@joshuafolkken/kit 1.3099.0 → 1.3125.0

package/dist/commands/chunk-6TC2ZMNB.js

@@ -0,0 +1,64 @@
+import {
+  timed_fetch
+} from "./chunk-5HVYOIIK.js";
+import {
+  error_text
+} from "./chunk-CDY4NFQG.js";
+import {
+  git_command
+} from "./chunk-KMED24C4.js";
+
+// scripts/sonar/sonar-project.ts
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+var SONAR_HOST = "https://sonarcloud.io";
+var PROPERTIES_FILE = "sonar-project.properties";
+var PROJECT_KEY_PREFIX = "sonar.projectKey=";
+var TOKEN_VARIABLE = "SONAR_TOKEN";
+var AUTHORIZATION_HEADER = "Authorization";
+function read_project_key(root) {
+  const file = path.join(root, PROPERTIES_FILE);
+  if (!existsSync(file)) return void 0;
+  const line = readFileSync(file, "utf8").split("\n").find((entry) => entry.startsWith(PROJECT_KEY_PREFIX));
+  return line?.slice(PROJECT_KEY_PREFIX.length).trim();
+}
+function api_url(api_path, query) {
+  return `${SONAR_HOST}${api_path}?${new URLSearchParams(query).toString()}`;
+}
+function request_init() {
+  const token = process.env[TOKEN_VARIABLE] ?? "";
+  return token === "" ? {} : { headers: [[AUTHORIZATION_HEADER, `Bearer ${token}`]] };
+}
+async function fetch_json(url, schema) {
+  try {
+    const response = await timed_fetch(url, request_init());
+    if (!response.ok) return { error: `HTTP ${String(response.status)}` };
+    return { data: schema.parse(await response.json()) };
+  } catch (error) {
+    return { error: error_text.message_of(error) };
+  }
+}
+async function resolve_target(argv, usage) {
+  const [pull_request] = argv;
+  if (pull_request === void 0 || pull_request.startsWith("-")) {
+    console.error(usage);
+    return void 0;
+  }
+  const project_key = read_project_key(await git_command.repository_root());
+  if (project_key === void 0) {
+    console.error(`no ${PROJECT_KEY_PREFIX} found in ${PROPERTIES_FILE}`);
+    return void 0;
+  }
+  return { project_key, pull_request };
+}
+var sonar_project = {
+  api_url,
+  fetch_json,
+  read_project_key,
+  request_init,
+  resolve_target
+};
+
+export {
+  sonar_project
+};

package/dist/commands/chunk-6TOHJZ4J.js

@@ -0,0 +1,224 @@
+import {
+  review_readers_scan
+} from "./chunk-W6MVQEMO.js";
+import {
+  git_grep_hits
+} from "./chunk-EWBEYTVS.js";
+import {
+  test_pinned_logic
+} from "./chunk-I36PDO6I.js";
+import {
+  COMMAND_MAP
+} from "./chunk-CCAVK7HN.js";
+import {
+  git_spawn
+} from "./chunk-LZNACCHR.js";
+
+// scripts/review/prose-stale-scan.ts
+var CODE_FILE = /\.(?:ts|js)$/u;
+var TEST_FILE = /\.test\.(?:ts|js)$/u;
+var IDENTIFIER_SHAPE = /[_\d]|[a-z][A-Z]/u;
+var REGEXP_SPECIAL = /[$()*+.?[\\\]^{|}]/gu;
+var BACKTICK = "`";
+var SPAN_PARITY = 2;
+var MARKDOWN_EXTENSION = ".md";
+var MARKDOWN_FILE = /\.md$/u;
+var COMMAND = /\bjosh\s+(?<command>[a-z][\w-]*:[\w:-]+)/gu;
+var UPPER_CASE = /^[A-Z][A-Z\d_]*[A-Z\d]$/u;
+var HEADING = /^#{1,6} (?<text>.+)$/u;
+var TOKEN = /[\w-]+(?::[\w-]+)*/gu;
+var COMMENT_LINE = /^\s*(?:\/[/*]|\*|#)/u;
+var OK_LINE = "ok";
+var FOUND_EXIT = 1;
+var FAILED_EXIT = 2;
+function to_terms(kind, words) {
+  return words.map((word) => ({ kind, word }));
+}
+function declared_names(source, is_deleted) {
