@visulima/vis 6.1.0 → 6.1.1

package/dist/packem_chunks/keys-refresh.js

@@ -1,4 +1,4 @@
-import{p as s}from"./cli-main.js";import{c as a,f as c}from"../packem_shared/registry-keys-DxdqMzyp.js";const f=async({options:r})=>{if(r.clear){const t=a();if(r.json){process.stdout.write(`${JSON.stringify({cleared:t,refetched:!1},void 0,2)}
+import{p as s}from"./cli-main.js";import{c as a,f as c}from"../packem_shared/registry-keys-z038Ecb4.js";const f=async({options:r})=>{if(r.clear){const t=a();if(r.json){process.stdout.write(`${JSON.stringify({cleared:t,refetched:!1},void 0,2)}
 `);return}s.success(t?"Cleared cached npm signing keys.":"No cached npm signing keys to clear.");return}const e=await c({forceRefresh:!0});if(e===void 0){if(r.json){process.stdout.write(`${JSON.stringify({cleared:!1,error:"fetch-failed",refetched:!1},void 0,2)}
 `),process.exitCode=1;return}s.error("Failed to fetch npm signing keys (network error and no cached keys available)."),process.exitCode=1;return}if(r.json){process.stdout.write(`${JSON.stringify({cleared:!1,fromCache:e.fromCache,keyCount:e.keys.length,refetched:!e.fromCache,stale:e.stale??!1},void 0,2)}
 `);return}if(e.fromCache&&e.stale===!0){s.warn(`Network fetch failed — falling back to expired cache (${String(e.keys.length)} keys).`);return}s.success(`Refreshed npm signing keys (${String(e.keys.length)} keys).`)};export{f as default};

package/dist/packem_chunks/list.js

@@ -1,3 +1,3 @@
-import{createRequire as _}from"node:module";import{w as x,p as t,x as R}from"./cli-main.js";import{d as P}from"../packem_shared/pm-runner-RM72mDZg.js";import{a as M}from"../packem_shared/build-scripts-CEDx_nJp.js";import{e as v}from"../packem_shared/index-BzhrR_iC.js";import{y as w}from"../packem_shared/isAccessibleSync-DYKTrrvc-C-_5cgwu.js";import{p as q}from"../packem_shared/readJsonSync-CbryXYxN-EWl7_7KX.js";let j;const B=c=>(j??=_(import.meta.url))(c),y=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,D=c=>{if(typeof y<"u"&&y.versions&&y.versions.node){const[i,f]=y.versions.node.split(".").map(Number);if(i>22||i===22&&f>=3||i===20&&f>=16)return y.getBuiltinModule(c)}return B(c)},{readdirSync:S,statSync:N}=D("node:fs"),T=(c,i={})=>{const f=v(c,"node_modules");if(!w(f))return[];const l=new Map,p=new Set,b=(n,o,r)=>{const e=`${o}@${r}`;if(p.has(e))return;p.add(e);const s=r.startsWith(c)?r.slice(c.length+1):r;let u=l.get(n);u||(u=[],l.set(n,u)),u.some($=>$.name===o)||u.push({name:o,relativePath:s})},m=(n,o="")=>{let r;try{r=S(n)}catch{return}for(const e of r){const s=v(n,e);if(e.startsWith("@")){m(s,`${e}/`);continue}if(e===".pnpm"&&o===""){let a;try{a=S(s)}catch{continue}for(const d of a){const g=v(s,d,"node_modules");w(g)&&m(g)}continue}if(e.startsWith("."))continue;const u=o+e,$=v(s,"package.json");try{if(!N(s).isDirectory()||!w($))continue;const a=q($),d=typeof a.name=="string"?a.name:u;if(typeof a.bin=="string"){const k=d.includes("/")?d.split("/").pop():d;b(k,d,s)}else if(a.bin&&typeof a.bin=="object")for(const k of Object.keys(a.bin))b(k,d,s);const g=v(s,"node_modules");w(g)&&m(g)}catch{}}};m(f);const h=[];for(const[n,o]of l)o.length<2||i[n]===!0||o.every(e=>i[`${e.name}#${n}`]===!0)||h.push({bin:n,packages:o});return h.sort((n,o)=>n.bin.localeCompare(o.bin))},V=new Set(["bun","npm","pnpm","yarn"]),F=({options:c,visConfig:i,workspaceRoot:f})=>{const l=f??process.cwd(),p=P(l),b=i?.security?.policies?.installScripts?.allow??{},m=i?.security?.allowBins??{},h=i?.security?.pinVersions===!0,n=M(l,b,{pinVersions:h}),o=T(l,m),r=i&&V.has(p.name)?x(i,p.name,l):void 0;if(c.json){process.stdout.write(`${JSON.stringify({binConflicts:o,drift:r,excess:n.excess,installed:n.installed.map(e=>({hooks:e.hooks,name:e.name,version:e.version})),packageManager:p.name,pinVersions:h,unapproved:n.unapproved.map(e=>({hooks:e.hooks,name:e.name,version:e.version})),versionDrift:n.versionDrift},void 0,2)}
+import{createRequire as _}from"node:module";import{l as R,p as t,m as x}from"./cli-main.js";import{d as P}from"../packem_shared/pm-runner-RM72mDZg.js";import{a as M}from"../packem_shared/build-scripts-CEDx_nJp.js";import{e as v}from"../packem_shared/index-BzhrR_iC.js";import{y as k}from"../packem_shared/isAccessibleSync-DYKTrrvc-C-_5cgwu.js";import{p as q}from"../packem_shared/readJsonSync-CbryXYxN-EWl7_7KX.js";let j;const B=c=>(j??=_(import.meta.url))(c),y=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,D=c=>{if(typeof y<"u"&&y.versions&&y.versions.node){const[i,f]=y.versions.node.split(".").map(Number);if(i>22||i===22&&f>=3||i===20&&f>=16)return y.getBuiltinModule(c)}return B(c)},{readdirSync:S,statSync:N}=D("node:fs"),T=(c,i={})=>{const f=v(c,"node_modules");if(!k(f))return[];const l=new Map,p=new Set,b=(n,o,r)=>{const e=`${o}@${r}`;if(p.has(e))return;p.add(e);const s=r.startsWith(c)?r.slice(c.length+1):r;let u=l.get(n);u||(u=[],l.set(n,u)),u.some($=>$.name===o)||u.push({name:o,relativePath:s})},m=(n,o="")=>{let r;try{r=S(n)}catch{return}for(const e of r){const s=v(n,e);if(e.startsWith("@")){m(s,`${e}/`);continue}if(e===".pnpm"&&o===""){let a;try{a=S(s)}catch{continue}for(const d of a){const g=v(s,d,"node_modules");k(g)&&m(g)}continue}if(e.startsWith("."))continue;const u=o+e,$=v(s,"package.json");try{if(!N(s).isDirectory()||!k($))continue;const a=q($),d=typeof a.name=="string"?a.name:u;if(typeof a.bin=="string"){const w=d.includes("/")?d.split("/").pop():d;b(w,d,s)}else if(a.bin&&typeof a.bin=="object")for(const w of Object.keys(a.bin))b(w,d,s);const g=v(s,"node_modules");k(g)&&m(g)}catch{}}};m(f);const h=[];for(const[n,o]of l)o.length<2||i[n]===!0||o.every(e=>i[`${e.name}#${n}`]===!0)||h.push({bin:n,packages:o});return h.sort((n,o)=>n.bin.localeCompare(o.bin))},V=new Set(["bun","npm","pnpm","yarn"]),F=({options:c,visConfig:i,workspaceRoot:f})=>{const l=f??process.cwd(),p=P(l),b=i?.security?.policies?.installScripts?.allow??{},m=i?.security?.allowBins??{},h=i?.security?.pinVersions===!0,n=M(l,b,{pinVersions:h}),o=T(l,m),r=i&&V.has(p.name)?R(i,p.name,l):void 0;if(c.json){process.stdout.write(`${JSON.stringify({binConflicts:o,drift:r,excess:n.excess,installed:n.installed.map(e=>({hooks:e.hooks,name:e.name,version:e.version})),packageManager:p.name,pinVersions:h,unapproved:n.unapproved.map(e=>({hooks:e.hooks,name:e.name,version:e.version})),versionDrift:n.versionDrift},void 0,2)}
 `);return}if(t.info(`Build-script status (${p.name}):
-`),n.installed.length===0&&n.unapproved.length===0&&t.success("  No installed packages declare lifecycle scripts."),n.installed.length>0){t.success(`  Approved (${String(n.installed.length)}):`);for(const e of n.installed)t.info(`    ✓ ${e.name} — ${e.hooks.join(", ")}`)}if(n.unapproved.length>0){t.info(""),t.warn(`  Unapproved (${String(n.unapproved.length)}):`);for(const e of n.unapproved)t.info(`    ✗ ${e.name} — ${e.hooks.join(", ")}`);t.notice("    Run 'vis approve-builds' to review.")}if(n.excess.length>0){t.info(""),t.warn(`  Stale allowlist entries (${String(n.excess.length)}):`);for(const e of n.excess)t.info(`    ! ${e}`);t.notice("    Remove these from vis.config.ts security.policies.installScripts.allow.")}if(n.versionDrift.length>0){t.info(""),t.warn(`  Version drift (pinVersions: true) — ${String(n.versionDrift.length)} entr${n.versionDrift.length===1?"y":"ies"} point at outdated versions:`);for(const{from:e,to:s}of n.versionDrift)t.info(`    ${e}  →  ${s}`);t.notice("    Update vis.config.ts security.policies.installScripts.allow keys to migrate.")}if(o.length>0){t.info(""),t.warn(`  Bin conflicts (${String(o.length)}) — multiple packages expose the same bin name:`);for(const e of o)t.info(`    ${e.bin} ← ${e.packages.map(s=>s.name).join(", ")}`);t.notice("    Add the bin (or 'pkg#bin') to vis.config.ts security.allowBins to silence this.")}if(r?.hasDrift){t.info("");for(const e of R(r))t.warn(e)}};export{F as default};
+`),n.installed.length===0&&n.unapproved.length===0&&t.success("  No installed packages declare lifecycle scripts."),n.installed.length>0){t.success(`  Approved (${String(n.installed.length)}):`);for(const e of n.installed)t.info(`    ✓ ${e.name} — ${e.hooks.join(", ")}`)}if(n.unapproved.length>0){t.info(""),t.warn(`  Unapproved (${String(n.unapproved.length)}):`);for(const e of n.unapproved)t.info(`    ✗ ${e.name} — ${e.hooks.join(", ")}`);t.notice("    Run 'vis approve-builds' to review.")}if(n.excess.length>0){t.info(""),t.warn(`  Stale allowlist entries (${String(n.excess.length)}):`);for(const e of n.excess)t.info(`    ! ${e}`);t.notice("    Remove these from vis.config.ts security.policies.installScripts.allow.")}if(n.versionDrift.length>0){t.info(""),t.warn(`  Version drift (pinVersions: true) — ${String(n.versionDrift.length)} entr${n.versionDrift.length===1?"y":"ies"} point at outdated versions:`);for(const{from:e,to:s}of n.versionDrift)t.info(`    ${e}  →  ${s}`);t.notice("    Update vis.config.ts security.policies.installScripts.allow keys to migrate.")}if(o.length>0){t.info(""),t.warn(`  Bin conflicts (${String(o.length)}) — multiple packages expose the same bin name:`);for(const e of o)t.info(`    ${e.bin} ← ${e.packages.map(s=>s.name).join(", ")}`);t.notice("    Add the bin (or 'pkg#bin') to vis.config.ts security.allowBins to silence this.")}if(r?.hasDrift){t.info("");for(const e of x(r))t.warn(e)}};export{F as default};

package/dist/packem_chunks/prune.js

@@ -1,3 +1,3 @@
-import{p as o}from"./cli-main.js";import{r as f}from"./catalog.js";const d=async({fs:c,logger:u,options:r,workspaceRoot:t})=>{if(!t)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const e=r.db??f(t),s=r.format==="json";if(!r.force){o.warn(`Prune is destructive. Will remove: ${e}`),o.info("Re-run with --force to proceed."),s&&process.stdout.write(`${JSON.stringify({dbPath:e,reason:"needs --force",removed:!1})}
+import{p as o}from"./cli-main.js";import{r as f}from"../packem_shared/advisories-BodWQ5DQ.js";const d=async({fs:c,logger:u,options:r,workspaceRoot:t})=>{if(!t)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const e=r.db??f(t),s=r.format==="json";if(!r.force){o.warn(`Prune is destructive. Will remove: ${e}`),o.info("Re-run with --force to proceed."),s&&process.stdout.write(`${JSON.stringify({dbPath:e,reason:"needs --force",removed:!1})}
 `);return}const a=[e,`${e}-wal`,`${e}-shm`,`${e}-journal`],i=[];for(const n of a)try{await c.rm(n,{force:!0}),i.push(n)}catch{}if(s){process.stdout.write(`${JSON.stringify({dbPath:e,files:i,removed:!0})}
 `);return}o.success(`Removed ${e}.`)},v=d;export{v as advisoriesPruneExecute};

package/dist/packem_chunks/python-plan.js

@@ -1,3 +1,3 @@
-import{createRequire as j}from"node:module";import{VisReleaseError as V}from"../packem_shared/VisReleaseError-DZtgcKf8.js";import{f as M,k as R}from"./index2.js";import{normalizePythonName as w}from"./python-projects.js";let b;const y=s=>(b??=j(import.meta.url))(s),p=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,_=s=>{if(typeof p<"u"&&p.versions&&p.versions.node){const[t,o]=p.versions.node.split(".").map(Number);if(t>22||t===22&&o>=3||t===20&&o>=16)return p.getBuiltinModule(s)}return y(s)},{readFile:k}=_("node:fs/promises"),{dirname:x}=_("node:path"),T=new Set(["project"]),E=/^source\s*=\s*\{\s*(?:editable|virtual|directory)\s*=/,v=s=>{const t=/^\s*v?(\d+(?:\.\d+)*)/.exec(s);return t?(t[1]??"").split(".").map(Number):[]},N=(s,t)=>{const o=Math.max(s.length,t.length);for(let e=0;e<o;e++){const r=(s[e]??0)-(t[e]??0);if(r!==0)return Math.sign(r)}return 0},q=(s,t,o)=>{const e=N(t,o);switch(s){case"!=":return e!==0;case"<":return e<0;case"<=":return e<=0;case"==":return e===0;case">":return e>0;case">=":return e>=0;default:return e>=0&&t.slice(0,o.length-1).join(".")===o.slice(0,-1).join(".")}},C=(s,t)=>{const o=v(t);for(const e of s.split(",")){const r=/^\s*(>=|<=|==|!=|~=|>|<)\s*(\S+)\s*$/.exec(e);if(!r)continue;const a=r[1],i=v(r[2]);if(i.length!==0&&!q(a,o,i))return!1}return!0},L=(s,t,o)=>{const e=s.split(`
-`),r=w(t),a=[];e.forEach((n,l)=>{n.trim()==="[[package]]"&&a.push(l)});let i=!1;for(let n=0;n<a.length;n++){const l=a[n],f=a[n+1]??e.length;let c,u=-1,d=!1;for(let m=l+1;m<f;m++){const h=e[m].trim(),g=/^name\s*=\s*"([^"]+)"$/.exec(h),$=/^version\s*=\s*"[^"]*"$/.test(h);g&&c===void 0?[,c]=g:$&&u===-1?u=m:E.test(h)&&(d=!0)}if(c===void 0||u===-1||!d||w(c)!==r)continue;const P=/^(\s*)/.exec(e[u])?.[1]??"";e[u]=`${P}version = "${o}"${e[u].endsWith("\r")?"\r":""}`,i=!0}return i?{content:e.join(`
-`),found:i}:{found:i}},S=async(s,t)=>s.get(t)??k(t,"utf8"),W=async s=>{const{cwd:t,dependents:o,pending:e,releases:r}=s,a=new Set,i=[];for(const n of r){const l=await S(e,n.manifestPath),f=M(l,n.newVersion,T);if(f.content!==void 0&&(e.set(n.manifestPath,f.content),a.add(n.manifestPath)),!f.found)throw new V({code:"CONFIG_INVALID",file:n.manifestPath,message:`${n.manifestPath} has no literal [project].version to bump.`});const c=await R(x(n.manifestPath),t,"uv.lock");if(c===void 0)continue;const u=e.get(c)??await k(c,"utf8"),d=L(u,n.name,n.newVersion);if(!d.found){i.push(`uv-lock: ${n.name} has no workspace-member entry in ${c}; run \`uv lock\` to add it.`);continue}d.content!==void 0&&(e.set(c,d.content),a.add(c))}for(const n of o)for(const l of r){const f=n.dependencies[l.name];f!==void 0&&f!=="*"&&!C(f,l.newVersion)&&i.push(`python-deps: ${n.name} requires ${l.name}${f}, which excludes ${l.newVersion}; widen the specifier before release.`)}return{touched:a,warnings:i}};export{W as planPythonWorkspace,L as rewriteUvLockVersion,C as specifierAccepts};
+import{createRequire as j}from"node:module";import{VisReleaseError as V}from"../packem_shared/VisReleaseError-DZtgcKf8.js";import{r as M,f as R}from"./cargo-lock.js";import{normalizePythonName as w}from"./python-projects.js";let b;const y=s=>(b??=j(import.meta.url))(s),p=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,_=s=>{if(typeof p<"u"&&p.versions&&p.versions.node){const[t,o]=p.versions.node.split(".").map(Number);if(t>22||t===22&&o>=3||t===20&&o>=16)return p.getBuiltinModule(s)}return y(s)},{readFile:P}=_("node:fs/promises"),{dirname:x}=_("node:path"),T=new Set(["project"]),E=/^source\s*=\s*\{\s*(?:editable|virtual|directory)\s*=/,v=s=>{const t=/^\s*v?(\d+(?:\.\d+)*)/.exec(s);return t?(t[1]??"").split(".").map(Number):[]},N=(s,t)=>{const o=Math.max(s.length,t.length);for(let e=0;e<o;e++){const r=(s[e]??0)-(t[e]??0);if(r!==0)return Math.sign(r)}return 0},q=(s,t,o)=>{const e=N(t,o);switch(s){case"!=":return e!==0;case"<":return e<0;case"<=":return e<=0;case"==":return e===0;case">":return e>0;case">=":return e>=0;default:return e>=0&&t.slice(0,o.length-1).join(".")===o.slice(0,-1).join(".")}},C=(s,t)=>{const o=v(t);for(const e of s.split(",")){const r=/^\s*(>=|<=|==|!=|~=|>|<)\s*(\S+)\s*$/.exec(e);if(!r)continue;const a=r[1],i=v(r[2]);if(i.length!==0&&!q(a,o,i))return!1}return!0},L=(s,t,o)=>{const e=s.split(`
+`),r=w(t),a=[];e.forEach((n,l)=>{n.trim()==="[[package]]"&&a.push(l)});let i=!1;for(let n=0;n<a.length;n++){const l=a[n],f=a[n+1]??e.length;let c,u=-1,d=!1;for(let m=l+1;m<f;m++){const h=e[m].trim(),g=/^name\s*=\s*"([^"]+)"$/.exec(h),k=/^version\s*=\s*"[^"]*"$/.test(h);g&&c===void 0?[,c]=g:k&&u===-1?u=m:E.test(h)&&(d=!0)}if(c===void 0||u===-1||!d||w(c)!==r)continue;const $=/^(\s*)/.exec(e[u])?.[1]??"";e[u]=`${$}version = "${o}"${e[u].endsWith("\r")?"\r":""}`,i=!0}return i?{content:e.join(`
+`),found:i}:{found:i}},S=async(s,t)=>s.get(t)??P(t,"utf8"),W=async s=>{const{cwd:t,dependents:o,pending:e,releases:r}=s,a=new Set,i=[];for(const n of r){const l=await S(e,n.manifestPath),f=M(l,n.newVersion,T);if(f.content!==void 0&&(e.set(n.manifestPath,f.content),a.add(n.manifestPath)),!f.found)throw new V({code:"CONFIG_INVALID",file:n.manifestPath,message:`${n.manifestPath} has no literal [project].version to bump.`});const c=await R(x(n.manifestPath),t,"uv.lock");if(c===void 0)continue;const u=e.get(c)??await P(c,"utf8"),d=L(u,n.name,n.newVersion);if(!d.found){i.push(`uv-lock: ${n.name} has no workspace-member entry in ${c}; run \`uv lock\` to add it.`);continue}d.content!==void 0&&(e.set(c,d.content),a.add(c))}for(const n of o)for(const l of r){const f=n.dependencies[l.name];f!==void 0&&f!=="*"&&!C(f,l.newVersion)&&i.push(`python-deps: ${n.name} requires ${l.name}${f}, which excludes ${l.newVersion}; widen the specifier before release.`)}return{touched:a,warnings:i}};export{W as planPythonWorkspace,L as rewriteUvLockVersion,C as specifierAccepts};

