@visulima/vis 4.2.0 → 4.3.0

package/CHANGELOG.md

@@ -1,3 +1,21 @@
+## @visulima/vis [4.3.0](https://github.com/visulima/visulima/compare/@visulima/vis@4.2.0...@visulima/vis@4.3.0) (2026-10-13)
+
+### Features
+
+* **vis:** release, task, audit and SBOM support for all languages ([#954](https://github.com/visulima/visulima/issues/954)) ([3bbd816](https://github.com/visulima/visulima/commit/3bbd816777b409d841bb6a2501ebc96db9bf0233)), closes [#947](https://github.com/visulima/visulima/issues/947)
+
+
+### Dependencies
+
+* **@visulima/tui:** upgraded to 4.0.30
+* **@visulima/tui-kit:** upgraded to 1.0.33
+* **@visulima/cerebro:** upgraded to 3.1.3
+* **@visulima/colorize:** upgraded to 2.2.0
+* **@visulima/fs:** upgraded to 6.1.0
+* **@visulima/package:** upgraded to 5.0.43
+* **@visulima/pail:** upgraded to 5.0.1
+* **@visulima/tsconfig:** upgraded to 3.2.37
+
 ## @visulima/vis [4.2.0](https://github.com/visulima/visulima/compare/@visulima/vis@4.1.20...@visulima/vis@4.2.0) (2026-10-09)
 
 ### Features

package/dist/bin.js

@@ -1 +1 @@
-import"./packem_shared/compile-cache-DoMHRsRZ.js";import"./packem_shared/bin-Cbs_ix6l.js";
+import"./packem_shared/compile-cache-DoMHRsRZ.js";import"./packem_shared/bin-D9TsVhq2.js";

package/dist/binx.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import{a as r,x as i,i as c,d as a,r as d}from"./packem_shared/vis-user-error-Bdg9NRuJ.js";import{t as n}from"./packem_shared/compile-cache-DoMHRsRZ.js";import{g as o}from"./packem_shared/package-version-C5EPMgRw.js";process.argv.includes("--no-color")&&(process.env.NO_COLOR="1",process.env.FORCE_COLOR="0");process.argv.slice(2).some(s=>s==="--version"||s==="-v"||s==="-V")&&(process.stdout.write(`${o()}
+import{a as r,x as i,i as c,d as a,r as d}from"./packem_shared/vis-user-error-Cpg2FqA4.js";import{t as n}from"./packem_shared/compile-cache-DoMHRsRZ.js";import{g as o}from"./packem_shared/package-version-DUcG-b7S.js";process.argv.includes("--no-color")&&(process.env.NO_COLOR="1",process.env.FORCE_COLOR="0");process.argv.slice(2).some(s=>s==="--version"||s==="-v"||s==="-V")&&(process.stdout.write(`${o()}
 `),process.exit(0));process.argv.splice(2,0,"dlx");n();const e=r("visx",{packageName:"visx",packageVersion:o()}),p=process.argv.includes("--debug")||!!process.env.DEBUG;e.addPlugin(i({concise:c,detailed:p,exitOnError:!1}));e.addCommand(a);d(e);

