@visulima/vis 1.0.0-alpha.35 → 1.0.0-alpha.37

package/dist/packem_chunks/handler48.js

@@ -1,48 +1,322 @@
-var yt=Object.defineProperty;var T=(e,t)=>yt(e,"name",{value:t,configurable:!0});import{createRequire as vt}from"node:module";import{q as tt,I as nt,e as U,T as X,E as F,j as wt}from"../packem_shared/Table-3pFgIUZ2-DABgc6rj.js";import{M,l as B,B as Q,a as bt}from"../packem_shared/readFileSync-DseCu8sg-DEq4Fn3a.js";import{b0 as Rt,m as ne,t as Be,b8 as xt,G as q,bI as At,B as Ct,J as St,X as st,bJ as Et,bK as ot,i as xe,h as jt,a as Tt,c as Ot,j as It,bL as Dt,k as Pe,R as _,l as Ut,d as Ae,n as W,bM as Nt,s as ve,T as Bt,bN as Pt,bO as Vt,bP as Mt,bQ as _t}from"./bin.js";import{H as Ft,e as qt,Z as Ve}from"../packem_shared/ai-analysis-3QD_RS6F.js";import{k as Lt,s as ce,b as rt,R as Wt}from"../packem_shared/pm-runner-DmKT2FqF.js";import{r as Gt,b as Ht,p as zt}from"../packem_shared/resolve-explicit-Xue0oq8V.js";import{r as Kt,s as Jt}from"../packem_shared/typosquats-acxQ7blw.js";import{U as Yt,C as Xt,a as Me}from"../packem_shared/vis-update-app-D0QyGneK.js";import{h as it,P as at}from"../packem_shared/peer-warnings-EvSJ18gE.js";import{d as Zt}from"../packem_shared/utils-DrNg0XTR.js";import{r as tn,q as nn}from"../packem_shared/advisories-CGKZo9Rx.js";import{E as sn}from"./config.js";const kt=vt(import.meta.url),ie=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,Qe=T(e=>{if(typeof ie<"u"&&ie.versions&&ie.versions.node){const[t,n]=ie.versions.node.split(".").map(Number);if(t>22||t===22&&n>=3||t===20&&n>=16)return ie.getBuiltinModule(e)}return kt(e)},"__cjs_getBuiltinModule"),{createInterface:et}=Qe("node:readline"),{existsSync:Qt,realpathSync:en}=Qe("node:fs");var on=Object.defineProperty,ee=T((e,t)=>on(e,"name",{value:t,configurable:!0}),"s$1");const rn=ee(e=>{const t=[];for(const n of e.filters)t.push("--filter",n);return e.workspaceRoot&&t.push("--filter","."),t.push("update"),e.latest&&t.push("--latest"),e.recursive&&t.push("--recursive"),e.interactive&&t.push("--interactive"),e.dev&&t.push("--dev"),e.prod&&t.push("--prod"),e.noOptional&&t.push("--no-optional"),e.noSave&&t.push("--no-save"),t.push(...e.packages),{args:t,bin:"pnpm"}},"resolvePnpm"),an=ee(e=>{const t=[];return e.filters.length>0&&t.push("workspace",e.filters[0]),t.push("upgrade"),e.latest&&t.push("--latest"),t.push(...e.packages),{args:t,bin:"yarn"}},"resolveYarnV1"),cn=ee(e=>{const t=[];if(e.filters.length>0||e.recursive){t.push("workspaces","foreach","--all");for(const n of e.filters)t.push("--include",n)}return t.push("up"),e.interactive&&t.push("--interactive"),t.push(...e.packages),{args:t,bin:"yarn"}},"resolveYarnBerry"),ln=ee((e,t)=>{const n=["update"];e.latest&&t.push("npm does not support --latest flag. Packages will be updated within their semver range."),e.interactive&&t.push("npm does not support --interactive mode.");for(const s of e.filters)n.push("--workspace",s);return e.recursive&&n.push("--workspaces"),e.workspaceRoot&&n.push("--include-workspace-root"),e.dev&&n.push("--dev"),e.prod&&n.push("--production"),e.noOptional&&n.push("--no-optional"),e.noSave&&n.push("--no-save"),n.push(...e.packages),{args:n,bin:"npm"}},"resolveNpm"),un=ee(e=>{const t=["update"];e.latest&&t.push("--latest");for(const n of e.filters)t.push("--filter",n);return t.push(...e.packages),{args:t,bin:"bun"}},"resolveBun"),dn=ee((e,t)=>{const n=["outdated","--update"];return e.latest&&n.push("--latest"),e.interactive&&n.push("--interactive"),e.filters.length>0&&t.push("deno outdated has no --filter flag; ignoring."),(e.dev||e.prod)&&t.push("deno outdated has no --dev / --prod flags; dev/prod is governed by deno.json."),e.noOptional&&t.push("deno outdated has no --no-optional flag; ignoring."),e.noSave&&t.push("deno outdated has no --no-save flag; ignoring."),n.push(...e.packages),{args:n,bin:"deno"}},"resolveDeno"),pn=ee((e,t,n)=>{const s=[];if(n.global&&e!=="aube"&&e!=="deno")return{command:{args:["update","--global",...n.packages],bin:"npm"},warnings:s};let r;switch(e){case"aube":{const o=Lt(n);r={args:o.args,bin:o.bin},s.push(...o.warnings);break}case"bun":{r=un(n);break}case"deno":{r=dn(n,s);break}case"npm":{r=ln(n,s);break}case"pnpm":{r=rn(n);break}case"yarn":{r=t.startsWith("1.")?an(n):cn(n);break}default:{const o=e;throw new Error(`Unsupported package manager: ${String(o)}`)}}return{command:r,warnings:s}},"resolveUpdateCommand");var fn=Object.defineProperty,z=T((e,t)=>fn(e,"name",{value:t,configurable:!0}),"d$2");const ct=z(e=>{const t=e.indexOf("@");return t<=0?e:e.slice(0,t)},"stripVersionSpec"),gn=z(e=>{switch(e){case"docker":case"docker-compose":return"docker";case"github-actions":return"actions";case"gitlab-ci":return"gitlab";default:return}},"mapDependabotEcosystem"),mn=z((e,t)=>{const n=[".github/dependabot.yml",".github/dependabot.yaml"];for(const s of n){const r=M(e,s);if(!B(r))continue;let o;try{o=Rt(Q(r))}catch{continue}if(o?.updates){for(const i of o.updates){const a=gn(i["package-ecosystem"]);if(!(!a||!Array.isArray(i.ignore)))for(const d of i.ignore){const l=d["dependency-name"];typeof l=="string"&&l.length>0&&t[a].add(ct(l))}}return}}},"loadDependabot"),hn=Object.freeze({"docker-compose":"docker",dockerfile:"docker","github-actions":"actions",gitlabci:"gitlab","gitlabci-include":"gitlab"}),$n=Object.freeze({docker:"docker","github-tags":"actions"}),Ce=z((e,t)=>{if(t)for(const n of t)typeof n=="string"&&n.length>0&&e.add(ct(n))},"addAll"),yn=z(e=>{let t="",n=0;const{length:s}=e;let r=!1,o="";for(;n<s;){const i=e[n]??"";if(r){if(t+=i,i==="\\"&&n+1<s){t+=e[n+1]??"",n+=2;continue}i===o&&(r=!1),n+=1;continue}if(i==='"'||i==="'"){r=!0,o=i,t+=i,n+=1;continue}if(i==="/"&&e[n+1]==="/"){for(;n<s&&e[n]!==`
-`;)n+=1;continue}if(i==="/"&&e[n+1]==="*"){for(n+=2;n<s&&!(e[n]==="*"&&e[n+1]==="/");)n+=1;n+=2;continue}if(i===","){let a=n+1;for(;a<s&&/\s/.test(e[a]??"");)a+=1;const d=e[a];if(d==="}"||d==="]"){n+=1;continue}}t+=i,n+=1}return t},"stripJsonComments"),vn=z((e,t)=>{const n=["renovate.json","renovate.json5",".renovaterc",".renovaterc.json"];for(const s of n){const r=M(e,s);if(!B(r))continue;let o;try{const a=Q(r);o=JSON.parse(yn(a))}catch{continue}if(!o)continue;if(Array.isArray(o.ignoreDeps))for(const a of["actions","docker","gitlab"])Ce(t[a],o.ignoreDeps);const i=[["github-actions","actions"],["dockerfile","docker"],["docker-compose","docker"],["gitlabci","gitlab"],["gitlabci-include","gitlab"]];for(const[a,d]of i){const l=o[a];Ce(t[d],l?.ignoreDeps)}if(!Array.isArray(o.packageRules))return;for(const a of o.packageRules){if(a.enabled!==!1)continue;const d=new Set;for(const c of a.matchManagers??[]){const f=hn[c];f&&d.add(f)}for(const c of a.matchDatasources??[]){const f=$n[c];f&&d.add(f)}d.size===0&&(d.add("actions"),d.add("docker"),d.add("gitlab"));const l=[...a.matchPackageNames??[],...a.matchDepNames??[],...a.matchPackagePatterns??[]];for(const c of d)Ce(t[c],l)}return}},"loadRenovate"),kn=z(e=>{const t={actions:new Set,docker:new Set,gitlab:new Set};return mn(e,t),vn(e,t),t},"loadIgnoreRules"),je=z((e,t,n)=>{const s=n[t];if(s.size===0)return!1;if(s.has(e))return!0;for(const r of s)if(/[*?[\]/.+]/.test(r))try{const o=r.replaceAll(/[.+^${}()|]/g,String.raw`\$&`).replaceAll("*",".*").replaceAll("?",".");if(new RegExp(`^${o}$`).test(e))return!0}catch{}return!1},"isIgnored");var wn=Object.defineProperty,ke=T((e,t)=>wn(e,"name",{value:t,configurable:!0}),"o$2");const G=ke(e=>{const t=e.trim();if(t==="")return;const n=t.startsWith("v")||t.startsWith("V")?t.slice(1):t,s=(ce.valid(n)?ce.parse(n):void 0)??ce.coerce(n,{includePrerelease:!0});if(s)return{major:s.major,minor:s.minor,normalized:`${String(s.major)}.${String(s.minor)}.${String(s.patch)}${s.prerelease.length>0?`-${s.prerelease.join(".")}`:""}`,patch:s.patch,prerelease:s.prerelease.length>0,raw:t}},"parseTag"),bn=ke((e,t)=>ce.rcompare(e.normalized,t.normalized),"compareTagsDesc"),Te=ke((e,t,n,s)=>{if(!t&&n!=="latest")return;const r=e.filter(o=>!s&&o.prerelease?!1:t?n==="patch"&&(o.major!==t.major||o.minor!==t.minor)||n==="minor"&&o.major!==t.major?!1:ce.gt(o.normalized,t.normalized):!0);if(r.length!==0)return r.toSorted(bn)[0]},"pickBestTag"),Oe=ke((e,t)=>!e||!t?"unknown":t.major!==e.major?"major":t.minor!==e.minor?"minor":t.patch!==e.patch?"patch":"unknown","classifyUpdate");var Rn=Object.defineProperty,Ie=T((e,t)=>Rn(e,"name",{value:t,configurable:!0}),"n$1");const xn="GitHub Actions",_e=Ie((e,t)=>`${e}@${t}`,"keyOf"),An=Ie(e=>({fixedVersions:e.fixedVersions,id:e.id,severity:e.severity,summary:e.summary}),"toAdvisory"),Cn=Ie((e,t)=>{if(t.length===0)return t;const n=tn(e);if(!Qt(n))return t;const s=new Map;for(const o of t){const i=o.currentVersion??o.currentRef;i&&s.set(_e(o.name,i),{name:o.name,version:i})}if(s.size===0)return t;const r=new Map;try{for(const[o,i]of s){const a=nn([i],{ecosystem:xn,workspaceRoot:e}).get(i.name);a&&a.length>0&&r.set(o,a)}}catch{return t}return r.size===0?t:t.map(o=>{const i=o.currentVersion??o.currentRef;if(!i)return o;const a=r.get(_e(o.name,i));return a?