@visulima/vis 5.0.0 → 6.0.1

package/CHANGELOG.md

@@ -1,3 +1,142 @@
+## @visulima/vis [6.0.1](https://github.com/visulima/vis/compare/@visulima/vis@6.0.0...@visulima/vis@6.0.1) (2026-10-16)
+
+### Bug Fixes
+
+* **ci:** resolve benches from the repo root and retry watcher writes ([5f2a7cd](https://github.com/visulima/vis/commit/5f2a7cda132bb624ac35ec4bc5230632530630fa))
+* **deps:** resolve audit findings in the benchmark fixtures ([aeec812](https://github.com/visulima/vis/commit/aeec812ff72973bea1d21f32775488388a1a7269))
+* **deps:** update dependency drizzle-orm to ^0.45.0 [security] ([7531967](https://github.com/visulima/vis/commit/7531967d48d9d4dbbdd15081a37db98577dfdedf))
+* **deps:** update dependency express to v4.20.0 [security] ([adbd076](https://github.com/visulima/vis/commit/adbd0768099f510ae43a341177b11d045b500c1b))
+* **deps:** update dependency next to v16.3.8 [security] ([bc83b50](https://github.com/visulima/vis/commit/bc83b508f863d0b565597c98dedea1e244eb3e93))
+* **deps:** update dependency next-auth to v5.0.0-beta.32 [security] ([9bb3876](https://github.com/visulima/vis/commit/9bb38767f93273c97c8404fd0b28b8b8eae83f84))
+* **deps:** update dependency postcss to v8.5.23 [security] ([bc4caac](https://github.com/visulima/vis/commit/bc4caace200682ac40b26e90193fe49394437544))
+* **vis:** satisfy arrow-body lint rule in pm-runner ([818a47d](https://github.com/visulima/vis/commit/818a47d67148c4957543d60049f287064739afe3))
+
+### Reverts
+
+* Revert "style(vis): format pm-runner to match prettier" ([beff276](https://github.com/visulima/vis/commit/beff276e3d3aaa90610a718d6724529511ca8362))
+
+### Styles
+
+* **vis:** format pm-runner to match prettier ([b6d57d6](https://github.com/visulima/vis/commit/b6d57d65fea5331c32b0e61aae42088e85bbe777))
+
+### Miscellaneous Chores
+
+* **deps:** merge renovate branch npm-drizzle-orm-vulnerability ([59de3b6](https://github.com/visulima/vis/commit/59de3b65acd9fd45574da4b5aa13a4ede87e83e2))
+* **deps:** merge renovate branch npm-next-auth-vulnerability ([2e94a35](https://github.com/visulima/vis/commit/2e94a3564a67f5ac571f0293730399498a66db89))
+* **deps:** merge renovate branch npm-next-vulnerability ([7fbd4f6](https://github.com/visulima/vis/commit/7fbd4f692ade178a5c94cd044ccef198ac115787))
+* **deps:** merge renovate branch npm-postcss-vulnerability ([e41310d](https://github.com/visulima/vis/commit/e41310d64d94593cb7f476b4b9b50aab4f90db40))
+* point package repository urls at visulima/vis ([8f43d61](https://github.com/visulima/vis/commit/8f43d618694dde94f06867ee6155315714238b1c))
+
+### Tests
+
+* **vis:** skip cerebro env scan when its source is absent ([b3d3587](https://github.com/visulima/vis/commit/b3d35870c5c5552ab70c4fdd4128e433993ba3e3))
+
+
+### Dependencies
+
+* **@visulima/secret-scanner:** upgraded to 2.0.2
+
+## @visulima/vis [6.0.0](https://github.com/visulima/visulima/compare/@visulima/vis@5.0.0...@visulima/vis@6.0.0) (2026-10-15)
+
+### ⚠ BREAKING CHANGES
+
+* Deno is no longer a supported runtime or package manager.
+vis targets node/bun runtimes and aube/npm/pnpm/yarn package managers; the
+deno-lint/deno-fmt adapters and deno inference targets are removed.
+
+* fix: resolve eslint errors after deno removal
+
+- vis: use a block body for applyIgnoreScripts (arrow-body-style)
+- is-ansi-color-supported: drop stale eslint-disable directives and
+  replace the raw-release if/else with a ternary (unicorn/prefer-ternary)
+
+* docs(cron-parser): remove remaining deno runtime mentions
+
+These doc/config files arrived with main's dialect-gating commit after this
+branch's base, so they still listed Deno as a supported runtime.