package/dist/config/index.d.ts

@@ -934,6 +934,13 @@ interface VisConfig {
    * renders the generated CODEOWNERS file.
    */
   codeowners?: CodeownersConfig;
+  /**
+   * Composer packages as task projects. Off by default: a `composer.json` in a
+   * subdirectory gets validate and, when its scripts define them, test and lint targets.
+   */
+  composer?: {
+    discover?: boolean;
+  };
   /**
    * Project dependency constraints.
    * Enforced after building the project graph, before running tasks.
@@ -1005,6 +1012,14 @@ interface VisConfig {
      */
     templates?: Record<string, string>;
   };
+  /**
+   * Dart pub workspace members as task projects. Off by default: each member listed
+   * under the root `pubspec.yaml`'s `workspace:` gets analyze, test and format-check
+   * targets only when this is set.
+   */
+  dart?: {
+    discover?: boolean;
+  };
   /**
    * Default base branch used by `vis affected`, `vis ci`, and `vis run --affected`
    * when no explicit `--base` is passed and no CI smart-resolver fires.
@@ -1096,6 +1111,15 @@ interface VisConfig {
      */
     order?: FmtAdapterId[];
   };
+  /**
+   * Gems as task projects. Off by default: each `*.gemspec` directory (except `vendor`,
+   * `node_modules` and `.bundle`) gets build, test and lint targets when this is set. The
+   * root directory is not a task project. POSIX only: the inferred commands are not verified
+   * on Windows.
+   */
+  gem?: {
+    discover?: boolean;
+  };
   /**
    * Configuration for the `vis generate` in-repo scaffolding command.
    * Points at additional template directories beyond the defaults
@@ -1127,6 +1151,28 @@ interface VisConfig {
      */
     templates?: string[];
   };
+  /**
+   * Go modules (the `use` entries of `go.work`) as task projects. Off by default.
+   * The root module is not a task project.
+   */
+  go?: {
+    discover?: boolean;
+  };
+  /**
+   * Gradle projects as task projects. Off by default: a `settings.gradle(.kts)`
+   * with a build script for each module gets build and test targets only when this is set.
+   */
+  gradle?: {
+    discover?: boolean;
+  };
+  /**
+   * Hex apps as task projects. Off by default: each `&lt;apps_path>/*` app of an umbrella
+   * `mix.exs` gets build, test and format-check targets when this is set. The root project
+   * is not a task project. POSIX only: the inferred commands are not verified on Windows.
+   */
+  hex?: {
+    discover?: boolean;
+  };
   /**
    * Auto-create targets from detected config files (Project Crystal-style).
    * Detectors run by default; set `false` to disable them entirely, or use
@@ -1293,6 +1339,13 @@ interface VisConfig {
      */
     order?: LintAdapterId[];
   };
+  /**
+   * Maven modules as task projects. Off by default: a directory with a
+   * `pom.xml` (and a project-root `artifactId`) gets build and test targets only when this is set.
+   */
+  maven?: {
+    discover?: boolean;
+  };
   /**
    * `vis-mcp` promotion notice shown after successful commands when an
    * AI CLI (Claude Code, Cursor, Windsurf, Continue, Zed, Cline) is
@@ -1319,6 +1372,14 @@ interface VisConfig {
    * to task-runner's `namedInputs` but configurable from the vis config.
    */
   namedInputs?: NamedInputs;
+  /**
+   * NuGet projects as task projects. Off by default: each directory with one `*.csproj` or
+   * `*.fsproj` (outside `bin`, `obj` and `node_modules`) gets build, test and format:check
+   * targets when this is set. POSIX only: the inferred commands are not verified on Windows.
+   */
+  nuget?: {
+    discover?: boolean;
+  };
   /** Package override mappings applied during migration (e.g., `{ "lodash": "lodash-es" }`) */
   overrides?: Record<string, string>;
   /**
@@ -1628,6 +1689,13 @@ interface VisConfig {
      */
     lockfile?: boolean;
   };
+  /**
+   * Python projects as task projects. Off by default: a directory with a
+   * `pyproject.toml` (and `[project]`) gets an inferred build target only when this is set.
+   */
+  python?: {
+    discover?: boolean;
+  };
   /**
    * Configuration for the `vis release` subsystem. Controls change-file
    * authoring, version computation, channel routing, publish behavior,
@@ -1698,6 +1766,19 @@ interface VisConfig {
    * cross-runtime multi-tool (see `rfc/design-runtime-multitool.md`).
    */
   runtime?: RuntimeId;
+  /**
+   * Options for `vis sbom`. `ecosystems` opts in ecosystems that the BOM otherwise leaves out:
+   * Maven, Gradle, Hex, Go, Dart, Swift, NuGet and Zig. An ecosystem is also included when its
+   * discover key (`maven.discover`, `go.discover`, ...) is on. Presence of a lock file or manifest
+   * alone does not include it; `vis sbom` reports such ecosystems on stderr instead.
+   * @example
+   * ```
+   * sbom: { ecosystems: ["go", "zig"] }
+   * ```
+   */
+  sbom?: {
+    ecosystems?: ("dart" | "go" | "gradle" | "hex" | "maven" | "nuget" | "swift" | "zig")[];
+  };
   /**
    * Cascading scoped-task blocks. Each block may narrow its tasks to a
    * subset of projects via `match`. Blocks are evaluated in order; later
@@ -2524,6 +2605,13 @@ interface VisConfig {
    * @default false
    */
   strictEnv?: boolean;
+  /**
+   * Swift packages (a `Package.swift` directory under the root) as task projects.
+   * Off by default. Commands are `swift build`, `swift test`, and a `swift-format lint --strict` check.
+   */
+  swift?: {
+    discover?: boolean;
+  };
   /**
    * Named bundles of target dependencies, referenceable from any task's
    * `dependsOn`. `dependsOn: [{ group: "lint" }]` expands to every entry
@@ -2663,6 +2751,14 @@ interface VisConfig {
    * @example ">=1.0.0"
    */
   versionConstraint?: string;
+  /**
+   * Zig packages as task projects. Off by default: the workspace root's
+   * `build.zig.zon` and its in-workspace `.path` dependencies get build, test and
+   * format-check targets only when this is set. The root itself is not a task project.
+   */
+  zig?: {
+    discover?: boolean;
+  };
 }
 /**
  * @since 1.0.0

