guards.packSecretScan is enabled but @visulima/secret-scanner is not installed."}],gate:"packSecretScan",passed:!1}}const i=[];for(const a of t.files){const o=E(a)?a:x(t.pkgDir,a);m(t.pkgDir,o)&&i.push(o)}const r=t.ignore??T,n=await s(i,{walk:{excludePatterns:[...r]}});for(const a of n)e.push({hint:"Add the file to .npmignore / package.json#files, or rotate the credential.",id:`packSecretScan:${a.ruleId}:${a.file}`,message:`${a.ruleId} match in ${a.file} (line ${a.startLine}, ${a.confidence} confidence).`});return{findings:e,gate:"packSecretScan",passed:e.length===0}},F=t=>typeof t=="string",y=(t,e,s)=>{if(t!==null){if(F(t)){s.push({keyPath:e,target:t});return}if(Array.isArray(t)){for(const[i,r]of t.entries())y(r,`${e}[${i}]`,s);return}if(typeof t=="object")for(const[i,r]of Object.entries(t))y(r,e===""?i:`${e}.${i}`,s)}},L=async(t,e)=>{if(!e.startsWith("./"))return!0;const s=e.replace(/^\.\//,""),i=s.includes("*"),r=i?s.split("*",1)[0].replace(/\/$/,""):s,n=x(t,r);if(!m(t,n))return!1;try{const a=await A(n);if(a.isSymbolicLink()){const o=await D(n);if(!m(t,o))return!1;const c=await R(o);return i?c.isDirectory():!0}return i?a.isDirectory():!0}catch{return!1}},M=async(t,e)=>{const s=[],i=[];for(const r of["main","module","types","typings","browser"]){const n=e[r];typeof n=="string"&&i.push({keyPath:r,target:n})}if(typeof e.bin=="string")i.push({keyPath:"bin",target:e.bin});else if(e.bin&&typeof e.bin=="object")for(const[r,n]of Object.entries(e.bin))typeof n=="string"&&i.push({keyPath:`bin.${r}`,target:n});e.exports!==void 0&&y(e.exports,"exports",i);for(const{keyPath:r,target:n}of i)await L(t,n)||s.push({hint:"Run the build before publishing, or remove the dangling export.",id:`exportsExist:${r}:${n}`,message:`Manifest field \`${r}\` points at \`${n}\` which does not exist in the pack root.`});return{findings:s,gate:"exportsExist",passed:s.length===0}},O=["preinstall","install","postinstall"],N=t=>t===void 0||t==="off"?{allow:{},mode:"off"}:typeof t=="string"?{allow:{},mode:t}:{allow:t.allow??{},mode:t.mode},W=(t,e)=>{const s=[],i=N(e);if(i.mode==="off")return{findings:s,gate:"lifecycleScripts",passed:!0};const r=t.scripts??{};for(const n of O){const a=r[n];a===void 0||i.allow[n]===a||s.push({hint:`Add to publish.guards.lifecycleScripts.allow.${n}, or set the gate to "warn"/"off".`,id:`lifecycleScripts:${n}`,message:`Lifecycle script \`${n}\` is set to \`${a}\` but is not in the allow-list.`})}return{findings:s,gate:"lifecycleScripts",passed:s.length===0}},w={critical:4,high:3,low:1,moderate:2},$=9e4,B=async(t,e,s)=>{const i=[];if(s===void 0||s==="off")return{findings:i,gate:"audit",passed:!0};const r=w[s]??4,n=Symbol("audit-timeout");let a;const o=new Promise(u=>{a=setTimeout(u,$,n)});let c;try{const u=await Promise.race([e.run("npm",["audit","--omit=dev","--json"],{cwd:t,silent:!0}),o]);if(u===n)return{findings:[{hint:'Network or registry outage — re-run later, or set publish.guards.audit: "off".',id:"audit:timeout",message:`\`npm audit\` exceeded ${$}ms and was aborted.`}],gate:"audit",passed:!1};c=u}finally{a&&clearTimeout(a)}let p;try{p=JSON.parse(c.stdout)}catch{return{findings:[{hint:c.stderr.trim()||"Re-run npm audit manually to inspect.",id:"audit:parse",message:`Could not parse \`npm audit\` output for ${t}.`}],gate:"audit",passed:!1}}const l=p.metadata?.vulnerabilities??{};for(const[u,f]of Object.entries(l)){if(f<=0)continue;const b=w[u];b!==void 0&&b>=r&&i.push({hint:"npm audit fix --omit=dev, or raise the threshold via publish.guards.audit.",id:`audit:${u}`,message:`${f} runtime ${u}-severity advisory(s) reported by npm audit.`})}return{findings:i,gate:"audit",passed:i.length===0}},I=async t=>{const e=h(t),s=S("sha256"),i=S("sha512");let r=0;return await new Promise((n,a)=>{const o=P(e);o.on("data",c=>{s.update(c),i.update(c),r+=c.length}),o.on("end",()=>{n()}),o.on("error",a)}),{path:e,sha256:s.digest("hex"),sha512:i.digest("hex"),size:r}},z=async t=>{const e=t.config??{},s=[],i=(l,u)=>u.catch(f=>({findings:[{hint:"Re-run with --debug to capture the stack, or disable this gate.",id:`${l}:internal-error`,message:`Guard "${l}" threw: ${f instanceof Error?f.message:String(f)}`}],gate:l,passed:!1}));if(e.packSecretScan){const l=typeof e.packSecretScan=="object"?e.packSecretScan.ignore:void 0;s.push(i("packSecretScan",q({files:t.packFiles,ignore:l,pkgDir:t.pkgDir})))}e.exportsExist&&s.push(i("exportsExist",M(t.pkgDir,t.manifest))),e.audit&&e.audit!=="off"&&s.push(i("audit",B(t.pkgDir,t.runner,e.audit)));const r=await Promise.all(s),n=W(t.sourceManifest??t.manifest,e.lifecycleScripts),a=[...r];n.gate&&e.lifecycleScripts!==void 0&&e.lifecycleScripts!=="off"&&a.push(n);const o=typeof e.lifecycleScripts=="string"?e.lifecycleScripts:e.lifecycleScripts?.mode??"off",c=[],p=[];for(const l of a)l.passed||(l.gate==="lifecycleScripts"&&o==="warn"?p.push(l):c.push(l));return{blockers:c,results:a,warnings:p}};export{G as extractPackFilesFromRaw,I as hashTarball,M as runExportsExist,W as runLifecycleScripts,q as runPackSecretScan,z as runPublishGuards,B as runRuntimeAudit};
+import{createRequire as _}from"node:module";let E;const x=e=>(E??=_(import.meta.url))(e),p=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,h=e=>{if(typeof p<"u"&&p.versions&&p.versions.node){const[t,s]=p.versions.node.split(".").map(Number);if(t>22||t===22&&s>=3||t===20&&s>=16)return p.getBuiltinModule(e)}return x(e)},{createHash:b}=h("node:crypto"),{createReadStream:j}=h("node:fs"),{lstat:R,realpath:T,stat:A}=h("node:fs/promises"),{resolve:g,isAbsolute:P,join:v,sep:w}=h("node:path"),y=(e,t)=>{const s=g(e),i=g(t),r=s.endsWith(w)?s:`${s}${w}`;return i===s||i.startsWith(r)},G=e=>{const t=Array.isArray(e)?e[0]:e;if(t===null||typeof t!="object")return;const{files:s}=t;if(!Array.isArray(s))return;const i=[];for(const r of s)r&&typeof r.path=="string"&&i.push(r.path);return i},L=["**/*.test.*","**/__tests__/**","**/__fixtures__/**"],D=async e=>{const t=[];let s;try{({scanFiles:s}=await import("@visulima/secret-scanner"))}catch{return{findings:[{hint:"pnpm add -D @visulima/secret-scanner, or set publish.guards.packSecretScan: false.",id:"packSecretScan:dep-missing",message:"publish.guards.packSecretScan is enabled but @visulima/secret-scanner is not installed."}],gate:"packSecretScan",passed:!1}}const i=[];for(const o of e.files){const a=P(o)?o:v(e.pkgDir,o);y(e.pkgDir,a)&&i.push(a)}const r=e.ignore??L,n=await s(i,{walk:{excludePatterns:[...r]}});for(const o of n)t.push({hint:"Add the file to .npmignore / package.json#files, or rotate the credential.",id:`packSecretScan:${o.ruleId}:${o.file}`,message:`${o.ruleId} match in ${o.file} (line ${o.startLine}, ${o.confidence} confidence).`});return{findings:t,gate:"packSecretScan",passed:t.length===0}},I=e=>typeof e=="string",m=(e,t,s)=>{if(e!==null){if(I(e)){s.push({keyPath:t,target:e});return}if(Array.isArray(e)){for(const[i,r]of e.entries())m(r,`${t}[${i}]`,s);return}if(typeof e=="object")for(const[i,r]of Object.entries(e))m(r,t===""?i:`${t}.${i}`,s)}},M=async(e,t)=>{if(!t.startsWith("./"))return!0;const s=t.replace(/^\.\//,""),i=s.includes("*"),r=i?s.split("*",1)[0].replace(/\/$/,""):s,n=v(e,r);if(!y(e,n))return!1;try{const o=await R(n);if(o.isSymbolicLink()){const a=await T(n);if(!y(e,a))return!1;const c=await A(a);return i?c.isDirectory():!0}return i?o.isDirectory():!0}catch{return!1}},O=async(e,t)=>{const s=[],i=[];for(const r of["main","module","types","typings","browser"]){const n=t[r];typeof n=="string"&&i.push({keyPath:r,target:n})}if(typeof t.bin=="string")i.push({keyPath:"bin",target:t.bin});else if(t.bin&&typeof t.bin=="object")for(const[r,n]of Object.entries(t.bin))typeof n=="string"&&i.push({keyPath:`bin.${r}`,target:n});t.exports!==void 0&&m(t.exports,"exports",i);for(const{keyPath:r,target:n}of i)await M(e,n)||s.push({hint:"Run the build before publishing, or remove the dangling export.",id:`exportsExist:${r}:${n}`,message:`Manifest field \`${r}\` points at \`${n}\` which does not exist in the pack root.`});return{findings:s,gate:"exportsExist",passed:s.length===0}},F=["preinstall","install","postinstall"],C=e=>e===void 0||e==="off"?{allow:{},mode:"off"}:typeof e=="string"?{allow:{},mode:e}:{allow:e.allow??{},mode:e.mode},N=(e,t)=>{const s=[],i=C(t);if(i.mode==="off")return{findings:s,gate:"lifecycleScripts",passed:!0};const r=e.scripts??{};for(const n of F){const o=r[n];o===void 0||i.allow[n]===o||s.push({hint:`Add to publish.guards.lifecycleScripts.allow.${n}, or set the gate to "warn"/"off".`,id:`lifecycleScripts:${n}`,message:`Lifecycle script \`${n}\` is set to \`${o}\` but is not in the allow-list.`})}return{findings:s,gate:"lifecycleScripts",passed:s.length===0}},$={critical:4,high:3,low:1,moderate:2},k=9e4,W=async(e,t,s)=>{const i=[];if(s===void 0||s==="off")return{findings:i,gate:"audit",passed:!0};const r=$[s]??4,n=Symbol("audit-timeout");let o;const a=new Promise(u=>{o=setTimeout(u,k,n)});let c;try{const u=await Promise.race([t.run("npm",["audit","--omit=dev","--json"],{cwd:e,silent:!0}),a]);if(u===n)return{findings:[{hint:'Network or registry outage — re-run later, or set publish.guards.audit: "off".',id:"audit:timeout",message:`\`npm audit\` exceeded ${k}ms and was aborted.`}],gate:"audit",passed:!1};c=u}finally{o&&clearTimeout(o)}let d;try{d=JSON.parse(c.stdout)}catch{return{findings:[{hint:c.stderr.trim()||"Re-run npm audit manually to inspect.",id:"audit:parse",message:`Could not parse \`npm audit\` output for ${e}.`}],gate:"audit",passed:!1}}const l=d.metadata?.vulnerabilities??{};for(const[u,f]of Object.entries(l)){if(f<=0)continue;const S=$[u];S!==void 0&&S>=r&&i.push({hint:"npm audit fix --omit=dev, or raise the threshold via publish.guards.audit.",id:`audit:${u}`,message:`${f} runtime ${u}-severity advisory(s) reported by npm audit.`})}return{findings:i,gate:"audit",passed:i.length===0}},U=async e=>{const t=g(e),s=b("sha256"),i=b("sha512");let r=0;return await new Promise((n,o)=>{const a=j(t);a.on("data",c=>{s.update(c),i.update(c),r+=c.length}),a.on("end",()=>{n()}),a.on("error",o)}),{path:t,sha256:s.digest("hex"),sha512:i.digest("hex"),size:r}},Y=async e=>{const t=e.config??{},s=[],i=(l,u)=>u.catch(f=>({findings:[{hint:"Re-run with --debug to capture the stack, or disable this gate.",id:`${l}:internal-error`,message:`Guard "${l}" threw: ${f instanceof Error?f.message:String(f)}`}],gate:l,passed:!1}));if(t.packSecretScan){const l=typeof t.packSecretScan=="object"?t.packSecretScan.ignore:void 0;s.push(i("packSecretScan",D({files:e.packFiles,ignore:l,pkgDir:e.pkgDir})))}t.exportsExist&&s.push(i("exportsExist",O(e.pkgDir,e.manifest))),t.audit&&t.audit!=="off"&&s.push(i("audit",W(e.pkgDir,e.runner,t.audit)));const r=await Promise.all(s),n=N(e.sourceManifest??e.manifest,t.lifecycleScripts),o=[...r];n.gate&&t.lifecycleScripts!==void 0&&t.lifecycleScripts!=="off"&&o.push(n);const a=typeof t.lifecycleScripts=="string"?t.lifecycleScripts:t.lifecycleScripts?.mode??"off",c=[],d=[];for(const l of o)l.passed||(l.gate==="lifecycleScripts"&&a==="warn"?d.push(l):c.push(l));return{blockers:c,results:o,warnings:d}};export{G as extractPackFilesFromRaw,U as hashTarball,O as runExportsExist,N as runLifecycleScripts,D as runPackSecretScan,Y as runPublishGuards,W as runRuntimeAudit};

