@visulima/vis 4.1.20 → 4.3.0

package/dist/packem_chunks/index2.js

@@ -1,48 +1,58 @@
-import{createRequire as _e}from"node:module";import{VersionActions as _}from"../packem_shared/AfterAllProjectsVersioned-CAKI2nWf.js";import{VisReleaseError as u}from"../packem_shared/VisReleaseError-DZtgcKf8.js";import{L as Me}from"../packem_shared/index-BisalDCf.js";import{resolveCleanStripList as De}from"./DEFAULT_CLEAN_KEEP.js";import{assertValidPackageName as F,resolveCustomCommands as W,interpolateCommand as H}from"./security.js";let Ne;const Ee=s=>(Ne??=_e(import.meta.url))(s),V=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,O=s=>{if(typeof V<"u"&&V.versions&&V.versions.node){const[e,r]=V.versions.node.split(".").map(Number);if(e>22||e===22&&r>=3||e===20&&r>=16)return V.getBuiltinModule(s)}return Ee(s)},{readFile:A,writeFile:j,rm:Ve,readdir:Oe}=O("node:fs/promises"),{dirname:G,join:f}=O("node:path"),{fileURLToPath:je}=O("node:url"),{mkdtempSync:B,writeFileSync:Re}=O("node:fs"),{tmpdir:J}=O("node:os"),Le=["dependencies","devDependencies","peerDependencies","optionalDependencies"],fe=(s,e)=>{if(s.startsWith("catalog:")||s==="*"||s==="workspace:*"||s==="workspace:^"||s==="workspace:~")return s;if(s.startsWith("workspace:")){const n=s.slice(10);return`workspace:${U(n)}${e}`}if(s.startsWith("npm:")){const n=s.lastIndexOf("@");if(n<=4)return s;const a=s.slice(4,n),t=s.slice(n+1),i=U(t);return`npm:${a}@${i}${e}`}return`${U(s)}${e}`},Te=/^([\^~=]|>=?|<=?)/,U=s=>{const e=Te.exec(s);return e?e[1]??"^":"^"},Gs=async(s,e,r={})=>{const n=r.serializeManifest??Je,a=r.changelogPath??He,t=r.renderChangelogEntry??Ke,i=new Map(s.releases.map(l=>[l.name,l.newVersion])),o=await Promise.all(s.releases.map(async l=>{const m=e.getPackage(l.name);if(!m)return;const b=Fe(m.manifest,l.newVersion,i),w=r.readManifest?.(m.manifestPath),k=a(m);return{changelogEntry:await t(l),changelogPath:k,manifestWrite:{content:n(b,w),path:m.manifestPath}}})),c=[],p=new Map;for(const l of o){if(!l)continue;c.push(l.manifestWrite);const m=p.get(l.changelogPath);m?m.push(l.changelogEntry):p.set(l.changelogPath,[l.changelogEntry])}for(const[l,m]of p){const b=m.join(`
+import{createRequire as ks}from"node:module";import{VersionActions as C}from"../packem_shared/AfterAllProjectsVersioned-CAKI2nWf.js";import{VisReleaseError as g}from"../packem_shared/VisReleaseError-DZtgcKf8.js";import Je from"./index.js";import{tagExists as ue,renderTagPattern as z,defaultTagFor as Ke}from"./git.js";import{a as Ns,s as me,o as he,i as fe}from"../packem_shared/gradle-build-CHZDHyjI.js";import{L as _s}from"../packem_shared/index-BisalDCf.js";import{resolveCleanStripList as Ss}from"./DEFAULT_CLEAN_KEEP.js";import{assertValidPackageName as x,resolveCustomCommands as re,interpolateCommand as te}from"./security.js";let vs;const $s=r=>(vs??=ks(import.meta.url))(r),F=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,U=r=>{if(typeof F<"u"&&F.versions&&F.versions.node){const[e,s]=F.versions.node.split(".").map(Number);if(e>22||e===22&&s>=3||e===20&&s>=16)return F.getBuiltinModule(r)}return $s(r)},{readFile:P,readdir:ce,rm:le,access:Ue,writeFile:B,mkdtemp:Is}=U("node:fs/promises"),{isAbsolute:G,join:f,dirname:E,resolve:Be,relative:We,sep:He,basename:R}=U("node:path"),{realpathSync:Cs,mkdtempSync:se,writeFileSync:Ps}=U("node:fs"),{fileURLToPath:As}=U("node:url"),{tmpdir:q}=U("node:os"),Vs=["dependencies","devDependencies","peerDependencies","optionalDependencies"],qe=(r,e)=>{if(r.startsWith("catalog:")||r==="*"||r==="workspace:*"||r==="workspace:^"||r==="workspace:~")return r;if(r.startsWith("workspace:")){const t=r.slice(10);return`workspace:${ee(t)}${e}`}if(r.startsWith("npm:")){const t=r.lastIndexOf("@");if(t<=4)return r;const n=r.slice(4,t),a=r.slice(t+1),i=ee(a);return`npm:${n}@${i}${e}`}return`${ee(r)}${e}`},Os=/^([\^~=]|>=?|<=?)/,ee=r=>{const e=Os.exec(r);return e?e[1]??"^":"^"},Pt=async(r,e,s={})=>{const t=s.serializeManifest??Ls,n=s.changelogPath??Ms,a=s.renderChangelogEntry??Ts,i=new Map(r.releases.map(d=>[d.name,d.newVersion])),o=await Promise.all(r.releases.map(async d=>{const p=e.getPackage(d.name);if(!p)return;const u=Es(p.manifest,d.newVersion,i),m=s.readManifest?.(p.manifestPath),h=n(p);return{changelogEntry:await a(d),changelogPath:h,manifestWrite:p.ecosystem===void 0?{content:t(u,m),path:p.manifestPath}:void 0}})),c=[],l=new Map;for(const d of o){if(!d)continue;d.manifestWrite&&c.push(d.manifestWrite);const p=l.get(d.changelogPath);p?p.push(d.changelogEntry):l.set(d.changelogPath,[d.changelogEntry])}for(const[d,p]of l){const u=p.join(`
 
-`),w=r.readChangelog?.(l);c.push({content:Be(b,w),path:l})}return{deletions:s.consumedChangeFiles.map(l=>l.path),writes:c}},Fe=(s,e,r)=>{const n={...s,version:e};for(const a of Le){const t=s[a];if(!t||typeof t!="object")continue;const i={...t};let o=!1;for(const[c,p]of Object.entries(t)){const l=r.get(c);if(l===void 0)continue;const m=fe(p,l);m!==p&&(i[c]=m,o=!0)}o&&(n[a]=i)}return n},Ue=/^# .+/,Ge=/^## /m,Be=(s,e)=>{const r=s.trim();if(!e||e.trim()==="")return`# Changelog
+`),m=s.readChangelog?.(d);c.push({content:js(u,m),path:d})}return{deletions:r.consumedChangeFiles.map(d=>d.path),writes:c}},Es=(r,e,s)=>{const t={...r,version:e};for(const n of Vs){const a=r[n];if(!a||typeof a!="object")continue;const i={...a};let o=!1;for(const[c,l]of Object.entries(a)){const d=s.get(c);if(d===void 0)continue;const p=qe(l,d);p!==l&&(i[c]=p,o=!0)}o&&(t[n]=i)}return t},Ds=/^# .+/,Rs=/^## /m,js=(r,e)=>{const s=r.trim();if(!e||e.trim()==="")return`# Changelog
 
-${r}
-`;const n=e.split(/\r?\n/);if(n[0]&&Ue.test(n[0])){let a=1;for(;a<n.length&&!(n[a]??"").startsWith("## ");)a+=1;const t=n.slice(0,a),i=n.slice(a);return t.length>0&&t[t.length-1]!==""&&t.push(""),[...t,r,"",...i].join(`
+${s}
+`;const t=e.split(/\r?\n/);if(t[0]&&Ds.test(t[0])){let n=1;for(;n<t.length&&!(t[n]??"").startsWith("## ");)n+=1;const a=t.slice(0,n),i=t.slice(n);return a.length>0&&a[a.length-1]!==""&&a.push(""),[...a,s,"",...i].join(`
 `).replaceAll(/\n{3,}/g,`
 
-`)}return Ge.test(e)?`${r}
+`)}return Rs.test(e)?`${s}
 
-${e.trimStart()}`:`${r}
+${e.trimStart()}`:`${s}
 
-${e.trimStart()}`},Je=(s,e)=>{const r=We(e);return`${JSON.stringify(s,null,r)}
-`},We=s=>{if(!s)return 4;const e=/\n(\s+)"/.exec(s);if(!e)return 4;const r=(e[1]??"").length;return r===2||r===4?r:4},He=s=>`${s.dir}/CHANGELOG.md`,Ke=s=>{const e=new Date().toISOString().slice(0,10),r=[`## ${s.newVersion}`,`<sub>${e}</sub>`,""];if(s.isCascadeBump||s.isGroupBump)for(const n of s.sources)r.push(`- Version bump from ${n.name}@${n.newVersion}`);else if(s.isDependencyBump&&s.changeFiles.length===0)for(const n of s.sources)n.newVersion===""?r.push(`- Removed dependency ${n.name}`):r.push(`- Updated dependency ${n.name}@${n.newVersion}`);else for(const n of s.changeFiles)for(const a of n.body.split(/\r?\n/)){if(a.trim()===""){r.push("");continue}r.push(a.startsWith("-")||a.startsWith("*")?a:`- ${a}`)}return r.join(`
-`)},qe=["dependencies","devDependencies","peerDependencies","optionalDependencies"],X={default:{},named:{}},Ye=s=>{if(!s)return X;let e;try{e=Me(s,{strict:!0})}catch(a){throw new u({cause:a,code:"CONFIG_INVALID",message:`Failed to parse pnpm-workspace.yaml: ${a.message}`})}if(typeof e!="object"||e===null||Array.isArray(e))return X;const r=e,n={default:{},named:{}};if(typeof r.catalog=="object"&&r.catalog!==null&&!Array.isArray(r.catalog))for(const[a,t]of Object.entries(r.catalog))typeof t=="string"&&(n.default[a]=t);if(typeof r.catalogs=="object"&&r.catalogs!==null&&!Array.isArray(r.catalogs))for(const[a,t]of Object.entries(r.catalogs)){if(typeof t!="object"||t===null||Array.isArray(t))continue;const i={};for(const[o,c]of Object.entries(t))typeof c=="string"&&(i[o]=c);n.named[a]=i}return n},we=(s,e,r)=>{if(!s.startsWith("catalog:"))return s;const n=s.slice(8),a=n===""?r.default:r.named[n];if(a)return a[e]},z=(s,e)=>{const r={...s};for(const n of qe){const a=s[n];if(!a||typeof a!="object")continue;const t={...a};for(const[i,o]of Object.entries(a)){if(!o.startsWith("catalog:"))continue;const c=we(o,i,e);if(c===void 0)throw new u({code:"CONFIG_INVALID",message:`Cannot resolve "${o}" for dependency "${i}" in package "${s.name}". Add it to pnpm-workspace.yaml's "catalog" or "catalogs" block.`,packageName:s.name});t[i]=c}r[n]=t}return r},Bs=Object.defineProperty({__proto__:null,parseCatalogs:Ye,resolveCatalogRef:we,rewriteCatalogRefs:z},Symbol.toStringTag,{value:"Module"}),ze="ACTIONS_ID_TOKEN_REQUEST_URL",Q=s=>{const e=!!s.env[ze],r=!!s.env[s.staticTokenVar],n=s.workspaceConfig?.publish?.preferStaticToken===!0;return e&&!(n&&r)?"oidc":r?"token":"missing"};let R;const Qe="https://github.com/visulima/visulima",Xe=async()=>{try{let e=G(je(import.meta.url));for(let r=0;r<6;r+=1){const n=f(e,"package.json");try{const t=await A(n,"utf8"),i=JSON.parse(t);if(i.name==="@visulima/vis"&&typeof i.version=="string")return i.version}catch{}const a=G(e);if(a===e)break;e=a}}catch{}return"unknown"},Ze=async()=>(R!==void 0||(R=`vis-release/${await Xe()} (+${Qe})`),R),Z=new Map,xe=async s=>{const e=Z.get(s);if(e!==void 0)return e;try{const r=await import("./index7.js").then(a=>a.i),n=new r.ProxyAgent(s);return Z.set(s,n),n}catch{return}},es=s=>s===301||s===302||s===303||s===307||s===308,ss=(s,e)=>{try{const r=new URL(s),n=new URL(e);return r.host===n.host&&r.protocol===n.protocol}catch{return!1}},N=async(s,e={})=>{const r=e.maxRedirects??2,a={"User-Agent":await Ze(),...e.headers};e.headers?.["User-Agent"]&&(a["User-Agent"]=e.headers["User-Agent"]);let t=s,i=0;const o=e.httpProxy?await xe(e.httpProxy):void 0;for(;;){let c;try{const m=e.fetchImpl??globalThis.fetch,b={headers:a,method:e.method??"GET",redirect:"manual"};o&&(b.dispatcher=o),c=await m(t,b)}catch{return{json:async()=>{},ok:!1,status:0,text:async()=>""}}if(!es(c.status))return{json:async()=>{try{return await c.json()}catch{return}},ok:c.ok,status:c.status,text:async()=>{try{return await c.text()}catch{return""}}};const p=c.headers.get("location")??c.headers.get("Location");if(!p||i>=r)return{json:async()=>{},ok:!1,status:0,text:async()=>""};let l;try{l=new URL(p,t).toString()}catch{return{json:async()=>{},ok:!1,status:0,text:async()=>""}}if(!ss(s,l))return{json:async()=>{},ok:!1,status:0,text:async()=>""};t=l,i+=1}},rs="https://crates.io/api/v1/crates",ns="Cargo.toml",x=async s=>{let e;try{e=await A(s,"utf8")}catch(o){throw new u({cause:o,code:"CONFIG_INVALID",file:s,message:`Failed to read Cargo.toml at ${s}: ${o.message}`})}const{parse:r}=await import("./index6.js");let n;try{n=r(e)}catch(o){throw new u({cause:o,code:"CONFIG_INVALID",file:s,message:`Failed to parse Cargo.toml at ${s}: ${o.message}`})}if(!n.package)throw new u({code:"CONFIG_INVALID",file:s,hint:"CargoVersionActions only supports publishable crates with a [package] table. For workspace roots, point per-package config at the member crate directory.",message:`Cargo.toml at ${s} has no [package] table.`});const{name:a}=n.package;if(typeof a!="string"||a.length===0)throw new u({code:"CONFIG_INVALID",file:s,message:`Cargo.toml at ${s} is missing [package].name.`});const t=n.package.version;let i;if(typeof t=="string"?i=t:t&&typeof t=="object"&&t.workspace===!0&&(i=n.workspace?.package?.version),typeof i!="string"||i.length===0)throw new u({code:"CONFIG_INVALID",file:s,hint:"Set [package].version explicitly, or — for workspace-inherited versions — ensure the root Cargo.toml carries [workspace.package].version and point per-package config at it.",message:`Cargo.toml at ${s} has no resolvable [package].version.`});return{name:a,version:i}},ee=async(s,e)=>{const r=`${rs}/${encodeURIComponent(s)}`;try{const n=await N(r,{headers:{Accept:"application/json"},httpProxy:e});if(n.status===404||!n.ok)return;const a=await n.json();return a?.crate?.max_stable_version??a?.crate?.max_version??void 0}catch{return}},as=(s,e)=>Q({env:s,staticTokenVar:"CARGO_REGISTRY_TOKEN",workspaceConfig:e})==="oidc",ts=async(s,e)=>{const r=await s.run("cargo",["package","--list","--allow-dirty"],{cwd:e,silent:!0});return r.exitCode!==0?[]:r.stdout.split(/\r?\n/).map(n=>n.trim()).filter(n=>n.length>0)};class is extends _{id="cargo";async readPublishedVersion(e){const r=K(e.pkg);try{const{name:n}=await x(r);return await ee(n)}catch{return}}async publish(e){if(e.dryRun)return{output:`[dry-run / cargo] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const r=K(e.pkg,e.perPackageConfig),n=os(e.pkg,e.perPackageConfig),{name:a,version:t}=await x(r);if(t!==e.release.newVersion)throw new u({code:"CONFIG_INVALID",file:r,hint:`Confirm the cargo() preset's crateDir points at the directory containing this Cargo.toml. Expected ${e.release.newVersion} on disk after the extra-files bump.`,message:`Cargo.toml version (${t}) does not match planned release version (${e.release.newVersion}) for ${e.pkg.name}.`,packageName:e.pkg.name});if(await ee(a,e.workspaceConfig?.httpProxy)===e.release.newVersion)return{alreadyPublished:!0,output:`[cargo] ${a}@${e.release.newVersion} already on crates.io`,published:!1};const o=as(process.env,e.workspaceConfig);if(!o&&!process.env.CARGO_REGISTRY_TOKEN)throw new u({code:"AUTH_MISSING",hint:"Set CARGO_REGISTRY_TOKEN, or run from a GH-Actions job with `permissions: id-token: write` for OIDC trusted publishing.",message:`Cannot publish ${a}@${e.release.newVersion}: neither CARGO_REGISTRY_TOKEN nor OIDC trusted publishing is available.`,packageName:e.pkg.name});const c=e.workspaceConfig?.publish?.guards;if(c?.packSecretScan){const m=await ts(e.pm.runner,n);if(m.length>0){const{runPackSecretScan:b}=await import("./publish-guards.js"),w=typeof c.packSecretScan=="object"?c.packSecretScan.ignore:void 0,k=await b({files:m,ignore:w,pkgDir:n});if(!k.passed){const{redactTokens:C}=await import("./security.js"),E=k.findings.map(v=>`  • [packSecretScan] ${C(v.message)}${v.hint?`