+  if (is_deleted) return review_readers_scan.reachable_names(source);
+  return review_readers_scan.declarations(source).map((entry) => entry.name);
+}
+function code_terms(source, is_deleted) {
+  const declared = declared_names(source, is_deleted);
+  const listed = [...review_readers_scan.exported_names(source)];
+  const constants = declared.filter((name) => UPPER_CASE.test(name));
+  const names = [...declared.filter((name) => !UPPER_CASE.test(name)), ...listed];
+  return [...to_terms("name", names), ...to_terms("constant", constants)];
+}
+function command_terms(lines) {
+  const commands = lines.flatMap(
+    (line) => [...line.matchAll(COMMAND)].map((match) => match.groups?.["command"] ?? "")
+  );
+  return to_terms("command", commands);
+}
+function headings(lines) {
+  const texts = lines.map((line) => HEADING.exec(line)?.groups?.["text"]?.trim());
+  return texts.filter((text) => text !== void 0 && text !== "");
+}
+function declared_in(lines) {
+  return review_readers_scan.declarations(lines.join("\n")).map((entry) => entry.name);
+}
+function renamed_terms(hunk) {
+  const before = declared_in(hunk.old_lines);
+  const after = declared_in(hunk.new_lines ?? []);
+  const gone = before.filter((name) => !after.includes(name));
+  const fresh = after.filter((name) => !before.includes(name));
+  return gone.flatMap((word, index) => {
+    const renamed_to = fresh[index];
+    if (renamed_to === void 0) return [];
+    return [{ kind: UPPER_CASE.test(word) ? "constant" : "name", word, renamed_to }];
+  });
+}
+function hunk_terms(hunk, deleted) {
+  const lines = hunk.old_lines;
+  const is_code = CODE_FILE.test(hunk.file) && !TEST_FILE.test(hunk.file);
+  const source = lines.join("\n");
+  const code = is_code ? [...code_terms(source, deleted.has(hunk.file)), ...renamed_terms(hunk)] : [];
+  const titled = hunk.file.endsWith(MARKDOWN_EXTENSION) ? to_terms("heading", headings(lines)) : [];
+  return [...code, ...command_terms(lines), ...titled];
+}
+function added_lines(hunks, extension) {
+  return hunks.filter((hunk) => extension.test(hunk.file)).flatMap((hunk) => hunk.new_lines ?? []);
+}
+function kept_of(hunks, registered) {
+  const added = hunks.flatMap((hunk) => hunk.new_lines ?? []);
+  const titles = headings(added_lines(hunks, MARKDOWN_FILE));
+  const declared = declared_in(added_lines(hunks, CODE_FILE));
+  const tokens = added.flatMap((line) => [...line.matchAll(TOKEN)].map((match) => match[0]));
+  return {
+    tokens: new Set(tokens),
+    titles: new Set(titles),
+    declared: new Set(declared),
+    registered
+  };
+}
+function is_removed(term, kept) {
+  if (term.renamed_to !== void 0) return !kept.declared.has(term.word);
+  if (term.kind === "heading") return !kept.titles.has(term.word);
+  if (term.kind === "command" && kept.registered.has(term.word)) return false;
+  return !kept.tokens.has(term.word);
+}
+var EMPTY_TREE = { surviving: /* @__PURE__ */ new Set(), deleted: /* @__PURE__ */ new Set() };
+function stale_terms(hunks, registered, tree = EMPTY_TREE) {
+  const { surviving, deleted } = tree;
+  const kept = kept_of(hunks, registered);
