@visulima/vis 4.2.0 → 4.3.0

package/dist/packem_chunks/orchestrator.js

@@ -1,46 +1,46 @@
-import{createRequire as He}from"node:module";import{a as W}from"../packem_shared/index-B4AjSxHU.js";import{DEFAULT_CHANGES_DIR as ne,DEFAULT_DEPENDENCY_BUMP_RULES as qe,DEFAULT_CONFIG as Xe}from"./DEFAULT_CLEAN_KEEP.js";import{VisReleaseError as N}from"../packem_shared/VisReleaseError-DZtgcKf8.js";import{e as Qe,p as Ze,b as xe}from"./index2.js";import{L as ss}from"../packem_shared/index-BisalDCf.js";import{BUMP_LEVELS as ye,maxBump as ue,normaliseGroup as ve,bumpRank as te}from"../release/types.js";import{isValidPackageName as as,escapeMarkdown as ns,assertValidPackageName as ts}from"./security.js";import re from"./index.js";import{d as rs,c as is}from"./index3.js";import{createShellRunner as ee}from"./shell-runner.js";let Ue;const We=e=>(Ue??=He(import.meta.url))(e),Q=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,we=e=>{if(typeof Q<"u"&&Q.versions&&Q.versions.node){const[s,a]=Q.versions.node.split(".").map(Number);if(s>22||s===22&&a>=3||s===20&&a>=16)return Q.getBuiltinModule(e)}return We(e)},{readdir:Ye,readFile:ze,writeFile:Ke,unlink:Je}=we("node:fs/promises"),{resolve:ge,sep:Z,join:es}=we("node:path"),{realpathSync:be}=we("node:fs"),os=/^exit[\s-]prerelease\s*:\s*(.+)$/i,cs=/^(.+)@(\d+\.\d+\.\d+(?:[-+].*)?)$/,ke=(e,s,a)=>{if(!as(e))throw new N({code:"BUMP_FILE_INVALID",file:a,message:`Invalid replay condition "${s}": ${JSON.stringify(e)} is not a valid package name.`,packageName:e||void 0});return e},ls=(e,s)=>{if(typeof e!="string"||e.trim()==="")throw new N({code:"BUMP_FILE_INVALID",file:s,message:`Invalid replay condition: ${JSON.stringify(e)}. Expected "name@1.2.0" or "exit-prerelease:name".`});const a=e.trim(),n=os.exec(a);if(n)return{kind:"exit-prerelease",package:ke((n[1]??"").trim(),a,s)};const t=cs.exec(a);if(t)return{kind:"version",package:ke((t[1]??"").trim(),a,s),version:t[2]??""};throw new N({code:"BUMP_FILE_INVALID",file:s,message:`Invalid replay condition "${a}". Expected "name@1.2.0" or "exit-prerelease:name".`})},ds=(e,s)=>{if(!Array.isArray(e))throw new N({code:"BUMP_FILE_INVALID",file:s,message:'`replay` must be a list of conditions (e.g. ["name@1.2.0", "exit-prerelease:name"]).'});return e.map(a=>ls(a,s))},fe=e=>!("bumps"in e.payload)&&Array.isArray(e.payload.replay)&&e.payload.replay.length>0,Pe=e=>/^\d+\.\d+\.\d+-/.test(e),ps=(e,s)=>e.package!==s.name?!1:e.kind==="version"?s.newVersion===e.version:Pe(s.oldVersion)&&!Pe(s.newVersion),gs=(e,s)=>{const a=new Map,n=[],t=[];for(const o of e){if(!fe(o))continue;const p=o.payload.replay;let c=!0;for(const r of p){const i=s.find(l=>ps(r,l));if(i){const l=a.get(i.name)??[];l.some(u=>u.id===o.id)||l.push(o),a.set(i.name,l)}else c=!1}c?n.push(o):t.push(o)}return{consumed:n,injectionsByPackage:a,retained:t}},us=/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/,fs=e=>{const s=us.exec(e);return s?{body:(s[2]??"").trim(),frontmatter:s[1]??""}:null},ms=/^(?:@[a-z0-9-]+\/)?[\w.-]+$/i,hs=214,ws=e=>e.length===0||e.length>hs||e.startsWith(".")||e.startsWith("_")||e.startsWith("-")?!1:ms.test(e),me=e=>typeof e=="string"&&ye.includes(e),ys=/^ {0,3}(#{1,3})\s+\S/,vs=/^ {0,3}(?:```|~~~)/,bs=e=>{let s,a=0,n=!1;for(const t of e.split(/\r?\n/)){if(vs.test(t)){n=!n;continue}if(n)continue;const o=ys.exec(t);if(!o)continue;const p=(o[1]??"").length,c=4-p;c>a&&(a=c,s=p===1?"major":p===2?"minor":"patch")}return s},ks=/^\s*(pr|commit|author)\s*:\s*(.+?)\s*$/i,Ps=e=>{const s=e.split(/\r?\n/),a={};let n=0;for(const o of s){if(o.trim()===""){n+=1;continue}const p=ks.exec(o);if(!p)break;const[,c="",r=""]=p;switch(c.toLowerCase()){case"author":{a.author=r.startsWith("@")?r:`@${r}`;break}case"commit":{a.commit=r;break}case"pr":{const l=Number.parseInt(r,10);!Number.isNaN(l)&&l>0&&(a.pr=l);break}}n+=1}const t=s.slice(n).join(`
-`).trim();return{meta:Object.keys(a).length>0?a:void 0,remainder:t}},$e=e=>typeof e=="object"&&e!==null&&!Array.isArray(e)&&("bump"in e||"replay"in e),$s=(e,s,a)=>{const n=s.replay!==void 0;if(n&&s.bump!==void 0)throw new N({code:"BUMP_FILE_INVALID",file:a,message:`"${e}" sets both \`bump\` and \`replay\`. Replay files are changelog-only and never bump — remove \`bump\`, or drop \`replay\` to make this a normal change file.`,packageName:e});const t=s.bump===void 0&&n?"none":s.bump;if(!me(t))throw new N({code:"BUMP_FILE_INVALID",file:a,message:`Invalid bump level for "${e}": ${JSON.stringify(s.bump)}. Expected one of: ${ye.join(", ")}`,packageName:e});const o={bump:t,package:e};if(n&&(o.replay=ds(s.replay,a)),s.releaseAs!==void 0){if(typeof s.releaseAs!="string"||!/^\d+\.\d+\.\d+(?:[-+].*)?$/.test(s.releaseAs))throw new N({code:"BUMP_FILE_INVALID",file:a,message:`Invalid releaseAs for "${e}": ${JSON.stringify(s.releaseAs)}. Expected a semver string like "2.0.0" or "2.0.0-rc.1".`,packageName:e});o.releaseAs=s.releaseAs}if(s.cascade!==void 0){if(typeof s.cascade!="object"||s.cascade===null||Array.isArray(s.cascade))throw new N({code:"BUMP_FILE_INVALID",file:a,message:`Cascade block for "${e}" must be an object mapping package globs to bump levels.`,packageName:e});const p={};for(const[c,r]of Object.entries(s.cascade)){if(!me(r))throw new N({code:"BUMP_FILE_INVALID",file:a,message:`Invalid cascade bump level for "${c}": ${JSON.stringify(r)}.`,packageName:e});p[c]=r}o.cascade=p}return o},ce=e=>e.replaceAll(/^.*[/\\]/g,"").replace(/\.md$/i,""),Cs=(e,s)=>{const a=fs(e);if(!a)throw new N({code:"BUMP_FILE_INVALID",file:s,message:"Change file is missing YAML frontmatter (expected `---` delimiters)."});let n;try{n=ss(a.frontmatter,{strict:!0})}catch(r){throw new N({cause:r,code:"BUMP_FILE_INVALID",file:s,message:`YAML parse failed: ${r.message}`})}if(n==null)return{body:a.body.trim(),id:ce(s),path:s,payload:{bumps:{}}};if(typeof n!="object"||Array.isArray(n))throw new N({code:"BUMP_FILE_INVALID",file:s,message:"Frontmatter must be a YAML object mapping package names to bump levels."});const t=Object.entries(n);if(t.length===0)return{body:a.body.trim(),id:ce(s),path:s,payload:{bumps:{}}};for(const[r]of t)if(!ws(r))throw new N({code:"BUMP_FILE_INVALID",file:s,message:`Invalid package name: ${JSON.stringify(r)}.`,packageName:r});let o;if(t.length===1&&$e(t[0][1])){const[r,i]=t[0];o=$s(r,i,s)}else{const r={},i=[];for(const[l,u]of t){if($e(u))throw new N({code:"BUMP_FILE_INVALID",file:s,message:`Mixed simple + nested entries are not allowed. Package "${l}" uses the nested shape but the file has multiple top-level entries.`,packageName:l});if(u==null||u===""){i.push(l);continue}if(!me(u))throw new N({code:"BUMP_FILE_INVALID",file:s,message:`Invalid bump level for "${l}": ${JSON.stringify(u)}. Expected one of: ${ye.join(", ")}`,packageName:l});r[l]=u}if(i.length>0){const l=bs(a.body);if(!l)throw new N({code:"BUMP_FILE_INVALID",file:s,message:`No bump level for ${i.map(u=>`"${u}"`).join(", ")}: the entry is empty and the body has no markdown heading to infer one from. Add an explicit level (e.g. \`${i[0]}: minor\`) or a heading (\`# major\`, \`## minor\`, \`### patch\`).`,packageName:i[0]});for(const u of i)r[u]=l}o={bumps:r}}const{meta:p,remainder:c}=Ps(a.body);return{body:c,id:ce(s),meta:p,path:s,payload:o}},ma=(e,s)=>{let a;if("bumps"in e){const n=Object.entries(e.bumps).map(([t,o])=>`${le(t)}: ${o}`);a=n.length>0?n.join(`
-`):"{}"}else{const n=[`${le(e.package)}:`,`  bump: ${e.bump}`];if(e.releaseAs&&n.push(`  releaseAs: ${e.releaseAs}`),e.cascade){n.push("  cascade:");for(const[t,o]of Object.entries(e.cascade))n.push(`    ${le(t)}: ${o}`)}if(e.replay&&e.replay.length>0){n.push("  replay:");for(const t of e.replay){const o=t.kind==="version"?`${t.package}@${t.version}`:`exit-prerelease:${t.package}`;n.push(`    - "${o}"`)}}a=n.join(`
+import{createRequire as ta}from"node:module";import{a as J}from"../packem_shared/index-B4AjSxHU.js";import{DEFAULT_CHANGES_DIR as oe,DEFAULT_DEPENDENCY_BUMP_RULES as ga,DEFAULT_CONFIG as ua}from"./DEFAULT_CLEAN_KEEP.js";import{VisReleaseError as E}from"../packem_shared/VisReleaseError-DZtgcKf8.js";import{l as ma,m as fa,p as ha,b as wa}from"./index2.js";import{L as ya}from"../packem_shared/index-BisalDCf.js";import{BUMP_LEVELS as be,maxBump as we,normaliseGroup as $e,bumpRank as ce}from"../release/types.js";import{isValidPackageName as va,escapeMarkdown as ka,assertValidPackageName as Pa}from"./security.js";import le from"./index.js";import{d as ba,c as $a}from"./index3.js";import{createShellRunner as re}from"./shell-runner.js";let ra;const ia=e=>(ra??=ta(import.meta.url))(e),ne=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,Pe=e=>{if(typeof ne<"u"&&ne.versions&&ne.versions.node){const[a,s]=ne.versions.node.split(".").map(Number);if(a>22||a===22&&s>=3||a===20&&s>=16)return ne.getBuiltinModule(e)}return ia(e)},{readdir:oa,readFile:ca,writeFile:la,unlink:da}=Pe("node:fs/promises"),{resolve:W,sep:x,join:pa,dirname:ge}=Pe("node:path"),{realpathSync:Ce}=Pe("node:fs"),Ca=/^exit[\s-]prerelease\s*:\s*(.+)$/i,Ra=/^(.+)@(\d+\.\d+\.\d+(?:[-+].*)?)$/,Re=(e,a,s)=>{if(!va(e))throw new E({code:"BUMP_FILE_INVALID",file:s,message:`Invalid replay condition "${a}": ${JSON.stringify(e)} is not a valid package name.`,packageName:e||void 0});return e},Aa=(e,a)=>{if(typeof e!="string"||e.trim()==="")throw new E({code:"BUMP_FILE_INVALID",file:a,message:`Invalid replay condition: ${JSON.stringify(e)}. Expected "name@1.2.0" or "exit-prerelease:name".`});const s=e.trim(),n=Ca.exec(s);if(n)return{kind:"exit-prerelease",package:Re((n[1]??"").trim(),s,a)};const t=Ra.exec(s);if(t)return{kind:"version",package:Re((t[1]??"").trim(),s,a),version:t[2]??""};throw new E({code:"BUMP_FILE_INVALID",file:a,message:`Invalid replay condition "${s}". Expected "name@1.2.0" or "exit-prerelease:name".`})},Na=(e,a)=>{if(!Array.isArray(e))throw new E({code:"BUMP_FILE_INVALID",file:a,message:'`replay` must be a list of conditions (e.g. ["name@1.2.0", "exit-prerelease:name"]).'});return e.map(s=>Aa(s,a))},ye=e=>!("bumps"in e.payload)&&Array.isArray(e.payload.replay)&&e.payload.replay.length>0,Ae=e=>/^\d+\.\d+\.\d+-/.test(e),Ea=(e,a)=>e.package!==a.name?!1:e.kind==="version"?a.newVersion===e.version:Ae(a.oldVersion)&&!Ae(a.newVersion),Ia=(e,a)=>{const s=new Map,n=[],t=[];for(const r of e){if(!ye(r))continue;const l=r.payload.replay;let c=!0;for(const i of l){const o=a.find(d=>Ea(i,d));if(o){const d=s.get(o.name)??[];d.some(u=>u.id===r.id)||d.push(r),s.set(o.name,d)}else c=!1}c?n.push(r):t.push(r)}return{consumed:n,injectionsByPackage:s,retained:t}},Ma=/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/,Da=e=>{const a=Ma.exec(e);return a?{body:(a[2]??"").trim(),frontmatter:a[1]??""}:null},ja=/^(?:@[a-z0-9-]+\/)?[\w.-]+(?:\/[\w.-]+)*(?::[\w.-]+)?$/i,_a=214,Sa=e=>e.length===0||e.length>_a||e.startsWith(".")||e.startsWith("_")||e.startsWith("-")?!1:ja.test(e),ve=e=>typeof e=="string"&&be.includes(e),Va=/^ {0,3}(#{1,3})\s+\S/,Fa=/^ {0,3}(?:```|~~~)/,Ta=e=>{let a,s=0,n=!1;for(const t of e.split(/\r?\n/)){if(Fa.test(t)){n=!n;continue}if(n)continue;const r=Va.exec(t);if(!r)continue;const l=(r[1]??"").length,c=4-l;c>s&&(s=c,a=l===1?"major":l===2?"minor":"patch")}return a},La=/^\s*(pr|commit|author)\s*:\s*(.+?)\s*$/i,Oa=e=>{const a=e.split(/\r?\n/),s={};let n=0;for(const r of a){if(r.trim()===""){n+=1;continue}const l=La.exec(r);if(!l)break;const[,c="",i=""]=l;switch(c.toLowerCase()){case"author":{s.author=i.startsWith("@")?i:`@${i}`;break}case"commit":{s.commit=i;break}case"pr":{const d=Number.parseInt(i,10);!Number.isNaN(d)&&d>0&&(s.pr=d);break}}n+=1}const t=a.slice(n).join(`
+`).trim();return{meta:Object.keys(s).length>0?s:void 0,remainder:t}},Ne=e=>typeof e=="object"&&e!==null&&!Array.isArray(e)&&("bump"in e||"replay"in e),Ba=(e,a,s)=>{const n=a.replay!==void 0;if(n&&a.bump!==void 0)throw new E({code:"BUMP_FILE_INVALID",file:s,message:`"${e}" sets both \`bump\` and \`replay\`. Replay files are changelog-only and never bump — remove \`bump\`, or drop \`replay\` to make this a normal change file.`,packageName:e});const t=a.bump===void 0&&n?"none":a.bump;if(!ve(t))throw new E({code:"BUMP_FILE_INVALID",file:s,message:`Invalid bump level for "${e}": ${JSON.stringify(a.bump)}. Expected one of: ${be.join(", ")}`,packageName:e});const r={bump:t,package:e};if(n&&(r.replay=Na(a.replay,s)),a.releaseAs!==void 0){if(typeof a.releaseAs!="string"||!/^\d+\.\d+\.\d+(?:[-+].*)?$/.test(a.releaseAs))throw new E({code:"BUMP_FILE_INVALID",file:s,message:`Invalid releaseAs for "${e}": ${JSON.stringify(a.releaseAs)}. Expected a semver string like "2.0.0" or "2.0.0-rc.1".`,packageName:e});r.releaseAs=a.releaseAs}if(a.cascade!==void 0){if(typeof a.cascade!="object"||a.cascade===null||Array.isArray(a.cascade))throw new E({code:"BUMP_FILE_INVALID",file:s,message:`Cascade block for "${e}" must be an object mapping package globs to bump levels.`,packageName:e});const l={};for(const[c,i]of Object.entries(a.cascade)){if(!ve(i))throw new E({code:"BUMP_FILE_INVALID",file:s,message:`Invalid cascade bump level for "${c}": ${JSON.stringify(i)}.`,packageName:e});l[c]=i}r.cascade=l}return r},ue=e=>e.replaceAll(/^.*[/\\]/g,"").replace(/\.md$/i,""),Ga=(e,a)=>{const s=Da(e);if(!s)throw new E({code:"BUMP_FILE_INVALID",file:a,message:"Change file is missing YAML frontmatter (expected `---` delimiters)."});let n;try{n=ya(s.frontmatter,{strict:!0})}catch(i){throw new E({cause:i,code:"BUMP_FILE_INVALID",file:a,message:`YAML parse failed: ${i.message}`})}if(n==null)return{body:s.body.trim(),id:ue(a),path:a,payload:{bumps:{}}};if(typeof n!="object"||Array.isArray(n))throw new E({code:"BUMP_FILE_INVALID",file:a,message:"Frontmatter must be a YAML object mapping package names to bump levels."});const t=Object.entries(n);if(t.length===0)return{body:s.body.trim(),id:ue(a),path:a,payload:{bumps:{}}};for(const[i]of t)if(!Sa(i))throw new E({code:"BUMP_FILE_INVALID",file:a,message:`Invalid package name: ${JSON.stringify(i)}.`,packageName:i});let r;if(t.length===1&&Ne(t[0][1])){const[i,o]=t[0];r=Ba(i,o,a)}else{const i={},o=[];for(const[d,u]of t){if(Ne(u))throw new E({code:"BUMP_FILE_INVALID",file:a,message:`Mixed simple + nested entries are not allowed. Package "${d}" uses the nested shape but the file has multiple top-level entries.`,packageName:d});if(u==null||u===""){o.push(d);continue}if(!ve(u))throw new E({code:"BUMP_FILE_INVALID",file:a,message:`Invalid bump level for "${d}": ${JSON.stringify(u)}. Expected one of: ${be.join(", ")}`,packageName:d});i[d]=u}if(o.length>0){const d=Ta(s.body);if(!d)throw new E({code:"BUMP_FILE_INVALID",file:a,message:`No bump level for ${o.map(u=>`"${u}"`).join(", ")}: the entry is empty and the body has no markdown heading to infer one from. Add an explicit level (e.g. \`${o[0]}: minor\`) or a heading (\`# major\`, \`## minor\`, \`### patch\`).`,packageName:o[0]});for(const u of o)i[u]=d}r={bumps:i}}const{meta:l,remainder:c}=Oa(s.body);return{body:c,id:ue(a),meta:l,path:a,payload:r}},Bs=(e,a)=>{let s;if("bumps"in e){const n=Object.entries(e.bumps).map(([t,r])=>`${me(t)}: ${r}`);s=n.length>0?n.join(`
+`):"{}"}else{const n=[`${me(e.package)}:`,`  bump: ${e.bump}`];if(e.releaseAs&&n.push(`  releaseAs: ${e.releaseAs}`),e.cascade){n.push("  cascade:");for(const[t,r]of Object.entries(e.cascade))n.push(`    ${me(t)}: ${r}`)}if(e.replay&&e.replay.length>0){n.push("  replay:");for(const t of e.replay){const r=t.kind==="version"?`${t.package}@${t.version}`:`exit-prerelease:${t.package}`;n.push(`    - "${r}"`)}}s=n.join(`
 `)}return`---
-${a}
+${s}
 ---
-${s.trim()===""?"":`${s.trim()}
-`}`},le=e=>/^[a-z0-9-]/.test(e)?e:`"${e}"`,Rs=e=>{const s=new Map,a=t=>t==="major"?3:t==="minor"?2:t==="patch"?1:0,n=(t,o)=>{const p=s.get(t);(p===void 0||a(o)>a(p))&&s.set(t,o)};for(const t of e)if("bumps"in t.payload)for(const[o,p]of Object.entries(t.payload.bumps))n(o,p);else n(t.payload.package,t.payload.bump);return s},Ce=(e,s)=>s.filter(a=>"bumps"in a.payload?Object.hasOwn(a.payload.bumps,e):a.payload.package===e),Ns=new Set(["README.md","readme.md"]),As=async e=>{const s=e.changesDir??ne,a=ge(e.cwd),n=ge(e.cwd,s),t=n,o=a.endsWith(Z)?a:`${a}${Z}`;if(n!==a&&!n.startsWith(o))throw new N({code:"CONFIG_INVALID",message:`changesDir resolves outside the workspace: ${n} (workspace: ${a}). Set release.changesDir to a path inside the repo.`});const p=[];let c;try{c=await Ye(t)}catch(l){if(l.code==="ENOENT")return{files:[],warnings:[]};throw new N({cause:l,code:"CONFIG_INVALID",message:`Cannot read change-files directory ${t}: ${l.message}`})}const r=c.filter(l=>!Ns.has(l)&&l.endsWith(".md"));return{files:await Promise.all(r.map(async l=>{const u=es(t,l),d=await ze(u,"utf8");return Cs(d,u)})),warnings:p}},Es=(e,s)=>{if(!s)return;if(Object.hasOwn(s,e)){const n=Object.keys(s).filter(t=>t!==e&&Ne(t)&&re(t,e));return Re(e,s[e],n)}const a=[];for(const[n]of Object.entries(s))Ne(n)&&re(n,e)&&a.push(n);if(a.length>0){const[n,...t]=a;return Re(e,s[n],t)}},Re=(e,s,a=[])=>{let{tag:n}=s;return n==="branch-name"&&(n=Is(e)),{branch:e,mode:s.mode??"auto-publish",...a.length>0?{overlapping:a}:{},prerelease:s.prerelease,range:s.range,tag:n}},Is=e=>e.toLowerCase().replaceAll(/[^a-z0-9.-]/g,"-").replaceAll(/^-+|-+$/g,"")||"branch",_s=/[!()*+?@[\]{|}]/,Ne=e=>_s.test(e),Ms=async(e,s)=>{try{const a=await s.run("git",["rev-parse","--abbrev-ref","HEAD"],{cwd:e,silent:!0});if(a.exitCode!==0)return;const n=a.stdout.trim();return n==="HEAD"||n===""?void 0:n}catch{return}},Ss=["dependencies","devDependencies","peerDependencies","optionalDependencies"];class Ds{dependents;dependenciesByPackage;packagesByName;constructor(s){this.dependents=new Map,this.dependenciesByPackage=new Map,this.packagesByName=new Map;for(const a of s){if(this.packagesByName.has(a.name))throw new N({code:"DUPLICATE_PACKAGE_NAME",message:`Duplicate package name "${a.name}" — found at ${this.packagesByName.get(a.name).dir} and ${a.dir}.`,packageName:a.name});this.packagesByName.set(a.name,a),this.dependents.set(a.name,[]),this.dependenciesByPackage.set(a.name,[])}for(const a of s)for(const n of Ss){const t=a.manifest[n];if(!(!t||typeof t!="object"))for(const[o,p]of Object.entries(t))this.packagesByName.has(o)&&(this.dependents.get(o).push({kind:n,name:a.name,range:p}),this.dependenciesByPackage.get(a.name).push({kind:n,name:o,range:p}))}}getPackage(s){return this.packagesByName.get(s)}allPackages(){return[...this.packagesByName.values()]}isInternal(s){return this.packagesByName.has(s)}getDependents(s){return this.dependents.get(s)??[]}getDependencies(s){return this.dependenciesByPackage.get(s)??[]}topologicalSort(s){const a=s?new Set(s):new Set(this.packagesByName.keys()),n=new Set,t=new Set,o=[],p=(c,r)=>{if(!n.has(c)){if(t.has(c)){const i=r.indexOf(c),l=i===-1?[...r,c]:[...r.slice(i),c];throw new N({code:"CYCLIC_DEPENDENCY",message:`Cyclic dependency detected: ${l.join(" → ")}`})}t.add(c);for(const i of this.getDependencies(c))a.has(i.name)&&i.kind!=="devDependencies"&&p(i.name,[...r,c]);t.delete(c),n.add(c),o.push(c)}};for(const c of a)p(c,[]);return o}get size(){return this.packagesByName.size}}const js=/\{(name|version|previousVersion|date|repo|contributors)\}/g,Fs=(e,s)=>e.replaceAll(js,(a,n)=>s[n]??""),Vs=(e,s={})=>{const a=new Set;for(const o of s.internalAuthors??[]){const p=o.trim().toLowerCase().replace(/^@/,"");p.length>0&&a.add(p)}const n=new Set,t=[];for(const o of e){const p=o.meta?.author;if(p)for(const c of p.split(",")){const r=c.trim();if(!r)continue;const i=r.replace(/^@/,"");if(i.length===0)continue;const l=i.toLowerCase();n.has(l)||a.has(l)||(n.add(l),t.push(ns(r)))}}return t.length===0?"":t.map(o=>`- ${o}`).join(`