{...o,advisories:a.map(d=>An(d))}:o})},"decorateActionsAdvisories");var Sn=Object.defineProperty,En=T((e,t)=>Sn(e,"name",{value:t,configurable:!0}),"n");const lt=En(e=>{if(!e)return{};const t={};for(const n of e.split(",")){const s=/^\s*<([^>]+)>\s*;\s*(.+)$/.exec(n);if(!s)continue;const r=s[1]??"",o=s[2]??"";switch(/rel\s*=\s*"?([^";\s]+)"?/i.exec(o)?.[1]?.toLowerCase()){case"first":{t.first=r;break}case"last":{t.last=r;break}case"next":{t.next=r;break}case"prev":case"previous":{t.previous=r;break}}}return t},"parseLinkHeader");var jn=Object.defineProperty,Tn=T((e,t)=>jn(e,"name",{value:t,configurable:!0}),"l");class On{static{T(this,"ActionsResolver")}static{Tn(this,"ActionsResolver")}token;apiBase;fetchImpl;tagsCache=new Map;commitCache=new Map;constructor(t){this.token=t.token??process.env.GITHUB_TOKEN??process.env.GH_TOKEN,this.apiBase=t.apiBase??"https://api.github.com",this.fetchImpl=t.fetch??fetch}async listTags(t,n){const s=`${t}/${n}`,r=this.tagsCache.get(s);if(r)return r;const o=this.fetchTags(t,n);return this.tagsCache.set(s,o),o}async resolveRef(t,n,s){const r=`${t}/${n}@${s}`,o=this.commitCache.get(r);if(o)return o;const i=this.fetchCommit(t,n,s);return this.commitCache.set(r,i),i}buildHeaders(){const t={Accept:"application/vnd.github+json","User-Agent":"vis-update-actions","X-GitHub-Api-Version":"2022-11-28"};return this.token&&(t.Authorization=`Bearer ${this.token}`),t}async fetchTags(t,n){const s=`${this.apiBase}/repos/${encodeURIComponent(t)}/${encodeURIComponent(n)}/tags?per_page=100`,r={parsed:[],tags:[]},o=[];let i=s,a=0;for(;i&&a<5;){const l=i;let c;try{c=await this.fetchImpl(l,{headers:this.buildHeaders()})}catch{return r}if(!c.ok)return r;let f;try{f=await c.json()}catch{return r}if(!Array.isArray(f))return r;for(const g of f){const m=typeof g.name=="string"?g.name:"",h=typeof g.commit?.sha=="string"?g.commit.sha:"";m!==""&&h!==""&&o.push({name:m,sha:h})}i=lt(c.headers.get("link")).next,a+=1}const d=[];for(const l of o){const c=G(l.name);c&&d.push({...c,sha:l.sha})}return{parsed:d,tags:o}}async fetchCommit(t,n,s){const r=`${this.apiBase}/repos/${encodeURIComponent(t)}/${encodeURIComponent(n)}/commits/${encodeURIComponent(s)}`;try{const o=await this.fetchImpl(r,{headers:this.buildHeaders()});if(!o.ok)return;const i=await o.json();return typeof i.sha!="string"?void 0:{committedAt:i.commit?.committer?.date,sha:i.sha}}catch{return}}}var In=Object.defineProperty,ue=T((e,t)=>In(e,"name",{value:t,configurable:!0}),"f$1");const Dn=".github/workflows",Un=".github/actions",Nn=/^\s*-?\s*uses:\s*(['"]?)([^'"\s#]+)\1(?:\s*#\s*(.+))?\s*$/,Bn=/^[a-f0-9]{40}$/i,Pn=/actions-up-ignore-next-line(?::\s*(.+))?/i,Vn=/actions-up-ignore-start/i,Mn=/actions-up-ignore-end/i,_n=ue(e=>{const t=e.split("/");if(t.length<2)return;const[n,s,...r]=t;if(!(!n||!s))return{owner:n,repo:s,subpath:r.length>0?r.join("/"):void 0}},"splitSlug"),Fn=ue((e,t)=>{const n=t.split(/\r?\n/),s=[];let r,o=!1;for(const[i,a]of n.entries()){const d=a??"";if(Vn.test(d)&&(o=!0),Mn.test(d)){o=!1;continue}const l=d.trim(),c=l===""||l.startsWith("#")?Pn.exec(d):void 0;if(c){r=c[1]??"actions-up-ignore-next-line";continue}const f=Nn.exec(d);if(!f){r=void 0;continue}const g=f[1]??"",m=g==="'"||g==='"'?g:"",h=f[2]??"",x=f[3]?.trim();if(h.startsWith("./")||h.startsWith("../")||h.startsWith("docker://")){r=void 0;continue}const b=h.lastIndexOf("@");if(b<=0){r=void 0;continue}const v=h.slice(0,b),k=h.slice(b+1),w=_n(v);if(!w){r=void 0;continue}let p=r??(o?"actions-up-ignore-block":void 0);if(x){const $=/^actions-up-ignore(?:-next-line)?(?::\s*(.+))?(?:\s|$)/i.exec(x);$&&(p=p??$[1]??"actions-up-ignore")}r=void 0,s.push({file:e,ignoreReason:p,isSha:Bn.test(k),line:i+1,original:`${m}${h}${m}`,owner:w.owner,quote:m,ref:k,repo:w.repo,slug:v,subpath:w.subpath,trailingComment:x&&!p?x:void 0})}return s},"extractUsesFromContent"),Fe=ue(e=>e.endsWith(".yml")||e.endsWith(".yaml"),"isWorkflowFile"),qn=ue((e,t=[])=>{const n=[],s=new Set,r=ue(a=>{if(s.has(a))return;s.add(a);let d;try{d=Q(a)}catch{return}const l=Fn(a,d);n.push(...l)},"collectFile"),o=M(e,Dn);if(B(o))for(const a of ne(o,{includeDirs:!1,includeSymlinks:!1,maxDepth:1}))Fe(a.name)&&r(a.path);const i=M(e,Un);if(B(i))for(const a of ne(i,{includeDirs:!1,includeSymlinks:!1,maxDepth:3}))(a.name==="action.yml"||a.name==="action.yaml")&&r(a.path);for(const a of["action.yml","action.yaml"]){const d=M(e,a);B(d)&&r(d)}for(const a of t){const d=bt(a)?a:M(e,a);if(B(d))for(const l of ne(d,{includeDirs:!1,includeSymlinks:!1}))Fe(l.name)&&r(l.path)}return n},"scanActionsRepository");var Ln=Object.defineProperty,de=T((e,t)=>Ln(e,"name",{value:t,configurable:!0}),"p$2");const Wn=40,Gn=1440*60*1e3,Hn=new Set(["develop","edge","main","master","stable","trunk"]),zn=de(e=>e.length===Wn&&/^[a-f0-9]{40}$/i.test(e)?!1:Hn.has(e.toLowerCase())?!0:G(e)===void 0,"looksLikeBranch"),qe=de((e,t)=>{for(const n of t)try{if(new RegExp(n).test(e))return!0}catch{if(e.includes(n))return!0}return!1},"matchesPattern"),Kn=de((e,t,n,s)=>{const r=s==="sha"||e.isSha,{quote:o}=e;return r?`${o}${e.slug}@${t}${o} # ${n}`:`${o}${e.slug}@${n}${o}`},"buildReplacement"),Jn=de(async(e,t)=>{const{ignoreRules:n,options:s,references:r,resolverOptions:o}=t,i=[],a=[],d=[];if(r.length===0)return{failed:d,ignored:a,updates:i};const l=new On({apiBase:o?.apiBase,fetch:o?.fetch,token:s.githubToken??o?.token}),c=new Map;for(const v of r){const k=`${v.owner}/${v.repo}`,w=c.get(k)??[];w.push(v),c.set(k,w)}const f=Math.max(1,s.maxConcurrentRequests),g=[...c.keys()];let m=0;const h=de(async v=>{const k=c.get(v)??[],[w,p]=v.split("/");if(!w||!p)return;let $;try{$=await l.listTags(w,p)}catch{for(const u of k)d.push({file:u.file,reason:`failed to list tags for ${v}`});return}for(const u of k){const A=u.slug;let y;if(u.ignoreReason?y=u.ignoreReason:qe(A,s.exclude)?y="matched --exclude":s.include.length>0&&!qe(A,s.include)?y="not matched by --include":s.respectDependabotConfig&&n&&je(A,"actions",n)&&(y="ignored by dependabot/renovate config"),y){a.push({currentRef:u.ref,currentVersion:u.isSha?u.trailingComment?.replace(/^#\s*/,""):u.ref,ecosystem:"actions",file:u.file,ignored:!0,line:u.line,name:A,newRef:u.ref,newVersion:void 0,original:u.original,reason:y,replacement:u.original,updateType:"unknown"});continue}if(!s.includeBranches&&!u.isSha&&zn(u.ref)){a.push({currentRef:u.ref,currentVersion:u.ref,ecosystem:"actions",file:u.file,ignored:!0,line:u.line,name:A,newRef:u.ref,newVersion:void 0,original:u.original,reason:"branch reference (use --include-branches)",replacement:u.original,updateType:"unknown"});continue}const j=u.isSha?u.trailingComment?.replace(/^#\s*/,"").split(/\s+/)[0]??"":u.ref,R=G(j);if(u.isSha&&!R&&s.mode!=="latest"){a.push({currentRef:u.ref,currentVersion:void 0,ecosystem:"actions",file:u.file,ignored:!0,line:u.line,name:A,newRef:u.ref,newVersion:void 0,original:u.original,reason:`SHA pin has no version-hint comment; cannot apply --target=${s.mode}`,replacement:u.original,updateType:"unknown"});continue}const S=Te($.parsed,R,s.mode,!1);if(!S)continue;if(s.minAgeDays!==void 0){const O=await l.resolveRef(w,p,S.sha),K=O?.committedAt?new Date(O.committedAt).getTime():void 0;if(K&&(Date.now()-K)/Gn<s.minAgeDays){a.push({currentRef:u.ref,currentVersion:R?.raw,ecosystem:"actions",file:u.file,ignored:!0,line:u.line,name:A,newRef:u.ref,newVersion:S.raw,original:u.original,reason:`release younger than ${String(s.minAgeDays)} days`,replacement:u.original,updateType:"unknown"});continue}}const E=s.style==="sha"||u.isSha?S.sha:S.raw,P=Kn(u,S.sha,S.raw,s.style);i.push({currentRef:u.ref,currentVersion:R?.raw??u.trailingComment?.replace(/^#\s*/,""),ecosystem:"actions",file:u.file,line:u.line,name:A,newRef:E,newVersion:S.raw,original:u.original,replacement:P,updateType:Oe(R,S),url:`https://github.com/${w}/${p}/releases/tag/${S.raw}`})}},"processGroup"),x=[];for(let v=0;v<Math.min(f,g.length);v++)x.push((async()=>{for(;m<g.length;){const k=g[m];m+=1,k!==void 0&&await h(k)}})());await Promise.all(x);const b=Cn(e,i);return{failed:d,ignored:a,updates:b}},"checkActions");var Yn=Object.defineProperty,ut=T((e,t)=>Yn(e,"name",{value:t,configurable:!0}),"u$3");const Xn=ut(e=>e.toSorted((t,n)=>t.file!==n.file?t.file<n.file?-1:1:t.line-n.line),"orderUpdates"),Zn=ut(e=>{const t=[],n=[];if(e.length===0)return{applied:t,skipped:n};const s=Xn(e),r=new Map;for(const o of s){const i=r.get(o.file)??[];i.push(o),r.set(o.file,i)}for(const[o,i]of r){let a;try{a=Q(o)}catch(g){for(const m of i)n.push({reason:`read failed: ${g.message}`,update:m});continue}const d=a.includes(`\r
-`)?`\r
-`:`