package/dist/packem_chunks/resolveFormatter.js

@@ -1,9 +1,9 @@
-import{createRequire as _}from"node:module";import{createShellRunner as S}from"./shell-runner.js";let V;const j=e=>(V??=_(import.meta.url))(e),y=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,k=e=>{if(typeof y<"u"&&y.versions&&y.versions.node){const[n,s]=y.versions.node.split(".").map(Number);if(n>22||n===22&&s>=3||n===20&&s>=16)return y.getBuiltinModule(e)}return j(e)},{pathToFileURL:G}=k("node:url"),W=[{section:"Breaking Changes",type:"breaking"},{section:"Features",type:"feat"},{section:"Bug Fixes",type:"fix"},{section:"Performance Improvements",type:"perf"},{section:"Reverts",type:"revert"},{section:"Documentation",type:"docs"},{hidden:!0,section:"Styles",type:"style"},{hidden:!0,section:"Code Refactoring",type:"refactor"},{hidden:!0,section:"Tests",type:"test"},{hidden:!0,section:"Build System",type:"build"},{hidden:!0,section:"Continuous Integration",type:"ci"},{hidden:!0,section:"Miscellaneous Chores",type:"chore"}],E=/^(?<type>[a-z]+)(?:\([^)]+\))?!?:\s+/,D=/^(?:[\p{Emoji_Presentation}\p{Extended_Pictographic}]|:\w+:)\s+/u,P=e=>{const n=e.replace(D,""),s=E.exec(n);if(s?.groups?.type)return n.includes("!:")&&n.split("!:")[0]?.match(/^[a-z]+(?:\([^)]+\))?$/)?"breaking":s.groups.type},T=e=>`(${e.startsWith("@")?e:`@${e}`})`,z=(e,n)=>{for(const s of n){const o=s.line.startsWith("-")||s.line.startsWith("*")?s.line:`- ${s.line}`;e.push(`${o}${s.suffix}`)}},L=(e,n,s)=>{const o=new Map;for(const t of n){const c=t.type??"other",i=o.get(c)??[];i.push({line:t.line,suffix:t.suffix}),o.set(c,i)}for(const t of s){const c=o.get(t.type);if(t.hidden){o.delete(t.type);continue}if(!(!c||c.length===0)){e.push(`### ${t.section}`),e.push("");for(const i of c){const u=i.line.startsWith("-")||i.line.startsWith("*")?i.line:`- ${i.line}`;e.push(`${u}${i.suffix}`)}e.push(""),o.delete(t.type)}}if(!s.some(t=>t.type==="other"&&t.hidden)&&o.size>0){e.push("### Miscellaneous"),e.push("");for(const t of o.values())for(const c of t){const i=c.line.startsWith("-")||c.line.startsWith("*")?c.line:`- ${c.line}`;e.push(`${i}${c.suffix}`)}}},B=(e={})=>n=>{const{changeFiles:s,date:o,release:t,target:c}=n,i=[];c!=="github-release"&&(i.push(`## ${t.newVersion}`),i.push(`<sub>${o}</sub>`),i.push(""));const u=[];for(const r of s){const a=r.body.trim();if(!a)continue;const p=e.authorCredit?r.meta?.author:void 0,h=p?` ${T(p)}`:"";for(const d of a.split(/\r?\n/)){const m=d.trim();m&&u.push({line:m,suffix:h,type:P(m)})}}const f=e.sections===void 0?void 0:e.sections.length===0?W:e.sections;if(f?L(i,u,f):z(i,u),t.isCascadeBump||t.isGroupBump)for(const r of t.sources){const a=t.isCascadeBump?"Cascade from":"Group bump with";i.push(`- ${a} ${r.name}@${r.newVersion}`)}else if(t.isDependencyBump&&s.length===0)for(const r of t.sources)r.newVersion===""?i.push(`- Removed dependency ${r.name}`):i.push(`- Updated dependency ${r.name}@${r.newVersion}`);return i.join(`
+import{createRequire as k}from"node:module";import{createShellRunner as G}from"./shell-runner.js";let B;const S=e=>(B??=k(import.meta.url))(e),g=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,T=e=>{if(typeof g<"u"&&g.versions&&g.versions.node){const[n,t]=g.versions.node.split(".").map(Number);if(n>22||n===22&&t>=3||n===20&&t>=16)return g.getBuiltinModule(e)}return S(e)},{pathToFileURL:I}=T("node:url"),P=[{section:"Breaking Changes",type:"breaking"},{section:"Features",type:"feat"},{section:"Bug Fixes",type:"fix"},{section:"Performance Improvements",type:"perf"},{section:"Reverts",type:"revert"},{section:"Documentation",type:"docs"},{hidden:!0,section:"Styles",type:"style"},{hidden:!0,section:"Code Refactoring",type:"refactor"},{hidden:!0,section:"Tests",type:"test"},{hidden:!0,section:"Build System",type:"build"},{hidden:!0,section:"Continuous Integration",type:"ci"},{hidden:!0,section:"Miscellaneous Chores",type:"chore"}],V=/^(?<type>[a-z]+)(?:\([^)]+\))?!?:\s+/,j=/^(?:[\p{Emoji_Presentation}\p{Extended_Pictographic}]|:\w+:)\s+/u,L=e=>{const n=e.replace(j,""),t=V.exec(n);if(t?.groups?.type)return n.includes("!:")&&n.split("!:")[0]?.match(/^[a-z]+(?:\([^)]+\))?$/)?"breaking":t.groups.type},D=e=>`(${e.startsWith("@")?e:`@${e}`})`,N=(e,n)=>{for(const t of n){const o=t.line.startsWith("-")||t.line.startsWith("*")?t.line:`- ${t.line}`;e.push(`${o}${t.suffix}`)}},W=(e,n,t)=>{const o=new Map;for(const c of n){const r=c.type??"other",u=o.get(r)??[];u.push({line:c.line,suffix:c.suffix}),o.set(r,u)}for(const c of t){const r=o.get(c.type);if(c.hidden){o.delete(c.type);continue}if(!(!r||r.length===0)){e.push(`### ${c.section}`),e.push("");for(const u of r){const d=u.line.startsWith("-")||u.line.startsWith("*")?u.line:`- ${u.line}`;e.push(`${d}${u.suffix}`)}e.push(""),o.delete(c.type)}}if(!t.some(c=>c.type==="other"&&c.hidden)&&o.size>0){e.push("### Miscellaneous"),e.push("");for(const c of o.values())for(const r of c){const u=r.line.startsWith("-")||r.line.startsWith("*")?r.line:`- ${r.line}`;e.push(`${u}${r.suffix}`)}}},E=(e={})=>n=>{const{changeFiles:t,date:o,release:s,target:c}=n,r=[];c!=="github-release"&&(r.push(`## ${s.newVersion}`),r.push(`<sub>${o}</sub>`),r.push(""));const u=[];for(const a of t){const i=a.body.trim();if(!i)continue;const f=e.authorCredit?a.meta?.author:void 0,h=f?` ${D(f)}`:"";for(const m of i.split(/\r?\n/)){const p=m.trim();p&&u.push({line:p,suffix:h,type:L(p)})}}const d=e.sections===void 0?void 0:e.sections.length===0?P:e.sections;if(d?W(r,u,d):N(r,u),s.isCascadeBump||s.isGroupBump)for(const a of s.sources){const i=s.isCascadeBump?"Cascade from":"Group bump with";r.push(`- ${i} ${a.name}@${a.newVersion}`)}else if(s.isDependencyBump&&t.length===0)for(const a of s.sources)a.newVersion===""?r.push(`- Removed dependency ${a.name}`):r.push(`- Updated dependency ${a.name}@${a.newVersion}`);return r.join(`
 `).replaceAll(/\n{3,}/g,`
 