-`)},ie=e=>{const{current:s,prerelease:a}=e;let{bump:n}=e;if(!W.valid(s))throw new N({code:"CONFIG_INVALID",message:`Invalid current version: ${JSON.stringify(s)}`});const t=W.parse(s),o=t.prerelease[0],p=t.prerelease.length>0;if(t.major===0&&e.bumpMinorPreMajor&&(n==="major"&&(n="minor"),n==="minor"&&e.bumpPatchForMinorPreMajor&&(n="patch")),n==="none")return(o??void 0)===(a??void 0)?s:!p&&a?`${t.major}.${t.minor}.${t.patch}-${a}.0`:p&&!a?`${t.major}.${t.minor}.${t.patch}`:p&&a?`${t.major}.${t.minor}.${t.patch}-${a}.0`:s;if(p&&a&&o===a){const r=Ts(t);if(Ae[n]<=Ae[r]){const u=W.inc(s,"prerelease",a);if(!u)throw new N({code:"CONFIG_INVALID",message:`semver.inc returned null for prerelease bump on ${s}`});return u}const i=`${t.major}.${t.minor}.${t.patch}`,l=W.inc(i,n);if(!l)throw new N({code:"CONFIG_INVALID",message:`semver.inc returned null for ${n} bump on ${i}`});return`${l}-${a}.0`}if(a){const r=`${t.major}.${t.minor}.${t.patch}`,i=W.inc(r,n);if(!i)throw new N({code:"CONFIG_INVALID",message:`semver.inc returned null for ${n} bump on ${r}`});return`${i}-${a}.0`}if(p){const r=`${t.major}.${t.minor}.${t.patch}`,i=W.inc(r,n);if(!i)throw new N({code:"CONFIG_INVALID",message:`semver.inc returned null for ${n} bump on ${r}`});return i}const c=W.inc(s,n);if(!c)throw new N({code:"CONFIG_INVALID",message:`semver.inc returned null for ${n} bump on ${s}`});return c},Ae={major:3,minor:2,patch:1},Ts=e=>e.minor===0&&e.patch===0?"major":e.patch===0?"minor":"patch",Ls=(e,s)=>{const a=Se(s);return a?W.satisfies(e,a,{includePrerelease:!0}):!0},Se=e=>{if(!e||e.startsWith("catalog:")||e==="*"||e==="workspace:*"||e==="workspace:^"||e==="workspace:~")return null;if(e.startsWith("workspace:")){const s=e.slice(10);return s==="*"||s==="^"||s==="~"?null:s}if(e.startsWith("npm:")){const s=e.lastIndexOf("@");return s>4?e.slice(s+1):null}return e},de=100,z=(e,s,a,n,{isCascadeBump:t=!1,isDependencyBump:o=!1,isGroupBump:p=!1,source:c}={})=>{const r=e.get(s);if(r){const i=r.type;return r.type=ue(r.type,a),r.reasons.add(n),o&&(r.isDependencyBump=!0),p&&(r.isGroupBump=!0),t&&(r.isCascadeBump=!0),c&&r.sources.set(c.name,{bumpType:c.bumpType,newVersion:c.newVersion}),r.type!==i}return e.set(s,{isCascadeBump:t,isDependencyBump:o,isGroupBump:p,name:s,proactiveSeen:!1,reasons:new Set([n]),sources:c?new Map([[c.name,{bumpType:c.bumpType,newVersion:c.newVersion}]]):new Map,type:a}),!0},Os=(e,s,a,n)=>{const t=a?.get(e)?.dependencyBumpRules?.[s];if(t!==void 0)return t;const o=n.dependencyBumpRules?.[s];return o!==void 0?o:qe[s]??!1},Ee=(e,s)=>te(e)>=te(s),Ie=(e,s)=>s==="match"?e:s,Bs=(e,s)=>s===!0?!0:Array.isArray(s)?s.includes(e):!1,Gs=10,Hs=(e,s,a,n,t,o,p)=>{let c=!1;for(const r of e.values()){const i=s.getPackage(r.name);if(!i)continue;const l=n.currentVersions?.get(r.name)??i.version,u=a.get(r.name)??ie({bump:r.type,bumpMinorPreMajor:n.bumpMinorPreMajor,bumpPatchForMinorPreMajor:n.bumpPatchForMinorPreMajor,current:l,prerelease:n.prerelease});a.set(r.name,u);for(const d of s.getDependents(r.name)){if(d.kind==="devDependencies"){if(!Bs(r.name,o.bumpDevDependencies))continue;if(z(e,d.name,"patch","DEVDEPENDENCY_BUMPED",{isDependencyBump:!0,source:{bumpType:r.type,name:r.name,newVersion:u}})&&(c=!0,a.delete(d.name)),o.bumpDevDependencies===!0){let v=p.get(r.name);v||(v=new Set,p.set(r.name,v)),v.add(d.name)}continue}const g=Se(d.range);if(g===null||Ls(u,g))continue;let f,y="DEPENDENCY_OUT_OF_RANGE";d.kind==="peerDependencies"?(f=r.type==="none"?"patch":r.type,y="PEER_DEP_MATCH",g.startsWith("^0.")&&f!=="patch"&&t.push(`^0.x peer dep "${r.name}" → "${d.name}" produced a ${f} bump. Consider widening the range manually.`)):f="patch",z(e,d.name,f,y,{isDependencyBump:!0,source:{bumpType:r.type,name:r.name,newVersion:u}})&&(c=!0,a.delete(d.name))}}return c},Us=(e,s,a)=>{let n=!1;for(const t of a.fixed??[]){const o=ve(t),p=oe(o.packages,s),c=p.filter(i=>e.has(i));if(c.length===0)continue;let r="none";for(const i of c)r=ue(r,e.get(i).type);for(const i of p){if(!s.isInternal(i))continue;z(e,i,r,"FIXED_GROUP",{isGroupBump:!0})&&(n=!0)}}for(const t of a.linked??[]){const o=ve(t),c=oe(o.packages,s).filter(i=>e.has(i));if(c.length===0)continue;let r="none";for(const i of c)r=ue(r,e.get(i).type);for(const i of c)z(e,i,r,"LINKED_GROUP",{isGroupBump:!0})&&(n=!0)}return n},_e=new WeakMap,Ws=/[!()*+?@[\]{|}]/,oe=(e,s)=>{let a=_e.get(s);a||(a={allNames:s.allPackages().map(t=>t.name),matched:new Map},_e.set(s,a));const n=new Set;for(const t of e){if(!Ws.test(t)){n.add(t);continue}let o=a.matched.get(t);o||(o=a.allNames.filter(p=>re(t,p)),a.matched.set(t,o));for(const p of o)n.add(p)}return[...n]},Ys=(e,s,a,n,t,o)=>{let p=!1;const c=n.updateInternalDependencies??"out-of-range",r=i=>{const l=o.get(i.name);if(l!==void 0)return l;const u=ie({bump:i.type,bumpMinorPreMajor:t.bumpMinorPreMajor,bumpPatchForMinorPreMajor:t.bumpPatchForMinorPreMajor,current:t.currentVersions?.get(i.name)??a.getPackage(i.name).version,prerelease:t.prerelease});return o.set(i.name,u),u};for(const i of s){if("bumps"in i.payload||!i.payload.cascade)continue;const l=e.get(i.payload.package);if(!l)continue;const u=o.get(l.name)??ie({bump:l.type,bumpMinorPreMajor:t.bumpMinorPreMajor,bumpPatchForMinorPreMajor:t.bumpPatchForMinorPreMajor,current:t.currentVersions?.get(l.name)??a.getPackage(l.name).version,prerelease:t.prerelease});o.set(l.name,u);for(const[d,g]of Object.entries(i.payload.cascade))for(const f of oe([d],a)){if(!a.isInternal(f))continue;z(e,f,g,"CASCADE",{isCascadeBump:!0,source:{bumpType:l.type,name:l.name,newVersion:u}})&&(p=!0)}}for(const i of e.values()){const l=t.perPackageConfig?.get(i.name)?.cascadeTo;if(l)for(const[u,d]of Object.entries(l)){if(!Ee(i.type,d.trigger))continue;const g=Ie(i.type,d.bumpAs),f=r(i);for(const y of oe([u],a)){if(!a.isInternal(y))continue;z(e,y,g,"CASCADE_TO",{isCascadeBump:!0,source:{bumpType:i.type,name:i.name,newVersion:f}})&&(p=!0)}}}if(c==="out-of-range")return p;for(const i of e.values())if(!i.proactiveSeen&&!(c==="minor"&&te(i.type)<te("minor"))){for(const l of a.getDependents(i.name)){const u=Os(l.name,l.kind,t.perPackageConfig,n);if(u===!1||!Ee(i.type,u.trigger))continue;const d=Ie(i.type,u.bumpAs);if(d==="none")continue;const g=r(i);z(e,l.name,d,"DEPENDENCY_BUMPED",{isDependencyBump:!0,source:{bumpType:i.type,name:i.name,newVersion:g}})&&(p=!0)}i.proactiveSeen=!0}return p},zs=(e,s,a,n={})=>{const t=e.filter(g=>fe(g)),o=t.length>0?e.filter(g=>!fe(g)):e,p=new Map,c=[],r=new Map;for(const[g,f]of Rs(o).entries()){if(!s.isInternal(g)){c.push(`Change file references non-workspace package "${g}" — ignored.`);continue}f!=="none"&&z(p,g,f,"EXPLICIT")}for(const g of n.catalogConsumers??[]){if(!s.isInternal(g.packageName))continue;const f=`catalog:${g.catalog}/${g.dep}`;z(p,g.packageName,"patch","CATALOG_CHANGED",{isDependencyBump:!0,source:{bumpType:"patch",name:f,newVersion:g.newVersion??""}})}const i=new Map,l=g=>{const f=Ce(g,o).map(w=>"releaseAs"in w.payload?{file:w.path,version:w.payload.releaseAs}:void 0).filter(w=>w!==void 0&&typeof w.version=="string"),y=new Set(f.map(w=>w.version));if(y.size>1)throw new N({code:"BUMP_FILE_INVALID",message:`Conflicting releaseAs values for ${g}: ${[...y].join(", ")}. Found in: ${f.map(w=>w.file).join(", ")}. Consolidate the change files to a single override.`,packageName:g});return f[0]?.version},u=new Map;for(const g of p.values()){if(g.type==="none")continue;const f=l(g.name);f&&(u.set(g.name,f),r.set(g.name,f))}for(let g=0;g<de;g+=1){const f=Hs(p,s,r,n,c,a,i),y=Us(p,s,a),w=Ys(p,o,s,a,n,r);if(!f&&!y&&!w)break;g===de-1&&c.push(`Release plan did not converge after ${de} iterations — releasing the current best plan. This usually indicates a config bug (cyclic cascade?).`)}for(const[g,f]of i){const y=f.size;y>Gs&&c.push(`bumpDevDependencies: true triggered ${y} patch-cascades to distinct dependents from a single devdep bump (${g}). Consider scoping with the array form ['only', 'these', 'sources'].`)}const d=[];for(const g of p.values()){if(g.type==="none")continue;const f=s.getPackage(g.name);if(!f)continue;const y=Ce(g.name,o),w=u.get(g.name),P=n.currentVersions?.get(g.name)??f.version,v=w??r.get(g.name)??ie({bump:g.type,bumpMinorPreMajor:n.bumpMinorPreMajor,bumpPatchForMinorPreMajor:n.bumpPatchForMinorPreMajor,current:P,prerelease:n.prerelease});d.push({changeFiles:y,isCascadeBump:g.isCascadeBump,isDependencyBump:g.isDependencyBump,isGroupBump:g.isGroupBump,name:g.name,newVersion:v,oldVersion:P,reasons:[...g.reasons],sources:[...g.sources.entries()].map(([$,D])=>({name:$,...D})),type:g.type})}if(d.sort((g,f)=>g.name.localeCompare(f.name)),t.length>0){const g=gs(t,d);for(const[f,y]of g.injectionsByPackage){const w=d.find(P=>P.name===f);w&&(w.changeFiles=[...w.changeFiles,...y])}return{consumedChangeFiles:[...o,...g.consumed],releases:d,warnings:c}}return{consumedChangeFiles:o,releases:d,warnings:c}},De=async(e,s,a={})=>{const n=await e.listPackages(),t=[],o=new Map,p=new Map,c=u=>{const d=ge(u);try{return be.native(d)}catch{try{return be(d)}catch{return d}}},r=a.cwd===void 0?void 0:c(a.cwd),i=u=>u.replaceAll("\\","/"),l=[];for(const{manifest:u,manifestPath:d}of n){const g=he(typeof u.name=="string"?u.name:"",u,s);if(u.napi!==void 0||g.versionActions==="native-addon"){const y=i(d.replace(/[/\\]package\.json$/i,""));l.push(`${y}/npm/`)}}for(const{manifest:u,manifestPath:d}of n){if(typeof u.name!="string"||u.name==="")continue;const g=i(d.replace(/[/\\]package\.json$/i,""));if(l.some(w=>g.startsWith(w)))continue;if(ts(u.name),p.has(u.name))throw new N({code:"DUPLICATE_PACKAGE_NAME",message:`Duplicate package name "${u.name}" — at ${p.get(u.name)} and ${d}.`,packageName:u.name});if(p.set(u.name,d),r!==void 0){const w=c(d),P=r.endsWith(Z)?r:`${r}${Z}`,v=D=>Z==="\\"?D.toLowerCase():D,$=v(w);if($!==v(r)&&!$.startsWith(v(P)))throw new N({code:"CONFIG_INVALID",message:`Package manifest is outside the workspace: ${d} (workspace: ${r}).`,packageName:u.name})}const f=he(u.name,u,s);if(!je(u.name,u,f,s))continue;const y=d.replace(/[/\\]package\.json$/i,"");t.push({dir:y,manifest:u,manifestPath:d,name:u.name,private:u.private===!0,version:typeof u.version=="string"?u.version:"0.0.0"}),o.set(u.name,f)}return{packages:t,perPackageConfig:o}},he=(e,s,a)=>{const n=a.packages?.[e]??{},t=s["vis-release"]??{};return{...n,...t}},je=(e,s,a,n)=>a.managed===!1?!1:a.managed===!0?!0:Me(e,n.ignore??[])?!1:Me(e,n.include??[])?!0:s.private===!0&&!(n.privatePackages?.version??!1)?!1:n.defaultManaged??!1,Me=(e,s)=>s.some(a=>re(a,e)),Fe=(e,s)=>s.versionActions!==void 0?s.versionActions:e.manifest.napi!==void 0?"native-addon":e.private?"private":"npm",ha=Object.defineProperty({__proto__:null,discoverPackages:De,isPackageManaged:je,mergePerPackageConfig:he,resolveVersionActionsId:Fe},Symbol.toStringTag,{value:"Module"}),wa=async(e={})=>{const s=e.cwd??process.cwd(),a=ee(),n=await rs(s),t=is(n,a),o=await t.detectVersion(s);if(o&&!Js(o,t.minVersion))throw new N({code:"PM_VERSION_TOO_LOW",hint:`pnpm install -g ${t.id}@latest  (or your equivalent)`,message:`${t.id} version ${o} is below the required minimum ${t.minVersion}. Upgrade ${t.id} to enable release operations.`});let p={};try{const{loadVisConfig:R}=await import("./CONFIG_FILES.js"),F=await R(s);F.release&&(p=F.release)}catch(R){const{code:F}=R,M=R.message??"";if(!(F==="ENOENT"||F==="MODULE_NOT_FOUND"||/cannot find module/i.test(M)))throw R}const c=Ks(p,e.config??{});!c.acknowledgeUnstable&&process.env.VIS_RELEASE_SUPPRESS_UNSTABLE!=="1"&&process.stderr.write("[vis release] ⚠ This subsystem is flagged unstable. Set `release.acknowledgeUnstable: true` in vis.config.ts to suppress this warning. (RFC §21.2)\n");const r=e.channel??await Ms(s,a),i=r?Es(r,c.channels):void 0,l=await import("node:fs/promises"),u={listPackages:async()=>{const R=await t.listWorkspacePackages(s);return(await Promise.all(R.map(async M=>{const _=`${M.path}/package.json`;try{const H=await l.readFile(_,"utf8");return{manifest:JSON.parse(H),manifestPath:_}}catch{return}}))).filter(M=>M!==void 0)}},{packages:d,perPackageConfig:g}=await De(u,c,{cwd:s}),f=new Ds(d),{files:y}=await As({changesDir:c.changesDir,cwd:s}),{readPreMode:w}=await import("./pre-mode.js"),P=await w(s,c.changesDir??".vis/release");let v;P?.mode==="pre"?v=P.tag:P?.mode==="exit-pending"?v=void 0:v=i?.prerelease;const $=e.firstRelease===!0,{resolveCurrentVersionsForWorkspace:D}=await import("./version-resolver.js"),{versions:h,warnings:O}=await D(d,f,c,g,{cwd:s,firstRelease:$,pm:t,runner:a,skipRegistryLookup:e.skipRegistryLookup===!0}),I=[],S=[];if(c.detectCatalogChanges===!0)try{const{detectCatalogChanges:R,findCatalogConsumers:F,parseCatalogs:M}=await import("./catalog-detector.js"),_=await t.readCatalogYaml(s),H=M(_);let G;try{const C=await a.run("git",["show","HEAD~1:pnpm-workspace.yaml"],{cwd:s,silent:!0});C.exitCode===0&&(G=C.stdout)}catch{}const J=M(G),m=R(J,H).filter(C=>C.oldVersion!==void 0&&C.newVersion!==void 0);if(m.length>0){const C=F(d,H);for(const A of m){const T=C.get(A.catalog)?.get(A.dep)??[];for(const j of T)I.push({catalog:A.catalog,dep:A.dep,newVersion:A.newVersion,oldVersion:A.oldVersion,packageName:j.packageName})}I.length>0&&S.push(`Catalog change-detection: ${m.length} catalog dep(s) moved; ${I.length} consumer-package patch bump(s) tagged CATALOG_CHANGED.`)}}catch(R){S.push(`Catalog change-detection skipped: ${R.message}.`)}const V=zs(y,f,c,{bumpMinorPreMajor:c.bumpMinorPreMajor,bumpPatchForMinorPreMajor:c.bumpPatchForMinorPreMajor,catalogConsumers:I,currentVersions:h,perPackageConfig:g,prerelease:v});if(S.length>0&&V.warnings.push(...S),O.length>0&&V.warnings.push(...O),$&&V.warnings.push('First-release mode: currentVersionResolver forced to "disk", remote tag-collision checks skipped. Drop --first-release after the initial wave lands.'),P?.mode==="pre"&&V.warnings.push(`Pre-mode is ACTIVE (tag "${P.tag}"); every version produces a prerelease. Exit with \`vis release pre exit\` when ready to ship stable.`),P?.mode==="exit-pending"&&V.warnings.push(`Pre-mode is EXIT-PENDING (was "${P.tag}"); the next \`vis release version\` will consolidate the prerelease and delete pre.json.`),i?.overlapping&&i.overlapping.length>0&&V.warnings.push(`Branch "${r}" matches multiple channel patterns: "${i.branch}" (active) plus ${i.overlapping.map(R=>`"${R}"`).join(", ")}. Reorder channels in vis.config.ts if this is unintentional.`),e.projects&&e.projects.length>0){const{default:R}=await import("./index.js"),F=e.projects;V.releases=V.releases.filter(M=>F.some(_=>M.name===_||R(_,M.name)))}return{branch:r,channel:i?{mode:i.mode,prerelease:i.prerelease,tag:i.tag}:void 0,config:c,cwd:s,depGraph:f,firstRelease:$,packages:d,perPackageConfig:g,plan:V,pm:t,preMode:P}},Ks=(...e)=>{let s={...Xe};for(const a of e)s={...s,...a};return s},Js=(e,s)=>{const a=W.coerce(e)?.version??e;try{return W.gte(a,s)}catch{return!0}},x=async(e,s,a)=>{if(!s||s.trim()==="")return;const n=ee(),t=process.platform==="win32",o=t?"cmd":"sh",p=t?["/c",s]:["-c",s],c=await n.run(o,p,{cwd:e,silent:!1});if(c.exitCode!==0)throw new Error(`${a} failed (exit ${c.exitCode}): ${s}`)},Ve=async(e,s,a,n={})=>{const{findConflictingPendingStages:t,readStagedRegistry:o,removePendingStages:p,writeStagedRegistry:c}=await import("./staged-registry.js"),r=e.config.changesDir??ne;let i=a??await o(e.cwd,r);if(i.pending.length===0)return;const l=new Map(e.plan.releases.map(w=>[w.name,w.newVersion])),u=[...l.keys()];let d=t(i,u).filter(w=>l.get(w.name)!==w.version);if(d.length===0)return;let g=[];if(!n.skipSelfHeal){const w=n.runner??ee();g=(await Promise.all(d.map(async v=>{const $=await w.run("npm",["view",`${v.name}@${v.version}`,"dist.tarball","--silent"],{cwd:e.cwd,silent:!0});return $.exitCode===0&&$.stdout.trim().length>0?v.id:void 0}))).filter(v=>v!==void 0)}if(g.length>0){if(i=p(i,g),n.persistSelfHeal!==!1)try{await c(e.cwd,r,i)}catch{}if(d=t(i,u).filter(w=>l.get(w.name)!==w.version),d.length===0)return}const f=d.map(w=>`  • ${w.name}@${w.version} — stage ${w.id} (${w.reason}, recorded ${w.stagedAt})`).join(`
-`),y=s==="version"?"version":"publish";throw new N({code:"STAGE_PENDING",hint:"Resolve via `vis release stage approve <id>` / `--all` or `vis release stage reject <id>`, commit the updated staged.json, then retry.",message:`Refusing to ${y} — ${d.length} package(s) have a pending stage from a prior wave:
-${f}`})},ya=async(e,s={})=>{if(e.plan.releases.length===0)return{changedFiles:[],deletedFiles:[],plan:e.plan};if(await Ve(e,"version",void 0,{persistSelfHeal:!1}),!s.dryRun&&e.config.preVersionCommand&&await x(e.cwd,e.config.preVersionCommand,"preVersionCommand"),!s.dryRun&&e.config.groupPreVersionCommands){const{normaliseGroup:d}=await import("../release/types.js"),g=[...e.config.fixed??[],...e.config.linked??[]].map(y=>d(y)),{default:f}=await import("./index.js");for(const[y,w]of Object.entries(e.config.groupPreVersionCommands)){const P=Number.parseInt(y.replace(/^group-/,""),10),v=g[P];!v||!e.plan.releases.some(D=>v.packages.some(h=>D.name===h||f(h,D.name)))||await x(e.cwd,w,`groupPreVersionCommand[${y}]`)}}const a=await import("node:fs/promises"),{readFileSync:n}=await import("node:fs"),{resolveFormatter:t}=await import("./resolveFormatter.js"),{resolveGroupChangelogRouting:o}=await import("./workspace.js"),p=await t(e.config.changelog,e.cwd),c=new Date().toISOString().slice(0,10),r=o(e.config,e.packages,e.cwd),i=await Qe(e.plan,e.depGraph,{changelogPath:d=>r.get(d.name)??`${d.dir}/CHANGELOG.md`,readChangelog:d=>{try{return n(d,"utf8")}catch{return}},readManifest:d=>{try{return n(d,"utf8")}catch{return}},renderChangelogEntry:d=>p({changeFiles:d.changeFiles,date:c,release:d,target:"changelog"})}),l=[];{const{applyExtraFilesForRelease:d}=await import("./extra-files.js"),g=await Promise.all(e.plan.releases.map(async f=>{const y=e.depGraph.getPackage(f.name);if(!y)return{warnings:[],writes:[]};const w=e.perPackageConfig.get(f.name)?.extraFiles??[],P=e.config.publish?.extraFiles??[];return w.length===0&&P.length===0?{warnings:[],writes:[]}:d(e.cwd,y.dir,f.newVersion,f.name,P,w)}));for(const f of g){for(const y of f.writes)i.writes.push({content:y.content,path:y.path});l.push(...f.warnings)}l.length>0&&e.plan.warnings.push(...l)}if(s.dryRun)return{changedFiles:i.writes.map(d=>d.path),deletedFiles:i.deletions,plan:e.plan};await Promise.all([...i.writes.map(d=>Ke(d.path,d.content)),...i.deletions.map(async d=>{try{await Je(d)}catch{}})]);try{await e.pm.installLockfileOnly({cwd:e.cwd,silent:!0})}catch{}if(!s.dryRun&&e.config.formatChangedFiles&&await qs(i.writes.map(d=>d.path),e.cwd),e.config.plugins?.length){const{runApplyDraftHooks:d}=await import("./defineReleasePlugin.js");await d({config:e.config,cwd:e.cwd},e.plan)}let u;if(s.commit){const{stageAndCommit:d}=await import("./git.js"),g=ee(),f=["pnpm-lock.yaml","package-lock.json","yarn.lock","bun.lock","bun.lockb"],y=await import("node:path"),w=[];for(const v of f)try{await a.access(y.join(e.cwd,v)),w.push(y.join(e.cwd,v))}catch{}const P=e.config.aggregateRelease===!0||typeof e.config.aggregateRelease=="object"&&e.config.aggregateRelease.enabled;if(e.config.oneCommitPerPackage===!0&&!P&&e.plan.releases.length>0){const v=e.channel?.tag??e.branch??"main",$=i.writes.map(O=>O.path),D=new Set,{releases:h}=e.plan;for(let O=0;O<h.length;O+=1){const I=h[O],S=e.depGraph.getPackage(I.name),V=S?`${S.dir}${y.sep}`:void 0,R=V?$.filter(_=>_.startsWith(V)):[];for(const _ of R)D.add(_);const F=O===h.length-1?[...$.filter(_=>!D.has(_)),...i.deletions,...w]:[],M=[...R,...F];M.length!==0&&(u=await d({cwd:e.cwd,runner:g},M,`release(${v}): ${I.name}@${I.newVersion} [skip ci]`,{author:e.config.gitUser}))}}else{const v=s.commitMessage??Xs(e),$=[...i.writes.map(D=>D.path),...i.deletions,...w];u=await d({cwd:e.cwd,runner:g},$,v,{author:e.config.gitUser})}}if(!s.dryRun&&e.config.postVersionCommand&&await x(e.cwd,e.config.postVersionCommand,"postVersionCommand"),!s.dryRun&&e.preMode?.mode==="exit-pending"){const{deletePreMode:d,preModeFilePath:g}=await import("./pre-mode.js"),f=e.config.changesDir??".vis/release";await d(e.cwd,f)&&e.plan.warnings.push(`Pre-mode exited: \`${g(e.cwd,f)}\` was deleted. Commit the deletion so the registry stays consistent across CI runs.`)}return{changedFiles:i.writes.map(d=>d.path),commitSha:u,deletedFiles:i.deletions,plan:e.plan}},qs=async(e,s)=>{if(e.length===0)return;const{join:a}=await import("node:path");let n;try{const{createRequire:o}=await import("node:module"),{pathToFileURL:p}=await import("node:url"),c=o(a(s,"package.json"));n=await import(p(c.resolve("prettier")).href)}catch{return}const t=await import("node:fs/promises");for(const o of e)try{const p=await n.getFileInfo(o);if(p.ignored||!p.inferredParser)continue;const c=await t.readFile(o,"utf8"),r=await n.resolveConfig(o),i=await n.format(c,{...r,filepath:o});i!==c&&await t.writeFile(o,i)}catch{}},Xs=e=>{const s=e.channel?.tag??e.branch??"main",{releases:a}=e.plan,n=a.length<=3?a.map(o=>`${o.name}@${o.newVersion}`).join(", "):`version ${a.length} packages`,t=a.map(o=>`- ${o.name}: ${o.oldVersion} → ${o.newVersion}`).join(`
-`);return`release(${s}): ${n} [skip ci]
-
-${t}`},pe=async(e,s,a,n,t)=>{const{stageAndCommitFile:o}=await import("./git.js"),{stateFilePath:p}=await import("./state.js");try{const c=await o({cwd:e.cwd,runner:s},p(e.cwd,a,!0),`chore(release): ${n} publish lock [skip ci]`,{author:e.config.gitUser,push:!t.noPush,sign:e.config.gitSignCommits===!0});!t.noPush&&c.committed&&!c.pushed&&process.stderr.write(`[vis release] Warning: publish lock (${n}) was committed locally but could not be pushed — cross-runner resume may use a stale lock.
+${a.trim()===""?"":`${a.trim()}