-`,l=a.split(/\r?\n/),c=[];for(const g of i){const m=g.line-1,h=l[m];if(h===void 0){n.push({reason:`line ${String(g.line)} out of range`,update:g});continue}const x=h.indexOf(g.original);if(x===-1){n.push({reason:"original token not found on expected line",update:g});continue}const b=h.slice(0,x),v=h.slice(x+g.original.length),k=/#\s*v?\d/.test(g.replacement)&&/^\s*#\s*v?\d[\w.+-]*\s*$/i.test(v)?"":v;l[m]=`${b}${g.replacement}${k}`,c.push(g)}if(c.length===0)continue;const f=l.join(d);try{sn(o,f),t.push(...c)}catch(g){for(const m of c)n.push({reason:`write failed: ${g.message}`,update:m})}}return{applied:t,skipped:n}},"applyEcosystemUpdates");var Qn=Object.defineProperty,me=T((e,t)=>Qn(e,"name",{value:t,configurable:!0}),"u$2");class es{static{T(this,"DockerRegistry")}static{me(this,"DockerRegistry")}tokens;fetchImpl;tagCache=new Map;constructor(t={}){this.tokens=t.tokens??{},this.fetchImpl=t.fetch??fetch}async listTags(t,n,s){const r=`${t}/${n}/${s}`,o=this.tagCache.get(r);if(o)return o;const i=t==="docker.io"?this.listDockerHubTags(n,s):this.listV2Tags(t,n,s);return this.tagCache.set(r,i),i}async listDockerHubTags(t,n){const s={parsed:[],raw:[]},r=[],o=new Map;let i=`https://hub.docker.com/v2/repositories/${encodeURIComponent(t)}/${encodeURIComponent(n)}/tags?page_size=100`,a=0;for(;i&&a<5;){try{const d=await this.fetchImpl(i,{headers:{Accept:"application/json"}});if(!d.ok)break;const l=await d.json();if(Array.isArray(l.results)){for(const c of l.results)if(typeof c.name=="string"&&(r.push(c.name),typeof c.last_updated=="string")){const f=Date.parse(c.last_updated);Number.isNaN(f)||o.set(c.name,f)}}i=typeof l.next=="string"?l.next:void 0}catch{break}a+=1}return r.length===0?s:{parsed:r.map(d=>{const l=G(d);if(l)return{...l,lastUpdated:o.get(d)}}).filter(d=>d!==void 0),raw:r}}async listV2Tags(t,n,s){const r={parsed:[],raw:[]},o=n==="library"?s:`${n}/${s}`,i={Accept:"application/json"},a=this.tokens[t]??process.env[`DOCKER_REGISTRY_TOKEN_${t.toUpperCase().replaceAll(/[^A-Z0-9]/g,"_")}`];a&&(i.Authorization=`Bearer ${a}`);const d=`https://${t}`,l=[];let c=`${d}/v2/${o}/tags/list?n=100`,f=i,g=0;const m=me(()=>{const h=[];for(const x of l){const b=G(x);b&&h.push({...b,lastUpdated:void 0})}return{parsed:h,raw:l}},"buildResult");for(;c&&g<5;){try{let h=await this.fetchImpl(c,{headers:f});if(h.status===401&&f===i){const v=ns(h.headers.get("www-authenticate"));if(v){const k=await this.fetchBearerToken(v);k&&(f={...i,Authorization:`Bearer ${k}`},h=await this.fetchImpl(c,{headers:f}))}}if(!h.ok)return g===0?r:m();const x=await h.json();if(!Array.isArray(x.tags))return g===0?r:m();for(const v of x.tags)typeof v=="string"&&l.push(v);const b=lt(h.headers.get("link"));c=b.next?new URL(b.next,d).toString():void 0}catch{return g===0?r:m()}g+=1}return l.length===0?r:m()}async fetchBearerToken(t){const n=new URLSearchParams({scope:t.scope,service:t.service}),s=`${t.realm}?${n.toString()}`;try{const r=await this.fetchImpl(s,{headers:{Accept:"application/json"}});if(!r.ok)return;const o=await r.json();return o.token??o.access_token}catch{return}}}const ts=me(e=>{const t=[];let n=0;const{length:s}=e;for(;n<s;){for(;n<s&&/\s/.test(e[n]??"");)n+=1;const r=n;for(;n<s&&e[n]!=="="&&e[n]!==",";)n+=1;const o=e.slice(r,n).trim();if(e[n]!=="="){for(;n<s&&e[n]!==",";)n+=1;n+=1;continue}n+=1;let i="";if(e[n]==='"'){for(n+=1;n<s&&e[n]!=='"';){if(e[n]==="\\"&&n+1<s){i+=e[n+1]??"",n+=2;continue}i+=e[n]??"",n+=1}n+=1}else{for(;n<s&&e[n]!==",";)i+=e[n]??"",n+=1;i=i.trim()}for(o.length>0&&t.push({key:o,value:i});n<s&&(/\s/.test(e[n]??"")||e[n]===",");)n+=1}return t},"splitAuthParams"),ns=me(e=>{if(!e)return;const t=/^Bearer\s+(.*)$/i.exec(e);if(!t)return;const n=new Map;for(const{key:o,value:i}of ts(t[1]??""))n.set(o.toLowerCase(),i);const s=n.get("realm"),r=n.get("service");if(s)return{realm:s,scope:n.get("scope")??"",service:r??""}},"parseAuthenticate");var ss=Object.defineProperty,H=T((e,t)=>ss(e,"name",{value:t,configurable:!0}),"d$1");const os="docker.io",rs="sha256:",he=H(e=>{const t=e.trim();if(t===""||t.startsWith("$")||t.includes("${")||t.includes("$("))return;let n=t,s;const r=n.indexOf(`@${rs}`);r!==-1&&(s=n.slice(r+1),n=n.slice(0,r));let o=os,i=n;const a=n.indexOf("/");if(a>0){const h=n.slice(0,a);(h==="localhost"||h.includes(".")||h.includes(":"))&&(o=h,i=n.slice(a+1))}let d="latest",l=i;const c=i.lastIndexOf(":");c!==-1&&!i.slice(c).includes("/")&&(d=i.slice(c+1),l=i.slice(0,c));let f="library",g=l;const m=l.indexOf("/");if(m!==-1&&(f=l.slice(0,m),g=l.slice(m+1)),g!=="")return{digest:s,name:g,namespace:f,original:t,registry:o,tag:d}},"parseImageReference"),$e=/vis-update-ignore-next-line/i,dt=/vis-update-ignore(?:\s|$|:)/i,pt=H(e=>{const t=e.trim();return t===""||t.startsWith("#")},"isCommentOnlyLine"),is=/^\s*FROM\s+(?:--\S+\s+)*([^\s#]+)(?:\s[^#]*)?(#.*)?$/i,as=H((e,t)=>{const n=t.split(/\r?\n/),s=[];let r=!1;for(const[o,i]of n.entries()){if($e.test(i)&&pt(i)){r=!0;continue}const a=is.exec(i);if(!a){i.trim()!==""&&!i.trim().startsWith("#")&&(r=!1);continue}const d=a[1]??"";if(d==="scratch"){r=!1;continue}const l=a[2]?.trim();let c=r?"vis-update-ignore-next-line":void 0;l&&$e.test(l)?c=c??"vis-update-ignore-next-line":l&&dt.test(l)&&(c=c??"vis-update-ignore");const f=he(d);r=!1,f&&s.push({...f,file:e,ignoreReason:c,kind:"dockerfile",line:o+1})}return s},"extractFromDockerfile"),cs=/^\s*image:\s*(['"]?)([^'"\s#]+)\1(\s*#.*)?$/,ls=H((e,t)=>{const n=t.split(/\r?\n/),s=[];let r=!1;for(const[o,i]of n.entries()){if($e.test(i)&&pt(i)){r=!0;continue}const a=cs.exec(i);if(!a){i.trim()!==""&&!i.trim().startsWith("#")&&(r=!1);continue}const d=a[2]??"",l=a[3]?.trim();let c=r?"vis-update-ignore-next-line":void 0;l&&$e.test(l)?c=c??"vis-update-ignore-next-line":l&&dt.test(l)&&(c=c??"vis-update-ignore");const f=he(d);r=!1,f&&s.push({...f,file:e,ignoreReason:c,kind:"compose",line:o+1})}return s},"extractFromCompose"),Le=H(e=>{const t=e.toLowerCase();return t==="dockerfile"||t.startsWith("dockerfile.")?!0:t.endsWith(".dockerfile")},"isDockerfile"),us=H(e=>{const t=e.toLowerCase();return/^(?:docker-)?compose(?:\..+)?\.ya?ml$/.test(t)},"isComposeFile"),ds=new Set([".cache",".git",".nx",".pnpm-store",".turbo","build","dist","node_modules"]),ps=/(?:^|\/)(?:\.git|node_modules|\.pnpm-store|\.turbo|\.nx|dist|build|\.cache)(?:\/|$)/,fs=H(e=>{const t=[];if(!B(e))return t;const n=new Set,s=H((r,o)=>{let i;try{i=en.native(r)}catch{i=r}if(n.has(i))return;n.add(i);let a;try{a=Q(r)}catch{return}t.push(...o==="dockerfile"?as(r,a):ls(r,a))},"collect");for(const r of ne(e,{includeDirs:!1,includeSymlinks:!1,skip:[ps]})){const{name:o}=r;ds.has(o)||(Le(o)?s(r.path,"dockerfile"):us(o)&&s(r.path,"compose"))}for(const r of["Dockerfile","dockerfile","compose.yml","compose.yaml","docker-compose.yml","docker-compose.yaml"]){const o=M(e,r);B(o)&&s(o,Le(r)?"dockerfile":"compose")}return t},"scanDockerRepository");var gs=Object.defineProperty,Z=T((e,t)=>gs(e,"name",{value:t,configurable:!0}),"c");const ms=864e5,We=Z((e,t)=>{for(const n of t)try{if(new RegExp(n).test(e))return!0}catch{if(e.includes(n))return!0}return!1},"matchesPattern"),Ge=Z(e=>{const t=e.namespace==="library"?e.name:`${e.namespace}/${e.name}`;return e.registry==="docker.io"?t:`${e.registry}/${t}`},"displayName"),hs=Z(e=>e.digest!==void 0&&e.digest.length>0,"hasDigestPin"),$s=Z(e=>{if(e.registry==="docker.io")return`https://hub.docker.com/${e.namespace==="library"?`_/${e.name}`:`r/${e.namespace}/${e.name}`}/tags`;const t=e.namespace==="library"?e.name:`${e.namespace}/${e.name}`;return`https://${e.registry}/${t}`},"buildRegistryUrl"),ys=Z((e,t)=>{const n=e.namespace==="library"?e.name:`${e.namespace}/${e.name}`;return`${e.registry==="docker.io"?n:`${e.registry}/${n}`}:${t}`},"buildReplacement"),ft=Z(async(e,t)=>{const{ignoreRules:n,options:s,references:r,registryOptions:o}=t,i=[],a=[],d=[];if(r.length===0)return{failed:d,ignored:a,updates:i};const l=new es({fetch:o?.fetch,tokens:o?.tokens}),c=new Map;for(const b of r){const v=`${b.registry}|${b.namespace}|${b.name}`,k=c.get(v)??[];k.push(b),c.set(v,k)}const f=Math.max(1,s.maxConcurrentRequests),g=[...c.keys()];let m=0;const h=Z(async b=>{const v=c.get(b)??[],k=v[0];if(!k)return;let w;try{w=await l.listTags(k.registry,k.namespace,k.name)}catch{for(const p of v)d.push({file:p.file,reason:`failed to list tags for ${Ge(p)}`});return}for(const p of v){const $=Ge(p);let u;if(p.ignoreReason?u=p.ignoreReason:We($,s.exclude)?u="matched --exclude":s.include.length>0&&!We($,s.include)?u="not matched by --include":s.respectDependabotConfig&&n&&je($,"docker",n)&&(u="ignored by dependabot/renovate config"),u){a.push({currentRef:p.tag,currentVersion:p.tag,ecosystem:"docker",file:p.file,ignored:!0,line:p.line,name:$,newRef:p.tag,newVersion:void 0,original:p.original,reason:u,replacement:p.original,updateType:"unknown"});continue}if(hs(p)){a.push({currentRef:p.tag,currentVersion:p.tag,ecosystem:"docker",file:p.file,ignored:!0,line:p.line,name:$,newRef:p.tag,newVersion:void 0,original:p.original,reason:"digest-pinned image (refresh the pin manually to update)",replacement:p.original,updateType:"digest"});continue}const A=G(p.tag);if(!A&&!s.includeBranches){a.push({currentRef:p.tag,currentVersion:p.tag,ecosystem:"docker",file:p.file,ignored:!0,line:p.line,name:$,newRef:p.tag,newVersion:void 0,original:p.original,reason:"non-semver tag (use --include-branches)",replacement:p.original,updateType:"unknown"});continue}if(!A&&s.mode!