+
+* feat!: remove deno runtime and tooling support
+
+Deno is being wound down: Cloudflare is acquiring the Deno team, the runtime
+gets one more year of monthly maintenance before development ends, and Deno
+Deploy shuts down. Drop Deno as a supported runtime, package manager, and
+lint/fmt/inference target across the monorepo.
+
+- vis: remove the deno runtime path, deno-lint/deno-fmt adapters, the
+  deno.json inference detector, Deno PM handling (TypeScript + Rust native
+  resolver), and the devcontainer deno mount; regenerate the JSON schemas.
+- libraries: drop Deno runtime detection from cerebro, ono,
+  is-ansi-color-supported, and task-runner command parsing; remove Deno
+  wording from package docs and READMEs.
+- delete the examples/deno directories (ono, pail, storage) and Deno docs.
+- keep JSR publishing (registry usable from Node), license/attribution
+  comments, the secret-scanner Deno-token rule, and the historical RFCs.
+* Deno is no longer a supported runtime or package manager.
+vis targets node/bun runtimes and aube/npm/pnpm/yarn package managers; the
+deno-lint/deno-fmt adapters and deno inference targets are removed.
+
+* fix: resolve eslint errors after deno removal
+
+- vis: use a block body for applyIgnoreScripts (arrow-body-style)
+- is-ansi-color-supported: drop stale eslint-disable directives and
+  replace the raw-release if/else with a ternary (unicorn/prefer-ternary)
+
+* chore(vis): tidy deno-removal leftovers from review
+
+* fix(vis): drop unused logger from x handler, restore bun typing
+
+Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
+
+* docs: add migration notes for removed deno exports
+
+Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
+
+* feat(vis): warn on stale adapter ids and deno-only projects
+
+Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
+
+* refactor(vis): derive runtime ids and reuse bun detection
+
+Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
+
+* refactor(vis): drop jsr deno option and deno auth reference
+
+Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
+
+* fix(vis): restore runtime id schema description
+
+Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
+
+* refactor(vis): remove jsr publishing support
+
+Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
+
+* feat(bytes): port @std/bytes helpers back in
+
+Carries the Uint8Array helpers from @std/bytes@1.0.6 (MIT, Copyright the Deno authors)
+into src/std-bytes.ts and re-exports them from the package entry. Keeps the public API that
+the Deno-removal commit dropped, without the jsr: devDependency. Docs and AGENTS notes are
+restored to describe the ported functions.
+
+Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
+
+* docs(bytes): attribute ported @std/bytes source
+
+The license file still listed @jsr/std__bytes as a bundled dependency.
+Replace it with the MIT notice for the ported src/std-bytes.ts, placed outside
+the generated dependency blocks.
+
+Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
+
+* fix(cron-parser): keep reviewed docs and 1.1.0 version
+
+The rebase onto the remote branch dropped the reviewed dialect sentence in the README and
+the installation table row, and the release commit's 1.1.0 version bump.
+
+### Features
+
+* remove deno runtime and tooling support ([#973](https://github.com/visulima/visulima/issues/973)) ([26fada1](https://github.com/visulima/visulima/commit/26fada1ac04731cba9db8f74fe20849c0a15db74))
+
 ## @visulima/vis [5.0.0](https://github.com/visulima/visulima/compare/@visulima/vis@4.3.1...@visulima/vis@5.0.0) (2026-10-14)
 