+`}`},me=e=>/^[a-z0-9-]/.test(e)?e:`"${e}"`,Ha=e=>{const a=new Map,s=t=>t==="major"?3:t==="minor"?2:t==="patch"?1:0,n=(t,r)=>{const l=a.get(t);(l===void 0||s(r)>s(l))&&a.set(t,r)};for(const t of e)if("bumps"in t.payload)for(const[r,l]of Object.entries(t.payload.bumps))n(r,l);else n(t.payload.package,t.payload.bump);return a},Ee=(e,a)=>a.filter(s=>"bumps"in s.payload?Object.hasOwn(s.payload.bumps,e):s.payload.package===e),Wa=new Set(["README.md","readme.md"]),Ua=async e=>{const a=e.changesDir??oe,s=W(e.cwd),n=W(e.cwd,a),t=n,r=s.endsWith(x)?s:`${s}${x}`;if(n!==s&&!n.startsWith(r))throw new E({code:"CONFIG_INVALID",message:`changesDir resolves outside the workspace: ${n} (workspace: ${s}). Set release.changesDir to a path inside the repo.`});const l=[];let c;try{c=await oa(t)}catch(d){if(d.code==="ENOENT")return{files:[],warnings:[]};throw new E({cause:d,code:"CONFIG_INVALID",message:`Cannot read change-files directory ${t}: ${d.message}`})}const i=c.filter(d=>!Wa.has(d)&&d.endsWith(".md"));return{files:await Promise.all(i.map(async d=>{const u=pa(t,d),g=await ca(u,"utf8");return Ga(g,u)})),warnings:l}},Ka=(e,a)=>{if(!a)return;if(Object.hasOwn(a,e)){const n=Object.keys(a).filter(t=>t!==e&&Me(t)&&le(t,e));return Ie(e,a[e],n)}const s=[];for(const[n]of Object.entries(a))Me(n)&&le(n,e)&&s.push(n);if(s.length>0){const[n,...t]=s;return Ie(e,a[n],t)}},Ie=(e,a,s=[])=>{let{tag:n}=a;return n==="branch-name"&&(n=za(e)),{branch:e,mode:a.mode??"auto-publish",...s.length>0?{overlapping:s}:{},prerelease:a.prerelease,range:a.range,tag:n}},za=e=>e.toLowerCase().replaceAll(/[^a-z0-9.-]/g,"-").replaceAll(/^-+|-+$/g,"")||"branch",Ya=/[!()*+?@[\]{|}]/,Me=e=>Ya.test(e),Ja=async(e,a)=>{try{const s=await a.run("git",["rev-parse","--abbrev-ref","HEAD"],{cwd:e,silent:!0});if(s.exitCode!==0)return;const n=s.stdout.trim();return n==="HEAD"||n===""?void 0:n}catch{return}},qa=["dependencies","devDependencies","peerDependencies","optionalDependencies"];class Xa{dependents;dependenciesByPackage;packagesByName;constructor(a){this.dependents=new Map,this.dependenciesByPackage=new Map,this.packagesByName=new Map;for(const s of a){if(this.packagesByName.has(s.name))throw new E({code:"DUPLICATE_PACKAGE_NAME",message:`Duplicate package name "${s.name}" — found at ${this.packagesByName.get(s.name).dir} and ${s.dir}.`,packageName:s.name});this.packagesByName.set(s.name,s),this.dependents.set(s.name,[]),this.dependenciesByPackage.set(s.name,[])}for(const s of a)for(const n of qa){const t=s.manifest[n];if(!(!t||typeof t!="object"))for(const[r,l]of Object.entries(t))this.packagesByName.has(r)&&(this.dependents.get(r).push({kind:n,name:s.name,range:l}),this.dependenciesByPackage.get(s.name).push({kind:n,name:r,range:l}))}}getPackage(a){return this.packagesByName.get(a)}allPackages(){return[...this.packagesByName.values()]}isInternal(a){return this.packagesByName.has(a)}getDependents(a){return this.dependents.get(a)??[]}getDependencies(a){return this.dependenciesByPackage.get(a)??[]}topologicalSort(a){const s=a?new Set(a):new Set(this.packagesByName.keys()),n=new Set,t=new Set,r=[],l=(c,i)=>{if(!n.has(c)){if(t.has(c)){const o=i.indexOf(c),d=o===-1?[...i,c]:[...i.slice(o),c];throw new E({code:"CYCLIC_DEPENDENCY",message:`Cyclic dependency detected: ${d.join(" → ")}`})}t.add(c);for(const o of this.getDependencies(c))s.has(o.name)&&o.kind!=="devDependencies"&&l(o.name,[...i,c]);t.delete(c),n.add(c),r.push(c)}};for(const c of s)l(c,[]);return r}get size(){return this.packagesByName.size}}const Za=e=>{const a="/version.rb";if(!e.endsWith(a))return!1;const s=e.length-a.length;let n;if(e.startsWith("lib/"))n=0;else{const r=e.indexOf("/lib/");if(r===-1)return!1;n=r+1}const t=e.slice(n+4,s);return t.length>0&&!/[\n\r\u2028\u2029]/.test(t)},Y=e=>e,Q=(e,a)=>(s,n)=>[...n.versionActions===e?[W(s.dir)]:[],...a===void 0?[]:(n.extraFiles??[]).filter(t=>a.test(t.path)).map(t=>ge(W(s.dir,t.path)))],Qa=e=>({managed:!0,versionActions:e}),Le=e=>a=>({managed:!0,...a.private?{}:{versionActions:e}}),ee=e=>async a=>({touched:await e(a),warnings:[]}),xa=Y({claimedDirs:(e,a)=>ma(e.dir,a).map(s=>ge(s)),configKey:"cargo",discover:async e=>{const{discoverCargoCrates:a}=await import("./index2.js").then(s=>s.q);return a(e)},id:"cargo",perPackage:Le("cargo"),toPackage:e=>e}),Oe=Y({claimedDirs:(e,a)=>a.versionActions==="python"||a.pythonProjectDir!==void 0?[W(e.dir,a.pythonProjectDir??".")]:[],configKey:"python",discover:async e=>{const{discoverPythonProjects:a}=await import("./python-projects.js");return a(e)},id:"python",perPackage:Le("python"),plan:async({context:e,pending:a,releases:s})=>{const{planPythonWorkspace:n}=await import("./python-plan.js"),t=s.flatMap(l=>{const c=e.depGraph.getPackage(l.name);return c?[{manifestPath:c.manifestPath,name:l.name,newVersion:l.newVersion}]:[]}),r=await n({cwd:e.cwd,dependents:e.packages.filter(l=>l.ecosystem==="python").map(l=>({dependencies:l.manifest.dependencies??{},name:l.name})),pending:a,releases:t});return{touched:r.touched,warnings:r.warnings}},toPackage:e=>e}),Be=Y({claimedDirs:(e,a)=>[...a.versionActions==="maven"||a.pomPath!==void 0?[a.pomPath??"pom.xml"]:[],...(a.extraFiles??[]).map(n=>n.path).filter(n=>/(?:^|\/)pom\.xml$/.test(n))].map(n=>ge(W(e.dir,n))),configKey:"maven",discover:async e=>{const{discoverMavenProjects:a}=await import("./maven-projects.js");return a(e)},id:"maven",plan:ee(async({pending:e,projects:a,releases:s})=>{const{planMavenWorkspace:n}=await import("./maven-plan.js");return n({pending:e,projects:a,releases:s})}),toPackage:e=>e.package}),Ge=Y({claimedDirs:Q("gradle",/(?:^|\/)(?:build\.gradle(?:\.kts)?|gradle\.properties)$/),configKey:"gradle",discover:async e=>{const{discoverGradleProjects:a}=await import("./index2.js").then(s=>s.t);return a(e)},id:"gradle",plan:ee(async({pending:e,projects:a,releases:s})=>{const{planGradleWorkspace:n}=await import("./gradle-plan.js");return n({pending:e,projects:a,releases:s})}),toPackage:e=>e.package}),es=Y({claimedDirs:Q("composer",/(?:^|\/)composer\.json$/),configKey:"composer",discover:async e=>{const{discoverComposerProjects:a}=await import("./composer-projects.js");return a(e)},id:"composer",perPackage:e=>e.perPackage,toPackage:e=>e.package}),He=Y({claimedDirs:Q("go",/(?:^|\/)go\.mod$/),configKey:"go",discover:async e=>{const{discoverGoProjects:a}=await import("./go-projects.js");return a(e)},id:"go",perPackage:e=>e.perPackage,toPackage:e=>e.package}),as=Q("swift",/(?:^|\/)Package\.swift$/),ss=Y({claimedDirs:(e,a,s)=>[...e.ecosystem===void 0&&W(e.dir)!==W(s)?[W(e.dir)]:[],...as(e,a)],configKey:"swift",discover:async e=>{const{discoverSwiftProjects:a}=await import("./swift-projects.js");return a(e)},id:"swift",perPackage:(e,a)=>({currentVersionResolver:"git-tag",managed:!0,versionActions:"swift",...W(e.package.dir)===W(a)?{releaseTagPattern:"{version}"}:{}}),toPackage:e=>e.package}),We=Y({claimedDirs:(e,a)=>{const s=a.versionActions==="gem"?[W(e.dir)]:[];for(const n of a.extraFiles??[]){const t=W(e.dir,n.path);if(/\.gemspec$/.test(n.path))s.push(ge(t));else if(Za(n.path)){const r=t.lastIndexOf(`${x}lib${x}`);r!==-1&&s.push(t.slice(0,r))}}return s},configKey:"gem",discover:async e=>{const{discoverGemProjects:a}=await import("./gem-projects.js");return a(e)},id:"gem",plan:ee(async({pending:e,projects:a,releases:s})=>{const{planGemWorkspace:n}=await import("./gem-plan.js");return n({pending:e,projects:a,releases:s})}),toPackage:e=>e.package}),Ue=Y({claimedDirs:Q("hex",/(?:^|\/)mix\.exs$/),configKey:"hex",discover:async e=>{const{discoverHexProjects:a}=await import("./hex-projects.js");return a(e)},id:"hex",plan:ee(async({pending:e,projects:a,releases:s})=>{const{planHexWorkspace:n}=await import("./hex-plan.js");return n({pending:e,projects:a,releases:s})}),toPackage:e=>e.package}),Ke=Y({claimedDirs:Q("nuget",/\.(?:cs|fs)proj$|(?:^|\/)Directory\.Build\.props$/),configKey:"nuget",discover:async e=>{const{discoverNuGetProjects:a}=await import("./nuget-projects.js");return a(e)},id:"nuget",plan:ee(async({pending:e,projects:a,releases:s})=>{const{planNuGetWorkspace:n}=await import("./nuget-plan.js");return n({pending:e,projects:a,releases:s})}),toPackage:e=>e.package}),ze=Y({claimedDirs:Q("zig",/(?:^|\/)build\.zig\.zon$/),configKey:"zig",discover:async e=>{const{discoverZigProjects:a}=await import("./zig-projects.js");return a(e)},id:"zig",plan:ee(async({pending:e,projects:a,releases:s})=>{const{planZigWorkspace:n}=await import("./zig-plan.js");return n({pending:e,projects:a,releases:s})}),toPackage:e=>e.package}),Ye=Y({claimedDirs:Q("dart",/(?:^|\/)pubspec\.yaml$/),configKey:"dart",discover:async e=>{const{discoverDartProjects:a}=await import("./dart-projects.js");return a(e)},id:"dart",plan:ee(async({pending:e,projects:a,releases:s})=>{const{planDartWorkspace:n}=await import("./dart-plan.js");return n({pending:e,projects:a,releases:s})}),toPackage:e=>e.package}),De=[xa,Oe,Be,Ge,es,He,ss,We,Ue,Ke,ze,Ye],ns=[Oe,Be,He,Ge,We,Ue,Ke,ze,Ye],ts=(e,a,s)=>e.perPackage?e.perPackage(a,s):Qa(e.id),je=(e,a)=>!!e[a.configKey]?.discover,rs=/\{(name|version|previousVersion|date|repo|contributors)\}/g,is=(e,a)=>e.replaceAll(rs,(s,n)=>a[n]??""),os=(e,a={})=>{const s=new Set;for(const r of a.internalAuthors??[]){const l=r.trim().toLowerCase().replace(/^@/,"");l.length>0&&s.add(l)}const n=new Set,t=[];for(const r of e){const l=r.meta?.author;if(l)for(const c of l.split(",")){const i=c.trim();if(!i)continue;const o=i.replace(/^@/,"");if(o.length===0)continue;const d=o.toLowerCase();n.has(d)||s.has(d)||(n.add(d),t.push(ka(i)))}}return t.length===0?"":t.map(r=>`- ${r}`).join(`
+`)},de=e=>{const{current:a,prerelease:s}=e;let{bump:n}=e;if(!J.valid(a))throw new E({code:"CONFIG_INVALID",message:`Invalid current version: ${JSON.stringify(a)}`});const t=J.parse(a),r=t.prerelease[0],l=t.prerelease.length>0;if(t.major===0&&e.bumpMinorPreMajor&&(n==="major"&&(n="minor"),n==="minor"&&e.bumpPatchForMinorPreMajor&&(n="patch")),n==="none")return(r??void 0)===(s??void 0)?a:!l&&s?`${t.major}.${t.minor}.${t.patch}-${s}.0`:l&&!s?`${t.major}.${t.minor}.${t.patch}`:l&&s?`${t.major}.${t.minor}.${t.patch}-${s}.0`:a;if(l&&s&&r===s){const i=cs(t);if(_e[n]<=_e[i]){const u=J.inc(a,"prerelease",s);if(!u)throw new E({code:"CONFIG_INVALID",message:`semver.inc returned null for prerelease bump on ${a}`});return u}const o=`${t.major}.${t.minor}.${t.patch}`,d=J.inc(o,n);if(!d)throw new E({code:"CONFIG_INVALID",message:`semver.inc returned null for ${n} bump on ${o}`});return`${d}-${s}.0`}if(s){const i=`${t.major}.${t.minor}.${t.patch}`,o=J.inc(i,n);if(!o)throw new E({code:"CONFIG_INVALID",message:`semver.inc returned null for ${n} bump on ${i}`});return`${o}-${s}.0`}if(l){const i=`${t.major}.${t.minor}.${t.patch}`,o=J.inc(i,n);if(!o)throw new E({code:"CONFIG_INVALID",message:`semver.inc returned null for ${n} bump on ${i}`});return o}const c=J.inc(a,n);if(!c)throw new E({code:"CONFIG_INVALID",message:`semver.inc returned null for ${n} bump on ${a}`});return c},_e={major:3,minor:2,patch:1},cs=e=>e.minor===0&&e.patch===0?"major":e.patch===0?"minor":"patch",ls=(e,a)=>{const s=Je(a);return s?J.satisfies(e,s,{includePrerelease:!0}):!0},Je=e=>{if(!e||e.startsWith("catalog:")||e==="*"||e==="workspace:*"||e==="workspace:^"||e==="workspace:~")return null;if(e.startsWith("workspace:")){const a=e.slice(10);return a==="*"||a==="^"||a==="~"?null:a}if(e.startsWith("npm:")){const a=e.lastIndexOf("@");return a>4?e.slice(a+1):null}return e},fe=100,X=(e,a,s,n,{isCascadeBump:t=!1,isDependencyBump:r=!1,isGroupBump:l=!1,source:c}={})=>{const i=e.get(a);if(i){const o=i.type;return i.type=we(i.type,s),i.reasons.add(n),r&&(i.isDependencyBump=!0),l&&(i.isGroupBump=!0),t&&(i.isCascadeBump=!0),c&&i.sources.set(c.name,{bumpType:c.bumpType,newVersion:c.newVersion}),i.type!==o}return e.set(a,{isCascadeBump:t,isDependencyBump:r,isGroupBump:l,name:a,proactiveSeen:!1,reasons:new Set([n]),sources:c?new Map([[c.name,{bumpType:c.bumpType,newVersion:c.newVersion}]]):new Map,type:s}),!0},ds=(e,a,s,n)=>{const t=s?.get(e)?.dependencyBumpRules?.[a];if(t!==void 0)return t;const r=n.dependencyBumpRules?.[a];return r!==void 0?r:ga[a]??!1},Se=(e,a)=>ce(e)>=ce(a),Ve=(e,a)=>a==="match"?e:a,ps=(e,a)=>a===!0?!0:Array.isArray(a)?a.includes(e):!1,gs=10,us=(e,a,s,n,t,r,l)=>{let c=!1;for(const i of e.values()){const o=a.getPackage(i.name);if(!o)continue;const d=n.currentVersions?.get(i.name)??o.version,u=s.get(i.name)??de({bump:i.type,bumpMinorPreMajor:n.bumpMinorPreMajor,bumpPatchForMinorPreMajor:n.bumpPatchForMinorPreMajor,current:d,prerelease:n.prerelease});s.set(i.name,u);for(const g of a.getDependents(i.name)){if(g.kind==="devDependencies"){if(!ps(i.name,r.bumpDevDependencies))continue;if(X(e,g.name,"patch","DEVDEPENDENCY_BUMPED",{isDependencyBump:!0,source:{bumpType:i.type,name:i.name,newVersion:u}})&&(c=!0,s.delete(g.name)),r.bumpDevDependencies===!0){let P=l.get(i.name);P||(P=new Set,l.set(i.name,P)),P.add(g.name)}continue}const p=Je(g.range);if(p===null||ls(u,p))continue;let f,k="DEPENDENCY_OUT_OF_RANGE";g.kind==="peerDependencies"?(f=i.type==="none"?"patch":i.type,k="PEER_DEP_MATCH",p.startsWith("^0.")&&f!=="patch"&&t.push(`^0.x peer dep "${i.name}" → "${g.name}" produced a ${f} bump. Consider widening the range manually.`)):f="patch",X(e,g.name,f,k,{isDependencyBump:!0,source:{bumpType:i.type,name:i.name,newVersion:u}})&&(c=!0,s.delete(g.name))}}return c},ms=(e,a,s)=>{let n=!1;for(const t of s.fixed??[]){const r=$e(t),l=pe(r.packages,a),c=l.filter(o=>e.has(o));if(c.length===0)continue;let i="none";for(const o of c)i=we(i,e.get(o).type);for(const o of l){if(!a.isInternal(o))continue;X(e,o,i,"FIXED_GROUP",{isGroupBump:!0})&&(n=!0)}}for(const t of s.linked??[]){const r=$e(t),c=pe(r.packages,a).filter(o=>e.has(o));if(c.length===0)continue;let i="none";for(const o of c)i=we(i,e.get(o).type);for(const o of c)X(e,o,i,"LINKED_GROUP",{isGroupBump:!0})&&(n=!0)}return n},Fe=new WeakMap,fs=/[!()*+?@[\]{|}]/,pe=(e,a)=>{let s=Fe.get(a);s||(s={allNames:a.allPackages().map(t=>t.name),matched:new Map},Fe.set(a,s));const n=new Set;for(const t of e){if(!fs.test(t)){n.add(t);continue}let r=s.matched.get(t);r||(r=s.allNames.filter(l=>le(t,l)),s.matched.set(t,r));for(const l of r)n.add(l)}return[...n]},hs=(e,a,s,n,t,r)=>{let l=!1;const c=n.updateInternalDependencies??"out-of-range",i=o=>{const d=r.get(o.name);if(d!==void 0)return d;const u=de({bump:o.type,bumpMinorPreMajor:t.bumpMinorPreMajor,bumpPatchForMinorPreMajor:t.bumpPatchForMinorPreMajor,current:t.currentVersions?.get(o.name)??s.getPackage(o.name).version,prerelease:t.prerelease});return r.set(o.name,u),u};for(const o of a){if("bumps"in o.payload||!o.payload.cascade)continue;const d=e.get(o.payload.package);if(!d)continue;const u=r.get(d.name)??de({bump:d.type,bumpMinorPreMajor:t.bumpMinorPreMajor,bumpPatchForMinorPreMajor:t.bumpPatchForMinorPreMajor,current:t.currentVersions?.get(d.name)??s.getPackage(d.name).version,prerelease:t.prerelease});r.set(d.name,u);for(const[g,p]of Object.entries(o.payload.cascade))for(const f of pe([g],s)){if(!s.isInternal(f))continue;X(e,f,p,"CASCADE",{isCascadeBump:!0,source:{bumpType:d.type,name:d.name,newVersion:u}})&&(l=!0)}}for(const o of e.values()){const d=t.perPackageConfig?.get(o.name)?.cascadeTo;if(d)for(const[u,g]of Object.entries(d)){if(!Se(o.type,g.trigger))continue;const p=Ve(o.type,g.bumpAs),f=i(o);for(const k of pe([u],s)){if(!s.isInternal(k))continue;X(e,k,p,"CASCADE_TO",{isCascadeBump:!0,source:{bumpType:o.type,name:o.name,newVersion:f}})&&(l=!0)}}}if(c==="out-of-range")return l;for(const o of e.values())if(!o.proactiveSeen&&!(c==="minor"&&ce(o.type)<ce("minor"))){for(const d of s.getDependents(o.name)){const u=ds(d.name,d.kind,t.perPackageConfig,n);if(u===!1||!Se(o.type,u.trigger))continue;const g=Ve(o.type,u.bumpAs);if(g==="none")continue;const p=i(o);X(e,d.name,g,"DEPENDENCY_BUMPED",{isDependencyBump:!0,source:{bumpType:o.type,name:o.name,newVersion:p}})&&(l=!0)}o.proactiveSeen=!0}return l},ws=(e,a,s,n={})=>{const t=e.filter(p=>ye(p)),r=t.length>0?e.filter(p=>!ye(p)):e,l=new Map,c=[],i=new Map;for(const[p,f]of Ha(r).entries()){if(!a.isInternal(p)){c.push(`Change file references non-workspace package "${p}" — ignored.`);continue}f!=="none"&&X(l,p,f,"EXPLICIT")}for(const p of n.catalogConsumers??[]){if(!a.isInternal(p.packageName))continue;const f=`catalog:${p.catalog}/${p.dep}`;X(l,p.packageName,"patch","CATALOG_CHANGED",{isDependencyBump:!0,source:{bumpType:"patch",name:f,newVersion:p.newVersion??""}})}const o=new Map,d=p=>{const f=Ee(p,r).map(w=>"releaseAs"in w.payload?{file:w.path,version:w.payload.releaseAs}:void 0).filter(w=>w!==void 0&&typeof w.version=="string"),k=new Set(f.map(w=>w.version));if(k.size>1)throw new E({code:"BUMP_FILE_INVALID",message:`Conflicting releaseAs values for ${p}: ${[...k].join(", ")}. Found in: ${f.map(w=>w.file).join(", ")}. Consolidate the change files to a single override.`,packageName:p});return f[0]?.version},u=new Map;for(const p of l.values()){if(p.type==="none")continue;const f=d(p.name);f&&(u.set(p.name,f),i.set(p.name,f))}for(let p=0;p<fe;p+=1){const f=us(l,a,i,n,c,s,o),k=ms(l,a,s),w=hs(l,r,a,s,n,i);if(!f&&!k&&!w)break;p===fe-1&&c.push(`Release plan did not converge after ${fe} iterations — releasing the current best plan. This usually indicates a config bug (cyclic cascade?).`)}for(const[p,f]of o){const k=f.size;k>gs&&c.push(`bumpDevDependencies: true triggered ${k} patch-cascades to distinct dependents from a single devdep bump (${p}). Consider scoping with the array form ['only', 'these', 'sources'].`)}const g=[];for(const p of l.values()){if(p.type==="none")continue;const f=a.getPackage(p.name);if(!f)continue;const k=Ee(p.name,r),w=u.get(p.name),N=n.currentVersions?.get(p.name)??f.version,P=w??i.get(p.name)??de({bump:p.type,bumpMinorPreMajor:n.bumpMinorPreMajor,bumpPatchForMinorPreMajor:n.bumpPatchForMinorPreMajor,current:N,prerelease:n.prerelease});g.push({changeFiles:k,isCascadeBump:p.isCascadeBump,isDependencyBump:p.isDependencyBump,isGroupBump:p.isGroupBump,name:p.name,newVersion:P,oldVersion:N,reasons:[...p.reasons],sources:[...p.sources.entries()].map(([b,y])=>({name:b,...y})),type:p.type})}if(g.sort((p,f)=>p.name.localeCompare(f.name)),t.length>0){const p=Ia(t,g);for(const[f,k]of p.injectionsByPackage){const w=g.find(N=>N.name===f);w&&(w.changeFiles=[...w.changeFiles,...k])}return{consumedChangeFiles:[...r,...p.consumed],releases:g,warnings:c}}return{consumedChangeFiles:r,releases:g,warnings:c}},qe=async(e,a,s={})=>{const n=await e.listPackages(),t=[],r=new Map,l=new Map,c=u=>{const g=W(u);try{return Ce.native(g)}catch{try{return Ce(g)}catch{return g}}},i=s.cwd===void 0?void 0:c(s.cwd),o=u=>u.replaceAll("\\","/"),d=[];for(const{manifest:u,manifestPath:g}of n){const p=ke(typeof u.name=="string"?u.name:"",u,a);if(u.napi!==void 0||p.versionActions==="native-addon"){const k=o(g.replace(/[/\\]package\.json$/i,""));d.push(`${k}/npm/`)}}for(const{manifest:u,manifestPath:g}of n){if(typeof u.name!="string"||u.name==="")continue;const p=o(g.replace(/[/\\]package\.json$/i,""));if(d.some(w=>p.startsWith(w)))continue;if(Pa(u.name),l.has(u.name))throw new E({code:"DUPLICATE_PACKAGE_NAME",message:`Duplicate package name "${u.name}" — at ${l.get(u.name)} and ${g}.`,packageName:u.name});if(l.set(u.name,g),i!==void 0){const w=c(g),N=i.endsWith(x)?i:`${i}${x}`,P=y=>x==="\\"?y.toLowerCase():y,b=P(w);if(b!==P(i)&&!b.startsWith(P(N)))throw new E({code:"CONFIG_INVALID",message:`Package manifest is outside the workspace: ${g} (workspace: ${i}).`,packageName:u.name})}const f=ke(u.name,u,a);if(!Xe(u.name,u,f,a))continue;const k=g.replace(/[/\\]package\.json$/i,"");t.push({dir:k,manifest:u,manifestPath:g,name:u.name,private:u.private===!0,version:typeof u.version=="string"?u.version:"0.0.0"}),r.set(u.name,f)}return{packages:t,perPackageConfig:r}},ke=(e,a,s)=>{const n=s.packages?.[e]??{},t=a["vis-release"]??{};return{...n,...t}},Xe=(e,a,s,n)=>s.managed===!1?!1:s.managed===!0?!0:Te(e,n.ignore??[])?!1:Te(e,n.include??[])?!0:a.private===!0&&!(n.privatePackages?.version??!1)?!1:n.defaultManaged??!1,Te=(e,a)=>a.some(s=>le(s,e)),Ze=(e,a)=>a.versionActions!==void 0?a.versionActions:e.manifest.napi!==void 0?"native-addon":e.private?"private":"npm",Gs=Object.defineProperty({__proto__:null,discoverPackages:qe,isPackageManaged:Xe,mergePerPackageConfig:ke,resolveVersionActionsId:Ze},Symbol.toStringTag,{value:"Module"}),Hs=async(e={})=>{const a=e.cwd??process.cwd(),s=re(),n=await ba(a),t=$a(n,s),r=await t.detectVersion(a);if(r&&!vs(r,t.minVersion))throw new E({code:"PM_VERSION_TOO_LOW",hint:`pnpm install -g ${t.id}@latest  (or your equivalent)`,message:`${t.id} version ${r} is below the required minimum ${t.minVersion}. Upgrade ${t.id} to enable release operations.`});let l={};try{const{loadVisConfig:A}=await import("./CONFIG_FILES.js"),v=await A(a);v.release&&(l=v.release)}catch(A){const{code:v}=A,D=A.message??"";if(!(v==="ENOENT"||v==="MODULE_NOT_FOUND"||/cannot find module/i.test(D)))throw A}const c=ys(l,e.config??