=="latest"){a.push({currentRef:p.tag,currentVersion:p.tag,ecosystem:"docker",file:p.file,ignored:!0,line:p.line,name:$,newRef:p.tag,newVersion:void 0,original:p.original,reason:`branch ref has no version baseline for --target=${s.mode}`,replacement:p.original,updateType:"unknown"});continue}const y=Te(w.parsed,A,s.mode,!1);if(!y)continue;if(s.minAgeDays!==void 0&&y.lastUpdated!==void 0&&(Date.now()-y.lastUpdated)/ms<s.minAgeDays){a.push({currentRef:p.tag,currentVersion:p.tag,ecosystem:"docker",file:p.file,ignored:!0,line:p.line,name:$,newRef:y.raw,newVersion:y.raw,original:p.original,reason:`release younger than ${String(s.minAgeDays)} days`,replacement:p.original,updateType:"unknown"});continue}const j=y.raw,R=ys(p,j);i.push({currentRef:p.tag,currentVersion:p.tag,ecosystem:"docker",file:p.file,line:p.line,name:$,newRef:j,newVersion:j,original:p.original,replacement:R,updateType:Oe(A,y),url:$s(p)})}},"processGroup"),x=[];for(let b=0;b<Math.min(f,g.length);b++)x.push((async()=>{for(;m<g.length;){const v=g[m];m+=1,v!==void 0&&await h(v)}})());return await Promise.all(x),{failed:d,ignored:a,updates:i}},"checkDocker");var vs=Object.defineProperty,ks=T((e,t)=>vs(e,"name",{value:t,configurable:!0}),"g$1");class ws{static{T(this,"GitlabResolver")}static{ks(this,"GitlabResolver")}token;tokenHeader;defaultApiBase;fetchImpl;tagCache=new Map;constructor(t){const n=t.token??process.env.GITLAB_TOKEN;n?(this.token=n,this.tokenHeader="PRIVATE-TOKEN"):process.env.CI_JOB_TOKEN?(this.token=process.env.CI_JOB_TOKEN,this.tokenHeader="JOB-TOKEN"):(this.token=void 0,this.tokenHeader="PRIVATE-TOKEN"),this.defaultApiBase=t.apiBase??"https://gitlab.com",this.fetchImpl=t.fetch??fetch}async listTags(t){const n=this.tagCache.get(t);if(n)return n;const s=this.fetchTags(t);return this.tagCache.set(t,s),s}resolveHostAndPath(t){const n=t.indexOf("/");if(n>0){const s=t.slice(0,n);if(s.includes("."))return{host:`https://${s}`,path:t.slice(n+1)}}return{host:this.defaultApiBase,path:t}}async fetchTags(t){const{host:n,path:s}=this.resolveHostAndPath(t),r=encodeURIComponent(s),o=`${n}/api/v4/projects/${r}/repository/tags?per_page=100`,i={Accept:"application/json","User-Agent":"vis-update-gitlab"};this.token&&(i[this.tokenHeader]=this.token);try{const a=await this.fetchImpl(o,{headers:i});if(!a.ok)return{error:`HTTP ${String(a.status)} from ${n}`,parsed:[],tags:[]};const d=await a.json();if(!Array.isArray(d))return{error:`unexpected response shape from ${n}`,parsed:[],tags:[]};const l=d.map(f=>({name:typeof f.name=="string"?f.name:"",sha:typeof f.commit?.id=="string"?f.commit.id:""})).filter(f=>f.name!==""),c=[];for(const f of l){const g=G(f.name);g&&c.push({...g,sha:f.sha})}return{parsed:c,tags:l}}catch(a){return{error:a instanceof Error?a.message:"fetch failed",parsed:[],tags:[]}}}}var bs=Object.defineProperty,ye=T((e,t)=>bs(e,"name",{value:t,configurable:!0}),"x");const Rs=/vis-update-ignore-next-line/i,ae=/vis-update-ignore(?:\s|$|:)/i,xs=new Set([".gitlab-ci.yaml",".gitlab-ci.yml"]),As=ye(e=>xs.has(e)||e.endsWith(".gitlab-ci.yml")||e.endsWith(".gitlab-ci.yaml"),"isGitlabCiFile"),Cs=/^\s*-?\s*project:\s*(['"]?)([^'"\s#]+)\1(?:\s*#.*)?$/,Ss=/^\s*ref:\s*(['"]?)([^'"\s#]+)\1(\s*#.*)?$/,Es=/^\s*-?\s*component:\s*(['"]?)([^'"\s#]+)\1(\s*#.*)?$/,js=/^\s*image:\s*(['"]?)([^'"\s#]+)\1(\s*#.*)?$/,Ts=/^\s*(?:-\s*)?(?:include:\s*)?\{([^}]*)\}\s*(?:#.*)?$/,Os=/project:\s*(['"]?)([^'"\s,}]+)\1/,Is=/ref:\s*(['"]?)([^'"\s,}]+)\1/,Ds=/component:\s*(['"]?)([^'"\s,}]+)\1/,Us=/^(\s*-\s*name:\s*)(['"]?)([^'"\s#]+)\2(\s*#.*)?$/,Ns=/^(\s*-\s*)(['"]?)([^'"\s#:]+:[^'"\s#]+)\2(\s*#.*)?$/,Bs=/^\s*-?\s*[a-z_][\w-]*:\s*(?:#.*)?$/i,Ps=ye((e,t)=>{const n=t.split(/\r?\n/),s=[],r=[];let o,i=!1,a=!1,d=-1;for(const[l,c]of n.entries()){const f=c??"",g=f.trim(),m=g===""||g.startsWith("#");if(Rs.test(f)&&m){i=!0;continue}const h=/^(\s*)services:\s*(?:#.*)?$/.exec(f);if(h){a=!0,d=h[1]?.length??0;continue}a&&g!==""&&!g.startsWith("-")&&!g.startsWith("#")&&f.search(/\S/)<=d&&(a=!1,d=-1);const x=js.exec(f);if(x){const p=x[2]??"",$=he(p);if($){const u=x[3]?.trim();let A=i?"vis-update-ignore-next-line":void 0;u&&ae.test(u)&&(A=A??"vis-update-ignore"),r.push({...$,file:e,ignoreReason:A,kind:"compose",line:l+1})}i=!1;continue}if(a){const p=Us.exec(f),$=p?void 0:Ns.exec(f),u=p??$;if(u){const A=u[3]??"",y=he(A);if(y){const j=u[4]?.trim();let R=i?"vis-update-ignore-next-line":void 0;j&&ae.test(j)&&(R=R??"vis-update-ignore"),r.push({...y,file:e,ignoreReason:R,kind:"compose",line:l+1})}}}const b=Cs.exec(f);if(b){o={line:l+1,project:b[2]??""};continue}const v=Ss.exec(f);if(v&&o){const p=v[3]?.trim();let $=i?"vis-update-ignore-next-line":void 0;p&&ae.test(p)&&($=$??"vis-update-ignore"),s.push({file:e,ignoreReason:$,kind:"project",line:l+1,original:v[2]??"",project:o.project,ref:v[2]??""}),o=void 0,i=!1;continue}const k=Es.exec(f);if(k){const p=k[2]??"",$=p.lastIndexOf("@");if($>0){const u=p.slice(0,$),A=p.slice($+1),y=u.lastIndexOf("/"),j=y>0?u.slice(0,y):u,R=y>0?u.slice(y+1):void 0,S=k[3]?.trim();let E=i?"vis-update-ignore-next-line":void 0;S&&ae.test(S)&&(E=E??"vis-update-ignore"),s.push({componentName:R,file:e,ignoreReason:E,kind:"component",line:l+1,original:p,project:j,ref:A})}i=!1;continue}const w=Ts.exec(f);if(w){const p=w[1]??"",$=/#(.*)$/.exec(f)?.[1]?.trim();let u=i?"vis-update-ignore-next-line":void 0;$&&ae.test($)&&(u=u??"vis-update-ignore");const A=Ds.exec(p);if(A){const y=A[2]??"",j=y.lastIndexOf("@");if(j>0){const R=y.slice(0,j),S=y.slice(j+1),E=R.lastIndexOf("/"),P=E>0?R.slice(0,E):R,O=E>0?R.slice(E+1):void 0;s.push({componentName:O,file:e,ignoreReason:u,kind:"component",line:l+1,original:y,project:P,ref:S})}}else{const y=Os.exec(p),j=Is.exec(p);y&&j&&s.push({file:e,ignoreReason:u,kind:"project",line:l+1,original:j[2]??"",project:y[2]??"",ref:j[2]??""})}i=!1;continue}g!==""&&!g.startsWith("#")&&!Bs.test(f)&&(i=!1)}return{images:r,includes:s}},"extractFromGitlabCi"),He=/^(?:\.git|node_modules|\.pnpm-store|\.turbo|\.nx|dist|build|\.cache)$/,Vs=ye(e=>{const t=[],n=[];if(!B(e))return{images:n,includes:t};const s=ye(o=>{let i;try{i=Q(o)}catch{return}const{images:a,includes:d}=Ps(o,i);t.push(...d),n.push(...a)},"collect");for(const o of[".gitlab-ci.yml",".gitlab-ci.yaml"]){const i=M(e,o);B(i)&&s(i)}const r=M(e,".gitlab");if(B(r))for(const o of ne(r,{includeDirs:!1,includeSymlinks:!1,skip:[He]}))(o.name.endsWith(".yml")||o.name.endsWith(".yaml"))&&s(o.path);for(const o of ne(e,{includeDirs:!1,includeSymlinks:!1,maxDepth:2,skip:[He]}))As(o.name)&&!n.some(i=>i.file===o.path)&&!t.some(i=>i.file===o.path)&&s(o.path);return{images:n,includes:t}},"scanGitlabRepository");var Ms=Object.defineProperty,le=T((e,t)=>Ms(e,"name",{value:t,configurable:!0}),"p$1");const ze=le((e,t)=>{for(const n of t)try{if(new RegExp(n).test(e))return!0}catch{if(e.includes(n))return!0}return!1},"matchesPattern"),_s=le((e,t,n)=>{const s=e.indexOf("/");return s>0&&e.slice(0,s).includes(".")?`https://${e.slice(0,s)}/${e.slice(s+1)}/-/releases/${t}`:`${n}/${e}/-/releases/${t}`},"buildReleaseUrl"),Fs=le(async(e,t)=>{const{ignoreRules:n,imageReferences:s,includes:r,options:o,registryOptions:i,resolverOptions:a}=t,d=[],l=[],c=[];if(s.length>0){const w=await ft(e,{ignoreRules:n,options:o,references:s,registryOptions:i});for(const p of w.updates)d.push({...p,ecosystem:"gitlab"});for(const p of w.ignored)l.push({...p,ecosystem:"gitlab"});c.push(...w.failed)}if(r.length===0)return{failed:c,ignored:l,updates:d};const f=new ws({apiBase:a?.apiBase,fetch:a?.fetch,token:o.gitlabToken??a?.token}),g=a?.apiBase??"https://gitlab.com",m=new Map;for(const w of r){const p=m.get(w.project)??[];p.push(w),m.set(w.project,p)}const h=Math.max(1,o.maxConcurrentRequests),x=[...m.keys()];let b=0;const v=le(async w=>{const p=m.get(w)??[];let $;try{$=await f.listTags(w)}catch{for(const u of p)c.push({file:u.file,reason:`failed to list tags for ${w}`});return}if($.error){for(const u of p)c.push({file:u.file,reason:`failed to list tags for ${w}: ${$.error}`});return}for(const u of p){const A=u.kind==="component"&&u.componentName?`${u.project}/${u.componentName}`:u.project;let y;u.ignoreReason?y=u.ignoreReason:ze(A,o.exclude)?y="matched --exclude":o.include.length>0&&!ze(A,o.include)?y="not matched by --include":o.respectDependabotConfig&&n&&je(A,"gitlab",n)&&(y="ignored by dependabot/renovate config");const j=le(P=>({currentRef:u.ref,currentVersion:u.ref,ecosystem:"gitlab",file:u.file,ignored:!0,line:u.line,name:A,newRef:u.ref,newVersion:void 0,original:u.original,reason:P,replacement:u.original,updateType:"unknown"}),"buildIgnored");if(y){l.push(j(y));continue}const R=G(u.ref);if(!R&&!o.includeBranches){l.push(j("branch reference (use --include-branches)"));continue}if(!R&&o.mode!=="latest"){l.push(j(`branch ref has no version baseline for --target=${o.mode}`));continue}const S=Te($.parsed,R,o.mode,!1);if(!S)continue;let E;u.kind==="component"?E=`${u.componentName?`${u.project}/${u.componentName}`:u.project}@${S.raw}`:E=S.raw,d.push({currentRef:u.ref,currentVersion:R?.raw??u.ref,ecosystem:"gitlab",file:u.file,line:u.line,name:A,newRef:S.raw,newVersion:S.raw,original:u.original,replacement:E,updateType:Oe(R,S),url:_s(u.project,S.raw,g)})}},"processGroup"),k=[];for(let w=0;w<Math.min(h,x.length);w++)k.push((async()=>{for(;b<x.length;){const p=x[b];b+=1,p!