package/dist/packem_chunks/python-projects.js

@@ -1 +1 @@
-import{createRequire as F}from"node:module";import D from"./index.js";import{VisReleaseError as h}from"../packem_shared/VisReleaseError-DZtgcKf8.js";import{h as M,g as j,j as V}from"./index2.js";let L;const $=o=>(L??=F(import.meta.url))(o),l=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,P=o=>{if(typeof l<"u"&&l.versions&&l.versions.node){const[t,n]=l.versions.node.split(".").map(Number);if(t>22||t===22&&n>=3||t===20&&n>=16)return l.getBuiltinModule(o)}return $(o)},{readFile:x}=P("node:fs/promises"),{join:g,resolve:C}=P("node:path"),z="Private :: Do Not Upload",I=o=>o.toLowerCase().replaceAll(/[-_.]+/g,"-"),d=o=>Array.isArray(o)?o.filter(t=>typeof t=="string"):[],A=async o=>{try{return await x(o,"utf8")}catch{return}},N=async(o,t)=>{const{parse:n}=await import("./index4.js");try{return n(o)}catch(c){throw new h({cause:c,code:"CONFIG_INVALID",file:t,message:`Failed to parse ${t}: ${c.message}`})}},O=o=>{const t=/^\s*([A-Z0-9](?:[\w.-]*[A-Z0-9])?)\s*(?:\[[^\]]*\])?\s*(.*?)\s*$/i.exec(o);if(!t)return;const n=(t[2]??"").split(";")[0].trim();return{name:t[1],specifier:n}},G=async o=>{const{claimedDirs:t,cwd:n}=o,c=g(n,"pyproject.toml"),w=await A(c);if(w===void 0)return[];const f=await N(w,c),u=new Set;f.project&&u.add(n);const b=d(f.tool?.uv?.workspace?.exclude);for(const e of d(f.tool?.uv?.workspace?.members))for(const s of await M(n,e)){const a=s.slice(n.length+1).split("\\").join("/");b.some(i=>D(i,a))||u.add(C(s))}const v=[],R=new Set([...t].map(e=>j(e)));for(const e of[...u].sort()){if(V(j(e),R))continue;const s=g(e,"pyproject.toml"),a=await A(s);if(a===void 0)continue;const i=await N(a,s);if(!i.project)continue;const{dynamic:y,name:r,version:p}=i.project;if(typeof r!="string"||r==="")throw new h({code:"CONFIG_INVALID",file:s,message:`${s} has no [project].name.`});if(typeof p!="string"){const m=d(y).includes("version")?"a dynamic version":"no [project].version";throw new h({code:"CONFIG_INVALID",file:s,message:`${s} has ${m}; vis can only release a literal version. Pin it in pyproject.toml or leave the project out of release.python.`})}v.push({dir:e,doc:i,manifestPath:s,name:r,private:d(i.project.classifiers).includes(z),version:p})}const q=new Map(v.map(e=>[I(e.name),e.name]));return v.map(e=>{const s={},a=e.doc.tool?.uv?.sources??{};for(const y of d(e.doc.project?.dependencies)){const r=O(y);if(!r)continue;const p=I(r.name),m=a[r.name]??a[p],_=q.get(p);_!==void 0&&typeof m=="object"&&m!==null&&m.workspace===!0&&(s[_]=r.specifier===""?"*":r.specifier)}const i={dependencies:s,name:e.name,private:e.private,version:e.version};return{dir:e.dir,ecosystem:"python",manifest:i,manifestPath:e.manifestPath,name:e.name,private:e.private,version:e.version}})};export{G as discoverPythonProjects,I as normalizePythonName,N as parsePyproject,O as splitRequirement};
+import{createRequire as F}from"node:module";import D from"./index.js";import{VisReleaseError as h}from"../packem_shared/VisReleaseError-DZtgcKf8.js";import{c as j}from"./cargo-lock.js";import{e as M,a as V}from"./index3.js";let L;const $=o=>(L??=F(import.meta.url))(o),l=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,P=o=>{if(typeof l<"u"&&l.versions&&l.versions.node){const[t,n]=l.versions.node.split(".").map(Number);if(t>22||t===22&&n>=3||t===20&&n>=16)return l.getBuiltinModule(o)}return $(o)},{readFile:x}=P("node:fs/promises"),{join:g,resolve:C}=P("node:path"),z="Private :: Do Not Upload",I=o=>o.toLowerCase().replaceAll(/[-_.]+/g,"-"),d=o=>Array.isArray(o)?o.filter(t=>typeof t=="string"):[],A=async o=>{try{return await x(o,"utf8")}catch{return}},N=async(o,t)=>{const{parse:n}=await import("./index4.js");try{return n(o)}catch(c){throw new h({cause:c,code:"CONFIG_INVALID",file:t,message:`Failed to parse ${t}: ${c.message}`})}},O=o=>{const t=/^\s*([A-Z0-9](?:[\w.-]*[A-Z0-9])?)\s*(?:\[[^\]]*\])?\s*(.*?)\s*$/i.exec(o);if(!t)return;const n=(t[2]??"").split(";")[0].trim();return{name:t[1],specifier:n}},B=async o=>{const{claimedDirs:t,cwd:n}=o,c=g(n,"pyproject.toml"),w=await A(c);if(w===void 0)return[];const f=await N(w,c),u=new Set;f.project&&u.add(n);const b=d(f.tool?.uv?.workspace?.exclude);for(const e of d(f.tool?.uv?.workspace?.members))for(const s of await M(n,e)){const a=s.slice(n.length+1).split("\\").join("/");b.some(i=>D(i,a))||u.add(C(s))}const v=[],R=new Set([...t].map(e=>j(e)));for(const e of[...u].sort()){if(V(j(e),R))continue;const s=g(e,"pyproject.toml"),a=await A(s);if(a===void 0)continue;const i=await N(a,s);if(!i.project)continue;const{dynamic:y,name:r,version:p}=i.project;if(typeof r!="string"||r==="")throw new h({code:"CONFIG_INVALID",file:s,message:`${s} has no [project].name.`});if(typeof p!="string"){const m=d(y).includes("version")?"a dynamic version":"no [project].version";throw new h({code:"CONFIG_INVALID",file:s,message:`${s} has ${m}; vis can only release a literal version. Pin it in pyproject.toml or leave the project out of release.python.`})}v.push({dir:e,doc:i,manifestPath:s,name:r,private:d(i.project.classifiers).includes(z),version:p})}const q=new Map(v.map(e=>[I(e.name),e.name]));return v.map(e=>{const s={},a=e.doc.tool?.uv?.sources??{};for(const y of d(e.doc.project?.dependencies)){const r=O(y);if(!r)continue;const p=I(r.name),m=a[r.name]??a[p],_=q.get(p);_!==void 0&&typeof m=="object"&&m!==null&&m.workspace===!0&&(s[_]=r.specifier===""?"*":r.specifier)}const i={dependencies:s,name:e.name,private:e.private,version:e.version};return{dir:e.dir,ecosystem:"python",manifest:i,manifestPath:e.manifestPath,name:e.name,private:e.private,version:e.version}})};export{B as discoverPythonProjects,I as normalizePythonName,N as parsePyproject,O as splitRequirement};

package/dist/packem_chunks/python.js

@@ -0,0 +1 @@
+import{createRequire as N}from"node:module";import{VisReleaseError as d}from"../packem_shared/VisReleaseError-DZtgcKf8.js";import{VersionActions as V}from"../packem_shared/AfterAllProjectsVersioned-CAKI2nWf.js";let U;const S=t=>(U??=N(import.meta.url))(t),y=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,k=t=>{if(typeof y<"u"&&y.versions&&y.versions.node){const[e,r]=y.versions.node.split(".").map(Number);if(e>22||e===22&&r>=3||e===20&&r>=16)return y.getBuiltinModule(t)}return S(t)},{readFile:P}=k("node:fs/promises"),{dirname:_,join:l}=k("node:path"),{fileURLToPath:R}=k("node:url"),T="ACTIONS_ID_TOKEN_REQUEST_URL",L=t=>{const e=!!t.env[T],r=!!t.env[t.staticTokenVar],n=t.workspaceConfig?.publish?.preferStaticToken===!0;return e&&!(n&&r)?"oidc":r?"token":"missing"};let f;const W="https://github.com/visulima/visulima",D=async()=>{try{let e=_(R(import.meta.url));for(let r=0;r<6;r+=1){const n=l(e,"package.json");try{const i=await P(n,"utf8"),a=JSON.parse(i);if(a.name==="@visulima/vis"&&typeof a.version=="string")return a.version}catch{}const s=_(e);if(s===e)break;e=s}}catch{}return"unknown"},M=async()=>(f!==void 0||(f=`vis-release/${await D()} (+${W})`),f),j=new Map,O=async t=>{const e=j.get(t);if(e!==void 0)return e;try{const r=await import("./index6.js").then(s=>s.i),n=new r.ProxyAgent(t);return j.set(t,n),n}catch{return}},F=t=>t===301||t===302||t===303||t===307||t===308,B=(t,e)=>{try{const r=new URL(t),n=new URL(e);return r.host===n.host&&r.protocol===n.protocol}catch{return!1}},q=async(t,e={})=>{const r=e.maxRedirects??2,s={"User-Agent":await M(),...e.headers};e.headers?.["User-Agent"]&&(s["User-Agent"]=e.headers["User-Agent"]);let i=t,a=0;const c=e.httpProxy?await O(e.httpProxy):void 0;for(;;){let u;try{const m=e.fetchImpl??globalThis.fetch,h={headers:s,method:e.method??"GET",redirect:"manual"};c&&(h.dispatcher=c),u=await m(i,h)}catch{return{json:async()=>{},ok:!1,status:0,text:async()=>""}}if(!F(u.status))return{json:async()=>{try{return await u.json()}catch{return}},ok:u.ok,status:u.status,text:async()=>{try{return await u.text()}catch{return""}}};const o=u.headers.get("location")??u.headers.get("Location");if(!o||a>=r)return{json:async()=>{},ok:!1,status:0,text:async()=>""};let p;try{p=new URL(o,i).toString()}catch{return{json:async()=>{},ok:!1,status:0,text:async()=>""}}if(!B(t,p))return{json:async()=>{},ok:!1,status:0,text:async()=>""};i=p,a+=1}},I=t=>`https://pypi.org/pypi/${encodeURIComponent(t.toLowerCase())}/json`,H=(t,e)=>e?.uvLockPath?l(t.dir,e.uvLockPath):l(t.dir,"uv.lock"),G=async(t,e)=>{let r;try{r=await g(t)}catch{return"no-root-pyproject"}if(r===void 0)return"no-root-pyproject";const n=r.tool?.uv?.workspace?.members;if(!Array.isArray(n)||n.length===0)return"no-workspace";const s=e.replace(/^\.\//,"").replaceAll("\\","/");for(const i of n){if(typeof i!="string")continue;const a=i.replace(/^\.\//,"").replaceAll("\\","/");if(a===s)return"member";if(a.endsWith("/*")){const c=a.slice(0,-2);if(s.startsWith(`${c}/`)&&!s.slice(c.length+1).includes("/"))return"member"}if(a.endsWith("/**")){const c=a.slice(0,-3);if(s===c||s.startsWith(`${c}/`))return"member"}}return"missing"},g=async t=>{const e=l(t,"pyproject.toml");let r;try{r=await P(e,"utf8")}catch(s){const{code:i}=s;if(i==="ENOENT")return;throw new d({cause:s,code:"BUMP_FILE_INVALID",file:e,message:`Failed to read ${e}: ${s.message}`})}const{parse:n}=await import("./index4.js");try{return n(r)}catch(s){throw new d({cause:s,code:"BUMP_FILE_INVALID",file:e,message:`Failed to parse ${e}: ${s.message}`})}},A=async(t,e)=>{try{return(await t.run("uv",["--version"],{cwd:e,silent:!0})).exitCode===0}catch{return!1}},$=t=>{const e=t?.["build-system"]?.["build-backend"];return e?e.startsWith("hatchling")?"hatch":e.startsWith("poetry.core")||e.startsWith("poetry_core")?"poetry":e.startsWith("pdm.backend")||e.startsWith("pdm_backend")?"pdm":e.startsWith("setuptools")?"setuptools":e.startsWith("uv_build")||e.startsWith("uv.build")?"uv":"unknown":"unknown"},C=(t,e)=>t==="uv"||t==="unknown"&&e?{backend:t,buildCommand:{args:["build"],binary:"uv"},hasUv:e,publishCommand:{args:["publish"],binary:"uv"}}:{backend:t,buildCommand:{args:["-m","build"],binary:"python"},hasUv:e,publishCommand:{args:["upload","dist/*"],binary:"twine"}},E=(t,e)=>L({env:t,staticTokenVar:"TWINE_PASSWORD",workspaceConfig:e}),v=async(t,e)=>{try{const r=await q(I(t),{headers:{Accept:"application/json"},httpProxy:e});return r.status===404||!r.ok?void 0:(await r.json())?.info?.version}catch{return}},w=(t,e)=>e?.pythonProjectDir?l(t.dir,e.pythonProjectDir):t.dir;class J extends V{id="python";async readPublishedVersion(e){const r=w(e.pkg,e.perPackageConfig),s=(await g(r).catch(()=>{}))?.project?.name??e.pkg.name.replace(/^@[^/]+\//,"");return v(s)}async publish(e){if(e.dryRun)return{output:`[dry-run / python] would publish ${e.pkg.name}@${e.release.newVersion}`,published:!0};const r=e.perPackageConfig??{},n=w(e.pkg,r),s=await g(n);if(s?.project?.dynamic?.includes("version"))throw new d({code:"CONFIG_INVALID",file:l(n,"pyproject.toml"),hint:"Dynamic versioning isn't supported by PythonVersionActions yet; use versionActions: 'shell' with your build backend's version-bump tool (e.g. `hatch version` or `poetry version` for non-vcs setups).",message:`${e.pkg.name}: pyproject.toml declares dynamic = ["version", ...]; PythonVersionActions requires a static [project] version.`,packageName:e.pkg.name});if(s?.project?.version&&s.project.version!==e.release.newVersion)throw new d({code:"BUMP_FILE_INVALID",file:l(n,"pyproject.toml"),hint:`Ensure the pyproject() preset is wired up for this package so the version literal in [project] is bumped before publish. Expected ${e.release.newVersion}, found ${s.project.version}.`,message:`${e.pkg.name}: pyproject.toml version ${s.project.version} differs from planned ${e.release.newVersion}.`,packageName:e.pkg.name});const i=s?.project?.name??e.pkg.name.replace(/^@[^/]+\//,"");if(await v(i,e.workspaceConfig?.httpProxy)===e.release.newVersion)return{alreadyPublished:!0,output:`[python] ${i}@${e.release.newVersion} already on PyPI`,published:!1};const c=await A(e.pm.runner,e.pkg.dir),u=$(s),o=C(u,c),p=E(process.env,e.workspaceConfig);if(p==="missing")throw new d({code:"AUTH_MISSING",hint:["Set TWINE_PASSWORD to a PyPI API token (`TWINE_USERNAME=__token__` is injected automatically), OR","configure trusted publishing on PyPI and grant the workflow `permissions: id-token: write` so ACTIONS_ID_TOKEN_REQUEST_URL is exposed.","See https://docs.pypi.org/trusted-publishers/"].join(" "),message:`${e.pkg.name}: no PyPI credentials detected (neither TWINE_PASSWORD nor OIDC trusted-publishing env).`,packageName:e.pkg.name});const m=await e.pm.runner.run(o.buildCommand.binary,o.buildCommand.args,{cwd:n,silent:!1});if(m.exitCode!==0)throw new d({code:"PUBLISH_FAILED",hint:`Inspect the ${o.buildCommand.binary} ${o.buildCommand.args.join(" ")} output above. Common causes: missing ${o.backend==="uv"?"uv":"build/setuptools/wheel"} dependency, broken pyproject.toml, source files missing from \`include\`.`,message:`${e.pkg.name}: build failed (${o.buildCommand.binary} ${o.buildCommand.args.join(" ")}): exit ${m.exitCode}. stderr: ${m.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});const h={...process.env};p==="token"&&!h.TWINE_USERNAME&&(h.TWINE_USERNAME="__token__");const b=await e.pm.runner.run(o.publishCommand.binary,o.publishCommand.args,{cwd:n,env:h,silent:!1});if(b.exitCode!==0)throw new d({code:"PUBLISH_FAILED",hint:`Inspect the ${o.publishCommand.binary} output above. Common causes: invalid API token, version already published (this should have been caught by readPublishedVersion — file a vis bug), 2FA required without a token.`,message:`${e.pkg.name}: publish failed (${o.publishCommand.binary} ${o.publishCommand.args.join(" ")}): exit ${b.exitCode}. stderr: ${b.stderr.trim().slice(0,500)}`,packageName:e.pkg.name});return{output:`[python/${o.backend}${o.hasUv?"+uv":""}] published ${i}@${e.release.newVersion}`,published:!0}}}const Y=Object.defineProperty({__proto__:null,PYPI_PROJECT_URL:I,PythonVersionActions:J,checkUvWorkspaceMembership:G,detectAuthMode:E,detectBackend:$,detectUv:A,fetchPyPiVersion:v,readPyProject:g,resolveBuildEnv:C,resolveProjectDir:w,resolveUvLockPath:H},Symbol.toStringTag,{value:"Module"});export{J as P,Y as p,L as r,q as s};

package/dist/packem_chunks/run.js

@@ -1 +1 @@
-import{p as s,f as a,g as p}from"./cli-main.js";const f=({options:t,visConfig:i,workspaceRoot:c})=>{const r=c??process.cwd(),l=i?.security?.policies?.installScripts?.allow??{},e=Object.entries(l).filter(([,o])=>o).map(([o])=>o);e.length===0&&!t.rootOnly&&(s.warn("No approved packages in security.policies.installScripts.allow — nothing to run."),!t.withRoot)||(t.rootOnly||a(r,e),(t.withRoot||t.rootOnly)&&p(r))};export{f as default};
+import{p as s,d as a,f as p}from"./cli-main.js";const f=({options:t,visConfig:i,workspaceRoot:c})=>{const r=c??process.cwd(),l=i?.security?.policies?.installScripts?.allow??{},e=Object.entries(l).filter(([,o])=>o).map(([o])=>o);e.length===0&&!t.rootOnly&&(s.warn("No approved packages in security.policies.installScripts.allow — nothing to run."),!t.withRoot)||(t.rootOnly||a(r,e),(t.withRoot||t.rootOnly)&&p(r))};export{f as default};

package/dist/packem_chunks/snapshot.js

@@ -1,2 +1,2 @@
-import{createRequire as O}from"node:module";import{DEFAULT_CHANGES_DIR as Y}from"./DEFAULT_CLEAN_KEEP.js";import{p as $,r as z,c as G,a as Q}from"./index2.js";import{getCurrentSha as X,getShortSha as Z}from"./git.js";import{N as ee}from"./index3.js";let U;const V=s=>(U??=O(import.meta.url))(s),g=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,K=s=>{if(typeof g<"u"&&g.versions&&g.versions.node){const[e,n]=g.versions.node.split(".").map(Number);if(e>22||e===22&&n>=3||e===20&&n>=16)return g.getBuiltinModule(s)}return V(s)},{readFile:W,writeFile:C}=K("node:fs/promises"),te=(s,e)=>s.replaceAll("{tag}",e.tag).replaceAll("{sha}",e.sha).replaceAll("{shortSha}",e.shortSha).replaceAll("{branch}",e.branch??"").replaceAll("{pr}",e.pr??"").replaceAll("{timestamp}",e.timestamp),le=async s=>{const{context:e,dryRun:n=!1,registry:w,tag:o}=s,{createShellRunner:c}=await import("./shell-runner.js"),r=s.runner??c(),l=await X({cwd:e.cwd,runner:r}),i=await Z({cwd:e.cwd,runner:r});if(!l||!i)throw new Error("Could not resolve git HEAD. Snapshot requires a git workspace.");const b=e.config.snapshot?.versionTemplate??"0.0.0-{tag}-{shortSha}",S=new Date().toISOString().replaceAll(/[:.]/g,"").slice(0,14),d=e.config.snapshot?.tags??[],p=await r.run("git",["rev-parse","--abbrev-ref","HEAD"],{cwd:e.cwd,silent:!0}).then(t=>t.exitCode===0?t.stdout.trim():void 0).catch(()=>{}),A=process.env.VIS_PR_NUMBER??process.env.PR_NUMBER,D=[o];for(const t of d){let a;switch(t){case"branch":{a=p&&p!=="HEAD"?p:void 0;break}case"pr":{a=A?`pr-${A}`:void 0;break}case"sha":{a=l;break}case"short-sha":{a=i;break}default:a=void 0}a&&a!==o&&!D.includes(a)&&D.push(a)}let m=e.packages;if(s.filter){const{default:t}=await import("./index.js"),a=s.filter.split(",").map(h=>h.trim()).filter(Boolean);m=m.filter(h=>a.some(_=>h.name===_||t(_,h.name)))}m=m.filter(t=>!t.private);const f=te(b,{branch:p&&p!=="HEAD"?p:void 0,pr:A,sha:l,shortSha:i,tag:o,timestamp:S}),N=new Map;for(const t of m)N.set(t.name,{...t.manifest,version:f});const q=$(await e.pm.readCatalogYaml(e.cwd)),x=new ee(r),k=[],u=[],v=[],P=e.config.changesDir??Y,{acquireLock:F,releaseLock:M}=await import("./state.js");let j=!1;if(!n)try{await F(e.cwd,P),j=!0}catch(t){return v.push({name:"_lock",reason:t.message}),{failed:v,published:k,skipped:u,snapshotVersion:f,tag:o}}try{for(const t of m){if(t.ecosystem!==void 0){u.push({name:t.name,reason:"non-npm-packages-have-no-snapshot"});continue}const a=ae(t,N),h=z(a,q),_=G(h,e.config.publish?.cleanPackageJson);if(n){k.push({name:t.name,version:f});continue}let R;try{R=await W(t.manifestPath,"utf8"),await C(t.manifestPath,`${JSON.stringify(_,null,4)}
-`);const{mkdtempSync:E}=await import("node:fs"),{tmpdir:T}=await import("node:os"),{join:B}=await import("node:path"),H=E(B(T(),"vis-snapshot-")),I=await e.pm.pack({cwd:t.dir,destination:H});let y;for(const L of D){const J=await x.publish({access:"public",extraArgs:["--no-git-checks"],registry:w,tag:L,tarball:I.tarball});y??=J}y?.published?k.push({name:t.name,version:f}):y?.alreadyPublished?u.push({name:t.name,reason:"already-published"}):u.push({name:t.name,reason:y?.output??"unknown"})}catch(E){v.push({name:t.name,reason:E.message})}finally{if(R!==void 0)try{await C(t.manifestPath,R)}catch{}}}}finally{j&&await M(e.cwd,P)}return{failed:v,published:k,skipped:u,snapshotVersion:f,tag:o}},se=["dependencies","devDependencies","peerDependencies","optionalDependencies"],ae=(s,e)=>{const n=e.get(s.name)??s.manifest,w={...n};for(const o of se){const c=n[o];if(!c||typeof c!="object")continue;const r={...c};for(const[l,i]of Object.entries(c)){const b=e.get(l);if(b&&i.startsWith("workspace:")){const S=i.slice(10),d=Q(S==="*"?"*":i,b.version);r[l]=d.startsWith("workspace:")?d.slice(10):d}}w[o]=r}return w};export{le as runSnapshot};
+import{createRequire as F}from"node:module";import{DEFAULT_CHANGES_DIR as B}from"./DEFAULT_CLEAN_KEEP.js";import{r as H}from"../packem_shared/apply-release-plan-BalHtK-g.js";import{parseCatalogs as I,rewriteCatalogRefs as L}from"./catalog.js";import{c as O}from"../packem_shared/clean-package-json-rutwkKl-.js";import{getCurrentSha as U,getShortSha as J}from"./git.js";import{N as V}from"./index2.js";let j;const x=t=>(j??=F(import.meta.url))(t),m=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,M=t=>{if(typeof m<"u"&&m.versions&&m.versions.node){const[e,n]=m.versions.node.split(".").map(Number);if(e>22||e===22&&n>=3||e===20&&n>=16)return m.getBuiltinModule(t)}return x(t)},{readFile:q,writeFile:A}=M("node:fs/promises"),W=(t,e)=>t.replaceAll("{tag}",e.tag).replaceAll("{sha}",e.sha).replaceAll("{shortSha}",e.shortSha).replaceAll("{branch}",e.branch??"").replaceAll("{pr}",e.pr??"").replaceAll("{timestamp}",e.timestamp),Y=(t,e)=>{switch(t){case"branch":return e.branch&&e.branch!=="HEAD"?e.branch:void 0;case"pr":return e.prFromEnv?`pr-${e.prFromEnv}`:void 0;case"sha":return e.sha;case"short-sha":return e.shortSha;default:return}},$=(t,e,n)=>{const s=[t];for(const o of e){const a=Y(o,n);a&&a!==t&&!s.includes(a)&&s.push(a)}return s},z=async(t,e)=>{let n=[...t];if(e){const{default:s}=await import("./index.js"),o=e.split(",").map(a=>a.trim()).filter(Boolean);n=n.filter(a=>o.some(i=>a.name===i||s(i,a.name)))}return n.filter(s=>!s.private)},G=async(t,e)=>{let n;for(const s of e.tags){const o=await e.npmCli.publish({access:"public",extraArgs:["--no-git-checks"],registry:e.registry,tag:s,tarball:t});n??=o}return n},K=t=>t?.published?{kind:"published"}:t?.alreadyPublished?{kind:"skipped",reason:"already-published"}:{kind:"skipped",reason:t?.output??"unknown"},Q=async(t,e,n)=>{let s;try{s=await q(t.manifestPath,"utf8"),await A(t.manifestPath,`${JSON.stringify(e,null,4)}
+`);const{mkdtempSync:o}=await import("node:fs"),{tmpdir:a}=await import("node:os"),{join:i}=await import("node:path"),l=o(i(a(),"vis-snapshot-")),c=await n.ctx.pm.pack({cwd:t.dir,destination:l});return K(await G(c.tarball,n))}catch(o){return{kind:"failed",reason:o.message}}finally{if(s!==void 0)try{await A(t.manifestPath,s)}catch{}}},X=(t,e)=>{const n=ee(t,e.versionedByName),s=L(n,e.catalogs);return O(s,e.ctx.config.publish?.cleanPackageJson)},ce=async t=>{const{context:e,dryRun:n=!1,registry:s,tag:o}=t,{createShellRunner:a}=await import("./shell-runner.js"),i=t.runner??a(),l=await U({cwd:e.cwd,runner:i}),c=await J({cwd:e.cwd,runner:i});if(!l||!c)throw new Error("Could not resolve git HEAD. Snapshot requires a git workspace.");const u=e.config.snapshot?.versionTemplate??"0.0.0-{tag}-{shortSha}",b=new Date().toISOString().replaceAll(/[:.]/g,"").slice(0,14),p=await i.run("git",["rev-parse","--abbrev-ref","HEAD"],{cwd:e.cwd,silent:!0}).then(r=>r.exitCode===0?r.stdout.trim():void 0).catch(()=>{}),k=process.env.VIS_PR_NUMBER??process.env.PR_NUMBER,D=p&&p!=="HEAD"?p:void 0,E=$(o,e.config.snapshot?.tags??[],{branch:p,prFromEnv:k,sha:l,shortSha:c}),v=await z(e.packages,t.filter),h=W(u,{branch:D,pr:k,sha:l,shortSha:c,tag:o,timestamp:b}),y=new Map;for(const r of v)y.set(r.name,{...r.manifest,version:h});const R=I(await e.pm.readCatalogYaml(e.cwd)),N={ctx:e,npmCli:new V(i),registry:s,tags:E},d=[],f=[],g=[],S=e.config.changesDir??B,{acquireLock:P,releaseLock:T}=await import("./state.js");let _=!1;if(!n)try{await P(e.cwd,S),_=!0}catch(r){return g.push({name:"_lock",reason:r.message}),{failed:g,published:d,skipped:f,snapshotVersion:h,tag:o}}try{for(const r of v){if(r.ecosystem!==void 0){f.push({name:r.name,reason:"non-npm-packages-have-no-snapshot"});continue}const C=X(r,{catalogs:R,ctx:e,versionedByName:y});if(n){d.push({name:r.name,version:h});continue}const w=await Q(r,C,N);w.kind==="published"?d.push({name:r.name,version:h}):w.kind==="skipped"?f.push({name:r.name,reason:w.reason}):g.push({name:r.name,reason:w.reason})}}finally{_&&await T(e.cwd,S)}return{failed:g,published:d,skipped:f,snapshotVersion:h,tag:o}},Z=["dependencies","devDependencies","peerDependencies","optionalDependencies"],ee=(t,e)=>{const n=e.get(t.name)??t.manifest,s={...n};for(const o of Z){const a=n[o];if(!a||typeof a!="object")continue;const i={...a};for(const[l,c]of Object.entries(a)){const u=e.get(l);if(u&&c.startsWith("workspace:")){const b=c.slice(10),p=H(b==="*"?"*":c,u.version);i[l]=p.startsWith("workspace:")?p.slice(10):p}}s[o]=i}return s};export{ce as runSnapshot};