package/dist/packem_chunks/CONFIG_FILES.js

@@ -1,9 +1,9 @@
-import{createRequire as I}from"node:module";import{L as x,m as K,T as O}from"../packem_shared/target-merge-hsawesT4.js";import"../packem_shared/index-CVBR-Kit.js";import{v as _,e as a,m as C}from"../packem_shared/path-CxEa27Rz-pjheKk6v.js";import{i as M}from"./ts-loader.js";import{otelPlugin as Se}from"../packem_shared/otelPlugin-D8LL2-4L.js";import{definePlugin as De}from"../packem_shared/definePlugin-DoUcoYSy.js";import{y as d}from"../packem_shared/isAccessibleSync-DYKTrrvc-K2xhg6sV.js";import{h as m}from"../packem_shared/writeFileSync-DJoHk3Ks-O9zOKqeM.js";import{p as S}from"../packem_shared/readJsonSync-CbryXYxN-BxKjDZnF.js";let N;const F=e=>(N??=I(import.meta.url))(e),l=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,v=e=>{if(typeof l<"u"&&l.versions&&l.versions.node){const[s,t]=l.versions.node.split(".").map(Number);if(s>22||s===22&&t>=3||s===20&&t>=16)return l.getBuiltinModule(e)}return F(e)},{createHash:w}=v("node:crypto"),{readdirSync:$,readFileSync:L}=v("node:fs"),{createRequire:q}=v("node:module");class p extends Error{chain;constructor(s,t,o){super(s,o),this.name=this.constructor.name,this.chain=t}}class P extends p{constructor(s,t){const o=[...t,`${s} (re-enters)`].join(" → ");super(`Config cycle: ${o}`,t)}}class E extends p{filePath;removedKeys;constructor(s,t,o){const r=[`${s} uses removed keys.`,""];for(const n of o){const c=n.location?` (at ${n.location})`:"";r.push(`  • ${n.name}${c} → renamed to \`${n.renamedTo}\``);for(const i of n.children??[])r.push(`        ↳ ${i.name} → renamed to \`${i.renamedTo}\``)}r.push("","Run `vis migrate self` to auto-rewrite the config (use --dry-run to preview)."),super(r.join(`
+import{createRequire as I}from"node:module";import{L as x,m as K,T as O}from"../packem_shared/target-merge-DVJl-7Qz.js";import{v as _,e as a,m as C}from"../packem_shared/index-BzhrR_iC.js";import{i as M}from"./ts-loader.js";import{otelPlugin as _e}from"../packem_shared/otelPlugin-D8LL2-4L.js";import{definePlugin as Ee}from"../packem_shared/definePlugin-DoUcoYSy.js";import{y as d}from"../packem_shared/isAccessibleSync-DYKTrrvc-C-_5cgwu.js";import{h as m}from"../packem_shared/writeFileSync-DJoHk3Ks-BPRoepNw.js";import{p as S}from"../packem_shared/readJsonSync-CbryXYxN-EWl7_7KX.js";let N;const F=e=>(N??=I(import.meta.url))(e),l=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,v=e=>{if(typeof l<"u"&&l.versions&&l.versions.node){const[s,t]=l.versions.node.split(".").map(Number);if(s>22||s===22&&t>=3||s===20&&t>=16)return l.getBuiltinModule(e)}return F(e)},{createHash:w}=v("node:crypto"),{readdirSync:$,readFileSync:L}=v("node:fs"),{createRequire:q}=v("node:module");class p extends Error{chain;constructor(s,t,o){super(s,o),this.name=this.constructor.name,this.chain=t}}class P extends p{constructor(s,t){const o=[...t,`${s} (re-enters)`].join(" → ");super(`Config cycle: ${o}`,t)}}class E extends p{filePath;removedKeys;constructor(s,t,o){const r=[`${s} uses removed keys.`,""];for(const n of o){const c=n.location?` (at ${n.location})`:"";r.push(`  • ${n.name}${c} → renamed to \`${n.renamedTo}\``);for(const i of n.children??[])r.push(`        ↳ ${i.name} → renamed to \`${i.renamedTo}\``)}r.push("","Run `vis migrate self` to auto-rewrite the config (use --dry-run to preview)."),super(r.join(`
 `),t),this.filePath=s,this.removedKeys=o}}class T extends p{constructor(s,t,o){const r=o instanceof Error?o.message:String(o),n=t.length>0?`
 Chain: ${t.join(" → ")}`:"";super(`Failed to load ${s}: ${r}${n}`,t,{cause:o})}}const U=e=>e.join(" → ");class k extends p{constructor(s,t,o){const r=t.length>0?t[t.length-1]:"<unknown>",n=o.length>0?`
 Tried:
   ${o.join(`
   `)}`:"";super(`Cannot resolve "${s}" extended from ${r}.${n}
 Chain: ${U(t)}`,t)}}class W extends p{filePath;violations;constructor(s,t,o){const r=[`${s} has an invalid value.`,""];for(const n of o)r.push(`  • ${n.location} — expected ${n.expected}, found ${n.found}`);r.push("","See https://visulima.com/docs/packages/vis/configuration for the expected shape."),super(r.join(`
-`),t),this.filePath=s,this.violations=o}}const z=e=>{const s=[];if(Object.hasOwn(e,"targetDefaults")&&s.push({name:"targetDefaults",renamedTo:"tasks"}),Object.hasOwn(e,"taskRunnerOptions")&&s.push({name:"taskRunnerOptions",renamedTo:"taskRunner"}),Object.hasOwn(e,"taskDefaults")){const{taskDefaults:t}=e,o=[];if(Array.isArray(t))for(const[r,n]of t.entries())n&&typeof n=="object"&&(Object.hasOwn(n,"scope")&&o.push({location:`taskDefaults[${r}].scope`,name:"scope",renamedTo:"match"}),Object.hasOwn(n,"targets")&&o.push({location:`taskDefaults[${r}].targets`,name:"targets",renamedTo:"tasks"}));s.push({children:o.length>0?o:void 0,name:"taskDefaults",renamedTo:"scopedTasks"})}else if(Array.isArray(e.scopedTasks))for(const[t,o]of e.scopedTasks.entries())o&&typeof o=="object"&&(Object.hasOwn(o,"scope")&&s.push({location:`scopedTasks[${t}].scope`,name:"scope",renamedTo:"match"}),Object.hasOwn(o,"targets")&&s.push({location:`scopedTasks[${t}].targets`,name:"targets",renamedTo:"tasks"}));return s},B=e=>Object.hasOwn(e,"targets")&&!Object.hasOwn(e,"tasks")?[{name:"targets",renamedTo:"tasks"}]:[],H=(e,s,t)=>{if(!t||typeof t!="object")return;const o=z(t);if(o.length>0)throw new E(e,s,o)},Y=(e,s,t)=>{if(!t||typeof t!="object")return;const o=B(t);if(o.length>0)throw new E(e,s,o)},h=e=>{if(e===null)return"null";if(Array.isArray(e))return"an array";if(typeof e=="object"){const s=Object.keys(e);return s.length>0?`an object with { ${s.join(", ")} }`:"an empty object"}return typeof e},g=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),J=e=>{const s=[];if(!Object.hasOwn(e,"scopedTasks")||e.scopedTasks===void 0)return s;const{scopedTasks:t}=e;if(!Array.isArray(t))return s.push({expected:"an array of `{ match?, tasks }` blocks",found:h(t),location:"scopedTasks"}),s;for(const[o,r]of t.entries()){const n=`scopedTasks[${o}]`;if(!g(r)){s.push({expected:"a `{ match?, tasks }` block",found:h(r),location:n});continue}g(r.tasks)||s.push({expected:"`tasks` to be an object keyed by target name",found:r.tasks===void 0?