-      → ${C(v.hint)}`:""}`).join(`
-`);throw new u({code:"PUBLISH_FAILED",message:`Pre-publish secret scan failed for ${a}@${e.release.newVersion}:
-${E}`,packageName:e.pkg.name})}}}const p=["publish","--allow-dirty"];e.registry&&e.registry!=="https://crates.io"&&p.push("--registry",e.registry);const l=await e.pm.runner.run("cargo",p,{cwd:n,silent:!1});if(l.exitCode!==0)throw new u({code:"PUBLISH_FAILED",hint:"Inspect the cargo output above. Common causes: missing CARGO_REGISTRY_TOKEN, OIDC permission misconfigured, version already published, crates.io rate limit. Re-runs are safe — the published-version probe short-circuits subsequent runs.",message:`cargo publish failed for ${a}@${e.release.newVersion}: exit ${l.exitCode}. stderr: ${l.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});return{output:`[cargo] published ${a}@${e.release.newVersion}${o?" (trusted publishing)":""}`,published:!0}}}const K=(s,e)=>{const r=e?.cargoTomlPath??ns;return f(s.dir,r)},os=(s,e)=>G(K(s,e)),cs=["linux/amd64","linux/arm64"],ls=s=>{const e=s.indexOf("/");if(e===-1)return{registry:"docker.io",repository:`library/${s}`};const r=s.slice(0,e),n=s.slice(e+1);return r==="localhost"||r.includes(".")||r.includes(":")?{registry:r,repository:n}:n.includes("/")?{registry:"docker.io",repository:s}:{registry:"docker.io",repository:`${r}/${n}`}},se=(s,e)=>{const{registry:r,repository:n}=ls(s);return`https://${r==="docker.io"?"registry-1.docker.io":r}/v2/${n}/manifests/${encodeURIComponent(e)}`},ke=s=>{const e=s??{};return{buildContext:e.buildContext,containerBuildArgs:e.containerBuildArgs,containerImage:e.containerImage,containerPlatforms:e.containerPlatforms,containerSigning:e.containerSigning,containerSkipLatest:e.containerSkipLatest}},ps=(s,e)=>{const r=ke(s);if(typeof r.containerImage!="string"||r.containerImage.length===0)throw new u({code:"CONFIG_INVALID",hint:["Container packages must declare `containerImage` in their per-pkg release config:","",'    release.packages["<pkg>"] = container({','        image: "ghcr.io/scope/foo",','        platforms: ["linux/amd64", "linux/arm64"],','        signing: "cosign", // optional',"    })","",'Or set `versionActions: "container"` + `containerImage` directly.'].join(`
-`),message:`containerImage is required for versionActions: "container" on ${e}`,packageName:e});return{buildContext:r.buildContext,containerBuildArgs:r.containerBuildArgs,containerImage:r.containerImage,containerPlatforms:r.containerPlatforms,containerSigning:r.containerSigning,containerSkipLatest:r.containerSkipLatest}};class us extends _{id="container";async readPublishedVersion(e){const r=ke(e.perPackageConfig);if(!r.containerImage)return;const n=e.pkg.version,a=se(r.containerImage,n);try{return(await N(a,{headers:{Accept:["application/vnd.oci.image.manifest.v1+json","application/vnd.oci.image.index.v1+json","application/vnd.docker.distribution.manifest.v2+json","application/vnd.docker.distribution.manifest.list.v2+json"].join(",")},httpProxy:e.workspaceConfig?.httpProxy,method:"HEAD"})).status===200?n:void 0}catch{return}}async publish(e){const r=ps(e.perPackageConfig,e.pkg.name);if(e.dryRun){const{command:t}=re(e,r);return{output:`[dry-run / container] would run: ${t.join(" ")}`,published:!0}}try{const t=se(r.containerImage,e.release.newVersion);if((await N(t,{httpProxy:e.workspaceConfig?.httpProxy,method:"HEAD"})).status===200)return{alreadyPublished:!0,output:`[container] ${r.containerImage}:${e.release.newVersion} already published`,published:!1}}catch{}const{command:n}=re(e,r),a=await e.pm.runner.run(n[0],n.slice(1),{cwd:e.pkg.dir,silent:!1});if(a.exitCode!==0)throw new u({code:"PUBLISH_FAILED",hint:["docker buildx build failed. Common causes:","  • Not authenticated to the registry — run `docker login <registry>` first.","    For ECR: `aws ecr get-login-password --region <r> | docker login --username AWS --password-stdin <account>.dkr.ecr.<r>.amazonaws.com`","    For GCR/GAR: `gcloud auth configure-docker <region>-docker.pkg.dev`","    For GHCR: `echo $GITHUB_TOKEN | docker login ghcr.io -u <user> --password-stdin`","  • Buildx not installed / configured — `docker buildx create --use` (one-time setup).","  • Multi-arch build needs QEMU registered — `docker run --privileged --rm tonistiigi/binfmt --install all`."].join(`
-`),message:`docker buildx failed for ${e.pkg.name}@${e.release.newVersion}: exit ${a.exitCode}. stderr: ${a.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});if(r.containerSigning==="cosign"){const t=`${r.containerImage}:${e.release.newVersion}`,i=await e.pm.runner.run("cosign",["sign","--yes",t],{cwd:e.pkg.dir,silent:!1});if(i.exitCode!==0)throw new u({code:"PUBLISH_FAILED",hint:"cosign signing failed. For keyless cosign, ensure COSIGN_EXPERIMENTAL=1 (cosign <2.0) and the CI runner has the OIDC token (`id-token: write` permission on GH Actions).",message:`cosign sign failed for ${t}: exit ${i.exitCode}. stderr: ${i.stderr.trim().slice(0,500)}`,packageName:e.pkg.name})}return{output:`[container] published ${r.containerImage}:${e.release.newVersion}${r.containerSkipLatest?"":" + :latest"}${r.containerSigning==="cosign"?" (signed via cosign)":""}`,published:!0}}}const re=(s,e)=>{if(!e.containerImage)throw new Error("buildBuildxCommand requires config.containerImage");const r=(e.containerPlatforms??cs).join(","),n=`${e.containerImage}:${s.release.newVersion}`,a=`${e.containerImage}:latest`,t=e.buildContext??".",i=["docker","buildx","build","--platform",r,"-t",n];e.containerSkipLatest||i.push("-t",a);for(const[o,c]of Object.entries(e.containerBuildArgs??{}))i.push("--build-arg",`${o}=${c}`);return i.push("--label",`org.opencontainers.image.version=${s.release.newVersion}`),i.push("--label",`org.opencontainers.image.title=${s.pkg.name}`),i.push("--push",t),{command:i}},ds="https://jsr.io",ms=/^@[a-z0-9-]+\/[a-z0-9-]+$/i,ne=async s=>{let e;try{e=await A(s,"utf8")}catch(n){throw new u({cause:n,code:"CONFIG_INVALID",file:s,message:`Failed to read JSR manifest at ${s}: ${n.message}`})}let r;try{r=JSON.parse(e)}catch(n){throw new u({cause:n,code:"CONFIG_INVALID",file:s,message:`Failed to parse JSR manifest at ${s}: ${n.message}`})}if(typeof r.name!="string"||r.name.length===0)throw new u({code:"CONFIG_INVALID",file:s,hint:"JSR manifests must declare a `name` field with the `@scope/name` form.",message:`JSR manifest at ${s} is missing the \`name\` field.`});if(!ms.test(r.name))throw new u({code:"CONFIG_INVALID",file:s,hint:"JSR requires every package to publish under `@scope/name`. Add the `@scope/` prefix and lowercase the name (a-z, 0-9, hyphen).",message:`JSR manifest at ${s} declares an invalid \`name\`: "${r.name}". JSR requires the @scope/name form.`});if(typeof r.version!="string"||r.version.length===0)throw new u({code:"CONFIG_INVALID",file:s,hint:"Add a `version` literal to the JSR manifest, or wire the `jsr()` preset so vis bumps it for you.",message:`JSR manifest at ${s} is missing the \`version\` field.`});return{name:r.name,version:r.version}},ae=async(s,e)=>{const r=`${ds}/${s}/meta.json`;try{const n=await N(r,{headers:{Accept:"application/json"},httpProxy:e});if(n.status===404||!n.ok)return;const a=await n.json();return typeof a?.latest=="string"?a.latest:void 0}catch{return}},gs=(s,e)=>Q({env:s,staticTokenVar:"JSR_API_KEY",workspaceConfig:e})==="oidc",te=(s,e)=>{const r=e?.jsrConfigPath??"jsr.json";return f(s.dir,r)};class hs extends _{id="jsr";async readPublishedVersion(e){const r=te(e.pkg,e.perPackageConfig);try{const{name:n}=await ne(r);return await ae(n,e.workspaceConfig?.httpProxy)}catch{return}}async publish(e){if(e.dryRun)return{output:`[dry-run / jsr] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const r=te(e.pkg,e.perPackageConfig),{name:n,version:a}=await ne(r);if(a!==e.release.newVersion)throw new u({code:"CONFIG_INVALID",file:r,hint:`Confirm the jsr() preset's manifestPath points at the JSR config file the extra-files rule rewrites. Expected ${e.release.newVersion} on disk after the bump.`,message:`JSR manifest version (${a}) does not match planned release version (${e.release.newVersion}) for ${e.pkg.name}.`,packageName:e.pkg.name});if(await ae(n,e.workspaceConfig?.httpProxy)===e.release.newVersion)return{alreadyPublished:!0,output:`[jsr] ${n}@${e.release.newVersion} already on jsr.io`,published:!1};const i=gs(process.env,e.workspaceConfig);if(!i&&!process.env.JSR_API_KEY)throw new u({code:"AUTH_MISSING",hint:"Set JSR_API_KEY for static-token auth, or run from a GH-Actions job with `permissions: id-token: write` so ACTIONS_ID_TOKEN_REQUEST_URL is exposed for OIDC trusted publishing.",message:`Cannot publish ${n}@${e.release.newVersion}: neither JSR_API_KEY nor OIDC trusted publishing is available.`,packageName:e.pkg.name});const o=["jsr","publish","--allow-dirty"],c=e.perPackageConfig?.jsrConfigPath;c!==void 0&&c!=="jsr.json"&&o.push("--config",c);for(const l of e.perPackageConfig?.jsrPublishArgs??[])o.push(l);const p=await e.pm.runner.run("npx",o,{cwd:e.pkg.dir,silent:!1});if(p.exitCode!==0)throw new u({code:"PUBLISH_FAILED",hint:"Inspect the jsr CLI output above. Common causes: invalid JSR_API_KEY, OIDC permission misconfigured, version already published, slow-mode rate limit. Re-runs are safe — the published-version probe short-circuits subsequent runs.",message:`jsr publish failed for ${n}@${e.release.newVersion}: exit ${p.exitCode}. stderr: ${p.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});return{output:`[jsr] published ${n}@${e.release.newVersion}${i?" (trusted publishing)":""}`,published:!0}}}const fs=/<!--[\s\S]*?-->/g,ws=/<project\b[^>]*>([\s\S]*)/i,ie=/<version>\s*([^<]+?)\s*<\/version>/i,oe=/<groupId>\s*([^<]+?)\s*<\/groupId>/i,ce=/<artifactId>\s*([^<]+?)\s*<\/artifactId>/i,ks=/<modules\b[^>]*>[\s\S]*?<module\b/i,le=s=>{const e=s.replaceAll(fs,""),n=ws.exec(e)?.[1]??e,a=n.replaceAll(/<parent\b[\s\S]*?<\/parent>/gi,"").replaceAll(/<dependencyManagement\b[\s\S]*?<\/dependencyManagement>/gi,"").replaceAll(/<dependencies\b[\s\S]*?<\/dependencies>/gi,"").replaceAll(/<build\b[\s\S]*?<\/build>/gi,"").replaceAll(/<profiles\b[\s\S]*?<\/profiles>/gi,"").replaceAll(/<pluginRepositories\b[\s\S]*?<\/pluginRepositories>/gi,"").replaceAll(/<repositories\b[\s\S]*?<\/repositories>/gi,""),t=ie.exec(a)??ie.exec(n),i=oe.exec(a)??oe.exec(n),o=ce.exec(a)??ce.exec(n),c=ks.test(n);return{artifactId:o?.[1],groupId:i?.[1],hasModules:c,version:t?.[1]}},bs=s=>{const e=/<latest>\s*([^<]+?)\s*<\/latest>/i.exec(s);if(e?.[1])return e[1];const r=/<versions>([\s\S]*?)<\/versions>/i.exec(s);return r?[...r[1].matchAll(/<version>\s*([^<]+?)\s*<\/version>/gi)].map(a=>a[1]).at(-1):void 0},ys=(s,e)=>{const r=s.split(".").map(a=>encodeURIComponent(a)).join("/"),n=encodeURIComponent(e);return`https://repo1.maven.org/maven2/${r}/${n}/maven-metadata.xml`},vs=["Native Maven publishing isn't implemented yet. Drop to the generic shell path:","",'  release.packages["<your-pkg>"] = {','      ...pomXml({ pomDir: "jvm/sdk" }),','      versionActions: "shell",','      publishCommand: "mvn -B -ntp deploy",','      checkPublished: "",',"  }","","Configure either `central-publishing-maven-plugin` (recommended for","Sonatype Central Portal) or `nexus-staging-maven-plugin` (legacy OSSRH)","in your pom.xml, plus credentials in ~/.m2/settings.xml.","","Maven Central does not (yet) support OIDC trusted publishing —","static credentials are required. See docs/guides/release-maven.mdx","for the full setup walkthrough."].join(`
-`);class $s extends _{id="maven";warnedMultiModule=new WeakSet;warnIfMultiModule(e,r){!r.hasModules||this.warnedMultiModule.has(e)||(this.warnedMultiModule.add(e),process.stderr.write(`[vis release] ⚠ ${e.name} (${r.groupId??"?"}:${r.artifactId??"?"}) is a multi-module Maven project (<modules> present). vis treats it as a single artifact for version-read + already-published checks. For proper reactor handling, use \`versionActions: "shell"\` with \`mvn -B -ntp deploy\`.
