build(deps-dev): bump @velarscript/cli from 0.18.0 to 0.34.2

[dependabot]

Bumps @velarscript/cli from 0.18.0 to 0.34.2.

Changelog

Sourced from @​velarscript/cli's changelog.

0.34.2 — 2026-09-27

Surfaces: core@0.10 · web@0.14 · node@0.17 · server@0.15 · desktop@0.10

Compiler and CLI

• Two-slot loops over a statically known List now use the List iterator directly. The OpenVoxel spawn search, which repeatedly samples lake and pond recipes, ran 16 fixed seeds in about 6 seconds instead of 14 seconds in a local end-to-end test; the 128-seed regression also completes within its existing limit.
• velar run and velar test preserve a source dependency's actually used native JavaScript package exports and their relative module closure in the compiled sandbox. A package can use import js from its own declared npm subpath without losing that subpath when the CLI assembles the test package.

0.34.1 — 2026-09-27

Surfaces: core@0.10 · web@0.14 · node@0.17 · server@0.15 · desktop@0.10

Compiler performance

• Repeated enum comparisons on a local const copy no longer emit runtime narrowing checks after each branch. Optional enum copies still check for null; mutable variables, parameters, imports, and structural union facts keep their runtime checks. This removes eight redundant checks from the OpenVoxel chunk mesher's generated loop.
• Node and Web Worker calls let postMessage copy small caller-owned buffers directly while keeping the transferable snapshot path for large buffers. OpenVoxel's meshing requests avoid an extra full message clone without slowing large mesh replies. A failed message send releases its queue slot.

0.34.0 — 2026-09-13

Surfaces: core@0.10 · web@0.14 · node@0.17 · server@0.15 · desktop@0.10

Language — core@0.10

• readonly protects the qualified layer's slots. readonly List<State> preserves mutable State elements; List<readonly State> protects each element’s field slots; readonly List<readonly State> protects both layers. Records, Map, Set and Record follow the same rule through reads, callbacks and copies.
• readonly type State protects every own and inherited field slot. State and its explicit readonly view have equivalent slot contracts. Readonly slots and containers may hold classes and capabilities with their own behavior.
• A20 simplifies all-readonly record declarations; A21 removes redundant readonly qualifiers. Editor quick fixes and velar fix apply both while preserving nested qualifiers and comments.
• Runtime shape narrowing preserves existing required fields and writable value domains, including nested containers and readonly aliases.

... (truncated)

Commits

• ac43908 Release VelarScript 0.34.2 with source export and List iteration fixes
• 91d350a Release VelarScript 0.34.1 with compiler, worker, and CLI fixes
• ff53a6b Complete Core 0.10 regression fixtures and release evidence
• ef01370 Implement Core 0.10 contracts and runtime validation
• d2b426c release: VelarScript 0.33.1
• 298c855 fix(runtime): apply stack ownership to detached test reports
• 39fce34 fix(cli): preserve private and npm imports in browser test sandboxes
• ad67749 fix(runtime): pass test owner regions to detached error channels
• 9142de8 fix(cli): preserve native import owners in browser test sandboxes
• 56a3e70 fix(runtime): unify program error stacks across run and test
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)