+  const terms = hunks.flatMap((hunk) => hunk_terms(hunk, deleted));
+  const unique = new Map(terms.map((term) => [term.word, term]));
+  return [...unique.values()].filter((term) => !surviving.has(term.word) && is_removed(term, kept));
+}
+function pattern(term) {
+  if (term.kind === "heading") return { target: `"${term.word}"`, flags: [] };
+  return { target: term.word, flags: ["-w"] };
+}
+function is_prose(hit) {
+  return hit.path.endsWith(MARKDOWN_EXTENSION) || COMMENT_LINE.test(hit.excerpt);
+}
+function code_spans(excerpt) {
+  return excerpt.split(BACKTICK).filter((_span, index) => index % SPAN_PARITY === 1);
+}
+function code_shape(word) {
+  const shapes = [
+    String.raw`\.${word}(?![\w$])`,
+    String.raw`(?<![\w$])${word}\(`,
+    String.raw`\{\s*(?:[\w$]+\s*,\s*)*${word}\s*[,}]`,
+    String.raw`\bimport\s+${word}\s+from\b`
+  ];
+  return new RegExp(shapes.join("|"), "u");
+}
+function is_code_use(term, excerpt) {
+  if (term.kind !== "name" || IDENTIFIER_SHAPE.test(term.word)) return true;
+  const word = term.word.replaceAll(REGEXP_SPECIAL, String.raw`\$&`);
+  const whole = new RegExp(String.raw`(?<![\w$])${word}(?![\w$])`, "u");
+  return code_spans(excerpt).some((span) => whole.test(span)) || code_shape(word).test(excerpt);
+}
+function reference_lines(reference) {
+  const { kind, word, renamed_to } = reference.term;
+  const label = renamed_to === void 0 ? word : `${word} (renamed to ${renamed_to})`;
+  if (reference.has_failed) return [`search failed: ${kind} ${label}`];
+  return reference.hits.filter((hit) => is_prose(hit) && is_code_use(reference.term, hit.excerpt)).map((hit) => `${hit.path}:${hit.line} ${kind} ${label}`);
+}
+function exit_code_of(references2, lines) {
+  if (references2.some((reference) => reference.has_failed)) return FAILED_EXIT;
+  return lines.length > 0 ? FOUND_EXIT : 0;
+}
+function report(references2) {
+  const lines = references2.flatMap((reference) => reference_lines(reference));
+  return {
+    text: lines.length > 0 ? lines.join("\n") : OK_LINE,
+    exit_code: exit_code_of(references2, lines)
+  };
+}
+var prose_stale_scan = { CODE_FILE, FAILED_EXIT, pattern, report, stale_terms };
+
+// scripts/review/prose-stale-read.ts
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+var SEARCH_PATHS = ["*.md", "prompts", "docs", ".claude", "scripts", ":(exclude)CHANGELOG.md"];
+var CODE_PATHSPECS = ["*.ts", "*.js", ":(exclude)*.test.ts", ":(exclude)*.test.js"];
+async function read_hunks(root, base) {
+  const diff = await git_spawn.read([
+    "-C",
+    root,
+    "diff",
+    "-U0",
+    "--no-color",
+    "--no-ext-diff",
+    "--src-prefix=a/",
+    "--dst-prefix=b/",
+    base
+  ]);
+  return test_pinned_logic.all_hunks(diff);
+}
+async function reference_of(term, root) {
+  const { target, flags } = prose_stale_scan.pattern(term);
+  const { hits, has_failed } = await git_grep_hits.search(target, flags, SEARCH_PATHS, root);
+  return { term, hits, has_failed };
+}
+async function declared_in2(root, files) {
+  const sources = await Promise.all(
+    files.map(async (file) => await readFile(path.join(root, file), "utf8"))
+  );
+  return sources.flatMap(