package/dist/packem_chunks/state.js

@@ -1,3 +1,3 @@
-import{createRequire as S}from"node:module";import{VisReleaseError as i}from"../packem_shared/VisReleaseError-DZtgcKf8.js";let g;const O=e=>(g??=S(import.meta.url))(e),c=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,u=e=>{if(typeof c<"u"&&c.versions&&c.versions.node){const[t,s]=c.versions.node.split(".").map(Number);if(t>22||t===22&&s>=3||t===20&&s>=16)return c.getBuiltinModule(e)}return O(e)},{constants:d}=u("node:fs"),{mkdir:w,readFile:m,unlink:f,writeFile:R,open:L}=u("node:fs/promises"),{platform:A,hostname:p}=u("node:os"),{dirname:_,join:y}=u("node:path"),$=".state.json",v="publish-lock.json",l=(e,t,s=!1)=>y(e,t,s?v:$),j=async(e,t,s=!1)=>{try{const a=await m(l(e,t,s),"utf8"),r=JSON.parse(a);if(r.version!==1)throw new i({code:"STATE_FILE_CORRUPT",message:`Unknown state file version: ${r.version}. Delete ${l(e,t,s)} to start fresh.`});return r}catch(a){if(a.code==="ENOENT")return;throw a instanceof i?a:new i({cause:a,code:"STATE_FILE_CORRUPT",message:`Failed to read state file: ${a.message}`})}},q=async(e,t,s,a=!1)=>{const r=l(e,t,a);await w(_(r),{recursive:!0}),await R(r,`${JSON.stringify(s,null,2)}
+import{createRequire as S}from"node:module";import{VisReleaseError as i}from"../packem_shared/VisReleaseError-DZtgcKf8.js";let g;const O=e=>(g??=S(import.meta.url))(e),c=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,u=e=>{if(typeof c<"u"&&c.versions&&c.versions.node){const[t,s]=c.versions.node.split(".").map(Number);if(t>22||t===22&&s>=3||t===20&&s>=16)return c.getBuiltinModule(e)}return O(e)},{constants:d}=u("node:fs"),{mkdir:w,readFile:m,unlink:f,open:R,writeFile:L}=u("node:fs/promises"),{platform:A,hostname:p}=u("node:os"),{dirname:_,join:y}=u("node:path"),$=".state.json",v="publish-lock.json",l=(e,t,s=!1)=>y(e,t,s?v:$),j=async(e,t,s=!1)=>{try{const a=await m(l(e,t,s),"utf8"),r=JSON.parse(a);if(r.version!==1)throw new i({code:"STATE_FILE_CORRUPT",message:`Unknown state file version: ${r.version}. Delete ${l(e,t,s)} to start fresh.`});return r}catch(a){if(a.code==="ENOENT")return;throw a instanceof i?a:new i({cause:a,code:"STATE_FILE_CORRUPT",message:`Failed to read state file: ${a.message}`})}},q=async(e,t,s,a=!1)=>{const r=l(e,t,a);await w(_(r),{recursive:!0}),await L(r,`${JSON.stringify(s,null,2)}
 `)},I=async(e,t,s=!1)=>{try{await f(l(e,t,s))}catch(a){if(a.code!=="ENOENT")throw new i({cause:a,code:"STATE_FILE_CORRUPT",message:`Could not clear state file at ${l(e,t,s)}: ${a.message}. Remove it manually before the next run.`})}},M=(e,t)=>({applied:[],channel:e,notified:[],plan:[...t],published:[],pushed:!1,startedAt:new Date().toISOString(),tagged:[],version:1,walked:[]}),U=(e,t)=>{const s=new Set(t.published);return e.filter(a=>!s.has(`${a.name}@${a.newVersion}`))},C=3600*1e3,T=(e,t)=>y(e,t,".lock"),F=e=>{try{return process.kill(e,0),!0}catch{return!1}},D=async(e,t)=>{const s=T(e,t);await w(_(s),{recursive:!0});const a={acquiredAt:new Date().toISOString(),hostname:p(),pid:process.pid,platform:A()},r=`${JSON.stringify(a,null,2)}
-`,h=async()=>{try{const n=await L(s,d.O_WRONLY|d.O_CREAT|d.O_EXCL,384);try{await n.writeFile(r)}finally{await n.close()}return!0}catch(n){if(n.code==="EEXIST")return!1;throw n}};if(await h())return s;let o;try{o=JSON.parse(await m(s,"utf8"))}catch{}if(o){const n=Date.now()-new Date(o.acquiredAt).getTime();if((!o.hostname||o.hostname===p())&&F(o.pid)&&n<C){const E=o.hostname?`${o.hostname}:${o.pid}`:`PID ${o.pid}`;throw new i({code:"STATE_FILE_CORRUPT",message:`Release lock held by ${E} (acquired ${Math.round(n/1e3)}s ago). Wait for the other run, or remove ${s} if you're sure it's stale.`})}}try{await f(s)}catch{}if(await h())return s;throw new i({code:"STATE_FILE_CORRUPT",message:`Could not acquire release lock at ${s} after clearing a stale entry. Another process took it. Retry in a few seconds.`})},J=async(e,t)=>{try{await f(T(e,t))}catch{}};export{D as acquireLock,I as clearState,U as filterPlanByState,T as lockFilePath,M as newState,j as readState,J as releaseLock,l as stateFilePath,q as writeState};
+`,h=async()=>{try{const n=await R(s,d.O_WRONLY|d.O_CREAT|d.O_EXCL,384);try{await n.writeFile(r)}finally{await n.close()}return!0}catch(n){if(n.code==="EEXIST")return!1;throw n}};if(await h())return s;let o;try{o=JSON.parse(await m(s,"utf8"))}catch{}if(o){const n=Date.now()-new Date(o.acquiredAt).getTime();if((!o.hostname||o.hostname===p())&&F(o.pid)&&n<C){const E=o.hostname?`${o.hostname}:${o.pid}`:`PID ${o.pid}`;throw new i({code:"STATE_FILE_CORRUPT",message:`Release lock held by ${E} (acquired ${Math.round(n/1e3)}s ago). Wait for the other run, or remove ${s} if you're sure it's stale.`})}}try{await f(s)}catch{}if(await h())return s;throw new i({code:"STATE_FILE_CORRUPT",message:`Could not acquire release lock at ${s} after clearing a stale entry. Another process took it. Retry in a few seconds.`})},J=async(e,t)=>{try{await f(T(e,t))}catch{}};export{D as acquireLock,I as clearState,U as filterPlanByState,T as lockFilePath,M as newState,j as readState,J as releaseLock,l as stateFilePath,q as writeState};

package/dist/packem_chunks/status.js

@@ -1,2 +1,2 @@
-import{b as d,F as i,J as l}from"../packem_shared/index.server-Ca_EEVfw.js";import{p as a}from"./cli-main.js";import{r as y,g}from"./catalog.js";const h=n=>{if(n===0)return"0 B";const r=["B","KB","MB","GB"],o=Math.min(Math.floor(Math.log(n)/Math.log(1024)),r.length-1),s=n/1024**o;return`${s.toFixed(s<10&&o>0?1:0)} ${r[o]}`},v=n=>{if(!n)return"never";const r=Date.parse(n);if(Number.isNaN(r))return n;const o=Date.now()-r;if(o<0)return n;const s=Math.floor(o/6e4);if(s<1)return"just now";if(s<60)return`${s}m ago`;const t=Math.floor(s/60);return t<24?`${t}h ago`:`${Math.floor(t/24)}d ago`},$=async({logger:n,options:r,workspaceRoot:o})=>{if(!o)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const s=r.db??y(o),t=await g(o,s);if(r.format==="json"){process.stdout.write(`${JSON.stringify({dbPath:s,ecosystems:t.ecosystems.map(e=>({advisoryCount:e.advisoryCount,lastSyncIso:e.lastSyncIso,manifestEtag:e.manifestEtag??null,name:e.name})),exists:t.exists,schemaVersion:t.schemaVersion,sizeBytes:t.sizeBytes},void 0,2)}
+import{b as d,F as i,J as l}from"../packem_shared/index.server-Ca_EEVfw.js";import{p as a}from"./cli-main.js";import{r as y,g}from"../packem_shared/advisories-BodWQ5DQ.js";const h=n=>{if(n===0)return"0 B";const r=["B","KB","MB","GB"],o=Math.min(Math.floor(Math.log(n)/Math.log(1024)),r.length-1),s=n/1024**o;return`${s.toFixed(s<10&&o>0?1:0)} ${r[o]}`},v=n=>{if(!n)return"never";const r=Date.parse(n);if(Number.isNaN(r))return n;const o=Date.now()-r;if(o<0)return n;const s=Math.floor(o/6e4);if(s<1)return"just now";if(s<60)return`${s}m ago`;const t=Math.floor(s/60);return t<24?`${t}h ago`:`${Math.floor(t/24)}d ago`},$=async({logger:n,options:r,workspaceRoot:o})=>{if(!o)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const s=r.db??y(o),t=await g(o,s);if(r.format==="json"){process.stdout.write(`${JSON.stringify({dbPath:s,ecosystems:t.ecosystems.map(e=>({advisoryCount:e.advisoryCount,lastSyncIso:e.lastSyncIso,manifestEtag:e.manifestEtag??null,name:e.name})),exists:t.exists,schemaVersion:t.schemaVersion,sizeBytes:t.sizeBytes},void 0,2)}
 `);return}if(a.info(`DB: ${s}`),!t.exists){a.warn(`No advisory DB yet. Run ${d("vis advisories sync")} to populate.`);return}if(a.info(`Schema: v${t.schemaVersion}   Size: ${h(t.sizeBytes)}`),t.ecosystems.length===0){a.warn("DB exists but contains no ecosystems. Run `vis advisories sync`.");return}a.info(""),a.info("Ecosystem    Advisories   Last sync           ETag"),a.info(i("──────────   ──────────   ─────────────────   ──────"));for(const e of t.ecosystems){const c=e.name.padEnd(10),u=e.advisoryCount.toLocaleString().padStart(10),m=`${e.lastSyncIso||"never"} (${v(e.lastSyncIso)})`.padEnd(19),f=e.manifestEtag??i("—");a.info(`${l(c)}   ${u}   ${m}   ${f}`)}},E=$;export{E as advisoriesStatusExecute};

package/dist/packem_chunks/sync.js

@@ -1,3 +1,3 @@
-import{F as v}from"../packem_shared/index.server-Ca_EEVfw.js";import{p as c}from"./cli-main.js";import{s as S}from"../packem_shared/scan-progress-RwCRxJdX.js";import{D as $,s as b,A as D}from"./catalog.js";import{c as w}from"../packem_shared/multi-eco-lockfiles-B2X3yhyo.js";const E=o=>o?.security?.audit?.advisories??{},A=o=>o?o.split(",").map(t=>t.trim()).filter(t=>t.length>0).map(t=>w(t)):["npm"],C=async({logger:o,options:t,visConfig:p,workspaceRoot:d})=>{if(!d)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const l=t.format==="json",u=E(p),m=t.source??u.source??$,f=A(t.ecosystem),y=f.map(s=>({id:s,label:`Sync ${s} advisories`})),n=S(y,{live:!l}),i=[];try{for(const s of f){n.start(s);const e=Date.now();try{const r=await b({allowedHosts:u.allowedHosts,dbPath:t.db,ecosystem:s,force:!!t.force,source:m,workspaceRoot:d});i.push({ecosystem:s,result:r}),r.upToDate?n.finish(s,"ok",`up to date · ${h(Date.now()-e)}`):n.finish(s,"ok",`${r.advisoriesIngested.toLocaleString()} advisories · ${h(r.durationMs)}`)}catch(r){const a=r instanceof Error?r.message:String(r);i.push({ecosystem:s,error:a}),n.finish(s,"error",a)}}}finally{n.stop()}const g=i.find(s=>s.result?.rebuiltFromSchema!==void 0)?.result?.rebuiltFromSchema;if(g!==void 0){const s=`advisory database is schema v${String(g)}; rebuilt to v${String(D)}`;l?process.stderr.write(`${s}
+import{F as v}from"../packem_shared/index.server-Ca_EEVfw.js";import{p as c}from"./cli-main.js";import{s as S}from"../packem_shared/scan-progress-D8ojNcKt.js";import{D as $,s as b,A as D}from"../packem_shared/advisories-BodWQ5DQ.js";import{c as w}from"../packem_shared/multi-eco-lockfiles-CyIfYw4u.js";const E=o=>o?.security?.audit?.advisories??{},A=o=>o?o.split(",").map(t=>t.trim()).filter(t=>t.length>0).map(t=>w(t)):["npm"],C=async({logger:o,options:t,visConfig:p,workspaceRoot:d})=>{if(!d)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const l=t.format==="json",u=E(p),m=t.source??u.source??$,f=A(t.ecosystem),y=f.map(s=>({id:s,label:`Sync ${s} advisories`})),n=S(y,{live:!l}),i=[];try{for(const s of f){n.start(s);const e=Date.now();try{const r=await b({allowedHosts:u.allowedHosts,dbPath:t.db,ecosystem:s,force:!!t.force,source:m,workspaceRoot:d});i.push({ecosystem:s,result:r}),r.upToDate?n.finish(s,"ok",`up to date · ${h(Date.now()-e)}`):n.finish(s,"ok",`${r.advisoriesIngested.toLocaleString()} advisories · ${h(r.durationMs)}`)}catch(r){const a=r instanceof Error?r.message:String(r);i.push({ecosystem:s,error:a}),n.finish(s,"error",a)}}}finally{n.stop()}const g=i.find(s=>s.result?.rebuiltFromSchema!==void 0)?.result?.rebuiltFromSchema;if(g!==void 0){const s=`advisory database is schema v${String(g)}; rebuilt to v${String(D)}`;l?process.stderr.write(`${s}
 `):c.info(s)}if(l){const s={ecosystems:i.map(e=>({advisoriesIngested:e.result?.advisoriesIngested??0,dbPath:e.result?.dbPath??null,durationMs:e.result?.durationMs??0,ecosystem:e.ecosystem,error:e.error??null,upToDate:e.result?.upToDate??!1})),source:m};process.stdout.write(`${JSON.stringify(s,void 0,2)}
 `)}else{const s=i.filter(a=>a.error),e=i.filter(a=>a.result),r=e[0];r?.result?.dbPath&&c.info(v(`DB: ${r.result.dbPath}`)),s.length===0?c.success(`Synced ${e.length} ecosystem${e.length===1?"":"s"}.`):c.error(`${s.length} ecosystem${s.length===1?"":"s"} failed to sync.`)}i.some(s=>s.error)&&(process.exitCode=1)},h=o=>o>=1e3?`${(o/1e3).toFixed(1)}s`:`${Math.round(o)}ms`,M=C;export{M as advisoriesSyncExecute,A as parseEcosystems};