{});!c.acknowledgeUnstable&&process.env.VIS_RELEASE_SUPPRESS_UNSTABLE!=="1"&&process.stderr.write("[vis release] ⚠ This subsystem is flagged unstable. Set `release.acknowledgeUnstable: true` in vis.config.ts to suppress this warning. (RFC §21.2)\n");const i=e.channel??await Ja(a,s),o=i?Ka(i,c.channels):void 0,d=await import("node:fs/promises"),g=await qe({listPackages:async()=>{const A=await t.listWorkspacePackages(a);return(await Promise.all(A.map(async D=>{const F=`${D.path}/package.json`;try{const G=await d.readFile(F,"utf8");return{manifest:JSON.parse(G),manifestPath:F}}catch{return}}))).filter(D=>D!==void 0)}},c,{cwd:a}),{perPackageConfig:p}=g;let{packages:f}=g;const k=new Map;if(De.some(A=>je(c,A))){for(const v of De){if(!je(c,v))continue;const D=new Set;for(const G of f)for(const z of v.claimedDirs(G,p.get(G.name)??{},a))D.add(z);const F=await v.discover({claimedDirs:D,cwd:a});for(const G of F){const{name:z}=v.toPackage(G);p.set(z,{...ts(v,G,a),...c.packages?.[z]})}f=[...f,...F.map(G=>v.toPackage(G))],k.set(v.id,F)}const A=new Map;for(const v of f){const D=A.get(v.name);if(D!==void 0&&v.ecosystem!==void 0)throw new E({code:"CONFIG_INVALID",message:`${v.name} is discovered as a ${v.ecosystem} project, but ${D.dir} already has that name. Rename one of them in config.packages.`,packageName:v.name});A.set(v.name,v)}}{const{assertSupportedVersionFiles:A}=await import("./index2.js").then(v=>v.v);for(const[v,D]of p)A(v,D.versionFiles??[])}const w=new Xa(f),{files:N}=await Ua({changesDir:c.changesDir,cwd:a}),{readPreMode:P}=await import("./pre-mode.js"),b=await P(a,c.changesDir??".vis/release");let y;b?.mode==="pre"?y=b.tag:b?.mode==="exit-pending"?y=void 0:y=o?.prerelease;const m=e.firstRelease===!0,{resolveCurrentVersionsForWorkspace:_}=await import("./version-resolver.js"),{versions:R,warnings:S}=await _(f,w,c,p,{cwd:a,firstRelease:m,pm:t,runner:s,skipRegistryLookup:e.skipRegistryLookup===!0}),U=[],M=[];if(c.detectCatalogChanges===!0)try{const{detectCatalogChanges:A,findCatalogConsumers:v,parseCatalogs:D}=await import("./catalog-detector.js"),F=await t.readCatalogYaml(a),G=D(F);let z;try{const L=await s.run("git",["show","HEAD~1:pnpm-workspace.yaml"],{cwd:a,silent:!0});L.exitCode===0&&(z=L.stdout)}catch{}const h=D(z),V=A(h,G).filter(L=>L.oldVersion!==void 0&&L.newVersion!==void 0);if(V.length>0){const L=v(f,G);for(const T of V){const K=L.get(T.catalog)?.get(T.dep)??[];for(const H of K)U.push({catalog:T.catalog,dep:T.dep,newVersion:T.newVersion,oldVersion:T.oldVersion,packageName:H.packageName})}U.length>0&&M.push(`Catalog change-detection: ${V.length} catalog dep(s) moved; ${U.length} consumer-package patch bump(s) tagged CATALOG_CHANGED.`)}}catch(A){M.push(`Catalog change-detection skipped: ${A.message}.`)}const O=ws(N,w,c,{bumpMinorPreMajor:c.bumpMinorPreMajor,bumpPatchForMinorPreMajor:c.bumpPatchForMinorPreMajor,catalogConsumers:U,currentVersions:R,perPackageConfig:p,prerelease:y});if(M.length>0&&O.warnings.push(...M),S.length>0&&O.warnings.push(...S),m&&O.warnings.push('First-release mode: currentVersionResolver forced to "disk", remote tag-collision checks skipped. Drop --first-release after the initial wave lands.'),b?.mode==="pre"&&O.warnings.push(`Pre-mode is ACTIVE (tag "${b.tag}"); every version produces a prerelease. Exit with \`vis release pre exit\` when ready to ship stable.`),b?.mode==="exit-pending"&&O.warnings.push(`Pre-mode is EXIT-PENDING (was "${b.tag}"); the next \`vis release version\` will consolidate the prerelease and delete pre.json.`),o?.overlapping&&o.overlapping.length>0&&O.warnings.push(`Branch "${i}" matches multiple channel patterns: "${o.branch}" (active) plus ${o.overlapping.map(A=>`"${A}"`).join(", ")}. Reorder channels in vis.config.ts if this is unintentional.`),e.projects&&e.projects.length>0){const{default:A}=await import("./index.js"),v=e.projects;O.releases=O.releases.filter(D=>v.some(F=>D.name===F||A(F,D.name)))}{const A=O.releases.flatMap(v=>w.getPackage(v.name)?.ecosystem==="go"?[{name:v.name,newVersion:v.newVersion}]:[]);if(A.length>0){const{planGoWorkspace:v}=await import("./go-plan.js");v({projects:k.get("go")??[],releases:A})}}return{branch:i,channel:o?{mode:o.mode,prerelease:o.prerelease,tag:o.tag}:void 0,config:c,cwd:a,depGraph:w,firstRelease:m,packages:f,perPackageConfig:p,plan:O,pm:t,preMode:b,projectsByEcosystem:k}},ys=(...e)=>{let a={...ua};for(const s of e)a={...a,...s};return a},vs=(e,a)=>{const s=J.coerce(e)?.version??e;try{return J.gte(s,a)}catch{return!0}},te=async(e,a,s)=>{if(!a||a.trim()==="")return;const n=re(),t=process.platform==="win32",r=t?"cmd":"sh",l=t?["/c",a]:["-c",a],c=await n.run(r,l,{cwd:e,silent:!1});if(c.exitCode!==0)throw new Error(`${s} failed (exit ${c.exitCode}): ${a}`)},Qe=async(e,a,s,n={})=>{const{findConflictingPendingStages:t,readStagedRegistry:r,removePendingStages:l,writeStagedRegistry:c}=await import("./staged-registry.js"),i=e.config.changesDir??oe;let o=s??await r(e.cwd,i);if(o.pending.length===0)return;const d=new Map(e.plan.releases.map(w=>[w.name,w.newVersion])),u=[...d.keys()];let g=t(o,u).filter(w=>d.get(w.name)!==w.version);if(g.length===0)return;let p=[];if(!n.skipSelfHeal){const w=n.runner??re();p=(await Promise.all(g.map(async P=>{const b=await w.run("npm",["view",`${P.name}@${P.version}`,"dist.tarball","--silent"],{cwd:e.cwd,silent:!0});return b.exitCode===0&&b.stdout.trim().length>0?P.id:void 0}))).filter(P=>P!==void 0)}if(p.length>0){if(o=l(o,p),n.persistSelfHeal!==!1)try{await c(e.cwd,i,o)}catch{}if(g=t(o,u).filter(w=>d.get(w.name)!==w.version),g.length===0)return}const f=g.map(w=>`  • ${w.name}@${w.version} — stage ${w.id} (${w.reason}, recorded ${w.stagedAt})`).join(`
+`),k=a==="version"?"version":"publish";throw new E({code:"STAGE_PENDING",hint:"Resolve via `vis release stage approve <id>` / `--all` or `vis release stage reject <id>`, commit the updated staged.json, then retry.",message:`Refusing to ${k} — ${g.length} package(s) have a pending stage from a prior wave:
+${f}`})},Ws=async(e,a={})=>{if(e.plan.releases.length===0)return{changedFiles:[],deletedFiles:[],plan:e.plan};if(await Qe(e,"version",void 0,{persistSelfHeal:!1}),!a.dryRun&&e.config.preVersionCommand&&await te(e.cwd,e.config.preVersionCommand,"preVersionCommand"),!a.dryRun&&e.config.groupPreVersionCommands){const{normaliseGroup:g}=await import("../release/types.js"),p=[...e.config.fixed??[],...e.config.linked??[]].map(k=>g(k)),{default:f}=await import("./index.js");for(const[k,w]of Object.entries(e.config.groupPreVersionCommands)){const N=Number.parseInt(k.replace(/^group-/,""),10),P=p[N];!P||!e.plan.releases.some(y=>P.packages.some(m=>y.name===m||f(m,y.name)))||await te(e.cwd,w,`groupPreVersionCommand[${k}]`)}}const s=await import("node:fs/promises"),{readFileSync:n}=await import("node:fs"),{resolveFormatter:t}=await import("./resolveFormatter.js"),{resolveGroupChangelogRouting:r}=await import("./workspace.js"),l=await t(e.config.changelog,e.cwd),c=new Date().toISOString().slice(0,10),i=r(e.config,e.packages,e.cwd),o=await fa(e.plan,e.depGraph,{changelogPath:g=>i.get(g.name)??`${g.dir}/CHANGELOG.md`,readChangelog:g=>{try{return n(g,"utf8")}catch{return}},readManifest:g=>{try{return n(g,"utf8")}catch{return}},renderChangelogEntry:g=>l({changeFiles:g.changeFiles,date:c,release:g,target:"changelog"})}),d=[];{const{applyExtraFilesForRelease:g}=await import("./extra-files.js"),{applyVersionFilesForRelease:p}=await import("./index2.js").then(y=>y.v),{cargoManifestPaths:f}=await import("./index2.js").then(y=>y.o),k=await Promise.all(e.plan.releases.map(async y=>{const m=e.depGraph.getPackage(y.name);if(!m)return{warnings:[],writes:[]};const _=e.perPackageConfig.get(y.name)?.extraFiles??[],R=e.config.publish?.extraFiles??[],S=e.perPackageConfig.get(y.name)?.versionFiles??[],M=_.length>0||R.length>0?await g(e.cwd,m.dir,y.newVersion,y.name,R,_):{warnings:[],writes:[]},O=S.length>0?await p(m.dir,S,y.newVersion,y.name,new Map(M.writes.map(A=>[A.path,A.content]))):{writes:[]};return{warnings:M.warnings,writes:[...M.writes,...O.writes]}})),w=new Map,N=new Set;for(const y of k){for(const m of y.writes)w.set(m.path,m.content),N.add(m.path);d.push(...y.warnings)}const P=e.packages.filter(y=>y.ecosystem==="cargo"),b=e.plan.releases.flatMap(y=>{const m=e.depGraph.getPackage(y.name);if(!m||m.ecosystem!==void 0&&m.ecosystem!=="cargo")return[];const _=m.ecosystem==="cargo"?[m.manifestPath]:f(m.dir,e.perPackageConfig.get(y.name)??{});return _.length>0||m.ecosystem==="cargo"?[{ecosystem:m.ecosystem,manifestPaths:_,name:y.name,newVersion:y.newVersion}]:[]});if(b.length>0){const y=new Set(P.map(R=>R.manifestPath));P.length>0&&y.add(W(e.cwd,"Cargo.toml"));for(const R of e.packages)if(R.ecosystem===void 0)for(const S of f(R.dir,e.perPackageConfig.get(R.name)??{}))y.add(S);const{planCargoWorkspace:m}=await import("./cargo-plan.js"),_=await m({crateManifests:P.map(R=>R.manifestPath),cwd:e.cwd,pending:w,releases:b,rewriteDependents:e.config.cargo?.discover===!0,scanManifests:[...y]});for(const R of _.touched)N.add(R);d.push(..._.warnings)}for(const y of ns){const m=e.plan.releases.flatMap(R=>e.depGraph.getPackage(R.name)?.ecosystem===y.id?[{name:R.name,newVersion:R.newVersion}]:[]);if(m.length===0||y.plan===void 0)continue;const _=await y.plan({context:e,pending:w,projects:e.projectsByEcosystem?.get(y.id)??[],releases:m});for(const R of _.touched)N.add(R);d.push(..._.warnings)}for(const y of N)o.writes.push({content:w.get(y),path:y});d.length>0&&e.plan.warnings.push(...d)}if(a.dryRun)return{changedFiles:o.writes.map(g=>g.path),deletedFiles:o.deletions,plan:e.plan};await Promise.all([...o.writes.map(g=>la(g.path,g.content)),...o.deletions.map(async g=>{try{await da(g)}catch{}})]);try{await e.pm.installLockfileOnly({cwd:e.cwd,silent:!0})}catch{}if(!a.dryRun&&e.config.formatChangedFiles&&await ks(o.writes.map(g=>g.path),e.cwd),e.config.plugins?.length){const{runApplyDraftHooks:g}=await import("./defineReleasePlugin.js");await g({config:e.config,cwd:e.cwd},e.plan)}let u;if(a.commit){const{stageAndCommit:g}=await import("./git.js"),p=re(),f=["pnpm-lock.yaml","package-lock.json","yarn.lock","bun.lock","bun.lockb"],k=await import("node:path"),w=[];for(const P of f)try{await s.access(k.join(e.cwd,P)),w.push(k.join(e.cwd,P))}catch{}const N=e.config.aggregateRelease===!0||typeof e.config.aggregateRelease=="object"&&e.config.aggregateRelease.enabled;if(e.config.oneCommitPerPackage===!0&&!N&&e.plan.releases.length>0){const P=e.channel?.tag??e.branch??"main",b=o.writes.map(_=>_.path),y=new Set,{releases:m}=e.plan;for(let _=0;_<m.length;_+=1){const R=m[_],S=e.depGraph.getPackage(R.name),U=S?`${S.dir}${k.sep}`:void 0,M=U?b.filter(v=>v.startsWith(U)):[];for(const v of M)y.add(v);const O=_===m.length-1?[...b.filter(v=>!y.has(v)),...o.deletions,...w]:[],A=[...M,...O];A.length!==0&&(u=await g({cwd:e.cwd,runner:p},A,`release(${P}): ${R.name}@${R.newVersion} [skip ci]`,{author:e.config.gitUser}))}}else{const P=a.commitMessage??Ps(e),b=[...o.writes.map(y=>y.path),...o.deletions,...w];u=await g({cwd:e.cwd,runner:p},b,P,{author:e.config.gitUser})}}if(!a.dryRun&&e.config.postVersionCommand&&await te(e.cwd,e.config.postVersionCommand,"postVersionCommand"),!a.dryRun&&e.preMode?.mode==="exit-pending"){const{deletePreMode:g,preModeFilePath:p}=await import("./pre-mode.js"),f=e.config.changesDir??".vis/release";await g(e.cwd,f)&&e.plan.warnings.push(`Pre-mode exited: \`${p(e.cwd,f)}\` was deleted. Commit the deletion so the registry stays consistent across CI runs.`)}return{changedFiles:o.writes.map(g=>g.path),commitSha:u,deletedFiles:o.deletions,plan:e.plan}},ks=async(e,a)=>{if(e.length===0)return;const{join:s}=await import("node:path");let n;try{const{createRequire:r}=await import("node:module"),{pathToFileURL:l}=await import("node:url"),c=r(s(a,"package.json"));n=await import(l(c.resolve("prettier")).href)}catch{return}const t=await import("node:fs/promises");for(const r of e)try{const l=await n.getFileInfo(r);if(l.ignored||!l.inferredParser)continue;const c=await t.readFile(r,"utf8"),i=await n.resolveConfig(r),o=await n.format(c,{...i,filepath:r});o!==c&&await t.writeFile(r,o)}catch{}},Ps=e=>{const a=e.channel?.tag??e.branch??"main",{releases:s}=e.plan,n=s.length<=3?s.map(r=>`${r.name}@${r.newVersion}`).join(", "):`version ${s.length} packages`,t=s.map(r=>`- ${r.name}: ${r.oldVersion} → ${r.newVersion}`).join(`
+`);return`release(${a}): ${n} [skip ci]
+
+${t}`},he=async(e,a,s,n,t)=>{const{stageAndCommitFile:r}=await import("./git.js"),{stateFilePath:l}=await import("./state.js");try{const c=await r({cwd:e.cwd,runner:a},l(e.cwd,s,!0),`chore(release): ${n} publish lock [skip ci]`,{author:e.config.gitUser,push:!t.noPush,sign:e.config.gitSignCommits===!0});!t.noPush&&c.committed&&!c.pushed&&process.stderr.write(`[vis release] Warning: publish lock (${n}) was committed locally but could not be pushed — cross-runner resume may use a stale lock.
 `)}catch(c){process.stderr.write(`[vis release] Warning: could not commit publish lock (${n}): ${c.message}
-`)}},Qs=async e=>{const{defaultTagFor:s,floatingMajorTagFor:a,renderTagPattern:n}=await import("./git.js"),{resolveSyncTagGroups:t}=await import("./group-tags.js"),o=e.plan.releases.filter(l=>e.depGraph.getPackage(l.name)?.manifest?.private!==!0).map(l=>({name:l.name,version:l.newVersion})),p=t(e.config,o),c=p.groups.map(l=>l.tag),r=[],i=!!e.channel?.prerelease||!!e.preMode;for(const{name:l,version:u}of o){if(p.grouped.has(l))continue;const d=e.perPackageConfig.get(l),g=d?.releaseTagPattern??e.config.releaseTagPattern;if(c.push(g?n(g,{channel:e.channel?.tag,name:l,version:u}):s(l,u)),e.config.floatingMajorTag===!0&&!i&&!g?.includes("{major}")&&d?.skipNpmPublish!==!0){const f=a(l,u);f!==void 0&&r.push(f)}}return{created:c,updated:r}},Zs=async(e,s,a)=>{if((await s.run("git",["remote","get-url","--push","origin"],{cwd:e.cwd,silent:!0})).exitCode!==0)return;const{getCurrentBranch:t,resolvePushCredentials:o,verifyPushAccess:p}=await import("./git.js"),c={cwd:e.cwd,runner:s},r=await p(c);if(r!==void 0)return`Cannot push to origin, nothing was published. Set VIS_GH_TOKEN (or GITHUB_TOKEN / GITLAB_TOKEN) with write access, or pass --no-push. git said: ${r}`;const{createRemoteClient:i,detectRemoteProvider:l}=await import("./detect.js");let u;try{u=await l(e.cwd,s,e.config.provider)}catch{return}if(u!=="github")return;const g=await i(u,{githubHost:e.config.githubHost,httpProxy:e.config.httpProxy}).detectRepoSlug(e.cwd,s);if(!g)return;const f=await o(c),y={...process.env};f!==void 0&&(y.GH_TOKEN=f.token),e.config.githubHost&&(y.GH_HOST=e.config.githubHost),e.config.httpProxy&&(y.HTTPS_PROXY=e.config.httpProxy,y.HTTP_PROXY=e.config.httpProxy);const{checkGithubPushRules:w}=await import("./github-push-rules.js"),P=a.noTag?{created:[],updated:[]}:await Qs(e),v=await w(s,{branch:await t(c),createdTags:P.created,cwd:e.cwd,env:y,repo:g,signedCommits:e.config.gitSignCommits===!0,updatedTags:P.updated});for(const $ of v.warnings)process.stderr.write(`[vis release] Warning: ${$}
-`);if(v.blocked.length>0)return`GitHub push rules would reject this release, nothing was published:
-  - ${v.blocked.join(`
+`)}},bs=async e=>{const{defaultTagFor:a,floatingMajorTagFor:s,renderTagPattern:n}=await import("./git.js"),{resolveSyncTagGroups:t}=await import("./group-tags.js"),r=e.plan.releases.filter(d=>e.depGraph.getPackage(d.name)?.manifest?.private!==!0).map(d=>({name:d.name,version:d.newVersion})),l=t(e.config,r),c=l.groups.map(d=>d.tag),i=[],o=!!e.channel?.prerelease||!!e.preMode;for(const{name:d,version:u}of r){if(l.grouped.has(d))continue;const g=e.perPackageConfig.get(d),p=g?.releaseTagPattern??e.config.releaseTagPattern;if(c.push(p?n(p,{channel:e.channel?.tag,name:d,version:u}):a(d,u)),e.config.floatingMajorTag===!0&&!o&&!p?.includes("{major}")&&g?.skipNpmPublish!==!0){const f=s(d,u);f!==void 0&&i.push(f)}}return{created:c,updated:i}},$s=async(e,a,s)=>{if((await a.run("git",["remote","get-url","--push","origin"],{cwd:e.cwd,silent:!0})).exitCode!==0)return;const{getCurrentBranch:t,resolvePushCredentials:r,verifyPushAccess:l}=await import("./git.js"),c={cwd:e.cwd,runner:a},i=await l(c);if(i!==void 0)return`Cannot push to origin, nothing was published. Set VIS_GH_TOKEN (or GITHUB_TOKEN / GITLAB_TOKEN) with write access, or pass --no-push. git said: ${i}`;const{createRemoteClient:o,detectRemoteProvider:d}=await import("./detect.js");let u;try{u=await d(e.cwd,a,e.config.provider)}catch{return}if(u!=="github")return;const p=await o(u,{githubHost:e.config.githubHost,httpProxy:e.config.httpProxy}).detectRepoSlug(e.cwd,a);if(!p)return;const f=await r(c),k={...process.env};f!==void 0&&(k.GH_TOKEN=f.token),e.config.githubHost&&(k.GH_HOST=e.config.githubHost),e.config.httpProxy&&(k.HTTPS_PROXY=e.config.httpProxy,k.HTTP_PROXY=e.config.httpProxy);const{checkGithubPushRules:w}=await import("./github-push-rules.js"),N=s.noTag?{created:[],updated:[]}:await bs(e),P=await w(a,{branch:await t(c),createdTags:N.created,cwd:e.cwd,env:k,repo:p,signedCommits:e.config.gitSignCommits===!0,updatedTags:N.updated});for(const b of P.warnings)process.stderr.write(`[vis release] Warning: ${b}
+`);if(P.blocked.length>0)return`GitHub push rules would reject this release, nothing was published:
+  - ${P.blocked.join(`
   - `)}
-Grant the pushing token a bypass, adjust the ruleset, or pass --no-push / --no-tag.`},va=async(e,s={})=>{const a={failed:[],published:[],skipped:[],tags:[],tagsPushed:!1},n=ee();if(e.plan.releases.length===0)return a;if(!s.dryRun&&e.channel?.mode==="version-pr"){const{createRemoteClient:r,detectRemoteProvider:i}=await import("./detect.js"),l=await i(e.cwd,n,e.config.provider),d=await r(l,{githubHost:e.config.githubHost,gitlabHost:e.config.gitlabHost,httpProxy:e.config.httpProxy}).detectRepoSlug(e.cwd,n),g=e.config.versionPr?.branch??"vis-release/version-packages";if(d)try{const f=await n.run("gh",["pr","list","--head",g,"--state","open","--json","number"],{cwd:e.cwd,silent:!0});if(f.exitCode===0&&f.stdout.trim()&&f.stdout.trim()!=="[]"){const y=JSON.parse(f.stdout);if(y[0])return a.failed.push({name:"_preflight",reason:`Open release PR #${y[0].number} exists. Merge or close it before publishing locally. (Override: --no-push then \`git push --tags\` manually.)`}),a}}catch{}}if(!s.dryRun&&e.config.prePublishCommand)try{await x(e.cwd,e.config.prePublishCommand,"prePublishCommand")}catch(r){return a.failed.push({name:"_prePublishCommand",reason:r.message}),a}if(!s.dryRun&&!s.noPush){const r=await Zs(e,n,{noTag:s.noTag===!0});if(r!==void 0)return a.failed.push({name:"_pushAccess",reason:r}),a}const t=e.config.changesDir??ne,{acquireLock:o,releaseLock:p}=await import("./state.js");let c=!1;if(!s.dryRun)try{await o(e.cwd,t),c=!0}catch(r){return a.failed.push({name:"_lock",reason:r.message}),a}try{const{clearState:r,filterPlanByState:i,newState:l,readState:u,writeState:d}=await import("./state.js"),{readStagedRegistry:g,removePendingStages:f,upsertPendingStages:y,writeStagedRegistry:w}=await import("./staged-registry.js"),P=e.config.changesDir??ne,v=e.config.publish?.lockInGit===!0;let $=s.resume||v?await u(e.cwd,P,v):void 0;$&&v&&($.channel=e.channel?.tag);const D=async()=>{s.dryRun||!$||(await d(e.cwd,P,$,v),v&&await pe(e,n,P,"progress",{noPush:s.noPush}))};let h=await g(e.cwd,P);await Ve(e,"publish",h,{runner:n}),h=await g(e.cwd,P);const O={...h,pending:[...h.pending]};let{releases:I}=e.plan;$?I=i(I,$):($=l(e.channel?.tag,e.plan.releases),s.dryRun||(await d(e.cwd,P,$,v),v&&await pe(e,n,P,"open",{noPush:s.noPush})));const S=await e.pm.readCatalogYaml(e.cwd),V=Ze(S),R=e.depGraph.topologicalSort(I.map(m=>m.name)),F=new Map(I.map(m=>[m.name,m])),M=new Set,_=new Map;for(const m of e.plan.releases){const C=e.depGraph.getPackage(m.name);C&&_.set(m.name,{...C.manifest,version:m.newVersion})}const H={config:e.config,cwd:e.cwd},G=e.config.plugins?.length?await import("./defineReleasePlugin.js"):void 0;for(const m of R){const C=F.get(m);if(!C){a.skipped.push({name:m,reason:"topo-sort returned a name not in the release plan (internal bug)"});continue}const A=e.depGraph.getPackage(m);if(!A)continue;const B=[...new Set(e.depGraph.getDependencies(m).filter(b=>b.kind!=="devDependencies"&&M.has(b.name)).map(b=>b.name))];if(B.length>0){a.skipped.push({name:m,reason:`dependency-failed: not published because ${B.join(", ")} failed to publish (publishing would orphan this package's dependency range)`}),M.add(m);continue}const T=e.perPackageConfig.get(m)??{},j=Fe(A,T),U=s.publishActionsOverride??xe(j),L=s.tag??e.channel?.tag;if(G){const b=await G.runWillPublishHooks(H,{dir:A.dir,name:m,oldVersion:C.oldVersion,version:C.newVersion});if(b.skip){a.skipped.push({name:m,reason:`plugin-skipped${b.by?