-`))}async readPublishedVersion(e){const r=e.perPackageConfig??{},n=f(e.pkg.dir,r.pomPath??"pom.xml");let a;try{a=await A(n,"utf8")}catch{return}const t=le(a);if(this.warnIfMultiModule(e.pkg,t),!t.groupId||!t.artifactId||r.mavenMetadataUrl==="")return;const i=r.mavenMetadataUrl??ys(t.groupId,t.artifactId);try{const o=await N(i,{headers:{Accept:"text/xml,application/xml;q=0.9,*/*;q=0.8"},httpProxy:e.workspaceConfig?.httpProxy});if(o.status===404||!o.ok)return;const c=await o.text();return bs(c)}catch{return}}async publish(e){const r=e.perPackageConfig??{},n=f(e.pkg.dir,r.pomPath??"pom.xml");let a;try{const o=await A(n,"utf8");a=le(o)}catch{a=void 0}const t=a?.groupId&&a?.artifactId?`${a.groupId}:${a.artifactId}`:e.pkg.name;if(e.dryRun)return{output:`[dry-run / maven] would publish ${e.pkg.name}@${e.release.newVersion} (${t}) (native publish not yet implemented — would use shell path)`,published:!0};const i=`Failing artifact: ${t}
-Pom: ${n}
-
-${vs}`;throw new u({code:"CONFIG_INVALID",hint:i,message:`Native Maven publishing is not implemented for ${e.pkg.name}@${e.release.newVersion} (${t}). Use \`versionActions: "shell"\` with \`mvn deploy\` until the Sonatype Central Portal client lands.`,packageName:e.pkg.name})}}const be=(s,e)=>{if(e===!1)return{...s};const r=new Set(De(e)),n={name:s.name,version:s.version};for(const[a,t]of Object.entries(s))r.has(a)||(n[a]=t);return n},ye="https://registry.npmjs.org/",Is="npm:registry.npmjs.org",pe=async s=>{const e=f(s,"npm");try{return(await Oe(e,{withFileTypes:!0})).filter(n=>n.isDirectory()).map(n=>n.name)}catch{return[]}},Cs=async s=>{const e=s.ACTIONS_ID_TOKEN_REQUEST_URL,r=s.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(!e||!r)return;const n=`${e}${e.includes("?")?"&":"?"}audience=${encodeURIComponent(Is)}`,a=await fetch(n,{headers:{Authorization:`Bearer ${r}`}});if(!a.ok)return;const t=await a.json().catch(()=>({}));return typeof t.value=="string"?t.value:void 0},Ps=async(s,e)=>{const r=await fetch(`${ye}-/npm/v1/oidc/token/exchange/package/${encodeURIComponent(s)}`,{headers:{Authorization:`Bearer ${e}`},method:"POST"});if(!r.ok)return;const n=await r.json().catch(()=>({}));return typeof n.token=="string"?n.token:void 0},ue=async(s,e,r)=>{if(e){const a=await Ps(s,e);if(a)return{source:"oidc",token:a}}const n=r.NPM_TOKEN;if(n)return{source:"NPM_TOKEN",token:n};throw new u({code:"AUTH_MISSING",message:`Cannot publish ${s}: OIDC exchange did not succeed and NPM_TOKEN is not set.`,packageName:s})},de=(s,e)=>{Re(s,`//registry.npmjs.org/:_authToken=${e}
-registry=${ye}
-`)};class Ss extends _{id="native-addon";async readPublishedVersion(e){try{F(e.pkg.name);const{execFileSync:r}=await import("node:child_process");return r("npm",["view",e.pkg.name,"version"],{stdio:["ignore","pipe","ignore"]}).toString().trim()||void 0}catch{return}}async publish(e){if(e.dryRun){const c=await pe(e.pkg.dir);return{output:`[dry-run] would publish ${e.pkg.name}@${e.release.newVersion} + ${c.length} platform package(s)`,published:!0}}const r=await pe(e.pkg.dir);if(r.length===0){const{NpmVersionActions:c}=await Promise.resolve().then(()=>Es);return new c().publish(e)}const{env:n}=process,a=await Cs(n),t=e.release.newVersion,i=new Map,o=[];try{await Promise.all(r.map(async g=>{const d=f(e.pkg.dir,"npm",g,"package.json"),h=await A(d,"utf8");i.set(d,h);const $=JSON.parse(h);$.version=t,await j(d,`${JSON.stringify($,null,4)}
-`)}));const{execFileSync:c}=await import("node:child_process"),p=await Promise.all(r.map(async g=>{const d=f(e.pkg.dir,"npm",g),h=f(d,"package.json"),$=await A(h,"utf8"),y=JSON.parse($);F(y.name);const S=await ue(y.name,a,n),I=B(f(J(),"vis-release-napi-"));o.push(I);const P=f(I,".npmrc");return de(P,S.token),{manifest:y,npmrcPath:P,platform:g,platformDir:d}})),l=e.workspaceConfig?.publish?.guards;if(l&&Object.values(l).some(g=>g!==void 0&&g!==!1&&g!=="off")){const{runPublishGuards:g}=await import("./publish-guards.js");for(const{manifest:d,platformDir:h}of p){const $=c("npm",["pack","--dry-run","--json"],{cwd:h,stdio:["ignore","pipe","ignore"]}).toString();let y=[];try{y=JSON.parse($)[0]?.files?.map(P=>P.path)??[]}catch{}const S=await g({config:l,manifest:d,packFiles:y,pkgDir:h,runner:e.pm.runner,sourceManifest:d});if(S.blockers.length>0){const I=S.blockers.flatMap(P=>P.findings.map(T=>`  • [${P.gate}] ${T.message}${T.hint?`
-      → ${T.hint}`:""}`)).join(`
-`);throw new u({code:"PUBLISH_FAILED",message:`Pre-publish guards failed for ${d.name}@${t} (platform package):
-${I}`,packageName:d.name})}}}const m=e.tag??"latest",b=(g,d)=>{const h=["publish",g,"--tag",m,"--access","public","--userconfig",d];return e.provenance&&h.push("--provenance"),h};for(const{manifest:g,npmrcPath:d,platformDir:h}of p)try{c("npm",b(h,d),{env:{...n,NPM_CONFIG_USERCONFIG:d},stdio:"inherit"})}catch($){const y=$.message;if(!y.includes("EPUBLISHCONFLICT")&&!y.includes("cannot publish over"))throw new u({cause:$,code:"PUBLISH_FAILED",message:`Failed to publish platform package ${g.name}@${t}: ${y}`,packageName:g.name})}const w=e.versionedManifestByName.get(e.pkg.name)??e.pkg.manifest,k={...w},C={...w.optionalDependencies};for(const{manifest:g}of p)Object.hasOwn(C,g.name)&&(C[g.name]=t);k.optionalDependencies=C;const E=z(k,e.catalogs),v=be(E,e.cleanPackageJsonConfig),L=await A(e.pkg.manifestPath,"utf8");try{await j(e.pkg.manifestPath,`${JSON.stringify(v,null,4)}
-`),F(e.pkg.name);const g=await ue(e.pkg.name,a,n),d=B(f(J(),"vis-release-napi-parent-"));o.push(d);const h=f(d,".npmrc");de(h,g.token);const $=c("npm",["pack","--pack-destination",d,"--json"],{cwd:e.pkg.dir,env:n,stdio:["ignore","pipe","ignore"]}).toString();let y;try{const I=JSON.parse($);I[0]?.filename&&(y=f(d,I[0].filename))}catch{}const S=["publish",y??e.pkg.dir,"--tag",m,"--access","public","--userconfig",h];if(e.provenance&&S.push("--provenance"),c("npm",S,{env:{...n,NPM_CONFIG_USERCONFIG:h},stdio:"inherit"}),y){const{hashTarball:I}=await import("./publish-guards.js");return{published:!0,tarball:await I(y)}}return{published:!0}}finally{await j(e.pkg.manifestPath,L)}}finally{for(const[c,p]of i)try{await j(c,p)}catch{}for(const c of o)try{await Ve(c,{force:!0,recursive:!0})}catch{}}}}const As=async(s,e)=>{const{extractPackFilesFromRaw:r}=await import("./publish-guards.js"),n=r(e.raw);if(n!==void 0)return n;const a=await s.pm.runner.run("npm",["pack","--dry-run","--json"],{cwd:s.pkg.dir,silent:!0});if(a.exitCode!==0)return[];try{return r(JSON.parse(a.stdout))??[]}catch{return[]}},me=1800*1e3,ge=15*1e3,he=s=>{if(s===!0)return{enabled:!0,pollIntervalMs:ge,timeoutMs:me};if(s&&typeof s=="object"){const e=s;return{enabled:!0,pollIntervalMs:e.pollIntervalMs??ge,timeoutMs:e.timeoutMs??me}}return{enabled:!1,pollIntervalMs:0,timeoutMs:0}};class ve extends _{id="npm";async readPublishedVersion(e){try{const r=await e.pm.runner.run("npm",["view",e.pkg.name,"version","--silent"],{cwd:e.pkg.dir,silent:!0});return r.exitCode!==0?void 0:r.stdout.trim()||void 0}catch{return}}async publish(e){if(e.dryRun)return{output:`[dry-run] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};if(e.resumeStageId){const p=he(e.workspaceConfig?.publish?.stage);if(!p.enabled)throw new u({code:"CONFIG_INVALID",message:`Cannot resume stage ${e.resumeStageId} for ${e.pkg.name}@${e.release.newVersion}: publish.stage is now disabled. Resolve the stage manually via \`vis release stage approve|reject ${e.resumeStageId}\`.`,packageName:e.pkg.name});return this.resumeStagedPublish(e,p)}const r=e.perPackageConfig&&e.workspaceConfig?W(e.pkg.name,e.perPackageConfig,e.workspaceConfig):{};if(r.buildCommand){const p=H(r.buildCommand,{name:e.pkg.name,version:e.release.newVersion}),l=await e.pm.runner.run(process.platform==="win32"?"cmd":"sh",process.platform==="win32"?["/c",p]:["-c",p],{cwd:e.pkg.dir,silent:!1});if(l.exitCode!==0)throw new Error(`buildCommand failed for ${e.pkg.name}: exit ${l.exitCode}`)}const n=e.versionedManifestByName.get(e.pkg.name)??e.pkg.manifest,a=Ns(n,e.versionedManifestByName),t=z(a,e.catalogs),i=be(t,e.cleanPackageJsonConfig),o=await import("node:fs/promises"),c=await o.readFile(e.pkg.manifestPath,"utf8");try{if(await o.writeFile(e.pkg.manifestPath,`${JSON.stringify(i,null,4)}
-`),r.publishCommand){const l={name:e.pkg.name,version:e.release.newVersion},m=Array.isArray(r.publishCommand)?r.publishCommand:[r.publishCommand];for(const b of m){const w=H(b,l),k=await e.pm.runner.run(process.platform==="win32"?"cmd":"sh",process.platform==="win32"?["/c",w]:["-c",w],{cwd:e.pkg.dir,silent:!1});if(k.exitCode!==0)throw new Error(`publishCommand failed for ${e.pkg.name}: exit ${k.exitCode}`)}return{output:`[custom] published ${e.pkg.name}@${e.release.newVersion}`,published:!0}}const p=B(f(J(),"vis-release-pack-"));try{const l=await e.pm.pack({cwd:e.pkg.dir,destination:p}),m=e.workspaceConfig?.publish?.guards;if(m&&Object.values(m).some(d=>d!==void 0&&d!==!1&&d!=="off")){const{runPublishGuards:d}=await import("./publish-guards.js"),h=await As(e,l),$=await d({config:m,manifest:i,packFiles:h,pkgDir:e.pkg.dir,runner:e.pm.runner,sourceManifest:e.pkg.manifest});if($.blockers.length>0){const{redactTokens:y}=await import("./security.js"),S=$.blockers.flatMap(I=>I.findings.map(P=>`  • [${I.gate}] ${y(P.message)}${P.hint?`
-      → ${y(P.hint)}`:""}`)).join(`
-`);throw new u({code:"PUBLISH_FAILED",message:`Pre-publish guards failed for ${e.pkg.name}@${e.release.newVersion}:
-${S}`,packageName:e.pkg.name})}}const{hashTarball:b}=await import("./publish-guards.js"),w=await b(l.tarball);if((e.workspaceConfig?.publish?.publishStrategy??"npm-publish-tarball")==="native"){const d=e.pm.id;return e.provenance&&d==="bun"&&process.stderr.write(`[vis release] ⚠ publishStrategy "native": bun has no --provenance/OIDC support; ${e.pkg.name}@${e.release.newVersion} publishes without provenance.
-`),e.otp&&d==="yarn"&&process.stderr.write(`[vis release] ⚠ publishStrategy "native": \`yarn npm publish\` ignores --otp; configure 2FA via .yarnrc.yml for ${e.pkg.name}.
-`),{...await e.pm.publishNative({access:"public",cwd:e.pkg.dir,otp:e.otp,provenance:e.provenance,registry:e.registry,tag:e.tag}),tarball:w}}const k=he(e.workspaceConfig?.publish?.stage);if(k.enabled){const{refuseRestrictedOidc:d}=await import("./stage-publisher.js"),h=e.pkg.manifest.publishConfig?.access;d(h)}const C=await e.pm.publish({access:"public",otp:e.otp,provenance:e.provenance,registry:e.registry,stage:k.enabled,tag:e.tag,tarball:l.tarball});if(!k.enabled||!C.stageId)return{...C,tarball:w};const{waitForStageDecision:E}=await import("./stage-publisher.js"),{stageId:v}=C,L=Date.now();process.stderr.write(`[vis release] ⏳ ${e.pkg.name}@${e.release.newVersion} staged (id ${v}). Waiting up to ${Math.round(k.timeoutMs/6e4)}m for a maintainer to approve via npmjs.com or \`npm stage approve ${v}\`...
-`);const g=await E({cwd:e.pkg.dir,onProgress:d=>{d>0&&d%3e5<k.pollIntervalMs&&process.stderr.write(`[vis release] still waiting for ${e.pkg.name} stage decision (${Math.round(d/6e4)}m elapsed)...
-`)},packageName:e.pkg.name,pollIntervalMs:k.pollIntervalMs,runner:e.pm.runner,stageId:v,timeoutMs:k.timeoutMs,version:e.release.newVersion});return g==="approved"?(process.stderr.write(`[vis release] ✓ ${e.pkg.name}@${e.release.newVersion} approved + promoted (${Math.round((Date.now()-L)/1e3)}s).
-`),{...C,stageId:void 0,tarball:w}):g==="rejected"?(process.stdout.write(`::warning::Stage rejected for ${e.pkg.name}@${e.release.newVersion} (id ${v}). Re-stage by re-running the release once the review feedback is addressed.
-`),{alreadyPublished:!1,output:`stage-rejected: ${v}`,published:!1,stageId:v}):(process.stdout.write(`::warning::Stage timeout for ${e.pkg.name}@${e.release.newVersion} (id ${v}) after ${Math.round(k.timeoutMs/6e4)}m. Re-run \`vis release publish\` once a maintainer can approve, or run \`vis release stage approve ${v}\` manually.
-`),{alreadyPublished:!1,output:`stage-timeout: ${v}`,published:!1,stageId:v})}finally{await o.rm(p,{force:!0,recursive:!0})}}finally{await o.writeFile(e.pkg.manifestPath,c)}}async resumeStagedPublish(e,r){const n=e.resumeStageId,a=Date.now();process.stderr.write(`[vis release] ↻ Resuming wait on staged ${e.pkg.name}@${e.release.newVersion} (id ${n}) — tarball already uploaded; not re-publishing.
-`);const{waitForStageDecision:t}=await import("./stage-publisher.js"),i=await t({cwd:e.pkg.dir,onProgress:o=>{o>0&&o%3e5<r.pollIntervalMs&&process.stderr.write(`[vis release] still waiting for ${e.pkg.name} stage decision (resume, ${Math.round(o/6e4)}m elapsed)...
-`)},packageName:e.pkg.name,pollIntervalMs:r.pollIntervalMs,runner:e.pm.runner,stageId:n,timeoutMs:r.timeoutMs,version:e.release.newVersion});return i==="approved"?(process.stderr.write(`[vis release] ✓ ${e.pkg.name}@${e.release.newVersion} approved + promoted on resume (${Math.round((Date.now()-a)/1e3)}s).
-`),{output:`[resumed] published ${e.pkg.name}@${e.release.newVersion}`,published:!0}):i==="rejected"?(process.stdout.write(`::warning::Stage rejected on resume for ${e.pkg.name}@${e.release.newVersion} (id ${n}).
-`),{alreadyPublished:!1,output:`stage-rejected: ${n}`,published:!1,stageId:n}):(process.stdout.write(`::warning::Stage timeout on resume for ${e.pkg.name}@${e.release.newVersion} (id ${n}) after ${Math.round(r.timeoutMs/6e4)}m.
-`),{alreadyPublished:!1,output:`stage-timeout: ${n}`,published:!1,stageId:n})}}const _s=["dependencies","devDependencies","peerDependencies","optionalDependencies"],Ns=(s,e)=>{const r={...s};for(const n of _s){const a=s[n];if(!a||typeof a!="object")continue;const t={...a};for(const[i,o]of Object.entries(a)){if(!o.startsWith("workspace:"))continue;const c=e.get(i);c&&(t[i]=fe(o.slice(10)==="*"?"*":o,c.version),t[i].startsWith("workspace:")&&(t[i]=t[i].slice(10)))}r[n]=t}return r},Es=Object.defineProperty({__proto__:null,NpmVersionActions:ve},Symbol.toStringTag,{value:"Module"});class Vs extends _{id="private";async readPublishedVersion(e){}async publish(e){return{output:`[private] skipped publish for ${e.pkg.name}@${e.release.newVersion}`,published:!1}}}const $e=s=>`https://pypi.org/pypi/${encodeURIComponent(s.toLowerCase())}/json`,Os=(s,e)=>e?.uvLockPath?f(s.dir,e.uvLockPath):f(s.dir,"uv.lock"),js=async(s,e)=>{let r;try{r=await D(s)}catch{return"no-root-pyproject"}if(r===void 0)return"no-root-pyproject";const n=r.tool?.uv?.workspace?.members;if(!Array.isArray(n)||n.length===0)return"no-workspace";const a=e.replace(/^\.\//,"").replaceAll("\\","/");for(const t of n){if(typeof t!="string")continue;const i=t.replace(/^\.\//,"").replaceAll("\\","/");if(i===a)return"member";if(i.endsWith("/*")){const o=i.slice(0,-2);if(a.startsWith(`${o}/`)&&!a.slice(o.length+1).includes("/"))return"member"}if(i.endsWith("/**")){const o=i.slice(0,-3);if(a===o||a.startsWith(`${o}/`))return"member"}}return"missing"},D=async s=>{const e=f(s,"pyproject.toml");let r;try{r=await A(e,"utf8")}catch(a){const{code:t}=a;if(t==="ENOENT")return;throw new u({cause:a,code:"BUMP_FILE_INVALID",file:e,message:`Failed to read ${e}: ${a.message}`})}const{parse:n}=await import("./index6.js");try{return n(r)}catch(a){throw new u({cause:a,code:"BUMP_FILE_INVALID",file:e,message:`Failed to parse ${e}: ${a.message}`})}},Ie=async(s,e)=>{try{return(await s.run("uv",["--version"],{cwd:e,silent:!0})).exitCode===0}catch{return!1}},Ce=s=>{const e=s?.["build-system"]?.["build-backend"];return e?e.startsWith("hatchling")?"hatch":e.startsWith("poetry.core")||e.startsWith("poetry_core")?"poetry":e.startsWith("pdm.backend")||e.startsWith("pdm_backend")?"pdm":e.startsWith("setuptools")?"setuptools":e.startsWith("uv_build")||e.startsWith("uv.build")?"uv":"unknown":"unknown"},Pe=(s,e)=>s==="uv"||s==="unknown"&&e?{backend:s,buildCommand:{args:["build"],binary:"uv"},hasUv:e,publishCommand:{args:["publish"],binary:"uv"}}:{backend:s,buildCommand:{args:["-m","build"],binary:"python"},hasUv:e,publishCommand:{args:["upload","dist/*"],binary:"twine"}},Se=(s,e)=>Q({env:s,staticTokenVar:"TWINE_PASSWORD",workspaceConfig:e}),q=async(s,e)=>{try{const r=await N($e(s),{headers:{Accept:"application/json"},httpProxy:e});return r.status===404||!r.ok?void 0:(await r.json())?.info?.version}catch{return}},Y=(s,e)=>e?.pythonProjectDir?f(s.dir,e.pythonProjectDir):s.dir;class Ae extends _{id="python";async readPublishedVersion(e){const r=Y(e.pkg,e.perPackageConfig),a=(await D(r).catch(()=>{}))?.project?.name??e.pkg.name.replace(/^@[^/]+\//,"");return q(a)}async publish(e){if(e.dryRun)return{output:`[dry-run / python] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const r=e.perPackageConfig??{},n=Y(e.pkg,r),a=await D(n);if(a?.project?.dynamic?.includes("version"))throw new u({code:"CONFIG_INVALID",file:f(n,"pyproject.toml"),hint:"Dynamic versioning isn't supported by PythonVersionActions yet; use versionActions: 'shell' with your build backend's version-bump tool (e.g. `hatch version` or `poetry version` for non-vcs setups).",message:`${e.pkg.name}: pyproject.toml declares dynamic = ["version", ...]; PythonVersionActions requires a static [project] version.`,packageName:e.pkg.name});if(a?.project?.version&&a.project.version!==e.release.newVersion)throw new u({code:"BUMP_FILE_INVALID",file:f(n,"pyproject.toml"),hint:`Ensure the pyproject() preset is wired up for this package so the version literal in [project] is bumped before publish. Expected ${e.release.newVersion}, found ${a.project.version}.`,message:`${e.pkg.name}: pyproject.toml version ${a.project.version} differs from planned ${e.release.newVersion}.