package/dist/packem_chunks/verify-lockfile.js

@@ -1,2 +1,2 @@
-import{p}from"./cli-main.js";import{d as b}from"../packem_shared/pm-runner-RM72mDZg.js";import{r as m,l as w,L as v}from"../packem_shared/dependency-scan-CawAKoU_.js";import{z as S,e as g}from"../packem_shared/index-BzhrR_iC.js";import{S as $}from"../packem_shared/lockfile-DhHAaHN5.js";import{e as x}from"../packem_shared/index-CDHP1kby.js";import{y as C}from"../packem_shared/isAccessibleSync-DYKTrrvc-C-_5cgwu.js";const E=e=>{const o=e.trim();return o===""?!1:/^(?:git\+|git:\/\/|git@|ssh:\/\/)/i.test(o)||/^(?:github|gitlab|bitbucket|gist):/i.test(o)||/^[\w.-]+\/[\w.-]+(?:#.+)?$/.test(o)&&!o.includes("@")?!0:/^https?:\/\//i.test(o)},M=(e,o)=>{for(const i of o)if(i===e||i.endsWith("*")&&e.startsWith(i.slice(0,-1)))return!0;return!1},L=(e,o,i={})=>{const t=m(e,o);if(!t)return[];let s;try{s=S(g(e,t.file))}catch{return[]}const n=$(s,t.type);if(n.length===0)return[];const r=i.allow??[],l=[],f=new Set;for(const c of n){const a=`${c.name}@${c.version}`;for(const d of[c.dependencies,c.optionalDependencies])if(d){for(const[u,h]of Object.entries(d))if(!M(u,r))for(const k of h){if(!E(k))continue;const y=`${a}->${u}@${k}`;f.has(y)||(f.add(y),l.push({declaredBy:a,packageName:u,source:k}))}}}return l.sort((c,a)=>c.packageName.localeCompare(a.packageName)||c.declaredBy.localeCompare(a.declaredBy))},D=new Set(["firstSeen","publisherChange"]),I=e=>e.severity==="block"&&e.acceptedRisk===void 0,N=e=>{const o=e.security?.policies?.firstSeen?.minutes,i=typeof o=="number"&&o>0,t=e.security?.policies?.publisherChange?.mode==="no-downgrade",s=e.security?.blockExoticSubdeps===!0;return i||t||s},O=async e=>{const{offline:o=!1,packageManager:i,visConfig:t,workspaceRoot:s}=e,n=Date.now();if(!N(t))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!1,status:"skipped"};const r=m(s,i);if(!r||!C(g(s,r.file)))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!0,status:"fail"};const l=w(s,i,{includeDev:!0}),f=l.length,c=await x({offline:o,packageManager:i,packages:l,workspaceRoot:s},"install",{enabledPolicies:new Set(D),visConfig:t}),a=t.security?.blockExoticSubdeps===!0?L(s,i,{allow:t.security.exoticSubdepsAllow}):[],d=c.some(u=>I(u))||a.length>0;return{decisions:c,durationMs:Date.now()-n,entryCount:f,exoticViolations:a,lockfileMissing:!1,status:d?"fail":"pass"}},P=e=>e<1e3?`${String(e)}ms`:`${(e/1e3).toFixed(1)}s`,V=e=>{if(e.status==="skipped")return["– Lockfile supply-chain verification skipped (no firstSeen / publisherChange / blockExoticSubdeps policy configured)"];if(e.lockfileMissing)return["✗ Lockfile supply-chain verification failed — no lockfile found, the resolved closure cannot be attested"];const o=`(${String(e.entryCount)} ${e.entryCount===1?"entry":"entries"}, ${P(e.durationMs)})`;if(e.status==="pass")return[`✓ Lockfile passes supply-chain policies ${o}`];const i=[`✗ Lockfile failed supply-chain policy check ${o}`];for(const t of e.decisions)t.severity==="block"&&t.acceptedRisk===void 0&&i.push(`  [${t.policy}] ${t.reason}`);for(const t of e.exoticViolations)i.push(`  [blockExoticSubdeps] ${t.packageName} pulled from exotic source by ${t.declaredBy}: ${t.source}`);return i},z=async({options:e,visConfig:o,workspaceRoot:i})=>{const t=i??process.cwd(),s=b(t);if(!v[s.name]){p.warn(`Package manager '${s.name}' has no lockfile vis can verify.`);return}const n=await O({offline:!!e.offline,packageManager:s.name,visConfig:o??{},workspaceRoot:t});if(e.json){process.stdout.write(`${JSON.stringify(n,void 0,2)}
+import{p}from"./cli-main.js";import{d as b}from"../packem_shared/pm-runner-RM72mDZg.js";import{r as m,l as w,L as v}from"../packem_shared/dependency-scan-DFnt1mni.js";import{z as S,e as g}from"../packem_shared/index-BzhrR_iC.js";import{S as $}from"../packem_shared/lockfile-DhHAaHN5.js";import{e as x}from"../packem_shared/index-CgNfNk12.js";import{y as C}from"../packem_shared/isAccessibleSync-DYKTrrvc-C-_5cgwu.js";const E=e=>{const o=e.trim();return o===""?!1:/^(?:git\+|git:\/\/|git@|ssh:\/\/)/i.test(o)||/^(?:github|gitlab|bitbucket|gist):/i.test(o)||/^[\w.-]+\/[\w.-]+(?:#.+)?$/.test(o)&&!o.includes("@")?!0:/^https?:\/\//i.test(o)},M=(e,o)=>{for(const i of o)if(i===e||i.endsWith("*")&&e.startsWith(i.slice(0,-1)))return!0;return!1},L=(e,o,i={})=>{const t=m(e,o);if(!t)return[];let s;try{s=S(g(e,t.file))}catch{return[]}const n=$(s,t.type);if(n.length===0)return[];const r=i.allow??[],l=[],f=new Set;for(const c of n){const a=`${c.name}@${c.version}`;for(const d of[c.dependencies,c.optionalDependencies])if(d){for(const[u,h]of Object.entries(d))if(!M(u,r))for(const k of h){if(!E(k))continue;const y=`${a}->${u}@${k}`;f.has(y)||(f.add(y),l.push({declaredBy:a,packageName:u,source:k}))}}}return l.sort((c,a)=>c.packageName.localeCompare(a.packageName)||c.declaredBy.localeCompare(a.declaredBy))},D=new Set(["firstSeen","publisherChange"]),I=e=>e.severity==="block"&&e.acceptedRisk===void 0,N=e=>{const o=e.security?.policies?.firstSeen?.minutes,i=typeof o=="number"&&o>0,t=e.security?.policies?.publisherChange?.mode==="no-downgrade",s=e.security?.blockExoticSubdeps===!0;return i||t||s},O=async e=>{const{offline:o=!1,packageManager:i,visConfig:t,workspaceRoot:s}=e,n=Date.now();if(!N(t))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!1,status:"skipped"};const r=m(s,i);if(!r||!C(g(s,r.file)))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!0,status:"fail"};const l=w(s,i,{includeDev:!0}),f=l.length,c=await x({offline:o,packageManager:i,packages:l,workspaceRoot:s},"install",{enabledPolicies:new Set(D),visConfig:t}),a=t.security?.blockExoticSubdeps===!0?L(s,i,{allow:t.security.exoticSubdepsAllow}):[],d=c.some(u=>I(u))||a.length>0;return{decisions:c,durationMs:Date.now()-n,entryCount:f,exoticViolations:a,lockfileMissing:!1,status:d?"fail":"pass"}},P=e=>e<1e3?`${String(e)}ms`:`${(e/1e3).toFixed(1)}s`,V=e=>{if(e.status==="skipped")return["– Lockfile supply-chain verification skipped (no firstSeen / publisherChange / blockExoticSubdeps policy configured)"];if(e.lockfileMissing)return["✗ Lockfile supply-chain verification failed — no lockfile found, the resolved closure cannot be attested"];const o=`(${String(e.entryCount)} ${e.entryCount===1?"entry":"entries"}, ${P(e.durationMs)})`;if(e.status==="pass")return[`✓ Lockfile passes supply-chain policies ${o}`];const i=[`✗ Lockfile failed supply-chain policy check ${o}`];for(const t of e.decisions)t.severity==="block"&&t.acceptedRisk===void 0&&i.push(`  [${t.policy}] ${t.reason}`);for(const t of e.exoticViolations)i.push(`  [blockExoticSubdeps] ${t.packageName} pulled from exotic source by ${t.declaredBy}: ${t.source}`);return i},z=async({options:e,visConfig:o,workspaceRoot:i})=>{const t=i??process.cwd(),s=b(t);if(!v[s.name]){p.warn(`Package manager '${s.name}' has no lockfile vis can verify.`);return}const n=await O({offline:!!e.offline,packageManager:s.name,visConfig:o??{},workspaceRoot:t});if(e.json){process.stdout.write(`${JSON.stringify(n,void 0,2)}
 `),n.status==="fail"&&(process.exitCode=1);return}const[r,...l]=V(n);if(n.status==="skipped"){p.info(r);return}if(n.status==="pass"){p.success(r);return}p.error(r);for(const f of l)p.error(f);process.exitCode=1};export{z as default};

package/dist/packem_chunks/version-resolver.js

@@ -1,3 +1,3 @@
-import{a as h}from"../packem_shared/index-B4AjSxHU.js";import{tagSafeName as b}from"./git.js";import{b as y}from"./index2.js";import{r as P}from"./orchestrator.js";const x=e=>{let s=0;const o=[],t=()=>{if(s>=e)return;const n=o.shift();n&&(s+=1,n())};return async n=>new Promise((d,a)=>{const m=()=>{s-=1,t()},u=()=>{n().then(d,a).finally(m)};o.push(u),t()})},C=4,g=new Map,w=(e,s)=>{const o=m=>m.replaceAll(/[$()*+.?[\\\]^{|}]/g,String.raw`\$&`);let t="^",n=0;const d=/\{(name|unscopedName|version|major|minor|patch|date|channel)\}/g;let a;for(;(a=d.exec(e))!==null;){switch(t+=o(e.slice(n,a.index)),a[1]){case"name":{t+=o(b(s.name));break}case"unscopedName":{t+=o(b(s.name.replace(/^@[^/]+\//,"")));break}case"version":{t+=String.raw`(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)`;break}default:t+="[^/]+"}n=a.index+a[0].length}return t+=`${o(e.slice(n))}$`,new RegExp(t)},$="{name}@{version}",k=(e,s)=>e.replaceAll(/\{(name|unscopedName|version|major|minor|patch|date|channel)\}/g,(o,t)=>t==="name"?b(s.name):t==="unscopedName"?b(s.name.replace(/^@[^/]+\//,"")):"*"),A=async(e,s,o,t)=>{if(s==="disk")return{resolvedFrom:"disk",version:e.version};if(s==="registry"){const c=P(e,t.perPackageConfig??{}),r=await y(c).readPublishedVersion({pkg:e,pm:t.pm,workspaceConfig:t.workspaceConfig});return r&&h.valid(r)?{resolvedFrom:"registry",version:r}:{fallbackReason:r===void 0?`registry returned no version for ${e.name} (likely a 404 / not-yet-published); falling back to manifest version ${e.version}.`:`registry returned an invalid semver "${r}" for ${e.name}; falling back to manifest version ${e.version}.`,resolvedFrom:"disk",version:e.version}}const n=t.perPackageConfig?.releaseTagPattern??t.workspaceConfig?.releaseTagPattern??$,d=k(n,e),a=await t.runner.run("git",["tag","--list",d,"--sort=-v:refname"],{cwd:t.cwd,silent:!0});if(a.exitCode!==0)return{fallbackReason:`git tag --list ${d} failed (exit ${a.exitCode}); falling back to manifest version ${e.version}.`,resolvedFrom:"disk",version:e.version};const m=a.stdout.split(`
+import{a as h}from"../packem_shared/index-B4AjSxHU.js";import{tagSafeName as b}from"./git.js";import{c as y}from"./index3.js";import{r as P}from"./context.js";const x=e=>{let s=0;const o=[],t=()=>{if(s>=e)return;const n=o.shift();n&&(s+=1,n())};return async n=>new Promise((d,a)=>{const m=()=>{s-=1,t()},u=()=>{n().then(d,a).finally(m)};o.push(u),t()})},C=4,g=new Map,w=(e,s)=>{const o=m=>m.replaceAll(/[$()*+.?[\\\]^{|}]/g,String.raw`\$&`);let t="^",n=0;const d=/\{(name|unscopedName|version|major|minor|patch|date|channel)\}/g;let a;for(;(a=d.exec(e))!==null;){switch(t+=o(e.slice(n,a.index)),a[1]){case"name":{t+=o(b(s.name));break}case"unscopedName":{t+=o(b(s.name.replace(/^@[^/]+\//,"")));break}case"version":{t+=String.raw`(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)`;break}default:t+="[^/]+"}n=a.index+a[0].length}return t+=`${o(e.slice(n))}$`,new RegExp(t)},$="{name}@{version}",k=(e,s)=>e.replaceAll(/\{(name|unscopedName|version|major|minor|patch|date|channel)\}/g,(o,t)=>t==="name"?b(s.name):t==="unscopedName"?b(s.name.replace(/^@[^/]+\//,"")):"*"),A=async(e,s,o,t)=>{if(s==="disk")return{resolvedFrom:"disk",version:e.version};if(s==="registry"){const c=P(e,t.perPackageConfig??{}),r=await y(c).readPublishedVersion({pkg:e,pm:t.pm,workspaceConfig:t.workspaceConfig});return r&&h.valid(r)?{resolvedFrom:"registry",version:r}:{fallbackReason:r===void 0?`registry returned no version for ${e.name} (likely a 404 / not-yet-published); falling back to manifest version ${e.version}.`:`registry returned an invalid semver "${r}" for ${e.name}; falling back to manifest version ${e.version}.`,resolvedFrom:"disk",version:e.version}}const n=t.perPackageConfig?.releaseTagPattern??t.workspaceConfig?.releaseTagPattern??$,d=k(n,e),a=await t.runner.run("git",["tag","--list",d,"--sort=-v:refname"],{cwd:t.cwd,silent:!0});if(a.exitCode!==0)return{fallbackReason:`git tag --list ${d} failed (exit ${a.exitCode}); falling back to manifest version ${e.version}.`,resolvedFrom:"disk",version:e.version};const m=a.stdout.split(`
 `).map(c=>c.trim()).filter(Boolean);if(m.length===0)return{fallbackReason:`no git tag matched pattern "${n}" for ${e.name}; falling back to manifest version ${e.version}. (Pass --first-release to bootstrap.)`,resolvedFrom:"disk",version:e.version};const u=w(n,e),i=[];for(const c of m){const f=u.exec(c);f?.[1]&&h.valid(f[1])&&i.push(f[1])}return i.length===0?{fallbackReason:`git tag pattern "${n}" matched tags but none yielded a valid semver for ${e.name}; falling back to manifest version ${e.version}.`,resolvedFrom:"disk",version:e.version}:(i.sort(h.rcompare),{resolvedFrom:"git-tag",version:i[0]})},T=(e,s,o)=>o?"disk":s?.currentVersionResolver??e?.currentVersionResolver??"disk",S=async(e,s,o,t,n)=>{const d=new Map,a=[],m=x(C),u=await Promise.all(e.map(async i=>m(async()=>{const c=t.get(i.name),f=T(o,c,n.firstRelease),r=n.skipRegistryLookup?"disk":f,l=`${i.name}@${r}@${i.version}`,p=g.get(l);if(p)return{mode:r,pkg:i,result:await p};const v=A(i,r,s,{...n,perPackageConfig:c,workspaceConfig:o});return g.set(l,v),v.catch(()=>{g.get(l)===v&&g.delete(l)}),{mode:r,pkg:i,result:await v}})));for(const{mode:i,pkg:c,result:f}of u)d.set(c.name,f.version),f.fallbackReason&&i!=="disk"&&a.push(`currentVersionResolver (${i}): ${f.fallbackReason}`);return{versions:d,warnings:a}},V=async e=>{const{cwd:s,packages:o,perPackageConfig:t,runner:n,workspaceConfig:d}=e,a=new Set,m=new Map;for(const r of o){const l=t?.get(r.name)?.releaseTagPattern??d?.releaseTagPattern??$;m.set(r.name,l),a.add(k(l,r))}const u=async r=>{const l=await n.run("git",["rev-list","--max-parents=0","HEAD"],{cwd:s,silent:!0}),v=(l.exitCode===0?l.stdout.split(`
 `).map(R=>R.trim()).filter(Boolean):[]).at(-1);return v?{kind:"root-commit",reason:`${r}; the only remaining boundary is the repository root commit (${v.slice(0,7)}) — the whole history`,ref:v}:{kind:"unresolved",reason:`${r} and the repository root commit could not be resolved`}};if(a.size===0)return u("no workspace packages to derive a release tag pattern from");const i=await n.run("git",["describe","--tags","--abbrev=0",...[...a].flatMap(r=>["--match",r]),"HEAD"],{cwd:s,silent:!0}),c=i.exitCode===0?i.stdout.trim():"";return c?o.some(r=>{const l=w(m.get(r.name)??$,r).exec(c);return l?.[1]!==void 0&&h.valid(l[1])!==null})?{kind:"tag",reason:`resolved the last release boundary to tag "${c}"`,ref:c,tag:c}:u(`the nearest matching tag "${c}" did not parse as a release tag`):u("no git tag matching the configured releaseTagPattern is reachable from HEAD")};export{$ as DEFAULT_RELEASE_TAG_PATTERN,C as REGISTRY_LOOKUP_CONCURRENCY,w as compileReleaseTagRegex,k as releaseTagListGlob,A as resolveCurrentVersion,S as resolveCurrentVersionsForWorkspace,V as resolveLastReleaseRef,T as resolveModeForPackage};

package/dist/packem_chunks/workspace.js

@@ -1,2 +1,2 @@
-import{createRequire as d}from"node:module";import v from"./index.js";import{normaliseGroup as C}from"../release/types.js";import{d as b}from"./index2.js";import{resolveFormatter as G}from"./resolveFormatter.js";let m;const f=e=>(m??=d(import.meta.url))(e),g=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,u=e=>{if(typeof g<"u"&&g.versions&&g.versions.node){const[n,o]=g.versions.node.split(".").map(Number);if(n>22||n===22&&o>=3||n===20&&o>=16)return g.getBuiltinModule(e)}return f(e)},{readFile:w,writeFile:_}=u("node:fs/promises"),j="## Release wave {date} ({count} packages)",k=async(e,n,o,s={})=>{const i=s.renderer??o,t=[(s.waveHeading??j).replaceAll("{date}",n).replaceAll("{count}",String(e.length)),""];for(const a of e){t.push(`### ${a.name} → ${a.newVersion}`),t.push("");const c={changeFiles:a.changeFiles,date:n,release:a,target:"github-release"},l=await i(c);l.trim()?t.push(l.trim()):t.push("_No changelog entries._"),t.push("")}return t.join(`
-`)},A=(e,n={})=>{const o=n.file??"CHANGELOG.md";return o.startsWith("/")?o:`${e}/${o}`},R=/[!()*+?@[\]{|}]/,y=(e,n)=>{const o=[],s=new Set;for(const i of e)if(R.test(i))for(const r of n)!s.has(r.name)&&v(i,r.name)&&(s.add(r.name),o.push(r));else{const r=n.find(t=>t.name===i);r&&!s.has(r.name)&&(s.add(r.name),o.push(r))}return o},N=(e,n,o)=>{const s=new Map,i=[...e.fixed??[],...e.linked??[]];for(const r of i){const t=C(r);if(t.changelog.mode!=="shared")continue;const a=y(t.packages,n);if(a.length===0)continue;let c;t.changelog.path?c=t.changelog.path.startsWith("/")?t.changelog.path:`${o}/${t.changelog.path}`:c=`${[...a].sort((h,p)=>h.name.localeCompare(p.name))[0].dir}/GROUP-CHANGELOG.md`;for(const l of a)s.has(l.name)||s.set(l.name,c)}return s},O=async(e,n)=>{if(n.length===0)return;const o=e.workspaceChangelog,s=typeof o=="object"?o:void 0,i=await G(e.changelogConfig,e.cwd),r=new Date().toISOString().slice(0,10),t=await k(n,r,i,s),a=A(e.cwd,s),c=await w(a,"utf8").catch(()=>{});return await _(a,b(t,c)),a};export{k as renderWorkspaceChangelog,N as resolveGroupChangelogRouting,A as workspaceChangelogPath,O as writeWorkspaceChangelogWave};
+import{createRequire as d}from"node:module";import v from"./index.js";import{normaliseGroup as C}from"../release/types.js";import{p as b}from"../packem_shared/apply-release-plan-BalHtK-g.js";import{resolveFormatter as G}from"./resolveFormatter.js";let m;const f=e=>(m??=d(import.meta.url))(e),g=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,u=e=>{if(typeof g<"u"&&g.versions&&g.versions.node){const[n,o]=g.versions.node.split(".").map(Number);if(n>22||n===22&&o>=3||n===20&&o>=16)return g.getBuiltinModule(e)}return f(e)},{readFile:w,writeFile:_}=u("node:fs/promises"),j="## Release wave {date} ({count} packages)",k=async(e,n,o,s={})=>{const i=s.renderer??o,t=[(s.waveHeading??j).replaceAll("{date}",n).replaceAll("{count}",String(e.length)),""];for(const a of e){t.push(`### ${a.name} → ${a.newVersion}`),t.push("");const c={changeFiles:a.changeFiles,date:n,release:a,target:"github-release"},l=await i(c);l.trim()?t.push(l.trim()):t.push("_No changelog entries._"),t.push("")}return t.join(`
+`)},A=(e,n={})=>{const o=n.file??"CHANGELOG.md";return o.startsWith("/")?o:`${e}/${o}`},R=/[!()*+?@[\]{|}]/,y=(e,n)=>{const o=[],s=new Set;for(const i of e)if(R.test(i))for(const r of n)!s.has(r.name)&&v(i,r.name)&&(s.add(r.name),o.push(r));else{const r=n.find(t=>t.name===i);r&&!s.has(r.name)&&(s.add(r.name),o.push(r))}return o},N=(e,n,o)=>{const s=new Map,i=[...e.fixed??[],...e.linked??[]];for(const r of i){const t=C(r);if(t.changelog.mode!=="shared")continue;const a=y(t.packages,n);if(a.length===0)continue;let c;t.changelog.path?c=t.changelog.path.startsWith("/")?t.changelog.path:`${o}/${t.changelog.path}`:c=`${[...a].sort((p,h)=>p.name.localeCompare(h.name))[0].dir}/GROUP-CHANGELOG.md`;for(const l of a)s.has(l.name)||s.set(l.name,c)}return s},O=async(e,n)=>{if(n.length===0)return;const o=e.workspaceChangelog,s=typeof o=="object"?o:void 0,i=await G(e.changelogConfig,e.cwd),r=new Date().toISOString().slice(0,10),t=await k(n,r,i,s),a=A(e.cwd,s),c=await w(a,"utf8").catch(()=>{});return await _(a,b(t,c)),a};export{k as renderWorkspaceChangelog,N as resolveGroupChangelogRouting,A as workspaceChangelogPath,O as writeWorkspaceChangelogWave};

package/dist/packem_shared/ReleaseClient-CWD9BC5w.js

@@ -0,0 +1 @@
+import{b as i}from"../packem_chunks/context.js";import{a as d}from"./apply-DoeQAAGm.js";import{p as u}from"./publish-Dc0XGH3K.js";const y=async(t={})=>{const e=await i(t),a=await d(e,{dryRun:t.dryRun});return{changedFiles:a.changedFiles,deletedFiles:a.deletedFiles,plan:a.plan}},w=async(t={})=>{const e=await i(t),{resolveFormatter:a}=await import("../packem_chunks/resolveFormatter.js"),n=await a(e.config.changelog,e.cwd),r=new Date().toISOString().slice(0,10),s=[];for(const c of e.plan.releases){const l=e.depGraph.getPackage(c.name);if(!l)continue;const o=await n({changeFiles:c.changeFiles,date:r,release:c,target:"changelog"});s.push({content:o,file:`${l.dir}/CHANGELOG.md`,package:c.name})}return{projectChangelogs:s}},m=async(t={})=>{const e=await i(t);return await u(e,{dryRun:t.dryRun,otp:t.otp,tag:t.tag})},F=async(t={})=>{const e=await i(t);let a=!1,n;const r=async()=>{if(n)return n;a=!0;const s=await d(e,{dryRun:t.dryRun});return n={changedFiles:s.changedFiles,deletedFiles:s.deletedFiles,plan:s.plan},n};return{apply:r,discard:()=>{a=!0},plan:e.plan,[Symbol.asyncDispose]:async()=>{a||await r()}}},R=async t=>{const e=await i(t),{runSnapshot:a}=await import("../packem_chunks/snapshot.js"),n=await a({context:e,dryRun:t.dryRun,registry:t.registry,tag:t.tag});return{failed:n.failed,published:n.published,skipped:n.skipped,snapshotVersion:n.snapshotVersion,tag:n.tag}},C=async(t={})=>{const e=await i(t),a=await d(e,{dryRun:t.dryRun}),n={changedFiles:a.changedFiles,deletedFiles:a.deletedFiles,plan:a.plan},{resolveFormatter:r}=await import("../packem_chunks/resolveFormatter.js"),s=await r(e.config.changelog,e.cwd),c=new Date().toISOString().slice(0,10),l=[];for(const g of a.plan.releases){const p=e.depGraph.getPackage(g.name);if(!p)continue;const f=await s({changeFiles:g.changeFiles,date:c,release:g,target:"changelog"});l.push({content:f,file:`${p.dir}/CHANGELOG.md`,package:g.name})}const o={projectChangelogs:l};if(t.skipPublish)return{changelog:o,publish:{failed:[],published:[],skipped:[]},version:n};const h=await u(e,{dryRun:t.dryRun,otp:void 0,tag:void 0});return{changelog:o,publish:h,version:n}};class S{constructor(e={}){this.config=e}config;releaseVersion(e={}){return y({...e,config:this.config})}releaseChangelog(e={}){return w({...e,config:this.config})}releasePublish(e={}){return m({...e,config:this.config})}releaseDraft(e={}){return F({...e,config:this.config})}releaseSnapshot(e){return R({...e,config:this.config})}}export{S as ReleaseClient,C as release,w as releaseChangelog,F as releaseDraft,m as releasePublish,R as releaseSnapshot,y as releaseVersion};