`a block with { ${Object.keys(r).join(", ")} }`:h(r.tasks),location:`${n}.tasks`}),r.match!==void 0&&!g(r.match)&&s.push({expected:"`match` to be an object of project constraints",found:h(r.match),location:`${n}.match`})}return s},Q=(e,s,t)=>{if(!t||typeof t!="object")return;const o=J(t);if(o.length>0)throw new W(e,s,o)},D=["vis.config.ts","vis.config.mts","vis.config.cts","vis.config.js","vis.config.mjs","vis.config.cjs"],X=new Set(D),A=["vis.task.ts","vis.task.mts","vis.task.cts","vis.task.js","vis.task.mjs","vis.task.cjs"],Z=new Set(A),Te=2880,y={blockExoticSubdeps:!0,policies:{installScripts:{strict:!0},publisherChange:{ignoreAfter:43200,mode:"no-downgrade"}}},ee=e=>{if(!e)return{...y};const s=y.policies??{},t=e.policies??{},o={...s,...t};for(const r of Object.keys(s)){const n=s[r],c=t[r];n!==void 0&&c!==void 0&&(o[r]={...n,...c})}return{...y,...e,policies:o}},b=e=>({...e,security:ee(e.security),update:{security:!0,target:"minor",...e.update}}),se=e=>{let s;try{s=$(e)}catch{return}const t=new Set(s.filter(o=>X.has(o)));for(const o of D)if(t.has(o))return a(e,o)},te=e=>{let s;try{s=$(e)}catch{return}const t=new Set(s.filter(o=>Z.has(o)));for(const o of A)if(t.has(o))return a(e,o)},V=e=>w("sha256").update(L(e)).digest("hex"),oe=e=>{const s=w("sha256"),t=[...e].sort();for(const o of t)s.update(o),s.update(":"),s.update(V(o)),s.update(`
-`);return s.digest("hex")},ne=e=>{const s=a(e,"node_modules");if(d(s)){const o=a(s,".cache","vis");return m(o),a(o,"vis-config-cache.json")}const t=x("vis",{create:!0,cwd:e});return t?a(t,"vis-config-cache.json"):void 0},re=(e,s)=>{if(d(e))try{const t=S(e);if(t.hash===s)return t.config}catch{}},ce=(e,s,t)=>{try{m(C(e)),O(e,{config:t,hash:s})}catch{}},ie=e=>e===void 0?[]:Array.isArray(e)?e:[e],ae=(e,s,t)=>{if(_(e))throw new k(e,[...t,s],["Absolute paths in `extends` are not supported. Use a relative path or an npm package name."]);const o=[];if(e.startsWith("./")||e.startsWith("../")){const r=C(s),n=a(r,e);if(o.push(n),d(n))return n;throw new k(e,[...t,s],o)}try{return q(s).resolve(e)}catch{throw o.push(`require.resolve("${e}") from ${s}`),new k(e,[...t,s],o)}},G=async(e,s)=>{let t;try{t=(await M(e)).default??{}}catch(o){throw new T(e,s,o)}try{return(typeof t=="function"?await t()??{}:t)??{}}catch(o){throw new T(e,s,o)}},fe=(e,s)=>{const t={...e,...s};if(e.tasks||s.tasks){const o=new Set([...Object.keys(e.tasks??{}),...Object.keys(s.tasks??{})]),r={};for(const n of o)r[n]=K(e.tasks?.[n],s.tasks?.[n]);t.tasks=r}if((e.scopedTasks||s.scopedTasks)&&(t.scopedTasks=[...e.scopedTasks??[],...s.scopedTasks??[]]),(e.fileGroups||s.fileGroups)&&(t.fileGroups={...e.fileGroups,...s.fileGroups}),(e.taskGroups||s.taskGroups)&&(t.taskGroups={...e.taskGroups,...s.taskGroups}),e.security||s.security){const o=e.security?.policies??{},r=s.security?.policies??{},n={...o,...r};for(const c of Object.keys(o)){const i=o[c],f=r[c];i!==void 0&&f!==void 0&&(n[c]={...i,...f})}t.security={...e.security,...s.security,acceptedRisks:{...e.security?.acceptedRisks,...s.security?.acceptedRisks},policies:n}}return(e.update||s.update)&&(t.update={...e.update,...s.update}),(e.taskRunner||s.taskRunner)&&(t.taskRunner={...e.taskRunner,...s.taskRunner}),delete t.extends,t},R=async(e,s,t,o,r)=>{if(t.has(e))throw new P(e,s);if(!o.has(e)){t.add(e);try{const n=await G(e,s);H(e,s,n),Q(e,s,n);const c=ie(n.extends);for(const i of c){const f=ae(i,e,s);await R(f,[...s,e],t,o,r)}o.set(e,n),r.push(e)}finally{t.delete(e)}}},be=async(e,s)=>{let t;if(s?.explicitConfigPath){const u=_(s.explicitConfigPath)?s.explicitConfigPath:a(e,s.explicitConfigPath);if(!d(u))throw new Error(`Cannot find config file at ${u}`);t=u}else t=se(e);if(!t)return b({});const o=new Set,r=new Map,n=[];await R(t,[],o,r,n);const c=oe(n),i=ne(e);if(i){const u=re(i,c);if(u)return u}let f={};for(const u of n)f=fe(f,r.get(u));const j=b(f);return i&&ce(i,c,j),j},ue=e=>e.replaceAll(/[^\w.-]+/g,"_"),de=(e,s)=>{const t=a(e,"node_modules"),o=ue(s);if(d(t)){const n=a(t,".cache","vis","task-configs");return m(n),a(n,`${o}.json`)}const r=x("vis",{create:!0,cwd:e});return r?a(r,"task-configs",`${o}.json`):void 0},le=(e,s)=>{if(d(e))try{const t=S(e);if(t.hash===s)return t.config}catch{}},pe=(e,s,t)=>{try{m(C(e)),O(e,{config:t,hash:s})}catch{}},we=async(e,s,t)=>{const o=te(s);if(!o)return;const r=V(o),n=de(e,t);if(n){const f=le(n,r);if(f)return f}const c=await G(o,[]);Y(o,[],c);const i=c;return n&&pe(n,r,i),i},$e=e=>e,xe=e=>e;export{D as CONFIG_FILES,Te as DEFAULT_MIN_RELEASE_AGE_MINUTES,y as SECURITY_DEFAULTS,A as TASK_CONFIG_FILES,b as applyDefaults,xe as defineConfig,De as definePlugin,$e as defineTaskConfig,se as findVisConfigFile,te as findVisTaskConfigFile,be as loadVisConfig,we as loadVisTaskConfig,Se as otelPlugin};
+`),t),this.filePath=s,this.violations=o}}const z=e=>{const s=[];if(Object.hasOwn(e,"targetDefaults")&&s.push({name:"targetDefaults",renamedTo:"tasks"}),Object.hasOwn(e,"taskRunnerOptions")&&s.push({name:"taskRunnerOptions",renamedTo:"taskRunner"}),Object.hasOwn(e,"taskDefaults")){const{taskDefaults:t}=e,o=[];if(Array.isArray(t))for(const[r,n]of t.entries())n&&typeof n=="object"&&(Object.hasOwn(n,"scope")&&o.push({location:`taskDefaults[${r}].scope`,name:"scope",renamedTo:"match"}),Object.hasOwn(n,"targets")&&o.push({location:`taskDefaults[${r}].targets`,name:"targets",renamedTo:"tasks"}));s.push({children:o.length>0?o:void 0,name:"taskDefaults",renamedTo:"scopedTasks"})}else if(Array.isArray(e.scopedTasks))for(const[t,o]of e.scopedTasks.entries())o&&typeof o=="object"&&(Object.hasOwn(o,"scope")&&s.push({location:`scopedTasks[${t}].scope`,name:"scope",renamedTo:"match"}),Object.hasOwn(o,"targets")&&s.push({location:`scopedTasks[${t}].targets`,name:"targets",renamedTo:"tasks"}));return s},B=e=>Object.hasOwn(e,"targets")&&!Object.hasOwn(e,"tasks")?