-`).trim()},N=B(),I={includeCommitLink:!0,internalAuthors:[],thankContributors:!0},M=async(e,n,s)=>{if(e)return e;const{createRemoteClient:o,detectRemoteProvider:t}=await import("./detect2.js"),c=await t(s,n,void 0);return o(c).detectRepoSlug(s,n)},U=async(e,n,s)=>{const o=await e.run("git",["log","--diff-filter=A","--pretty=format:%aN%n%aE","--",s],{cwd:n,silent:!0});return o.exitCode!==0?void 0:o.stdout.split(`
-`)[0]?.trim()||void 0},q=(e,n)=>n?e.replaceAll(/(?<!\[)#(\d+)/g,(s,o)=>`[#${o}](https://github.com/${n}/issues/${o})`):e,x=(e={})=>{const n={...I,...e},s=e.runner??S();let o;return async t=>{const{changeFiles:c,date:i,release:u,target:f}=t,r=[],a=new Set,p=process.cwd();o||(o=M(e.repo,s,p));const h=await o;f!=="github-release"&&(r.push(`## ${u.newVersion}`),r.push(`<sub>${i}</sub>`),r.push(""));for(const d of c){const m=d.body.trim(),l=d.meta??{},$=l.author??await U(s,p,d.path);$&&n.thankContributors&&!n.internalAuthors.includes($.replace(/^@/,""))&&a.add($.startsWith("@")?$:`@${$}`);const g=[];if(l.pr&&h?g.push(`[#${l.pr}](https://github.com/${h}/pull/${l.pr})`):l.pr&&g.push(`#${l.pr}`),l.commit&&n.includeCommitLink&&h){const b=l.commit.slice(0,7);g.push(`[\`${b}\`](https://github.com/${h}/commit/${l.commit})`)}const w=g.length>0?` (${g.join(", ")})`:"";if(m)for(const b of m.split(/\r?\n/)){const C=b.trim();if(!C)continue;const v=q(C,h);C.startsWith("-")||C.startsWith("*")?r.push(`${v}${w}`):r.push(`- ${v}${w}`)}}if(u.isCascadeBump||u.isGroupBump)for(const d of u.sources){const m=u.isCascadeBump?"Cascade from":"Group bump with";r.push(`- ${m} ${d.name}@${d.newVersion}`)}else if(u.isDependencyBump&&c.length===0)for(const d of u.sources)d.newVersion===""?r.push(`- Removed dependency ${d.name}`):r.push(`- Updated dependency ${d.name}@${d.newVersion}`);return n.thankContributors&&a.size>0&&(r.push(""),r.push(`Thanks ${[...a].join(", ")}!`)),r.join(`
-`)}},F=["Added","Changed","Deprecated","Removed","Fixed","Security"],K=e=>{const n=e.toLowerCase();return F.find(s=>s.toLowerCase()===n)},H={add:"Added",bugfix:"Fixed",change:"Changed",changed:"Changed",chore:"Changed",deprecate:"Deprecated",deprecated:"Deprecated",feat:"Added",feature:"Added",fix:"Fixed",perf:"Changed",refactor:"Changed",remove:"Removed",removed:"Removed",sec:"Security",security:"Security"},J=/^\s*\[(added|changed|deprecated|removed|fixed|security)\]\s*:?\s*(.*)$/i,O=e=>e.replace(/^[-*]\s+/,"").trim(),Q=e=>{const n=/^([a-z]+)(?:\([^)]+\))?!?\s*:\s*(.*)$/i.exec(e.trim());if(!n)return;const s=n[1].toLowerCase(),o=H[s];if(o)return{rest:n[2].trim(),section:o}},X=e=>e==="major"?"Changed":e==="minor"?"Added":"Fixed",A=(e,n)=>/\bBREAKING(?:\s+CHANGE)?\b/.test(e)||/^\s*[a-z]+(?:\([^)]+\))?!\s*:/i.test(e)||n==="major",Y=(e,n,s,o)=>{const t=O(e);if(!t)return;const c=J.exec(t);if(c){const u=K(c[1]);if(u){s[u].push(`- ${c[2].trim()}`);return}}const i=Q(t);if(i){A(t,n)&&o.push(`- ${i.rest||t}`),s[i.section].push(`- ${i.rest||t}`);return}A(t,n)&&o.push(`- ${t}`),s[X(n)].push(`- ${t}`)},Z=(e,n,s,o,t)=>{if(n)return`${n}/compare/${o}...${t}`;if(e)return`https://github.com/${e}/compare/${o}...${t}`},R=(e={})=>n=>{const{changeFiles:s,date:o,release:t,target:c}=n,i={Added:[],Changed:[],Deprecated:[],Fixed:[],Removed:[],Security:[]},u=[],f=t.type;for(const a of s)for(const p of a.body.trim().split(/\r?\n/))p.trim()&&Y(p,f,i,u);if(t.isCascadeBump||t.isGroupBump)for(const a of t.sources){const p=t.isCascadeBump?"Cascade from":"Group bump with";i.Changed.push(`- ${p} \`${a.name}\`@${a.newVersion}`)}else if(t.isDependencyBump&&s.length===0)for(const a of t.sources)a.newVersion===""?i.Removed.push(`- Removed dependency \`${a.name}\``):i.Changed.push(`- Updated dependency \`${a.name}\`@${a.newVersion}`);const r=[];if(c!=="github-release"&&(r.push(`## [${t.newVersion}] - ${o}`),r.push("")),u.length>0){r.push("### ⚠ BREAKING CHANGES"),r.push("");for(const a of u)r.push(a);r.push("")}for(const a of F){const p=i[a];if(p.length!==0){r.push(`### ${a}`),r.push("");for(const h of p)r.push(h);r.push("")}}if(c!=="github-release"){const a=`${t.name}@${t.oldVersion}`,p=`${t.name}@${t.newVersion}`,h=Z(e.repo,e.compareUrlPrefix,t.name,a,p);h&&r.push(`[${t.newVersion}]: ${h}`)}return r.join(`
+`).trim()},M=E(),O={includeCommitLink:!0,internalAuthors:[],thankContributors:!0},z=async(e,n,t)=>{if(e)return e;const{createRemoteClient:o,detectRemoteProvider:s}=await import("./detect.js"),c=await s(t,n,void 0);return o(c).detectRepoSlug(t,n)},U=async(e,n,t)=>{const o=await e.run("git",["log","--diff-filter=A","--pretty=format:%aN%n%aE","--",t],{cwd:n,silent:!0});return o.exitCode!==0?void 0:o.stdout.split(`
+`)[0]?.trim()||void 0},H=(e,n)=>n?e.replaceAll(/(?<!\[)#(\d+)/g,(t,o)=>`[#${o}](https://github.com/${n}/issues/${o})`):e,x=(e={})=>{const n={...O,...e},t=e.runner??G();let o;return async c=>{const{changeFiles:r,date:u,release:d,target:a}=c,i=[],f=new Set,h=process.cwd();o||(o=z(e.repo,t,h));const m=await o;a!=="github-release"&&(i.push(`## ${d.newVersion}`),i.push(`<sub>${u}</sub>`),i.push(""));for(const p of r){const C=p.body.trim(),l=p.meta??{},$=l.author??await U(t,h,p.path);$&&n.thankContributors&&!n.internalAuthors.includes($.replace(/^@/,""))&&f.add($.startsWith("@")?$:`@${$}`);const y=[];if(l.pr&&m?y.push(`[#${l.pr}](https://github.com/${m}/pull/${l.pr})`):l.pr&&y.push(`#${l.pr}`),l.commit&&n.includeCommitLink&&m){const v=l.commit.slice(0,7);y.push(`[\`${v}\`](https://github.com/${m}/commit/${l.commit})`)}const w=y.length>0?` (${y.join(", ")})`:"";if(C)for(const v of C.split(/\r?\n/)){const b=v.trim();if(!b)continue;const _=H(b,m);b.startsWith("-")||b.startsWith("*")?i.push(`${_}${w}`):i.push(`- ${_}${w}`)}}if(d.isCascadeBump||d.isGroupBump)for(const p of d.sources){const C=d.isCascadeBump?"Cascade from":"Group bump with";i.push(`- ${C} ${p.name}@${p.newVersion}`)}else if(d.isDependencyBump&&r.length===0)for(const p of d.sources)p.newVersion===""?i.push(`- Removed dependency ${p.name}`):i.push(`- Updated dependency ${p.name}@${p.newVersion}`);return n.thankContributors&&f.size>0&&(i.push(""),i.push(`Thanks ${[...f].join(", ")}!`)),i.join(`
+`)}},F=["Added","Changed","Deprecated","Removed","Fixed","Security"],X=e=>{const n=e.toLowerCase();return F.find(t=>t.toLowerCase()===n)},q={add:"Added",bugfix:"Fixed",change:"Changed",changed:"Changed",chore:"Changed",deprecate:"Deprecated",deprecated:"Deprecated",feat:"Added",feature:"Added",fix:"Fixed",perf:"Changed",refactor:"Changed",remove:"Removed",removed:"Removed",sec:"Security",security:"Security"},K=/^\s*\[(added|changed|deprecated|removed|fixed|security)\]\s*:?\s*(.*)$/i,J=e=>e.replace(/^[-*]\s+/,"").trim(),Y=e=>{const n=/^([a-z]+)(?:\([^)]+\))?!?\s*:\s*(.*)$/i.exec(e.trim());if(!n)return;const t=n[1].toLowerCase(),o=q[t];if(o)return{rest:n[2].trim(),section:o}},Q=e=>e==="major"?"Changed":e==="minor"?"Added":"Fixed",R=(e,n)=>/\bBREAKING(?:\s+CHANGE)?\b/.test(e)||/^\s*[a-z]+(?:\([^)]+\))?!\s*:/i.test(e)||n==="major",Z=(e,n,t,o)=>{const s=J(e);if(!s)return;const c=K.exec(s);if(c){const u=X(c[1]);if(u){t[u].push(`- ${c[2].trim()}`);return}}const r=Y(s);if(r){R(s,n)&&o.push(`- ${r.rest||s}`),t[r.section].push(`- ${r.rest||s}`);return}R(s,n)&&o.push(`- ${s}`),t[Q(n)].push(`- ${s}`)},ee=(e,n,t,o,s)=>{if(n)return`${n}/compare/${o}...${s}`;if(e)return`https://github.com/${e}/compare/${o}...${s}`},A=(e={})=>n=>{const{changeFiles:t,date:o,release:s,target:c}=n,r={Added:[],Changed:[],Deprecated:[],Fixed:[],Removed:[],Security:[]},u=[],d=s.type;for(const i of t)for(const f of i.body.trim().split(/\r?\n/))f.trim()&&Z(f,d,r,u);if(s.isCascadeBump||s.isGroupBump)for(const i of s.sources){const f=s.isCascadeBump?"Cascade from":"Group bump with";r.Changed.push(`- ${f} \`${i.name}\`@${i.newVersion}`)}else if(s.isDependencyBump&&t.length===0)for(const i of s.sources)i.newVersion===""?r.Removed.push(`- Removed dependency \`${i.name}\``):r.Changed.push(`- Updated dependency \`${i.name}\`@${i.newVersion}`);const a=[];if(c!=="github-release"&&(a.push(`## [${s.newVersion}] - ${o}`),a.push("")),u.length>0){a.push("### ⚠ BREAKING CHANGES"),a.push("");for(const i of u)a.push(i);a.push("")}for(const i of F){const f=r[i];if(f.length!==0){a.push(`### ${i}`),a.push("");for(const h of f)a.push(h);a.push("")}}if(c!=="github-release"){const i=`${s.name}@${s.oldVersion}`,f=`${s.name}@${s.newVersion}`,h=ee(e.repo,e.compareUrlPrefix,s.name,i,f);h&&a.push(`[${s.newVersion}]: ${h}`)}return a.join(`
 `).replaceAll(/\n{3,}/g,`
 
-`).trimEnd()},se=async(e,n)=>{if(e===!1)return()=>"";if(e===void 0||e==="default")return N;if(e==="github")return x();if(e==="keep-a-changelog"||e==="keepachangelog")return R();let s,o={};if(Array.isArray(e)?[s,o={}]=e:s=e,s==="default")return B(o);if(s==="github")return x(o);if(s==="keep-a-changelog"||s==="keepachangelog")return R(o);const t=s.startsWith(".")?`${n}/${s}`:s,c=G(t).href,{dynamicEsmImport:i}=await import("./dynamic-import.js"),u=await i(c),f=typeof u=="function"?u:u.default;if(typeof f!="function")throw new TypeError(`Custom changelog formatter at ${s} did not export a default function or a callable module.`);if(Array.isArray(e))try{const r=f(o);if(typeof r=="function")return r}catch{}return f};export{se as resolveFormatter};
+`).trimEnd()},se=async(e,n)=>{if(e===!1)return()=>"";if(e===void 0||e==="default")return M;if(e==="github")return x();if(e==="keep-a-changelog"||e==="keepachangelog")return A();let t,o={};if(Array.isArray(e)?[t,o={}]=e:t=e,t==="default")return E(o);if(t==="github")return x(o);if(t==="keep-a-changelog"||t==="keepachangelog")return A(o);const s=t.startsWith(".")?`${n}/${t}`:t,c=I(s).href,{dynamicEsmImport:r}=await import("./dynamic-import.js"),u=await r(c),d=typeof u=="function"?u:u.default;if(typeof d!="function")throw new TypeError(`Custom changelog formatter at ${t} did not export a default function or a callable module.`);if(Array.isArray(e))try{const a=d(o);if(typeof a=="function")return a}catch{}return d};export{se as resolveFormatter};

package/dist/packem_chunks/run.js

@@ -1 +1 @@
-import{p as n,A as a,R as p}from"./cli-main.js";const w=({options:o,visConfig:l,workspaceRoot:r})=>{const i=r??process.cwd(),e=l?.security?.policies?.installScripts?.allow??{},s=Object.entries(e).filter(([,t])=>t).map(([t])=>t);s.length===0&&!o.rootOnly&&(n.warn("No approved packages in security.policies.installScripts.allow — nothing to run."),!o.withRoot)||(o.rootOnly||a(i,s),(o.withRoot||o.rootOnly)&&p(i))};export{w as default};
+import{p as s,f as a,g as p}from"./cli-main.js";const f=({options:t,visConfig:i,workspaceRoot:c})=>{const r=c??process.cwd(),l=i?.security?.policies?.installScripts?.allow??{},e=Object.entries(l).filter(([,o])=>o).map(([o])=>o);e.length===0&&!t.rootOnly&&(s.warn("No approved packages in security.policies.installScripts.allow — nothing to run."),!t.withRoot)||(t.rootOnly||a(r,e),(t.withRoot||t.rootOnly)&&p(r))};export{f as default};