==void 0&&await v(p)}})());return await Promise.all(k),{failed:c,ignored:l,updates:d}},"checkGitlab");var qs=Object.defineProperty,Ls=T((e,t)=>qs(e,"name",{value:t,configurable:!0}),"r$1");const Ws={disabled:new Set,exclude:[],githubToken:void 0,gitlabToken:void 0,include:[],includeBranches:!1,maxConcurrentRequests:8,minAgeDays:void 0,mode:"latest",respectDependabotConfig:!0,style:"sha"},Gs=Ls(async e=>{const t={...Ws,...e.options,disabled:e.options?.disabled??new Set},n=t.respectDependabotConfig?kn(e.workspaceRoot):void 0,s={actions:{failed:[],ignored:[],updates:[]},docker:{failed:[],ignored:[],updates:[]},gitlab:{failed:[],ignored:[],updates:[]}},r=[];let o=0;if(!t.disabled.has("actions")){const d=qn(e.workspaceRoot);d.length>0&&(o+=1,r.push(Jn(e.workspaceRoot,{ignoreRules:n,options:t,references:d}).then(l=>{s.actions=l})))}if(!t.disabled.has("docker")){const d=fs(e.workspaceRoot);d.length>0&&(o+=1,r.push(ft(e.workspaceRoot,{ignoreRules:n,options:t,references:d}).then(l=>{s.docker=l})))}if(!t.disabled.has("gitlab")){const{images:d,includes:l}=Vs(e.workspaceRoot);d.length+l.length>0&&(o+=1,r.push(Fs(e.workspaceRoot,{ignoreRules:n,imageReferences:d,includes:l,options:t}).then(c=>{s.gitlab=c})))}await Promise.all(r);const i=[...s.actions.updates,...s.docker.updates,...s.gitlab.updates],a=[...s.actions.ignored,...s.docker.ignored,...s.gitlab.ignored];return{failed:[...s.actions.failed,...s.docker.failed,...s.gitlab.failed],ignored:a,perEcosystem:s,scanned:o,updates:i}},"checkEcosystems");var Hs=Object.defineProperty,se=T((e,t)=>Hs(e,"name",{value:t,configurable:!0}),"r");const zs={actions:"GitHub Actions",docker:"Docker",gitlab:"GitLab CI"},Se=se(e=>e.updateType==="major","isBreakingUpdate"),Ks=se(e=>{switch(e){case"major":return X;case"minor":return U;case"patch":return nt;default:return tt}},"colorForUpdateType"),Ke=se(e=>{const t=Ks(e.updateType),n=e.currentVersion??e.currentRef,s=e.newVersion??e.newRef,r=e.url?`  ${F(e.url)}`:"",o=e.advisories&&e.advisories.length>0?` ${X(`⚠ ${String(e.advisories.length)} advisor${e.advisories.length===1?"y":"ies"}`)}`:"";return`    ${t(e.updateType.padEnd(7))}  ${e.name}  ${F(n)} → ${s}${o}${r}`},"formatUpdateLine"),Je=se(e=>!e.advisories||e.advisories.length===0?[]:e.advisories.map(t=>`        ${t.severity==="CRITICAL"||t.severity==="HIGH"?X(t.severity):U(t.severity)}  ${t.id}  ${F(t.summary)}`),"formatAdvisoryLines"),Js=se((e,t)=>{const n=[],s=e.updates.length;if(s===0&&e.scanned===0)return"";if(s===0){if(e.failed.length===0&&e.ignored.length===0)return n.push(`${nt("✓")} All ecosystem references up to date.`),n.join(`
-`);if(n.push(`${U("⚠")} No actionable updates found.`),e.failed.length>0){n.push(`
-  ${U("Failed lookups:")}`);for(const o of e.failed)n.push(`    ${o.file}: ${o.reason}`)}if(t.showIgnored&&e.ignored.length>0){n.push(`
-  ${F("Ignored:")}`);for(const o of e.ignored)n.push(`    ${F(o.name)}  ${F(o.reason??"")}`)}return n.join(`
-`)}n.push(`
-${tt("Ecosystem updates")} — ${String(s)} reference${s===1?"":"s"} can be bumped:`);const r=e.updates.filter(o=>Se(o));if(r.length>0){n.push(`
-  ${X(wt(`⚠ Breaking changes (${String(r.length)})`))}`),n.push(`  ${F("Review release notes before applying — these cross a major-version boundary.")}`);for(const o of r)n.push(Ke(o)),n.push(...Je(o))}for(const o of Object.keys(e.perEcosystem)){const i=e.perEcosystem[o];if(i.updates.length!==0){n.push(`
-  ${zs[o]} (${String(i.updates.length)})`);for(const a of i.updates)n.push(Ke(a)),n.push(...Je(a))}}if(t.showIgnored&&e.ignored.length>0){n.push(`
-  ${F("Ignored:")}`);for(const o of e.ignored)n.push(`    ${F(o.name)}  ${F(o.reason??"")}`)}if(e.failed.length>0){n.push(`
-  ${U("Failed lookups:")}`);for(const o of e.failed)n.push(`    ${o.file}: ${o.reason}`)}return t.previewOnly&&n.push(`
-  ${U("ℹ")} ${F("Not applied automatically — re-run with `--interactive` to choose which to apply, or `--yes` to apply all.")}`),n.join(`
-`)},"formatEcosystemReport"),Ys=se(e=>JSON.stringify({ecosystems:{failed:e.failed,ignored:e.ignored,perEcosystem:e.perEcosystem,scanned:e.scanned,updates:e.updates}},void 0,2),"formatEcosystemJson");var Xs=Object.defineProperty,te=T((e,t)=>Xs(e,"name",{value:t,configurable:!0}),"o");const Zs=te(()=>{const e=et({input:process.stdin,output:process.stdout});return{ask:te(t=>new Promise(n=>{e.question(t,s=>{n(s.trim())})}),"ask"),close:te(()=>{e.close()},"close"),write:te(t=>{process.stdout.write(`${t}
-`)},"write")}},"createReadlineIO"),Qs=te((e,t)=>e.split(",").map(n=>Number.parseInt(n.trim(),10)-1).filter(n=>Number.isInteger(n)&&n>=0&&n<t),"parseIndexSelection"),eo=te(async(e,t=Zs())=>{if(e.length===0)return t.close(),[];t.write(""),t.write("Outdated ecosystem references:");for(const[s,r]of e.entries()){const o=r.currentVersion??r.currentRef,i=r.newVersion??r.newRef,a=Se(r)?" [BREAKING]":"";t.write(`  ${String(s+1)}. [${r.ecosystem}] ${r.name}: ${o} → ${i} (${r.updateType})${a}`)}t.write("");const n=(await t.ask("Apply updates? [a]ll / [s]afe / [n]one / numbers: ")).toLowerCase();if(n==="a"||n==="all")return t.close(),e;if(n==="s"||n==="safe")return t.close(),e.filter(s=>!Se(s));if(n==="n"||n==="none"||n==="")return t.close(),[];if(/^[\d ,]+$/.test(n)){const s=Qs(n,e.length);return t.close(),s.map(r=>e[r]).filter(r=>r!==void 0)}return t.close(),[]},"promptEcosystemSelection");var to=Object.defineProperty,N=T((e,t)=>to(e,"name",{value:t,configurable:!0}),"y");const gt=N(e=>{const t=e.trim();if(t==="")return;const n=/^(\d+(?:\.\d+)?)\s*([mhdw])?$/i.exec(t);if(!n)return;const s=Number.parseFloat(n[1]);if(!(!Number.isFinite(s)||s<0))switch((n[2]??"m").toLowerCase()){case"d":return s*60*24;case"h":return s*60;case"m":return s;case"w":return s*60*24*7;default:return}},"parseTimeStringToMinutes"),no=N(e=>{const t=e.trim();return/^\d+(?:\.\d+)?$/.test(t)?Number.parseFloat(t)*1440:gt(t)},"parseNpmReleaseAgeValue"),So=N(e=>!Number.isFinite(e)||e<=0?"0m":e%1440===0?`${String(e/1440)}d`:e%60===0?`${String(e/60)}h`:`${String(e)}m`,"formatMinutesAsTimeString"),so=N((e,t)=>{try{switch(t){case"bun":{const n=M(e,"bunfig.toml");if(B(n)){const s=xt(n),r=s?.install?.minimumReleaseAge;return{excludes:Array.isArray(s?.install?.minimumReleaseAgeExcludes)?s.install.minimumReleaseAgeExcludes:void 0,minutes:typeof r=="number"?Math.round(r/60):void 0}}break}case"npm":{const n=M(e,".npmrc");if(B(n)){const s=Q(n),r=/^\s*min-release-age\s*=\s*([^\s#;]+)/m.exec(s);return{minutes:r?no(r[1]):void 0}}break}case"pnpm":{const n=M(e,"pnpm-workspace.yaml");if(B(n)){const s=Be(n);return{excludes:Array.isArray(s?.minimumReleaseAgeExclude)?s.minimumReleaseAgeExclude:void 0,minutes:typeof s?.minimumReleaseAge=="number"?s.minimumReleaseAge:void 0}}break}case"yarn":{const n=M(e,".yarnrc.yml");if(B(n)){const s=Be(n)?.npmMinimalAgeGate;if(typeof s=="string")return{minutes:gt(s)};if(typeof s=="number")return{minutes:s}}break}}}catch{}return{}},"readPmNativeMinimumReleaseAge"),oo=N((e,t,n)=>{const s=e.latest?"latest":e.target??t.target??"latest";if(!["latest","minor","patch"].includes(s))throw new Error(`Invalid target "${s}". Use: latest, minor, or patch.`);const r=e.maxConcurrentRequests,o=typeof r=="number"&&r>0?r:t.maxConcurrentRequests,i=typeof e.releaseChannel=="string"?e.releaseChannel.toLowerCase():void 0;if(i!==void 0&&!["any","same","stable"].includes(i))throw new Error(`Invalid --release-channel "${String(e.releaseChannel)}". Use: any, same, or stable.`);const a=i??t.releaseChannel;return{exclude:[...q(e.exclude),...q(t.exclude)],ignore:q(t.ignore),include:[...q(e.include),...q(t.include),...n],includeLocked:e.includeLocked||t.includeLocked||!1,includePrerelease:e.prerelease||t.prerelease||!1,maxConcurrentRequests:o,minimumReleaseAge:t.minimumReleaseAge,minimumReleaseAgeExclude:t.minimumReleaseAgeExclude,packageMode:t.packageMode,releaseChannel:a,security:e.security===!1?!1:e.ai||(t.security??!0),target:s}},"buildCatalogCheckOptions"),Ye=N((e,t)=>{if(e.length!==0){t.info(`
-${U("⚠")} ${String(e.length)} package${e.length===1?"":"s"} skipped by target constraint (use --target latest to include):`);for(const n of e)t.info(`    ${n.packageName}  ${n.currentRange} → ${n.newRange}  (${n.updateType})`)}},"logFilteredByTarget"),Xe=N((e,t,n,s,r)=>{n==="json"?process.stdout.write(`${At({checkedCount:0,failed:t,filteredByTarget:[],ignored:[],outdated:e})}
-`):n==="minimal"?process.stdout.write(`${Ct(e)}
-`):(St(e,s),s.info(st(e,r)))},"writeFormattedOutput"),Ze=N(async(e,t,n,s,r,o,i)=>{const a=Et(e,n,t,!0,{useEditorconfig:i}),d=t==="pnpm"?"pnpm-workspace.yaml":"package.json";if(r.info(`
-Updated ${d}`),a&&r.info(`Backup saved to ${a}`),s.changelog){r.info(`
-Fetching changelogs...`);const l=await ot(n,void 0,o);for(const c of l){const f=c.releaseUrl??c.repoUrl??c.npmUrl;r.info(`  ${c.packageName}: ${f}`)}}if(s.install??!0){const l=t,c=["install"];r.info(`Running ${l} ${c.join(" ")}...