[{name:"targets",renamedTo:"tasks"}]:[],H=(e,s,t)=>{if(!t||typeof t!="object")return;const o=z(t);if(o.length>0)throw new E(e,s,o)},Y=(e,s,t)=>{if(!t||typeof t!="object")return;const o=B(t);if(o.length>0)throw new E(e,s,o)},h=e=>{if(e===null)return"null";if(Array.isArray(e))return"an array";if(typeof e=="object"){const s=Object.keys(e);return s.length>0?`an object with { ${s.join(", ")} }`:"an empty object"}return typeof e},g=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),J=e=>{const s=[];if(!Object.hasOwn(e,"scopedTasks")||e.scopedTasks===void 0)return s;const{scopedTasks:t}=e;if(!Array.isArray(t))return s.push({expected:"an array of `{ match?, tasks }` blocks",found:h(t),location:"scopedTasks"}),s;for(const[o,r]of t.entries()){const n=`scopedTasks[${o}]`;if(!g(r)){s.push({expected:"a `{ match?, tasks }` block",found:h(r),location:n});continue}g(r.tasks)||s.push({expected:"`tasks` to be an object keyed by target name",found:r.tasks===void 0?`a block with { ${Object.keys(r).join(", ")} }`:h(r.tasks),location:`${n}.tasks`}),r.match!==void 0&&!g(r.match)&&s.push({expected:"`match` to be an object of project constraints",found:h(r.match),location:`${n}.match`})}return s},Q=(e,s,t)=>{if(!t||typeof t!="object")return;const o=J(t);if(o.length>0)throw new W(e,s,o)},D=["vis.config.ts","vis.config.mts","vis.config.cts","vis.config.js","vis.config.mjs","vis.config.cjs"],X=new Set(D),A=["vis.task.ts","vis.task.mts","vis.task.cts","vis.task.js","vis.task.mjs","vis.task.cjs"],Z=new Set(A),je=2880,y={blockExoticSubdeps:!0,policies:{installScripts:{strict:!0},publisherChange:{ignoreAfter:43200,mode:"no-downgrade"}}},ee=e=>{if(!e)return{...y};const s=y.policies??{},t=e.policies??{},o={...s,...t};for(const r of Object.keys(s)){const n=s[r],c=t[r];n!==void 0&&c!==void 0&&(o[r]={...n,...c})}return{...y,...e,policies:o}},b=e=>({...e,security:ee(e.security),update:{security:!0,target:"minor",...e.update}}),se=e=>{let s;try{s=$(e)}catch{return}const t=new Set(s.filter(o=>X.has(o)));for(const o of D)if(t.has(o))return a(e,o)},te=e=>{let s;try{s=$(e)}catch{return}const t=new Set(s.filter(o=>Z.has(o)));for(const o of A)if(t.has(o))return a(e,o)},V=e=>w("sha256").update(L(e)).digest("hex"),oe=e=>{const s=w("sha256"),t=[...e].sort();for(const o of t)s.update(o),s.update(":"),s.update(V(o)),s.update(`
+`);return s.digest("hex")},ne=e=>{const s=a(e,"node_modules");if(d(s)){const o=a(s,".cache","vis");return m(o),a(o,"vis-config-cache.json")}const t=x("vis",{create:!0,cwd:e});return t?a(t,"vis-config-cache.json"):void 0},re=(e,s)=>{if(d(e))try{const t=S(e);if(t.hash===s)return t.config}catch{}},ce=(e,s,t)=>{try{m(C(e)),O(e,{config:t,hash:s})}catch{}},ie=e=>e===void 0?[]:Array.isArray(e)?e:[e],ae=(e,s,t)=>{if(_(e))throw new k(e,[...t,s],["Absolute paths in `extends` are not supported. Use a relative path or an npm package name."]);const o=[];if(e.startsWith("./")||e.startsWith("../")){const r=C(s),n=a(r,e);if(o.push(n),d(n))return n;throw new k(e,[...t,s],o)}try{return q(s).resolve(e)}catch{throw o.push(`require.resolve("${e}") from ${s}`),new k(e,[...t,s],o)}},G=async(e,s)=>{let t;try{t=(await M(e)).default??{}}catch(o){throw new T(e,s,o)}try{return(typeof t=="function"?await t()??{}:t)??{}}catch(o){throw new T(e,s,o)}},fe=(e,s)=>{const t={...e,...s};if(e.tasks||s.tasks){const o=new Set([...Object.keys(e.tasks??{}),...Object.keys(s.tasks??{})]),r={};for(const n of o)r[n]=K(e.tasks?.[n],s.tasks?.[n]);t.tasks=r}if((e.scopedTasks||s.scopedTasks)&&(t.scopedTasks=[...e.scopedTasks??[],...s.scopedTasks??[]]),(e.fileGroups||s.fileGroups)&&(t.fileGroups={...e.fileGroups,...s.fileGroups}),(e.taskGroups||s.taskGroups)&&(t.taskGroups={...e.taskGroups,...s.taskGroups}),e.security||s.security){const o=e.security?.policies??{},r=s.security?.policies??{},n={...o,...r};for(const c of Object.keys(o)){const i=o[c],f=r[c];i!==void 0&&f!==void 0&&(n[c]={...i,...f})}t.security={...e.security,...s.security,acceptedRisks:{...e.security?.acceptedRisks,...s.security?.acceptedRisks},policies:n}}return(e.update||s.update)&&(t.update={...e.update,...s.update}),(e.taskRunner||s.taskRunner)&&(t.taskRunner={...e.taskRunner,...s.taskRunner}),delete t.extends,t},R=async(e,s,t,o,r)=>{if(t.has(e))throw new P(e,s);if(!o.has(e)){t.add(e);try{const n=await G(e,s);H(e,s,n),Q(e,s,n);const c=ie(n.extends);for(const i of c){const f=ae(i,e,s);await R(f,[...s,e],t,o,r)}o.set(e,n),r.push(e)}finally{t.delete(e)}}},Te=async(e,s)=>{let t;if(s?.explicitConfigPath){const u=_(s.explicitConfigPath)?s.explicitConfigPath:a(e,s.explicitConfigPath);if(!d(u))throw new Error(`Cannot find config file at ${u}`);t=u}else t=se(e);if(!t)return b({});const o=new Set,r=new Map,n=[];await R(t,[],o,r,n);const c=oe(n),i=ne(e);if(i){const u=re(i,c);if(u)return u}let f={};for(const u of n)f=fe(f,r.get(u));const j=b(f);return i&&ce(i,c,j),j},ue=e=>e.replaceAll(/[^\w.-]+/g,"_"),de=(e,s)=>{const t=a(e,"node_modules"),o=ue(s);if(d(t)){const n=a(t,".cache","vis","task-configs");return m(n),a(n,`${o}.json`)}const r=x("vis",{create:!0,cwd:e});return r?a(r,"task-configs",`${o}.json`):void 0},le=(e,s)=>{if(d(e))try{const t=S(e);if(t.hash===s)return t.config}catch{}},pe=(e,s,t)=>{try{m(C(e)),O(e,{config:t,hash:s})}catch{}},be=async(e,s,t)=>{const o=te(s);if(!o)return;const r=V(o),n=de(e,t);if(n){const f=le(n,r);if(f)return f}const c=await G(o,[]);Y(o,[],c);const i=c;return n&&pe(n,r,i),i},we=e=>e,$e=e=>e;export{D as CONFIG_FILES,je as DEFAULT_MIN_RELEASE_AGE_MINUTES,y as SECURITY_DEFAULTS,A as TASK_CONFIG_FILES,b as applyDefaults,$e as defineConfig,Ee as definePlugin,we as defineTaskConfig,se as findVisConfigFile,te as findVisTaskConfigFile,Te as loadVisConfig,be as loadVisTaskConfig,_e as otelPlugin};