package/dist/packem_chunks/security.js

@@ -1 +1 @@
-import o from"./index.js";import{VisReleaseError as r}from"../packem_shared/VisReleaseError-DMGRBTNO.js";const g=/^(?:@[a-z0-9-]{1,39}\/)?[a-z0-9._-]{1,214}$/,n=a=>typeof a!="string"||a.length===0||a.length>214||a.startsWith(".")||a.startsWith("_")?!1:g.test(a),h=a=>{if(!n(a))throw new r({code:"CONFIG_INVALID",message:`Invalid package name: ${JSON.stringify(a)}. Must match ^(@scope/)?[a-z0-9._-]+$ and be ≤ 214 chars (npm spec).`,packageName:typeof a=="string"?a:void 0})},c=a=>`'${a.replaceAll("'",String.raw`'\''`)}'`,m=a=>`"${a.replaceAll('"','""')}"`,l=(a,e=process.platform==="win32")=>e?m(a):c(a),i=(a,e)=>{const s=e.allowCustomCommands;return s===void 0||s===!1?!1:s===!0?!0:Array.isArray(s)?s.some(t=>a===t||o(t,a)):!1},u=(a,e,s=process.platform==="win32")=>a.replaceAll("{{name}}",l(e.name,s)).replaceAll("{{version}}",l(e.version,s)).replaceAll("{{tag}}",l(e.tag??"",s)).replaceAll("{{registry}}",l(e.registry??"",s)),p=[/\bnpm_[A-Za-z0-9]{20,}/g,/\bghp_[A-Za-z0-9]{20,}/g,/\bgho_[A-Za-z0-9]{20,}/g,/\bghs_[A-Za-z0-9]{20,}/g,/\bghu_[A-Za-z0-9]{20,}/g,/\bgithub_pat_\w{70,}/g,/\bglpat-[\w-]{20,}/g,/\bAKIA[0-9A-Z]{16}\b/g,/\bASIA[0-9A-Z]{16}\b/g,/\bcio[A-Za-z0-9]{40,}/g,/\bpypi-AgEIcHlwaS5vcmcCJ[\w-]+/g,/ACTIONS_ID_TOKEN_REQUEST_TOKEN=\S+/g,/\b_authToken=\S+/g,/\bBasic\s+[A-Za-z0-9+/=]{16,}/g,/--otp[= ]\S+/g,/\bone[- ]time password:?\s*\d{6,}/gi,/\bEOTP\s+\d{6,}/g,/Bearer (?!\[REDACTED\])[^\s"']+/g],C=a=>{let e=a;for(const s of p)e=e.replaceAll(s,"[REDACTED]");return e},A={"&":"&amp;","<":"&lt;",">":"&gt;"},_=a=>{let e=a.replaceAll(/[<>&]/g,s=>A[s]??s);return e=e.replaceAll("`","\\`"),e},f=(a,e,s)=>i(a,s)?{buildCommand:e.buildCommand,checkPublished:e.checkPublished,publishCommand:e.publishCommand}:{};export{h as assertValidPackageName,m as cmdq,_ as escapeMarkdown,u as interpolateCommand,i as isCustomCommandAllowed,n as isValidPackageName,C as redactTokens,f as resolveCustomCommands,l as shellQuote,c as sq};
+import l from"./index.js";import{VisReleaseError as o}from"../packem_shared/VisReleaseError-DZtgcKf8.js";const c=/^(?:@[a-z0-9-]{1,39}\/)?[a-z0-9._-]{1,214}$/,n=e=>typeof e!="string"||e.length===0||e.length>214||e.startsWith(".")||e.startsWith("_")?!1:c.test(e),d=e=>{if(!n(e))throw new o({code:"CONFIG_INVALID",message:`Invalid package name: ${JSON.stringify(e)}. Must match ^(@scope/)?[a-z0-9._-]+$ and be ≤ 214 chars (npm spec).`,packageName:typeof e=="string"?e:void 0})},g=e=>`'${e.replaceAll("'",String.raw`'\''`)}'`,i=e=>`"${e.replaceAll('"','""')}"`,a=(e,t=process.platform==="win32")=>t?i(e):g(e),A=(e,t)=>{const r=t.allowCustomCommands;return r===void 0||r===!1?!1:r===!0?!0:Array.isArray(r)?r.some(s=>e===s||l(s,e)):!1},f=(e,t,r=process.platform==="win32")=>e.replaceAll("{{name}}",a(t.name,r)).replaceAll("{{version}}",a(t.version,r)).replaceAll("{{tag}}",a(t.tag??"",r)).replaceAll("{{registry}}",a(t.registry??"",r)),p=[/\bnpm_[A-Za-z0-9]{20,}/g,/\bghp_[A-Za-z0-9]{20,}/g,/\bgho_[A-Za-z0-9]{20,}/g,/\bghs_[A-Za-z0-9]{20,}/g,/\bghu_[A-Za-z0-9]{20,}/g,/\bgithub_pat_\w{70,}/g,/\bglpat-[\w-]{20,}/g,/\bAKIA[0-9A-Z]{16}\b/g,/\bASIA[0-9A-Z]{16}\b/g,/\bcio[A-Za-z0-9]{40,}/g,/\bpypi-AgEIcHlwaS5vcmcCJ[\w-]+/g,/ACTIONS_ID_TOKEN_REQUEST_TOKEN=\S+/g,/\b_authToken=\S+/g,/\bBasic\s+[A-Za-z0-9+/=]{16,}/g,/--otp[= ]\S+/g,/\bone[- ]time password:?\s*\d{6,}/gi,/\bEOTP\s+\d{6,}/g,/Bearer (?!\[REDACTED\])[^\s"']+/g],h=e=>{let t=e;for(const r of p)t=t.replaceAll(r,"[REDACTED]");return t},m={"&":"&amp;","<":"&lt;",">":"&gt;"},_=e=>{let t=e.replaceAll(/[<>&]/g,r=>m[r]??r);return t=t.replaceAll("`","\\`"),t},C=(e,t,r)=>A(e,r)?{buildCommand:t.buildCommand,checkPublished:t.checkPublished,publishCommand:t.publishCommand}:{};export{d as assertValidPackageName,i as cmdq,_ as escapeMarkdown,f as interpolateCommand,A as isCustomCommandAllowed,n as isValidPackageName,h as redactTokens,C as resolveCustomCommands,a as shellQuote,g as sq};

package/dist/packem_chunks/shell-runner.js

@@ -1 +1 @@
-import{k as c}from"../packem_shared/main-D_cam4hv.js";import{redactTokens as o}from"./security.js";const h=()=>({run:async(s,t,r)=>{try{const e=await c(s,[...t],{nodeOptions:{cwd:r.cwd,env:{...process.env,COREPACK_ENABLE_DOWNLOAD_PROMPT:"0",...r.env},stdio:r.silent?["ignore","pipe","pipe"]:"inherit"},throwOnError:!1});return{exitCode:typeof e.exitCode=="number"?e.exitCode:-1,stderr:o(e.stderr??""),stdout:o(e.stdout??"")}}catch(e){return{exitCode:-1,stderr:o(e.message),stdout:""}}}}),f=()=>new a;class a{handlers=[];on(t,r,e){this.handlers.push({argsPrefix:r,command:t,respond:e})}async run(t,r,e){for(const n of this.handlers)if(!(n.command!==t||r.length<n.argsPrefix.length)&&n.argsPrefix.every((d,i)=>d===r[i]))return n.respond(e.cwd);return{exitCode:0,stderr:"",stdout:""}}}export{a as MockRunner,f as createMockRunner,h as createShellRunner};
+import{R as i}from"../packem_shared/main-BjJN8kWj.js";import{redactTokens as s}from"./security.js";const f=()=>({run:async(o,t,r)=>{try{const e=await i(o,[...t],{nodeOptions:{cwd:r.cwd,env:{...process.env,COREPACK_ENABLE_DOWNLOAD_PROMPT:"0",...r.env},stdio:r.silent?["ignore","pipe","pipe"]:"inherit"},throwOnError:!1});return{exitCode:typeof e.exitCode=="number"?e.exitCode:-1,stderr:s(e.stderr??""),stdout:s(e.stdout??"")}}catch(e){return{exitCode:-1,stderr:s(e.message),stdout:""}}}}),m=()=>new a;class a{handlers=[];on(t,r,e){this.handlers.push({argsPrefix:r,command:t,respond:e})}async run(t,r,e){for(const n of this.handlers){if(n.command!==t||r.length<n.argsPrefix.length)continue;if(n.argsPrefix.every((d,c)=>d===r[c]))return n.respond(e.cwd)}return{exitCode:0,stderr:"",stdout:""}}}export{a as MockRunner,m as createMockRunner,f as createShellRunner};

package/dist/packem_chunks/slack.js

@@ -1,2 +1,2 @@
-import{expandNotificationTemplate as r}from"./interface.js";const l=n=>n.url?`• <${n.url}|${n.name}@${n.version}>`:`• ${n.name}@${n.version}`;class m{constructor(t){this.config=t,this.id=t.id?`slack:${t.id}`:"slack"}config;id;async send(t){const c=this.config.title?r(this.config.title,t):`🚀 Released ${t.published.length} package${t.published.length===1?"":"s"}`,i=[{text:{text:c,type:"plain_text"},type:"header"}];t.published.length>0&&i.push({text:{text:t.published.map(e=>l(e)).join(`
-`),type:"mrkdwn"},type:"section"});const o=[];t.channel&&o.push(`channel: \`${t.channel}\``),t.repo&&o.push(`<https://github.com/${t.repo}|${t.repo}>`);const a=Date.parse(t.completedAt);Number.isFinite(a)?o.push(`<!date^${Math.floor(a/1e3)}^{date_short_pretty} at {time}|${t.completedAt}>`):o.push(t.completedAt),i.push({elements:[{text:o.join("  •  "),type:"mrkdwn"}],type:"context"}),t.skipped.length>0&&this.config.includeSkipped!==!1&&(i.push({type:"divider"}),i.push({text:{text:`*Skipped (${t.skipped.length}):* ${t.skipped.map(e=>`\`${e.name}\` (${e.reason})`).join(", ")}`,type:"mrkdwn"},type:"section"}));const h={blocks:i,text:c,...this.config.channelOverride?{channel:this.config.channelOverride}:{},...this.config.username?{username:this.config.username}:{},...this.config.iconEmoji?{icon_emoji:this.config.iconEmoji}:{}};let s;try{s=await fetch(this.config.webhook,{body:JSON.stringify(h),headers:{"Content-Type":"application/json"},method:"POST"})}catch(e){const p=e instanceof Error?e.name:"NetworkError";throw new Error(`Slack webhook fetch failed (${p})`,{cause:e})}if(!s.ok){const e=await s.text().catch(()=>"");throw new Error(`Slack webhook returned ${s.status} ${s.statusText}${e?`: ${e.slice(0,200)}`:""}`)}}}export{m as SlackNotificationChannel};
+import{expandNotificationTemplate as c}from"./interface.js";const l=i=>i.url?`• <${i.url}|${i.name}@${i.version}>`:`• ${i.name}@${i.version}`;class f{constructor(e){this.config=e,this.id=e.id?`slack:${e.id}`:"slack"}config;id;async send(e){const r=this.config.title?c(this.config.title,e):`🚀 Released ${e.published.length} package${e.published.length===1?"":"s"}`,s=[{text:{text:r,type:"plain_text"},type:"header"}];e.published.length>0&&s.push({text:{text:e.published.map(t=>l(t)).join(`
+`),type:"mrkdwn"},type:"section"});const n=[];e.channel&&n.push(`channel: \`${e.channel}\``),e.repo&&n.push(`<https://github.com/${e.repo}|${e.repo}>`);const a=Date.parse(e.completedAt);Number.isFinite(a)?n.push(`<!date^${Math.floor(a/1e3)}^{date_short_pretty} at {time}|${e.completedAt}>`):n.push(e.completedAt),s.push({elements:[{text:n.join("  •  "),type:"mrkdwn"}],type:"context"}),e.skipped.length>0&&this.config.includeSkipped!==!1&&(s.push({type:"divider"}),s.push({text:{text:`*Skipped (${e.skipped.length}):* ${e.skipped.map(t=>`\`${t.name}\` (${t.reason})`).join(", ")}`,type:"mrkdwn"},type:"section"}));const h={blocks:s,text:r,...this.config.channelOverride?{channel:this.config.channelOverride}:{},...this.config.username?{username:this.config.username}:{},...this.config.iconEmoji?{icon_emoji:this.config.iconEmoji}:{}};let o;try{o=await fetch(this.config.webhook,{body:JSON.stringify(h),headers:{"Content-Type":"application/json"},method:"POST"})}catch(t){const p=t instanceof Error?t.name:"NetworkError";throw new Error(`Slack webhook fetch failed (${p})`,{cause:t})}if(!o.ok){const t=await o.text().catch(()=>"");throw new Error(`Slack webhook returned ${o.status} ${o.statusText}${t?`: ${t.slice(0,200)}`:""}`)}}}export{f as SlackNotificationChannel};