`,packageName:e.pkg.name});const t=a?.project?.name??e.pkg.name.replace(/^@[^/]+\//,"");if(await q(t,e.workspaceConfig?.httpProxy)===e.release.newVersion)return{alreadyPublished:!0,output:`[python] ${t}@${e.release.newVersion} already on PyPI`,published:!1};const o=await Ie(e.pm.runner,e.pkg.dir),c=Ce(a),p=Pe(c,o),l=Se(process.env,e.workspaceConfig);if(l==="missing")throw new u({code:"AUTH_MISSING",hint:["Set TWINE_PASSWORD to a PyPI API token (`TWINE_USERNAME=__token__` is injected automatically), OR","configure trusted publishing on PyPI and grant the workflow `permissions: id-token: write` so ACTIONS_ID_TOKEN_REQUEST_URL is exposed.","See https://docs.pypi.org/trusted-publishers/"].join(" "),message:`${e.pkg.name}: no PyPI credentials detected (neither TWINE_PASSWORD nor OIDC trusted-publishing env).`,packageName:e.pkg.name});const m=await e.pm.runner.run(p.buildCommand.binary,p.buildCommand.args,{cwd:n,silent:!1});if(m.exitCode!==0)throw new u({code:"PUBLISH_FAILED",hint:`Inspect the ${p.buildCommand.binary} ${p.buildCommand.args.join(" ")} output above. Common causes: missing ${p.backend==="uv"?"uv":"build/setuptools/wheel"} dependency, broken pyproject.toml, source files missing from \`include\`.`,message:`${e.pkg.name}: build failed (${p.buildCommand.binary} ${p.buildCommand.args.join(" ")}): exit ${m.exitCode}. stderr: ${m.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});const b={...process.env};l==="token"&&!b.TWINE_USERNAME&&(b.TWINE_USERNAME="__token__");const w=await e.pm.runner.run(p.publishCommand.binary,p.publishCommand.args,{cwd:n,env:b,silent:!1});if(w.exitCode!==0)throw new u({code:"PUBLISH_FAILED",hint:`Inspect the ${p.publishCommand.binary} output above. Common causes: invalid API token, version already published (this should have been caught by readPublishedVersion — file a vis bug), 2FA required without a token.`,message:`${e.pkg.name}: publish failed (${p.publishCommand.binary} ${p.publishCommand.args.join(" ")}): exit ${w.exitCode}. stderr: ${w.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});return{output:`[python/${p.backend}${p.hasUv?"+uv":""}] published ${t}@${e.release.newVersion}`,published:!0}}}const Js=Object.defineProperty({__proto__:null,PYPI_PROJECT_URL:$e,PythonVersionActions:Ae,checkUvWorkspaceMembership:js,detectAuthMode:Se,detectBackend:Ce,detectUv:Ie,fetchPyPiVersion:q,readPyProject:D,resolveBuildEnv:Pe,resolveProjectDir:Y,resolveUvLockPath:Os},Symbol.toStringTag,{value:"Module"}),M=async(s,e,r,n)=>{const a=H(r,n),t=process.platform==="win32",i=t?"cmd":"sh",o=t?["/c",a]:["-c",a];return s.run(i,o,{cwd:e,silent:!1})};class Rs extends _{id="shell";async readPublishedVersion(e){const r=e.perPackageConfig??{},{workspaceConfig:n}=e;if(!n)return;const a=W(e.pkg.name,r,n);if(!a.checkPublished)return;const t=await M(e.pm.runner,e.pkg.dir,a.checkPublished,{name:e.pkg.name,version:e.pkg.version});if(t.exitCode!==0)return;const i=t.stdout.trim();return/\b\d+\.\d+\.\d+(?:[-+][\w.+-]+)?\b/.exec(i)?.[0]}async publish(e){if(e.dryRun)return{output:`[dry-run / shell] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const{workspaceConfig:r}=e,n=e.perPackageConfig??{};if(!r)throw new u({code:"CONFIG_INVALID",message:`Shell publish actions for ${e.pkg.name} require a workspace config (release.allowCustomCommands gate).`,packageName:e.pkg.name});const a=W(e.pkg.name,n,r);if(!a.publishCommand)throw new u({code:"CONFIG_INVALID",hint:`Set release.allowCustomCommands (workspace-wide boolean or an allow-list including "${e.pkg.name}") and configure release.packages["${e.pkg.name}"].publishCommand.`,message:`Shell publish actions for ${e.pkg.name} require a publishCommand AND the trust gate to permit it.`,packageName:e.pkg.name});const t={name:e.pkg.name,registry:e.registry,tag:e.tag,version:e.release.newVersion};if(a.checkPublished){const o=await M(e.pm.runner,e.pkg.dir,a.checkPublished,t);if(o.exitCode===0&&/\b\d+\.\d+\.\d+(?:[-+][\w.+-]+)?\b/.exec(o.stdout.trim())?.[0]===e.release.newVersion)return{alreadyPublished:!0,output:`[shell] ${e.pkg.name}@${e.release.newVersion} already on the registry`,published:!1}}if(a.buildCommand){const o=await M(e.pm.runner,e.pkg.dir,a.buildCommand,t);if(o.exitCode!==0)throw new u({code:"PUBLISH_FAILED",message:`buildCommand failed for ${e.pkg.name}: exit ${o.exitCode}. stderr: ${o.stderr.trim().slice(0,500)}`,packageName:e.pkg.name})}const i=Array.isArray(a.publishCommand)?a.publishCommand:[a.publishCommand];for(const o of i){const c=await M(e.pm.runner,e.pkg.dir,o,t);if(c.exitCode!==0)throw new u({code:"PUBLISH_FAILED",hint:"Inspect the publishCommand output above. Common causes: missing auth token, registry unreachable, version already published (re-run safe — `checkPublished` short-circuits subsequent runs).",message:`publishCommand failed for ${e.pkg.name}@${e.release.newVersion}: exit ${c.exitCode}. stderr: ${c.stderr.trim().slice(0,500)}`,packageName:e.pkg.name})}return{output:`[shell] published ${e.pkg.name}@${e.release.newVersion}`,published:!0}}}const Ws=s=>{switch(s){case"cargo":return new is;case"container":return new us;case"jsr":return new hs;case"maven":return new $s;case"native-addon":return new Ss;case"private":return new Vs;case"python":return new Ae;case"shell":return new Rs;default:return new ve}};export{fe as a,Ws as b,be as c,Be as d,Gs as e,Bs as f,Js as g,Ye as p,z as r};
+${e.trimStart()}`},Ls=(r,e)=>{const s=Fs(e);return`${JSON.stringify(r,null,s)}
+`},Fs=r=>{if(!r)return 4;const e=/\n(\s+)"/.exec(r);if(!e)return 4;const s=(e[1]??"").length;return s===2||s===4?s:4},Ms=r=>`${r.dir}/CHANGELOG.md`,Ts=r=>{const e=new Date().toISOString().slice(0,10),s=[`## ${r.newVersion}`,`<sub>${e}</sub>`,""];if(r.isCascadeBump||r.isGroupBump)for(const t of r.sources)s.push(`- Version bump from ${t.name}@${t.newVersion}`);else if(r.isDependencyBump&&r.changeFiles.length===0)for(const t of r.sources)t.newVersion===""?s.push(`- Removed dependency ${t.name}`):s.push(`- Updated dependency ${t.name}@${t.newVersion}`);else for(const t of r.changeFiles)for(const n of t.body.split(/\r?\n/)){if(n.trim()===""){s.push("");continue}s.push(n.startsWith("-")||n.startsWith("*")?n:`- ${n}`)}return s.join(`
+`)},Gs=["dependencies","devDependencies","peerDependencies","optionalDependencies"],we={default:{},named:{}},Us=r=>{if(!r)return we;let e;try{e=_s(r,{strict:!0})}catch(n){throw new g({cause:n,code:"CONFIG_INVALID",message:`Failed to parse pnpm-workspace.yaml: ${n.message}`})}if(typeof e!="object"||e===null||Array.isArray(e))return we;const s=e,t={default:{},named:{}};if(typeof s.catalog=="object"&&s.catalog!==null&&!Array.isArray(s.catalog))for(const[n,a]of Object.entries(s.catalog))typeof a=="string"&&(t.default[n]=a);if(typeof s.catalogs=="object"&&s.catalogs!==null&&!Array.isArray(s.catalogs))for(const[n,a]of Object.entries(s.catalogs)){if(typeof a!="object"||a===null||Array.isArray(a))continue;const i={};for(const[o,c]of Object.entries(a))typeof c=="string"&&(i[o]=c);t.named[n]=i}return t},Ye=(r,e,s)=>{if(!r.startsWith("catalog:"))return r;const t=r.slice(8),n=t===""?s.default:s.named[t];if(n)return n[e]},de=(r,e)=>{const s={...r};for(const t of Gs){const n=r[t];if(!n||typeof n!="object")continue;const a={...n};for(const[i,o]of Object.entries(n)){if(!o.startsWith("catalog:"))continue;const c=Ye(o,i,e);if(c===void 0)throw new g({code:"CONFIG_INVALID",message:`Cannot resolve "${o}" for dependency "${i}" in package "${r.name}". Add it to pnpm-workspace.yaml's "catalog" or "catalogs" block.`,packageName:r.name});a[i]=c}s[t]=a}return s},At=Object.defineProperty({__proto__:null,parseCatalogs:Us,resolveCatalogRef:Ye,rewriteCatalogRefs:de},Symbol.toStringTag,{value:"Module"}),Xe={"Cargo.toml":"cargo","tauri.conf.json":"tauri"},pe=Object.keys(Xe),Bs=r=>r.replaceAll("\\","/").split("/").pop()??r,L=r=>Xe[Bs(r)],Ws=new Set(["package","workspace.package"]),Hs=/^\s*\[\[?\s*([^\]]+?)\s*\]\]?\s*(?:#.*)?$/,Js=/^(\s*version\s*=\s*)(["'])[^"']*\2/,ze=(r,e,s=Ws)=>{const t=r.split(`
+`);let n="",a=!1;for(let i=0;i<t.length;i++){const o=t[i],c=Hs.exec(o);if(c){n=c[1].replaceAll(/\s+/g,"");continue}if(!s.has(n))continue;const l=Js.exec(o);l&&(a=!0,t[i]=`${l[1]}${l[2]}${e}${l[2]}${o.slice(l[0].length)}`)}return a?{content:t.join(`
+`),found:a}:{found:a}},Qe=(r,e)=>{const s=[];let t,n=0;for(;n<r.length;){const a=r[n];if(a==="{"||a==="["){s.push({isObject:a==="{",key:t}),t=void 0,n++;continue}if(a==="}"||a==="]"){s.pop(),t=void 0,n++;continue}if(a===","){t=void 0,n++;continue}if(a!=='"'){n++;continue}const i=n;for(n++;n<r.length&&r[n]!=='"';)n+=r[n]==="\\"?2:1;n++;const o=r.slice(i,n);let c=n;for(;c<r.length&&/\s/.test(r[c]);)c++;if(r[c]===":"){t=JSON.parse(o),n=c+1;continue}const l=s[s.length-1];if(t!==void 0&&l?.isObject){const d=[...s.slice(1).map(p=>p.key??""),t];if(d.length===e.length&&d.every((p,u)=>p===e[u]))return{end:n,start:i,value:JSON.parse(o)}}}},Ze=r=>{if(typeof r!="object"||r===null)return;const e=r;if(typeof e.version=="string")return["version"];if(typeof e.package?.version=="string")return["package","version"]},xe=(r,e)=>{let s;try{s=JSON.parse(r)}catch{return{delegated:!1,found:!1}}const t=Ze(s);if(!t)return{delegated:!1,found:!1};const n=Qe(r,t);return n?n.value.startsWith(".")||n.value.startsWith("/")?{delegated:!0,found:!0}:{content:`${r.slice(0,n.start)}${JSON.stringify(e)}${r.slice(n.end)}`,delegated:!1,found:!0}:{delegated:!1,found:!1}},es=async(r,e)=>{const s=L(r);if(s==="cargo"){const{parse:t}=await import("./index4.js"),n=t(e),a=n.package?.version,i=typeof a=="string"?a:n.workspace?.package?.version;return typeof i=="string"?{version:i}:void 0}if(s==="tauri"){let t;try{t=JSON.parse(e)}catch{return}const n=Ze(t);if(!n)return;const a=Qe(e,n);return a?a.value.startsWith(".")||a.value.startsWith("/")?{delegated:!0}:{version:a.value}:void 0}},ss=(r,e)=>{for(const s of e)if(!L(s))throw new g({code:"CONFIG_INVALID",hint:`Supported basenames: ${pe.join(", ")}. Use extraFiles for other manifests.`,message:`versionFiles entry "${s}" for ${r} is not a supported version manifest.`})},Ks=async(r,e,s,t,n=new Map)=>{ss(t,e);const a=[];for(const i of e){const o=L(i),c=G(i)?i:f(r,i);let l=n.get(c);if(l===void 0)try{l=await P(c,"utf8")}catch(p){const u=p.code==="ENOENT"?"does not exist":`could not be read (${p.message})`;throw new g({code:"CONFIG_INVALID",file:c,message:`versionFiles: ${t} → ${c} ${u}.`})}const d=o==="cargo"?ze(l,s):xe(l,s);if(!d.found)throw new g({code:"CONFIG_INVALID",file:c,message:`versionFiles: ${t} → no version field found in ${c}.`});d.content!==void 0&&d.content!==l&&a.push({content:d.content,path:c})}return{writes:a}},qs=async r=>{const{entry:e,packageDir:s,packageName:t,packageVersion:n}=r,a=`version-files/${t}/${e}`,i=G(e)?e:f(s,e);if(!L(e))return{message:`${t}: versionFiles entry "${e}" is not a supported manifest. Supported basenames: ${pe.join(", ")}.`,name:a,severity:"warn",status:"fail"};let o;try{o=await P(i,"utf8")}catch{return{message:`${t}: versionFiles entry "${e}" doesn't exist (expected ${i}).`,name:a,severity:"warn",status:"fail"}}let c;try{c=await es(e,o)}catch(l){return{message:`${t}: could not parse ${i}: ${l.message}`,name:a,severity:"warn",status:"fail"}}return c?.delegated?{message:`${e} of ${t} delegates its version to another file.`,name:a,severity:"info",status:"pass"}:c?.version===void 0?{message:`${t}: no version field found in ${i}.`,name:a,severity:"warn",status:"fail"}:c.version===n?{message:`${e} of ${t} matches package.json (${n}).`,name:a,severity:"info",status:"pass"}:{message:`${t}: ${e} declares ${c.version} but package.json declares ${n}. Set the two to the same version by hand; the next release only rewrites them when it bumps the package.`,name:a,severity:"warn",status:"fail"}},Nt=Object.defineProperty({__proto__:null,SUPPORTED_VERSION_FILES:pe,applyVersionFilesForRelease:Ks,assertSupportedVersionFiles:ss,checkVersionFile:qs,readManifestVersion:es,resolveVersionFileKind:L,rewriteCargoVersion:ze,rewriteTauriVersion:xe},Symbol.toStringTag,{value:"Module"}),Ys="[[package]]",rs=(r,e,s)=>{const t=r.split(`
+`);let n=!1,a=-1;const i=[];for(const[o,c]of t.entries())c.trim()===Ys&&(a!==-1&&i.push({end:o,start:a}),a=o);a!==-1&&i.push({end:t.length,start:a});for(const{end:o,start:c}of i){let l,d=-1,p=!1;for(let u=c+1;u<o;u++){const m=t[u],h=/^name\s*=\s*"([^"]+)"\s*$/.exec(m),b=/^version\s*=\s*"[^"]*"\s*$/.exec(m);h&&l===void 0?[,l]=h:b&&d===-1?d=u:/^source\s*=/.test(m)&&(p=!0)}l!==e||p||d===-1||(t[d]=`version = "${s}"${t[d].endsWith("\r")?"\r":""}`,n=!0)}return n?{content:t.join(`
+`),found:n}:{found:n}},j=r=>{const e=Be(r);try{return Cs.native(e)}catch{return e}},ts=async(r,e)=>ns(r,e,"Cargo.lock"),ns=async(r,e,s)=>{const t=j(e);let n=j(r);for(;;){const a=f(n,s);try{return await P(a,"utf8"),a}catch{}if(n===t)return;const i=E(n),o=We(t,i);if(i===n||o.startsWith("..")||G(o))return;n=i}},as=async(r,e)=>{const{parse:s}=await import("./index4.js");try{const t=s(r);return typeof t.package?.name=="string"?t.package.name:void 0}catch(t){throw new g({cause:t,code:"CONFIG_INVALID",file:e,message:`Failed to parse ${e}: ${t.message}`})}},Xs=(r,e)=>{const s=new Set;for(const t of e.versionFiles??[])L(t)==="cargo"&&s.add(G(t)?t:f(r,t));if(e.versionActions==="cargo"){const t=e.cargoTomlPath??"Cargo.toml";s.add(G(t)?t:f(r,t))}return[...s]},zs=async r=>{const{entries:e,pending:s,workspaceRoot:t}=r,n=[],a=[];for(const{manifestPath:i,newVersion:o}of e){let c=s.get(i);if(c===void 0)try{c=await P(i,"utf8")}catch{continue}const l=await as(c,i);if(l===void 0)continue;const d=await ts(E(i),t);if(d===void 0)continue;let p=s.get(d);p===void 0&&(p=await P(d,"utf8"));const u=rs(p,l,o);if(!u.found){n.push(`cargo-lock: ${l} has no workspace-member entry in ${d}; run \`cargo generate-lockfile\` or build once to add it.`);continue}if(u.content!==void 0&&u.content!==p){s.set(d,u.content);const m=a.findIndex(b=>b.path===d),h={content:u.content,path:d};m===-1?a.push(h):a[m]=h}}return{warnings:n,writes:a}},_t=Object.defineProperty({__proto__:null,canonicalPath:j,cargoManifestPaths:Xs,findCargoLock:ts,findLockfile:ns,readCrateName:as,rewriteCargoLockVersion:rs,syncCargoLocks:zs},Symbol.toStringTag,{value:"Module"}),Qs=async(r,e)=>{let s=[r];for(const t of e.split("/").filter(n=>n!==""&&n!==".")){if(t==="**")throw new g({code:"CONFIG_INVALID",message:`Unsupported [workspace].members pattern "${e}": "**" is not supported. List the crate directories explicitly or use "dir/*".`});const n=/[*?[{]/.test(t),a=[];for(const i of s){if(!n){a.push(f(i,t));continue}const o=await ce(i,{withFileTypes:!0}).catch(()=>[]);for(const c of o)c.isDirectory()&&Je(t,c.name)&&a.push(f(i,c.name))}s=a}return s},Zs=(r,e)=>{for(const s of e)if(r===s||r.startsWith(`${s}${He}`))return!0;return!1},is=async r=>{let e=E(j(r));for(;;){const s=f(e,"Cargo.toml"),t=await ne(s);if(t!==void 0){const i=(await Y(t,s)).workspace?.package?.version;if(typeof i=="string")return i}const n=E(e);if(n===e)return;e=n}},ne=async r=>{try{return await P(r,"utf8")}catch{return}},Y=async(r,e)=>{const{parse:s}=await import("./index4.js");try{return s(r)}catch(t){throw new g({cause:t,code:"CONFIG_INVALID",file:e,message:`Failed to parse ${e}: ${t.message}`})}},be=r=>Array.isArray(r)?r.filter(e=>typeof e=="string"):[],Q=r=>typeof r=="object"&&r!==null&&r.workspace===!0,xs=(r,e)=>{const s=Q(r.publish)?e.workspace?.package?.publish:r.publish;return s===!1||Array.isArray(s)&&s.length===0},er=(r,e,s,t)=>{const n=[];for(const[a,i]of Object.entries(r.dependencies??{})){const o=i,c=Q(o),l=c?e.workspace?.dependencies?.[a]:o,d=c?t:s;l===void 0||typeof l!="object"||typeof l.path!="string"||n.push({dir:Be(d,l.path),name:typeof l.package=="string"?l.package:a,requirement:typeof l.version=="string"?l.version:"*"})}return n},sr=async r=>{const{claimedDirs:e,cwd:s}=r,t=f(s,"Cargo.toml"),n=await ne(t);if(n===void 0)return[];const a=await Y(n,t),i=new Set;a.package&&i.add(s);const o=be(a.workspace?.exclude);for(const p of be(a.workspace?.members))for(const u of await Qs(s,p)){const m=We(s,u).split(He).join("/");m.split("/").includes("target")||o.some(h=>Je(h,m))||i.add(u)}const c=new Set([...e].map(p=>j(p))),l=[];for(const p of[...i].sort()){if(Zs(j(p),c))continue;const u=f(p,"Cargo.toml"),m=await ne(u);if(m===void 0)continue;const h=await Y(m,u);if(!h.package)continue;const{name:b}=h.package;if(typeof b!="string"||b==="")throw new g({code:"CONFIG_INVALID",file:u,message:`${u} has a [package] table without a name.`});const A=h.package.version,k=typeof A=="string"?A:Q(A)?a.workspace?.package?.version:void 0;if(typeof k!="string")throw new g({code:"CONFIG_INVALID",file:u,message:`${u} has no resolvable [package].version.`});l.push({dir:p,manifestPath:u,name:b,pathDeps:er(h,a,p,s),private:xs(h.package,a),version:k})}const d=new Map(l.map(p=>[p.dir,p]));return l.map(p=>{const u={};for(const h of p.pathDeps){const b=d.get(h.dir);b&&(u[b.name]=h.requirement)}const m={dependencies:u,name:p.name,private:p.private,version:p.version};return{dir:p.dir,ecosystem:"cargo",manifest:m,manifestPath:p.manifestPath,name:p.name,private:p.private,version:p.version}})},St=Object.defineProperty({__proto__:null,discoverCargoCrates:sr,findInheritedWorkspaceVersion:is,inheritsFromWorkspace:Q,parseCargoDoc:Y},Symbol.toStringTag,{value:"Module"}),rr="ACTIONS_ID_TOKEN_REQUEST_URL",ge=r=>{const e=!!r.env[rr],s=!!r.env[r.staticTokenVar],t=r.workspaceConfig?.publish?.preferStaticToken===!0;return e&&!(t&&s)?"oidc":s?"token":"missing"};let W;const tr="https://github.com/visulima/visulima",nr=async()=>{try{let e=E(As(import.meta.url));for(let s=0;s<6;s+=1){const t=f(e,"package.json");try{const a=await P(t,"utf8"),i=JSON.parse(a);if(i.name==="@visulima/vis"&&typeof i.version=="string")return i.version}catch{}const n=E(e);if(n===e)break;e=n}}catch{}return"unknown"},ar=async()=>(W!==void 0||(W=`vis-release/${await nr()} (+${tr})`),W),ye=new Map,ir=async r=>{const e=ye.get(r);if(e!