+    (source) => review_readers_scan.declarations(source).map(({ name }) => name)
+  );
+}
+async function files_writing(root, names) {
+  const results = await Promise.all(
+    names.map(async (name) => await git_grep_hits.search(name, ["-w"], CODE_PATHSPECS, root))
+  );
+  const files = new Set(results.flatMap(({ hits }) => hits.map((hit) => hit.path)));
+  return [...files].filter((file) => existsSync(path.join(root, file)));
+}
+async function declared_elsewhere(root, hunks, deleted) {
+  const gone = hunks.filter((hunk) => deleted.includes(hunk.file));
+  const names = [
+    ...new Set(
+      gone.flatMap((hunk) => review_readers_scan.reachable_names(hunk.old_lines.join("\n")))
+    )
+  ];
+  const declared = new Set(await declared_in2(root, await files_writing(root, names)));
+  return names.filter((name) => declared.has(name));
+}
+async function tree_of(root, hunks) {
+  const files = [...new Set(hunks.map((hunk) => hunk.file))].filter(
+    (file) => prose_stale_scan.CODE_FILE.test(file)
+  );
+  const present = files.filter((file) => existsSync(path.join(root, file)));
+  const names = await declared_in2(root, present);
+  const deleted = files.filter((file) => !present.includes(file));
+  const elsewhere = await declared_elsewhere(root, hunks, deleted);
+  return { surviving: /* @__PURE__ */ new Set([...names, ...elsewhere]), deleted: new Set(deleted) };
+}
+async function references(root, hunks) {
+  const registered = new Set(Object.keys(COMMAND_MAP));
+  const tree = await tree_of(root, hunks);
+  const terms = prose_stale_scan.stale_terms(hunks, registered, tree);
+  return await Promise.all(terms.map(async (term) => await reference_of(term, root)));
+}
+var prose_stale_read = { read_hunks, references };
+
+export {
+  prose_stale_scan,
+  prose_stale_read
+};

package/dist/commands/chunk-6TOWGIY2.js

@@ -0,0 +1,127 @@
+import {
+  capped_output
+} from "./chunk-7HP3FQGQ.js";
+import {
+  git_gh_command
+} from "./chunk-VJNE7W7O.js";
+import {
+  issue_state
+} from "./chunk-HXM26K3O.js";
+import {
+  session_cite
+} from "./chunk-22DVQCP6.js";
+import {
+  issue_number_shape
+} from "./chunk-G75GWNNY.js";
+import {
+  cli_flags
+} from "./chunk-2FE3C4PH.js";
+
+// scripts/issue/issue-report-failures.ts
+var SUCCESS_EXIT_CODE = 0;
+var FAILURE_EXIT_CODE = 1;
+var UNCLASSIFIED_CAUSE = "a rate limit, expired auth, or a dropped connection";
+function print_blocks(blocks, separator, label) {
+  if (blocks.length === 0) return;
+  capped_output.capped_print(blocks.join(separator), label);
+}
+function report_failure(kind, issue_number, misreading, hint) {
+  if (kind === "missing") {
+    console.error(
+      `\u2716 issue ${session_cite.issue(issue_number)} does not resolve \u2014 check the number and the repository`
+    );
+  } else {
+    console.error(
+      `\u2716 could not read issue ${session_cite.issue(issue_number)} \u2014 ${hint ?? UNCLASSIFIED_CAUSE}. This is not "${misreading}"`
+    );
+  }
+}
+function is_failure_kind(kind) {
+  return kind === "missing" || kind === "unreadable";
+}
+function report_one_failure(report, terms) {
+  const { kind, hint } = report.result;