package/dist/packem_chunks/bloom-status.js

@@ -1,2 +1,2 @@
-import{b as f,F as s,J as c}from"../packem_shared/index.server-sXNQYpsl.js";import{p as r}from"./cli-main.js";import{g as u}from"../packem_shared/osv-bloom-BRacgzs7.js";const a=t=>{if(!t)return"never";const i=Date.parse(t);if(Number.isNaN(i))return t;const e=Date.now()-i;if(e<0)return t;const n=Math.floor(e/6e4);if(n<1)return"just now";if(n<60)return`${n}m ago`;const o=Math.floor(n/60);return o<24?`${o}h ago`:`${Math.floor(o/24)}d ago`},m=t=>t<1024?`${t} B`:t<1024*1024?`${(t/1024).toFixed(1)} KB`:`${(t/(1024*1024)).toFixed(1)} MB`,l=async({options:t,workspaceRoot:i})=>{if(!i)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const e=await u(i,t.cacheDir);if(t.format==="json"){process.stdout.write(`${JSON.stringify(e,void 0,2)}
+import{b as f,F as s,J as c}from"../packem_shared/index.server-sXNQYpsl.js";import{p as r}from"./cli-main.js";import{g as u}from"../packem_shared/osv-bloom-BCAX5ARR.js";const a=t=>{if(!t)return"never";const i=Date.parse(t);if(Number.isNaN(i))return t;const e=Date.now()-i;if(e<0)return t;const n=Math.floor(e/6e4);if(n<1)return"just now";if(n<60)return`${n}m ago`;const o=Math.floor(n/60);return o<24?`${o}h ago`:`${Math.floor(o/24)}d ago`},m=t=>t<1024?`${t} B`:t<1024*1024?`${(t/1024).toFixed(1)} KB`:`${(t/(1024*1024)).toFixed(1)} MB`,l=async({options:t,workspaceRoot:i})=>{if(!i)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const e=await u(i,t.cacheDir);if(t.format==="json"){process.stdout.write(`${JSON.stringify(e,void 0,2)}
 `);return}if(r.info(`Cache: ${e.cacheDir}`),!e.present){r.warn(`No osv-bloom filter yet. Run ${f("vis advisories bloom sync")} to populate.`);return}if(e.manifest){const{manifest:o}=e;r.info(`Built:  ${o.builtAtRfc3339} (${a(o.builtAtRfc3339)})`),r.info(`Fetch:  ${e.fetchedAtIso??s("—")} (${a(e.fetchedAtIso)})`),r.info(`Filter: ${c(m(o.bloomByteLen))}   m=${o.bloomMBits.toLocaleString()} bits   k=${String(o.bloomKHashes)}`),r.info(`Set:    ${o.entryCount.toLocaleString()} entries from ${o.advisoryCount.toLocaleString()} advisories (target FPR ${o.targetFpr})`),r.info(s(`Digest: ${o.setDigestSha256}`))}else r.warn("filter.bin present but manifest.json missing — `vis advisories bloom sync` will rewrite the cache.")},g=l;export{g as advisoriesBloomStatusExecute};