==void 0)return e;try{const s=await import("./index7.js").then(n=>n.i),t=new s.ProxyAgent(r);return ye.set(r,t),t}catch{return}},or=r=>r===301||r===302||r===303||r===307||r===308,cr=(r,e)=>{try{const s=new URL(r),t=new URL(e);return s.host===t.host&&s.protocol===t.protocol}catch{return!1}},S=async(r,e={})=>{const s=e.maxRedirects??2,n={"User-Agent":await ar(),...e.headers};e.headers?.["User-Agent"]&&(n["User-Agent"]=e.headers["User-Agent"]);let a=r,i=0;const o=e.httpProxy?await ir(e.httpProxy):void 0;for(;;){let c;try{const p=e.fetchImpl??globalThis.fetch,u={headers:n,method:e.method??"GET",redirect:"manual"};o&&(u.dispatcher=o),c=await p(a,u)}catch{return{json:async()=>{},ok:!1,status:0,text:async()=>""}}if(!or(c.status))return{json:async()=>{try{return await c.json()}catch{return}},ok:c.ok,status:c.status,text:async()=>{try{return await c.text()}catch{return""}}};const l=c.headers.get("location")??c.headers.get("Location");if(!l||i>=s)return{json:async()=>{},ok:!1,status:0,text:async()=>""};let d;try{d=new URL(l,a).toString()}catch{return{json:async()=>{},ok:!1,status:0,text:async()=>""}}if(!cr(r,d))return{json:async()=>{},ok:!1,status:0,text:async()=>""};a=d,i+=1}},lr="https://crates.io/api/v1/crates",ur="Cargo.toml",ke=async r=>{let e;try{e=await P(r,"utf8")}catch(o){throw new g({cause:o,code:"CONFIG_INVALID",file:r,message:`Failed to read Cargo.toml at ${r}: ${o.message}`})}const{parse:s}=await import("./index4.js");let t;try{t=s(e)}catch(o){throw new g({cause:o,code:"CONFIG_INVALID",file:r,message:`Failed to parse Cargo.toml at ${r}: ${o.message}`})}if(!t.package)throw new g({code:"CONFIG_INVALID",file:r,hint:"CargoVersionActions only supports publishable crates with a [package] table. For workspace roots, point per-package config at the member crate directory.",message:`Cargo.toml at ${r} has no [package] table.`});const{name:n}=t.package;if(typeof n!="string"||n.length===0)throw new g({code:"CONFIG_INVALID",file:r,message:`Cargo.toml at ${r} is missing [package].name.`});const a=t.package.version;let i;if(typeof a=="string"?i=a:a&&typeof a=="object"&&a.workspace===!0&&(i=await is(r)??t.workspace?.package?.version),typeof i!="string"||i.length===0)throw new g({code:"CONFIG_INVALID",file:r,hint:"Set [package].version explicitly, or — for workspace-inherited versions — ensure the root Cargo.toml carries [workspace.package].version and point per-package config at it.",message:`Cargo.toml at ${r} has no resolvable [package].version.`});return{name:n,version:i}},ve=async(r,e)=>{const s=`${lr}/${encodeURIComponent(r)}`;try{const t=await S(s,{headers:{Accept:"application/json"},httpProxy:e});if(t.status===404||!t.ok)return;const n=await t.json();return n?.crate?.max_stable_version??n?.crate?.max_version??void 0}catch{return}},dr=(r,e)=>ge({env:r,staticTokenVar:"CARGO_REGISTRY_TOKEN",workspaceConfig:e})==="oidc",pr=async(r,e)=>{const s=await r.run("cargo",["package","--list","--allow-dirty"],{cwd:e,silent:!0});return s.exitCode!==0?[]:s.stdout.split(/\r?\n/).map(t=>t.trim()).filter(t=>t.length>0)};class gr extends C{id="cargo";async readPublishedVersion(e){const s=ae(e.pkg);try{const{name:t}=await ke(s);return await ve(t)}catch{return}}async publish(e){if(e.dryRun)return{output:`[dry-run / cargo] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const s=ae(e.pkg,e.perPackageConfig),t=mr(e.pkg,e.perPackageConfig),{name:n,version:a}=await ke(s);if(a!==e.release.newVersion)throw new g({code:"CONFIG_INVALID",file:s,hint:`Confirm the cargo() preset's crateDir points at the directory containing this Cargo.toml. Expected ${e.release.newVersion} on disk after the extra-files bump.`,message:`Cargo.toml version (${a}) does not match planned release version (${e.release.newVersion}) for ${e.pkg.name}.`,packageName:e.pkg.name});if(await ve(n,e.workspaceConfig?.httpProxy)===e.release.newVersion)return{alreadyPublished:!0,output:`[cargo] ${n}@${e.release.newVersion} already on crates.io`,published:!1};const o=dr(process.env,e.workspaceConfig);if(!o&&!process.env.CARGO_REGISTRY_TOKEN)throw new g({code:"AUTH_MISSING",hint:"Set CARGO_REGISTRY_TOKEN, or run from a GH-Actions job with `permissions: id-token: write` for OIDC trusted publishing.",message:`Cannot publish ${n}@${e.release.newVersion}: neither CARGO_REGISTRY_TOKEN nor OIDC trusted publishing is available.`,packageName:e.pkg.name});const c=e.workspaceConfig?.publish?.guards;if(c?.packSecretScan){const p=await pr(e.pm.runner,t);if(p.length>0){const{runPackSecretScan:u}=await import("./publish-guards.js"),m=typeof c.packSecretScan=="object"?c.packSecretScan.ignore:void 0,h=await u({files:p,ignore:m,pkgDir:t});if(!h.passed){const{redactTokens:b}=await import("./security.js"),A=h.findings.map(k=>`  • [packSecretScan] ${b(k.message)}${k.hint?`
+      → ${b(k.hint)}`:""}`).join(`
+`);throw new g({code:"PUBLISH_FAILED",message:`Pre-publish secret scan failed for ${n}@${e.release.newVersion}:
+${A}`,packageName:e.pkg.name})}}}const l=["publish","--allow-dirty"];e.registry&&e.registry!=="https://crates.io"&&l.push("--registry",e.registry);const d=await e.pm.runner.run("cargo",l,{cwd:t,silent:!1});if(d.exitCode!==0)throw new g({code:"PUBLISH_FAILED",hint:"Inspect the cargo output above. Common causes: missing CARGO_REGISTRY_TOKEN, OIDC permission misconfigured, version already published, crates.io rate limit. Re-runs are safe — the published-version probe short-circuits subsequent runs.",message:`cargo publish failed for ${n}@${e.release.newVersion}: exit ${d.exitCode}. stderr: ${d.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});return{output:`[cargo] published ${n}@${e.release.newVersion}${o?" (trusted publishing)":""}`,published:!0}}}const ae=(r,e)=>{const s=e?.cargoTomlPath??ur;return f(r.dir,s)},mr=(r,e)=>E(ae(r,e)),hr=(r,e,s)=>z(r?.releaseTagPattern??"v{version}",{name:e,version:s});class fr extends C{id="composer";async readPublishedVersion(e){}async publish(e){const{name:s}=e.pkg,t=e.release.newVersion,n=hr(e.perPackageConfig,s,t);if(e.dryRun)return{output:`[dry-run / composer] would tag ${n} for ${s}@${t}`,published:!0};if(process.platform==="win32")throw new g({code:"CONFIG_INVALID",message:`${s} cannot be released from Windows yet: the Composer tag path is not tested there. Release from a POSIX runner.`,packageName:s});if((await e.pm.runner.run("git",["--version"],{cwd:e.pkg.dir,silent:!0})).exitCode!==0)throw new g({code:"CONFIG_INVALID",message:`${s} needs git on PATH to release its tag, and git --version failed.`,packageName:s});return await ue({cwd:e.pkg.dir,runner:e.pm.runner},n)?{alreadyPublished:!0,output:`[composer] ${s}@${t} is already tagged ${n}; skipped`,published:!1}:{output:`[composer] ${s}@${t} released by tag ${n}`,published:!0}}}const wr=["linux/amd64","linux/arm64"],br=r=>{const e=r.indexOf("/");if(e===-1)return{registry:"docker.io",repository:`library/${r}`};const s=r.slice(0,e),t=r.slice(e+1);return s==="localhost"||s.includes(".")||s.includes(":")?{registry:s,repository:t}:t.includes("/")?{registry:"docker.io",repository:r}:{registry:"docker.io",repository:`${s}/${t}`}},$e=(r,e)=>{const{registry:s,repository:t}=br(r);return`https://${s==="docker.io"?"registry-1.docker.io":s}/v2/${t}/manifests/${encodeURIComponent(e)}`},os=r=>{const e=r??{};return{buildContext:e.buildContext,containerBuildArgs:e.containerBuildArgs,containerImage:e.containerImage,containerPlatforms:e.containerPlatforms,containerSigning:e.containerSigning,containerSkipLatest:e.containerSkipLatest}},yr=(r,e)=>{const s=os(r);if(typeof s.containerImage!="string"||s.containerImage.length===0)throw new g({code:"CONFIG_INVALID",hint:["Container packages must declare `containerImage` in their per-pkg release config:","",'    release.packages["<pkg>"] = container({','        image: "ghcr.io/scope/foo",','        platforms: ["linux/amd64", "linux/arm64"],','        signing: "cosign", // optional',"    })","",'Or set `versionActions: "container"` + `containerImage` directly.'].join(`
+`),message:`containerImage is required for versionActions: "container" on ${e}`,packageName:e});return{buildContext:s.buildContext,containerBuildArgs:s.containerBuildArgs,containerImage:s.containerImage,containerPlatforms:s.containerPlatforms,containerSigning:s.containerSigning,containerSkipLatest:s.containerSkipLatest}};class kr extends C{id="container";async readPublishedVersion(e){const s=os(e.perPackageConfig);if(!s.containerImage)return;const t=e.pkg.version,n=$e(s.containerImage,t);try{return(await S(n,{headers:{Accept:["application/vnd.oci.image.manifest.v1+json","application/vnd.oci.image.index.v1+json","application/vnd.docker.distribution.manifest.v2+json","application/vnd.docker.distribution.manifest.list.v2+json"].join(",")},httpProxy:e.workspaceConfig?.httpProxy,method:"HEAD"})).status===200?t:void 0}catch{return}}async publish(e){const s=yr(e.perPackageConfig,e.pkg.name);if(e.dryRun){const{command:a}=Ie(e,s);return{output:`[dry-run / container] would run: ${a.join(" ")}`,published:!0}}try{const a=$e(s.containerImage,e.release.newVersion);if((await S(a,{httpProxy:e.workspaceConfig?.httpProxy,method:"HEAD"})).status===200)return{alreadyPublished:!0,output:`[container] ${s.containerImage}:${e.release.newVersion} already published`,published:!1}}catch{}const{command:t}=Ie(e,s),n=await e.pm.runner.run(t[0],t.slice(1),{cwd:e.pkg.dir,silent:!1});if(n.exitCode!==0)throw new g({code:"PUBLISH_FAILED",hint:["docker buildx build failed. Common causes:","  • Not authenticated to the registry — run `docker login <registry>` first.","    For ECR: `aws ecr get-login-password --region <r> | docker login --username AWS --password-stdin <account>.dkr.ecr.<r>.amazonaws.com`","    For GCR/GAR: `gcloud auth configure-docker <region>-docker.pkg.dev`","    For GHCR: `echo $GITHUB_TOKEN | docker login ghcr.io -u <user> --password-stdin`","  • Buildx not installed / configured — `docker buildx create --use` (one-time setup).","  • Multi-arch build needs QEMU registered — `docker run --privileged --rm tonistiigi/binfmt --install all`."].join(`
+`),message:`docker buildx failed for ${e.pkg.name}@${e.release.newVersion}: exit ${n.exitCode}. stderr: ${n.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});if(s.containerSigning==="cosign"){const a=`${s.containerImage}:${e.release.newVersion}`,i=await e.pm.runner.run("cosign",["sign","--yes",a],{cwd:e.pkg.dir,silent:!1});if(i.exitCode!==0)throw new g({code:"PUBLISH_FAILED",hint:"cosign signing failed. For keyless cosign, ensure COSIGN_EXPERIMENTAL=1 (cosign <2.0) and the CI runner has the OIDC token (`id-token: write` permission on GH Actions).",message:`cosign sign failed for ${a}: exit ${i.exitCode}. stderr: ${i.stderr.trim().slice(0,500)}`,packageName:e.pkg.name})}return{output:`[container] published ${s.containerImage}:${e.release.newVersion}${s.containerSkipLatest?"":" + :latest"}${s.containerSigning==="cosign"?" (signed via cosign)":""}`,published:!0}}}const Ie=(r,e)=>{if(!e.containerImage)throw new Error("buildBuildxCommand requires config.containerImage");const s=(e.containerPlatforms??wr).join(","),t=`${e.containerImage}:${r.release.newVersion}`,n=`${e.containerImage}:latest`,a=e.buildContext??".",i=["docker","buildx","build","--platform",s,"-t",t];e.containerSkipLatest||i.push("-t",n);for(const[o,c]of Object.entries(e.containerBuildArgs??{}))i.push("--build-arg",`${o}=${c}`);return i.push("--label",`org.opencontainers.image.version=${r.release.newVersion}`),i.push("--label",`org.opencontainers.image.title=${r.pkg.name}`),i.push("--push",a),{command:i}},vr=r=>`https://pub.dev/api/packages/${encodeURIComponent(r)}`,$r=async r=>{try{const e=await S(vr(r.pkg.name),{headers:{Accept:"application/vnd.pub.v2+json"},httpProxy:r.workspaceConfig?.httpProxy});if(!e.ok)return!1;const s=JSON.parse(await e.text());return Array.isArray(s.versions)&&s.versions.some(t=>t.version===r.release.newVersion)}catch{return!1}};class Ir extends C{id="dart";async readPublishedVersion(e){}async publish(e){const{dir:s,name:t}=e.pkg,n=e.release.newVersion;if(e.dryRun)return{output:`[dry-run / dart] would run dart pub publish --force in ${s} for ${t}@${n}`,published:!0};if(process.platform==="win32")throw new g({code:"CONFIG_INVALID",message:`${t} cannot be published from Windows yet: the Dart path is only verified on POSIX. Publish from a POSIX runner.`,packageName:t});try{const i=await e.pm.runner.run("dart",["--version"],{cwd:s,silent:!0});if(i.exitCode!==0)throw new Error(`exit ${i.exitCode}`)}catch{throw new g({code:"CONFIG_INVALID",message:`${t} needs the Dart SDK to publish, and "dart" is not on PATH. Install the Dart SDK on the runner.`,packageName:t})}if(await $r(e))return{alreadyPublished:!0,output:`[dart] ${t}@${n} is already on pub.dev; skipped`,published:!1};const a=await e.pm.runner.run("dart",["pub","publish","--force"],{cwd:s,silent:!1});if(a.exitCode!==0)throw new g({code:"PUBLISH_FAILED",hint:`Failing command: dart pub publish --force in ${s}
+Check the output above. Authenticate with "dart pub token add https://pub.dev" on this runner, or configure automated publishing (OIDC) for the pub.dev package. Errors stop the upload; warnings do not.`,message:`dart pub publish failed for ${t}@${n}: exit ${a.exitCode}. stderr: ${a.stderr.trim().slice(0,500)}`,packageName:t});return{output:`[dart] published ${t}@${n} to pub.dev`,published:!0}}}const Cr="https://rubygems.org",Pr=async(r,e,s)=>{const t=`${Cr}/api/v1/versions/${encodeURIComponent(r)}.json`;try{const n=await S(t,{headers:{Accept:"application/json"},httpProxy:s.workspaceConfig?.httpProxy});if(!n.ok)return!1;const a=await n.json();return Array.isArray(a)&&a.some(i=>typeof i=="object"&&i!==null&&i.number===e)}catch{return!1}},Ar=async(r,e)=>{try{return(await r.pm.runner.run("gem",["--version"],{cwd:e,silent:!0})).exitCode===0}catch{return!1}};class Nr extends C{id="gem";async readPublishedVersion(e){}async publish(e){const{name:s}=e.pkg,t=e.release.newVersion,n=R(e.pkg.manifestPath),a=`${s}-${t}.gem`,i=e.pkg.dir;if(e.dryRun)return{output:`[dry-run / gem] would run gem build ${n} and gem push ${a} for ${s}@${t}`,published:!0};if(process.platform==="win32")throw new g({code:"CONFIG_INVALID",message:`${s} cannot be published from Windows yet: the gem path is only verified on POSIX. Publish from a POSIX runner.`,packageName:s});if(!await Ar(e,i))throw new g({code:"CONFIG_INVALID",message:`${s} needs the gem command on PATH to publish, and "gem --version" failed. Install Ruby (which ships RubyGems) on the runner.`,packageName:s});if(await Pr(s,t,e))return{alreadyPublished:!0,output:`[gem] ${s}@${t} is already on RubyGems; skipped`,published:!1};const o=await e.pm.runner.run("gem",["build",n],{cwd:i,silent:!1});if(o.exitCode!==0)throw new g({code:"PUBLISH_FAILED",hint:`Failing step: gem build ${n} in ${i}
+Fix the gemspec validation error above.`,message:`gem build failed for ${s}@${t}: exit ${o.exitCode}. stderr: ${o.stderr.trim().slice(0,500)}`,packageName:s});try{const c=await e.pm.runner.run("gem",["push",a],{cwd:i,silent:!1});if(c.exitCode!==0)throw new g({code:"PUBLISH_FAILED",hint:`Failing step: gem push ${a}
+Check the output above. Credentials come from GEM_HOST_API_KEY in the environment; a gem push to an existing version is refused by RubyGems.`,message:`gem push failed for ${s}@${t}: exit ${c.exitCode}. stderr: ${c.stderr.trim().slice(0,500)}`,packageName:s})}finally{await le(f(i,a),{force:!0})}return{output:`[gem] published ${s}@${t} (${a})`,published:!0}}}const _r=(r,e,s)=>z(r?.releaseTagPattern??"v{version}",{name:e,version:s});class Sr extends C{id="go";async readPublishedVersion(e){}async publish(e){const{name:s}=e.pkg,t=e.release.newVersion,n=_r(e.perPackageConfig,s,t);if(e.dryRun)return{output:`[dry-run / go] would tag ${n} for ${s}@${t}`,published:!0};if(process.platform==="win32")throw new g({code:"CONFIG_INVALID",message:`${s} cannot be released from Windows yet: the Go tag path is not tested there. Release from a POSIX runner.`,packageName:s});if((await e.pm.runner.run("git",["--version"],{cwd:e.pkg.dir,silent:!0})).exitCode!==0)throw new g({code:"CONFIG_INVALID",message:`${s} needs git on PATH to release its tag, and git --version failed.`,packageName:s});return await ue({cwd:e.pkg.dir,runner:e.pm.runner},n)?{alreadyPublished:!0,output:`[go] ${s}@${t} is already tagged ${n}; skipped`,published:!1}:{output:`[go] ${s}@${t} released by tag ${n}`,published:!0}}}const Ce=["build.gradle.kts","build.gradle"],cs=["settings.gradle.kts","settings.gradle"],D=(r,e)=>new g({code:"CONFIG_INVALID",file:r,message:e}),Vr=async(r,e)=>{for(const s of new Set([f(r,"gradle.properties"),f(e,"gradle.properties")])){let t;try{t=await P(s,"utf8")}catch{continue}if(/^\s*version\s*[=:]/m.test(t))return s}},Or=r=>Ue(r).then(()=>!0,()=>!1),K=async(r,e)=>{for(const s of e){const t=f(r,s);try{return{path:t,raw:await P(t,"utf8")}}catch{}}},H=(r,e,s)=>{if(r.length===0)return;if(r.length>1)throw D(e,`${e} declares ${s} ${r.length} times on the path that reaches a module (lines ${r.map(n=>n.line).join(", ")}). vis cannot tell which one applies.`);const[t]=r;if(t.literal===void 0)throw D(e,`${e} sets ${s} to an expression on line ${t.line}. vis reads only a plain string literal, such as ${s} = "1.0.0".`);return{assignment:t,value:t.literal.value}},Er=async r=>{const{claimedDirs:e,cwd:s}=r,t=await K(s,Ce),n=await K(s,cs);if(!t&&!n)return[];const a=n?Ns(n.raw):void 0;if(a?.unsupported.length)throw D(n.path,`${n.path} moves a project (${a.unsupported.join(", ")}). vis cannot follow that to a version; remove it or release the module with a shell publish.`);a?.dynamicIncludes&&process.stderr.write(`[vis release] ⚠ ${n.path} builds part of its include list from code; vis only reads literal include("…") entries.