` by "${b.by}"`:""}`}),M.add(m);continue}}const Y=h.pending.find(b=>b.name===m&&b.version===C.newVersion);try{const b=await U.publish({catalogs:V,cleanPackageJsonConfig:e.config.publish?.cleanPackageJson,dryRun:s.dryRun,otp:s.otp,perPackageConfig:T,pkg:A,pm:e.pm,provenance:na(e),registry:T.registry,release:C,resumeStageId:Y?.id,tag:L,versionedManifestByName:_,workspaceConfig:e.config});if(b.published||b.alreadyPublished){const k=h.pending.filter(E=>E.name===m&&E.version===C.newVersion).map(E=>E.id);k.length>0&&(h=f(h,k))}if(b.published)a.published.push({name:m,stageId:b.stageId,tarball:b.tarball,version:C.newVersion}),$.published.push(`${m}@${C.newVersion}`),G&&await G.runAfterPublishHooks(H,{dir:A.dir,name:m,oldVersion:C.oldVersion,version:C.newVersion});else if(b.alreadyPublished)a.skipped.push({name:m,reason:"already-published"}),$.published.push(`${m}@${C.newVersion}`);else if(a.skipped.push({name:m,reason:b.output??"skipped"}),b.stageId){const k=(b.output??"").startsWith("stage-rejected")?"rejected":"timeout";h=y(h,[{id:b.stageId,name:m,reason:k,stagedAt:new Date().toISOString(),tag:L??"latest",version:C.newVersion}])}await D()}catch(b){a.failed.push({name:m,reason:b.message}),M.add(m)}}G&&await G.runAfterPublishAllHooks(H,{failed:a.failed.map(m=>({name:m.name,reason:m.reason})),published:a.published.map(m=>({name:m.name,version:m.version})),skipped:a.skipped.map(m=>({name:m.name,reason:m.reason}))});const{resolveSyncTagGroups:J}=await import("./group-tags.js"),se=J(e.config,a.published);if(!s.dryRun&&!s.noTag&&a.published.length>0){const{createOrUpdateFloatingTag:m,createTag:C,defaultTagFor:A,floatingMajorTagFor:B,pushTags:T,renderTagPattern:j}=await import("./git.js"),U=e.config.releaseTagPattern,L=e.channel?.tag,Y=e.config.floatingMajorTag===!0,b=!!e.channel?.prerelease||!!e.preMode;for(const{name:k,version:E}of a.published){if(se.grouped.has(k))continue;const X=e.perPackageConfig.get(k)?.releaseTagPattern??U,ae=X?j(X,{channel:L,name:k,version:E}):A(k,E);try{await C({cwd:e.cwd,runner:n},ae,`Release ${k}@${E}`,{signing:e.config.signing,skipRemoteCheck:e.firstRelease}),a.tags.push(ae)}catch(K){e.firstRelease&&K instanceof N&&K.code==="TAG_COLLISION"?a.skipped.push({name:ae,reason:"tag-creation: tag already exists (first-release — skipped)"}):a.skipped.push({name:ae,reason:`tag-creation: ${K.message}`})}const Te=e.depGraph.getPackage(k),Le=e.perPackageConfig.get(k),Oe=Te?.manifest?.private===!0,Be=Le?.skipNpmPublish===!0;if(Y&&!b&&!X?.includes("{major}")&&!Oe&&!Be){const K=B(k,E);if(K!==void 0)try{await m({cwd:e.cwd,runner:n},K,{push:!s.noPush,signing:e.config.signing}),a.tags.push(K)}catch(Ge){a.skipped.push({name:K,reason:`floating-major-tag: ${Ge.message}`})}}}for(const k of se.groups)try{await C({cwd:e.cwd,runner:n},k.tag,`Release ${k.name} ${k.version}`,{signing:e.config.signing,skipRemoteCheck:e.firstRelease}),a.tags.push(k.tag)}catch(E){e.firstRelease&&E instanceof N&&E.code==="TAG_COLLISION"?a.skipped.push({name:k.tag,reason:"tag-creation: tag already exists (first-release — skipped)"}):a.skipped.push({name:k.tag,reason:`tag-creation: ${E.message}`})}if(!s.noPush&&a.tags.length>0)try{await T({cwd:e.cwd,runner:n}),a.tagsPushed=!0}catch(k){a.tagsPushed=!1,a.failed.push({name:"_pushTags",reason:`git push --tags failed: ${k.message}. Retry with: git push --tags`})}$.tagged=[...a.tags],$.pushed=a.tagsPushed,await D(),a.failed.length===0&&!s.dryRun&&(await r(e.cwd,P,v),v&&await pe(e,n,P,"close",{noPush:s.noPush}))}if(!s.dryRun){const m=O.pending.length,C=h.pending.length,A=await w(e.cwd,P,h);if(A.changed){const{stageAndCommitFile:B}=await import("./git.js");let T;if(A.removed)T="chore(release): clear pending stage registry [skip ci]";else if(C>m){const j=C-m;T=`chore(release): record ${j} new pending stage${j===1?"":"s"} [skip ci]`}else if(C<m){const j=m-C;T=`chore(release): drain ${j} resolved stage${j===1?"":"s"} [skip ci]`}else T=`chore(release): update pending stage registry (${C} pending) [skip ci]`;try{await B({cwd:e.cwd,runner:n},A.path,T,{author:e.config.gitUser,push:!s.noPush,sign:e.config.gitSignCommits===!0})}catch(j){process.stderr.write(`[vis release] Warning: could not commit ${A.path}: ${j.message}
-`)}}}if(!s.dryRun&&a.published.length>0&&e.config.workspaceChangelog!==!1){const m=e.config.workspaceChangelog,C=typeof m=="object"?m:void 0,A=typeof e.config.aggregateRelease=="object"?e.config.aggregateRelease.enabled:e.config.aggregateRelease===!0;if(C!==void 0||A)try{const{writeWorkspaceChangelogWave:B}=await import("./workspace.js"),T=new Set(a.published.map(L=>L.name)),j=e.plan.releases.filter(L=>T.has(L.name)),U=await B({changelogConfig:e.config.changelog,cwd:e.cwd,workspaceChangelog:e.config.workspaceChangelog},j);if(U)try{const{stageAndCommitFile:L}=await import("./git.js");await L({cwd:e.cwd,runner:n},U,"chore(release): record wave [skip ci]",{author:e.config.gitUser,push:!s.noPush,sign:e.config.gitSignCommits===!0})}catch(L){process.stderr.write(`[vis release] Warning: could not commit workspace CHANGELOG.md: ${L.message}
-`)}}catch(B){process.stderr.write(`[vis release] Warning: could not write workspace CHANGELOG.md wave entry: ${B.message}
-`)}}if(!s.dryRun&&a.published.length>0&&a.tagsPushed){e.config.publish?.noRelease!==!0&&await aa(e,a,n,se);try{const{walkSuccessfulRelease:m}=await import("./success-walk.js"),{createRemoteClient:C,detectRemoteProvider:A}=await import("./detect.js"),{resolveFormatter:B}=await import("./resolveFormatter.js"),T=await A(e.cwd,n,e.config.provider),j=C(T,{githubHost:e.config.githubHost,gitlabHost:e.config.gitlabHost,httpProxy:e.config.httpProxy}),U=await j.detectRepoSlug(e.cwd,n),L=await B(e.config.changelog,e.cwd),{recordRecentlyWalked:Y}=await import("./staged-registry.js"),b=new Set([...$.walked??[],...(h.recentlyWalked??[]).map(E=>E.key)]),k={...a,published:a.published.filter(E=>!b.has(`${E.name}@${E.version}`))};if(k.published.length>0){const E=await m(e,k,n,{client:j,formatter:L,repo:U}),q=k.published.map(X=>`${X.name}@${X.version}`);$.walked=[...$.walked??[],...q],await D(),h=Y(h,q),E.warnings.length>0&&e.plan.warnings.push(...E.warnings)}}catch(m){e.plan.warnings.push(`successWalk: could not run post-release walk: ${m.message}`)}if(e.config.notifications)try{const{dispatchNotifications:m}=await import("./interface.js"),{createRemoteClient:C,detectRemoteProvider:A}=await import("./detect.js"),B=await A(e.cwd,n,e.config.provider),j=await C(B,{githubHost:e.config.githubHost,gitlabHost:e.config.gitlabHost,httpProxy:e.config.httpProxy}).detectRepoSlug(e.cwd,n);let U;try{const b=`${e.cwd}/package.json`,k=await import("node:fs/promises");U=JSON.parse(await k.readFile(b,"utf8")).name}catch{}const L=new Set([...$.notified??[],...(h.recentlyNotified??[]).map(b=>b.key)]),Y=a.published.filter(b=>!L.has(`${b.name}@${b.version}`));if(Y.length>0){const b=await m(e.config.notifications,{channel:e.channel?.tag,completedAt:new Date().toISOString(),...U===void 0?{}:{monorepoName:U},published:Y.map(k=>({name:k.name,tag:e.channel?.tag,...k.url===void 0?{}:{url:k.url},version:k.version})),...j===void 0?{}:{repo:j},skipped:a.skipped.map(k=>({name:k.name,reason:k.reason}))},{warn:k=>e.plan.warnings.push(k)});if(b.succeeded.length>0){const k=Y.map(q=>`${q.name}@${q.version}`);$.notified=[...$.notified??[],...k],await D();const{recordRecentlyNotified:E}=await import("./staged-registry.js");h=E(h,k)}if(b.failed.length>0||b.succeeded.length>0){const k=b.succeeded.length+b.failed.length;if(b.failed.length>0){e.plan.warnings.push(`[notifications] dispatched ${b.succeeded.length}/${k} channels${b.succeeded.length>0?` (succeeded: ${b.succeeded.join(", ")})`:""}; ${b.failed.length} failed.`);for(const E of b.failed)e.plan.warnings.push(`[notifications:${E.id}] ${E.error}`)}}}}catch(m){e.plan.warnings.push(`notifications: dispatch failed: ${m.message}`)}if(!s.dryRun)try{const m=await w(e.cwd,P,h);if(m.changed){const{stageAndCommitFile:C}=await import("./git.js");try{await C({cwd:e.cwd,runner:n},m.path,"chore(release): record cross-runner notify/walk dedupe [skip ci]",{author:e.config.gitUser,push:!s.noPush,sign:e.config.gitSignCommits===!0})}catch(A){process.stderr.write(`[vis release] Warning: could not commit ${m.path} (notify/walk dedupe): ${A.message}
-`)}}}catch(m){process.stderr.write(`[vis release] Warning: could not update cross-runner dedupe registry: ${m.message}
-`)}}if(!s.dryRun&&e.config.postPublishCommand)try{await x(e.cwd,e.config.postPublishCommand,"postPublishCommand")}catch(m){a.failed.push({name:"_postPublishCommand",reason:m.message})}return a}finally{c&&await p(e.cwd,t)}},xs=e=>e.length===0?"":`## Related releases
+Grant the pushing token a bypass, adjust the ruleset, or pass --no-push / --no-tag.`},Us=async(e,a={})=>{const s={failed:[],published:[],skipped:[],tags:[],tagsPushed:!1},n=re();if(e.plan.releases.length===0)return s;if(!a.dryRun&&e.channel?.mode==="version-pr"){const{createRemoteClient:i,detectRemoteProvider:o}=await import("./detect.js"),d=await o(e.cwd,n,e.config.provider),g=await i(d,{githubHost:e.config.githubHost,gitlabHost:e.config.gitlabHost,httpProxy:e.config.httpProxy}).detectRepoSlug(e.cwd,n),p=e.config.versionPr?.branch??"vis-release/version-packages";if(g)try{const f=await n.run("gh",["pr","list","--head",p,"--state","open","--json","number"],{cwd:e.cwd,silent:!0});if(f.exitCode===0&&f.stdout.trim()&&f.stdout.trim()!=="[]"){const k=JSON.parse(f.stdout);if(k[0])return s.failed.push({name:"_preflight",reason:`Open release PR #${k[0].number} exists. Merge or close it before publishing locally. (Override: --no-push then \`git push --tags\` manually.)`}),s}}catch{}}if(!a.dryRun&&e.config.prePublishCommand)try{await te(e.cwd,e.config.prePublishCommand,"prePublishCommand")}catch(i){return s.failed.push({name:"_prePublishCommand",reason:i.message}),s}if(!a.dryRun&&!a.noPush){const i=await $s(e,n,{noTag:a.noTag===!0});if(i!==void 0)return s.failed.push({name:"_pushAccess",reason:i}),s}const t=e.config.changesDir??oe,{acquireLock:r,releaseLock:l}=await import("./state.js");let c=!1;if(!a.dryRun)try{await r(e.cwd,t),c=!0}catch(i){return s.failed.push({name:"_lock",reason:i.message}),s}try{const{clearState:i,filterPlanByState:o,newState:d,readState:u,writeState:g}=await import("./state.js"),{readStagedRegistry:p,removePendingStages:f,upsertPendingStages:k,writeStagedRegistry:w}=await import("./staged-registry.js"),N=e.config.changesDir??oe,P=e.config.publish?.lockInGit===!0;let b=a.resume||P?await u(e.cwd,N,P):void 0;b&&P&&(b.channel=e.channel?.tag);const y=async()=>{a.dryRun||!b||(await g(e.cwd,N,b,P),P&&await he(e,n,N,"progress",{noPush:a.noPush}))};let m=await p(e.cwd,N);await Qe(e,"publish",m,{runner:n}),m=await p(e.cwd,N);const _={...m,pending:[...m.pending]};let{releases:R}=e.plan;b?R=o(R,b):(b=d(e.channel?.tag,e.plan.releases),a.dryRun||(await g(e.cwd,N,b,P),P&&await he(e,n,N,"open",{noPush:a.noPush})));const S=await e.pm.readCatalogYaml(e.cwd),U=ha(S),M=e.depGraph.topologicalSort(R.map(h=>h.name)),O=new Map(R.map(h=>[h.name,h])),A=new Set,v=new Map;for(const h of e.plan.releases){const I=e.depGraph.getPackage(h.name);I&&v.set(h.name,{...I.manifest,version:h.newVersion})}const D={config:e.config,cwd:e.cwd},F=e.config.plugins?.length?await import("./defineReleasePlugin.js"):void 0;for(const h of M){const I=O.get(h);if(!I){s.skipped.push({name:h,reason:"topo-sort returned a name not in the release plan (internal bug)"});continue}const V=e.depGraph.getPackage(h);if(!V)continue;const L=[...new Set(e.depGraph.getDependencies(h).filter($=>$.kind!=="devDependencies"&&A.has($.name)).map($=>$.name))];if(L.length>0){s.skipped.push({name:h,reason:`dependency-failed: not published because ${L.join(", ")} failed to publish (publishing would orphan this package's dependency range)`}),A.add(h);continue}const T=e.perPackageConfig.get(h)??{},B=Ze(V,T),K=a.publishActionsOverride??wa(B),H=a.tag??e.channel?.tag;if(F){const $=await F.runWillPublishHooks(D,{dir:V.dir,name:h,oldVersion:I.oldVersion,version:I.newVersion});if($.skip){s.skipped.push({name:h,reason:`plugin-skipped${$.by?` by "${$.by}"`:""}`}),A.add(h);continue}}const q=m.pending.find($=>$.name===h&&$.version===I.newVersion);try{const $=await K.publish({catalogs:U,cleanPackageJsonConfig:e.config.publish?.cleanPackageJson,dryRun:a.dryRun,otp:a.otp,perPackageConfig:T,pkg:V,pm:e.pm,provenance:Es(e),registry:T.registry,release:I,resumeStageId:q?.id,tag:H,versionedManifestByName:v,workspaceConfig:e.config});if($.published||$.alreadyPublished){const C=m.pending.filter(j=>j.name===h&&j.version===I.newVersion).map(j=>j.id);C.length>0&&(m=f(m,C))}if($.published)s.published.push({name:h,stageId:$.stageId,tarball:$.tarball,version:I.newVersion}),b.published.push(`${h}@${I.newVersion}`),F&&await F.runAfterPublishHooks(D,{dir:V.dir,name:h,oldVersion:I.oldVersion,version:I.newVersion});else if($.alreadyPublished)s.skipped.push({name:h,reason:"already-published"}),b.published.push(`${h}@${I.newVersion}`);else if(s.skipped.push({name:h,reason:$.output??"skipped"}),$.stageId){const C=($.output??"").startsWith("stage-rejected")?"rejected":"timeout";m=k(m,[{id:$.stageId,name:h,reason:C,stagedAt:new Date().toISOString(),tag:H??"latest",version:I.newVersion}])}await y()}catch($){s.failed.push({name:h,reason:$.message}),A.add(h)}}F&&await F.runAfterPublishAllHooks(D,{failed:s.failed.map(h=>({name:h.name,reason:h.reason})),published:s.published.map(h=>({name:h.name,version:h.version})),skipped:s.skipped.map(h=>({name:h.name,reason:h.reason}))});const{resolveSyncTagGroups:G}=await import("./group-tags.js"),z=G(e.config,s.published);if(!a.dryRun&&!a.noTag&&s.published.length>0){const{createOrUpdateFloatingTag:h,createTag:I,defaultTagFor:V,floatingMajorTagFor:L,pushTags:T,renderTagPattern:B}=await import("./git.js"),K=e.config.releaseTagPattern,H=e.channel?.tag,q=e.config.floatingMajorTag===!0,$=!!e.channel?.prerelease||!!e.preMode;for(const{name:C,version:j}of s.published){if(z.grouped.has(C))continue;const se=e.perPackageConfig.get(C)?.releaseTagPattern??K,ie=se?B(se,{channel:H,name:C,version:j}):V(C,j);try{await I({cwd:e.cwd,runner:n},ie,`Release ${C}@${j}`,{signing:e.config.signing,skipRemoteCheck:e.firstRelease}),s.tags.push(ie)}catch(Z){e.firstRelease&&Z instanceof E&&Z.code==="TAG_COLLISION"?s.skipped.push({name:ie,reason:"tag-creation: tag already exists (first-release — skipped)"}):s.failed.push({name:ie,reason:`tag-creation: ${Z.message}`})}const xe=e.depGraph.getPackage(C),ea=e.perPackageConfig.get(C),aa=xe?.manifest?.private===!0,sa=ea?.skipNpmPublish===!0;if(q&&!$&&!se?.includes("{major}")&&!aa&&!sa){const Z=L(C,j);if(Z!==void 0)try{await h({cwd:e.cwd,runner:n},Z,{push:!a.noPush,signing:e.config.signing}),s.tags.push(Z)}catch(na){s.skipped.push({name:Z,reason:`floating-major-tag: ${na.message}`})}}}for(const C of z.groups)try{await I({cwd:e.cwd,runner:n},C.tag,`Release ${C.name} ${C.version}`,{signing:e.config.signing,skipRemoteCheck:e.firstRelease}),s.tags.push(C.tag)}catch(j){e.firstRelease&&j instanceof E&&j.code==="TAG_COLLISION"?s.skipped.push({name:C.tag,reason:"tag-creation: tag already exists (first-release — skipped)"}):s.failed.push({name:C.tag,reason:`tag-creation: ${j.message}`})}if(!a.noPush&&s.tags.length>0)try{await T({cwd:e.cwd,runner:n}),s.tagsPushed=!0}catch(C){s.tagsPushed=!1,s.failed.push({name:"_pushTags",reason:`git push --tags failed: ${C.message}. Retry with: git push --tags`})}b.tagged=[...s.tags],b.pushed=s.tagsPushed,await y(),s.failed.length===0&&!a.dryRun&&(await i(e.cwd,N,P),P&&await he(e,n,N,"close",{noPush:a.noPush}))}if(!a.dryRun){const h=_.pending.length,I=m.pending.length,V=await w(e.cwd,N,m);if(V.changed){const{stageAndCommitFile:L}=await import("./git.js");let T;if(V.removed)T="chore(release): clear pending stage registry [skip ci]";else if(I>h){const B=I-h;T=`chore(release): record ${B} new pending stage${B===1?"":"s"} [skip ci]`}else if(I<h){const B=h-I;T=`chore(release): drain ${B} resolved stage${B===1?"":"s"} [skip ci]`}else T=`chore(release): update pending stage registry (${I} pending) [skip ci]`;try{await L({cwd:e.cwd,runner:n},V.path,T,{author:e.config.gitUser,push:!a.noPush,sign:e.config.gitSignCommits===!0})}catch(B){process.stderr.write(`[vis release] Warning: could not commit ${V.path}: ${B.message}
+`)}}}if(!a.dryRun&&s.published.length>0&&e.config.workspaceChangelog!==!1){const h=e.config.workspaceChangelog,I=typeof h=="object"?h:void 0,V=typeof e.config.aggregateRelease=="object"?e.config.aggregateRelease.enabled:e.config.aggregateRelease===!0;if(I!==void 0||V)try{const{writeWorkspaceChangelogWave:L}=await import("./workspace.js"),T=new Set(s.published.map(H=>H.name)),B=e.plan.releases.filter(H=>T.has(H.name)),K=await L({changelogConfig:e.config.changelog,cwd:e.cwd,workspaceChangelog:e.config.workspaceChangelog},B);if(K)try{const{stageAndCommitFile:H}=await import("./git.js");await H({cwd:e.cwd,runner:n},K,"chore(release): record wave [skip ci]",{author:e.config.gitUser,push:!a.noPush,sign:e.config.gitSignCommits===!0})}catch(H){process.stderr.write(`[vis release] Warning: could not commit workspace CHANGELOG.md: ${H.message}
+`)}}catch(L){process.stderr.write(`[vis release] Warning: could not write workspace CHANGELOG.md wave entry: ${L.message}
+`)}}if(!a.dryRun&&s.published.length>0&&s.tagsPushed){e.config.publish?.noRelease!==!0&&await Ns(e,s,n,z);try{const{walkSuccessfulRelease:h}=await import("./success-walk.js"),{createRemoteClient:I,detectRemoteProvider:V}=await import("./detect.js"),{resolveFormatter:L}=await import("./resolveFormatter.js"),T=await V(e.cwd,n,e.config.provider),B=I(T,{githubHost:e.config.githubHost,gitlabHost:e.config.gitlabHost,httpProxy:e.config.httpProxy}),K=await B.detectRepoSlug(e.cwd,n),H=await L(e.config.changelog,e.cwd),{recordRecentlyWalked:q}=await import("./staged-registry.js"),$=new Set([...b.walked??[],...(m.recentlyWalked??[]).map(j=>j.key)]),C={...s,published:s.published.filter(j=>!$.has(`${j.name}@${j.version}`))};if(C.published.length>0){const j=await h(e,C,n,{client:B,formatter:H,repo:K}),ae=C.published.map(se=>`${se.name}@${se.version}`);b.walked=[...b.walked??[],...ae],await y(),m=q(m,ae),j.warnings.length>0&&e.plan.warnings.push(...j.warnings)}}catch(h){e.plan.warnings.push(`successWalk: could not run post-release walk: ${h.message}`)}if(e.config.notifications)try{const{dispatchNotifications:h}=await import("./interface.js"),{createRemoteClient:I,detectRemoteProvider:V}=await import("./detect.js"),L=await V(e.cwd,n,e.config.provider),B=await I(L,{githubHost:e.config.githubHost,gitlabHost:e.config.gitlabHost,httpProxy:e.config.httpProxy}).detectRepoSlug(e.cwd,n);let K;try{const $=`${e.cwd}/package.json`,C=await import("node:fs/promises");K=JSON.parse(await C.readFile($,"utf8")).name}catch{}const H=new Set([...b.notified??[],...(m.recentlyNotified??[]).map($=>$.key)]),q=s.published.filter($=>!H.has(`${$.name}@${$.version}`));if(q.length>0){const $=await h(e.config.notifications,{channel:e.channel?.tag,completedAt:new Date().toISOString(),...K===void 0?{}:{monorepoName:K},published:q.map(C=>({name:C.name,tag:e.channel?.tag,...C.url===void 0?{}:{url:C.url},version:C.version})),...B===void 0?{}:{repo:B},skipped:s.skipped.map(C=>({name:C.name,reason:C.reason}))},{warn:C=>e.plan.warnings.push(C)});if($.succeeded.length>0){const C=q.map(ae=>`${ae.name}@${ae.version}`);b.notified=[...b.notified??[],...C],await y();const{recordRecentlyNotified:j}=await import("./staged-registry.js");m=j(m,C)}if($.failed.length>0||$.succeeded.length>0){const C=$.succeeded.length+$.failed.length;if($.failed.length>0){e.plan.warnings.push(`[notifications] dispatched ${$.succeeded.length}/${C} channels${$.succeeded.length>0?` (succeeded: ${$.succeeded.join(", ")})`:""}; ${$.failed.length} failed.`);for(const j of $.failed)e.plan.warnings.push(`[notifications:${j.id}] ${j.error}`)}}}}catch(h){e.plan.warnings.push(`notifications: dispatch failed: ${h.message}`)}if(!a.dryRun)try{const h=await w(e.cwd,N,m);if(h.changed){const{stageAndCommitFile:I}=await import("./git.js");try{await I({cwd:e.cwd,runner:n},h.path,"chore(release): record cross-runner notify/walk dedupe [skip ci]",{author:e.config.gitUser,push:!a.noPush,sign:e.config.gitSignCommits===!0})}catch(V){process.stderr.write(`[vis release] Warning: could not commit ${h.path} (notify/walk dedupe): ${V.message}
+`)}}}catch(h){process.stderr.write(`[vis release] Warning: could not update cross-runner dedupe registry: ${h.message}
+`)}}if(!a.dryRun&&e.config.postPublishCommand)try{await te(e.cwd,e.config.postPublishCommand,"postPublishCommand")}catch(h){s.failed.push({name:"_postPublishCommand",reason:h.message})}return s}finally{c&&await l(e.cwd,t)}},Cs=e=>e.length===0?"":`## Related releases
 