package/dist/packem_chunks/snapshot.js

@@ -1,2 +1,2 @@
-import{createRequire as O}from"node:module";import{DEFAULT_CHANGES_DIR as $}from"./DEFAULT_CLEAN_KEEP.js";import{p as Q,r as X,a as Y,b as z}from"./registry.js";import{getCurrentSha as K,getShortSha as Z}from"./git.js";import{N as ee}from"./detect.js";let J;const U=a=>(J??=O(import.meta.url))(a),u=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,W=a=>{if(typeof u<"u"&&u.versions&&u.versions.node){const[e,r]=u.versions.node.split(".").map(Number);if(e>22||e===22&&r>=3||e===20&&r>=16)return u.getBuiltinModule(a)}return U(a)},{readFile:G,writeFile:N}=W("node:fs/promises"),te=(a,e)=>a.replaceAll("{tag}",e.tag).replaceAll("{sha}",e.sha).replaceAll("{shortSha}",e.shortSha).replaceAll("{branch}",e.branch??"").replaceAll("{pr}",e.pr??"").replaceAll("{timestamp}",e.timestamp),le=async a=>{const{context:e,dryRun:r=!1,registry:g,tag:n}=a,{createShellRunner:c}=await import("./shell-runner.js"),o=a.runner??c(),l=await K({cwd:e.cwd,runner:o}),i=await Z({cwd:e.cwd,runner:o});if(!l||!i)throw new Error("Could not resolve git HEAD. Snapshot requires a git workspace.");const w=e.config.snapshot?.versionTemplate??"0.0.0-{tag}-{shortSha}",A=new Date().toISOString().replaceAll(/[:.]/g,"").slice(0,14),m=e.config.snapshot?.tags??[],p=await o.run("git",["rev-parse","--abbrev-ref","HEAD"],{cwd:e.cwd,silent:!0}).then(t=>t.exitCode===0?t.stdout.trim():void 0).catch(()=>{}),S=process.env.VIS_PR_NUMBER??process.env.PR_NUMBER,R=[n];for(const t of m){let s;switch(t){case"branch":{s=p&&p!=="HEAD"?p:void 0;break}case"pr":{s=S?`pr-${S}`:void 0;break}case"sha":{s=l;break}case"short-sha":{s=i;break}default:s=void 0}s&&s!==n&&!R.includes(s)&&R.push(s)}let h=e.packages;if(a.filter){const{default:t}=await import("./index.js"),s=a.filter.split(",").map(f=>f.trim()).filter(Boolean);h=h.filter(f=>s.some(k=>f.name===k||t(k,f.name)))}h=h.filter(t=>!t.private);const d=te(w,{branch:p&&p!=="HEAD"?p:void 0,pr:S,sha:l,shortSha:i,tag:n,timestamp:A}),P=new Map;for(const t of h)P.set(t.name,{...t.manifest,version:d});const q=Q(await e.pm.readCatalogYaml(e.cwd)),F=new ee(o),b=[],v=[],_=[],j=e.config.changesDir??$,{acquireLock:H,releaseLock:T}=await import("./state.js");let C=!1;if(!r)try{await H(e.cwd,j),C=!0}catch(t){return _.push({name:"_lock",reason:t.message}),{failed:_,published:b,skipped:v,snapshotVersion:d,tag:n}}try{for(const t of h){const s=se(t,P),f=X(s,q),k=Y(f,e.config.publish?.cleanPackageJson);if(r){b.push({name:t.name,version:d});continue}let D;try{D=await G(t.manifestPath,"utf8"),await N(t.manifestPath,`${JSON.stringify(k,null,4)}
-`);const{mkdtempSync:E}=await import("node:fs"),{tmpdir:x}=await import("node:os"),{join:B}=await import("node:path"),M=E(B(x(),"vis-snapshot-")),V=await e.pm.pack({cwd:t.dir,destination:M});let y;for(const I of R){const L=await F.publish({access:"public",extraArgs:["--no-git-checks"],registry:g,tag:I,tarball:V.tarball});y??=L}y?.published?b.push({name:t.name,version:d}):y?.alreadyPublished?v.push({name:t.name,reason:"already-published"}):v.push({name:t.name,reason:y?.output??"unknown"})}catch(E){_.push({name:t.name,reason:E.message})}finally{if(D!==void 0)try{await N(t.manifestPath,D)}catch{}}}}finally{C&&await T(e.cwd,j)}return{failed:_,published:b,skipped:v,snapshotVersion:d,tag:n}},ae=["dependencies","devDependencies","peerDependencies","optionalDependencies"],se=(a,e)=>{const r=e.get(a.name)??a.manifest,g={...r};for(const n of ae){const c=r[n];if(!c||typeof c!="object")continue;const o={...c};for(const[l,i]of Object.entries(c)){const w=e.get(l);if(w&&i.startsWith("workspace:")){const A=i.slice(10),m=z(A==="*"?"*":i,w.version);o[l]=m.startsWith("workspace:")?m.slice(10):m}}g[n]=o}return g};export{le as runSnapshot};
+import{createRequire as O}from"node:module";import{DEFAULT_CHANGES_DIR as Y}from"./DEFAULT_CLEAN_KEEP.js";import{p as $,r as z,c as G,a as Q}from"./index2.js";import{getCurrentSha as X,getShortSha as Z}from"./git.js";import{N as ee}from"./index3.js";let U;const V=s=>(U??=O(import.meta.url))(s),u=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,K=s=>{if(typeof u<"u"&&u.versions&&u.versions.node){const[e,n]=u.versions.node.split(".").map(Number);if(e>22||e===22&&n>=3||e===20&&n>=16)return u.getBuiltinModule(s)}return V(s)},{readFile:W,writeFile:C}=K("node:fs/promises"),te=(s,e)=>s.replaceAll("{tag}",e.tag).replaceAll("{sha}",e.sha).replaceAll("{shortSha}",e.shortSha).replaceAll("{branch}",e.branch??"").replaceAll("{pr}",e.pr??"").replaceAll("{timestamp}",e.timestamp),le=async s=>{const{context:e,dryRun:n=!1,registry:g,tag:o}=s,{createShellRunner:c}=await import("./shell-runner.js"),r=s.runner??c(),l=await X({cwd:e.cwd,runner:r}),i=await Z({cwd:e.cwd,runner:r});if(!l||!i)throw new Error("Could not resolve git HEAD. Snapshot requires a git workspace.");const w=e.config.snapshot?.versionTemplate??"0.0.0-{tag}-{shortSha}",y=new Date().toISOString().replaceAll(/[:.]/g,"").slice(0,14),f=e.config.snapshot?.tags??[],p=await r.run("git",["rev-parse","--abbrev-ref","HEAD"],{cwd:e.cwd,silent:!0}).then(t=>t.exitCode===0?t.stdout.trim():void 0).catch(()=>{}),A=process.env.VIS_PR_NUMBER??process.env.PR_NUMBER,D=[o];for(const t of f){let a;switch(t){case"branch":{a=p&&p!=="HEAD"?p:void 0;break}case"pr":{a=A?`pr-${A}`:void 0;break}case"sha":{a=l;break}case"short-sha":{a=i;break}default:a=void 0}a&&a!==o&&!D.includes(a)&&D.push(a)}let m=e.packages;if(s.filter){const{default:t}=await import("./index.js"),a=s.filter.split(",").map(d=>d.trim()).filter(Boolean);m=m.filter(d=>a.some(v=>d.name===v||t(v,d.name)))}m=m.filter(t=>!t.private);const h=te(w,{branch:p&&p!=="HEAD"?p:void 0,pr:A,sha:l,shortSha:i,tag:o,timestamp:y}),N=new Map;for(const t of m)N.set(t.name,{...t.manifest,version:h});const q=$(await e.pm.readCatalogYaml(e.cwd)),x=new ee(r),b=[],k=[],_=[],P=e.config.changesDir??Y,{acquireLock:F,releaseLock:M}=await import("./state.js");let j=!1;if(!n)try{await F(e.cwd,P),j=!0}catch(t){return _.push({name:"_lock",reason:t.message}),{failed:_,published:b,skipped:k,snapshotVersion:h,tag:o}}try{for(const t of m){const a=ae(t,N),d=z(a,q),v=G(d,e.config.publish?.cleanPackageJson);if(n){b.push({name:t.name,version:h});continue}let R;try{R=await W(t.manifestPath,"utf8"),await C(t.manifestPath,`${JSON.stringify(v,null,4)}
+`);const{mkdtempSync:E}=await import("node:fs"),{tmpdir:T}=await import("node:os"),{join:B}=await import("node:path"),H=E(B(T(),"vis-snapshot-")),I=await e.pm.pack({cwd:t.dir,destination:H});let S;for(const L of D){const J=await x.publish({access:"public",extraArgs:["--no-git-checks"],registry:g,tag:L,tarball:I.tarball});S??=J}S?.published?b.push({name:t.name,version:h}):S?.alreadyPublished?k.push({name:t.name,reason:"already-published"}):k.push({name:t.name,reason:S?.output??"unknown"})}catch(E){_.push({name:t.name,reason:E.message})}finally{if(R!==void 0)try{await C(t.manifestPath,R)}catch{}}}}finally{j&&await M(e.cwd,P)}return{failed:_,published:b,skipped:k,snapshotVersion:h,tag:o}},se=["dependencies","devDependencies","peerDependencies","optionalDependencies"],ae=(s,e)=>{const n=e.get(s.name)??s.manifest,g={...n};for(const o of se){const c=n[o];if(!c||typeof c!="object")continue;const r={...c};for(const[l,i]of Object.entries(c)){const w=e.get(l);if(w&&i.startsWith("workspace:")){const y=i.slice(10),f=Q(y==="*"?"*":i,w.version);r[l]=f.startsWith("workspace:")?f.slice(10):f}}g[o]=r}return g};export{le as runSnapshot};

package/dist/packem_chunks/stage-publisher.js

@@ -1 +1 @@
-import{createRequire as n}from"node:module";import{VisReleaseError as l}from"../packem_shared/VisReleaseError-DMGRBTNO.js";let a;const c=e=>(a??=n(import.meta.url))(e),o=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,u=e=>{if(typeof o<"u"&&o.versions&&o.versions.node){const[t,s]=o.versions.node.split(".").map(Number);if(t>22||t===22&&s>=3||t===20&&s>=16)return o.getBuiltinModule(e)}return c(e)},{setTimeout:d}=u("node:timers/promises"),_=async e=>{const t=Date.now(),s=r=>{const i=r.trim();if(!i)return!1;try{return typeof JSON.parse(i).id=="string"}catch{return!1}};for(;Date.now()-t<e.timeoutMs;){const r=await e.runner.run("npm",["stage","view",e.stageId,"--json"],{cwd:e.cwd,silent:!0});if(!(r.exitCode===0&&s(r.stdout))){const i=await e.runner.run("npm",["view",`${e.packageName}@${e.version}`,"dist.tarball","--silent"],{cwd:e.cwd,silent:!0});return i.exitCode===0&&i.stdout.trim()?"approved":"rejected"}e.onProgress?.(Date.now()-t),await d(e.pollIntervalMs)}return"timeout"},m=(e,t=process.env)=>{const s=e==="restricted",r=!!t.ACTIONS_ID_TOKEN_REQUEST_URL&&!t.NPM_TOKEN;if(s&&r)throw new l({code:"CONFIG_INVALID",hint:"Either set publish.stage: false, or fall back to NPM_TOKEN authentication (export NPM_TOKEN; trusted publishing on restricted packages is tracked for a future release).",message:"publish.stage with OIDC trusted publishing is not supported for restricted-access packages in v1."})};export{m as refuseRestrictedOidc,_ as waitForStageDecision};
+import{createRequire as o}from"node:module";import{VisReleaseError as p}from"../packem_shared/VisReleaseError-DZtgcKf8.js";let c;const u=e=>(c??=o(import.meta.url))(e),i=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,d=e=>{if(typeof i<"u"&&i.versions&&i.versions.node){const[t,s]=i.versions.node.split(".").map(Number);if(t>22||t===22&&s>=3||t===20&&s>=16)return i.getBuiltinModule(e)}return u(e)},{setTimeout:l}=d("node:timers/promises"),g=async e=>{const t=Date.now(),s=r=>{const n=r.trim();if(!n)return!1;try{return typeof JSON.parse(n).id=="string"}catch{return!1}};for(;Date.now()-t<e.timeoutMs;){const r=await e.runner.run("npm",["stage","view",e.stageId,"--json"],{cwd:e.cwd,silent:!0});if(!(r.exitCode===0&&s(r.stdout))){const a=await e.runner.run("npm",["view",`${e.packageName}@${e.version}`,"dist.tarball","--silent"],{cwd:e.cwd,silent:!0});return a.exitCode===0&&a.stdout.trim()?"approved":"rejected"}e.onProgress?.(Date.now()-t),await l(e.pollIntervalMs)}return"timeout"},m=(e,t=process.env)=>{const s=e==="restricted",r=!!t.ACTIONS_ID_TOKEN_REQUEST_URL&&!t.NPM_TOKEN;if(s&&r)throw new p({code:"CONFIG_INVALID",hint:"Either set publish.stage: false, or fall back to NPM_TOKEN authentication (export NPM_TOKEN; trusted publishing on restricted packages is tracked for a future release).",message:"publish.stage with OIDC trusted publishing is not supported for restricted-access packages in v1."})};export{m as refuseRestrictedOidc,g as waitForStageDecision};