+`);const i=t?me(t.raw):void 0,o=i?.assignments??[],c=[];t&&c.push({build:t,dir:s,isRoot:!0,path:"",taskPath:""});for(const u of a?.includes??[]){const m=f(s,u),h=await K(m,Ce);h&&c.push({build:h,dir:m,isRoot:!1,path:u,taskPath:`:${u.replaceAll("/",":")}`})}const l=[];for(const u of c){if(e.has(u.dir))continue;const m=u.isRoot&&i?i:me(u.build.raw),h=H(he(m.assignments,"version"),u.build.path,"version");if(u.isRoot&&h===void 0)continue;const b=h?void 0:H(fe(o,"version",u.isRoot),t?.path??u.build.path,"version"),A=h??b;if(!A){const y=await Vr(u.dir,s);if(y!==void 0)throw D(y,`${y} sets version, and vis reads only a string literal in a build script. Move it to version = "…" in ${u.build.path}, or remove it.`);continue}const k=H(he(m.assignments,"group"),u.build.path,"group")??H(fe(o,"group",u.isRoot),t?.path??u.build.path,"group");if(k===void 0)throw D(u.build.path,`${u.build.path} has a version but no group. Declare group = "…" in its build script or in the root build script's allprojects block.`);if(m.usesArchiveName||i?.usesArchiveName)throw D(u.build.path,`${u.build.path} renames its archive (archivesName). vis cannot read the artifact name from that; remove it or release the module with a shell publish.`);const O=u.isRoot?a?.rootName??R(s):R(u.dir);l.push({kind:h?"literal":"inherited",line:A.assignment.line,module:u,name:`${k.value}:${O}`,owner:h?u.build.path:t.path,scan:m,version:A.value})}const d=new Map;for(const u of l){const m=d.get(u.name);if(m!==void 0)throw D(u.module.build.path,`${u.name} is declared by both ${m} and ${u.module.build.path}. Gradle coordinates must be unique to release them.`);d.set(u.name,u.module.build.path)}const p=new Map(l.map(u=>[u.module.path,u.name]));return l.map(({kind:u,line:m,module:h,name:b,owner:A,scan:k,version:O})=>{const y={};for(const v of k.projectRefs){const I=p.get(v.replace(/^:+/,"").split(":").filter($=>$!=="").join("/"));I!==void 0&&I!==b&&(y[I]="*")}const w={dependencies:y,name:b,private:!1,version:O};return{kind:u,line:m,name:b,owner:A,package:{dir:h.dir,ecosystem:"gradle",manifest:w,manifestPath:h.build.path,name:b,private:!1,version:O},taskPath:h.taskPath}})},ls=async r=>{let e=r;for(;;){if(await Or(f(e,"gradlew"))||await K(e,cs)!==void 0)return e;const s=E(e);if(s===e)return;e=s}},Vt=Object.defineProperty({__proto__:null,discoverGradleProjects:Er,findGradleRoot:ls},Symbol.toStringTag,{value:"Module"}),Dr=/<!--[\s\S]*?-->/g,Rr=/<project\b[^>]*>([\s\S]*)/i,Pe=/<version>\s*([^<]+?)\s*<\/version>/i,Ae=/<groupId>\s*([^<]+?)\s*<\/groupId>/i,Ne=/<artifactId>\s*([^<]+?)\s*<\/artifactId>/i,jr=/<modules\b[^>]*>[\s\S]*?<module\b/i,_e=r=>{const e=r.replaceAll(Dr,""),t=Rr.exec(e)?.[1]??e,n=t.replaceAll(/<parent\b[\s\S]*?<\/parent>/gi,"").replaceAll(/<dependencyManagement\b[\s\S]*?<\/dependencyManagement>/gi,"").replaceAll(/<dependencies\b[\s\S]*?<\/dependencies>/gi,"").replaceAll(/<build\b[\s\S]*?<\/build>/gi,"").replaceAll(/<profiles\b[\s\S]*?<\/profiles>/gi,"").replaceAll(/<pluginRepositories\b[\s\S]*?<\/pluginRepositories>/gi,"").replaceAll(/<repositories\b[\s\S]*?<\/repositories>/gi,""),a=Pe.exec(n)??Pe.exec(t),i=Ae.exec(n)??Ae.exec(t),o=Ne.exec(n)??Ne.exec(t),c=jr.test(t);return{artifactId:o?.[1],groupId:i?.[1],hasModules:c,version:a?.[1]}},Lr=r=>{const e=/<latest>\s*([^<]+?)\s*<\/latest>/i.exec(r);if(e?.[1])return e[1];const s=/<versions>([\s\S]*?)<\/versions>/i.exec(r);return s?[...s[1].matchAll(/<version>\s*([^<]+?)\s*<\/version>/gi)].map(n=>n[1]).at(-1):void 0},Fr=r=>{const e=/<versions>([\s\S]*?)<\/versions>/i.exec(r);return e?[...e[1].matchAll(/<version>\s*([^<]+?)\s*<\/version>/gi)].map(s=>s[1]):[]},us=(r,e)=>{const s=r.split(".").map(n=>encodeURIComponent(n)).join("/"),t=encodeURIComponent(e);return`https://repo1.maven.org/maven2/${s}/${t}/maven-metadata.xml`};class Mr extends C{id="maven";warnedMultiModule=new WeakSet;warnIfMultiModule(e,s){!s.hasModules||this.warnedMultiModule.has(e)||(this.warnedMultiModule.add(e),process.stderr.write(`[vis release] ⚠ ${e.name} (${s.groupId??"?"}:${s.artifactId??"?"}) is a multi-module Maven project (<modules> present). vis treats it as a single artifact for version-read + already-published checks. For proper reactor handling, use \`versionActions: "shell"\` with \`mvn -B -ntp deploy\`.
+`))}async readPublishedVersion(e){const s=e.perPackageConfig??{},t=f(e.pkg.dir,s.pomPath??"pom.xml");let n;try{n=await P(t,"utf8")}catch{return}const a=_e(n);if(this.warnIfMultiModule(e.pkg,a),!a.groupId||!a.artifactId||s.mavenMetadataUrl==="")return;const i=s.mavenMetadataUrl??us(a.groupId,a.artifactId);try{const o=await S(i,{headers:{Accept:"text/xml,application/xml;q=0.9,*/*;q=0.8"},httpProxy:e.workspaceConfig?.httpProxy});if(o.status===404||!o.ok)return;const c=await o.text();return Lr(c)}catch{return}}async publish(e){const s=e.perPackageConfig??{},t=f(e.pkg.dir,s.pomPath??"pom.xml");let n;try{const o=await P(t,"utf8");n=_e(o)}catch{n=void 0}const a=n?.groupId&&n?.artifactId?`${n.groupId}:${n.artifactId}`:e.pkg.name;if(e.dryRun)return{output:`[dry-run / maven] would run mvn -B -N -f ${t} deploy for ${e.pkg.name}@${e.release.newVersion} (${a})`,published:!0};if(process.platform==="win32")throw new g({code:"CONFIG_INVALID",message:`${e.pkg.name} cannot be published from Windows yet: Maven publish is POSIX-only for now. Publish from a POSIX runner.`,packageName:e.pkg.name});const i=await e.pm.runner.run("mvn",["-B","-N","-f",t,"deploy"],{cwd:e.pkg.dir,silent:!1});if(i.exitCode!==0)throw new g({code:"PUBLISH_FAILED",hint:`Failing artifact: ${a}
+Pom: ${t}
+Check the mvn output above. Credentials come from ~/.m2/settings.xml, and the pom needs a deploy target (distributionManagement or central-publishing-maven-plugin). See docs/guides/release-maven.mdx.`,message:`mvn deploy failed for ${e.pkg.name}@${e.release.newVersion} (${a}): exit ${i.exitCode}. stderr: ${i.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});return{output:`[maven] deployed ${e.pkg.name}@${e.release.newVersion} (${a})`,published:!0}}}const Tr=r=>{const e=r.indexOf(":");return e===-1?void 0:{artifactId:r.slice(e+1),groupId:r.slice(0,e)}},Gr=async r=>{const e=r.perPackageConfig??{},s=Tr(r.pkg.name);if(e.mavenMetadataUrl===""||s===void 0)return!1;const t=e.mavenMetadataUrl??us(s.groupId,s.artifactId);try{const n=await S(t,{headers:{Accept:"text/xml,application/xml;q=0.9,*/*;q=0.8"},httpProxy:r.workspaceConfig?.httpProxy});return n.ok&&Fr(await n.text()).includes(r.release.newVersion)}catch{return!1}};class Ur extends C{id="gradle";async readPublishedVersion(e){}async publish(e){const s=await ls(e.pkg.dir);if(s===void 0)throw new g({code:"CONFIG_INVALID",file:e.pkg.manifestPath,message:`${e.pkg.name} has no Gradle build root (no gradlew or settings.gradle above ${e.pkg.dir}).`,packageName:e.pkg.name});const t=e.pkg.dir===s?"":e.pkg.dir.slice(s.length+1).split("\\").join("/"),n=t===""?":publish":`:${t.replaceAll("/",":")}:publish`;if(e.dryRun)return{output:`[dry-run / gradle] would run ${f(s,"gradlew")} ${n} for ${e.pkg.name}@${e.release.newVersion}`,published:!0};if(process.platform==="win32")throw new g({code:"CONFIG_INVALID",message:`${e.pkg.name} cannot be published from Windows yet: vis runs ./gradlew without a shell, and gradlew.bat needs one. Publish from a POSIX runner.`,packageName:e.pkg.name});const a=f(s,"gradlew");try{await Ue(a)}catch{throw new g({code:"CONFIG_INVALID",message:`${e.pkg.name} needs ${a} to publish, and the build root has none. Add the Gradle wrapper (gradle wrapper) at the root.`,packageName:e.pkg.name})}if(await Gr(e))return{alreadyPublished:!0,output:`[gradle] ${e.pkg.name}@${e.release.newVersion} is already on the repository; skipped`,published:!1};const i=await e.pm.runner.run(a,[n],{cwd:s,silent:!1});if(i.exitCode!==0)throw new g({code:"PUBLISH_FAILED",hint:`Failing task: ${n} in ${s}
+Check the Gradle output above. The module needs a publishing plugin and repository (for example maven-publish). Credentials come from your Gradle properties or environment.`,message:`gradle ${n} failed for ${e.pkg.name}@${e.release.newVersion}: exit ${i.exitCode}. stderr: ${i.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});return{output:`[gradle] published ${e.pkg.name}@${e.release.newVersion} (${n})`,published:!0}}}const Br="https://hex.pm",Wr=async(r,e,s)=>{const t=`${Br}/api/packages/${encodeURIComponent(r)}`;try{const n=await S(t,{headers:{Accept:"application/json"},httpProxy:s.workspaceConfig?.httpProxy});if(!n.ok)return!1;const a=await n.json(),i=typeof a=="object"&&a!==null?a.releases:void 0;return Array.isArray(i)&&i.some(o=>typeof o=="object"&&o!==null&&o.version===e)}catch{return!1}},Hr=async(r,e)=>{try{return(await r.pm.runner.run("mix",["help"],{cwd:e,silent:!0})).exitCode===0}catch{return!1}};class Jr extends C{id="hex";async readPublishedVersion(e){}async publish(e){const{name:s}=e.pkg,t=e.release.newVersion,n=e.pkg.dir;if(e.dryRun)return{output:`[dry-run / hex] would run mix hex.publish --yes in ${R(n)} for ${s}@${t}`,published:!0};if(process.platform==="win32")throw new g({code:"CONFIG_INVALID",message:`${s} cannot be published from Windows yet: the mix path is only verified on POSIX. Publish from a POSIX runner.`,packageName:s});if(!await Hr(e,n))throw new g({code:"CONFIG_INVALID",message:`${s} needs the mix command on PATH to publish, and "mix help" failed. Install Elixir (which ships Mix) on the runner.`,packageName:s});if(await Wr(s,t,e))return{alreadyPublished:!0,output:`[hex] ${s}@${t} is already on hex.pm; skipped`,published:!1};const a=await e.pm.runner.run("mix",["hex.publish","--yes"],{cwd:n,silent:!1});if(a.exitCode!==0)throw new g({code:"PUBLISH_FAILED",hint:`Failing step: mix hex.publish --yes in ${n}
+Check the output above. Credentials come from HEX_API_KEY in the environment; Hex refuses to replace an existing version.`,message:`mix hex.publish failed for ${s}@${t}: exit ${a.exitCode}. stderr: ${a.stderr.trim().slice(0,500)}`,packageName:s});return{output:`[hex] published ${s}@${t}`,published:!0}}}const Kr="https://jsr.io",qr=/^@[a-z0-9-]+\/[a-z0-9-]+$/i,Se=async r=>{let e;try{e=await P(r,"utf8")}catch(t){throw new g({cause:t,code:"CONFIG_INVALID",file:r,message:`Failed to read JSR manifest at ${r}: ${t.message}`})}let s;try{s=JSON.parse(e)}catch(t){throw new g({cause:t,code:"CONFIG_INVALID",file:r,message:`Failed to parse JSR manifest at ${r}: ${t.message}`})}if(typeof s.name!="string"||s.name.length===0)throw new g({code:"CONFIG_INVALID",file:r,hint:"JSR manifests must declare a `name` field with the `@scope/name` form.",message:`JSR manifest at ${r} is missing the \`name\` field.`});if(!qr.test(s.name))throw new g({code:"CONFIG_INVALID",file:r,hint:"JSR requires every package to publish under `@scope/name`. Add the `@scope/` prefix and lowercase the name (a-z, 0-9, hyphen).",message:`JSR manifest at ${r} declares an invalid \`name\`: "${s.name}". JSR requires the @scope/name form.`});if(typeof s.version!="string"||s.version.length===0)throw new g({code:"CONFIG_INVALID",file:r,hint:"Add a `version` literal to the JSR manifest, or wire the `jsr()` preset so vis bumps it for you.",message:`JSR manifest at ${r} is missing the \`version\` field.`});return{name:s.name,version:s.version}},Ve=async(r,e)=>{const s=`${Kr}/${r}/meta.json`;try{const t=await S(s,{headers:{Accept:"application/json"},httpProxy:e});if(t.status===404||!t.ok)return;const n=await t.json();return typeof n?.latest=="string"?n.latest:void 0}catch{return}},Yr=(r,e)=>ge({env:r,staticTokenVar:"JSR_API_KEY",workspaceConfig:e})==="oidc",Oe=(r,e)=>{const s=e?.jsrConfigPath??"jsr.json";return f(r.dir,s)};class Xr extends C{id="jsr";async readPublishedVersion(e){const s=Oe(e.pkg,e.perPackageConfig);try{const{name:t}=await Se(s);return await Ve(t,e.workspaceConfig?.httpProxy)}catch{return}}async publish(e){if(e.dryRun)return{output:`[dry-run / jsr] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const s=Oe(e.pkg,e.perPackageConfig),{name:t,version:n}=await Se(s);if(n!==e.release.newVersion)throw new g({code:"CONFIG_INVALID",file:s,hint:`Confirm the jsr() preset's manifestPath points at the JSR config file the extra-files rule rewrites. Expected ${e.release.newVersion} on disk after the bump.`,message:`JSR manifest version (${n}) does not match planned release version (${e.release.newVersion}) for ${e.pkg.name}.`,packageName:e.pkg.name});if(await Ve(t,e.workspaceConfig?.httpProxy)===e.release.newVersion)return{alreadyPublished:!0,output:`[jsr] ${t}@${e.release.newVersion} already on jsr.io`,published:!1};const i=Yr(process.env,e.workspaceConfig);if(!i&&!process.env.JSR_API_KEY)throw new g({code:"AUTH_MISSING",hint:"Set JSR_API_KEY for static-token auth, or run from a GH-Actions job with `permissions: id-token: write` so ACTIONS_ID_TOKEN_REQUEST_URL is exposed for OIDC trusted publishing.",message:`Cannot publish ${t}@${e.release.newVersion}: neither JSR_API_KEY nor OIDC trusted publishing is available.