package/dist/packem_shared/advisories-BodWQ5DQ.js

@@ -0,0 +1 @@
+import{createRequire as N}from"node:module";import{L as M}from"./target-merge-DVJl-7Qz.js";import{advisoriesStatus as h,advisoriesQuery as k,NATIVE_BINDING_VERSION as E,advisoriesIngest as z}from"#native";import{V as S}from"./vis-user-error-D_ekz9rF.js";let R;const T=e=>(R??=N(import.meta.url))(e),m=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,l=e=>{if(typeof m<"u"&&m.versions&&m.versions.node){const[s,r]=m.versions.node.split(".").map(Number);if(s>22||s===22&&r>=3||s===20&&r>=16)return m.getBuiltinModule(e)}return T(e)},{randomUUID:D}=l("node:crypto"),{existsSync:_,createWriteStream:U}=l("node:fs"),{mkdir:P,rm:w,rename:O,stat:L,unlink:V}=l("node:fs/promises"),{join:p,dirname:B}=l("node:path"),{Readable:x}=l("node:stream"),{pipeline:C}=l("node:stream/promises"),b=6;if(E!==b)throw new Error(`vis native binding ABI mismatch in advisories: expected ${b}, got ${E}. Rebuild via \`pnpm --filter @visulima/vis run build:native\` or reinstall the platform binding package.`);const oe="https://osv-vulnerabilities.storage.googleapis.com",W=new Set(["osv-vulnerabilities.storage.googleapis.com"]);class j extends Error{cause="DB_NOT_FOUND";constructor(s){super(`No local advisory DB at ${s}. Run 'vis advisories sync' first.`),this.name="AdvisoryDbNotFoundError"}}const v=2;class H extends Error{cause="DB_SCHEMA_OUTDATED";constructor(s,r){super(`Advisory DB at ${s} uses schema v${String(r)}; this build of vis needs v${String(v)}. Run 'vis advisories sync' to rebuild it.`),this.name="AdvisoryDbSchemaError"}}class F extends Error{cause="DB_REBUILD_FAILED";constructor(s,r,o){super(`Could not rebuild advisory DB at ${s} from schema v${String(r)} to v${String(v)}: ${o}. The existing file was left unchanged.`),this.name="AdvisoryDbRebuildError"}}const ne=e=>{const{schemaVersion:s}=h(e);return s<v?new H(e,s):void 0};class y extends Error{cause="SOURCE_NOT_ALLOWED";constructor(s){super(`Advisory source host '${s}' is not in the built-in allowlist. Add it to \`security.audit.advisories.allowedHosts\` if intentional.`),this.name="AdvisorySourceNotAllowedError"}}class $ extends Error{cause="SYNC_NETWORK";constructor(s,r){super(`Advisory sync failed for ${s}: ${r}. Check connectivity, proxy env vars, or --source.`),this.name="AdvisorySyncNetworkError"}}const f=e=>{const r=M("vis",{create:!0,cwd:e})??p(e,"node_modules",".cache","vis");return p(r,"advisories","db.sqlite")},G=(e,s)=>{let r;try{r=new URL(e)}catch{throw new y(e)}if(r.protocol!=="https:")throw new y(`${r.protocol}//${r.host}`);if(!new Set([...W,...s??[]]).has(r.host))throw new y(r.host);return r},A=["-wal","-shm","-journal"],g=async e=>{const s=`${e.dbPath}.${e.ecosystem}.${process.pid}.${D()}.zip.tmp`;try{const r=await I(e.zipUrl,{method:"GET"});if(!r.ok||!r.body)throw new $(e.zipUrl.toString(),r.status);const o=e.etag??r.headers.get("etag"),a=r.headers.get("content-length"),n=a?Number.parseInt(a,10):null;let i=0;const t=U(s),d=x.fromWeb(r.body);return e.onProgress&&n&&d.on("data",c=>{i+=c.byteLength,e.onProgress?.(i,n,"download")}),await C(d,t),await z({dbPath:e.dbPath,ecosystem:e.ecosystem,manifestEtag:o??void 0,zipPath:s},(c,u)=>e.onProgress?.(c,u,"ingest"))}finally{await V(s).catch(()=>{})}},K=async(e,s,r,o,a)=>{const n=`${s}.rebuild.${process.pid}.${D()}.tmp`;try{const i=await g({dbPath:n,ecosystem:e.ecosystem,etag:null,onProgress:e.onProgress,zipUrl:a(e.ecosystem)});for(const t of o)t!==e.ecosystem&&await g({dbPath:n,ecosystem:t,etag:null,onProgress:e.onProgress,zipUrl:a(t)});return await Promise.all(A.map(t=>w(`${s}${t}`,{force:!0}))),await O(n,s),i}catch(i){throw await Promise.all(["",...A].map(t=>w(`${n}${t}`,{force:!0}).catch(()=>{}))),new F(s,r,i instanceof Error?i.message:String(i))}},Y=(e,s)=>{if(!/^[A-Z0-9][\w.:-]*$/i.test(s))throw new S(`Advisory ecosystem "${s}" is not a valid OSV name.`);const r=J(e.toString()),o=new URL(`${s}/all.zip`,r);if(o.origin!==e.origin||!o.pathname.startsWith(new URL(r).pathname))throw new S(`Advisory ecosystem "${s}" resolves outside the configured advisory source.`);return o},ie=async e=>{const s=e.dbPath??f(e.workspaceRoot),r=G(e.source,e.allowedHosts),o=t=>Y(r,t);if(_(s)){const t=h(s);if(t.schemaVersion<v){const d=t.ecosystems.map(u=>u.name),c=await K(e,s,t.schemaVersion,d,o);return{advisoriesIngested:c.advisoriesIngested,dbPath:s,durationMs:c.durationMs,rebuiltFromSchema:t.schemaVersion,upToDate:!1}}}await P(B(s),{recursive:!0});const a=await Z(s,e.ecosystem);let n=null;if(!e.force){const t=await I(o(e.ecosystem),{method:"HEAD"});if(t.ok&&(n=t.headers.get("etag"),n&&a&&n===a))return{advisoriesIngested:0,dbPath:s,durationMs:0,upToDate:!0}}const i=await g({dbPath:s,ecosystem:e.ecosystem,etag:n,onProgress:e.onProgress,zipUrl:o(e.ecosystem)});return{advisoriesIngested:i.advisoriesIngested,dbPath:s,durationMs:i.durationMs,upToDate:!1}},Q=(e,s)=>`${e}@${s}`,ae=(e,s)=>{if(e.length===0)return new Map;const r=s.dbPath??f(s.workspaceRoot),o=s.ecosystem??"npm";if(!_(r))throw new j(r);const a=e.map(t=>({ecosystem:o,name:t.name,version:t.version})),n=k(r,a),i=new Map;for(const[t,d]of e.entries()){const c=n[t];!c||c.vulnerabilities.length===0||i.set(Q(d.name,d.version),c.vulnerabilities.map(u=>X(u)))}return i},ce=async(e,s)=>{const r=s??f(e);return h(r)},Z=async(e,s)=>{try{await L(e)}catch{return null}return h(e).ecosystems.find(a=>a.name===s)?.manifestEtag??null},X=e=>({aliases:e.aliases.length>0?e.aliases:void 0,cvssScore:e.cvssScore??void 0,fixedVersions:e.fixedVersions,id:e.id,severity:q(e.severity),summary:e.summary}),q=e=>{const s=e.toUpperCase();return s==="CRITICAL"||s==="HIGH"||s==="MODERATE"||s==="LOW"?s:"UNKNOWN"},J=e=>e.endsWith("/")?e:`${e}/`,I=async(e,s)=>{try{return await fetch(e,s)}catch(r){throw new $(e.toString(),r instanceof Error?r.message:String(r))}};export{v as A,oe as D,Q as a,ne as b,j as c,ce as g,ae as q,f as r,ie as s};

package/dist/packem_shared/{affected-selection-DGb6Xu5K.js → affected-selection-QaMUnFqe.js}

@@ -1 +1 @@
-import{createRequire as T}from"node:module";import{getAffectedProjects as W}from"@visulima/task-runner";import{i as A}from"./index-BjdW45xX.js";import{V as k}from"./vis-user-error-CRmrBaD1.js";import{r as B}from"./affected-shas-B_kfSKss.js";let I;const R=e=>(I??=T(import.meta.url))(e),f=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,F=e=>{if(typeof f<"u"&&f.versions&&f.versions.node){const[t,s]=f.versions.node.split(".").map(Number);if(t>22||t===22&&s>=3||t===20&&s>=16)return f.getBuiltinModule(e)}return R(e)},{spawnSync:S}=F("node:child_process"),b=new Set(["deep","direct","none"]),O=e=>{const t=[],s=e.split("\0");for(let n=0;n<s.length;n++){const o=s[n];if(!o||o.length<4)continue;const c=o.slice(0,2),p=o.slice(3);if(p&&t.push(p),c.includes("R")||c.includes("C")){n+=1;const l=s[n];l&&t.push(l)}}return t},P=e=>{const t=S("git",["status","--porcelain","-z"],{cwd:e,encoding:"utf8"});return t.error||t.status!==0||typeof t.stdout!="string"?[]:O(t.stdout)},D=async(e,t,s={})=>{const n=e.downstream??"deep",o=e.upstream??"none";if(!b.has(n))throw new k(`Invalid --downstream value: "${n}". Must be "none", "direct", or "deep".`);if(!b.has(o))throw new k(`Invalid --upstream value: "${o}". Must be "none", "direct", or "deep".`);const{fileOwners:c,projectGraph:p,projects:l,workspaceRoot:h}=t,a=[];let{base:g}=e,{head:i}=e;if(!g||!i){const u=B({defaultBase:s.defaultBase,workspaceRoot:h});g=g||u.base,i=i||u.head,a.push(`Resolved affected refs from ${u.provider} (${u.notes.join("; ")})`)}const y=s.runningInCi??A,w=i==="HEAD"||i==="",$=e.uncommitted??(!y&&w);let d=[];if($)if(w){const j=(s.readWorkingTreeChanges??P)(h),C=Object.values(l).map(r=>r.root?.replace(/\/$/,"")).filter(r=>!!r&&r!==".");d=j.filter(r=>c!==void 0&&Object.hasOwn(c,r)||C.some(v=>r===v||r.startsWith(`${v}/`)));const _=j.length-d.length;d.length>0&&a.push(`including ${d.length} uncommitted working-tree file(s)`),_>0&&a.push(`ignoring ${_} uncommitted path(s) outside any project (untracked scratch would otherwise mark every project affected)`)}else a.push(`ignoring --uncommitted: --head=${i} pins the comparison to a commit, not the working tree`);const m=await W({additionalChangedFiles:d,base:g,downstream:n,fileOwners:c,head:i,ignoredFiles:s.affectedIgnore,projectGraph:p,projects:l,upstream:o,workspaceRoot:h});return m.ignoredFiles.length>0&&a.push(`ignoring ${m.ignoredFiles.length} changed path(s) outside any project matching affectedIgnore`),{...m,notes:a,uncommittedFileCount:d.length}};export{D as s};
+import{createRequire as T}from"node:module";import{getAffectedProjects as W}from"@visulima/task-runner";import{i as A}from"./index-BjdW45xX.js";import{V as k}from"./vis-user-error-D_ekz9rF.js";import{r as B}from"./affected-shas-B_kfSKss.js";let I;const R=e=>(I??=T(import.meta.url))(e),f=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,F=e=>{if(typeof f<"u"&&f.versions&&f.versions.node){const[t,s]=f.versions.node.split(".").map(Number);if(t>22||t===22&&s>=3||t===20&&s>=16)return f.getBuiltinModule(e)}return R(e)},{spawnSync:S}=F("node:child_process"),b=new Set(["deep","direct","none"]),O=e=>{const t=[],s=e.split("\0");for(let n=0;n<s.length;n++){const o=s[n];if(!o||o.length<4)continue;const c=o.slice(0,2),p=o.slice(3);if(p&&t.push(p),c.includes("R")||c.includes("C")){n+=1;const l=s[n];l&&t.push(l)}}return t},P=e=>{const t=S("git",["status","--porcelain","-z"],{cwd:e,encoding:"utf8"});return t.error||t.status!==0||typeof t.stdout!="string"?[]:O(t.stdout)},D=async(e,t,s={})=>{const n=e.downstream??"deep",o=e.upstream??"none";if(!b.has(n))throw new k(`Invalid --downstream value: "${n}". Must be "none", "direct", or "deep".`);if(!b.has(o))throw new k(`Invalid --upstream value: "${o}". Must be "none", "direct", or "deep".`);const{fileOwners:c,projectGraph:p,projects:l,workspaceRoot:h}=t,a=[];let{base:g}=e,{head:i}=e;if(!g||!i){const u=B({defaultBase:s.defaultBase,workspaceRoot:h});g=g||u.base,i=i||u.head,a.push(`Resolved affected refs from ${u.provider} (${u.notes.join("; ")})`)}const y=s.runningInCi??A,w=i==="HEAD"||i==="",$=e.uncommitted??(!y&&w);let d=[];if($)if(w){const j=(s.readWorkingTreeChanges??P)(h),C=Object.values(l).map(r=>r.root?.replace(/\/$/,"")).filter(r=>!!r&&r!==".");d=j.filter(r=>c!==void 0&&Object.hasOwn(c,r)||C.some(v=>r===v||r.startsWith(`${v}/`)));const _=j.length-d.length;d.length>0&&a.push(`including ${d.length} uncommitted working-tree file(s)`),_>0&&a.push(`ignoring ${_} uncommitted path(s) outside any project (untracked scratch would otherwise mark every project affected)`)}else a.push(`ignoring --uncommitted: --head=${i} pins the comparison to a commit, not the working tree`);const m=await W({additionalChangedFiles:d,base:g,downstream:n,fileOwners:c,head:i,ignoredFiles:s.affectedIgnore,projectGraph:p,projects:l,upstream:o,workspaceRoot:h});return m.ignoredFiles.length>0&&a.push(`ignoring ${m.ignoredFiles.length} changed path(s) outside any project matching affectedIgnore`),{...m,notes:a,uncommittedFileCount:d.length}};export{D as s};