-${e.map(a=>`- [${a.name}](${a.url})`).join(`
-`)}`,ea=(e,s,a)=>{if(!s||!s.header&&!s.footer)return e;const n=o=>Fs(o,{contributors:a.contributors??"",date:a.date,name:a.name,previousVersion:a.previousVersion,repo:a.repo,version:a.version}).replaceAll(/\n{3,}/g,`
+${e.map(s=>`- [${s.name}](${s.url})`).join(`
+`)}`,Rs=(e,a,s)=>{if(!a||!a.header&&!a.footer)return e;const n=r=>is(r,{contributors:s.contributors??"",date:s.date,name:s.name,previousVersion:s.previousVersion,repo:s.repo,version:s.version}).replaceAll(/\n{3,}/g,`
 
-`).replace(/\s+$/,""),t=[];if(s.header){const o=n(s.header);o.length>0&&t.push(o)}if(t.push(e),s.footer){const o=n(s.footer);o.length>0&&t.push(o)}return t.join(`
+`).replace(/\s+$/,""),t=[];if(a.header){const r=n(a.header);r.length>0&&t.push(r)}if(t.push(e),a.footer){const r=n(a.footer);r.length>0&&t.push(r)}return t.join(`
 
-`)},sa=e=>{if(!Array.isArray(e))return;const[s,a]=e;if(s!=="github"||typeof a!="object"||a===null)return;const{internalAuthors:n}=a;if(Array.isArray(n))return n.filter(t=>typeof t=="string")},aa=async(e,s,a,n)=>{const{createRemoteClient:t,detectRemoteProvider:o}=await import("./detect.js"),p=await o(e.cwd,a,e.config.provider),c=t(p,{githubHost:e.config.githubHost,gitlabHost:e.config.gitlabHost,httpProxy:e.config.httpProxy}),r=await c.detectRepoSlug(e.cwd,a);if(!r)return;const i=typeof e.config.aggregateRelease=="object"?e.config.aggregateRelease:{enabled:e.config.aggregateRelease===!0},l=e.config.publish?.draftRelease===!0,u=e.config.publish?.discussionCategory,d=e.config.publish?.addReleases;if(i.enabled){const h=new Date().toISOString().slice(0,10),I=(i.title??"Release {date}").replaceAll("{date}",h),S=`release-${h}`,V=s.published.map(R=>`- \`${R.name}\` → ${R.version}`).join(`
-`);try{const R=await c.createRelease(a,{body:V,cwd:e.cwd,discussionCategory:u,draft:l,repo:r,tag:S,title:I});if(R?.url)for(const F of s.published)F.url=R.url}catch{}return}const{defaultTagFor:g,renderTagPattern:f}=await import("./git.js"),y=e.config.releaseTagPattern,w=e.channel?.tag,P=e.config.publish?.releaseAssets??{},v=new Date().toISOString().slice(0,10),$=sa(e.config.changelog),D=Vs(e.plan.consumedChangeFiles??[],{internalAuthors:$});for(const h of n.groups){const O=h.members.map(I=>`- \`${I}\` → ${s.published.find(S=>S.name===I)?.version??h.version}`).join(`
-`);try{const I=await c.createRelease(a,{body:O,cwd:e.cwd,discussionCategory:u,draft:l,prerelease:h.version.includes("-"),repo:r,tag:h.tag,title:`${h.name} ${h.version}`});if(I?.url)for(const S of s.published)h.members.includes(S.name)&&(S.url=I.url)}catch(I){console.warn(`createRelease failed for group ${h.name} (tag ${h.tag}): ${I.message}`)}}for(const h of s.published){if(n.grouped.has(h.name))continue;const I=e.perPackageConfig.get(h.name)?.releaseTagPattern??y,S=I?f(I,{channel:w,name:h.name,version:h.version}):g(h.name,h.version),V=h.version.includes("-");let R=`Release of ${h.name}@${h.version}.`;if(h.stageId&&(R=`${R}
+`)},As=e=>{if(!Array.isArray(e))return;const[a,s]=e;if(a!=="github"||typeof s!="object"||s===null)return;const{internalAuthors:n}=s;if(Array.isArray(n))return n.filter(t=>typeof t=="string")},Ns=async(e,a,s,n)=>{const{createRemoteClient:t,detectRemoteProvider:r}=await import("./detect.js"),l=await r(e.cwd,s,e.config.provider),c=t(l,{githubHost:e.config.githubHost,gitlabHost:e.config.gitlabHost,httpProxy:e.config.httpProxy}),i=await c.detectRepoSlug(e.cwd,s);if(!i)return;const o=typeof e.config.aggregateRelease=="object"?e.config.aggregateRelease:{enabled:e.config.aggregateRelease===!0},d=e.config.publish?.draftRelease===!0,u=e.config.publish?.discussionCategory,g=e.config.publish?.addReleases;if(o.enabled){const m=new Date().toISOString().slice(0,10),R=(o.title??"Release {date}").replaceAll("{date}",m),S=`release-${m}`,U=a.published.map(M=>`- \`${M.name}\` → ${M.version}`).join(`
+`);try{const M=await c.createRelease(s,{body:U,cwd:e.cwd,discussionCategory:u,draft:d,repo:i,tag:S,title:R});if(M?.url)for(const O of a.published)O.url=M.url}catch{}return}const{defaultTagFor:p,renderTagPattern:f}=await import("./git.js"),k=e.config.releaseTagPattern,w=e.channel?.tag,N=e.config.publish?.releaseAssets??{},P=new Date().toISOString().slice(0,10),b=As(e.config.changelog),y=os(e.plan.consumedChangeFiles??[],{internalAuthors:b});for(const m of n.groups){const _=m.members.map(R=>`- \`${R}\` → ${a.published.find(S=>S.name===R)?.version??m.version}`).join(`
+`);try{const R=await c.createRelease(s,{body:_,cwd:e.cwd,discussionCategory:u,draft:d,prerelease:m.version.includes("-"),repo:i,tag:m.tag,title:`${m.name} ${m.version}`});if(R?.url)for(const S of a.published)m.members.includes(S.name)&&(S.url=R.url)}catch(R){console.warn(`createRelease failed for group ${m.name} (tag ${m.tag}): ${R.message}`)}}for(const m of a.published){if(n.grouped.has(m.name))continue;const R=e.perPackageConfig.get(m.name)?.releaseTagPattern??k,S=R?f(R,{channel:w,name:m.name,version:m.version}):p(m.name,m.version),U=m.version.includes("-");let M=`Release of ${m.name}@${m.version}.`;if(m.stageId&&(M=`${M}
 
-> ⏳ **Staged — not yet installable.** Approve via \`vis release stage approve ${h.stageId}\` or the npmjs.com web UI.`),P.stampHashes&&h.tarball&&(R=`${R}
+> ⏳ **Staged — not yet installable.** Approve via \`vis release stage approve ${m.stageId}\` or the npmjs.com web UI.`),N.stampHashes&&m.tarball&&(M=`${M}
 
 ### Tarball integrity
 
-- size: \`${h.tarball.size}\` bytes
-- sha256: \`${h.tarball.sha256}\`
-- sha512: \`${h.tarball.sha512}\``),d!==void 0&&d!==!1)try{const _=S.lastIndexOf("@"),H=_>0?S.slice(0,_+1):"",G=await c.listRecentReleases(a,{cwd:e.cwd,excludeTag:S,limit:5,repo:r,tagPrefix:H}),J=xs(G);J&&(R=d==="top"?`${J}
+- size: \`${m.tarball.size}\` bytes
+- sha256: \`${m.tarball.sha256}\`
+- sha512: \`${m.tarball.sha512}\``),g!==void 0&&g!==!1)try{const v=S.lastIndexOf("@"),D=v>0?S.slice(0,v+1):"",F=await c.listRecentReleases(s,{cwd:e.cwd,excludeTag:S,limit:5,repo:i,tagPrefix:D}),G=Cs(F);G&&(M=g==="top"?`${G}
 