 ### ⚠ BREAKING CHANGES

package/LICENSE.md

@@ -8168,7 +8168,7 @@ Repository: git+https://github.com/visulima/visulima.git
 ## @visulima/tui
 License: MIT
 By: Daniel Bannert
-Repository: git+https://github.com/visulima/visulima.git
+Repository: git+https://github.com/visulima/vis.git
 
 > MIT License
 >

package/README.md

@@ -233,8 +233,8 @@ When aube is the installer, `vis doctor` surfaces aube's effective hardening pos
 | `vis hook <action>`     |        | Manage git hooks (install, uninstall, migrate)                                         |
 | `vis secrets [paths]`   |        | Scan for hardcoded secrets / credentials (Rust-native)                                 |
 | `vis toolchain <cmd>`   |        | Inspect / delegate to the version manager (proto, mise, fnm, volta…)                   |
-| `vis lint [files]`      |        | Orchestrate detected source-code linters (oxlint, biome, eslint, stylelint, deno-lint) |
-| `vis fmt [files]`       |        | Orchestrate detected formatters (oxfmt, biome, dprint, prettier, deno-fmt)             |
+| `vis lint [files]`      |        | Orchestrate detected source-code linters (oxlint, biome, eslint, stylelint)           |
+| `vis fmt [files]`       |        | Orchestrate detected formatters (oxfmt, biome, dprint, prettier)                       |
 | `vis staged`            |        | Run tasks on staged files (built-in `lint-staged` replacement)                         |
 | `vis migrate <type>`    |        | Migrate from other tools — now including `gitleaks` and `secretlint`                   |
 

package/dist/bin.js

@@ -1 +1 @@
-import"./packem_shared/compile-cache-DoMHRsRZ.js";import"./packem_shared/bin-Dx8mjl3g.js";
+import"./packem_shared/compile-cache-DoMHRsRZ.js";import"./packem_shared/bin-D3TtXgz6.js";

package/dist/binx.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import{a as r,x as i,i as c,d as a,r as d}from"./packem_shared/vis-user-error-Dd7hwxlW.js";import{t as n}from"./packem_shared/compile-cache-DoMHRsRZ.js";import{g as o}from"./packem_shared/package-version-CiRZecQu.js";process.argv.includes("--no-color")&&(process.env.NO_COLOR="1",process.env.FORCE_COLOR="0");process.argv.slice(2).some(s=>s==="--version"||s==="-v"||s==="-V")&&(process.stdout.write(`${o()}
+import{a as r,x as i,i as c,d as a,r as d}from"./packem_shared/vis-user-error-S0Fesz5y.js";import{t as n}from"./packem_shared/compile-cache-DoMHRsRZ.js";import{g as o}from"./packem_shared/package-version-QFmE9anh.js";process.argv.includes("--no-color")&&(process.env.NO_COLOR="1",process.env.FORCE_COLOR="0");process.argv.slice(2).some(s=>s==="--version"||s==="-v"||s==="-V")&&(process.stdout.write(`${o()}
 `),process.exit(0));process.argv.splice(2,0,"dlx");n();const e=r("visx",{packageName:"visx",packageVersion:o()}),p=process.argv.includes("--debug")||!!process.env.DEBUG;e.addPlugin(i({concise:c,detailed:p,exitOnError:!1}));e.addCommand(a);d(e);