-`);try{const{code:f,output:g}=await rt(l,c,{cwd:e,env:process.env});f!==0?r.warn(`${l} ${c.join(" ")} failed. You may need to run it manually.`):s.peer!==!0&&it(g)&&r.info(at)}catch{r.warn(`${l} ${c.join(" ")} failed. You may need to run it manually.`)}}},"applyCatalogAndInstall"),Ee={applied:!1,canceled:!1,jsonEmitted:!1},ro=N(async(e,t,n,s,r,o)=>{const i=n.update??{},a=[["global","--global is not supported in catalog mode"],["recursive","--recursive is not needed in catalog mode (catalogs are workspace-level)"],["filter","--filter is not supported in catalog mode (use --include/--exclude instead)"],["no-save","--no-save is not supported in catalog mode"],["workspace-root","--workspace-root is not needed in catalog mode"],["no-optional","--no-optional is not supported in catalog mode"]];for(const[C,I]of a)s[C]&&o.warn(`${U("⚠")} ${I}, ignoring.`);const d=xe("minReleaseAge"),{excludes:l,minutes:c}=d?{excludes:void 0,minutes:void 0}:so(e,t),f=d?void 0:i.minimumReleaseAge??c,g=d?void 0:i.minimumReleaseAgeExclude??l;if(d&&(i.minimumReleaseAge!==void 0||c!==void 0)&&o.info("minimumReleaseAge gate disabled via MARSHALL_DISABLE_MIN_RELEASE_AGE."),!d&&i.minimumReleaseAge!==void 0&&c!==void 0&&i.minimumReleaseAge!==c){const C=t==="pnpm"?"pnpm-workspace.yaml":"bunfig.toml";o.warn(`${U("⚠")} minimumReleaseAge mismatch: vis config = ${String(i.minimumReleaseAge)} min, ${C} = ${String(c)} min. Consider keeping them in sync.`)}const m=jt(e),h=s["include-internal"],x=s.peer,b=Tt(e,t,{depFields:i.depFields,dev:s.dev,includeInternal:h,peer:x,prod:s.prod});if(b.size===0)return o.info("No catalogs found."),Ee;const v={...i,minimumReleaseAge:f,minimumReleaseAgeExclude:g},k=oo(s,v,r);let w=0;for(const C of b.values())w+=C.size;const p=!!process.stdout.isTTY&&!ve;let $;const u=p?(C,I)=>{$?$.rerender(_.createElement(Me,{current:C,total:I})):(process.stdout.write(`
-`),$=Pe(_.createElement(Me,{current:C,total:I}),{interactive:!0,patchConsole:!1}))}:(C,I)=>{o.info(`Checking ${String(C)}/${String(I)} dependencies...`)};p||o.info(`Checking ${String(w)} catalog dependencies...
-`);const A=new Set;xe("socket")&&A.add("socket"),xe("depsDev")&&A.add("deps-dev");const y=n.security?.policies?.score?.minimum,j=Ot(n.security,{disabled:A,minimumScore:y}),{checkedCount:R,failed:S,filteredByTarget:E,ignored:P,outdated:O}=await It(b,k,m,u,e,j,n.security?.acceptedRisks);$&&($.clear(),$.unmount());const K=h?{ignored:[],outdated:[]}:Dt(e,{depFields:i.depFields,dev:s.dev,exclude:k.exclude,ignore:k.ignore,include:k.include,packageMode:k.packageMode,peer:x,prod:s.prod,target:k.target});if(K.outdated.length>0){const C=new Set(O.map(I=>`${I.catalogName}|${I.packageName}`));for(const I of K.outdated)C.has(`${I.catalogName}|${I.packageName}`)||O.push(I)}if(K.ignored.length>0)for(const C of K.ignored)P.includes(C)||P.push(C);const De=R-O.length-S.length;if(S.length>0&&o.warn(`Failed to fetch: ${S.join(", ")}`),P.length>0&&o.info(`Skipped ${String(P.length)} ignored package${P.length===1?"":"s"}: ${P.join(", ")}`),!p&&R>O.length){const C=[...b.values()].reduce((re,we)=>re+we.size,0),I=C>R?` (${String(C)} catalog entries, ${String(C-R)} duplicates)`:"";o.info(`Checked ${String(R)} unique packages${I}: ${String(O.length)} outdated, ${String(De)} up-to-date${S.length>0?`, ${String(S.length)} failed`:""}${E.length>0?`, ${String(E.length)} skipped by target`:""}`)}if(O.length===0)return E.length>0?o.info(`All catalog dependencies are up to date within the current target.
-${String(E.length)} package${E.length===1?" has":"s have"} newer versions available with --target latest:
-${E.map(C=>`  ${C.packageName}  ${C.currentRange} → ${C.newRange}  (${C.updateType})`).join(`
-`)}`):o.info("All catalog dependencies are up to date."),Ee;const J=s.format??i.format??"table";let L;if(s.ai){const C=Ft(s.aiType??"impact");L=await qt(O,o,n.ai,C)}const pe=!!s.dryRun;if(!pe&&r.length>0&&s.marshallCheck!==!1){const C=await Gt(r);if(C.length>0){const I=await Ht(C,{config:n?.security?.marshalls,workspaceRoot:e});if(!await zt(I))return process.exitCode=1,{applied:!1,canceled:!0,jsonEmitted:!1}}}if(p&&J==="table"){const C=new Yt(O,L??null);let I;if(s.changelog){o.info("Fetching changelogs...");const D=await ot(O,void 0,m);I=new Map;for(const V of D){const Y=V.releaseUrl??V.repoUrl??V.npmUrl;Y&&I.set(V.packageName,Y)}}const re=n.tui?.autoExit??!1,we=re===!0?3:typeof re=="number"?re:0,Ue=await Pe(_.createElement(Xt,{autoExitSeconds:we,changelogUrls:I,checkedCount:R,filteredOutEntries:E,isDryRun:pe,store:C,totalCatalogEntries:w}),{alternateScreen:!0,exitOnCtrlC:!1,interactive:!0,patchConsole:!0}).waitUntilExit(),be=process.stdout.columns||80;process.stdout.write(`
-`);for(const D of O){const V=D.vulnerabilities?.length||D.socketReport&&D.socketReport.alerts.length>0,Y=!!D.acceptedRisk,Re=V?Y?"✓":"⚠":"✓",ht=Y?"gray":D.updateType==="major"?"red":D.updateType==="minor"?"yellow":"green",ge=D.socketReport?.score.overall,$t=ge===void 0?"":` [${String(Math.round(ge*100))}%]`,Ne=ge===void 0?void 0:Ut(ge);process.stdout.write(`${Ae(_.createElement(W,null,"   ",_.createElement(W,{color:ht},Re),`  ${D.packageName}  ${D.currentRange} → ${D.newRange}`,_.createElement(W,{dimColor:!0},`  ${D.updateType}`),Ne?_.createElement(W,{color:Ne},$t):null),{columns:be})}
-`)}if(process.stdout.write(`
-`),o.info(st(O,y)),R>O.length){const D=[...b.values()].reduce((Y,Re)=>Y+Re.size,0),V=D>R?` (${String(D)} catalog entries, ${String(D-R)} duplicates)`:"";o.log(),o.info(`Checked ${String(R)} unique packages${V}: ${String(De)} up-to-date${S.length>0?`, ${String(S.length)} failed`:""}`)}if(E.length>0){process.stdout.write(`
-`);const D=`${String(E.length)} package${E.length===1?"":"s"} skipped by target constraint (use --target latest to include):`;process.stdout.write(`${Ae(_.createElement(W,{color:"yellow"},`  ${D}`),{columns:be})}
-`);for(const V of E)process.stdout.write(`${Ae(_.createElement(W,null,"     ",_.createElement(W,{dimColor:!0},V.packageName),`  ${V.currentRange} → ${V.newRange}`,_.createElement(W,{dimColor:!0},`  ${V.updateType}`)),{columns:be})}
-`)}const fe=Array.isArray(Ue)?Ue:[];if(fe.length>0&&!pe){o.info(`
-Applying ${String(fe.length)} updates...
-`);const D={...s,install:s.install??i.install};return await Ze(e,t,fe,D,o,m,n.editorconfig??!0),{applied:!0,canceled:!1,jsonEmitted:!1}}return{applied:!1,canceled:fe.length===0,jsonEmitted:!1}}if(pe){if(J==="json"){const C={failed:S,filteredByTarget:E,ignored:P,outdated:O};L&&(C.aiAnalysis=L),process.stdout.write(`${JSON.stringify(C,void 0,2)}
-`)}else o.info(`Would update ${String(O.length)} dependencies:
-`),Xe(O,S,J,o,y),L&&(o.info(""),o.info(Ve(L))),Ye(E,o);return{applied:!1,canceled:!1,jsonEmitted:J==="json"}}L&&J!=="json"&&(o.info(Ve(L)),o.info(""));let oe=O;if(s.interactive&&(oe=await Nt(O),oe.length===0))return o.info("No updates selected."),{applied:!1,canceled:!0,jsonEmitted:!1};o.info(`Updating ${String(oe.length)} catalog dependencies...