package/dist/packem_chunks/bloom-sync.js

@@ -1,2 +1,2 @@
-import{F as f}from"../packem_shared/index.server-sXNQYpsl.js";import{p as i}from"./cli-main.js";import{s as d}from"../packem_shared/scan-progress-BGB9hIrD.js";import{D as p,s as D}from"../packem_shared/osv-bloom-BRacgzs7.js";const h=o=>o?.security?.audit?.advisories?.bloom??{},u=o=>o>=1e3?`${(o/1e3).toFixed(1)}s`:`${Math.round(o)}ms`,$=o=>o<1024?`${o} B`:o<1024*1024?`${(o/1024).toFixed(1)} KB`:`${(o/(1024*1024)).toFixed(1)} MB`,b=async({options:o,visConfig:m,workspaceRoot:n})=>{if(!n)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const a=o.format==="json",c=h(m),l=o.source??c.source??p,r=d([{id:"bloom",label:"Sync osv-bloom prefilter"}],{live:!a});let e,t;try{r.start("bloom");const s=Date.now();e=await D({allowedHosts:c.allowedHosts,cacheDir:o.cacheDir,force:!!o.force,source:l,workspaceRoot:n}),e.upToDate?r.finish("bloom","ok",`up to date · ${u(Date.now()-s)}`):r.finish("bloom","ok",`${e.manifest.entryCount.toLocaleString()} entries · ${$(e.bytesOnDisk)} · ${u(e.durationMs)}`)}catch(s){t=s instanceof Error?s.message:String(s),r.finish("bloom","error",t)}finally{r.stop()}a?process.stdout.write(`${JSON.stringify({bytesOnDisk:e?.bytesOnDisk??0,cacheDir:e?.cacheDir??null,durationMs:e?.durationMs??0,error:t??null,manifest:e?.manifest??null,source:l,upToDate:e?.upToDate??!1},void 0,2)}
+import{F as f}from"../packem_shared/index.server-sXNQYpsl.js";import{p as i}from"./cli-main.js";import{s as d}from"../packem_shared/scan-progress-C_zaZjyY.js";import{D as p,s as D}from"../packem_shared/osv-bloom-BCAX5ARR.js";const h=o=>o?.security?.audit?.advisories?.bloom??{},u=o=>o>=1e3?`${(o/1e3).toFixed(1)}s`:`${Math.round(o)}ms`,$=o=>o<1024?`${o} B`:o<1024*1024?`${(o/1024).toFixed(1)} KB`:`${(o/(1024*1024)).toFixed(1)} MB`,b=async({options:o,visConfig:m,workspaceRoot:n})=>{if(!n)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const a=o.format==="json",c=h(m),l=o.source??c.source??p,r=d([{id:"bloom",label:"Sync osv-bloom prefilter"}],{live:!a});let e,t;try{r.start("bloom");const s=Date.now();e=await D({allowedHosts:c.allowedHosts,cacheDir:o.cacheDir,force:!!o.force,source:l,workspaceRoot:n}),e.upToDate?r.finish("bloom","ok",`up to date · ${u(Date.now()-s)}`):r.finish("bloom","ok",`${e.manifest.entryCount.toLocaleString()} entries · ${$(e.bytesOnDisk)} · ${u(e.durationMs)}`)}catch(s){t=s instanceof Error?s.message:String(s),r.finish("bloom","error",t)}finally{r.stop()}a?process.stdout.write(`${JSON.stringify({bytesOnDisk:e?.bytesOnDisk??0,cacheDir:e?.cacheDir??null,durationMs:e?.durationMs??0,error:t??null,manifest:e?.manifest??null,source:l,upToDate:e?.upToDate??!1},void 0,2)}
 `):e&&(i.info(f(`Cache: ${e.cacheDir}`)),i.info(f(`Built: ${e.manifest.builtAtRfc3339}`)),t||i.success(e.upToDate?"osv-bloom prefilter up to date.":"osv-bloom prefilter synced.")),t&&(process.exitCode=1)},g=b;export{g as advisoriesBloomSyncExecute};