package/dist/config/index.d.ts

@@ -21,22 +21,21 @@ interface SimilarDepFamily {
   prefixes?: string[];
 }
 /** Adapter IDs that can format (adapter `kind` is `"fmt"` or `"both"`). */
-type FmtAdapterId = "biome" | "deno-fmt" | "dprint" | "oxfmt" | "prettier" | "ruff-fmt";
+type FmtAdapterId = "biome" | "dprint" | "oxfmt" | "prettier" | "ruff-fmt";
 /** Adapter IDs that can lint (adapter `kind` is `"lint"` or `"both"`). */
-type LintAdapterId = "biome" | "deno-lint" | "eslint" | "markdownlint" | "oxlint" | "ruff-check" | "shellcheck" | "stylelint" | "typecheck";
+type LintAdapterId = "biome" | "eslint" | "markdownlint" | "oxlint" | "ruff-check" | "shellcheck" | "stylelint" | "typecheck";
 /**
  * Runtime adapter contract for the cross-runtime multi-tool (see
  * `rfc/design-runtime-multitool.md`). Phase 0 defines the identity +
  * detection metadata; Phase 1 extends adapters with the spawn-building
  * methods (`runFile` / `runScript` / `install` / `exec`) that route through
- * `pm-runner`. Deno is a planned third adapter — deliberately not a
- * `RuntimeId` yet (it carries permission + no-`node_modules` semantics that
- * the first cut omits).
+ * `pm-runner`.
  */
-/** JS runtimes vis can target today. `"deno"` is deferred. */
-type RuntimeId = "bun" | "node";
+declare const RUNTIME_IDS: readonly ["bun", "node"];
+/** JS runtimes vis can target today. */
+type RuntimeId = (typeof RUNTIME_IDS)[number];
 type VersionManagerName = "asdf" | "corepack" | "fnm" | "mise" | "none" | "nvm" | "proto" | "self-activate" | "volta";
-type RuntimeTool = "aube" | "bun" | "deno" | "go" | "node" | "npm" | "pnpm" | "python" | "ruby" | "rust" | "yarn";
+type RuntimeTool = "aube" | "bun" | "go" | "node" | "npm" | "pnpm" | "python" | "ruby" | "rust" | "yarn";
 interface ToolchainConfig {
   /**
    * When a tool pin doesn't match the running version, try to fix it
@@ -1103,15 +1102,15 @@ interface VisConfig {
    * Tunes adapter detection precedence, per-extension routing, and
    * per-adapter overrides. Flags on the CLI always win over config.
    *
-   * The default fmt precedence is `oxfmt → biome → dprint → prettier
-   * → deno-fmt`. When multiple adapters claim the same extension,
+   * The default fmt precedence is `oxfmt → biome → dprint → prettier`.
+   * When multiple adapters claim the same extension,
    * the first in this order owns it unless overridden here.
    * @example
    * ```
    * fmt: {
    *   order: ["biome", "prettier"],
    *   extensionOverrides: { md: "dprint" },
-   *   adapters: { "deno-fmt": { enabled: false } },
+   *   adapters: { dprint: { enabled: false } },
    * }
    * ```
    */
@@ -1235,7 +1234,6 @@ interface VisConfig {
    *   format:check), `biome` (lint, format), `oxlint` (lint),
    *   `oxfmt` (format / format:check), `stylelint` (lint:css),
    *   `knip` (knip).
-   * - **Runtimes** — `deno` (test/lint/fmt/check).
    * - **Database tooling** — `prisma` (db:generate/db:migrate/
    *   db:push/db:studio), `drizzle` (db:generate/db:migrate/
    *   db:push/db:studio).
@@ -1251,15 +1249,15 @@ interface VisConfig {
    * a config file (because the package frequently appears transitively
    * and a dep-only match would synthesize broken commands): `vite`,
    * `rolldown`, `rollup`, `webpack`, `storybook`, `nest`, `remix`,
-   * `vitepress`, `bun`, `deno`, `changeset`.
+   * `vitepress`, `bun`, `changeset`.
    *
    * Conflict resolution: detectors are evaluated in registration order
    * (see `BUILT_IN_DETECTORS`) and the first to claim a target name
    * wins. Per-name priorities: `build` → nuxt > next > remix > astro
    * > gatsby > docusaurus > vite > nest > rolldown > tsdown > tsup >
-   * packem > rollup > webpack; `test` → vitest > jest > bun > deno;
+   * packem > rollup > webpack; `test` → vitest > jest > bun;
    * `test:e2e` → playwright > cypress; `lint` → eslint > biome >
-   * oxlint > deno; `format` → prettier > biome > oxfmt; `db:*` →
+   * oxlint; `format` → prettier > biome > oxfmt; `db:*` →
    * prisma > drizzle.
    *
    * Also accepts an object form (`{ vite: false, vitest: true }`) to
@@ -1327,7 +1325,7 @@ interface VisConfig {
      *   and the PM is corepack-managed (errors loudly otherwise).
      * - `false`: never go through corepack — invoke the PM directly.
      *
-     * Mirrors nypm's `corepack: true` flag. Bun, deno, and aube are
+     * Mirrors nypm's `corepack: true` flag. Bun and aube are
      * never wrapped — corepack does not manage them.
      * @default "auto"
      */
@@ -1340,13 +1338,13 @@ interface VisConfig {
    * Flags on the CLI always win over config.
    *
    * The default lint precedence is `oxlint → biome → eslint →
-   * stylelint → deno-lint`. Override with `order` to e.g. let biome
+   * stylelint`. Override with `order` to e.g. let biome
    * fire before oxlint when the workspace standardises on biome.
    * @example
    * ```
    * lint: {
    *   order: ["biome", "eslint"],
-   *   adapters: { "deno-lint": { enabled: false } },
+   *   adapters: { oxlint: { enabled: false } },
    * }
    * ```
    */