package/dist/packem_chunks/staged-registry.js

@@ -1,2 +1,2 @@
-import{createRequire as S}from"node:module";import{VisReleaseError as l}from"../packem_shared/VisReleaseError-DMGRBTNO.js";let w;const _=e=>(w??=S(import.meta.url))(e),o=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,p=e=>{if(typeof o<"u"&&o.versions&&o.versions.node){const[n,r]=o.versions.node.split(".").map(Number);if(n>22||n===22&&r>=3||n===20&&r>=16)return o.getBuiltinModule(e)}return _(e)},{readFile:h,unlink:v,mkdir:N,writeFile:R}=p("node:fs/promises"),{dirname:k,join:O}=p("node:path"),y=(e,n)=>O(e,n,"staged.json"),T=()=>({pending:[],recentlyNotified:[],recentlyWalked:[],updatedAt:new Date().toISOString(),version:1}),c=100,E=720*60*60*1e3,u=(e,n=Date.now())=>{if(!e||e.length===0)return[];const r=n-E,t=e.filter(i=>{const a=Date.parse(i.at);return Number.isFinite(a)&&a>=r});return t.length<=c?t:[...t].sort((i,a)=>Date.parse(a.at)-Date.parse(i.at)).slice(0,c)},j=async(e,n)=>{const r=y(e,n);let t;try{t=await h(r,"utf8")}catch(a){if(a.code==="ENOENT")return T();throw new l({cause:a,code:"STATE_FILE_CORRUPT",message:`Failed to read staged registry at ${r}: ${a.message}`})}let i;try{i=JSON.parse(t)}catch(a){throw new l({cause:a,code:"STATE_FILE_CORRUPT",message:`Staged registry at ${r} is not valid JSON: ${a.message}. Remove the file or fix it manually.`})}if(i.version!==1)throw new l({code:"STATE_FILE_CORRUPT",message:`Staged registry at ${r} reports unknown version ${i.version}. Upgrade vis or remove the file.`});if(!Array.isArray(i.pending))throw new l({code:"STATE_FILE_CORRUPT",message:`Staged registry at ${r} is missing the "pending" array.`});return i},F=async(e,n,r)=>{const t=y(e,n);let i;try{const d=await h(t,"utf8");i=JSON.parse(d)}catch{i=void 0}const a=u(r.recentlyNotified),s=u(r.recentlyWalked),g={...r,recentlyNotified:a,recentlyWalked:s};if(g.pending.length===0&&a.length===0&&s.length===0){if(i===void 0)return{changed:!1,path:t,removed:!1};try{await v(t)}catch(d){if(d.code!=="ENOENT")throw d}return{changed:!0,path:t,removed:!0}}if(i&&A(i,g))return{changed:!1,path:t,removed:!1};await N(k(t),{recursive:!0});const m=`${JSON.stringify({...g,updatedAt:new Date().toISOString()},null,2)}
-`;return await R(t,m),{changed:!0,path:t,removed:!1}},W=(e,n,r=new Date().toISOString())=>{if(n.length===0)return e;const t=e.recentlyNotified??[],i=new Set(t.map(s=>s.key)),a=n.filter(s=>!i.has(s)).map(s=>({at:r,key:s}));return a.length===0?e:{...e,recentlyNotified:[...t,...a],updatedAt:r}},$=(e,n,r=new Date().toISOString())=>{if(n.length===0)return e;const t=e.recentlyWalked??[],i=new Set(t.map(s=>s.key)),a=n.filter(s=>!i.has(s)).map(s=>({at:r,key:s}));return a.length===0?e:{...e,recentlyWalked:[...t,...a],updatedAt:r}},q=(e,n)=>{if(n.length===0)return e;const r=new Map(e.pending.map(t=>[t.id,t]));for(const t of n)r.set(t.id,t);return{...e,pending:[...r.values()],updatedAt:new Date().toISOString()}},C=(e,n)=>{if(n.length===0||e.pending.length===0)return e;const r=new Set(n),t=e.pending.filter(i=>!r.has(i.id));return t.length===e.pending.length?e:{...e,pending:t,updatedAt:new Date().toISOString()}},b=(e,n)=>{if(e.pending.length===0||n.length===0)return[];const r=new Set(n);return e.pending.filter(t=>r.has(t.name))},f=(e,n)=>{const r=e??[],t=n??[];if(r.length!==t.length)return!1;if(r.length===0)return!0;const i=new Map(r.map(a=>[a.key,a]));for(const a of t)if(i.get(a.key)?.at!==a.at)return!1;return!0},A=(e,n)=>D(e.pending,n.pending)&&f(e.recentlyNotified,n.recentlyNotified)&&f(e.recentlyWalked,n.recentlyWalked),D=(e,n)=>{if(e.length!==n.length)return!1;if(e.length===0)return!0;const r=new Map(e.map(t=>[t.id,t]));for(const t of n){const i=r.get(t.id);if(!i||i.name!==t.name||i.version!==t.version||i.reason!==t.reason||(i.tag??"latest")!==(t.tag??"latest"))return!1}return!0};export{b as findConflictingPendingStages,D as pendingSetsEqual,u as pruneOldEntries,j as readStagedRegistry,W as recordRecentlyNotified,$ as recordRecentlyWalked,A as registryContentsEqual,C as removePendingStages,y as stagedRegistryPath,q as upsertPendingStages,F as writeStagedRegistry};
+import{createRequire as y}from"node:module";import{VisReleaseError as c}from"../packem_shared/VisReleaseError-DZtgcKf8.js";let w;const _=e=>(w??=y(import.meta.url))(e),i=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,p=e=>{if(typeof i<"u"&&i.versions&&i.versions.node){const[n,r]=i.versions.node.split(".").map(Number);if(n>22||n===22&&r>=3||n===20&&r>=16)return i.getBuiltinModule(e)}return _(e)},{readFile:h,unlink:E,mkdir:v,writeFile:N}=p("node:fs/promises"),{join:R,dirname:T}=p("node:path"),m=(e,n)=>R(e,n,"staged.json"),O=()=>({pending:[],recentlyNotified:[],recentlyWalked:[],updatedAt:new Date().toISOString(),version:1}),u=100,A=720*60*60*1e3,f=(e,n=Date.now())=>{if(!e||e.length===0)return[];const r=n-A,t=e.filter(a=>{const o=Date.parse(a.at);return Number.isFinite(o)&&o>=r});return t.length<=u?t:[...t].sort((a,o)=>Date.parse(o.at)-Date.parse(a.at)).slice(0,u)},j=async(e,n)=>{const r=m(e,n);let t;try{t=await h(r,"utf8")}catch(o){if(o.code==="ENOENT")return O();throw new c({cause:o,code:"STATE_FILE_CORRUPT",message:`Failed to read staged registry at ${r}: ${o.message}`})}let a;try{a=JSON.parse(t)}catch(o){throw new c({cause:o,code:"STATE_FILE_CORRUPT",message:`Staged registry at ${r} is not valid JSON: ${o.message}. Remove the file or fix it manually.`})}if(a.version!==1)throw new c({code:"STATE_FILE_CORRUPT",message:`Staged registry at ${r} reports unknown version ${a.version}. Upgrade vis or remove the file.`});if(!Array.isArray(a.pending))throw new c({code:"STATE_FILE_CORRUPT",message:`Staged registry at ${r} is missing the "pending" array.`});return a},C=async(e,n,r)=>{const t=m(e,n);let a;try{const d=await h(t,"utf8");a=JSON.parse(d)}catch{a=void 0}const o=f(r.recentlyNotified),s=f(r.recentlyWalked),l={...r,recentlyNotified:o,recentlyWalked:s};if(l.pending.length===0&&o.length===0&&s.length===0){if(a===void 0)return{changed:!1,path:t,removed:!1};try{await E(t)}catch(d){if(d.code!=="ENOENT")throw d}return{changed:!0,path:t,removed:!0}}if(a&&k(a,l))return{changed:!1,path:t,removed:!1};await v(T(t),{recursive:!0});const S=`${JSON.stringify({...l,updatedAt:new Date().toISOString()},null,2)}
+`;return await N(t,S),{changed:!0,path:t,removed:!1}},F=(e,n,r=new Date().toISOString())=>{if(n.length===0)return e;const t=e.recentlyNotified??[],a=new Set(t.map(s=>s.key)),o=n.filter(s=>!a.has(s)).map(s=>({at:r,key:s}));return o.length===0?e:{...e,recentlyNotified:[...t,...o],updatedAt:r}},M=(e,n,r=new Date().toISOString())=>{if(n.length===0)return e;const t=e.recentlyWalked??[],a=new Set(t.map(s=>s.key)),o=n.filter(s=>!a.has(s)).map(s=>({at:r,key:s}));return o.length===0?e:{...e,recentlyWalked:[...t,...o],updatedAt:r}},$=(e,n)=>{if(n.length===0)return e;const r=new Map(e.pending.map(t=>[t.id,t]));for(const t of n)r.set(t.id,t);return{...e,pending:[...r.values()],updatedAt:new Date().toISOString()}},q=(e,n)=>{if(n.length===0||e.pending.length===0)return e;const r=new Set(n),t=e.pending.filter(a=>!r.has(a.id));return t.length===e.pending.length?e:{...e,pending:t,updatedAt:new Date().toISOString()}},x=(e,n)=>{if(e.pending.length===0||n.length===0)return[];const r=new Set(n);return e.pending.filter(t=>r.has(t.name))},g=(e,n)=>{const r=e??[],t=n??[];if(r.length!==t.length)return!1;if(r.length===0)return!0;const a=new Map(r.map(o=>[o.key,o]));for(const o of t)if(a.get(o.key)?.at!==o.at)return!1;return!0},k=(e,n)=>I(e.pending,n.pending)&&g(e.recentlyNotified,n.recentlyNotified)&&g(e.recentlyWalked,n.recentlyWalked),I=(e,n)=>{if(e.length!==n.length)return!1;if(e.length===0)return!0;const r=new Map(e.map(t=>[t.id,t]));for(const t of n){const a=r.get(t.id);if(!a||a.name!==t.name||a.version!==t.version||a.reason!==t.reason||(a.tag??"latest")!==(t.tag??"latest"))return!1}return!0};export{x as findConflictingPendingStages,I as pendingSetsEqual,f as pruneOldEntries,j as readStagedRegistry,F as recordRecentlyNotified,M as recordRecentlyWalked,k as registryContentsEqual,q as removePendingStages,m as stagedRegistryPath,$ as upsertPendingStages,C as writeStagedRegistry};

package/dist/packem_chunks/state.js

@@ -1,3 +1,3 @@
-import{createRequire as S}from"node:module";import{VisReleaseError as i}from"../packem_shared/VisReleaseError-DMGRBTNO.js";let R;const E=e=>(R??=S(import.meta.url))(e),c=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,u=e=>{if(typeof c<"u"&&c.versions&&c.versions.node){const[t,a]=c.versions.node.split(".").map(Number);if(t>22||t===22&&a>=3||t===20&&a>=16)return c.getBuiltinModule(e)}return E(e)},{constants:d}=u("node:fs"),{mkdir:p,readFile:m,unlink:f,open:O,writeFile:$}=u("node:fs/promises"),{platform:k,hostname:w}=u("node:os"),{dirname:_,join:y}=u("node:path"),v=".state.json",F="publish-lock.json",l=(e,t,a=!1)=>y(e,t,a?F:v),b=async(e,t,a=!1)=>{try{const s=await m(l(e,t,a),"utf8"),n=JSON.parse(s);if(n.version!==1)throw new i({code:"STATE_FILE_CORRUPT",message:`Unknown state file version: ${n.version}. Delete ${l(e,t,a)} to start fresh.`});return n}catch(s){if(s.code==="ENOENT")return;throw s instanceof i?s:new i({cause:s,code:"STATE_FILE_CORRUPT",message:`Failed to read state file: ${s.message}`})}},j=async(e,t,a,s=!1)=>{const n=l(e,t,s);await p(_(n),{recursive:!0}),await $(n,`${JSON.stringify(a,null,2)}
-`)},q=async(e,t,a=!1)=>{try{await f(l(e,t,a))}catch(s){if(s.code!=="ENOENT")throw new i({cause:s,code:"STATE_FILE_CORRUPT",message:`Could not clear state file at ${l(e,t,a)}: ${s.message}. Remove it manually before the next run.`})}},C=(e,t)=>({applied:[],channel:e,notified:[],plan:[...t],published:[],pushed:!1,startedAt:new Date().toISOString(),tagged:[],version:1,walked:[]}),I=(e,t)=>{const a=new Set(t.published);return e.filter(s=>!a.has(`${s.name}@${s.newVersion}`))},A=3600*1e3,T=(e,t)=>y(e,t,".lock"),L=e=>{try{return process.kill(e,0),!0}catch{return!1}},D=async(e,t)=>{const a=T(e,t);await p(_(a),{recursive:!0});const s={acquiredAt:new Date().toISOString(),hostname:w(),pid:process.pid,platform:k()},n=`${JSON.stringify(s,null,2)}
-`,h=async()=>{try{const o=await O(a,d.O_WRONLY|d.O_CREAT|d.O_EXCL,384);try{await o.writeFile(n)}finally{await o.close()}return!0}catch(o){if(o.code==="EEXIST")return!1;throw o}};if(await h())return a;let r;try{r=JSON.parse(await m(a,"utf8"))}catch{}if(r){const o=Date.now()-new Date(r.acquiredAt).getTime();if((!r.hostname||r.hostname===w())&&L(r.pid)&&o<A){const g=r.hostname?`${r.hostname}:${r.pid}`:`PID ${r.pid}`;throw new i({code:"STATE_FILE_CORRUPT",message:`Release lock held by ${g} (acquired ${Math.round(o/1e3)}s ago). Wait for the other run, or remove ${a} if you're sure it's stale.`})}}try{await f(a)}catch{}if(await h())return a;throw new i({code:"STATE_FILE_CORRUPT",message:`Could not acquire release lock at ${a} after clearing a stale entry. Another process took it. Retry in a few seconds.`})},U=async(e,t)=>{try{await f(T(e,t))}catch{}};export{D as acquireLock,q as clearState,I as filterPlanByState,T as lockFilePath,C as newState,b as readState,U as releaseLock,l as stateFilePath,j as writeState};
+import{createRequire as S}from"node:module";import{VisReleaseError as i}from"../packem_shared/VisReleaseError-DZtgcKf8.js";let g;const O=e=>(g??=S(import.meta.url))(e),c=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,u=e=>{if(typeof c<"u"&&c.versions&&c.versions.node){const[t,s]=c.versions.node.split(".").map(Number);if(t>22||t===22&&s>=3||t===20&&s>=16)return c.getBuiltinModule(e)}return O(e)},{constants:d}=u("node:fs"),{mkdir:w,readFile:m,unlink:f,writeFile:R,open:L}=u("node:fs/promises"),{platform:A,hostname:p}=u("node:os"),{dirname:_,join:y}=u("node:path"),$=".state.json",v="publish-lock.json",l=(e,t,s=!1)=>y(e,t,s?v:$),j=async(e,t,s=!1)=>{try{const a=await m(l(e,t,s),"utf8"),r=JSON.parse(a);if(r.version!==1)throw new i({code:"STATE_FILE_CORRUPT",message:`Unknown state file version: ${r.version}. Delete ${l(e,t,s)} to start fresh.`});return r}catch(a){if(a.code==="ENOENT")return;throw a instanceof i?a:new i({cause:a,code:"STATE_FILE_CORRUPT",message:`Failed to read state file: ${a.message}`})}},q=async(e,t,s,a=!1)=>{const r=l(e,t,a);await w(_(r),{recursive:!0}),await R(r,`${JSON.stringify(s,null,2)}
+`)},I=async(e,t,s=!1)=>{try{await f(l(e,t,s))}catch(a){if(a.code!=="ENOENT")throw new i({cause:a,code:"STATE_FILE_CORRUPT",message:`Could not clear state file at ${l(e,t,s)}: ${a.message}. Remove it manually before the next run.`})}},M=(e,t)=>({applied:[],channel:e,notified:[],plan:[...t],published:[],pushed:!1,startedAt:new Date().toISOString(),tagged:[],version:1,walked:[]}),U=(e,t)=>{const s=new Set(t.published);return e.filter(a=>!s.has(`${a.name}@${a.newVersion}`))},C=3600*1e3,T=(e,t)=>y(e,t,".lock"),F=e=>{try{return process.kill(e,0),!0}catch{return!1}},D=async(e,t)=>{const s=T(e,t);await w(_(s),{recursive:!0});const a={acquiredAt:new Date().toISOString(),hostname:p(),pid:process.pid,platform:A()},r=`${JSON.stringify(a,null,2)}
+`,h=async()=>{try{const n=await L(s,d.O_WRONLY|d.O_CREAT|d.O_EXCL,384);try{await n.writeFile(r)}finally{await n.close()}return!0}catch(n){if(n.code==="EEXIST")return!1;throw n}};if(await h())return s;let o;try{o=JSON.parse(await m(s,"utf8"))}catch{}if(o){const n=Date.now()-new Date(o.acquiredAt).getTime();if((!o.hostname||o.hostname===p())&&F(o.pid)&&n<C){const E=o.hostname?`${o.hostname}:${o.pid}`:`PID ${o.pid}`;throw new i({code:"STATE_FILE_CORRUPT",message:`Release lock held by ${E} (acquired ${Math.round(n/1e3)}s ago). Wait for the other run, or remove ${s} if you're sure it's stale.`})}}try{await f(s)}catch{}if(await h())return s;throw new i({code:"STATE_FILE_CORRUPT",message:`Could not acquire release lock at ${s} after clearing a stale entry. Another process took it. Retry in a few seconds.`})},J=async(e,t)=>{try{await f(T(e,t))}catch{}};export{D as acquireLock,I as clearState,U as filterPlanByState,T as lockFilePath,M as newState,j as readState,J as releaseLock,l as stateFilePath,q as writeState};