`,packageName:e.pkg.name});const o=["jsr","publish","--allow-dirty"],c=e.perPackageConfig?.jsrConfigPath;c!==void 0&&c!=="jsr.json"&&o.push("--config",c);for(const d of e.perPackageConfig?.jsrPublishArgs??[])o.push(d);const l=await e.pm.runner.run("npx",o,{cwd:e.pkg.dir,silent:!1});if(l.exitCode!==0)throw new g({code:"PUBLISH_FAILED",hint:"Inspect the jsr CLI output above. Common causes: invalid JSR_API_KEY, OIDC permission misconfigured, version already published, slow-mode rate limit. Re-runs are safe — the published-version probe short-circuits subsequent runs.",message:`jsr publish failed for ${t}@${e.release.newVersion}: exit ${l.exitCode}. stderr: ${l.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});return{output:`[jsr] published ${t}@${e.release.newVersion}${i?" (trusted publishing)":""}`,published:!0}}}const ds=(r,e)=>{if(e===!1)return{...r};const s=new Set(Ss(e)),t={name:r.name,version:r.version};for(const[n,a]of Object.entries(r))s.has(n)||(t[n]=a);return t},ps="https://registry.npmjs.org/",zr="npm:registry.npmjs.org",Ee=async r=>{const e=f(r,"npm");try{return(await ce(e,{withFileTypes:!0})).filter(t=>t.isDirectory()).map(t=>t.name)}catch{return[]}},Qr=async r=>{const e=r.ACTIONS_ID_TOKEN_REQUEST_URL,s=r.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(!e||!s)return;const t=`${e}${e.includes("?")?"&":"?"}audience=${encodeURIComponent(zr)}`,n=await fetch(t,{headers:{Authorization:`Bearer ${s}`}});if(!n.ok)return;const a=await n.json().catch(()=>({}));return typeof a.value=="string"?a.value:void 0},Zr=async(r,e)=>{const s=await fetch(`${ps}-/npm/v1/oidc/token/exchange/package/${encodeURIComponent(r)}`,{headers:{Authorization:`Bearer ${e}`},method:"POST"});if(!s.ok)return;const t=await s.json().catch(()=>({}));return typeof t.token=="string"?t.token:void 0},De=async(r,e,s)=>{if(e){const n=await Zr(r,e);if(n)return{source:"oidc",token:n}}const t=s.NPM_TOKEN;if(t)return{source:"NPM_TOKEN",token:t};throw new g({code:"AUTH_MISSING",message:`Cannot publish ${r}: OIDC exchange did not succeed and NPM_TOKEN is not set.`,packageName:r})},Re=(r,e)=>{Ps(r,`//registry.npmjs.org/:_authToken=${e}
+registry=${ps}
+`)};class xr extends C{id="native-addon";async readPublishedVersion(e){try{x(e.pkg.name);const{execFileSync:s}=await import("node:child_process");return s("npm",["view",e.pkg.name,"version"],{stdio:["ignore","pipe","ignore"]}).toString().trim()||void 0}catch{return}}async publish(e){if(e.dryRun){const c=await Ee(e.pkg.dir);return{output:`[dry-run] would publish ${e.pkg.name}@${e.release.newVersion} + ${c.length} platform package(s)`,published:!0}}const s=await Ee(e.pkg.dir);if(s.length===0){const{NpmVersionActions:c}=await Promise.resolve().then(()=>tt);return new c().publish(e)}const{env:t}=process,n=await Qr(t),a=e.release.newVersion,i=new Map,o=[];try{await Promise.all(s.map(async y=>{const w=f(e.pkg.dir,"npm",y,"package.json"),v=await P(w,"utf8");i.set(w,v);const I=JSON.parse(v);I.version=a,await B(w,`${JSON.stringify(I,null,4)}
+`)}));const{execFileSync:c}=await import("node:child_process"),l=await Promise.all(s.map(async y=>{const w=f(e.pkg.dir,"npm",y),v=f(w,"package.json"),I=await P(v,"utf8"),$=JSON.parse(I);x($.name);const V=await De($.name,n,t),N=se(f(q(),"vis-release-napi-"));o.push(N);const _=f(N,".npmrc");return Re(_,V.token),{manifest:$,npmrcPath:_,platform:y,platformDir:w}})),d=e.workspaceConfig?.publish?.guards;if(d&&Object.values(d).some(y=>y!==void 0&&y!==!1&&y!=="off")){const{runPublishGuards:y}=await import("./publish-guards.js");for(const{manifest:w,platformDir:v}of l){const I=c("npm",["pack","--dry-run","--json"],{cwd:v,stdio:["ignore","pipe","ignore"]}).toString();let $=[];try{$=JSON.parse(I)[0]?.files?.map(_=>_.path)??[]}catch{}const V=await y({config:d,manifest:w,packFiles:$,pkgDir:v,runner:e.pm.runner,sourceManifest:w});if(V.blockers.length>0){const N=V.blockers.flatMap(_=>_.findings.map(Z=>`  • [${_.gate}] ${Z.message}${Z.hint?`
+      → ${Z.hint}`:""}`)).join(`
+`);throw new g({code:"PUBLISH_FAILED",message:`Pre-publish guards failed for ${w.name}@${a} (platform package):
+${N}`,packageName:w.name})}}}const p=e.tag??"latest",u=(y,w)=>{const v=["publish",y,"--tag",p,"--access","public","--userconfig",w];return e.provenance&&v.push("--provenance"),v};for(const{manifest:y,npmrcPath:w,platformDir:v}of l)try{c("npm",u(v,w),{env:{...t,NPM_CONFIG_USERCONFIG:w},stdio:"inherit"})}catch(I){const $=I.message;if(!$.includes("EPUBLISHCONFLICT")&&!$.includes("cannot publish over"))throw new g({cause:I,code:"PUBLISH_FAILED",message:`Failed to publish platform package ${y.name}@${a}: ${$}`,packageName:y.name})}const m=e.versionedManifestByName.get(e.pkg.name)??e.pkg.manifest,h={...m},b={...m.optionalDependencies};for(const{manifest:y}of l)Object.hasOwn(b,y.name)&&(b[y.name]=a);h.optionalDependencies=b;const A=de(h,e.catalogs),k=ds(A,e.cleanPackageJsonConfig),O=await P(e.pkg.manifestPath,"utf8");try{await B(e.pkg.manifestPath,`${JSON.stringify(k,null,4)}
+`),x(e.pkg.name);const y=await De(e.pkg.name,n,t),w=se(f(q(),"vis-release-napi-parent-"));o.push(w);const v=f(w,".npmrc");Re(v,y.token);const I=c("npm",["pack","--pack-destination",w,"--json"],{cwd:e.pkg.dir,env:t,stdio:["ignore","pipe","ignore"]}).toString();let $;try{const N=JSON.parse(I);N[0]?.filename&&($=f(w,N[0].filename))}catch{}const V=["publish",$??e.pkg.dir,"--tag",p,"--access","public","--userconfig",v];if(e.provenance&&V.push("--provenance"),c("npm",V,{env:{...t,NPM_CONFIG_USERCONFIG:v},stdio:"inherit"}),$){const{hashTarball:N}=await import("./publish-guards.js");return{published:!0,tarball:await N($)}}return{published:!0}}finally{await B(e.pkg.manifestPath,O)}}finally{for(const[c,l]of i)try{await B(c,l)}catch{}for(const c of o)try{await le(c,{force:!0,recursive:!0})}catch{}}}}const et=async(r,e)=>{const{extractPackFilesFromRaw:s}=await import("./publish-guards.js"),t=s(e.raw);if(t!==void 0)return t;const n=await r.pm.runner.run("npm",["pack","--dry-run","--json"],{cwd:r.pkg.dir,silent:!0});if(n.exitCode!==0)return[];try{return s(JSON.parse(n.stdout))??[]}catch{return[]}},je=1800*1e3,Le=15*1e3,Fe=r=>{if(r===!0)return{enabled:!0,pollIntervalMs:Le,timeoutMs:je};if(r&&typeof r=="object"){const e=r;return{enabled:!0,pollIntervalMs:e.pollIntervalMs??Le,timeoutMs:e.timeoutMs??je}}return{enabled:!1,pollIntervalMs:0,timeoutMs:0}};class gs extends C{id="npm";async readPublishedVersion(e){try{const s=await e.pm.runner.run("npm",["view",e.pkg.name,"version","--silent"],{cwd:e.pkg.dir,silent:!0});return s.exitCode!==0?void 0:s.stdout.trim()||void 0}catch{return}}async publish(e){if(e.dryRun)return{output:`[dry-run] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};if(e.resumeStageId){const l=Fe(e.workspaceConfig?.publish?.stage);if(!l.enabled)throw new g({code:"CONFIG_INVALID",message:`Cannot resume stage ${e.resumeStageId} for ${e.pkg.name}@${e.release.newVersion}: publish.stage is now disabled. Resolve the stage manually via \`vis release stage approve|reject ${e.resumeStageId}\`.`,packageName:e.pkg.name});return this.resumeStagedPublish(e,l)}const s=e.perPackageConfig&&e.workspaceConfig?re(e.pkg.name,e.perPackageConfig,e.workspaceConfig):{};if(s.buildCommand){const l=te(s.buildCommand,{name:e.pkg.name,version:e.release.newVersion}),d=await e.pm.runner.run(process.platform==="win32"?"cmd":"sh",process.platform==="win32"?["/c",l]:["-c",l],{cwd:e.pkg.dir,silent:!1});if(d.exitCode!==0)throw new Error(`buildCommand failed for ${e.pkg.name}: exit ${d.exitCode}`)}const t=e.versionedManifestByName.get(e.pkg.name)??e.pkg.manifest,n=rt(t,e.versionedManifestByName),a=de(n,e.catalogs),i=ds(a,e.cleanPackageJsonConfig),o=await import("node:fs/promises"),c=await o.readFile(e.pkg.manifestPath,"utf8");try{if(await o.writeFile(e.pkg.manifestPath,`${JSON.stringify(i,null,4)}
+`),s.publishCommand){const d={name:e.pkg.name,version:e.release.newVersion},p=Array.isArray(s.publishCommand)?s.publishCommand:[s.publishCommand];for(const u of p){const m=te(u,d),h=await e.pm.runner.run(process.platform==="win32"?"cmd":"sh",process.platform==="win32"?["/c",m]:["-c",m],{cwd:e.pkg.dir,silent:!1});if(h.exitCode!==0)throw new Error(`publishCommand failed for ${e.pkg.name}: exit ${h.exitCode}`)}return{output:`[custom] published ${e.pkg.name}@${e.release.newVersion}`,published:!0}}const l=se(f(q(),"vis-release-pack-"));try{const d=await e.pm.pack({cwd:e.pkg.dir,destination:l}),p=e.workspaceConfig?.publish?.guards;if(p&&Object.values(p).some(w=>w!==void 0&&w!==!1&&w!=="off")){const{runPublishGuards:w}=await import("./publish-guards.js"),v=await et(e,d),I=await w({config:p,manifest:i,packFiles:v,pkgDir:e.pkg.dir,runner:e.pm.runner,sourceManifest:e.pkg.manifest});if(I.blockers.length>0){const{redactTokens:$}=await import("./security.js"),V=I.blockers.flatMap(N=>N.findings.map(_=>`  • [${N.gate}] ${$(_.message)}${_.hint?`
+      → ${$(_.hint)}`:""}`)).join(`
+`);throw new g({code:"PUBLISH_FAILED",message:`Pre-publish guards failed for ${e.pkg.name}@${e.release.newVersion}:
+${V}`,packageName:e.pkg.name})}}const{hashTarball:u}=await import("./publish-guards.js"),m=await u(d.tarball);if((e.workspaceConfig?.publish?.publishStrategy??"npm-publish-tarball")==="native"){const w=e.pm.id;return e.provenance&&w==="bun"&&process.stderr.write(`[vis release] ⚠ publishStrategy "native": bun has no --provenance/OIDC support; ${e.pkg.name}@${e.release.newVersion} publishes without provenance.
+`),e.otp&&w==="yarn"&&process.stderr.write(`[vis release] ⚠ publishStrategy "native": \`yarn npm publish\` ignores --otp; configure 2FA via .yarnrc.yml for ${e.pkg.name}.
+`),{...await e.pm.publishNative({access:"public",cwd:e.pkg.dir,otp:e.otp,provenance:e.provenance,registry:e.registry,tag:e.tag}),tarball:m}}const h=Fe(e.workspaceConfig?.publish?.stage);if(h.enabled){const{refuseRestrictedOidc:w}=await import("./stage-publisher.js"),v=e.pkg.manifest.publishConfig?.access;w(v)}const b=await e.pm.publish({access:"public",otp:e.otp,provenance:e.provenance,registry:e.registry,stage:h.enabled,tag:e.tag,tarball:d.tarball});if(!h.enabled||!b.stageId)return{...b,tarball:m};const{waitForStageDecision:A}=await import("./stage-publisher.js"),{stageId:k}=b,O=Date.now();process.stderr.write(`[vis release] ⏳ ${e.pkg.name}@${e.release.newVersion} staged (id ${k}). Waiting up to ${Math.round(h.timeoutMs/6e4)}m for a maintainer to approve via npmjs.com or \`npm stage approve ${k}\`...
+`);const y=await A({cwd:e.pkg.dir,onProgress:w=>{w>0&&w%3e5<h.pollIntervalMs&&process.stderr.write(`[vis release] still waiting for ${e.pkg.name} stage decision (${Math.round(w/6e4)}m elapsed)...
+`)},packageName:e.pkg.name,pollIntervalMs:h.pollIntervalMs,runner:e.pm.runner,stageId:k,timeoutMs:h.timeoutMs,version:e.release.newVersion});return y==="approved"?(process.stderr.write(`[vis release] ✓ ${e.pkg.name}@${e.release.newVersion} approved + promoted (${Math.round((Date.now()-O)/1e3)}s).
+`),{...b,stageId:void 0,tarball:m}):y==="rejected"?(process.stdout.write(`::warning::Stage rejected for ${e.pkg.name}@${e.release.newVersion} (id ${k}). Re-stage by re-running the release once the review feedback is addressed.
+`),{alreadyPublished:!1,output:`stage-rejected: ${k}`,published:!1,stageId:k}):(process.stdout.write(`::warning::Stage timeout for ${e.pkg.name}@${e.release.newVersion} (id ${k}) after ${Math.round(h.timeoutMs/6e4)}m. Re-run \`vis release publish\` once a maintainer can approve, or run \`vis release stage approve ${k}\` manually.
+`),{alreadyPublished:!1,output:`stage-timeout: ${k}`,published:!1,stageId:k})}finally{await o.rm(l,{force:!0,recursive:!0})}}finally{await o.writeFile(e.pkg.manifestPath,c)}}async resumeStagedPublish(e,s){const t=e.resumeStageId,n=Date.now();process.stderr.write(`[vis release] ↻ Resuming wait on staged ${e.pkg.name}@${e.release.newVersion} (id ${t}) — tarball already uploaded; not re-publishing.
+`);const{waitForStageDecision:a}=await import("./stage-publisher.js"),i=await a({cwd:e.pkg.dir,onProgress:o=>{o>0&&o%3e5<s.pollIntervalMs&&process.stderr.write(`[vis release] still waiting for ${e.pkg.name} stage decision (resume, ${Math.round(o/6e4)}m elapsed)...
+`)},packageName:e.pkg.name,pollIntervalMs:s.pollIntervalMs,runner:e.pm.runner,stageId:t,timeoutMs:s.timeoutMs,version:e.release.newVersion});return i==="approved"?(process.stderr.write(`[vis release] ✓ ${e.pkg.name}@${e.release.newVersion} approved + promoted on resume (${Math.round((Date.now()-n)/1e3)}s).
+`),{output:`[resumed] published ${e.pkg.name}@${e.release.newVersion}`,published:!0}):i==="rejected"?(process.stdout.write(`::warning::Stage rejected on resume for ${e.pkg.name}@${e.release.newVersion} (id ${t}).
+`),{alreadyPublished:!1,output:`stage-rejected: ${t}`,published:!1,stageId:t}):(process.stdout.write(`::warning::Stage timeout on resume for ${e.pkg.name}@${e.release.newVersion} (id ${t}) after ${Math.round(s.timeoutMs/6e4)}m.