package/dist/packem_shared/{ai-analysis-pldoS_N4.js → ai-analysis-D7jlbJky.js}

@@ -1,4 +1,4 @@
-import{createRequire as Z}from"node:module";import{O as ie,R as v,X as ce,o as k,q as de}from"../packem_chunks/catalog.js";import{a0 as le,a1 as ue,a2 as pe,a3 as me}from"../packem_chunks/cli-main.js";let ee;const te=e=>(ee??=Z(import.meta.url))(e),y=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,E=e=>{if(typeof y<"u"&&y.versions&&y.versions.node){const[n,t]=y.versions.node.split(".").map(Number);if(n>22||n===22&&t>=3||n===20&&t>=16)return y.getBuiltinModule(e)}return te(e)},{spawn:ne,execFileSync:G,execFile:se}=E("node:child_process"),{existsSync:_,readFileSync:oe}=E("node:fs"),{platform:re,homedir:q}=E("node:os"),{join:h,win32:R}=E("node:path"),{StringDecoder:$}=E("node:string_decoder"),{promisify:ae}=E("node:util"),fe=/v?(\d+\.\d+\.\d+(?:-[\w.]+)?)/,he=5e3,ge=1e4,ve=3e5,be=4096,O=re()==="win32",U=["amp","claude","codex","copilot","crush","cursor","droid","gemini","kimi","opencode","qwen"],ke={alternateCommands:[],buildArgs:(e,{dangerous:n})=>{const t=["-x",e];return n&&t.push("--dangerously-allow-all"),t},command:"amp",defaultModel:"",displayName:"Amp",envVariable:"AMP_PATH",sessionMarkers:[{confidence:"definite",variable:"AMP_CURRENT_THREAD_ID"},{confidence:"definite",equals:"amp",variable:"AGENT"}],supportsMaxTokens:!1,supportsModel:!1},Ae={alternateCommands:[],buildArgs:(e,{dangerous:n,model:t})=>{const s=[];return n&&s.push("--dangerously-skip-permissions"),t&&s.push("--model",t),s.push("--output-format","text","-p",e),s},command:"claude",defaultModel:"",displayName:"Claude Code",envVariable:"CLAUDE_PATH",sessionMarkers:[{confidence:"definite",variable:"CLAUDECODE"},{confidence:"definite",variable:"CLAUDE_CODE"}],supportsMaxTokens:!1,supportsModel:!0},Ee={alternateCommands:["openai-codex"],buildArgs:(e,{dangerous:n,model:t})=>{const s=["exec"];return t&&s.push("--model",t),n&&s.push("--dangerously-bypass-approvals-and-sandbox"),s.push("--",e),s},command:"codex",defaultModel:"",displayName:"Codex",envVariable:"CODEX_PATH",sessionMarkers:[{confidence:"definite",variable:"CODEX_SANDBOX"},{confidence:"definite",variable:"CODEX_THREAD_ID"},{confidence:"definite",variable:"CODEX_CI"}],supportsMaxTokens:!1,supportsModel:!0},Ce={alternateCommands:[],buildArgs:(e,{dangerous:n,model:t})=>{const s=["-p",e];return n&&s.push("--allow-all-tools"),t&&s.push("--model",t),s},command:"copilot",defaultModel:"",displayName:"GitHub Copilot CLI",envVariable:"COPILOT_PATH",sessionMarkers:[{confidence:"definite",variable:"COPILOT_MODEL"},{confidence:"definite",variable:"COPILOT_ALLOW_ALL"},{confidence:"definite",variable:"COPILOT_GITHUB_TOKEN"},{agent:"GitHub Copilot in VS Code",confidence:"definite",label:"TERM_PROGRAM+GIT_PAGER",match:{all:[["TERM_PROGRAM","vscode"],["GIT_PAGER","cat"]],none:["CURSOR_TRACE_ID"]}}],supportsMaxTokens:!1,supportsModel:!0},ye={alternateCommands:[],buildArgs:(e,{dangerous:n,model:t})=>{const s=["run"];return n&&s.push("--yolo"),t&&s.push("-m",t),s.push("--",e),s},command:"crush",defaultModel:"",displayName:"Crush",envVariable:"CRUSH_PATH",sessionMarkers:[{confidence:"definite",equals:"1",variable:"CRUSH"},{confidence:"definite",equals:"crush",variable:"AGENT"}],supportsMaxTokens:!1,supportsModel:!0},we={alternateCommands:["cursor"],buildArgs:(e,{dangerous:n,model:t})=>{const s=["-p"];return n&&s.push("--force"),s.push("--output-format","text"),t&&s.push("--model",t),s.push("--",e),s},command:"agent",defaultModel:"",displayName:"Cursor Agent",envVariable:"CURSOR_PATH",sessionMarkers:[{confidence:"definite",variable:"CURSOR_AGENT"},{confidence:"definite",label:"CURSOR_TRACE_ID+PAGER",match:{all:["CURSOR_TRACE_ID",["PAGER","head -n 10000 | cat"]]}},{agent:"Cursor editor",confidence:"ambient",variable:"CURSOR_TRACE_ID"}],supportsMaxTokens:!1,supportsModel:!0},Se={alternateCommands:[],buildArgs:(e,{dangerous:n,model:t})=>{const s=[];return n&&s.push("--skip-permissions-unsafe"),s.push("-o","text"),t&&s.push("-m",t),s.push("--",e),s},command:"droid",defaultModel:"",displayName:"Droid",envVariable:"DROID_PATH",sessionMarkers:[],supportsMaxTokens:!1,supportsModel:!0},Me={alternateCommands:["gemini-cli"],buildArgs:(e,{dangerous:n,maxTokens:t,model:s})=>{const o=[];return n||o.push("--sandbox"),s&&o.push("--model",s),o.push("--max-output-tokens",String(t),"-p",e),o},command:"gemini",defaultModel:"gemini-2.5-pro",displayName:"Gemini CLI",envVariable:"GEMINI_PATH",sessionMarkers:[{confidence:"definite",label:"GEMINI_CLI",match:{all:["GEMINI_CLI"],none:["QWEN_CODE"]}}],supportsMaxTokens:!0,supportsModel:!0},_e={alternateCommands:[],buildArgs:(e,{model:n})=>{const t=["--quiet","-p",e];return n&&t.push("-m",n),t},command:"kimi",defaultModel:"",displayName:"Kimi CLI",envVariable:"KIMI_PATH",sessionMarkers:[],supportsMaxTokens:!1,supportsModel:!0},Re={alternateCommands:[],buildArgs:(e,{model:n})=>{const t=["run"];return n&&t.push("-m",n),t.push("--",e),t},command:"opencode",defaultModel:"",displayName:"opencode",envVariable:"OPENCODE_PATH",sessionMarkers:[{confidence:"definite",label:"OPENCODE",match:{any:["OPENCODE","OPENCODE_BIN_PATH","OPENCODE_SERVER","OPENCODE_APP_INFO","OPENCODE_MODES","OPENCODE_CLIENT"]}}],supportsMaxTokens:!1,supportsModel:!0},Oe={alternateCommands:["qwen-code"],buildArgs:(e,{dangerous:n,model:t})=>{const s=["-p",e];return n&&s.push("--yolo"),s.push("-o","text"),t&&s.push("-m",t),s},command:"qwen",defaultModel:"",displayName:"Qwen Code",envVariable:"QWEN_PATH",sessionMarkers:[{confidence:"definite",equals:"1",variable:"QWEN_CODE"}],supportsMaxTokens:!1,supportsModel:!0},F={amp:ke,claude:Ae,codex:Ee,copilot:Ce,crush:ye,cursor:we,droid:Se,gemini:Me,kimi:_e,opencode:Re,qwen:Oe};class A extends Error{exitCode;durationMs;provider;stderr;stdout;timedOut;aborted;constructor(n,t){super(n),this.name="AiRunError",this.provider=t.provider,this.exitCode=t.exitCode??null,this.durationMs=t.durationMs,this.stdout=t.stdout??"",this.stderr=t.stderr??"",this.timedOut=t.timedOut??!1,this.aborted=t.aborted??!1}}const Te=/"%~?dp0%?\\?([^"]+?\.[cm]?js)"/i,Ie=(e,n)=>{const t=Te.exec(e)?.[1];if(t!==void 0)return R.resolve(R.dirname(n),t)},Ne=e=>{let n;try{n=oe(e,"utf8")}catch{return}const t=Ie(n,e);if(t!==void 0)return _(t)?t:void 0},Le=e=>{const n=R.join(R.dirname(e),"node.exe");return _(n)?n:"node"};ae(se);const xe=/\.(?:bat|cmd)$/i,j=e=>`"${e.replaceAll('"','""')}"`,B=(e,n=O)=>{if(!n||!xe.test(e))return{file:e,mode:"direct",prefixArguments:[]};const t=Ne(e);return t!==void 0?{file:Le(e),mode:"direct",prefixArguments:[t]}:{commandPath:e,mode:"shell"}},K=(e,n)=>e.mode==="shell"?{file:j(e.commandPath),shell:!0,spawnArguments:n.map(t=>j(t))}:{file:e.file,shell:!1,spawnArguments:[...e.prefixArguments,...n]},V=e=>e==="~"||e.startsWith("~/")||O&&e.startsWith("~\\")?h(q(),e.slice(2)):e,Pe=e=>{try{const n=G(O?"where":"which",[e],{encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:he}).trim().split(`
+import{createRequire as Z}from"node:module";import{O as ie}from"./renderToString-DR0zDUjh-C7p-L6AO.js";import{R as v,X as ce,O as k}from"./registry-CkoaWkjP.js";import{q as de}from"./table-DDAJalPF.js";import{a as le,c as ue,d as pe,e as me}from"./ai-cache-iSIyY3So.js";let ee;const te=e=>(ee??=Z(import.meta.url))(e),y=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,E=e=>{if(typeof y<"u"&&y.versions&&y.versions.node){const[n,t]=y.versions.node.split(".").map(Number);if(n>22||n===22&&t>=3||n===20&&t>=16)return y.getBuiltinModule(e)}return te(e)},{spawn:ne,execFileSync:G,execFile:se}=E("node:child_process"),{existsSync:_,readFileSync:oe}=E("node:fs"),{platform:re,homedir:q}=E("node:os"),{join:h,win32:R}=E("node:path"),{StringDecoder:$}=E("node:string_decoder"),{promisify:ae}=E("node:util"),fe=/v?(\d+\.\d+\.\d+(?:-[\w.]+)?)/,he=5e3,ge=1e4,ve=3e5,be=4096,O=re()==="win32",U=["amp","claude","codex","copilot","crush","cursor","droid","gemini","kimi","opencode","qwen"],ke={alternateCommands:[],buildArgs:(e,{dangerous:n})=>{const t=["-x",e];return n&&t.push("--dangerously-allow-all"),t},command:"amp",defaultModel:"",displayName:"Amp",envVariable:"AMP_PATH",sessionMarkers:[{confidence:"definite",variable:"AMP_CURRENT_THREAD_ID"},{confidence:"definite",equals:"amp",variable:"AGENT"}],supportsMaxTokens:!1,supportsModel:!1},Ae={alternateCommands:[],buildArgs:(e,{dangerous:n,model:t})=>{const s=[];return n&&s.push("--dangerously-skip-permissions"),t&&s.push("--model",t),s.push("--output-format","text","-p",e),s},command:"claude",defaultModel:"",displayName:"Claude Code",envVariable:"CLAUDE_PATH",sessionMarkers:[{confidence:"definite",variable:"CLAUDECODE"},{confidence:"definite",variable:"CLAUDE_CODE"}],supportsMaxTokens:!1,supportsModel:!0},Ee={alternateCommands:["openai-codex"],buildArgs:(e,{dangerous:n,model:t})=>{const s=["exec"];return t&&s.push("--model",t),n&&s.push("--dangerously-bypass-approvals-and-sandbox"),s.push("--",e),s},command:"codex",defaultModel:"",displayName:"Codex",envVariable:"CODEX_PATH",sessionMarkers:[{confidence:"definite",variable:"CODEX_SANDBOX"},{confidence:"definite",variable:"CODEX_THREAD_ID"},{confidence:"definite",variable:"CODEX_CI"}],supportsMaxTokens:!1,supportsModel:!0},Ce={alternateCommands:[],buildArgs:(e,{dangerous:n,model:t})=>{const s=["-p",e];return n&&s.push("--allow-all-tools"),t&&s.push("--model",t),s},command:"copilot",defaultModel:"",displayName:"GitHub Copilot CLI",envVariable:"COPILOT_PATH",sessionMarkers:[{confidence:"definite",variable:"COPILOT_MODEL"},{confidence:"definite",variable:"COPILOT_ALLOW_ALL"},{confidence:"definite",variable:"COPILOT_GITHUB_TOKEN"},{agent:"GitHub Copilot in VS Code",confidence:"definite",label:"TERM_PROGRAM+GIT_PAGER",match:{all:[["TERM_PROGRAM","vscode"],["GIT_PAGER","cat"]],none:["CURSOR_TRACE_ID"]}}],supportsMaxTokens:!1,supportsModel:!0},ye={alternateCommands:[],buildArgs:(e,{dangerous:n,model:t})=>{const s=["run"];return n&&s.push("--yolo"),t&&s.push("-m",t),s.push("--",e),s},command:"crush",defaultModel:"",displayName:"Crush",envVariable:"CRUSH_PATH",sessionMarkers:[{confidence:"definite",equals:"1",variable:"CRUSH"},{confidence:"definite",equals:"crush",variable:"AGENT"}],supportsMaxTokens:!1,supportsModel:!0},we={alternateCommands:["cursor"],buildArgs:(e,{dangerous:n,model:t})=>{const s=["-p"];return n&&s.push("--force"),s.push("--output-format","text"),t&&s.push("--model",t),s.push("--",e),s},command:"agent",defaultModel:"",displayName:"Cursor Agent",envVariable:"CURSOR_PATH",sessionMarkers:[{confidence:"definite",variable:"CURSOR_AGENT"},{confidence:"definite",label:"CURSOR_TRACE_ID+PAGER",match:{all:["CURSOR_TRACE_ID",["PAGER","head -n 10000 | cat"]]}},{agent:"Cursor editor",confidence:"ambient",variable:"CURSOR_TRACE_ID"}],supportsMaxTokens:!1,supportsModel:!0},Se={alternateCommands:[],buildArgs:(e,{dangerous:n,model:t})=>{const s=[];return n&&s.push("--skip-permissions-unsafe"),s.push("-o","text"),t&&s.push("-m",t),s.push("--",e),s},command:"droid",defaultModel:"",displayName:"Droid",envVariable:"DROID_PATH",sessionMarkers:[],supportsMaxTokens:!1,supportsModel:!0},Me={alternateCommands:["gemini-cli"],buildArgs:(e,{dangerous:n,maxTokens:t,model:s})=>{const o=[];return n||o.push("--sandbox"),s&&o.push("--model",s),o.push("--max-output-tokens",String(t),"-p",e),o},command:"gemini",defaultModel:"gemini-2.5-pro",displayName:"Gemini CLI",envVariable:"GEMINI_PATH",sessionMarkers:[{confidence:"definite",label:"GEMINI_CLI",match:{all:["GEMINI_CLI"],none:["QWEN_CODE"]}}],supportsMaxTokens:!0,supportsModel:!0},_e={alternateCommands:[],buildArgs:(e,{model:n})=>{const t=["--quiet","-p",e];return n&&t.push("-m",n),t},command:"kimi",defaultModel:"",displayName:"Kimi CLI",envVariable:"KIMI_PATH",sessionMarkers:[],supportsMaxTokens:!1,supportsModel:!0},Re={alternateCommands:[],buildArgs:(e,{model:n})=>{const t=["run"];return n&&t.push("-m",n),t.push("--",e),t},command:"opencode",defaultModel:"",displayName:"opencode",envVariable:"OPENCODE_PATH",sessionMarkers:[{confidence:"definite",label:"OPENCODE",match:{any:["OPENCODE","OPENCODE_BIN_PATH","OPENCODE_SERVER","OPENCODE_APP_INFO","OPENCODE_MODES","OPENCODE_CLIENT"]}}],supportsMaxTokens:!1,supportsModel:!0},Oe={alternateCommands:["qwen-code"],buildArgs:(e,{dangerous:n,model:t})=>{const s=["-p",e];return n&&s.push("--yolo"),s.push("-o","text"),t&&s.push("-m",t),s},command:"qwen",defaultModel:"",displayName:"Qwen Code",envVariable:"QWEN_PATH",sessionMarkers:[{confidence:"definite",equals:"1",variable:"QWEN_CODE"}],supportsMaxTokens:!1,supportsModel:!0},F={amp:ke,claude:Ae,codex:Ee,copilot:Ce,crush:ye,cursor:we,droid:Se,gemini:Me,kimi:_e,opencode:Re,qwen:Oe};class A extends Error{exitCode;durationMs;provider;stderr;stdout;timedOut;aborted;constructor(n,t){super(n),this.name="AiRunError",this.provider=t.provider,this.exitCode=t.exitCode??null,this.durationMs=t.durationMs,this.stdout=t.stdout??"",this.stderr=t.stderr??"",this.timedOut=t.timedOut??!1,this.aborted=t.aborted??!1}}const Te=/"%~?dp0%?\\?([^"]+?\.[cm]?js)"/i,Ie=(e,n)=>{const t=Te.exec(e)?.[1];if(t!==void 0)return R.resolve(R.dirname(n),t)},Ne=e=>{let n;try{n=oe(e,"utf8")}catch{return}const t=Ie(n,e);if(t!==void 0)return _(t)?t:void 0},Le=e=>{const n=R.join(R.dirname(e),"node.exe");return _(n)?n:"node"};ae(se);const xe=/\.(?:bat|cmd)$/i,j=e=>`"${e.replaceAll('"','""')}"`,B=(e,n=O)=>{if(!n||!xe.test(e))return{file:e,mode:"direct",prefixArguments:[]};const t=Ne(e);return t!==void 0?{file:Le(e),mode:"direct",prefixArguments:[t]}:{commandPath:e,mode:"shell"}},K=(e,n)=>e.mode==="shell"?{file:j(e.commandPath),shell:!0,spawnArguments:n.map(t=>j(t))}:{file:e.file,shell:!1,spawnArguments:[...e.prefixArguments,...n]},V=e=>e==="~"||e.startsWith("~/")||O&&e.startsWith("~\\")?h(q(),e.slice(2)):e,Pe=e=>{try{const n=G(O?"where":"which",[e],{encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:he}).trim().split(`
 `)[0]?.trim();return n&&n.length>0?n:void 0}catch{return}},De=e=>{const n=q();if(O){const t=process.env.APPDATA??"",s=process.env.LOCALAPPDATA??"",o=process.env.ProgramFiles??"";return[h(t,"npm",`${e}.cmd`),h(t,"npm",e),h(s,"Programs",e,`${e}.exe`),h(o,e,`${e}.exe`),h(n,".npm-global","bin",`${e}.cmd`)]}return[`/opt/homebrew/bin/${e}`,`/usr/local/bin/${e}`,h(n,".npm-global","bin",e),h(n,".local","bin",e),h(n,".cargo","bin",e)]},$e=e=>{try{const{file:n,shell:t,spawnArguments:s}=K(B(e),["--version"]),o=G(n,s,{encoding:"utf8",shell:t,stdio:["pipe","pipe","pipe"],timeout:ge}),r=fe.exec(o);return r?r[1]:void 0}catch{return}},X=(e,n={})=>{const t=F[e],s={available:!1,name:e},o=n.version!==!1,r=i=>{if(o)return $e(i)},a=process.env[t.envVariable];if(a&&_(V(a))){const i=V(a);return{...s,available:!0,detectionMethod:"envvar",path:i,version:r(i)}}const l=[t.command,...t.alternateCommands];for(const i of l){const c=Pe(i);if(c)return{...s,available:!0,detectionMethod:"which",path:c,version:r(c)}}for(const i of l)for(const c of De(i))if(_(c))return{...s,available:!0,detectionMethod:"known-path",path:c,version:r(c)};return s},je=(e={})=>U.map(n=>X(n,e)),Ve=(e={})=>je(e).filter(n=>n.available),He=(e,n,t={})=>{const s=F[e],o=t.model??s.defaultModel,r=t.maxTokens!==void 0&&Number.isFinite(t.maxTokens)?t.maxTokens:be;return s.buildArgs(n,{dangerous:t.dangerous===!0,maxTokens:r,model:o})},Ge=async(e,n,t={})=>{if(!e.available||!e.path)throw new A(`AI provider "${e.name}" is not available.`,{durationMs:0,provider:e.name});const s=He(e.name,n,t),o=t.timeoutMs!==void 0&&Number.isFinite(t.timeoutMs)?t.timeoutMs:ve,r=e.path,a=K(B(r),s),l=Date.now();if(t.signal?.aborted)throw new A(`${e.name} CLI run was aborted.`,{aborted:!0,durationMs:0,provider:e.name});return new Promise((i,c)=>{const f={cwd:t.cwd,env:{...process.env,...t.env,FORCE_COLOR:"0",NO_COLOR:"1"},shell:a.shell,stdio:["pipe","pipe","pipe"]},d=ne(a.file,a.spawnArguments,f);d.stdin?.end();let m="",g="",b=!1;const N=new $("utf8"),L=new $("utf8");let w,x,S;const T=()=>{clearTimeout(x),S&&t.signal?.removeEventListener("abort",S)},Q=()=>{d.kill("SIGKILL")},P=p=>{if(b)return;b=!0,d.kill("SIGTERM"),w=setTimeout(Q,5e3),w.unref(),T();const u=Date.now()-l,C=p?new A(`${e.name} CLI run was aborted.`,{aborted:!0,durationMs:u,provider:e.name,stderr:g,stdout:m}):new A(`${e.name} CLI timed out after ${String(o)}ms`,{durationMs:u,provider:e.name,stderr:g,stdout:m,timedOut:!0});c(C)};x=setTimeout(P,o,!1),S=()=>{P(!0)},t.signal?.addEventListener("abort",S,{once:!0}),d.stdout?.on("data",p=>{const u=N.write(p);u&&(m+=u,t.onStdout?.(u))}),d.stderr?.on("data",p=>{const u=L.write(p);u&&(g+=u,t.onStderr?.(u))}),d.on("close",p=>{clearTimeout(w);const u=N.end();u&&(m+=u,t.onStdout?.(u));const C=L.end();if(C&&(g+=C,t.onStderr?.(C)),b)return;b=!0,T();const D=Date.now()-l;p===0?i({durationMs:D,exitCode:p,provider:e.name,stderr:g,stdout:m}):c(new A(`${e.name} CLI exited with code ${String(p)}: ${g||m}`,{durationMs:D,exitCode:p,provider:e.name,stderr:g,stdout:m}))}),d.on("error",p=>{clearTimeout(w),!b&&(b=!0,T(),c(new A(`Failed to spawn ${e.name} CLI: ${p.message}`,{durationMs:Date.now()-l,provider:e.name,stderr:g,stdout:m})))})})},qe=12e4,Ue=2,Fe=1e3,Be=e=>new Promise(n=>{setTimeout(n,e)}),J=async(e,n,t=Ue)=>{let s;for(let o=0;o<=t;o+=1)try{return(await Ge(e,n,{timeoutMs:qe})).stdout}catch(r){if(s=r instanceof Error?r:new Error(String(r)),s.message.includes("timed out"))throw s;if(o<t){const a=Fe*2**o;await Be(a)}}throw s??new Error("AI request failed after retries")},Ke={amp:30,claude:80,codex:60,copilot:50,crush:35,cursor:40,droid:20,gemini:100,kimi:25,opencode:35,qwen:30},Xe=e=>{if(e?.provider){if(!U.includes(e.provider))return;const s=X(e.provider);return s.available?s:void 0}const n=Ve();if(n.length===0)return;const t={...Ke,...e?.priority};return n.toSorted((s,o)=>(t[o.name]??0)-(t[s.name]??0))[0]},Je=new Set(["defer","review","skip","update"]),We=new Set(["critical","high","low","medium"]),Ye=new Set(["high","low","medium"]),ze=50,I=30,Qe=e=>e.map(n=>{const t=n.vulnerabilities&&n.vulnerabilities.length>0?` [VULNERABILITIES: ${n.vulnerabilities.map(o=>`${o.severity} ${o.id}`).join(", ")}]`:"";let s="";if(n.socketReport){const o=Math.round(n.socketReport.score.overall*100),r=[`score:${String(o)}%`];if(n.socketReport.alerts.length>0){const a={};for(const i of n.socketReport.alerts)a[i.severity]=(a[i.severity]??0)+1;const l=Object.entries(a).map(([i,c])=>`${String(c)} ${i}`).join(", ");r.push(`alerts: ${l}`)}r.push(`supply-chain:${String(Math.round(n.socketReport.score.supplyChain*100))}%`),r.push(`quality:${String(Math.round(n.socketReport.score.quality*100))}%`),s=` [SOCKET.DEV: ${r.join(", ")}]`}return`- ${n.packageName}: ${n.currentRange} → ${n.newRange} (${n.updateType})${t}${s}`}).join(`
 `),M=`Respond ONLY with valid JSON in this exact structure:
 {
@@ -60,9 +60,9 @@ For each package:
 5. Flag any packages where skipping the update poses security risk
 6. If Socket.dev scores are provided, factor in supply chain and quality scores — low scores indicate higher risk
 
-${M}`},et=new Set(["compatibility","impact","recommend","security"]),pt=e=>et.has(e)?e:"impact",W=(e,n="impact")=>{const t=Qe(e);return Ze[n](t)},tt=/```(?:json)?\s*([\s\S]*?)```/,nt=/\{[\s\S]*\}/,st=e=>{try{return JSON.parse(e)}catch{}const n=tt.exec(e);if(n?.[1])try{return JSON.parse(n[1])}catch{}const t=nt.exec(e);if(t?.[0])try{return JSON.parse(t[0])}catch{}},ot=e=>({action:Je.has(e.action)?e.action:"review",breakingChanges:Array.isArray(e.breakingChanges)?e.breakingChanges:[],effort:Ye.has(e.effort)?e.effort:"medium",package:typeof e.package=="string"?e.package:"",reason:typeof e.reason=="string"?e.reason:"",riskLevel:We.has(e.riskLevel)?e.riskLevel:"medium"}),Y=(e,n,t)=>{const s=st(e);if(!s||typeof s!="object")return{analysisType:t,provider:n,recommendations:[],summary:"Failed to parse AI response.",warnings:["AI response was not valid JSON."]};const o=s,r=Array.isArray(o.recommendations)?o.recommendations:[];return{analysisType:t,provider:n,recommendations:r.map(a=>ot(a)),summary:typeof o.summary=="string"?o.summary:"",warnings:Array.isArray(o.warnings)?o.warnings:[]}},rt={eslint:["ESLint 9.0: Flat config required","ESLint 8.0+: New rule formats"],next:["Next.js 13+: App router changes","Next.js 14+: Server components default"],react:["React 17 to 18: Concurrent features","React 18+: Strict mode changes"],typescript:["TypeScript 5.0: New decorators","TypeScript 4.7+: ESM changes"],vite:["Vite 5: Node.js 18+ required"],vue:["Vue 3: Composition API","Vue 3: Breaking template changes"],webpack:["Webpack 5: Node.js polyfills removed"]},at=new Set(["bcrypt","cors","crypto-js","express-session","helmet","jose","jsonwebtoken","node-forge","oauth","passport"]),H=(e,n)=>{const t=e.map(s=>{const o=s.vulnerabilities&&s.vulnerabilities.length>0,r=at.has(s.packageName),a=rt[s.packageName]??[];let l="low",i="update",c="low",f="Patch/minor update, safe to apply.";return s.updateType==="major"?(l="high",i=a.length>0?"review":"update",c="medium",f=a.length>0?`Major update with known breaking changes: ${a[0]}`:"Major version update, review changelog before applying."):s.updateType==="minor"&&(l="medium",f="Minor update, generally safe."),o&&(l="high",i="update",f="Security update — current version has known vulnerabilities."),r&&s.updateType==="major"&&(i="review",f="Security-sensitive package with major update, careful review needed.",c="high"),{action:i,breakingChanges:a,effort:c,package:s.packageName,reason:f,riskLevel:l}});return{analysisType:n,provider:"rule-engine",recommendations:t,summary:`Rule-based ${n} analysis for ${String(e.length)} packages.`,warnings:["No AI provider available — using built-in rule engine."]}},it=async(e,n,t)=>{const s=W(n,t),o=await J(e,s);return Y(o,e.name,t)},ct=(e,n,t)=>{const s=[],o=[],r=[];for(const a of e)s.push(...a.recommendations),o.push(...a.warnings),a.summary&&r.push(a.summary);return{analysisType:t,provider:n,recommendations:s,summary:r.length===1?r[0]??"":`Analyzed ${String(s.length)} packages in ${String(e.length)} batches.`,warnings:[...new Set(o)]}},z={compatibility:"Compatibility",impact:"Impact",recommend:"Recommendations",security:"Security"},mt=e=>{const t=`${z[e.analysisType]??e.analysisType} Analysis (${e.provider})`,s=e.recommendations.flatMap(r=>{const a=[{action:r.action,effort:r.effort,package:r.package,reason:r.reason,risk:r.riskLevel}];return r.breakingChanges.length>0&&a.push({action:"",effort:"",package:"",reason:`Breaking: ${r.breakingChanges.join("; ")}`,risk:""}),a}),o=process.stdout.columns||80;return ie(v.createElement(ce,{borderStyle:"round",flexDirection:"column",paddingLeft:1,paddingRight:1},v.createElement(k,{bold:!0},t),v.createElement(k,null,""),v.createElement(k,null,e.summary),v.createElement(k,null,""),v.createElement(de,{borderStyle:"none",data:s}),...e.warnings.length>0?[v.createElement(k,null,""),...e.warnings.map((r,a)=>v.createElement(k,{dimColor:!0,key:String(a)},`  ${r}`))]:[]),{columns:o})},ft=async(e,n,t,s="impact")=>{const o=Xe(t);if(!o)return n.info(`No AI CLI tool found, using rule-based analysis.
+${M}`},et=new Set(["compatibility","impact","recommend","security"]),ft=e=>et.has(e)?e:"impact",W=(e,n="impact")=>{const t=Qe(e);return Ze[n](t)},tt=/```(?:json)?\s*([\s\S]*?)```/,nt=/\{[\s\S]*\}/,st=e=>{try{return JSON.parse(e)}catch{}const n=tt.exec(e);if(n?.[1])try{return JSON.parse(n[1])}catch{}const t=nt.exec(e);if(t?.[0])try{return JSON.parse(t[0])}catch{}},ot=e=>({action:Je.has(e.action)?e.action:"review",breakingChanges:Array.isArray(e.breakingChanges)?e.breakingChanges:[],effort:Ye.has(e.effort)?e.effort:"medium",package:typeof e.package=="string"?e.package:"",reason:typeof e.reason=="string"?e.reason:"",riskLevel:We.has(e.riskLevel)?e.riskLevel:"medium"}),Y=(e,n,t)=>{const s=st(e);if(!s||typeof s!="object")return{analysisType:t,provider:n,recommendations:[],summary:"Failed to parse AI response.",warnings:["AI response was not valid JSON."]};const o=s,r=Array.isArray(o.recommendations)?o.recommendations:[];return{analysisType:t,provider:n,recommendations:r.map(a=>ot(a)),summary:typeof o.summary=="string"?o.summary:"",warnings:Array.isArray(o.warnings)?o.warnings:[]}},rt={eslint:["ESLint 9.0: Flat config required","ESLint 8.0+: New rule formats"],next:["Next.js 13+: App router changes","Next.js 14+: Server components default"],react:["React 17 to 18: Concurrent features","React 18+: Strict mode changes"],typescript:["TypeScript 5.0: New decorators","TypeScript 4.7+: ESM changes"],vite:["Vite 5: Node.js 18+ required"],vue:["Vue 3: Composition API","Vue 3: Breaking template changes"],webpack:["Webpack 5: Node.js polyfills removed"]},at=new Set(["bcrypt","cors","crypto-js","express-session","helmet","jose","jsonwebtoken","node-forge","oauth","passport"]),H=(e,n)=>{const t=e.map(s=>{const o=s.vulnerabilities&&s.vulnerabilities.length>0,r=at.has(s.packageName),a=rt[s.packageName]??[];let l="low",i="update",c="low",f="Patch/minor update, safe to apply.";return s.updateType==="major"?(l="high",i=a.length>0?"review":"update",c="medium",f=a.length>0?`Major update with known breaking changes: ${a[0]}`:"Major version update, review changelog before applying."):s.updateType==="minor"&&(l="medium",f="Minor update, generally safe."),o&&(l="high",i="update",f="Security update — current version has known vulnerabilities."),r&&s.updateType==="major"&&(i="review",f="Security-sensitive package with major update, careful review needed.",c="high"),{action:i,breakingChanges:a,effort:c,package:s.packageName,reason:f,riskLevel:l}});return{analysisType:n,provider:"rule-engine",recommendations:t,summary:`Rule-based ${n} analysis for ${String(e.length)} packages.`,warnings:["No AI provider available — using built-in rule engine."]}},it=async(e,n,t)=>{const s=W(n,t),o=await J(e,s);return Y(o,e.name,t)},ct=(e,n,t)=>{const s=[],o=[],r=[];for(const a of e)s.push(...a.recommendations),o.push(...a.warnings),a.summary&&r.push(a.summary);return{analysisType:t,provider:n,recommendations:s,summary:r.length===1?r[0]??"":`Analyzed ${String(s.length)} packages in ${String(e.length)} batches.`,warnings:[...new Set(o)]}},z={compatibility:"Compatibility",impact:"Impact",recommend:"Recommendations",security:"Security"},ht=e=>{const t=`${z[e.analysisType]??e.analysisType} Analysis (${e.provider})`,s=e.recommendations.flatMap(r=>{const a=[{action:r.action,effort:r.effort,package:r.package,reason:r.reason,risk:r.riskLevel}];return r.breakingChanges.length>0&&a.push({action:"",effort:"",package:"",reason:`Breaking: ${r.breakingChanges.join("; ")}`,risk:""}),a}),o=process.stdout.columns||80;return ie(v.createElement(ce,{borderStyle:"round",flexDirection:"column",paddingLeft:1,paddingRight:1},v.createElement(k,{bold:!0},t),v.createElement(k,null,""),v.createElement(k,null,e.summary),v.createElement(k,null,""),v.createElement(de,{borderStyle:"none",data:s}),...e.warnings.length>0?[v.createElement(k,null,""),...e.warnings.map((r,a)=>v.createElement(k,{dimColor:!0,key:String(a)},`  ${r}`))]:[]),{columns:o})},gt=async(e,n,t,s="impact")=>{const o=Xe(t);if(!o)return n.info(`No AI CLI tool found, using rule-based analysis.
 `),H(e,s);const r=le(o.name,s,e),a=ue(r);if(a)return n.info(`Using cached ${s} analysis from ${a.provider}.
 `),a;const l=z[s]??s;n.info(`Running ${l.toLowerCase()} analysis with ${o.name}...
 `);try{let i;if(e.length>ze){n.info(`Splitting ${String(e.length)} packages into batches of ${String(I)}...
 `);const c=[];for(let d=0;d<e.length;d+=I)c.push(e.slice(d,d+I));const f=[];for(let d=0;d<c.length;d+=1){n.info(`  Batch ${String(d+1)}/${String(c.length)}...`);const m=c[d];m&&f.push(await it(o,m,s))}i=ct(f,o.name,s)}else{const c=await J(o,W(e,s));i=Y(c,o.name,s)}return pe(r,i,me(s,t?.cacheTtl)),i}catch(i){const c=i instanceof Error?i.message:String(i);return n.warn(`AI analysis failed (${c}), falling back to rule engine.
-`),H(e,s)}};export{Ke as D,Ge as T,Xe as a,J as b,je as c,st as e,mt as f,ft as r,pt as v};
+`),H(e,s)}};export{Ke as D,Ge as T,Xe as a,J as b,je as c,st as e,ht as f,gt as r,ft as v};