-`),Xe(oe,[],J,o,y),Ye(E,o);const mt={...s,install:s.install??i.install};return await Ze(e,t,oe,mt,o,m),{applied:!0,canceled:!1,jsonEmitted:J==="json"}},"executeCatalogUpdate"),io=N(async(e,t,n,s,r,o)=>{const i={dev:s.dev,filters:q(s.filter),global:s.global,interactive:s.interactive,latest:s.latest||s.target==="latest",noOptional:s.optional===!1,noSave:s.save===!1,packages:r,prod:s.prod,recursive:s.recursive,workspaceRoot:s.workspaceRoot},{command:a,warnings:d}=pn(t,n,i);for(const c of d)o.warn(c);const l=`${a.bin} ${a.args.join(" ")}`.trim();if(s.dryRun)return o.info(`Would run: ${l}`),Ee;o.info(`Running: ${l}`);try{const{code:c,output:f}=await rt(a.bin,a.args,{cwd:e,env:process.env});if(c!==0)return o.error(`
-${X("✖")} Update failed (exit code ${String(c)})`),o.error(`  Command: ${l}`),o.error(`  Directory: ${e}
-`),process.exitCode=c,{applied:!1,canceled:!1,jsonEmitted:!1};s.peer!==!0&&it(f)&&o.info(at)}catch(c){const f=c.status??1;return o.error(`
-${X("✖")} Update failed (exit code ${String(f)})`),o.error(`  Command: ${l}`),o.error(`  Directory: ${e}
-`),process.exitCode=f,{applied:!1,canceled:!1,jsonEmitted:!1}}return{applied:!0,canceled:!1,jsonEmitted:!1}},"executePmWrapper"),ao=N(async(e,t,n)=>{const s=e.latest===!0||e.target==="latest";if(t||!s||e.dryRun===!0||e.yes===!0||e.interactive===!0)return!0;if(!(process.stdout.isTTY&&!ve))return n.error(`${X("✖")} Refusing to run blanket --latest update in a non-interactive context.`),n.error("  Re-run with --yes to confirm, --dry-run to preview, or pass explicit package names."),process.exitCode=1,!1;const r=et({input:process.stdin,output:process.stdout});try{const o=(await new Promise(i=>{r.question(`${U("⚠")} About to upgrade ALL dependencies to their latest versions. This may include breaking changes.
-  Continue? [y/N] `,i)})).trim().toLowerCase();return o==="y"||o==="yes"?!0:(n.info("Aborted."),!1)}finally{r.close()}},"requireBlanketUpdateConfirmation"),co=N((e,t)=>{const n=new Set;e.actions===!1&&n.add("actions"),e.docker===!1&&n.add("docker"),e.gitlab===!1&&n.add("gitlab");const s=e.style??"sha";if(s!=="sha"&&s!=="preserve")throw new Error(`Invalid --style "${s}". Use: sha or preserve.`);const r=e.latest===!0?"latest":e.target??"latest";if(r!=="latest"&&r!=="minor"&&r!=="patch")throw new Error(`Invalid target "${r}". Use: latest, minor, or patch.`);const o=r,i=t.update??{};return{disabled:n,exclude:[...q(e.exclude),...q(i.exclude)],githubToken:e.actionsToken??void 0,gitlabToken:e.gitlabToken??void 0,include:q(e.include),includeBranches:e.includeBranches===!0,maxConcurrentRequests:typeof e.maxConcurrentRequests=="number"&&e.maxConcurrentRequests>0?e.maxConcurrentRequests:8,minAgeDays:typeof i.minimumReleaseAge=="number"&&i.minimumReleaseAge>0?i.minimumReleaseAge/1440:void 0,mode:o,respectDependabotConfig:!0,style:s}},"buildEcosystemOptions"),lo=N((e,t)=>e.dryRun===!0||process.exitCode!==void 0&&process.exitCode!==0||t.canceled?!1:e.yes===!0?!0:e.interactive===!0&&!!process.stdout.isTTY&&!ve,"shouldApplyEcosystem"),uo=N(async(e,t,n,s,r)=>{const o=co(t,n);if(o.disabled.size===3)return;let i;try{i=await Gs({options:o,workspaceRoot:e})}catch(m){s.warn(`${U("⚠")} Ecosystem update scan failed: ${m.message}`);return}if(i.scanned===0)return i;const a=t.format??"table",d=!!t.dryRun,l=lo(t,r);if(a==="json")r.jsonEmitted?s.warn(`${U("⚠")} ${String(i.updates.length)} ecosystem update${i.updates.length===1?"":"s"} available but not emitted in --format=json (catalog already wrote one JSON document). Rerun with --format=table or --no-catalog to see them.`):process.stdout.write(`${Ys(i)}
-`);else if(a!=="minimal"){const m=Js(i,{previewOnly:!l&&!d,showIgnored:t.interactive===!0});m&&s.info(m)}if(i.updates.length===0)return i;if(d)return a==="minimal"&&s.info(`
-${U("ℹ")} ${String(i.updates.length)} ecosystem reference${i.updates.length===1?"":"s"} can be bumped — not applied (--dry-run). Re-run without --dry-run and with \`--interactive\` or \`--yes\` to apply.`),i;if(!l)return a==="minimal"&&s.info(`
-${U("ℹ")} ${String(i.updates.length)} ecosystem reference${i.updates.length===1?"":"s"} can be bumped — not applied automatically. Re-run with \`--interactive\` to choose, or \`--yes\` to apply all (or \`--no-actions\` / \`--no-docker\` / \`--no-gitlab\` to silence by ecosystem).`),i;let c=i.updates;if(t.interactive===!0&&process.stdout.isTTY&&!ve&&(c=await eo(i.updates),c.length===0))return s.info(`${U("ℹ")} No ecosystem updates selected.`),i;const{applied:f,skipped:g}=Zn(c);if(f.length>0&&s.info(`
-${String(f.length)} ecosystem reference${f.length===1?"":"s"} updated.`),g.length>0){s.warn(`${U("⚠")} ${String(g.length)} ecosystem update${g.length===1?"":"s"} skipped:`);for(const m of g)s.warn(`    ${m.update.name} (${m.update.file}:${String(m.update.line)}): ${m.reason}`)}return i},"runEcosystemUpdate"),po=N(e=>{const t=e.style;if(t!==void 0&&t!=="sha"&&t!=="preserve")throw new Error(`Invalid --style "${t}". Use: sha or preserve.`);const n=e.target;if(n!==void 0&&n!=="latest"&&n!=="minor"&&n!=="patch")throw new Error(`Invalid --target "${n}". Use: latest, minor, or patch.`)},"validateEcosystemFlags"),Eo=N(async({argument:e,logger:t,options:n,visConfig:s,workspaceRoot:r})=>{if(!r)throw new Error("Could not determine workspace root. Run this command inside a monorepo.");po(n);let o=e;const i=r,{packageManager:a}=Bt(i);if(n.typosquatCheck!==!1){if(o.length>0){const c=o.map(m=>Zt(m)),f=s?.security?.typosquatAllowlist,g=await Kt(c.map(m=>m.name),f);if(!g.ok){process.exitCode=1;return}o=c.map((m,h)=>{const x=g.packages[h];return x!==m.name?m.versionSpec?`${x}@${m.versionSpec}`:x??"":o[h]??""})}else if(!await Jt(i,s?.security?.typosquatAllowlist)){process.exitCode=1;return}}if(n.rollback){if(!Pt(i,a)){t.info("No backup found. Run 'vis update' first to create a backup.");return}if(Vt(i,a))t.info("Restored from backup.");else throw new Error("Failed to restore from backup.");return}if(!await ao(n,o.length>0,t))return;const d=n.catalog!==!1&&Mt(i,a);let l;if(d)l=await ro(i,a,s??{},n,o,t);else{const c=Wt(i,{configBackend:s?.install?.backend,configCorepack:s?.install?.corepack}),f=c.name==="aube"?"":_t(c.name);l=await io(i,c.name,f,n,o,t)}o.length===0&&await uo(i,n,s??{},t,l)},"execute");export{Eo as default,So as formatMinutesAsTimeString,no as parseNpmReleaseAgeValue,gt as parseTimeStringToMinutes,so as readPmNativeMinimumReleaseAge,ao as requireBlanketUpdateConfirmation,uo as runEcosystemUpdate,lo as shouldApplyEcosystem};
+import{createRequire as Et}from"node:module";import{V as we,E as D,s as ye,q as pt,Q as dt}from"../packem_shared/Table-CcVkyULl-B_ef6zfS.js";import{I as Lt,m as z,f as J,v as be,T as Ze,B as Tt}from"../packem_shared/index-BDmTbWX1.js";import{ad as Pt,ab as Vt,ac as zt,aC as Wt,u as Ve,l as _t,s as Ht,aR as Ut,p as u,i as Qe,a as Ft,N as Gt,f as Bt,Z as Xe,b as Kt,O as qt,j as De,a3 as Jt,a0 as Yt,a2 as Zt}from"./bin.js";import{whichBin as Qt}from"#native";import{r as ei,R as ti,b as ii}from"../packem_shared/ai-analysis-DT3bU-_M.js";import{s as L,w as ai,M as ni}from"../packem_shared/pm-runner-pVihAfxV.js";import{c as gt,s as he,p as ri,e as oi,g as si}from"../packem_shared/index-DMefdF51.js";import{d as li}from"../packem_shared/anolilab-text-CAM_E6uK.js";import{t as ci,b as pi}from"../packem_shared/cyclonedx-86-DbHtf.js";import{s as fi}from"../packem_shared/scan-progress-JBbd9QeT.js";import{r as ui,A as et,q as tt}from"../packem_shared/advisories-DLeO5KMN.js";import{a as ut}from"./config.js";import{l as mi,f as hi,a as vi}from"../packem_shared/dependency-scan-BDTH898x.js";import{r as wi}from"../packem_shared/manifests-Dj3pRKBT.js";import{l as $i,p as Si,O as Ni}from"../packem_shared/osv-bloom-B03tUWf3.js";const Ot=Et(import.meta.url),ee=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,Y=e=>{if(typeof ee<"u"&&ee.versions&&ee.versions.node){const[t,i]=ee.versions.node.split(".").map(Number);if(t>22||t===22&&i>=3||t===20&&i>=16)return ee.getBuiltinModule(e)}return Ot(e)},{spawnSync:Dt}=Y("node:child_process"),{createInterface:Mt}=Y("node:readline"),{stripVTControlCharacters:Xt}=Y("node:util"),{createHash:di}=Y("node:crypto"),{relative:ft,join:gi}=Y("node:path"),{readFileSync:mt,existsSync:yi,writeFileSync:bi,renameSync:xi,unlinkSync:ki}=Y("node:fs"),it=(e,t={})=>{Array.isArray(t.extensions)||(t.extensions=["js","mjs","cjs","ts"]);const i=[];for(const a of Lt(e,t))i.push(a.path);return i},xe=e=>`${e.packageName}@${e.packageVersion}:${e.vulnerability.id}`,Ai=e=>e==null||e===!0||e===""||e==="true"||e.toString().toLowerCase()==="all",Ci=(e,t)=>{if(Ai(t))return e;const i=String(t).trim();if(/^\d+$/.test(i)){const n=Number.parseInt(i,10)-1,o=e[n];return o?[o]:[]}const a=i.toLowerCase();return e.filter(n=>{const{aliases:o,id:r}=n.vulnerability;return r.toLowerCase()===a||(o??[]).some(l=>l.toLowerCase()===a)})},Ri=e=>{const{packageName:t,packageVersion:i,vulnerability:a}=e,n=(a.aliases??[]).join(", ")||"none",o=(a.fixedVersions??[]).join(", ")||"no fixed version published";return`You are a security engineer. Explain this dependency vulnerability for a developer triaging it.
