build(deps-dev): bump @velarscript/cli from 0.18.0 to 0.33.1

[dependabot]

Bumps @velarscript/cli from 0.18.0 to 0.33.1.

Changelog

Sourced from @​velarscript/cli's changelog.

0.33.1 — 2026-09-08

Surfaces: core@0.9 · web@0.14 · node@0.17 · server@0.15 · desktop@0.10

Web runtime

• List, Map, Set, and record reads outside an active reactive observer no longer allocate empty dependency maps, subscriber sets, and cleanup closures. Tracked reads and observer cleanup retain their existing behavior, while collection-heavy non-reactive work creates substantially less temporary garbage and no longer accumulates unused key slots.

0.33.0 — 2026-09-08

Surfaces: core@0.9 · web@0.14 · node@0.17 · server@0.15 · desktop@0.10

Core adds advisory A19 for a Promise inspected before its result is awaited. The other surface counters stand. This release also completes diagnostic, library-output, and reference-documentation work from the 0.32.0 audit.

Language — core@0.9

• A19 flags a Promise passed to print, str, or an f-string, including optional/union values and immutable aliases of the builtins. Intentional inspection takes a reasoned velar-allow A19; the compiler does not insert await. Printing remains legal, while text conversions keep their existing type errors. Mutable or unrelated callees are not mistaken for builtins.
• Breaking: compile-time argument contracts share bounded scalar proofs: arithmetic, text concatenation, and immutable lexical bindings now expose invalid string indexes/counts and text patterns before execution. Web domId prefixes and Node static-file roots consume the same facts. Dynamic values remain runtime-checked; calls, mutable cells, and object members are not evaluated by this analysis.
• Invalid iterables poison both loop bindings, and non-convergent recursive results no longer cause a second text-conversion report. Wrong call shapes stop parameter inference and result propagation across ordinary, generic, collection, constructor, and intrinsic calls; independently invalid expressions inside the arguments still report. Literal checks run after a valid call plan and read its named-argument order.
• A uniquely misspelled record field or named parameter gets a precise mechanical rename, without the derivative missing-field report. The fix preserves shorthand values and avoids creating duplicate names; unrelated missing required fields remain visible. Field reads offer the same rename.
• Map(source) and Set(source) adopt compatible contextual element types at fresh construction sites. Shared mutable records and collections retain their invariant write contracts; fresh literals and readonly views keep their existing safe widening rules.
• Migration messages use the actual import aliases, export names, inferred function signatures, and declaration sites. Function replacements can be applied as written; unknown named arguments and refused imports point to

... (truncated)

Commits

• d2b426c release: VelarScript 0.33.1
• 298c855 fix(runtime): apply stack ownership to detached test reports
• 39fce34 fix(cli): preserve private and npm imports in browser test sandboxes
• ad67749 fix(runtime): pass test owner regions to detached error channels
• 9142de8 fix(cli): preserve native import owners in browser test sandboxes
• 56a3e70 fix(runtime): unify program error stacks across run and test
• 793283e fix(runtime): unify program traces and support test stack mode
• 911779b chore(release): prepare the 0.33.0 toolchain and core 0.9 surface
• d97b6a7 feat(compiler): share scalar contract proofs and warn about Promise inspection
• 8f35652 fix(cli): finish actionable project diagnostics and safe library commands
• Additional commits viewable in compare view

[dependabot]

Superseded by #10.