+`),{alreadyPublished:!1,output:`stage-timeout: ${t}`,published:!1,stageId:t})}}const st=["dependencies","devDependencies","peerDependencies","optionalDependencies"],rt=(r,e)=>{const s={...r};for(const t of st){const n=r[t];if(!n||typeof n!="object")continue;const a={...n};for(const[i,o]of Object.entries(n)){if(!o.startsWith("workspace:"))continue;const c=e.get(i);c&&(a[i]=qe(o.slice(10)==="*"?"*":o,c.version),a[i].startsWith("workspace:")&&(a[i]=a[i].slice(10)))}s[t]=a}return s},tt=Object.defineProperty({__proto__:null,NpmVersionActions:gs},Symbol.toStringTag,{value:"Module"}),Me="https://api.nuget.org/v3/index.json",nt="https://api.nuget.org/v3-flatcontainer",M="NUGET_API_KEY",T=[10,0,300],at=r=>{const e=/^(\d+)\.(\d+)\.(\d+)(-[\w.-]+)?/.exec(r.trim());if(!e)return!1;const s=[Number(e[1]),Number(e[2]),Number(e[3])];for(const[t,n]of s.entries())if(n!==T[t])return n>T[t];return e[4]===void 0},Te=r=>r.split("+")[0].toLowerCase(),it=async(r,e,s)=>{try{const t=await S(`${nt}/${encodeURIComponent(r)}/index.json`,{headers:{Accept:"application/json"},httpProxy:s.workspaceConfig?.httpProxy});if(!t.ok)return!1;const n=await t.json();return(typeof n=="object"&&n!==null&&Array.isArray(n.versions)?n.versions:[]).some(i=>typeof i=="string"&&Te(i)===Te(e))}catch{return!1}},Ge=(r,e)=>r.split(e).join("***").trim().slice(0,500);class ot extends C{id="nuget";async readPublishedVersion(e){}async publish(e){const{name:s}=e.pkg,t=e.release.newVersion,n=e.pkg.manifestPath,a=e.pkg.dir;if(e.dryRun)return{output:`[dry-run / nuget] would run dotnet pack ${R(n)} -c Release, then dotnet nuget push the package to ${Me} for ${s}@${t}`,published:!0};if(process.platform==="win32")throw new g({code:"CONFIG_INVALID",message:`${s} cannot be published from Windows yet: the NuGet path is only verified on POSIX. Publish from a POSIX runner.`,packageName:s});const i=await e.pm.runner.run("dotnet",["--version"],{cwd:a,silent:!0}).then(l=>l.exitCode===0?l.stdout:void 0).catch(()=>{});if(i===void 0)throw new g({code:"CONFIG_INVALID",message:`${s} needs the dotnet CLI on PATH to publish, and "dotnet --version" failed. Install the .NET SDK on the runner.`,packageName:s});if(!at(i))throw new g({code:"CONFIG_INVALID",message:`${s} publishes with the ${M} environment variable, which dotnet nuget push reads from .NET SDK ${T.join(".")} (NuGet 7.6) on. This runner has dotnet ${i.trim()}. Install .NET SDK ${T.join(".")} or later on the runner.`,packageName:s});if(await it(s,t,e))return{alreadyPublished:!0,output:`[nuget] ${s}@${t} is already on nuget.org; skipped`,published:!1};const o=process.env[M];if(o===void 0||o==="")throw new g({code:"CONFIG_INVALID",message:`${s} needs the API key in the ${M} environment variable to push to nuget.org. Set it on the runner; vis never logs it.`,packageName:s});const c=await Is(f(q(),"vis-nuget-"));try{const l=await e.pm.runner.run("dotnet",["pack",n,"-c","Release","-o",c],{cwd:a,silent:!1});if(l.exitCode!==0)throw new g({code:"PUBLISH_FAILED",hint:`Failing step: dotnet pack ${R(n)}
+Fix the build or packaging error above.`,message:`dotnet pack failed for ${s}@${t}: exit ${l.exitCode}. stderr: ${Ge(l.stderr,o)}`,packageName:s});const p=(await ce(c)).filter(m=>m.endsWith(".nupkg")&&!m.endsWith(".symbols.nupkg"));if(p.length!==1)throw new g({code:"PUBLISH_FAILED",hint:`dotnet pack wrote ${p.length} packages to a temporary directory. vis pushes exactly one per project.`,message:`expected one .nupkg for ${s}@${t}, found ${p.length}`,packageName:s});const u=await e.pm.runner.run("dotnet",["nuget","push",f(c,p[0]),"--source",Me],{cwd:a,env:{[M]:o},silent:!1});if(u.exitCode!==0)throw new g({code:"PUBLISH_FAILED",hint:`Failing step: dotnet nuget push
+Check the output above. A version nuget.org already has is refused. The key comes from ${M}, which dotnet nuget push reads on .NET SDK ${T.join(".")} or later.`,message:`dotnet nuget push failed for ${s}@${t}: exit ${u.exitCode}. stderr: ${Ge(u.stderr,o)}`,packageName:s})}finally{await le(c,{force:!0,recursive:!0})}return{output:`[nuget] published ${s}@${t} to nuget.org`,published:!0}}}class ct extends C{id="private";async readPublishedVersion(e){}async publish(e){return{output:`[private] skipped publish for ${e.pkg.name}@${e.release.newVersion}`,published:!1}}}const ms=r=>`https://pypi.org/pypi/${encodeURIComponent(r.toLowerCase())}/json`,lt=(r,e)=>e?.uvLockPath?f(r.dir,e.uvLockPath):f(r.dir,"uv.lock"),ut=async(r,e)=>{let s;try{s=await X(r)}catch{return"no-root-pyproject"}if(s===void 0)return"no-root-pyproject";const t=s.tool?.uv?.workspace?.members;if(!Array.isArray(t)||t.length===0)return"no-workspace";const n=e.replace(/^\.\//,"").replaceAll("\\","/");for(const a of t){if(typeof a!="string")continue;const i=a.replace(/^\.\//,"").replaceAll("\\","/");if(i===n)return"member";if(i.endsWith("/*")){const o=i.slice(0,-2);if(n.startsWith(`${o}/`)&&!n.slice(o.length+1).includes("/"))return"member"}if(i.endsWith("/**")){const o=i.slice(0,-3);if(n===o||n.startsWith(`${o}/`))return"member"}}return"missing"},X=async r=>{const e=f(r,"pyproject.toml");let s;try{s=await P(e,"utf8")}catch(n){const{code:a}=n;if(a==="ENOENT")return;throw new g({cause:n,code:"BUMP_FILE_INVALID",file:e,message:`Failed to read ${e}: ${n.message}`})}const{parse:t}=await import("./index4.js");try{return t(s)}catch(n){throw new g({cause:n,code:"BUMP_FILE_INVALID",file:e,message:`Failed to parse ${e}: ${n.message}`})}},hs=async(r,e)=>{try{return(await r.run("uv",["--version"],{cwd:e,silent:!0})).exitCode===0}catch{return!1}},fs=r=>{const e=r?.["build-system"]?.["build-backend"];return e?e.startsWith("hatchling")?"hatch":e.startsWith("poetry.core")||e.startsWith("poetry_core")?"poetry":e.startsWith("pdm.backend")||e.startsWith("pdm_backend")?"pdm":e.startsWith("setuptools")?"setuptools":e.startsWith("uv_build")||e.startsWith("uv.build")?"uv":"unknown":"unknown"},ws=(r,e)=>r==="uv"||r==="unknown"&&e?{backend:r,buildCommand:{args:["build"],binary:"uv"},hasUv:e,publishCommand:{args:["publish"],binary:"uv"}}:{backend:r,buildCommand:{args:["-m","build"],binary:"python"},hasUv:e,publishCommand:{args:["upload","dist/*"],binary:"twine"}},bs=(r,e)=>ge({env:r,staticTokenVar:"TWINE_PASSWORD",workspaceConfig:e}),ie=async(r,e)=>{try{const s=await S(ms(r),{headers:{Accept:"application/json"},httpProxy:e});return s.status===404||!s.ok?void 0:(await s.json())?.info?.version}catch{return}},oe=(r,e)=>e?.pythonProjectDir?f(r.dir,e.pythonProjectDir):r.dir;class ys extends C{id="python";async readPublishedVersion(e){const s=oe(e.pkg,e.perPackageConfig),n=(await X(s).catch(()=>{}))?.project?.name??e.pkg.name.replace(/^@[^/]+\//,"");return ie(n)}async publish(e){if(e.dryRun)return{output:`[dry-run / python] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const s=e.perPackageConfig??{},t=oe(e.pkg,s),n=await X(t);if(n?.project?.dynamic?.includes("version"))throw new g({code:"CONFIG_INVALID",file:f(t,"pyproject.toml"),hint:"Dynamic versioning isn't supported by PythonVersionActions yet; use versionActions: 'shell' with your build backend's version-bump tool (e.g. `hatch version` or `poetry version` for non-vcs setups).",message:`${e.pkg.name}: pyproject.toml declares dynamic = ["version", ...]; PythonVersionActions requires a static [project] version.`,packageName:e.pkg.name});if(n?.project?.version&&n.project.version!==e.release.newVersion)throw new g({code:"BUMP_FILE_INVALID",file:f(t,"pyproject.toml"),hint:`Ensure the pyproject() preset is wired up for this package so the version literal in [project] is bumped before publish. Expected ${e.release.newVersion}, found ${n.project.version}.`,message:`${e.pkg.name}: pyproject.toml version ${n.project.version} differs from planned ${e.release.newVersion}.`,packageName:e.pkg.name});const a=n?.project?.name??e.pkg.name.replace(/^@[^/]+\//,"");if(await ie(a,e.workspaceConfig?.httpProxy)===e.release.newVersion)return{alreadyPublished:!0,output:`[python] ${a}@${e.release.newVersion} already on PyPI`,published:!1};const o=await hs(e.pm.runner,e.pkg.dir),c=fs(n),l=ws(c,o),d=bs(process.env,e.workspaceConfig);if(d==="missing")throw new g({code:"AUTH_MISSING",hint:["Set TWINE_PASSWORD to a PyPI API token (`TWINE_USERNAME=__token__` is injected automatically), OR","configure trusted publishing on PyPI and grant the workflow `permissions: id-token: write` so ACTIONS_ID_TOKEN_REQUEST_URL is exposed.","See https://docs.pypi.org/trusted-publishers/"].join(" "),message:`${e.pkg.name}: no PyPI credentials detected (neither TWINE_PASSWORD nor OIDC trusted-publishing env).`,packageName:e.pkg.name});const p=await e.pm.runner.run(l.buildCommand.binary,l.buildCommand.args,{cwd:t,silent:!1});if(p.exitCode!==0)throw new g({code:"PUBLISH_FAILED",hint:`Inspect the ${l.buildCommand.binary} ${l.buildCommand.args.join(" ")} output above. Common causes: missing ${l.backend==="uv"?"uv":"build/setuptools/wheel"} dependency, broken pyproject.toml, source files missing from \`include\`.`,message:`${e.pkg.name}: build failed (${l.buildCommand.binary} ${l.buildCommand.args.join(" ")}): exit ${p.exitCode}. stderr: ${p.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});const u={...process.env};d==="token"&&!u.TWINE_USERNAME&&(u.TWINE_USERNAME="__token__");const m=await e.pm.runner.run(l.publishCommand.binary,l.publishCommand.args,{cwd:t,env:u,silent:!1});if(m.exitCode!==0)throw new g({code:"PUBLISH_FAILED",hint:`Inspect the ${l.publishCommand.binary} output above. Common causes: invalid API token, version already published (this should have been caught by readPublishedVersion — file a vis bug), 2FA required without a token.`,message:`${e.pkg.name}: publish failed (${l.publishCommand.binary} ${l.publishCommand.args.join(" ")}): exit ${m.exitCode}. stderr: ${m.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});return{output:`[python/${l.backend}${l.hasUv?"+uv":""}] published ${a}@${e.release.newVersion}`,published:!0}}}const Ot=Object.defineProperty({__proto__:null,PYPI_PROJECT_URL:ms,PythonVersionActions:ys,checkUvWorkspaceMembership:ut,detectAuthMode:bs,detectBackend:fs,detectUv:hs,fetchPyPiVersion:ie,readPyProject:X,resolveBuildEnv:ws,resolveProjectDir:oe,resolveUvLockPath:lt},Symbol.toStringTag,{value:"Module"}),J=async(r,e,s,t)=>{const n=te(s,t),a=process.platform==="win32",i=a?"cmd":"sh",o=a?["/c",n]:["-c",n];return r.run(i,o,{cwd:e,silent:!1})};class dt extends C{id="shell";async readPublishedVersion(e){const s=e.perPackageConfig??{},{workspaceConfig:t}=e;if(!t)return;const n=re(e.pkg.name,s,t);if(!n.checkPublished)return;const a=await J(e.pm.runner,e.pkg.dir,n.checkPublished,{name:e.pkg.name,version:e.pkg.version});if(a.exitCode!==0)return;const i=a.stdout.trim();return/\b\d+\.\d+\.\d+(?:[-+][\w.+-]+)?\b/.exec(i)?.[0]}async publish(e){if(e.dryRun)return{output:`[dry-run / shell] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const{workspaceConfig:s}=e,t=e.perPackageConfig??{};if(!s)throw new g({code:"CONFIG_INVALID",message:`Shell publish actions for ${e.pkg.name} require a workspace config (release.allowCustomCommands gate).`,packageName:e.pkg.name});const n=re(e.pkg.name,t,s);if(!n.publishCommand)throw new g({code:"CONFIG_INVALID",hint:`Set release.allowCustomCommands (workspace-wide boolean or an allow-list including "${e.pkg.name}") and configure release.packages["${e.pkg.name}"].publishCommand.`,message:`Shell publish actions for ${e.pkg.name} require a publishCommand AND the trust gate to permit it.`,packageName:e.pkg.name});const a={name:e.pkg.name,registry:e.registry,tag:e.tag,version:e.release.newVersion};if(n.checkPublished){const o=await J(e.pm.runner,e.pkg.dir,n.checkPublished,a);if(o.exitCode===0&&/\b\d+\.\d+\.\d+(?:[-+][\w.+-]+)?\b/.exec(o.stdout.trim())?.[0]===e.release.newVersion)return{alreadyPublished:!0,output:`[shell] ${e.pkg.name}@${e.release.newVersion} already on the registry`,published:!1}}if(n.buildCommand){const o=await J(e.pm.runner,e.pkg.dir,n.buildCommand,a);if(o.exitCode!==0)throw new g({code:"PUBLISH_FAILED",message:`buildCommand failed for ${e.pkg.name}: exit ${o.exitCode}. stderr: ${o.stderr.trim().slice(0,500)}`,packageName:e.pkg.name})}const i=Array.isArray(n.publishCommand)?n.publishCommand:[n.publishCommand];for(const o of i){const c=await J(e.pm.runner,e.pkg.dir,o,a);if(c.exitCode!==0)throw new g({code:"PUBLISH_FAILED",hint:"Inspect the publishCommand output above. Common causes: missing auth token, registry unreachable, version already published (re-run safe — `checkPublished` short-circuits subsequent runs).",message:`publishCommand failed for ${e.pkg.name}@${e.release.newVersion}: exit ${c.exitCode}. stderr: ${c.stderr.trim().slice(0,500)}`,packageName:e.pkg.name})}return{output:`[shell] published ${e.pkg.name}@${e.release.newVersion}`,published:!0}}}const pt=async(r,e)=>{try{return(await r.pm.runner.run("git",["rev-parse","--quiet","--verify",`refs/tags/${e}`],{cwd:r.pkg.dir,silent:!0})).exitCode===0}catch{return!1}};class gt extends C{id="swift";async readPublishedVersion(e){}async publish(e){const s=e.release.newVersion,t=e.perPackageConfig?.releaseTagPattern??e.workspaceConfig?.releaseTagPattern,n=t===void 0?Ke(e.pkg.name,s):z(t,{name:e.pkg.name,version:s});if(e.dryRun)return{output:`[dry-run / swift] would tag ${n} for ${e.pkg.name}@${s}`,published:!0};if(process.platform==="win32")throw new g({code:"CONFIG_INVALID",message:`${e.pkg.name} cannot be released from Windows yet: SwiftPM is not run on Windows here. Release from a POSIX runner.`,packageName:e.pkg.name});return await pt(e,n)?{alreadyPublished:!0,output:`[swift] tag ${n} already exists; ${e.pkg.name}@${s} skipped`,published:!1}:{output:`[swift] ${e.pkg.name}@${s} is released by tag ${n}, created with the release`,published:!0}}}const mt=(r,e,s)=>{const t=s.perPackageConfig?.releaseTagPattern??s.workspaceConfig?.releaseTagPattern;return t?z(t,{channel:s.channel,name:r,version:e}):Ke(r,e)};class ht extends C{id="zig";async readPublishedVersion(e){}async publish(e){const{name:s}=e.pkg,t=e.release.newVersion,n=mt(s,t,{channel:e.tag,perPackageConfig:e.perPackageConfig,workspaceConfig:e.workspaceConfig});if(e.dryRun)return{output:`[dry-run / zig] would tag ${n} for ${s}@${t}; nothing is uploaded`,published:!0};if(process.platform==="win32")throw new g({code:"CONFIG_INVALID",message:`${s} cannot be released from Windows yet: the Zig path is only verified on POSIX. Release from a POSIX runner.`,packageName:s});return await ue({cwd:e.pkg.dir,runner:e.pm.runner},n)?{alreadyPublished:!0,output:`[zig] tag ${n} already exists for ${s}@${t}; skipped`,published:!1}:{output:`[zig] ${s}@${t} has no registry; tag ${n} is created by the release`,published:!0}}}const Et=r=>{switch(r){case"cargo":return new gr;case"composer":return new fr;case"container":return new kr;case"dart":return new Ir;case"gem":return new Nr;case"go":return new Sr;case"gradle":return new Ur;case"hex":return new Jr;case"jsr":return new Xr;case"maven":return new Mr;case"native-addon":return new xr;case"nuget":return new ot;case"private":return new ct;case"python":return new ys;case"shell":return new dt;case"swift":return new gt;case"zig":return new ht;default:return new gs}};export{qe as a,Et as b,ds as c,js as d,Y as e,ze as f,j as g,Qs as h,Q as i,Zs as j,ns as k,Xs as l,Pt as m,At as n,_t as o,Us as p,St as q,de as r,zs as s,Vt as t,Ot as u,Nt as v};