+  if (!is_failure_kind(kind)) return false;
+  report_failure(kind, report.issue_number, terms.misreading, hint);
+  return true;
+}
+function report_failures(reports, terms) {
+  let has_failure = false;
+  for (const report of reports) {
+    has_failure = report_one_failure(report, terms) || has_failure;
+  }
+  return has_failure ? FAILURE_EXIT_CODE : SUCCESS_EXIT_CODE;
+}
+var issue_report_failures = { print_blocks, report_failures };
+
+// scripts/issue/issue-state-cli.ts
+var FAILURE_EXIT_CODE2 = 1;
+var USAGE = "Usage: josh issue:state <issue-number> [<issue-number> ...] [--repo <owner/repo>]";
+var BLOCK_SEPARATOR = "\n\n";
+var STATE_FIELDS = "state,labels";
+var FAILURE_TERMS = { success_kind: "state", misreading: "the issue is open" };
+var OPTIONS = { repo: { type: "string", multiple: true } };
+function read_repo(given) {
+  if (given === void 0) return {};
+  const [repo, ...rest] = given;
+  return repo !== void 0 && rest.length === 0 && repo.length > 0 ? { repo } : void 0;
+}
+function is_issue_numbers(positionals) {
+  return positionals.length > 0 && positionals.every((argument) => issue_number_shape.is_issue_number(argument));
+}
+function parse_request(argv) {
+  const parsed = cli_flags.arguments_of(argv, OPTIONS);
+  if (parsed === void 0) return void 0;
+  const repo = read_repo(parsed.values.repo);
+  if (repo === void 0 || !is_issue_numbers(parsed.positionals)) return void 0;
+  return { issue_numbers: [...new Set(parsed.positionals)], ...repo };
+}
+async function read_issue(issue_number, repo) {
+  const read = await git_gh_command.issue_view_json_classified(issue_number, STATE_FIELDS, repo);
+  if (read.kind !== "read") return read;
+  const parsed = issue_state.parse_issue_state(read.json);
+  return parsed === void 0 ? { kind: "unreadable", reason: "malformed" } : { kind: "state", state: parsed };
+}
+async function read_all(request) {
+  return await Promise.all(
+    request.issue_numbers.map(async (issue_number) => ({
+      issue_number,
+      result: await read_issue(issue_number, request.repo)
+    }))
+  );
+}
+function state_blocks(report, should_attribute) {
+  if (report.result.kind !== "state") return [];
+  const { state } = report.result;
+  if (!should_attribute) return [issue_state.format_issue_state(state)];
+  return [issue_state.format_attributed_issue_state(report.issue_number, state)];
+}
+function print_states(reports) {
+  const should_attribute = reports.length > 1;
+  const blocks = reports.flatMap((report) => state_blocks(report, should_attribute));
+  issue_report_failures.print_blocks(blocks, BLOCK_SEPARATOR, "issue:state");
+}
+async function run(argv) {
+  const request = parse_request(argv);
+  if (request === void 0) {
+    console.error(USAGE);
+    return FAILURE_EXIT_CODE2;
+  }
+  const reports = await read_all(request);
+  print_states(reports);
+  return issue_report_failures.report_failures(reports, FAILURE_TERMS);
+}
+var issue_state_cli = {
+  REPO_OPTIONS: OPTIONS,
+  STATE_FIELDS,
+  USAGE,
+  parse_request,
+  read_issue,
+  read_repo,
+  run
+};
+
+export {
+  issue_report_failures,
+  issue_state_cli
+};