package/dist/packem_chunks/bloom-status.js

@@ -1,2 +1,2 @@
-import{b as f,F as s,J as c}from"../packem_shared/index.server-sXNQYpsl.js";import{p as r}from"./cli-main.js";import{g as u}from"../packem_shared/osv-bloom-BCAX5ARR.js";const a=t=>{if(!t)return"never";const i=Date.parse(t);if(Number.isNaN(i))return t;const e=Date.now()-i;if(e<0)return t;const n=Math.floor(e/6e4);if(n<1)return"just now";if(n<60)return`${n}m ago`;const o=Math.floor(n/60);return o<24?`${o}h ago`:`${Math.floor(o/24)}d ago`},m=t=>t<1024?`${t} B`:t<1024*1024?`${(t/1024).toFixed(1)} KB`:`${(t/(1024*1024)).toFixed(1)} MB`,l=async({options:t,workspaceRoot:i})=>{if(!i)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const e=await u(i,t.cacheDir);if(t.format==="json"){process.stdout.write(`${JSON.stringify(e,void 0,2)}
+import{b as f,F as s,J as c}from"../packem_shared/index.server-Ca_EEVfw.js";import{p as r}from"./cli-main.js";import{g as u}from"../packem_shared/osv-bloom-BCAX5ARR.js";const a=t=>{if(!t)return"never";const i=Date.parse(t);if(Number.isNaN(i))return t;const e=Date.now()-i;if(e<0)return t;const n=Math.floor(e/6e4);if(n<1)return"just now";if(n<60)return`${n}m ago`;const o=Math.floor(n/60);return o<24?`${o}h ago`:`${Math.floor(o/24)}d ago`},m=t=>t<1024?`${t} B`:t<1024*1024?`${(t/1024).toFixed(1)} KB`:`${(t/(1024*1024)).toFixed(1)} MB`,l=async({options:t,workspaceRoot:i})=>{if(!i)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const e=await u(i,t.cacheDir);if(t.format==="json"){process.stdout.write(`${JSON.stringify(e,void 0,2)}
 `);return}if(r.info(`Cache: ${e.cacheDir}`),!e.present){r.warn(`No osv-bloom filter yet. Run ${f("vis advisories bloom sync")} to populate.`);return}if(e.manifest){const{manifest:o}=e;r.info(`Built:  ${o.builtAtRfc3339} (${a(o.builtAtRfc3339)})`),r.info(`Fetch:  ${e.fetchedAtIso??s("—")} (${a(e.fetchedAtIso)})`),r.info(`Filter: ${c(m(o.bloomByteLen))}   m=${o.bloomMBits.toLocaleString()} bits   k=${String(o.bloomKHashes)}`),r.info(`Set:    ${o.entryCount.toLocaleString()} entries from ${o.advisoryCount.toLocaleString()} advisories (target FPR ${o.targetFpr})`),r.info(s(`Digest: ${o.setDigestSha256}`))}else r.warn("filter.bin present but manifest.json missing — `vis advisories bloom sync` will rewrite the cache.")},g=l;export{g as advisoriesBloomStatusExecute};