package/dist/packem_chunks/cargo-plan.js

@@ -0,0 +1,3 @@
+import{createRequire as S}from"node:module";import{s as P}from"../packem_shared/index-B4AjSxHU.js";import{VisReleaseError as R}from"../packem_shared/VisReleaseError-DZtgcKf8.js";import{e as b,i as j,f as L,s as F,g as x}from"./index2.js";let O;const q=a=>(O??=S(import.meta.url))(a),_=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,M=a=>{if(typeof _<"u"&&_.versions&&_.versions.node){const[n,s]=_.versions.node.split(".").map(Number);if(n>22||n===22&&s>=3||n===20&&s>=16)return _.getBuiltinModule(a)}return q(a)},{readFile:B}=M("node:fs/promises"),{dirname:$,join:D,resolve:E}=M("node:path"),G=new Set(["package"]),K=new Set(["workspace.package"]),y=new Set(["build-dependencies","dependencies","dev-dependencies"]),V=async(a,n)=>a.get(n)??B(n,"utf8"),I=async(a,n,s)=>{const o=x(n);let i=x(a);for(;;){const d=D(i,"Cargo.toml"),r=await V(s,d).catch(()=>{});if(r!==void 0&&typeof(await b(r,d)).workspace?.package?.version=="string")return d;if(i===o)return;const u=$(i);if(u===i)return;i=u}},W=(a,n)=>{const s=/^([\^~=])?\s*(.+)$/.exec(a.trim());if(!s)return;const o=s[1]??"",i=s[2];if(i.includes("*"))return;const d=o===""?`^${i}`:`${o}${i}`;if(P.validRange(d)&&!P.satisfies(n,d))return`${o}${n}`},T=a=>{const n=a.split(".").map(d=>d.trim()),s=n[n.length-1]??"",o=n[0]==="target"||n[0]==="workspace"||n.length===1||y.has(n[0]??"");if(y.has(s)&&o)return{kind:"table"};const i=n[n.length-2]??"";return y.has(i)&&(n[0]==="target"||n[0]==="workspace"||n.length===2)?{key:s,kind:"dep"}:{kind:"none"}},C=/(version\s*=\s*)(["'])([^"']*)\2/,H=(a,n,s)=>{const o=a.split(`
+`),i=[];let d=!1,r={kind:"none"};const u=(l,f,v,p)=>{if(f===void 0)return;if(f.includes(",")){i.push(`cargo-deps: ${p} has a compound requirement "${f}" in ${n}; left unchanged.`);return}const e=W(f,v);e!==void 0&&(o[l]=o[l].replace(C,(t,c,h)=>`${c}${h}${e}${h}`),d=!0)},w=()=>{if(r.kind!=="dep"||r.path===void 0||r.versionLine===void 0||r.version===void 0)return;const l=s.get(E(n,r.path));l!==void 0&&u(r.versionLine,r.version,l,r.key)};for(const[l,f]of o.entries()){const v=/^\s*\[\[?\s*([^\]]+?)\s*\]\]?\s*(?:#.*)?$/.exec(f);if(v){w(),r=T(v[1].replaceAll(/\s+/g,""));continue}if(r.kind==="table"){const p=/^\s*([^=\s]+)\s*=\s*\{(.*)\}\s*$/.exec(f);if(!p)continue;const e=/path\s*=\s*"([^"]*)"/.exec(p[2])?.[1],t=C.exec(p[2])?.[3];if(e===void 0||t===void 0)continue;const c=s.get(E(n,e));c!==void 0&&u(l,t,c,p[1]);continue}if(r.kind==="dep"){const p=/^\s*path\s*=\s*"([^"]*)"/.exec(f)?.[1];if(p!==void 0){r.path=p;continue}const e=C.exec(f);e&&(r.versionLine=l,r.version=e.at(3))}}return w(),d?{content:o.join(`
+`),warnings:i}:{warnings:i}},X=async a=>{const{crateManifests:n,cwd:s,pending:o,releases:i,rewriteDependents:d=!0,scanManifests:r}=a,u=new Set,w=[],l=new Map,f=new Map;for(const e of i)for(const t of e.manifestPaths)l.set($(t),e.newVersion),f.set(t,e.newVersion);const v=new Map;for(const e of i){if(e.ecosystem!=="cargo")continue;const t=e.manifestPaths[0];if(t===void 0)continue;const c=await V(o,t),h=await b(c,t);if(!j(h.package?.version)){const g=L(c,e.newVersion,G);g.content!==void 0&&(o.set(t,g.content),u.add(t));continue}const m=await I($(t),s,o);if(m===void 0)throw new R({code:"CONFIG_INVALID",file:t,message:`${t} inherits its version, but no ancestor Cargo.toml declares [workspace.package].version.`});const k=v.get(m)??{members:[],version:e.newVersion};k.members.push(t),v.set(m,k)}for(const[e,t]of v){const c=[];for(const g of n){const A=await V(o,g).catch(()=>{});if(A===void 0)continue;const N=await b(A,g);j(N.package?.version)&&await I($(g),s,o)===e&&c.push(g)}const h=c.filter(g=>f.get(g)!==t.version);if(h.length>0)throw new R({code:"CONFIG_INVALID",file:e,message:`Crates inherit [workspace.package].version from ${e}, so they must release together at ${t.version}. Not released at that version: ${h.join(", ")}.`});const m=await V(o,e),k=L(m,t.version,K);k.content!==void 0&&(o.set(e,k.content),u.add(e))}for(const e of d?r:[]){const t=await V(o,e).catch(()=>{});if(t===void 0)continue;const c=H(t,$(e),l);w.push(...c.warnings),c.content!==void 0&&(o.set(e,c.content),u.add(e))}const p=i.flatMap(e=>e.manifestPaths.map(t=>({manifestPath:t,newVersion:e.newVersion})));if(p.length>0){const e=await F({entries:p,pending:o,workspaceRoot:s});w.push(...e.warnings);for(const t of e.writes)u.add(t.path)}return{touched:u,warnings:w}};export{W as nextRequirement,X as planCargoWorkspace,H as rewriteCargoRequirements};