package/dist/commands/chunk-6TPGDOOD.js

@@ -0,0 +1,48 @@
+import {
+  run_step
+} from "./chunk-C3V6H6TW.js";
+
+// scripts/run/run-next.ts
+var ALREADY_DONE_STEP = "Issue is CLOSED \u2014 nothing to run. Verify it against merged code before starting.";
+var KEEP_WORK_STEP = 'Issue is CLOSED but this lane holds uncommitted work \u2014 stash it with `pnpm josh stash:push "<N>: uncommitted work at already-done"` before ending.';
+var LATEST_STEP = "Update dependencies first (latest: required), load the dependency-update skill, then implement.";
+var HUMAN_REVIEW_STEP = "Implement and run the verification gate, then STOP before the commit (needs-human-review).";
+var IMPLEMENT_STEP = "Implement, then run the verification gate (refactor, gate, /code-review).";
+var UNKNOWN_STEP = "State could not be read \u2014 resolve the failure in run:prep before deciding the next step.";
+var STEP_OF = {
+  "already-done": ALREADY_DONE_STEP,
+  "human-review": HUMAN_REVIEW_STEP,
+  implement: IMPLEMENT_STEP,
+  "keep-work": KEEP_WORK_STEP,
+  unknown: UNKNOWN_STEP,
+  "update-deps": LATEST_STEP
+};
+function to_input(parts) {
+  return {
+    state: parts.state?.state,
+    is_human_review: parts.state?.is_human_review ?? false,
+    latest_scope: parts.latest_scope,
+    has_changes: parts.has_changes
+  };
+}
+function next_step(input) {
+  return STEP_OF[run_step.pre_verdict(input)];
+}
+function format_report(parts) {
+  return next_step(to_input(parts));
+}
+var run_next = {
+  ALREADY_DONE_STEP,
+  HUMAN_REVIEW_STEP,
+  IMPLEMENT_STEP,
+  KEEP_WORK_STEP,
+  LATEST_STEP,
+  UNKNOWN_STEP,
+  format_report,
+  next_step,
+  to_input
+};
+
+export {
+  run_next
+};

package/dist/commands/chunk-6XXEW3NQ.js

@@ -0,0 +1,159 @@
+import {
+  repo_setting
+} from "./chunk-VBZ47BVH.js";
+
+// scripts/repo/auto-merge-setting-logic.ts
+var SETTING_LABEL = "Repository auto-merge";
+var ALLOW_AUTO_MERGE_FIELD = "allow_auto_merge";
+var ORIGIN_ISSUE = "joshuafolkken/kit#834";
+var WORKFLOW_PATH = ".github/workflows/dependabot-auto-merge.yml";
+function enable_command(repo) {
+  return `gh api -X PATCH repos/${repo_setting.command_target(repo)} -f ${ALLOW_AUTO_MERGE_FIELD}=true`;
+}
+function classify_auto_merge(exit_code, stdout) {
+  return repo_setting.classify_boolean_setting(
+    repo_setting.parse_payload(exit_code, stdout),
+    ALLOW_AUTO_MERGE_FIELD
+  );
+}
+function format_disabled_detail(repo) {
+  return [
+    `    off, so ${WORKFLOW_PATH} fails with`,
+    "    `Auto-merge is not allowed for this repository` and Dependabot pull requests stay open.",
+    `    Enable: ${enable_command(repo)}`,
+    `    ${ORIGIN_ISSUE} distributes the workflow; kit never changes this setting.`
+  ];
+}
+function format_unreadable_detail(repo) {
+  if (repo === void 0) {
+    return [
+      "    The repository could not be identified \u2014 `gh` is missing, unauthenticated, or this is",
+      "    not a GitHub remote."
+    ];
+  }
+  return [
+    "    No admin access, or the request failed (offline, timed out, or an unexpected response).",
+    "    Check Settings \u2192 General \u2192 Pull Requests \u2192 Allow auto-merge on the repository's page."