package/dist/packem_chunks/bloom-sync.js

@@ -1,2 +1,2 @@
-import{F as f}from"../packem_shared/index.server-sXNQYpsl.js";import{p as i}from"./cli-main.js";import{s as d}from"../packem_shared/scan-progress-CkumcBG-.js";import{D as p,s as D}from"../packem_shared/osv-bloom-BCAX5ARR.js";const h=o=>o?.security?.audit?.advisories?.bloom??{},u=o=>o>=1e3?`${(o/1e3).toFixed(1)}s`:`${Math.round(o)}ms`,$=o=>o<1024?`${o} B`:o<1024*1024?`${(o/1024).toFixed(1)} KB`:`${(o/(1024*1024)).toFixed(1)} MB`,b=async({options:o,visConfig:m,workspaceRoot:n})=>{if(!n)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const a=o.format==="json",c=h(m),l=o.source??c.source??p,r=d([{id:"bloom",label:"Sync osv-bloom prefilter"}],{live:!a});let e,t;try{r.start("bloom");const s=Date.now();e=await D({allowedHosts:c.allowedHosts,cacheDir:o.cacheDir,force:!!o.force,source:l,workspaceRoot:n}),e.upToDate?r.finish("bloom","ok",`up to date · ${u(Date.now()-s)}`):r.finish("bloom","ok",`${e.manifest.entryCount.toLocaleString()} entries · ${$(e.bytesOnDisk)} · ${u(e.durationMs)}`)}catch(s){t=s instanceof Error?s.message:String(s),r.finish("bloom","error",t)}finally{r.stop()}a?process.stdout.write(`${JSON.stringify({bytesOnDisk:e?.bytesOnDisk??0,cacheDir:e?.cacheDir??null,durationMs:e?.durationMs??0,error:t??null,manifest:e?.manifest??null,source:l,upToDate:e?.upToDate??!1},void 0,2)}
+import{F as f}from"../packem_shared/index.server-Ca_EEVfw.js";import{p as i}from"./cli-main.js";import{s as d}from"../packem_shared/scan-progress-RwCRxJdX.js";import{D as p,s as D}from"../packem_shared/osv-bloom-BCAX5ARR.js";const h=o=>o?.security?.audit?.advisories?.bloom??{},u=o=>o>=1e3?`${(o/1e3).toFixed(1)}s`:`${Math.round(o)}ms`,$=o=>o<1024?`${o} B`:o<1024*1024?`${(o/1024).toFixed(1)} KB`:`${(o/(1024*1024)).toFixed(1)} MB`,b=async({options:o,visConfig:m,workspaceRoot:n})=>{if(!n)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const a=o.format==="json",c=h(m),l=o.source??c.source??p,r=d([{id:"bloom",label:"Sync osv-bloom prefilter"}],{live:!a});let e,t;try{r.start("bloom");const s=Date.now();e=await D({allowedHosts:c.allowedHosts,cacheDir:o.cacheDir,force:!!o.force,source:l,workspaceRoot:n}),e.upToDate?r.finish("bloom","ok",`up to date · ${u(Date.now()-s)}`):r.finish("bloom","ok",`${e.manifest.entryCount.toLocaleString()} entries · ${$(e.bytesOnDisk)} · ${u(e.durationMs)}`)}catch(s){t=s instanceof Error?s.message:String(s),r.finish("bloom","error",t)}finally{r.stop()}a?process.stdout.write(`${JSON.stringify({bytesOnDisk:e?.bytesOnDisk??0,cacheDir:e?.cacheDir??null,durationMs:e?.durationMs??0,error:t??null,manifest:e?.manifest??null,source:l,upToDate:e?.upToDate??!1},void 0,2)}
 `):e&&(i.info(f(`Cache: ${e.cacheDir}`)),i.info(f(`Built: ${e.manifest.builtAtRfc3339}`)),t||i.success(e.upToDate?"osv-bloom prefilter up to date.":"osv-bloom prefilter synced.")),t&&(process.exitCode=1)},g=b;export{g as advisoriesBloomSyncExecute};