package/dist/packem_shared/ai-cache-iSIyY3So.js

@@ -0,0 +1 @@
+import{createRequire as v}from"node:module";import{x as p}from"./xxh3-BLHlvhgT.js";import{e as c}from"./index-BzhrR_iC.js";import{g as M}from"./env-BSXG3QKH.js";import{y as d}from"./isAccessibleSync-DYKTrrvc-C-_5cgwu.js";import{p as g}from"./readJsonSync-CbryXYxN-EWl7_7KX.js";import{h as $}from"./writeFileSync-DJoHk3Ks-BPRoepNw.js";let C;const D=t=>(C??=v(import.meta.url))(t),a=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,h=t=>{if(typeof a<"u"&&a.versions&&a.versions.node){const[e,r]=a.versions.node.split(".").map(Number);if(e>22||e===22&&r>=3||e===20&&r>=16)return a.getBuiltinModule(t)}return D(t)},{randomUUID:j}=h("node:crypto"),{rmSync:f,writeFileSync:w,renameSync:T,unlinkSync:A,readdirSync:m,statSync:b}=h("node:fs"),i=()=>c(M(),"ai"),B=3600*1e3,E=1800*1e3,_=()=>{$(i())},S=(t,e)=>{const r=`${t}.${String(process.pid)}.${j()}.tmp`;try{w(r,e,"utf8"),T(r,t)}catch(o){try{A(r)}catch{}throw o}},U=(t,e,r)=>{const o=r.map(n=>({currentRange:n.currentRange,name:n.packageName,targetVersion:n.targetVersion})).toSorted((n,l)=>n.name.localeCompare(l.name)),s=JSON.stringify({analysisType:e,packages:o,provider:t});return p(Buffer.from(s))},k=t=>{const e=c(i(),`${t}.json`);if(d(e))try{const r=g(e);if(Date.now()-r.createdAt>r.ttlMs){f(e,{force:!0});return}return r.result}catch{f(e,{force:!0});return}},z=(t,e,r)=>{_();const o=i(),s={createdAt:Date.now(),result:e,ttlMs:r};S(c(o,`${t}.json`),JSON.stringify(s,void 0,2))},F=(t,e)=>e!==void 0&&e>0?e:t==="security"?E:B,L=()=>{const t=i();if(!d(t))return{entries:0,newestEntry:void 0,oldestEntry:void 0,totalSizeBytes:0};const e=m(t).filter(n=>n.endsWith(".json"));let r=0,o,s;for(const n of e){const l=c(t,n),y=b(l);r+=y.size;const{mtimeMs:u}=y;(o===void 0||u<o)&&(o=u),(s===void 0||u>s)&&(s=u)}return{entries:e.length,newestEntry:s,oldestEntry:o,totalSizeBytes:r}},V=t=>p(Buffer.from(JSON.stringify(t))),W=t=>{const e=c(i(),`${t}.json`);if(d(e))try{const r=g(e);if(Date.now()-r.createdAt>r.ttlMs){f(e,{force:!0});return}return r.result}catch{f(e,{force:!0});return}},H=(t,e,r)=>{_();const o=i(),s={createdAt:Date.now(),result:e,ttlMs:r};S(c(o,`${t}.json`),JSON.stringify(s,void 0,2))},I=()=>{const t=i();if(!d(t))return 0;const e=m(t).filter(r=>r.endsWith(".json"));for(const r of e)f(c(t,r),{force:!0});return e.length};export{U as a,V as b,k as c,z as d,F as e,I as f,W as g,L as h,H as s};

package/dist/packem_shared/{ai-fix-D9MxigBQ.js → ai-fix-CgCyO65Q.js}

@@ -1,5 +1,5 @@
-import{createRequire as T}from"node:module";import{readLastRunSummary as _}from"@visulima/task-runner";import{a as $}from"./failure-log-BP-gCUb5.js";import{m as v,n as P,o as D,d as j,s as E,t as N,u as A}from"../packem_chunks/cli-main.js";import{c as R}from"./formatBytes-_HvjOy8a-B_qQr4Hw.js";import{v as x,U as y,e as B,a as H}from"./index-BzhrR_iC.js";import{a as C,b as U,e as k}from"./ai-analysis-pldoS_N4.js";let I;const F=e=>(I??=T(import.meta.url))(e),h=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,O=e=>{if(typeof h<"u"&&h.versions&&h.versions.node){const[t,n]=h.versions.node.split(".").map(Number);if(t>22||t===22&&n>=3||t===20&&n>=16)return h.getBuiltinModule(e)}return F(e)},{readFile:L,writeFile:M}=O("node:fs/promises"),q=32*1024,W=(e,t)=>{if(e.length<=t)return e;const n=e.slice(-t),o=e.length-n.length;return`[…${String(o)} bytes truncated from head…]
-${n}`},J=async(e,t)=>t===void 0?_(e,{dataDirectory:R(e)}):j(e,t),pe=async(e,t,n={})=>{const o=n.terminalOutputLimit??q,[r,i]=await Promise.all([$(e,t),J(e,n.runId)]),s=i?v(i,t):void 0;if(!r&&!s)return;let a,c;if(i&&s){const u=await P(e,i.id),f=u?v(u,t):void 0;a=D(s.hashDetails,f?.hashDetails),c=u?.id}const d=r?.terminalOutput??"";return{command:r?.command??void 0,cwd:r?.cwd??void 0,dependencies:s?.dependencies??[],duration:s?.duration,exitCode:r?.exitCode??s?.exitCode,hash:s?.hash??r?.hash,hashDetails:s?.hashDetails,hashDiff:a,previousRunId:c,project:s?.target.project,runId:i?.id??r?.runId,status:r?.status??(s?K(s):void 0),target:s?.target.target,taskId:t,terminalOutput:W(d,o),terminalOutputCaptured:!!r,timestamp:r?.timestamp??s?.endTime??s?.startTime}},K=e=>{if(e.exitCode!==void 0&&e.exitCode!==0)return"failure";switch(e.cacheStatus){case"HIT":return"local-cache";case"REMOTE_HIT":return"remote-cache";case"SKIPPED":return"skipped";default:return e.exitCode===0?"success":void 0}},Y=3600*1e3,w=80,V=new Set(["high","low","medium"]),X=()=>`You are an expert software engineer helping fix a failing build/test/lint task.
+import{createRequire as T}from"node:module";import{readLastRunSummary as _}from"@visulima/task-runner";import{a as $}from"./failure-log-DIsKBKaI.js";import{f as v,a as P,d as D,r as j}from"./run-summary-utils-CMeURYtS.js";import{d as E}from"./env-BSXG3QKH.js";import{v as x,U as y,e as R,a as L}from"./index-BzhrR_iC.js";import{a as M,b as B,e as H}from"./ai-analysis-D7jlbJky.js";import{g as C,s as U,b as k}from"./ai-cache-iSIyY3So.js";let I;const F=e=>(I??=T(import.meta.url))(e),h=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,O=e=>{if(typeof h<"u"&&h.versions&&h.versions.node){const[t,n]=h.versions.node.split(".").map(Number);if(t>22||t===22&&n>=3||t===20&&n>=16)return h.getBuiltinModule(e)}return F(e)},{readFile:N,writeFile:A}=O("node:fs/promises"),q=32*1024,W=(e,t)=>{if(e.length<=t)return e;const n=e.slice(-t),o=e.length-n.length;return`[…${String(o)} bytes truncated from head…]
+${n}`},J=async(e,t)=>t===void 0?_(e,{dataDirectory:E(e)}):j(e,t),le=async(e,t,n={})=>{const o=n.terminalOutputLimit??q,[r,i]=await Promise.all([$(e,t),J(e,n.runId)]),s=i?v(i,t):void 0;if(!r&&!s)return;let a,c;if(i&&s){const u=await P(e,i.id),f=u?v(u,t):void 0;a=D(s.hashDetails,f?.hashDetails),c=u?.id}const d=r?.terminalOutput??"";return{command:r?.command??void 0,cwd:r?.cwd??void 0,dependencies:s?.dependencies??[],duration:s?.duration,exitCode:r?.exitCode??s?.exitCode,hash:s?.hash??r?.hash,hashDetails:s?.hashDetails,hashDiff:a,previousRunId:c,project:s?.target.project,runId:i?.id??r?.runId,status:r?.status??(s?K(s):void 0),target:s?.target.target,taskId:t,terminalOutput:W(d,o),terminalOutputCaptured:!!r,timestamp:r?.timestamp??s?.endTime??s?.startTime}},K=e=>{if(e.exitCode!==void 0&&e.exitCode!==0)return"failure";switch(e.cacheStatus){case"HIT":return"local-cache";case"REMOTE_HIT":return"remote-cache";case"SKIPPED":return"skipped";default:return e.exitCode===0?"success":void 0}},Y=3600*1e3,w=80,V=new Set(["high","low","medium"]),X=()=>`You are an expert software engineer helping fix a failing build/test/lint task.
 
 You will be given:
 - The terminal output (stdout/stderr) from the failed task.
@@ -36,8 +36,8 @@ ${n.join(`
 `)},G=e=>{const t=[`Task: ${e.taskId}`];return e.project&&t.push(`Project: ${e.project}`),e.target&&t.push(`Target: ${e.target}`),e.command&&t.push(`Command: ${e.command}`),e.cwd&&t.push(`CWD: ${e.cwd}`),e.exitCode!==void 0&&t.push(`Exit code: ${String(e.exitCode)}`),e.hash&&t.push(`Task hash: ${e.hash}`),t.push("","Hash-diff since previous run:",z(e),""),e.terminalOutputCaptured?t.push("Terminal output:","```",e.terminalOutput,"```"):t.push("Terminal output: <no failure log was captured for this task>",'Set "cannotFix" and tell the user to re-run with `vis run` so logs can be captured.'),t.join(`
 `)},Q=e=>`${X()}
 
-${G(e)}`,Z=(e,t)=>{const n=Array.isArray(e.patches)?e.patches:[],o=[];for(const i of n)typeof i.file!="string"||i.file.length===0||typeof i.oldString!="string"||i.oldString.length===0||typeof i.newString=="string"&&o.push({file:i.file,newString:i.newString,oldString:i.oldString,reason:typeof i.reason=="string"&&i.reason.length>0?i.reason:void 0});const r=typeof e.cannotFix=="string"&&e.cannotFix.length>0?e.cannotFix:void 0;return{cannotFix:r,confidence:V.has(e.confidence)?e.confidence:"low",explanation:typeof e.explanation=="string"?e.explanation:"",patches:r?[]:o,provider:t}},ee=(e,t)=>{const n=k(e);return!n||typeof n!="object"?{cannotFix:"AI response was not valid JSON.",confidence:"low",explanation:"Failed to parse AI response.",patches:[],provider:t}:Z(n,t)},te=(e,t)=>A({cwd:t.cwd??null,flow:"ai-fix",hash:t.hash??null,provider:e,taskId:t.taskId,terminalOutput:t.terminalOutput,terminalOutputCaptured:t.terminalOutputCaptured}),le=async(e,t,n={})=>{const o=C(n.config);if(!o){t.warn(`No AI provider available — install one of: claude, gemini, copilot, codex.
-`);return}const r=n.cache!==!1,i=te(o.name,e);if(r){const s=E(i);if(s)return t.info(`Using cached fix proposal from ${s.provider}.
+${G(e)}`,Z=(e,t)=>{const n=Array.isArray(e.patches)?e.patches:[],o=[];for(const i of n)typeof i.file!="string"||i.file.length===0||typeof i.oldString!="string"||i.oldString.length===0||typeof i.newString=="string"&&o.push({file:i.file,newString:i.newString,oldString:i.oldString,reason:typeof i.reason=="string"&&i.reason.length>0?i.reason:void 0});const r=typeof e.cannotFix=="string"&&e.cannotFix.length>0?e.cannotFix:void 0;return{cannotFix:r,confidence:V.has(e.confidence)?e.confidence:"low",explanation:typeof e.explanation=="string"?e.explanation:"",patches:r?[]:o,provider:t}},ee=(e,t)=>{const n=H(e);return!n||typeof n!="object"?{cannotFix:"AI response was not valid JSON.",confidence:"low",explanation:"Failed to parse AI response.",patches:[],provider:t}:Z(n,t)},te=(e,t)=>k({cwd:t.cwd??null,flow:"ai-fix",hash:t.hash??null,provider:e,taskId:t.taskId,terminalOutput:t.terminalOutput,terminalOutputCaptured:t.terminalOutputCaptured}),fe=async(e,t,n={})=>{const o=M(n.config);if(!o){t.warn(`No AI provider available — install one of: claude, gemini, copilot, codex.
+`);return}const r=n.cache!==!1,i=te(o.name,e);if(r){const s=C(i);if(s)return t.info(`Using cached fix proposal from ${s.provider}.
 `),s}t.info(`Generating fix proposal with ${o.name}...
-`);try{const s=await U(o,Q(e)),a=ee(s,o.name);return r&&a.patches.length>0&&!a.cannotFix&&N(i,a,Y),a}catch(s){const a=s instanceof Error?s.message:String(s);t.warn(`AI fix proposal failed (${a}).
-`);return}},ne=(e,t,n)=>x(n)?y(n):y(B(t??e,n)),se=(e,t)=>{const n=H(e,t);return n===""?!0:!n.startsWith("..")&&!x(n)},ie=(e,t,n)=>{const o=e.indexOf(t),r=Math.max(0,o-w),i=Math.min(e.length,o+t.length+w),s=e.slice(r,i);return{previewAfter:`${e.slice(r,o)}${n}${e.slice(o+t.length,i)}`,previewBefore:s}},fe=async(e,t,n,o={})=>{const r=o.dryRun===!0,i=new Map,s=[];for(const a of n.patches){const c=ne(e,t,a.file);if(!se(e,c)){s.push({absolutePath:c,patch:a,status:"outside-workspace"});continue}let d=i.get(c);if(d===void 0){try{d=await L(c,"utf8")}catch(p){const g=p.code;s.push({absolutePath:c,error:g==="ENOENT"?void 0:p.message,patch:a,status:g==="ENOENT"?"missing-file":"error"});continue}i.set(c,d)}const u=d.indexOf(a.oldString);if(u===-1){s.push({absolutePath:c,patch:a,status:"no-match"});continue}if(d.indexOf(a.oldString,u+a.oldString.length)!==-1){s.push({absolutePath:c,patch:a,status:"ambiguous-match"});continue}const{previewAfter:S,previewBefore:b}=ie(d,a.oldString,a.newString),m=`${d.slice(0,u)}${a.newString}${d.slice(u+a.oldString.length)}`;if(!r)try{await M(c,m,"utf8")}catch(p){i.delete(c),s.push({absolutePath:c,error:p.message,patch:a,status:"error"});continue}i.set(c,m),s.push({absolutePath:c,patch:a,previewAfter:S,previewBefore:b,status:"applied"})}return s};export{pe as a,fe as b,ne as c,le as r};
+`);try{const s=await B(o,Q(e)),a=ee(s,o.name);return r&&a.patches.length>0&&!a.cannotFix&&U(i,a,Y),a}catch(s){const a=s instanceof Error?s.message:String(s);t.warn(`AI fix proposal failed (${a}).
+`);return}},ne=(e,t,n)=>x(n)?y(n):y(R(t??e,n)),se=(e,t)=>{const n=L(e,t);return n===""?!0:!n.startsWith("..")&&!x(n)},ie=(e,t,n)=>{const o=e.indexOf(t),r=Math.max(0,o-w),i=Math.min(e.length,o+t.length+w),s=e.slice(r,i);return{previewAfter:`${e.slice(r,o)}${n}${e.slice(o+t.length,i)}`,previewBefore:s}},me=async(e,t,n,o={})=>{const r=o.dryRun===!0,i=new Map,s=[];for(const a of n.patches){const c=ne(e,t,a.file);if(!se(e,c)){s.push({absolutePath:c,patch:a,status:"outside-workspace"});continue}let d=i.get(c);if(d===void 0){try{d=await N(c,"utf8")}catch(p){const g=p.code;s.push({absolutePath:c,error:g==="ENOENT"?void 0:p.message,patch:a,status:g==="ENOENT"?"missing-file":"error"});continue}i.set(c,d)}const u=d.indexOf(a.oldString);if(u===-1){s.push({absolutePath:c,patch:a,status:"no-match"});continue}if(d.indexOf(a.oldString,u+a.oldString.length)!==-1){s.push({absolutePath:c,patch:a,status:"ambiguous-match"});continue}const{previewAfter:S,previewBefore:b}=ie(d,a.oldString,a.newString),m=`${d.slice(0,u)}${a.newString}${d.slice(u+a.oldString.length)}`;if(!r)try{await A(c,m,"utf8")}catch(p){i.delete(c),s.push({absolutePath:c,error:p.message,patch:a,status:"error"});continue}i.set(c,m),s.push({absolutePath:c,patch:a,previewAfter:S,previewBefore:b,status:"applied"})}return s};export{le as a,me as b,ne as c,fe as r};