+  ];
+}
+function format_auto_merge_report(status, repo) {
+  const target = repo_setting.report_target(repo);
+  if (status === "enabled") return [`  \u2714 ${SETTING_LABEL}: enabled (${target})`];
+  if (status === "unreadable") {
+    return [
+      `  \u26A0 ${SETTING_LABEL}: could not be read (${target}) \u2014 not checked, not necessarily off`,
+      ...format_unreadable_detail(repo)
+    ];
+  }
+  return [`  \u26A0 ${SETTING_LABEL}: disabled (${target})`, ...format_disabled_detail(repo)];
+}
+var auto_merge_setting_logic = {
+  SETTING_LABEL,
+  classify_auto_merge,
+  format_auto_merge_report
+};
+
+// scripts/repo/auto-merge-setting.ts
+function read_auto_merge(repo) {
+  const { exit_code, stdout } = repo_setting.query_repo_api(`repos/${repo}`);
+  return auto_merge_setting_logic.classify_auto_merge(exit_code, stdout);
+}
+function report_auto_merge_section(repo) {
+  const status = repo === void 0 ? "unreadable" : read_auto_merge(repo);
+  repo_setting.print_section(auto_merge_setting_logic.format_auto_merge_report(status, repo));
+  return status;
+}
+var auto_merge_setting = {
+  GH_TIMEOUT_MS: repo_setting.GH_TIMEOUT_MS,
+  read_auto_merge,
+  report_auto_merge_section
+};
+
+// scripts/security/security-updates-logic.ts
+var SETTING_LABEL2 = "Dependabot security updates";
+var ENABLED_FIELD = "enabled";
+var PAUSED_FIELD = "paused";
+var ORIGIN_ISSUE2 = "joshuafolkken/kit#803";
+function enable_command2(repo) {
+  return `gh api -X PUT repos/${repo_setting.command_target(repo)}/automated-security-fixes`;
+}
+function classify_active(paused) {
+  if (paused === void 0) return "enabled";
+  if (typeof paused !== "boolean") return "unreadable";
+  return paused ? "paused" : "enabled";
+}
+function classify_security_updates(exit_code, stdout) {
+  const payload = repo_setting.parse_payload(exit_code, stdout);
+  const status = repo_setting.classify_boolean_setting(payload, ENABLED_FIELD);
+  if (status !== "enabled") return status;
+  return classify_active(repo_setting.read_field(payload, PAUSED_FIELD));
+}
+function is_exposed(status) {
+  return status === "disabled" || status === "paused";
+}
+function format_exposed_detail(status, repo) {
+  const remediation = status === "paused" ? [
+    "    enabled but paused, so no advisory pull request is opened.",
+    "    Resume it from the repository's Security \u2192 Dependabot page; re-running the enable",
+    "    API does not clear a pause."
+  ] : [
+    "    off, so npm advisories open no pull request at all.",
+    `    Enable: ${enable_command2(repo)}`
+  ];
+  return [
+    ...remediation,
+    `    ${ORIGIN_ISSUE2} disabled npm version updates, so this is the only remaining npm path.`
+  ];
+}
+function format_unreadable_detail2(repo) {
+  if (repo === void 0) {
+    return [
+      "    The repository could not be identified \u2014 `gh` is missing, unauthenticated, or this is",
+      "    not a GitHub remote."
+    ];
+  }
+  return [
+    "    No admin access, Dependabot not enabled for the repository, or the request failed",
+    "    (offline, timed out, or an unexpected response).",
+    "    Check the repository's Security \u2192 Dependabot page."
+  ];
+}
+function format_security_updates_report(status, repo) {
+  const target = repo_setting.report_target(repo);
+  if (status === "enabled") return [`  \u2714 ${SETTING_LABEL2}: enabled (${target})`];
+  if (!is_exposed(status)) {
+    return [
+      `  \u26A0 ${SETTING_LABEL2}: could not be read (${target}) \u2014 not checked, not necessarily off`,
+      ...format_unreadable_detail2(repo)
+    ];
+  }
+  return [`  \u26A0 ${SETTING_LABEL2}: ${status} (${target})`, ...format_exposed_detail(status, repo)];
+}
+var security_updates_logic = {
+  enable_command: enable_command2,
+  classify_security_updates,
+  is_exposed,
+  format_security_updates_report
+};
+
+// scripts/security/security-updates.ts
+var SECURITY_FIXES_PATH = "automated-security-fixes";
+function read_security_updates(repo) {
+  const { exit_code, stdout } = repo_setting.query_repo_api(`repos/${repo}/${SECURITY_FIXES_PATH}`);
+  return security_updates_logic.classify_security_updates(exit_code, stdout);
+}
+function report_security_updates_section(repo) {
+  const status = repo === void 0 ? "unreadable" : read_security_updates(repo);
+  repo_setting.print_section(security_updates_logic.format_security_updates_report(status, repo));
+  return status;
+}
+var security_updates = {
+  GH_TIMEOUT_MS: repo_setting.GH_TIMEOUT_MS,
+  read_security_updates,
+  report_security_updates_section
+};
+
+export {
+  auto_merge_setting,
+  security_updates
+};