package/dist/packem_chunks/status.js

@@ -1,2 +1,2 @@
-import{s as d,E as i,I as y}from"../packem_shared/index.server-CusjRLCh.js";import{p as a}from"./cli-main.js";import{r as l,g as h}from"../packem_shared/advisories-DsXRmIA5.js";const p=r=>{if(r===0)return"0 B";const n=["B","KB","MB","GB"],t=Math.min(Math.floor(Math.log(r)/Math.log(1024)),n.length-1),o=r/1024**t;return`${o.toFixed(o<10&&t>0?1:0)} ${n[t]}`},v=r=>{if(!r)return"never";const n=Date.parse(r);if(Number.isNaN(n))return r;const t=Date.now()-n;if(t<0)return r;const o=Math.floor(t/6e4);if(o<1)return"just now";if(o<60)return`${o}m ago`;const s=Math.floor(o/60);return s<24?`${s}h ago`:`${Math.floor(s/24)}d ago`},g=async({logger:r,options:n,workspaceRoot:t})=>{if(!t)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const o=n.db??l(t),s=await h(t,o);if(n.format==="json"){process.stdout.write(`${JSON.stringify({dbPath:o,ecosystems:s.ecosystems.map(e=>({advisoryCount:e.advisoryCount,lastSyncIso:e.lastSyncIso,manifestEtag:e.manifestEtag??null,name:e.name})),exists:s.exists,schemaVersion:s.schemaVersion,sizeBytes:s.sizeBytes},void 0,2)}
-`);return}if(a.info(`DB: ${o}`),!s.exists){a.warn(`No advisory DB yet. Run ${d("vis advisories sync")} to populate.`);return}if(a.info(`Schema: v${s.schemaVersion}   Size: ${p(s.sizeBytes)}`),s.ecosystems.length===0){a.warn("DB exists but contains no ecosystems. Run `vis advisories sync`.");return}a.info(""),a.info("Ecosystem    Advisories   Last sync           ETag"),a.info(i("──────────   ──────────   ─────────────────   ──────"));for(const e of s.ecosystems){const c=e.name.padEnd(10),f=e.advisoryCount.toLocaleString().padStart(10),m=`${e.lastSyncIso||"never"} (${v(e.lastSyncIso)})`.padEnd(19),u=e.manifestEtag??i("—");a.info(`${y(c)}   ${f}   ${m}   ${u}`)}},S=g;export{S as advisoriesStatusExecute};
+import{r as d,F as i,J as l}from"../packem_shared/index.server-CwSgbeN7.js";import{p as a}from"./cli-main.js";import{r as y,g}from"../packem_shared/advisories-CyDqzi5j.js";const h=n=>{if(n===0)return"0 B";const r=["B","KB","MB","GB"],o=Math.min(Math.floor(Math.log(n)/Math.log(1024)),r.length-1),s=n/1024**o;return`${s.toFixed(s<10&&o>0?1:0)} ${r[o]}`},v=n=>{if(!n)return"never";const r=Date.parse(n);if(Number.isNaN(r))return n;const o=Date.now()-r;if(o<0)return n;const s=Math.floor(o/6e4);if(s<1)return"just now";if(s<60)return`${s}m ago`;const t=Math.floor(s/60);return t<24?`${t}h ago`:`${Math.floor(t/24)}d ago`},$=async({logger:n,options:r,workspaceRoot:o})=>{if(!o)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const s=r.db??y(o),t=await g(o,s);if(r.format==="json"){process.stdout.write(`${JSON.stringify({dbPath:s,ecosystems:t.ecosystems.map(e=>({advisoryCount:e.advisoryCount,lastSyncIso:e.lastSyncIso,manifestEtag:e.manifestEtag??null,name:e.name})),exists:t.exists,schemaVersion:t.schemaVersion,sizeBytes:t.sizeBytes},void 0,2)}
+`);return}if(a.info(`DB: ${s}`),!t.exists){a.warn(`No advisory DB yet. Run ${d("vis advisories sync")} to populate.`);return}if(a.info(`Schema: v${t.schemaVersion}   Size: ${h(t.sizeBytes)}`),t.ecosystems.length===0){a.warn("DB exists but contains no ecosystems. Run `vis advisories sync`.");return}a.info(""),a.info("Ecosystem    Advisories   Last sync           ETag"),a.info(i("──────────   ──────────   ─────────────────   ──────"));for(const e of t.ecosystems){const c=e.name.padEnd(10),u=e.advisoryCount.toLocaleString().padStart(10),m=`${e.lastSyncIso||"never"} (${v(e.lastSyncIso)})`.padEnd(19),f=e.manifestEtag??i("—");a.info(`${l(c)}   ${u}   ${m}   ${f}`)}},E=$;export{E as advisoriesStatusExecute};

package/dist/packem_chunks/success-walk.js

@@ -1,8 +1,8 @@
-const p="<!-- vis-release-success -->",k=["released"],v=`${p}
+const d="<!-- vis-release-success -->",S=["released"],R=`${d}
 :tada: This issue has been resolved in version {version} :tada:
 
 The release is available on [GitHub release]({url}).
 