package/dist/packem_shared/apply-DoeQAAGm.js

@@ -0,0 +1,6 @@
+import{createRequire as j}from"node:module";import{DEFAULT_CHANGES_DIR as M}from"../packem_chunks/DEFAULT_CLEAN_KEEP.js";import{VisReleaseError as G}from"./VisReleaseError-DZtgcKf8.js";import{a as D}from"./apply-release-plan-BalHtK-g.js";import{createShellRunner as R}from"../packem_chunks/shell-runner.js";import{R as N}from"../packem_chunks/context.js";let b;const S=e=>(b??=j(import.meta.url))(e),P=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,$=e=>{if(typeof P<"u"&&P.versions&&P.versions.node){const[i,t]=P.versions.node.split(".").map(Number);if(i>22||i===22&&t>=3||i===20&&t>=16)return P.getBuiltinModule(e)}return S(e)},{writeFile:_,unlink:E}=$("node:fs/promises"),{resolve:A}=$("node:path"),T=e=>{const i=e.channel?.tag??e.branch??"main",{releases:t}=e.plan,d=t.length<=3?t.map(r=>`${r.name}@${r.newVersion}`).join(", "):`version ${t.length} packages`,m=t.map(r=>`- ${r.name}: ${r.oldVersion} → ${r.newVersion}`).join(`
+`);return`release(${i}): ${d} [skip ci]
+
+${m}`},H=async(e,i,t)=>{const d=await import("node:fs/promises"),{stageAndCommit:m}=await import("../packem_chunks/git.js"),r=R(),w=["pnpm-lock.yaml","package-lock.json","yarn.lock","bun.lock","bun.lockb"],l=await import("node:path"),o=[];for(const a of w)try{await d.access(l.join(e.cwd,a)),o.push(l.join(e.cwd,a))}catch{}const f=e.config.aggregateRelease===!0||typeof e.config.aggregateRelease=="object"&&e.config.aggregateRelease.enabled;let s;if(e.config.oneCommitPerPackage===!0&&!f&&e.plan.releases.length>0){const a=e.channel?.tag??e.branch??"main",n=i.writes.map(h=>h.path),g=new Set,{releases:c}=e.plan;for(let h=0;h<c.length;h+=1){const p=c[h],k=e.depGraph.getPackage(p.name),u=k?`${k.dir}${l.sep}`:void 0,y=u?n.filter(v=>v.startsWith(u)):[];for(const v of y)g.add(v);const V=h===c.length-1?[...n.filter(v=>!g.has(v)),...i.deletions,...o]:[],F=[...y,...V];F.length!==0&&(s=await m({cwd:e.cwd,runner:r},F,`release(${a}): ${p.name}@${p.newVersion} [skip ci]`,{author:e.config.gitUser}))}}else{const a=t??T(e),n=[...i.writes.map(g=>g.path),...i.deletions,...o];s=await m({cwd:e.cwd,runner:r},n,a,{author:e.config.gitUser})}return s},I=async(e,i)=>{const t=[],{applyExtraFilesForRelease:d}=await import("../packem_chunks/extra-files.js"),{applyVersionFilesForRelease:m}=await import("../packem_chunks/cargo-lock.js").then(a=>a.v),{cargoManifestPaths:r}=await import("../packem_chunks/cargo-lock.js").then(a=>a.b),w=await Promise.all(e.plan.releases.map(async a=>{const n=e.depGraph.getPackage(a.name);if(!n)return{warnings:[],writes:[]};const g=e.perPackageConfig.get(a.name)?.extraFiles??[],c=e.config.publish?.extraFiles??[],h=e.perPackageConfig.get(a.name)?.versionFiles??[],k=g.length>0||c.length>0?await d(e.cwd,n.dir,a.newVersion,a.name,c,g):{warnings:[],writes:[]},u=h.length>0?await m(n.dir,h,a.newVersion,a.name,new Map(k.writes.map(y=>[y.path,y.content]))):{writes:[]};return{warnings:k.warnings,writes:[...k.writes,...u.writes]}})),l=new Map,o=new Set;for(const a of w){for(const n of a.writes)l.set(n.path,n.content),o.add(n.path);t.push(...a.warnings)}const f=e.packages.filter(a=>a.ecosystem==="cargo"),s=e.plan.releases.flatMap(a=>{const n=e.depGraph.getPackage(a.name);if(!n||n.ecosystem!==void 0&&n.ecosystem!=="cargo")return[];const g=n.ecosystem==="cargo"?[n.manifestPath]:r(n.dir,e.perPackageConfig.get(a.name)??{});return g.length>0||n.ecosystem==="cargo"?[{ecosystem:n.ecosystem,manifestPaths:g,name:a.name,newVersion:a.newVersion}]:[]});if(s.length>0){const a=new Set(f.map(c=>c.manifestPath));f.length>0&&a.add(A(e.cwd,"Cargo.toml"));for(const c of e.packages)if(c.ecosystem===void 0)for(const h of r(c.dir,e.perPackageConfig.get(c.name)??{}))a.add(h);const{planCargoWorkspace:n}=await import("../packem_chunks/cargo-plan.js"),g=await n({crateManifests:f.map(c=>c.manifestPath),cwd:e.cwd,pending:l,releases:s,rewriteDependents:e.config.cargo?.discover===!0,scanManifests:[...a]});for(const c of g.touched)o.add(c);t.push(...g.warnings)}for(const a of N){const n=e.plan.releases.flatMap(c=>e.depGraph.getPackage(c.name)?.ecosystem===a.id?[{name:c.name,newVersion:c.newVersion}]:[]);if(n.length===0||a.plan===void 0)continue;const g=await a.plan({context:e,pending:l,projects:e.projectsByEcosystem?.get(a.id)??[],releases:n});for(const c of g.touched)o.add(c);t.push(...g.warnings)}for(const a of o)i.writes.push({content:l.get(a),path:a});t.length>0&&e.plan.warnings.push(...t)},q=async(e,i)=>{if(e.length===0)return;const{join:t}=await import("node:path");let d;try{const{createRequire:r}=await import("node:module"),{pathToFileURL:w}=await import("node:url"),l=r(t(i,"package.json"));d=await import(w(l.resolve("prettier")).href)}catch{return}const m=await import("node:fs/promises");for(const r of e)try{const w=await d.getFileInfo(r);if(w.ignored||!w.inferredParser)continue;const l=await m.readFile(r,"utf8"),o=await d.resolveConfig(r),f=await d.format(l,{...o,filepath:r});f!==l&&await m.writeFile(r,f)}catch{}},C=async(e,i,t)=>{if(!i||i.trim()==="")return;const d=R(),m=process.platform==="win32",r=m?"cmd":"sh",w=m?["/c",i]:["-c",i],l=await d.run(r,w,{cwd:e,silent:!1});if(l.exitCode!==0)throw new Error(`${t} failed (exit ${l.exitCode}): ${i}`)},L=async(e,i)=>{const{normaliseGroup:t}=await import("../release/types.js"),d=[...e.config.fixed??[],...e.config.linked??[]].map(r=>t(r)),{default:m}=await import("../packem_chunks/index.js");for(const[r,w]of Object.entries(i)){const l=Number.parseInt(r.replace(/^group-/,""),10),o=d[l];!o||!e.plan.releases.some(s=>o.packages.some(a=>s.name===a||m(a,s.name)))||await C(e.cwd,w,`groupPreVersionCommand[${r}]`)}},O=async(e,i,t,d={})=>{const{findConflictingPendingStages:m,readStagedRegistry:r,removePendingStages:w,writeStagedRegistry:l}=await import("../packem_chunks/staged-registry.js"),o=e.config.changesDir??M;let f=t??await r(e.cwd,o);if(f.pending.length===0)return;const s=new Map(e.plan.releases.map(p=>[p.name,p.newVersion])),a=[...s.keys()];let n=m(f,a).filter(p=>s.get(p.name)!==p.version);if(n.length===0)return;let g=[];if(!d.skipSelfHeal){const p=d.runner??R();g=(await Promise.all(n.map(async u=>{const y=await p.run("npm",["view",`${u.name}@${u.version}`,"dist.tarball","--silent"],{cwd:e.cwd,silent:!0});return y.exitCode===0&&y.stdout.trim().length>0?u.id:void 0}))).filter(u=>u!==void 0)}if(g.length>0){if(f=w(f,g),d.persistSelfHeal!==!1)try{await l(e.cwd,o,f)}catch{}if(n=m(f,a).filter(p=>s.get(p.name)!==p.version),n.length===0)return}const c=n.map(p=>`  • ${p.name}@${p.version} — stage ${p.id} (${p.reason}, recorded ${p.stagedAt})`).join(`
+`),h=i==="version"?"version":"publish";throw new G({code:"STAGE_PENDING",hint:"Resolve via `vis release stage approve <id>` / `--all` or `vis release stage reject <id>`, commit the updated staged.json, then retry.",message:`Refusing to ${h} — ${n.length} package(s) have a pending stage from a prior wave:
+${c}`})},Q=async(e,i={})=>{if(e.plan.releases.length===0)return{changedFiles:[],deletedFiles:[],plan:e.plan};await O(e,"version",void 0,{persistSelfHeal:!1}),!i.dryRun&&e.config.preVersionCommand&&await C(e.cwd,e.config.preVersionCommand,"preVersionCommand"),!i.dryRun&&e.config.groupPreVersionCommands&&await L(e,e.config.groupPreVersionCommands);const{readFileSync:t}=await import("node:fs"),{resolveFormatter:d}=await import("../packem_chunks/resolveFormatter.js"),{resolveGroupChangelogRouting:m}=await import("../packem_chunks/workspace.js"),r=await d(e.config.changelog,e.cwd),w=new Date().toISOString().slice(0,10),l=m(e.config,e.packages,e.cwd),o=await D(e.plan,e.depGraph,{changelogPath:s=>l.get(s.name)??`${s.dir}/CHANGELOG.md`,readChangelog:s=>{try{return t(s,"utf8")}catch{return}},readManifest:s=>{try{return t(s,"utf8")}catch{return}},renderChangelogEntry:s=>r({changeFiles:s.changeFiles,date:w,release:s,target:"changelog"})});if(await I(e,o),i.dryRun)return{changedFiles:o.writes.map(s=>s.path),deletedFiles:o.deletions,plan:e.plan};await Promise.all([...o.writes.map(s=>_(s.path,s.content)),...o.deletions.map(async s=>{try{await E(s)}catch{}})]);try{await e.pm.installLockfileOnly({cwd:e.cwd,silent:!0})}catch{}if(!i.dryRun&&e.config.formatChangedFiles&&await q(o.writes.map(s=>s.path),e.cwd),e.config.plugins?.length){const{runApplyDraftHooks:s}=await import("../packem_chunks/defineReleasePlugin.js");await s({config:e.config,cwd:e.cwd},e.plan)}const f=i.commit?await H(e,o,i.commitMessage):void 0;if(!i.dryRun&&e.config.postVersionCommand&&await C(e.cwd,e.config.postVersionCommand,"postVersionCommand"),!i.dryRun&&e.preMode?.mode==="exit-pending"){const{deletePreMode:s,preModeFilePath:a}=await import("../packem_chunks/pre-mode.js"),n=e.config.changesDir??".vis/release";await s(e.cwd,n)&&e.plan.warnings.push(`Pre-mode exited: \`${a(e.cwd,n)}\` was deleted. Commit the deletion so the registry stays consistent across CI runs.`)}return{changedFiles:o.writes.map(s=>s.path),commitSha:f,deletedFiles:o.deletions,plan:e.plan}};export{Q as a,O as b,C as r};

package/dist/packem_shared/apply-release-plan-BalHtK-g.js

@@ -0,0 +1,15 @@
+const m=["dependencies","devDependencies","peerDependencies","optionalDependencies"],$=(e,s)=>{if(e.startsWith("catalog:")||e==="*"||e==="workspace:*"||e==="workspace:^"||e==="workspace:~")return e;if(e.startsWith("workspace:")){const n=e.slice(10);return`workspace:${g(n)}${s}`}if(e.startsWith("npm:")){const n=e.lastIndexOf("@");if(n<=4)return e;const i=e.slice(4,n),r=e.slice(n+1),a=g(r);return`npm:${i}@${a}${s}`}return`${g(e)}${s}`},w=/^([\^~=]|>=?|<=?)/,g=e=>{const s=w.exec(e);return s?s[1]??"^":"^"},W=async(e,s,t={})=>{const n=t.serializeManifest??C,i=t.changelogPath??x,r=t.renderChangelogEntry??M,a=new Map(e.releases.map(o=>[o.name,o.newVersion])),p=await Promise.all(e.releases.map(async o=>{const c=s.getPackage(o.name);if(!c)return;const h=y(c.manifest,o.newVersion,a),d=t.readManifest?.(c.manifestPath),u=i(c);return{changelogEntry:await r(o),changelogPath:u,manifestWrite:c.ecosystem===void 0?{content:n(h,d),path:c.manifestPath}:void 0}})),f=[],l=new Map;for(const o of p){if(!o)continue;o.manifestWrite&&f.push(o.manifestWrite);const c=l.get(o.changelogPath);c?c.push(o.changelogEntry):l.set(o.changelogPath,[o.changelogEntry])}for(const[o,c]of l){const h=c.join(`
+
+`),d=t.readChangelog?.(o);f.push({content:k(h,d),path:o})}return{deletions:e.consumedChangeFiles.map(o=>o.path),writes:f}},y=(e,s,t)=>{const n={...e,version:s};for(const i of m){const r=e[i];if(!r||typeof r!="object")continue;const a={...r};let p=!1;for(const[f,l]of Object.entries(r)){const o=t.get(f);if(o===void 0)continue;const c=$(l,o);c!==l&&(a[f]=c,p=!0)}p&&(n[i]=a)}return n},E=/^# .+/,P=/^## /m,k=(e,s)=>{const t=e.trim();if(!s||s.trim()==="")return`# Changelog
+
+${t}
+`;const n=s.split(/\r?\n/);if(n[0]&&E.test(n[0])){let i=1;for(;i<n.length&&!(n[i]??"").startsWith("## ");)i+=1;const r=n.slice(0,i),a=n.slice(i);return r.length>0&&r[r.length-1]!==""&&r.push(""),[...r,t,"",...a].join(`
+`).replaceAll(/\n{3,}/g,`
+
+`)}return P.test(s)?`${t}
+
+${s.trimStart()}`:`${t}
+
+${s.trimStart()}`},C=(e,s)=>{const t=D(s);return`${JSON.stringify(e,null,t)}
+`},D=e=>{if(!e)return 4;const s=/\n(\s+)"/.exec(e);if(!s)return 4;const t=(s[1]??"").length;return t===2||t===4?t:4},x=e=>`${e.dir}/CHANGELOG.md`,M=e=>{const s=new Date().toISOString().slice(0,10),t=[`## ${e.newVersion}`,`<sub>${s}</sub>`,""];if(e.isCascadeBump||e.isGroupBump)for(const n of e.sources)t.push(`- Version bump from ${n.name}@${n.newVersion}`);else if(e.isDependencyBump&&e.changeFiles.length===0)for(const n of e.sources)n.newVersion===""?t.push(`- Removed dependency ${n.name}`):t.push(`- Updated dependency ${n.name}@${n.newVersion}`);else for(const n of e.changeFiles)for(const i of n.body.split(/\r?\n/)){if(i.trim()===""){t.push("");continue}t.push(i.startsWith("-")||i.startsWith("*")?i:`- ${i}`)}return t.join(`
+`)};export{W as a,k as p,$ as r};

package/dist/packem_shared/{bin-AZQv95jh.js → bin-LyW9KY0i.js}

@@ -1 +1 @@
-import{createRequire as v}from"node:module";import{t as T}from"./compile-cache-DoMHRsRZ.js";import{a as w,c as R,i as $,t as M,u as m,g as S}from"./package-version-KLwH0Ivy.js";import{i as j}from"./index-BjdW45xX.js";let _;const x=s=>(_??=v(import.meta.url))(s),t=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,b=s=>{if(typeof t<"u"&&t.versions&&t.versions.node){const[e,o]=t.versions.node.split(".").map(Number);if(e>22||e===22&&o>=3||e===20&&o>=16)return t.getBuiltinModule(s)}return x(s)},{createRequire:y}=b("node:module");let N;const O=s=>(N??=y(import.meta.url))(s),r=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,f=s=>{if(typeof r<"u"&&r.versions&&r.versions.node){const[e,o]=r.versions.node.split(".").map(Number);if(e>22||e===22&&o>=3||e===20&&o>=16)return r.getBuiltinModule(s)}return O(s)},{execFileSync:C}=f("node:child_process"),{totalmem:I}=f("node:os"),q=/--max-old-space-size=(\d+)/,z=/--max-semi-space-size=(\d+)/,E=s=>Math.floor(I()/1024/1024*s),P=s=>s<=512?4:s<=1024?8:s<=2048?16:s<=4096?32:s<=8192?64:Math.floor(Math.log2(s))*8,d=(s,e)=>{for(const o of e){const n=s.exec(o);if(n)return Number.parseInt(n[1],10)}},B=s=>{const o=[...w()],n=[...R()],a=d(q,o),p=d(z,o);if(a!==void 0&&p!==void 0)return;const l=a??E(.75),g=p??P(l),c=[];if(a===void 0&&c.push(`--max-old-space-size=${String(l)}`),p===void 0&&c.push(`--max-semi-space-size=${String(g)}`),c.length!==0)try{C($(),[...c,...o,...n.slice(1)],{env:M(),stdio:"inherit"}),m(0)}catch(h){const u=h.status;m(typeof u=="number"?u:1)}},V=()=>{process.env.VIS_VERSION=S()},H=s=>{!process.stdout.isTTY||j||process.env.TERM==="dumb"||process.stdout.write(`\x1B]0;${s}\x07`)},A=new Set(["","--help","--version","-h","-v","completion","dlx","exec","x"]),i=process.argv[2]??"";!A.has(i)&&!process.argv.includes("--help")&&!process.argv.includes("-h")&&B();process.argv.includes("--no-color")&&(process.env.NO_COLOR="1",process.env.FORCE_COLOR="0");V();T();(async()=>{if(i==="__pm-shim"){const{dispatchShim:e}=await import("../packem_chunks/dispatch.js");e(process.argv[3]??"",process.argv.slice(4));return}if(i==="x"){const{runLeanX:e}=await import("../packem_chunks/lean.js");await e(process.argv.slice(3));return}if(i==="exec"||i==="dlx"){const{runExecCli:e}=await import("../packem_chunks/cli-exec.js");await e();return}const{runCli:s}=await import("../packem_chunks/cli-main.js").then(e=>e.ax);await s()})();export{H as s};
+import{createRequire as v}from"node:module";import{t as T}from"./compile-cache-DoMHRsRZ.js";import{a as w,c as R,i as $,t as M,u as m,g as S}from"./package-version-DqYSd_ia.js";import{i as j}from"./index-BjdW45xX.js";let _;const x=s=>(_??=v(import.meta.url))(s),t=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,b=s=>{if(typeof t<"u"&&t.versions&&t.versions.node){const[e,o]=t.versions.node.split(".").map(Number);if(e>22||e===22&&o>=3||e===20&&o>=16)return t.getBuiltinModule(s)}return x(s)},{createRequire:y}=b("node:module");let N;const O=s=>(N??=y(import.meta.url))(s),r=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,f=s=>{if(typeof r<"u"&&r.versions&&r.versions.node){const[e,o]=r.versions.node.split(".").map(Number);if(e>22||e===22&&o>=3||e===20&&o>=16)return r.getBuiltinModule(s)}return O(s)},{execFileSync:C}=f("node:child_process"),{totalmem:I}=f("node:os"),q=/--max-old-space-size=(\d+)/,z=/--max-semi-space-size=(\d+)/,E=s=>Math.floor(I()/1024/1024*s),P=s=>s<=512?4:s<=1024?8:s<=2048?16:s<=4096?32:s<=8192?64:Math.floor(Math.log2(s))*8,d=(s,e)=>{for(const o of e){const n=s.exec(o);if(n)return Number.parseInt(n[1],10)}},B=s=>{const o=[...w()],n=[...R()],a=d(q,o),p=d(z,o);if(a!==void 0&&p!==void 0)return;const l=a??E(.75),g=p??P(l),c=[];if(a===void 0&&c.push(`--max-old-space-size=${String(l)}`),p===void 0&&c.push(`--max-semi-space-size=${String(g)}`),c.length!==0)try{C($(),[...c,...o,...n.slice(1)],{env:M(),stdio:"inherit"}),m(0)}catch(h){const u=h.status;m(typeof u=="number"?u:1)}},V=()=>{process.env.VIS_VERSION=S()},H=s=>{!process.stdout.isTTY||j||process.env.TERM==="dumb"||process.stdout.write(`\x1B]0;${s}\x07`)},A=new Set(["","--help","--version","-h","-v","completion","dlx","exec","x"]),i=process.argv[2]??"";!A.has(i)&&!process.argv.includes("--help")&&!process.argv.includes("-h")&&B();process.argv.includes("--no-color")&&(process.env.NO_COLOR="1",process.env.FORCE_COLOR="0");V();T();(async()=>{if(i==="__pm-shim"){const{dispatchShim:e}=await import("../packem_chunks/dispatch.js");e(process.argv[3]??"",process.argv.slice(4));return}if(i==="x"){const{runLeanX:e}=await import("../packem_chunks/lean.js");await e(process.argv.slice(3));return}if(i==="exec"||i==="dlx"){const{runExecCli:e}=await import("../packem_chunks/cli-exec.js");await e();return}const{runCli:s}=await import("../packem_chunks/cli-main.js").then(e=>e.ao);await s()})();export{H as s};

package/dist/packem_shared/clean-package-json-rutwkKl-.js

@@ -0,0 +1 @@
+import{resolveCleanStripList as i}from"../packem_chunks/DEFAULT_CLEAN_KEEP.js";const a=(e,o)=>{if(o===!1)return{...e};const t=new Set(i(o)),r={name:e.name,version:e.version};for(const[n,s]of Object.entries(e))t.has(n)||(r[n]=s);return r};export{a as c};

package/dist/packem_shared/createAdapter-DMK4bBET.js

@@ -0,0 +1 @@
+import{c as r,d as t}from"../packem_chunks/index2.js";export{r as createAdapter,t as detectPackageManager};

package/dist/packem_shared/createVersionActions-DXo4z8VN.js

@@ -0,0 +1 @@
+import{c as t}from"../packem_chunks/index3.js";import"../packem_chunks/python.js";export{t as createVersionActions};

package/dist/packem_shared/dependency-scan-DFnt1mni.js

@@ -0,0 +1 @@
+import{e as l,z as d}from"./index-BzhrR_iC.js";import{S as m}from"./lockfile-DhHAaHN5.js";import{h as g,i as D}from"./registry-CkoaWkjP.js";import{y as S}from"./isAccessibleSync-DYKTrrvc-C-_5cgwu.js";const k={vite:"Separate vite copies each load their own plugin and config state. Pin one version with a package manager override.",vitest:"Separate vitest copies each keep their own expect, mocks and runner state. Pin one version with a package manager override."},P={bun:{file:"bun.lock",type:"bun"},npm:{aliases:["npm-shrinkwrap.json"],file:"package-lock.json",type:"npm"},pnpm:{file:"pnpm-lock.yaml",type:"pnpm"},yarn:{file:"yarn.lock",type:"yarn"}},b=t=>{const o=P[t];return o?[...o.aliases??[],o.file].map(n=>({file:n,type:o.type})):[]},h=(t,o)=>{const n=b(o);if(n.length!==0)return n.find(r=>S(l(t,r.file)))??n[n.length-1]},v=t=>{try{return JSON.parse(d(t))}catch{return}},y=t=>{const o=[],n=v(l(t,"package.json"));n&&o.push(n);const r=g(t);let c;if(r?c=r:n?.workspaces&&(Array.isArray(n.workspaces)?c=n.workspaces:n.workspaces.packages&&(c=n.workspaces.packages)),!c)return o;const i=D(t,c);for(const s of i){const e=v(l(t,s,"package.json"));e&&o.push(e)}return o},w=(t,o)=>{const n=new Set,r=[],c=new Map;for(const s of o){const e=c.get(s.name);e?e.push(s):c.set(s.name,[s])}const i=s=>{if(s)for(const e of Object.keys(s))n.has(e)||(n.add(e),r.push(e))};for(const s of y(t))i(s.dependencies),i(s.peerDependencies),i(s.optionalDependencies);for(;r.length>0;){const s=r.shift(),e=c.get(s);if(e){for(const a of e)for(const f of[a.dependencies,a.peerDependencies,a.optionalDependencies])if(f)for(const p of Object.keys(f))n.has(p)||(n.add(p),r.push(p))}}return n},L=(t,o,n={})=>{const r=h(t,o);if(!r)return[];let c;try{c=d(l(t,r.file))}catch{return[]}const i=m(c,r.type);if(i.length===0)return[];const e=n.includeDev??!0?void 0:w(t,i),a=new Set,f=[];for(const p of i){if(e&&!e.has(p.name))continue;const u=`${p.name}@${p.version}`;a.has(u)||(a.add(u),f.push({isDev:!1,name:p.name,version:p.version}))}return f},O=(t,o)=>{const n=h(t,o);if(!n)return[];let r;try{r=d(l(t,n.file))}catch{return[]}const c=m(r,n.type);if(c.length===0)return[];const i=new Map;for(const e of c)i.has(e.name)||i.set(e.name,new Set),i.get(e.name).add(e.version);const s=[];for(const[e,a]of i){if(a.size<=1)continue;const f={name:e,versions:[...a]};k[e]&&(f.hint=k[e]),s.push(f)}return s.sort((e,a)=>e.name.localeCompare(a.name))},M=(t,o)=>{const n=h(t,o);if(!n)return;let r;try{r=d(l(t,n.file))}catch{return}const c=m(r,n.type);if(c.length===0)return;const i=[],s=new Set;for(const e of y(t))for(const a of[e.dependencies,e.devDependencies,e.peerDependencies,e.optionalDependencies])if(a)for(const[f,p]of Object.entries(a)){const u=`${f}@${p}`;s.has(u)||(s.add(u),i.push({name:f,version:p}))}return{entries:c,roots:i}};export{P as L,M as a,O as f,L as l,h as r};