-${R}`:`${R}
+${M}`:`${M}
 
-${J}`)}catch{}const{releaseNoteTemplate:F}=e.config;if(F){const H=e.plan.releases.find(G=>G.name===h.name)?.oldVersion??"";R=ea(R,F,{contributors:D,date:v,name:h.name,previousVersion:H,repo:r,version:h.version})}const M=[];P.uploadTarball&&h.tarball&&M.push(h.tarball.path);try{const _=await c.createRelease(a,{assets:M.length>0?M:void 0,body:R,cwd:e.cwd,discussionCategory:u,draft:l,prerelease:V,repo:r,tag:S,title:`${h.name} v${h.version}`});_?.url&&(h.url=_.url)}catch(_){console.warn(`createRelease failed for ${h.name}@${h.version} (tag ${S}): ${_.message}`)}}},na=e=>(e.config.publish?.publishArgs??[]).includes("--provenance")&&e.pm.id!=="bun";export{ya as a,wa as b,As as c,Rs as d,ma as f,va as p,Fe as r,ha as w};
+${G}`)}catch{}const{releaseNoteTemplate:O}=e.config;if(O){const D=e.plan.releases.find(F=>F.name===m.name)?.oldVersion??"";M=Rs(M,O,{contributors:y,date:P,name:m.name,previousVersion:D,repo:i,version:m.version})}const A=[];N.uploadTarball&&m.tarball&&A.push(m.tarball.path);try{const v=await c.createRelease(s,{assets:A.length>0?A:void 0,body:M,cwd:e.cwd,discussionCategory:u,draft:d,prerelease:U,repo:i,tag:S,title:`${m.name} v${m.version}`});v?.url&&(m.url=v.url)}catch(v){console.warn(`createRelease failed for ${m.name}@${m.version} (tag ${S}): ${v.message}`)}}},Es=e=>(e.config.publish?.publishArgs??[]).includes("--provenance")&&e.pm.id!=="bun";export{Ws as a,Hs as b,Ua as c,Ha as d,Bs as f,Us as p,Ze as r,Gs as w};

package/dist/packem_chunks/prune.js

@@ -1,3 +1,3 @@
-import{p as o}from"./cli-main.js";import{r as f}from"../packem_shared/advisories-BSpzRIXP.js";const d=async({fs:c,logger:u,options:r,workspaceRoot:t})=>{if(!t)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const e=r.db??f(t),s=r.format==="json";if(!r.force){o.warn(`Prune is destructive. Will remove: ${e}`),o.info("Re-run with --force to proceed."),s&&process.stdout.write(`${JSON.stringify({dbPath:e,reason:"needs --force",removed:!1})}
+import{p as o}from"./cli-main.js";import{r as f}from"./catalog.js";const d=async({fs:c,logger:u,options:r,workspaceRoot:t})=>{if(!t)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const e=r.db??f(t),s=r.format==="json";if(!r.force){o.warn(`Prune is destructive. Will remove: ${e}`),o.info("Re-run with --force to proceed."),s&&process.stdout.write(`${JSON.stringify({dbPath:e,reason:"needs --force",removed:!1})}
 `);return}const a=[e,`${e}-wal`,`${e}-shm`,`${e}-journal`],i=[];for(const n of a)try{await c.rm(n,{force:!0}),i.push(n)}catch{}if(s){process.stdout.write(`${JSON.stringify({dbPath:e,files:i,removed:!0})}
 `);return}o.success(`Removed ${e}.`)},v=d;export{v as advisoriesPruneExecute};

package/dist/packem_chunks/python-plan.js

@@ -0,0 +1,3 @@
+import{createRequire as j}from"node:module";import{VisReleaseError as V}from"../packem_shared/VisReleaseError-DZtgcKf8.js";import{f as M,k as R}from"./index2.js";import{normalizePythonName as w}from"./python-projects.js";let b;const y=s=>(b??=j(import.meta.url))(s),p=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,_=s=>{if(typeof p<"u"&&p.versions&&p.versions.node){const[t,o]=p.versions.node.split(".").map(Number);if(t>22||t===22&&o>=3||t===20&&o>=16)return p.getBuiltinModule(s)}return y(s)},{readFile:k}=_("node:fs/promises"),{dirname:x}=_("node:path"),T=new Set(["project"]),E=/^source\s*=\s*\{\s*(?:editable|virtual|directory)\s*=/,v=s=>{const t=/^\s*v?(\d+(?:\.\d+)*)/.exec(s);return t?(t[1]??"").split(".").map(Number):[]},N=(s,t)=>{const o=Math.max(s.length,t.length);for(let e=0;e<o;e++){const r=(s[e]??0)-(t[e]??0);if(r!==0)return Math.sign(r)}return 0},q=(s,t,o)=>{const e=N(t,o);switch(s){case"!=":return e!==0;case"<":return e<0;case"<=":return e<=0;case"==":return e===0;case">":return e>0;case">=":return e>=0;default:return e>=0&&t.slice(0,o.length-1).join(".")===o.slice(0,-1).join(".")}},C=(s,t)=>{const o=v(t);for(const e of s.split(",")){const r=/^\s*(>=|<=|==|!=|~=|>|<)\s*(\S+)\s*$/.exec(e);if(!r)continue;const a=r[1],i=v(r[2]);if(i.length!==0&&!q(a,o,i))return!1}return!0},L=(s,t,o)=>{const e=s.split(`
+`),r=w(t),a=[];e.forEach((n,l)=>{n.trim()==="[[package]]"&&a.push(l)});let i=!1;for(let n=0;n<a.length;n++){const l=a[n],f=a[n+1]??e.length;let c,u=-1,d=!1;for(let m=l+1;m<f;m++){const h=e[m].trim(),g=/^name\s*=\s*"([^"]+)"$/.exec(h),$=/^version\s*=\s*"[^"]*"$/.test(h);g&&c===void 0?[,c]=g:$&&u===-1?u=m:E.test(h)&&(d=!0)}if(c===void 0||u===-1||!d||w(c)!==r)continue;const P=/^(\s*)/.exec(e[u])?.[1]??"";e[u]=`${P}version = "${o}"${e[u].endsWith("\r")?"\r":""}`,i=!0}return i?{content:e.join(`
+`),found:i}:{found:i}},S=async(s,t)=>s.get(t)??k(t,"utf8"),W=async s=>{const{cwd:t,dependents:o,pending:e,releases:r}=s,a=new Set,i=[];for(const n of r){const l=await S(e,n.manifestPath),f=M(l,n.newVersion,T);if(f.content!==void 0&&(e.set(n.manifestPath,f.content),a.add(n.manifestPath)),!f.found)throw new V({code:"CONFIG_INVALID",file:n.manifestPath,message:`${n.manifestPath} has no literal [project].version to bump.`});const c=await R(x(n.manifestPath),t,"uv.lock");if(c===void 0)continue;const u=e.get(c)??await k(c,"utf8"),d=L(u,n.name,n.newVersion);if(!d.found){i.push(`uv-lock: ${n.name} has no workspace-member entry in ${c}; run \`uv lock\` to add it.`);continue}d.content!==void 0&&(e.set(c,d.content),a.add(c))}for(const n of o)for(const l of r){const f=n.dependencies[l.name];f!==void 0&&f!=="*"&&!C(f,l.newVersion)&&i.push(`python-deps: ${n.name} requires ${l.name}${f}, which excludes ${l.newVersion}; widen the specifier before release.`)}return{touched:a,warnings:i}};export{W as planPythonWorkspace,L as rewriteUvLockVersion,C as specifierAccepts};

package/dist/packem_chunks/python-projects.js

@@ -0,0 +1 @@
+import{createRequire as F}from"node:module";import D from"./index.js";import{VisReleaseError as h}from"../packem_shared/VisReleaseError-DZtgcKf8.js";import{h as M,g as j,j as V}from"./index2.js";let L;const $=o=>(L??=F(import.meta.url))(o),l=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,P=o=>{if(typeof l<"u"&&l.versions&&l.versions.node){const[t,n]=l.versions.node.split(".").map(Number);if(t>22||t===22&&n>=3||t===20&&n>=16)return l.getBuiltinModule(o)}return $(o)},{readFile:x}=P("node:fs/promises"),{join:g,resolve:C}=P("node:path"),z="Private :: Do Not Upload",I=o=>o.toLowerCase().replaceAll(/[-_.]+/g,"-"),d=o=>Array.isArray(o)?o.filter(t=>typeof t=="string"):[],A=async o=>{try{return await x(o,"utf8")}catch{return}},N=async(o,t)=>{const{parse:n}=await import("./index4.js");try{return n(o)}catch(c){throw new h({cause:c,code:"CONFIG_INVALID",file:t,message:`Failed to parse ${t}: ${c.message}`})}},O=o=>{const t=/^\s*([A-Z0-9](?:[\w.-]*[A-Z0-9])?)\s*(?:\[[^\]]*\])?\s*(.*?)\s*$/i.exec(o);if(!t)return;const n=(t[2]??"").split(";")[0].trim();return{name:t[1],specifier:n}},G=async o=>{const{claimedDirs:t,cwd:n}=o,c=g(n,"pyproject.toml"),w=await A(c);if(w===void 0)return[];const f=await N(w,c),u=new Set;f.project&&u.add(n);const b=d(f.tool?.uv?.workspace?.exclude);for(const e of d(f.tool?.uv?.workspace?.members))for(const s of await M(n,e)){const a=s.slice(n.length+1).split("\\").join("/");b.some(i=>D(i,a))||u.add(C(s))}const v=[],R=new Set([...t].map(e=>j(e)));for(const e of[...u].sort()){if(V(j(e),R))continue;const s=g(e,"pyproject.toml"),a=await A(s);if(a===void 0)continue;const i=await N(a,s);if(!i.project)continue;const{dynamic:y,name:r,version:p}=i.project;if(typeof r!="string"||r==="")throw new h({code:"CONFIG_INVALID",file:s,message:`${s} has no [project].name.`});if(typeof p!="string"){const m=d(y).includes("version")?"a dynamic version":"no [project].version";throw new h({code:"CONFIG_INVALID",file:s,message:`${s} has ${m}; vis can only release a literal version. Pin it in pyproject.toml or leave the project out of release.python.`})}v.push({dir:e,doc:i,manifestPath:s,name:r,private:d(i.project.classifiers).includes(z),version:p})}const q=new Map(v.map(e=>[I(e.name),e.name]));return v.map(e=>{const s={},a=e.doc.tool?.uv?.sources??{};for(const y of d(e.doc.project?.dependencies)){const r=O(y);if(!r)continue;const p=I(r.name),m=a[r.name]??a[p],_=q.get(p);_!==void 0&&typeof m=="object"&&m!==null&&m.workspace===!0&&(s[_]=r.specifier===""?"*":r.specifier)}const i={dependencies:s,name:e.name,private:e.private,version:e.version};return{dir:e.dir,ecosystem:"python",manifest:i,manifestPath:e.manifestPath,name:e.name,private:e.private,version:e.version}})};export{G as discoverPythonProjects,I as normalizePythonName,N as parsePyproject,O as splitRequirement};

package/dist/packem_chunks/security.js

@@ -1 +1 @@
-import l from"./index.js";import{VisReleaseError as o}from"../packem_shared/VisReleaseError-DZtgcKf8.js";const c=/^(?:@[a-z0-9-]{1,39}\/)?[a-z0-9._-]{1,214}$/,n=e=>typeof e!="string"||e.length===0||e.length>214||e.startsWith(".")||e.startsWith("_")?!1:c.test(e),d=e=>{if(!n(e))throw new o({code:"CONFIG_INVALID",message:`Invalid package name: ${JSON.stringify(e)}. Must match ^(@scope/)?[a-z0-9._-]+$ and be ≤ 214 chars (npm spec).`,packageName:typeof e=="string"?e:void 0})},g=e=>`'${e.replaceAll("'",String.raw`'\''`)}'`,i=e=>`"${e.replaceAll('"','""')}"`,a=(e,t=process.platform==="win32")=>t?i(e):g(e),A=(e,t)=>{const r=t.allowCustomCommands;return r===void 0||r===!1?!1:r===!0?!0:Array.isArray(r)?r.some(s=>e===s||l(s,e)):!1},f=(e,t,r=process.platform==="win32")=>e.replaceAll("{{name}}",a(t.name,r)).replaceAll("{{version}}",a(t.version,r)).replaceAll("{{tag}}",a(t.tag??"",r)).replaceAll("{{registry}}",a(t.registry??"",r)),p=[/\bnpm_[A-Za-z0-9]{20,}/g,/\bghp_[A-Za-z0-9]{20,}/g,/\bgho_[A-Za-z0-9]{20,}/g,/\bghs_[A-Za-z0-9]{20,}/g,/\bghu_[A-Za-z0-9]{20,}/g,/\bgithub_pat_\w{70,}/g,/\bglpat-[\w-]{20,}/g,/\bAKIA[0-9A-Z]{16}\b/g,/\bASIA[0-9A-Z]{16}\b/g,/\bcio[A-Za-z0-9]{40,}/g,/\bpypi-AgEIcHlwaS5vcmcCJ[\w-]+/g,/ACTIONS_ID_TOKEN_REQUEST_TOKEN=\S+/g,/\b_authToken=\S+/g,/\bBasic\s+[A-Za-z0-9+/=]{16,}/g,/--otp[= ]\S+/g,/\bone[- ]time password:?\s*\d{6,}/gi,/\bEOTP\s+\d{6,}/g,/Bearer (?!\[REDACTED\])[^\s"']+/g],h=e=>{let t=e;for(const r of p)t=t.replaceAll(r,"[REDACTED]");return t},m={"&":"&amp;","<":"&lt;",">":"&gt;"},_=e=>{let t=e.replaceAll(/[<>&]/g,r=>m[r]??r);return t=t.replaceAll("`","\\`"),t},C=(e,t,r)=>A(e,r)?{buildCommand:t.buildCommand,checkPublished:t.checkPublished,publishCommand:t.publishCommand}:{};export{d as assertValidPackageName,i as cmdq,_ as escapeMarkdown,f as interpolateCommand,A as isCustomCommandAllowed,n as isValidPackageName,h as redactTokens,C as resolveCustomCommands,a as shellQuote,g as sq};
+import l from"./index.js";import{VisReleaseError as o}from"../packem_shared/VisReleaseError-DZtgcKf8.js";const c=/^(?:@[a-z0-9-]{1,39}\/)?[a-z0-9._-]{1,214}(?:\/[a-z0-9._-]{1,214})*$/,n=e=>typeof e!="string"||e.length===0||e.length>214||e.startsWith(".")||e.startsWith("_")?!1:c.test(e),d=e=>{if(!n(e))throw new o({code:"CONFIG_INVALID",message:`Invalid package name: ${JSON.stringify(e)}. Must match ^(@scope/)?[a-z0-9._-]+(/[a-z0-9._-]+)*$ and be ≤ 214 chars.`,packageName:typeof e=="string"?e:void 0})},g=e=>`'${e.replaceAll("'",String.raw`'\''`)}'`,i=e=>`"${e.replaceAll('"','""')}"`,a=(e,t=process.platform==="win32")=>t?i(e):g(e),A=(e,t)=>{const r=t.allowCustomCommands;return r===void 0||r===!1?!1:r===!0?!0:Array.isArray(r)?r.some(s=>e===s||l(s,e)):!1},_=(e,t,r=process.platform==="win32")=>e.replaceAll("{{name}}",a(t.name,r)).replaceAll("{{version}}",a(t.version,r)).replaceAll("{{tag}}",a(t.tag??"",r)).replaceAll("{{registry}}",a(t.registry??"",r)),p=[/\bnpm_[A-Za-z0-9]{20,}/g,/\bghp_[A-Za-z0-9]{20,}/g,/\bgho_[A-Za-z0-9]{20,}/g,/\bghs_[A-Za-z0-9]{20,}/g,/\bghu_[A-Za-z0-9]{20,}/g,/\bgithub_pat_\w{70,}/g,/\bglpat-[\w-]{20,}/g,/\bAKIA[0-9A-Z]{16}\b/g,/\bASIA[0-9A-Z]{16}\b/g,/\bcio[A-Za-z0-9]{40,}/g,/\bpypi-AgEIcHlwaS5vcmcCJ[\w-]+/g,/ACTIONS_ID_TOKEN_REQUEST_TOKEN=\S+/g,/\b_authToken=\S+/g,/\bBasic\s+[A-Za-z0-9+/=]{16,}/g,/--otp[= ]\S+/g,/\bone[- ]time password:?\s*\d{6,}/gi,/\bEOTP\s+\d{6,}/g,/Bearer (?!\[REDACTED\])[^\s"']+/g],f=e=>{let t=e;for(const r of p)t=t.replaceAll(r,"[REDACTED]");return t},m={"&":"&amp;","<":"&lt;",">":"&gt;"},h=e=>{let t=e.replaceAll(/[<>&]/g,r=>m[r]??r);return t=t.replaceAll("`","\\`"),t},C=(e,t,r)=>A(e,r)?{buildCommand:t.buildCommand,checkPublished:t.checkPublished,publishCommand:t.publishCommand}:{};export{d as assertValidPackageName,i as cmdq,h as escapeMarkdown,_ as interpolateCommand,A as isCustomCommandAllowed,n as isValidPackageName,f as redactTokens,C as resolveCustomCommands,a as shellQuote,g as sq};

package/dist/packem_chunks/snapshot.js

@@ -1,2 +1,2 @@
-import{createRequire as O}from"node:module";import{DEFAULT_CHANGES_DIR as Y}from"./DEFAULT_CLEAN_KEEP.js";import{p as $,r as z,c as G,a as Q}from"./index2.js";import{getCurrentSha as X,getShortSha as Z}from"./git.js";import{N as ee}from"./index3.js";let U;const V=s=>(U??=O(import.meta.url))(s),u=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,K=s=>{if(typeof u<"u"&&u.versions&&u.versions.node){const[e,n]=u.versions.node.split(".").map(Number);if(e>22||e===22&&n>=3||e===20&&n>=16)return u.getBuiltinModule(s)}return V(s)},{readFile:W,writeFile:C}=K("node:fs/promises"),te=(s,e)=>s.replaceAll("{tag}",e.tag).replaceAll("{sha}",e.sha).replaceAll("{shortSha}",e.shortSha).replaceAll("{branch}",e.branch??"").replaceAll("{pr}",e.pr??"").replaceAll("{timestamp}",e.timestamp),le=async s=>{const{context:e,dryRun:n=!1,registry:g,tag:o}=s,{createShellRunner:c}=await import("./shell-runner.js"),r=s.runner??c(),l=await X({cwd:e.cwd,runner:r}),i=await Z({cwd:e.cwd,runner:r});if(!l||!i)throw new Error("Could not resolve git HEAD. Snapshot requires a git workspace.");const w=e.config.snapshot?.versionTemplate??"0.0.0-{tag}-{shortSha}",y=new Date().toISOString().replaceAll(/[:.]/g,"").slice(0,14),f=e.config.snapshot?.tags??[],p=await r.run("git",["rev-parse","--abbrev-ref","HEAD"],{cwd:e.cwd,silent:!0}).then(t=>t.exitCode===0?t.stdout.trim():void 0).catch(()=>{}),A=process.env.VIS_PR_NUMBER??process.env.PR_NUMBER,D=[o];for(const t of f){let a;switch(t){case"branch":{a=p&&p!=="HEAD"?p:void 0;break}case"pr":{a=A?`pr-${A}`:void 0;break}case"sha":{a=l;break}case"short-sha":{a=i;break}default:a=void 0}a&&a!==o&&!D.includes(a)&&D.push(a)}let m=e.packages;if(s.filter){const{default:t}=await import("./index.js"),a=s.filter.split(",").map(d=>d.trim()).filter(Boolean);m=m.filter(d=>a.some(v=>d.name===v||t(v,d.name)))}m=m.filter(t=>!t.private);const h=te(w,{branch:p&&p!=="HEAD"?p:void 0,pr:A,sha:l,shortSha:i,tag:o,timestamp:y}),N=new Map;for(const t of m)N.set(t.name,{...t.manifest,version:h});const q=$(await e.pm.readCatalogYaml(e.cwd)),x=new ee(r),b=[],k=[],_=[],P=e.config.changesDir??Y,{acquireLock:F,releaseLock:M}=await import("./state.js");let j=!1;if(!n)try{await F(e.cwd,P),j=!0}catch(t){return _.push({name:"_lock",reason:t.message}),{failed:_,published:b,skipped:k,snapshotVersion:h,tag:o}}try{for(const t of m){const a=ae(t,N),d=z(a,q),v=G(d,e.config.publish?.cleanPackageJson);if(n){b.push({name:t.name,version:h});continue}let R;try{R=await W(t.manifestPath,"utf8"),await C(t.manifestPath,`${JSON.stringify(v,null,4)}
-`);const{mkdtempSync:E}=await import("node:fs"),{tmpdir:T}=await import("node:os"),{join:B}=await import("node:path"),H=E(B(T(),"vis-snapshot-")),I=await e.pm.pack({cwd:t.dir,destination:H});let S;for(const L of D){const J=await x.publish({access:"public",extraArgs:["--no-git-checks"],registry:g,tag:L,tarball:I.tarball});S??=J}S?.published?b.push({name:t.name,version:h}):S?.alreadyPublished?k.push({name:t.name,reason:"already-published"}):k.push({name:t.name,reason:S?.output??"unknown"})}catch(E){_.push({name:t.name,reason:E.message})}finally{if(R!==void 0)try{await C(t.manifestPath,R)}catch{}}}}finally{j&&await M(e.cwd,P)}return{failed:_,published:b,skipped:k,snapshotVersion:h,tag:o}},se=["dependencies","devDependencies","peerDependencies","optionalDependencies"],ae=(s,e)=>{const n=e.get(s.name)??s.manifest,g={...n};for(const o of se){const c=n[o];if(!c||typeof c!="object")continue;const r={...c};for(const[l,i]of Object.entries(c)){const w=e.get(l);if(w&&i.startsWith("workspace:")){const y=i.slice(10),f=Q(y==="*"?"*":i,w.version);r[l]=f.startsWith("workspace:")?f.slice(10):f}}g[o]=r}return g};export{le as runSnapshot};
+import{createRequire as O}from"node:module";import{DEFAULT_CHANGES_DIR as Y}from"./DEFAULT_CLEAN_KEEP.js";import{p as $,r as z,c as G,a as Q}from"./index2.js";import{getCurrentSha as X,getShortSha as Z}from"./git.js";import{N as ee}from"./index3.js";let U;const V=s=>(U??=O(import.meta.url))(s),g=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,K=s=>{if(typeof g<"u"&&g.versions&&g.versions.node){const[e,n]=g.versions.node.split(".").map(Number);if(e>22||e===22&&n>=3||e===20&&n>=16)return g.getBuiltinModule(s)}return V(s)},{readFile:W,writeFile:C}=K("node:fs/promises"),te=(s,e)=>s.replaceAll("{tag}",e.tag).replaceAll("{sha}",e.sha).replaceAll("{shortSha}",e.shortSha).replaceAll("{branch}",e.branch??"").replaceAll("{pr}",e.pr??"").replaceAll("{timestamp}",e.timestamp),le=async s=>{const{context:e,dryRun:n=!1,registry:w,tag:o}=s,{createShellRunner:c}=await import("./shell-runner.js"),r=s.runner??c(),l=await X({cwd:e.cwd,runner:r}),i=await Z({cwd:e.cwd,runner:r});if(!l||!i)throw new Error("Could not resolve git HEAD. Snapshot requires a git workspace.");const b=e.config.snapshot?.versionTemplate??"0.0.0-{tag}-{shortSha}",S=new Date().toISOString().replaceAll(/[:.]/g,"").slice(0,14),d=e.config.snapshot?.tags??[],p=await r.run("git",["rev-parse","--abbrev-ref","HEAD"],{cwd:e.cwd,silent:!0}).then(t=>t.exitCode===0?t.stdout.trim():void 0).catch(()=>{}),A=process.env.VIS_PR_NUMBER??process.env.PR_NUMBER,D=[o];for(const t of d){let a;switch(t){case"branch":{a=p&&p!=="HEAD"?p:void 0;break}case"pr":{a=A?`pr-${A}`:void 0;break}case"sha":{a=l;break}case"short-sha":{a=i;break}default:a=void 0}a&&a!==o&&!D.includes(a)&&D.push(a)}let m=e.packages;if(s.filter){const{default:t}=await import("./index.js"),a=s.filter.split(",").map(h=>h.trim()).filter(Boolean);m=m.filter(h=>a.some(_=>h.name===_||t(_,h.name)))}m=m.filter(t=>!t.private);const f=te(b,{branch:p&&p!=="HEAD"?p:void 0,pr:A,sha:l,shortSha:i,tag:o,timestamp:S}),N=new Map;for(const t of m)N.set(t.name,{...t.manifest,version:f});const q=$(await e.pm.readCatalogYaml(e.cwd)),x=new ee(r),k=[],u=[],v=[],P=e.config.changesDir??Y,{acquireLock:F,releaseLock:M}=await import("./state.js");let j=!1;if(!n)try{await F(e.cwd,P),j=!0}catch(t){return v.push({name:"_lock",reason:t.message}),{failed:v,published:k,skipped:u,snapshotVersion:f,tag:o}}try{for(const t of m){if(t.ecosystem!==void 0){u.push({name:t.name,reason:"non-npm-packages-have-no-snapshot"});continue}const a=ae(t,N),h=z(a,q),_=G(h,e.config.publish?.cleanPackageJson);if(n){k.push({name:t.name,version:f});continue}let R;try{R=await W(t.manifestPath,"utf8"),await C(t.manifestPath,`${JSON.stringify(_,null,4)}
+`);const{mkdtempSync:E}=await import("node:fs"),{tmpdir:T}=await import("node:os"),{join:B}=await import("node:path"),H=E(B(T(),"vis-snapshot-")),I=await e.pm.pack({cwd:t.dir,destination:H});let y;for(const L of D){const J=await x.publish({access:"public",extraArgs:["--no-git-checks"],registry:w,tag:L,tarball:I.tarball});y??=J}y?.published?k.push({name:t.name,version:f}):y?.alreadyPublished?u.push({name:t.name,reason:"already-published"}):u.push({name:t.name,reason:y?.output??"unknown"})}catch(E){v.push({name:t.name,reason:E.message})}finally{if(R!==void 0)try{await C(t.manifestPath,R)}catch{}}}}finally{j&&await M(e.cwd,P)}return{failed:v,published:k,skipped:u,snapshotVersion:f,tag:o}},se=["dependencies","devDependencies","peerDependencies","optionalDependencies"],ae=(s,e)=>{const n=e.get(s.name)??s.manifest,w={...n};for(const o of se){const c=n[o];if(!c||typeof c!="object")continue;const r={...c};for(const[l,i]of Object.entries(c)){const b=e.get(l);if(b&&i.startsWith("workspace:")){const S=i.slice(10),d=Q(S==="*"?"*":i,b.version);r[l]=d.startsWith("workspace:")?d.slice(10):d}}w[o]=r}return w};export{le as runSnapshot};