-Your **[vis](https://github.com/visulima/visulima)** release pipeline shipped this. :rocket:`,C=(s,e)=>{const t=new Set,n=/(?:^|[\s(,;:!?])#(\d+)/g;let r;for(;(r=n.exec(s))!==null;){const a=Number.parseInt(r[1],10);Number.isFinite(a)&&a>0&&t.add(a)}const o=/\bgh-(\d+)/gi;for(;(r=o.exec(s))!==null;){const a=Number.parseInt(r[1],10);Number.isFinite(a)&&a>0&&t.add(a)}const u=/https?:\/\/([^\s/]+)\/([^\s)]*?)\/(?:pull|issues|merge_requests)\/(\d+)/gi;for(;(r=u.exec(s))!==null;){const a=Number.parseInt(r[3],10);if(Number.isFinite(a)&&a>0){if(e){const l=(r[2]??"").replaceAll(/^\/+|\/+$/g,"").replace(/\/-$/,""),m=e.replaceAll(/^\/+|\/+$/g,"");if(l.toLowerCase()!==m.toLowerCase())continue}t.add(a)}}return[...t].sort((a,l)=>a-l)},$=(s,e)=>{let t=s;if(e.url)t=t.replaceAll("{url}",e.url);else{const n=`${e.name}@${e.version}`;t=t.replaceAll(/\[[^\]]*\]\(\{url\}\)/g,n),t=t.replaceAll("{url}",n)}return t.replaceAll("{version}",e.version).replaceAll("{name}",e.name).replaceAll("{tag}",e.tag)},L=s=>{const e=s.config.successWalk??{};return{commentBody:e.commentBody??v,enabled:e.enabled!==!1,labels:e.labels??k,skipPrerelease:e.skipPrerelease!==!1}},N=async(s,e,t,n)=>{const r=new Set,o=new Map,u=new Date().toISOString().slice(0,10);for(const a of e.published){const l=s.plan.releases.find(c=>c.name===a.name);if(!l)continue;let m;try{m=await t({changeFiles:l.changeFiles,date:u,release:l,target:"github-release"})}catch{continue}const d=[m,...l.changeFiles.map(c=>c.body)].join(`
-`);for(const c of C(d,n))o.has(c)||o.set(c,l),r.add(c)}return{firstReleaseByRef:o,refs:[...r].sort((a,l)=>a-l)}},R=(s,e)=>s?e.published.find(t=>t.name===s.name)?.url??"":"",F=s=>{let e=0;const t=[],n=()=>{if(e>=s)return;const r=t.shift();r&&(e+=1,r())};return r=>new Promise((o,u)=>{const a=()=>{e-=1,n()},l=()=>{r().then(o,u).finally(a)};t.push(l),n()})},W=s=>new Promise(e=>{setTimeout(e,s)}),_=s=>{if(!s||typeof s!="object")return!1;const e=s;return typeof e.status=="number"&&e.status===429||typeof e.statusCode=="number"&&e.statusCode===429?!0:typeof e.message=="string"?/\b429\b|rate[- ]?limit/i.test(e.message):!1},E=(s,e)=>{if(!s||typeof s!="object")return e;const t=s;if(typeof t.retryAfter=="number"&&Number.isFinite(t.retryAfter)&&t.retryAfter>=0)return Math.round(t.retryAfter*1e3);if(typeof t.message=="string"){const n=/Retry-After:\s*(\d+)/i.exec(t.message);if(n){const r=Number.parseInt(n[1],10);if(Number.isFinite(r)&&r>=0)return r*1e3}}return e},g=async(s,e=5e3)=>{try{return await s()}catch(t){if(!_(t))throw t;const n=E(t,e);return await W(n),s()}},x=async(s,e,t,n)=>{const r={commented:[],labeled:[],warnings:[]};if(s.config.successWalk===void 0)return r;const o=L(s);if(!o.enabled)return r;const u=!!s.channel?.prerelease||e.published.some(i=>i.version.includes("-"));if(o.skipPrerelease&&u||!n.repo)return r;const{firstReleaseByRef:a,refs:l}=await N(s,e,n.formatter,n.repo);if(l.length===0)return r;const m=s.channel?.tag??"",d=F(4),c=l.map(i=>d(async()=>{const f=a.get(i),y=f?.newVersion??e.published[0]?.version??"",w=f?.name??e.published[0]?.name??"",A=R(f,e),b=$(o.commentBody,{name:w,tag:m,url:A,version:y}),S=b.includes(p)?b:`${p}
-${b}`;try{if(await g(()=>n.client.upsertStickyComment(t,{body:S,cwd:s.cwd,issueNumber:i,marker:p,repo:n.repo})))r.commented.push(i);else{r.warnings.push(`successWalk: upsertStickyComment returned undefined for #${i}; skipping label step.`);return}}catch(h){r.warnings.push(`successWalk: failed to comment on #${i}: ${h.message}`);return}if(o.labels.length!==0)try{await g(()=>n.client.addLabels(t,{cwd:s.cwd,issueNumber:i,labels:o.labels,repo:n.repo}))?r.labeled.push(i):r.warnings.push(`successWalk: addLabels returned false for #${i}; the labels may not have been applied.`)}catch(h){r.warnings.push(`successWalk: failed to label #${i}: ${h.message}`)}}));return await Promise.all(c),r.commented.sort((i,f)=>i-f),r.labeled.sort((i,f)=>i-f),r};export{v as DEFAULT_SUCCESS_WALK_COMMENT,k as DEFAULT_SUCCESS_WALK_LABELS,p as SUCCESS_WALK_MARKER,C as extractReferences,F as pLimit,x as walkSuccessfulRelease,g as withRateLimitRetry};
+Your **[vis](https://github.com/visulima/visulima)** release pipeline shipped this. :rocket:`,C=(s,e)=>{const n=new Set,r=/(?:^|[\s(,;:!?])#(\d+)/g;let t;for(;(t=r.exec(s))!==null;){const a=Number.parseInt(t[1],10);Number.isFinite(a)&&a>0&&n.add(a)}const o=/\bgh-(\d+)/gi;for(;(t=o.exec(s))!==null;){const a=Number.parseInt(t[1],10);Number.isFinite(a)&&a>0&&n.add(a)}const u=/https?:\/\/([^\s/]+)\/([^\s)]*?)\/(?:pull|issues|merge_requests)\/(\d+)/gi;for(;(t=u.exec(s))!==null;){const a=Number.parseInt(t[3],10);if(Number.isFinite(a)&&a>0){if(e){const i=(t[2]??"").replaceAll(/^\/+|\/+$/g,"").replace(/\/-$/,""),f=e.replaceAll(/^\/+|\/+$/g,"");if(i.toLowerCase()!==f.toLowerCase())continue}n.add(a)}}return[...n].sort((a,i)=>a-i)},L=(s,e)=>{let n=s;if(e.url)n=n.replaceAll("{url}",e.url);else{const r=`${e.name}@${e.version}`;n=n.replaceAll(/\[[^\]]*\]\(\{url\}\)/g,r),n=n.replaceAll("{url}",r)}return n.replaceAll("{version}",e.version).replaceAll("{name}",e.name).replaceAll("{tag}",e.tag)},$=s=>{const e=s.config.successWalk??{};return{commentBody:e.commentBody??R,enabled:e.enabled!==!1,labels:e.labels??S,skipPrerelease:e.skipPrerelease!==!1}},v=async(s,e,n,r)=>{const t=new Set,o=new Map,u=new Date().toISOString().slice(0,10);for(const a of e.published){const i=s.plan.releases.find(c=>c.name===a.name);if(!i)continue;let f;try{f=await n({changeFiles:i.changeFiles,date:u,release:i,target:"github-release"})}catch{continue}const b=[f,...i.changeFiles.map(c=>c.body)].join(`
+`);for(const c of C(b,r))o.has(c)||o.set(c,i),t.add(c)}return{firstReleaseByRef:o,refs:[...t].sort((a,i)=>a-i)}},N=(s,e)=>s?e.published.find(r=>r.name===s.name)?.url??"":"",F=s=>{let e=0;const n=[],r=()=>{if(e>=s)return;const t=n.shift();t&&(e+=1,t())};return t=>new Promise((o,u)=>{const a=()=>{e-=1,r()},i=()=>{t().then(o,u).finally(a)};n.push(i),r()})},W=s=>new Promise(e=>{setTimeout(e,s)}),_=s=>{if(!s||typeof s!="object")return!1;const e=s;return typeof e.status=="number"&&e.status===429||typeof e.statusCode=="number"&&e.statusCode===429?!0:typeof e.message=="string"?/\b429\b|rate[- ]?limit/i.test(e.message):!1},B=(s,e)=>{if(!s||typeof s!="object")return e;const n=s;if(typeof n.retryAfter=="number"&&Number.isFinite(n.retryAfter)&&n.retryAfter>=0)return Math.round(n.retryAfter*1e3);if(typeof n.message=="string"){const r=/Retry-After:\s*(\d+)/i.exec(n.message);if(r){const t=Number.parseInt(r[1],10);if(Number.isFinite(t)&&t>=0)return t*1e3}}return e},g=async(s,e=5e3)=>{try{return await s()}catch(n){if(!_(n))throw n;const r=B(n,e);return await W(r),s()}},E=async(s,e,n,r)=>{const t={commented:[],labeled:[],warnings:[]};if(s.config.successWalk===void 0)return t;const o=$(s);if(!o.enabled)return t;const u=!!s.channel?.prerelease||e.published.some(l=>l.version.includes("-"));if(o.skipPrerelease&&u||!r.repo)return t;const{firstReleaseByRef:a,refs:i}=await v(s,e,r.formatter,r.repo);if(i.length===0)return t;const f=s.channel?.tag??"",b=F(4),c=i.map(l=>b(async()=>{const m=a.get(l),y=m?.newVersion??e.published[0]?.version??"",w=m?.name??e.published[0]?.name??"",A=N(m,e),h=L(o.commentBody,{name:w,tag:f,url:A,version:y}),k=h.includes(d)?h:`${d}
+${h}`;try{if(await g(()=>r.client.upsertStickyComment(n,{body:k,cwd:s.cwd,issueNumber:l,marker:d,repo:r.repo})))t.commented.push(l);else{t.warnings.push(`successWalk: upsertStickyComment returned undefined for #${l}; skipping label step.`);return}}catch(p){t.warnings.push(`successWalk: failed to comment on #${l}: ${p.message}`);return}if(o.labels.length!==0)try{await g(()=>r.client.addLabels(n,{cwd:s.cwd,issueNumber:l,labels:o.labels,repo:r.repo}))?t.labeled.push(l):t.warnings.push(`successWalk: addLabels returned false for #${l}; the labels may not have been applied.`)}catch(p){t.warnings.push(`successWalk: failed to label #${l}: ${p.message}`)}}));return await Promise.all(c),t.commented.sort((l,m)=>l-m),t.labeled.sort((l,m)=>l-m),t};export{R as DEFAULT_SUCCESS_WALK_COMMENT,S as DEFAULT_SUCCESS_WALK_LABELS,d as SUCCESS_WALK_MARKER,C as extractReferences,F as pLimit,E as walkSuccessfulRelease,g as withRateLimitRetry};

package/dist/packem_chunks/sync.js

@@ -1,2 +1,2 @@
-import{E as g}from"../packem_shared/index.server-CusjRLCh.js";import{p as c}from"./cli-main.js";import{s as $}from"../packem_shared/scan-progress-DWfY4zkp.js";import{s as w,D as v}from"../packem_shared/advisories-DsXRmIA5.js";const S=t=>t?.security?.audit?.advisories??{},D=t=>t?t.split(",").map(r=>r.trim()).filter(r=>r.length>0):["npm"],b=async({logger:t,options:r,visConfig:h,workspaceRoot:d})=>{if(!d)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const l=r.format==="json",u=S(h),m=r.source??u.source??v,p=D(r.ecosystem),y=p.map(s=>({id:s,label:`Sync ${s} advisories`})),n=$(y,{live:!l}),i=[];try{for(const s of p){n.start(s);const o=Date.now();try{const e=await w({allowedHosts:u.allowedHosts,dbPath:r.db,ecosystem:s,force:!!r.force,source:m,workspaceRoot:d});i.push({ecosystem:s,result:e}),e.upToDate?n.finish(s,"ok",`up to date · ${f(Date.now()-o)}`):n.finish(s,"ok",`${e.advisoriesIngested.toLocaleString()} advisories · ${f(e.durationMs)}`)}catch(e){const a=e instanceof Error?e.message:String(e);i.push({ecosystem:s,error:a}),n.finish(s,"error",a)}}}finally{n.stop()}if(l){const s={ecosystems:i.map(o=>({advisoriesIngested:o.result?.advisoriesIngested??0,dbPath:o.result?.dbPath??null,durationMs:o.result?.durationMs??0,ecosystem:o.ecosystem,error:o.error??null,upToDate:o.result?.upToDate??!1})),source:m};process.stdout.write(`${JSON.stringify(s,void 0,2)}
-`)}else{const s=i.filter(a=>a.error),o=i.filter(a=>a.result),e=o[0];e?.result?.dbPath&&c.info(g(`DB: ${e.result.dbPath}`)),s.length===0?c.success(`Synced ${o.length} ecosystem${o.length===1?"":"s"}.`):c.error(`${s.length} ecosystem${s.length===1?"":"s"} failed to sync.`)}i.some(s=>s.error)&&(process.exitCode=1)},f=t=>t>=1e3?`${(t/1e3).toFixed(1)}s`:`${Math.round(t)}ms`,R=b;export{R as advisoriesSyncExecute};
+import{F as p}from"../packem_shared/index.server-CwSgbeN7.js";import{p as c}from"./cli-main.js";import{s as v}from"../packem_shared/scan-progress-C9nMDLis.js";import{D as $,s as D}from"../packem_shared/advisories-CyDqzi5j.js";const S=o=>o?.security?.audit?.advisories??{},w=o=>o?o.split(",").map(r=>r.trim()).filter(r=>r.length>0):["npm"],b=async({logger:o,options:r,visConfig:y,workspaceRoot:l})=>{if(!l)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const d=r.format==="json",u=S(y),f=r.source??u.source??$,m=w(r.ecosystem),h=m.map(s=>({id:s,label:`Sync ${s} advisories`})),a=v(h,{live:!d}),i=[];try{for(const s of m){a.start(s);const e=Date.now();try{const t=await D({allowedHosts:u.allowedHosts,dbPath:r.db,ecosystem:s,force:!!r.force,source:f,workspaceRoot:l});i.push({ecosystem:s,result:t}),t.upToDate?a.finish(s,"ok",`up to date · ${g(Date.now()-e)}`):a.finish(s,"ok",`${t.advisoriesIngested.toLocaleString()} advisories · ${g(t.durationMs)}`)}catch(t){const n=t instanceof Error?t.message:String(t);i.push({ecosystem:s,error:n}),a.finish(s,"error",n)}}}finally{a.stop()}if(d){const s={ecosystems:i.map(e=>({advisoriesIngested:e.result?.advisoriesIngested??0,dbPath:e.result?.dbPath??null,durationMs:e.result?.durationMs??0,ecosystem:e.ecosystem,error:e.error??null,upToDate:e.result?.upToDate??!1})),source:f};process.stdout.write(`${JSON.stringify(s,void 0,2)}
+`)}else{const s=i.filter(n=>n.error),e=i.filter(n=>n.result),t=e[0];t?.result?.dbPath&&c.info(p(`DB: ${t.result.dbPath}`)),s.length===0?c.success(`Synced ${e.length} ecosystem${e.length===1?"":"s"}.`):c.error(`${s.length} ecosystem${s.length===1?"":"s"} failed to sync.`)}i.some(s=>s.error)&&(process.exitCode=1)},g=o=>o>=1e3?`${(o/1e3).toFixed(1)}s`:`${Math.round(o)}ms`,C=b;export{C as advisoriesSyncExecute};

package/dist/packem_chunks/sync2.js

@@ -1,2 +1,2 @@
-import{p as e}from"./cli-main.js";import{A as u}from"../packem_shared/pm-runner-DRybtzOV.js";import{O as g}from"../packem_shared/native-config-sync-CHMCJx7H.js";import{S as l}from"../packem_shared/min-release-age-6avfn81h.js";const y=new Set(["bun","npm","pnpm","yarn"]),k=({options:r,visConfig:c,workspaceRoot:f})=>{const s=f??process.cwd(),n=u(s);if(!y.has(n.name)){e.warn(`Package manager '${n.name}' has no native security config to sync.`);return}if(!c?.security){e.warn("vis.config has no `security` block — nothing to sync.");return}const t=c.security.policies??{},a=Object.fromEntries(Object.entries(t.installScripts?.allow??{}).filter(([,o])=>o)),m=t.firstSeen?.minutes,p=t.firstSeen?.exclude??[],i=[];if(Object.keys(a).length>0&&!r.skipAllowBuilds&&i.push(...g(n.name,s,a)),r.skipMinReleaseAge||i.push(...l(n.name,s,m,p)),i.length===0){e.success("Nothing to sync — vis.config and native PM config are aligned.");return}e.info(`Syncing vis.config security settings to ${n.name} native config…
-`);for(const o of i)e.success(`  ${o}`)};export{k as default};
+import{p as n}from"./cli-main.js";import{d as u}from"../packem_shared/pm-runner-de-jCq8q.js";import{s as p}from"../packem_shared/native-config-sync-BSzU4qUO.js";import{s as g}from"../packem_shared/min-release-age-ChzTC7_I.js";const y=new Set(["bun","npm","pnpm","yarn"]),S=({options:c,visConfig:a,workspaceRoot:l})=>{const i=l??process.cwd(),e=u(i);if(!y.has(e.name)){n.warn(`Package manager '${e.name}' has no native security config to sync.`);return}if(!a?.security){n.warn("vis.config has no `security` block — nothing to sync.");return}const t=a.security.policies??{},r=Object.fromEntries(Object.entries(t.installScripts?.allow??{}).filter(([,o])=>o)),f=t.firstSeen?.minutes,m=t.firstSeen?.exclude??[],s=[];if(Object.keys(r).length>0&&!c.skipAllowBuilds&&s.push(...p(e.name,i,r)),c.skipMinReleaseAge||s.push(...g(e.name,i,f,m)),s.length===0){n.success("Nothing to sync — vis.config and native PM config are aligned.");return}n.info(`Syncing vis.config security settings to ${e.name} native config…
+`);for(const o of s)n.success(`  ${o}`)};export{S as default};