package/dist/packem_chunks/status.js

@@ -1,2 +1,2 @@
-import{b as d,F as i,J as l}from"../packem_shared/index.server-sXNQYpsl.js";import{p as a}from"./cli-main.js";import{r as y,g}from"../packem_shared/advisories-BSpzRIXP.js";const h=n=>{if(n===0)return"0 B";const r=["B","KB","MB","GB"],o=Math.min(Math.floor(Math.log(n)/Math.log(1024)),r.length-1),s=n/1024**o;return`${s.toFixed(s<10&&o>0?1:0)} ${r[o]}`},v=n=>{if(!n)return"never";const r=Date.parse(n);if(Number.isNaN(r))return n;const o=Date.now()-r;if(o<0)return n;const s=Math.floor(o/6e4);if(s<1)return"just now";if(s<60)return`${s}m ago`;const t=Math.floor(s/60);return t<24?`${t}h ago`:`${Math.floor(t/24)}d ago`},$=async({logger:n,options:r,workspaceRoot:o})=>{if(!o)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const s=r.db??y(o),t=await g(o,s);if(r.format==="json"){process.stdout.write(`${JSON.stringify({dbPath:s,ecosystems:t.ecosystems.map(e=>({advisoryCount:e.advisoryCount,lastSyncIso:e.lastSyncIso,manifestEtag:e.manifestEtag??null,name:e.name})),exists:t.exists,schemaVersion:t.schemaVersion,sizeBytes:t.sizeBytes},void 0,2)}
+import{b as d,F as i,J as l}from"../packem_shared/index.server-sXNQYpsl.js";import{p as a}from"./cli-main.js";import{r as y,g}from"./catalog.js";const h=n=>{if(n===0)return"0 B";const r=["B","KB","MB","GB"],o=Math.min(Math.floor(Math.log(n)/Math.log(1024)),r.length-1),s=n/1024**o;return`${s.toFixed(s<10&&o>0?1:0)} ${r[o]}`},v=n=>{if(!n)return"never";const r=Date.parse(n);if(Number.isNaN(r))return n;const o=Date.now()-r;if(o<0)return n;const s=Math.floor(o/6e4);if(s<1)return"just now";if(s<60)return`${s}m ago`;const t=Math.floor(s/60);return t<24?`${t}h ago`:`${Math.floor(t/24)}d ago`},$=async({logger:n,options:r,workspaceRoot:o})=>{if(!o)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const s=r.db??y(o),t=await g(o,s);if(r.format==="json"){process.stdout.write(`${JSON.stringify({dbPath:s,ecosystems:t.ecosystems.map(e=>({advisoryCount:e.advisoryCount,lastSyncIso:e.lastSyncIso,manifestEtag:e.manifestEtag??null,name:e.name})),exists:t.exists,schemaVersion:t.schemaVersion,sizeBytes:t.sizeBytes},void 0,2)}
 `);return}if(a.info(`DB: ${s}`),!t.exists){a.warn(`No advisory DB yet. Run ${d("vis advisories sync")} to populate.`);return}if(a.info(`Schema: v${t.schemaVersion}   Size: ${h(t.sizeBytes)}`),t.ecosystems.length===0){a.warn("DB exists but contains no ecosystems. Run `vis advisories sync`.");return}a.info(""),a.info("Ecosystem    Advisories   Last sync           ETag"),a.info(i("──────────   ──────────   ─────────────────   ──────"));for(const e of t.ecosystems){const c=e.name.padEnd(10),u=e.advisoryCount.toLocaleString().padStart(10),m=`${e.lastSyncIso||"never"} (${v(e.lastSyncIso)})`.padEnd(19),f=e.manifestEtag??i("—");a.info(`${l(c)}   ${u}   ${m}   ${f}`)}},E=$;export{E as advisoriesStatusExecute};

package/dist/packem_chunks/swift-projects.js

@@ -0,0 +1 @@
+import{createRequire as _}from"node:module";import{f as S,S as $,r as b,a as j}from"../packem_shared/swift-package-B6X5kzQE.js";import{VisReleaseError as N}from"../packem_shared/VisReleaseError-DZtgcKf8.js";import{isValidPackageName as D}from"./security.js";let w;const v=a=>(w??=_(import.meta.url))(a),o=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,g=a=>{if(typeof o<"u"&&o.versions&&o.versions.node){const[t,c]=o.versions.node.split(".").map(Number);if(t>22||t===22&&c>=3||t===20&&c>=16)return o.getBuiltinModule(a)}return v(a)},{readFileSync:P}=g("node:fs"),{resolve:l,sep:k,join:y}=g("node:path"),h="0.0.0",r=(a,t)=>new N({code:"CONFIG_INVALID",file:a,message:t}),E=async a=>{const{claimedDirs:t,cwd:c}=a,m=[];for(const e of S(l(c))){if([...t].some(f=>e===f||e.startsWith(`${f}${k}`)))continue;const s=y(e,$),d=P(s,"utf8"),n=b(d);if(n.kind==="missing")throw r(s,`${s} has no Package(name: "…") string literal. vis reads the release name from it.`);if(n.kind==="dynamic")throw r(s,`${s} sets the package name to an expression. vis reads only a plain string literal, such as Package(name: "my-lib").`);if(!D(n.name))throw r(s,`${s} names the package ${JSON.stringify(n.name)}. A release name uses lowercase letters, digits, '.', '_' and '-' only.`);const i=j(d);if(i.dynamic)throw r(s,`${s} has a .package(path:) dependency that is not a string literal. vis cannot follow it.`);m.push({dir:e,manifestPath:s,name:n.name,paths:i.paths.map(f=>l(e,f))})}const p=new Map;for(const e of m){const s=p.get(e.name);if(s!==void 0)throw r(e.manifestPath,`${e.name} is declared by both ${s} and ${e.manifestPath}. Release names must be unique.`);p.set(e.name,e.manifestPath)}const u=new Map(m.map(e=>[e.dir,e.name]));return m.map(e=>{const s={};for(const n of e.paths){const i=u.get(n);i!==void 0&&i!==e.name&&(s[i]="*")}const d={dependencies:s,name:e.name,private:!1,version:h};return{package:{dir:e.dir,ecosystem:"swift",manifest:d,manifestPath:e.manifestPath,name:e.name,private:!1,version:h}}})};export{h as SWIFT_PLACEHOLDER_VERSION,E as discoverSwiftProjects};

package/dist/packem_chunks/sync.js

@@ -1,2 +1,3 @@
-import{F as p}from"../packem_shared/index.server-sXNQYpsl.js";import{p as c}from"./cli-main.js";import{s as v}from"../packem_shared/scan-progress-BGB9hIrD.js";import{D as $,s as D}from"../packem_shared/advisories-BSpzRIXP.js";const S=o=>o?.security?.audit?.advisories??{},w=o=>o?o.split(",").map(r=>r.trim()).filter(r=>r.length>0):["npm"],b=async({logger:o,options:r,visConfig:y,workspaceRoot:l})=>{if(!l)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const d=r.format==="json",u=S(y),f=r.source??u.source??$,m=w(r.ecosystem),h=m.map(s=>({id:s,label:`Sync ${s} advisories`})),a=v(h,{live:!d}),i=[];try{for(const s of m){a.start(s);const e=Date.now();try{const t=await D({allowedHosts:u.allowedHosts,dbPath:r.db,ecosystem:s,force:!!r.force,source:f,workspaceRoot:l});i.push({ecosystem:s,result:t}),t.upToDate?a.finish(s,"ok",`up to date · ${g(Date.now()-e)}`):a.finish(s,"ok",`${t.advisoriesIngested.toLocaleString()} advisories · ${g(t.durationMs)}`)}catch(t){const n=t instanceof Error?t.message:String(t);i.push({ecosystem:s,error:n}),a.finish(s,"error",n)}}}finally{a.stop()}if(d){const s={ecosystems:i.map(e=>({advisoriesIngested:e.result?.advisoriesIngested??0,dbPath:e.result?.dbPath??null,durationMs:e.result?.durationMs??0,ecosystem:e.ecosystem,error:e.error??null,upToDate:e.result?.upToDate??!1})),source:f};process.stdout.write(`${JSON.stringify(s,void 0,2)}
-`)}else{const s=i.filter(n=>n.error),e=i.filter(n=>n.result),t=e[0];t?.result?.dbPath&&c.info(p(`DB: ${t.result.dbPath}`)),s.length===0?c.success(`Synced ${e.length} ecosystem${e.length===1?"":"s"}.`):c.error(`${s.length} ecosystem${s.length===1?"":"s"} failed to sync.`)}i.some(s=>s.error)&&(process.exitCode=1)},g=o=>o>=1e3?`${(o/1e3).toFixed(1)}s`:`${Math.round(o)}ms`,C=b;export{C as advisoriesSyncExecute};
+import{F as v}from"../packem_shared/index.server-sXNQYpsl.js";import{p as c}from"./cli-main.js";import{s as S}from"../packem_shared/scan-progress-C_zaZjyY.js";import{D as $,s as b,A as D}from"./catalog.js";import{c as w}from"../packem_shared/multi-eco-lockfiles-CUUxUjHK.js";const E=o=>o?.security?.audit?.advisories??{},A=o=>o?o.split(",").map(t=>t.trim()).filter(t=>t.length>0).map(t=>w(t)):["npm"],C=async({logger:o,options:t,visConfig:p,workspaceRoot:d})=>{if(!d)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const l=t.format==="json",u=E(p),m=t.source??u.source??$,f=A(t.ecosystem),y=f.map(s=>({id:s,label:`Sync ${s} advisories`})),n=S(y,{live:!l}),i=[];try{for(const s of f){n.start(s);const e=Date.now();try{const r=await b({allowedHosts:u.allowedHosts,dbPath:t.db,ecosystem:s,force:!!t.force,source:m,workspaceRoot:d});i.push({ecosystem:s,result:r}),r.upToDate?n.finish(s,"ok",`up to date · ${h(Date.now()-e)}`):n.finish(s,"ok",`${r.advisoriesIngested.toLocaleString()} advisories · ${h(r.durationMs)}`)}catch(r){const a=r instanceof Error?r.message:String(r);i.push({ecosystem:s,error:a}),n.finish(s,"error",a)}}}finally{n.stop()}const g=i.find(s=>s.result?.rebuiltFromSchema!==void 0)?.result?.rebuiltFromSchema;if(g!==void 0){const s=`advisory database is schema v${String(g)}; rebuilt to v${String(D)}`;l?process.stderr.write(`${s}
+`):c.info(s)}if(l){const s={ecosystems:i.map(e=>({advisoriesIngested:e.result?.advisoriesIngested??0,dbPath:e.result?.dbPath??null,durationMs:e.result?.durationMs??0,ecosystem:e.ecosystem,error:e.error??null,upToDate:e.result?.upToDate??!1})),source:m};process.stdout.write(`${JSON.stringify(s,void 0,2)}
+`)}else{const s=i.filter(a=>a.error),e=i.filter(a=>a.result),r=e[0];r?.result?.dbPath&&c.info(v(`DB: ${r.result.dbPath}`)),s.length===0?c.success(`Synced ${e.length} ecosystem${e.length===1?"":"s"}.`):c.error(`${s.length} ecosystem${s.length===1?"":"s"} failed to sync.`)}i.some(s=>s.error)&&(process.exitCode=1)},h=o=>o>=1e3?`${(o/1e3).toFixed(1)}s`:`${Math.round(o)}ms`,M=C;export{M as advisoriesSyncExecute,A as parseEcosystems};

package/dist/packem_chunks/sync2.js

@@ -1,2 +1,2 @@
-import{p as n}from"./cli-main.js";import{d as u}from"../packem_shared/pm-runner-9L6ocnu2.js";import{s as p}from"../packem_shared/native-config-sync-CEB0rWlk.js";import{s as g}from"../packem_shared/min-release-age-Da4V046o.js";const y=new Set(["bun","npm","pnpm","yarn"]),S=({options:c,visConfig:a,workspaceRoot:l})=>{const i=l??process.cwd(),e=u(i);if(!y.has(e.name)){n.warn(`Package manager '${e.name}' has no native security config to sync.`);return}if(!a?.security){n.warn("vis.config has no `security` block — nothing to sync.");return}const t=a.security.policies??{},r=Object.fromEntries(Object.entries(t.installScripts?.allow??{}).filter(([,o])=>o)),f=t.firstSeen?.minutes,m=t.firstSeen?.exclude??[],s=[];if(Object.keys(r).length>0&&!c.skipAllowBuilds&&s.push(...p(e.name,i,r)),c.skipMinReleaseAge||s.push(...g(e.name,i,f,m)),s.length===0){n.success("Nothing to sync — vis.config and native PM config are aligned.");return}n.info(`Syncing vis.config security settings to ${e.name} native config…
+import{p as n}from"./cli-main.js";import{d as u}from"../packem_shared/pm-runner-CMSml1Bj.js";import{s as p}from"../packem_shared/native-config-sync-TdTWjVgI.js";import{s as g}from"../packem_shared/min-release-age-JViyQuBM.js";const y=new Set(["bun","npm","pnpm","yarn"]),S=({options:c,visConfig:a,workspaceRoot:l})=>{const i=l??process.cwd(),e=u(i);if(!y.has(e.name)){n.warn(`Package manager '${e.name}' has no native security config to sync.`);return}if(!a?.security){n.warn("vis.config has no `security` block — nothing to sync.");return}const t=a.security.policies??{},r=Object.fromEntries(Object.entries(t.installScripts?.allow??{}).filter(([,o])=>o)),f=t.firstSeen?.minutes,m=t.firstSeen?.exclude??[],s=[];if(Object.keys(r).length>0&&!c.skipAllowBuilds&&s.push(...p(e.name,i,r)),c.skipMinReleaseAge||s.push(...g(e.name,i,f,m)),s.length===0){n.success("Nothing to sync — vis.config and native PM config are aligned.");return}n.info(`Syncing vis.config security settings to ${e.name} native config…
 `);for(const o of s)n.success(`  ${o}`)};export{S as default};

package/dist/packem_chunks/tripwire.js

@@ -1,2 +1,2 @@
-import{createRequire as g}from"node:module";import"../packem_shared/index-CVBR-Kit.js";import{e as p}from"../packem_shared/path-CxEa27Rz-pjheKk6v.js";import{p as e}from"./cli-main.js";import{d as _}from"../packem_shared/pm-runner-9L6ocnu2.js";import{y as u}from"../packem_shared/isAccessibleSync-DYKTrrvc-K2xhg6sV.js";import{p as m}from"../packem_shared/readJsonSync-CbryXYxN-BxKjDZnF.js";import{U as $}from"../packem_shared/writeFileSync-DJoHk3Ks-O9zOKqeM.js";let y;const w=r=>(y??=g(import.meta.url))(r),c=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,v=r=>{if(typeof c<"u"&&c.versions&&c.versions.node){const[n,s]=c.versions.node.split(".").map(Number);if(n>22||n===22&&s>=3||n===20&&s>=16)return c.getBuiltinModule(r)}return w(r)},{spawnSync:h}=v("node:child_process"),t="@lavamoat/preinstall-always-fail",d=r=>{const n=p(r,"package.json");if(!u(n))return"no-package-json";try{const s=m(n);if(s.devDependencies?.[t]||s.dependencies?.[t])return"installed"}catch{}return"missing"},k=r=>{const n=p(r,"package.json");if(!u(n))return!1;try{const s=m(n);let i=!1;const l=a=>!a||!(t in a)?a:(i=!0,Object.fromEntries(Object.entries(a).filter(([o])=>o!==t)));return s.devDependencies=l(s.devDependencies),s.dependencies=l(s.dependencies),i&&$(n,`${JSON.stringify(s,null,2)}
-`),i}catch{return!1}},q=({options:r,workspaceRoot:n})=>{const s=n??process.cwd();if(r.status){switch(d(s)){case"installed":{e.success(`Preinstall tripwire is installed (${t}).`),e.info("Removing 'ignore-scripts=true' will cause future installs to fail loudly.");break}case"missing":{e.warn("Preinstall tripwire is not installed."),e.info(`Run 'vis security tripwire' to add ${t} as a devDependency.`);break}default:e.error("No package.json found at the workspace root."),process.exitCode=1}return}if(r.remove){k(s)?e.success(`Removed ${t} from package.json. Run your PM's install to clean node_modules.`):e.info(`${t} was not present in package.json.`);return}if(d(s)==="installed"){e.info(`${t} is already installed.`);return}const i=_(s),a={bun:["add","-d",t],npm:["install","--save-dev",t],pnpm:["add","-D","-w",t],yarn:["add","-D",t]}[i.name];if(!a){e.error(`Cannot install tripwire — unsupported package manager '${i.name}'.`),process.exitCode=1;return}e.info(`Installing ${t} via ${i.name}…`);const o=h(i.name,a,{cwd:s,stdio:"inherit"});if(o.error){e.error(`Failed to install tripwire: ${o.error.message}`),process.exitCode=1;return}if(o.signal!==null){e.error(`${i.name} was terminated by signal ${o.signal}`),process.exitCode=1;return}if(o.status!==0){e.error(`${i.name} exited with code ${String(o.status)}`),process.exitCode=o.status??1;return}e.success(`Installed ${t} as a devDependency.`),e.notice(""),e.notice("How the tripwire works:"),e.notice(`  ${t} declares a preinstall script that always fails.`),e.notice("  When 'ignore-scripts=true' is set (.npmrc / bunfig.toml / .yarnrc.yml),"),e.notice("  the script is skipped and installs succeed normally. If someone deletes"),e.notice("  that setting, the next install fails — loudly — instead of silently"),e.notice("  running every dependency's lifecycle scripts.")};export{q as default};
+import{createRequire as g}from"node:module";import{e as p}from"../packem_shared/index-BzhrR_iC.js";import{p as e}from"./cli-main.js";import{d as _}from"../packem_shared/pm-runner-CMSml1Bj.js";import{y as u}from"../packem_shared/isAccessibleSync-DYKTrrvc-C-_5cgwu.js";import{p as m}from"../packem_shared/readJsonSync-CbryXYxN-EWl7_7KX.js";import{U as $}from"../packem_shared/writeFileSync-DJoHk3Ks-BPRoepNw.js";let y;const w=r=>(y??=g(import.meta.url))(r),c=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,v=r=>{if(typeof c<"u"&&c.versions&&c.versions.node){const[n,s]=c.versions.node.split(".").map(Number);if(n>22||n===22&&s>=3||n===20&&s>=16)return c.getBuiltinModule(r)}return w(r)},{spawnSync:h}=v("node:child_process"),t="@lavamoat/preinstall-always-fail",d=r=>{const n=p(r,"package.json");if(!u(n))return"no-package-json";try{const s=m(n);if(s.devDependencies?.[t]||s.dependencies?.[t])return"installed"}catch{}return"missing"},k=r=>{const n=p(r,"package.json");if(!u(n))return!1;try{const s=m(n);let i=!1;const l=a=>!a||!(t in a)?a:(i=!0,Object.fromEntries(Object.entries(a).filter(([o])=>o!==t)));return s.devDependencies=l(s.devDependencies),s.dependencies=l(s.dependencies),i&&$(n,`${JSON.stringify(s,null,2)}
+`),i}catch{return!1}},I=({options:r,workspaceRoot:n})=>{const s=n??process.cwd();if(r.status){switch(d(s)){case"installed":{e.success(`Preinstall tripwire is installed (${t}).`),e.info("Removing 'ignore-scripts=true' will cause future installs to fail loudly.");break}case"missing":{e.warn("Preinstall tripwire is not installed."),e.info(`Run 'vis security tripwire' to add ${t} as a devDependency.`);break}default:e.error("No package.json found at the workspace root."),process.exitCode=1}return}if(r.remove){k(s)?e.success(`Removed ${t} from package.json. Run your PM's install to clean node_modules.`):e.info(`${t} was not present in package.json.`);return}if(d(s)==="installed"){e.info(`${t} is already installed.`);return}const i=_(s),a={bun:["add","-d",t],npm:["install","--save-dev",t],pnpm:["add","-D","-w",t],yarn:["add","-D",t]}[i.name];if(!a){e.error(`Cannot install tripwire — unsupported package manager '${i.name}'.`),process.exitCode=1;return}e.info(`Installing ${t} via ${i.name}…`);const o=h(i.name,a,{cwd:s,stdio:"inherit"});if(o.error){e.error(`Failed to install tripwire: ${o.error.message}`),process.exitCode=1;return}if(o.signal!==null){e.error(`${i.name} was terminated by signal ${o.signal}`),process.exitCode=1;return}if(o.status!==0){e.error(`${i.name} exited with code ${String(o.status)}`),process.exitCode=o.status??1;return}e.success(`Installed ${t} as a devDependency.`),e.notice(""),e.notice("How the tripwire works:"),e.notice(`  ${t} declares a preinstall script that always fails.`),e.notice("  When 'ignore-scripts=true' is set (.npmrc / bunfig.toml / .yarnrc.yml),"),e.notice("  the script is skipped and installs succeed normally. If someone deletes"),e.notice("  that setting, the next install fails — loudly — instead of silently"),e.notice("  running every dependency's lifecycle scripts.")};export{I as default};