+
+Package: ${t}@${i}
+Advisory: ${a.id} (aliases: ${n})
+Severity: ${a.severity}
+Fixed in: ${o}
+Summary: ${a.summary}
+
+Respond ONLY with valid JSON in this exact structure, each value 1-3 plain sentences, no markdown:
+{
+  "whatItIs": "what the vulnerability is and how it is exploited",
+  "areYouAtRisk": "what usage pattern makes an app actually exposed; be honest that lockfile presence alone is not exploitation",
+  "whatToDo": "the concrete remediation step"
+}`},me=e=>Xt(e).replaceAll(/[\u0000-\u0008\u000B-\u001F\u007F]/gu,"").trim(),Ii=e=>`What it is: ${e.whatItIs}
+Are you at risk: ${e.areYouAtRisk}
+What to do: ${e.whatToDo}`,ji=e=>{const t=ii(e);if(t&&typeof t=="object"){const i=t,a=typeof i.whatItIs=="string"?me(i.whatItIs):"",n=typeof i.areYouAtRisk=="string"?me(i.areYouAtRisk):"",o=typeof i.whatToDo=="string"?me(i.whatToDo):"";if(a||n||o)return Ii({areYouAtRisk:n,whatItIs:a,whatToDo:o})}return me(e)},Ei=async(e,t,i)=>{let a=0;const n=Array.from({length:Math.min(t,e.length)},async()=>{for(;a<e.length;){const o=a;a+=1;const r=e[o];r!==void 0&&await i(r)}});await Promise.all(n)},Oi=3,Di={resolveProvider:ti,runWithRetry:ei},Mi=async(e,t,i,a=Di)=>{const n=new Map;if(e.length===0)return n;const o=a.resolveProvider(t);if(!o)return i?.info?.("No AI CLI provider found on PATH — skipping --explain."),n;const r=Wt("security",t?.cacheTtl);return await Ei(e,Oi,async l=>{const c=xe(l),d=Pt({id:l.vulnerability.id,kind:"audit-explain",name:l.packageName,provider:o.name,version:l.packageVersion}),m=Vt(d);if(typeof m=="string"){n.set(c,m);return}try{const b=await a.runWithRetry(o,Ri(l)),h=ji(b);h&&(n.set(c,h),zt(d,h,r))}catch(b){const h=b instanceof Error?b.message:String(b);i?.warn?.(`Explain failed for ${l.vulnerability.id} (${h}).`)}}),n},ke=e=>Array.isArray(e)?e.filter(t=>typeof t=="string"):[],Me=(e,t)=>{for(const i of t)if(i===e||i.endsWith("*")&&e.startsWith(i.slice(0,-1)))return!0;return!1},ht=e=>{const t=z(e,"pnpm-workspace.yaml");if(!J(t))return{excludedPackages:[],ignoredAdvisories:[]};try{const i=Ve(t);return{excludedPackages:[],ignoredAdvisories:[...ke(i?.auditConfig?.ignoreCves),...ke(i?.auditConfig?.ignoreGhsas)]}}catch{return{excludedPackages:[],ignoredAdvisories:[]}}},vt=e=>{const t=z(e,".yarnrc.yml");if(!J(t))return{excludedPackages:[],ignoredAdvisories:[]};try{const i=Ve(t);return{excludedPackages:ke(i?.npmAuditExcludePackages),ignoredAdvisories:ke(i?.npmAuditIgnoreAdvisories)}}catch{return{excludedPackages:[],ignoredAdvisories:[]}}},Li=(e,t)=>{switch(t){case"pnpm":return ht(e);case"yarn":return vt(e);default:return{excludedPackages:[],ignoredAdvisories:[]}}},ae=(e,t,i)=>{if(Me(e,t.ignoredAdvisories))return!0;if(i){for(const a of i)if(Me(a,t.ignoredAdvisories))return!0}return!1},Ti=(e,t)=>Me(e,t.excludedPackages),Pi=(e,t,i)=>{if(i.length===0)return["No advisory IDs to sync."];const a=[];switch(e){case"bun":{a.push(`bun has no audit config file. Use CLI flags: bun audit ${i.map(n=>`--ignore ${n}`).join(" ")}`);break}case"npm":{a.push("npm has no native audit exclusion config. vis accepted risks are the only layer.");break}case"pnpm":{const n=z(t,"pnpm-workspace.yaml");if(!J(n)){a.push("pnpm-workspace.yaml not found. Cannot sync.");break}const o=ht(t),r=new Set(o.ignoredAdvisories.filter(g=>g.startsWith("CVE-"))),l=new Set(o.ignoredAdvisories.filter(g=>g.startsWith("GHSA-"))),c=i.filter(g=>g.startsWith("CVE-")),d=i.filter(g=>g.startsWith("GHSA-")),m=[...new Set([...r,...c])],b=[...new Set([...l,...d])],h=c.filter(g=>!r.has(g)).length,v=d.filter(g=>!l.has(g)).length;if(h===0&&v===0){a.push("All advisory IDs already present in pnpm-workspace.yaml.");break}let y=be(n);if(m.length>0){const g=`  ignoreCves:
+${m.map($=>`    - ${$}`).join(`
+`)}
+`;/auditConfig:/.test(y)?y=/ignoreCves:/.test(y)?y.replace(/ignoreCves:\s*\n(?:\s+-\s+(?:\S.*|[\t\v\f \u00A0\u1680\u2000-\u200A\u202F\u205F\u3000\uFEFF])\n)*/,g):y.replace(/auditConfig:\s*\n/,`auditConfig:
+${g}`):y=`${y.trimEnd()}
+
+auditConfig:
+${g}`,h>0&&a.push(`Added ${String(h)} new CVE${h===1?"":"s"} to pnpm-workspace.yaml (${String(m.length)} total)`)}if(b.length>0){const g=`  ignoreGhsas:
+${b.map($=>`    - ${$}`).join(`
+`)}
+`;/auditConfig:/.test(y)&&(y=/ignoreGhsas:/.test(y)?y.replace(/ignoreGhsas:\s*\n(?:\s+-\s+(?:\S.*|[\t\v\f \u00A0\u1680\u2000-\u200A\u202F\u205F\u3000\uFEFF])\n)*/,g):y.replace(/(auditConfig:[\s\S]*?)(\n\S|\n?$)/m,`$1${g}$2`)),v>0&&a.push(`Added ${String(v)} new GHSA${v===1?"":"s"} to pnpm-workspace.yaml (${String(b.length)} total)`)}Ze(n,y);break}case"yarn":{const n=z(t,".yarnrc.yml");if(!J(n)){a.push(".yarnrc.yml not found. Cannot sync.");break}const o=vt(t),r=new Set(o.ignoredAdvisories),l=[...new Set([...r,...i])],c=i.filter(b=>!r.has(b)).length;if(c===0){a.push("All advisory IDs already present in .yarnrc.yml.");break}let d=be(n);const m=`npmAuditIgnoreAdvisories:
+${l.map(b=>`  - "${b}"`).join(`
+`)}
+`;d=/npmAuditIgnoreAdvisories:/.test(d)?d.replace(/npmAuditIgnoreAdvisories:\s*\n(?:\s+-\s+(?:\S.*|[\t\v\f \u00A0\u1680\u2000-\u200A\u202F\u205F\u3000\uFEFF])\n)*/,m):`${d.trimEnd()}
+
+${m}`,Ze(n,d),a.push(`Synced ${String(c)} advisor${c===1?"y":"ies"} to .yarnrc.yml (${String(l.length)} total)`);break}default:a.push(`Unknown package manager: ${e}`)}return a},Vi="1.0",zi=e=>{const{bloomHits:t,duplicates:i,explanations:a,filtered:n,now:o,packagesScanned:r,policyDecisions:l,tool:c,unknownPolicyTokens:d,workspaceRoot:m}=e,b=n.map(g=>({acceptedRisk:g.acceptedRisk??null,dependencyPaths:g.dependencyPaths?g.dependencyPaths.map($=>$.map(x=>({name:x.name,version:x.version}))):[],name:g.name,socketAlerts:g.socketReport?.alerts??[],socketScore:g.socketReport?.score.overall??null,version:g.version,vulnerabilities:g.vulnerabilities.map($=>{const x=a.get(xe({packageName:g.name,packageVersion:g.version,vulnerability:$}));return x?{...$,explanation:x}:{...$}})})),h=l.map(g=>({acceptedRisk:g.acceptedRisk??null,data:g.data??null,packageName:g.packageName,policy:g.policy,reason:g.reason,severity:g.severity,version:g.version})),v={accepted:b.filter(g=>g.acceptedRisk!==null).length,duplicatePackages:i.length,issues:b.filter(g=>g.acceptedRisk===null).length,policyBlocks:h.filter(g=>g.severity==="block"&&g.acceptedRisk===null).length,policyDecisions:h.length,total:b.length},y=d.map(g=>({kind:"unknown-policy",token:g}));return{bloomHits:t.map(g=>({name:g.name,version:g.version})),duplicates:i.map(g=>({name:g.name,versionCount:g.versions.length,versions:[...g.versions]})),generatedAt:(o??new Date).toISOString(),packages:r,policies:h,results:b,schemaVersion:Vi,summary:v,tool:c,warnings:y,workspaceRoot:m}},Wi=["CRITICAL","HIGH","MODERATE","LOW","UNKNOWN"],_i={CRITICAL:"error",HIGH:"error",LOW:"note",MODERATE:"warning",UNKNOWN:"none"},Hi={CRITICAL:"critical",HIGH:"high",LOW:"low",MODERATE:"medium",UNKNOWN:"none"},Ui={CRITICAL:9.5,HIGH:8,LOW:2.5,MODERATE:5.5,UNKNOWN:0},Fi=e=>_i[e],Le=e=>Hi[e],Gi=e=>Ui[e],ze=e=>typeof e.cvssScore=="number"&&Number.isFinite(e.cvssScore)?e.cvssScore:Gi(e.severity),Bi=e=>ze(e).toFixed(1),T=e=>e.startsWith("CVE-")?`https://nvd.nist.gov/vuln/detail/${e}`:e.startsWith("GHSA-")?`https://github.com/advisories/${e}`:`https://osv.dev/vulnerability/${e}`,ve=e=>e.startsWith("CVE-")?"NVD":e.startsWith("GHSA-")?"GitHub Advisory Database":"OSV";var Ki=`/*! tailwindcss v4.3.0 | MIT License | https://tailwindcss.com */
+@layer properties{@supports (((-webkit-hyphens:none)) and (not (margin-trim:inline))) or ((-moz-orient:inline) and (not (color:rgb(from red r g b)))){*,:before,:after,::backdrop{--tw-rotate-x:initial;--tw-rotate-y:initial;--tw-rotate-z:initial;--tw-skew-x:initial;--tw-skew-y:initial;--tw-space-y-reverse:0;--tw-border-style:solid;--tw-leading:initial;--tw-font-weight:initial;--tw-tracking:initial;--tw-ordinal:initial;--tw-slashed-zero:initial;--tw-numeric-figure:initial;--tw-numeric-spacing:initial;--tw-numeric-fraction:initial;--tw-shadow:0 0 #0000;--tw-shadow-color:initial;--tw-shadow-alpha:100%;--tw-inset-shadow:0 0 #0000;--tw-inset-shadow-color:initial;--tw-inset-shadow-alpha:100%;--tw-ring-color:initial;--tw-ring-shadow:0 0 #0000;--tw-inset-ring-color:initial;--tw-inset-ring-shadow:0 0 #0000;--tw-ring-inset:initial;--tw-ring-offset-width:0px;--tw-ring-offset-color:#fff;--tw-ring-offset-shadow:0 0 #0000;--tw-outline-style:solid;--tw-blur:initial;--tw-brightness:initial;--tw-contrast:initial;--tw-grayscale:initial;--tw-hue-rotate:initial;--tw-invert:initial;--tw-opacity:initial;--tw-saturate:initial;--tw-sepia:initial;--tw-drop-shadow:initial;--tw-drop-shadow-color:initial;--tw-drop-shadow-alpha:100%;--tw-drop-shadow-size:initial;--tw-backdrop-blur:initial;--tw-backdrop-brightness:initial;--tw-backdrop-contrast:initial;--tw-backdrop-grayscale:initial;--tw-backdrop-hue-rotate:initial;--tw-backdrop-invert:initial;--tw-backdrop-opacity:initial;--tw-backdrop-saturate:initial;--tw-backdrop-sepia:initial;--tw-duration:initial;--tw-content:""}}}@layer theme{:root,:host{--font-sans:ui-sans-serif, system-ui, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";--font-mono:ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;--color-white:#fff;--spacing:.25rem;--text-sm:.875rem;--text-sm--line-height:calc(1.25 / .875);--font-weight-light:300;--font-weight-medium:500;--font-weight-semibold:600;--font-weight-bold:700;--tracking-tight:-.025em;--tracking-normal:0em;--leading-tight:1.25;--leading-snug:1.375;--radius-sm:.25rem;--ease-out:cubic-bezier(0, 0, .2, 1);--blur-sm:8px;--default-transition-duration:.15s;--default-transition-timing-function:cubic-bezier(.4, 0, .2, 1);--default-font-family:var(--font-sans);--default-mono-font-family:var(--font-mono)}}@layer base{*,:after,:before,::backdrop{box-sizing:border-box;border:0 solid;margin:0;padding:0}::file-selector-button{box-sizing:border-box;border:0 solid;margin:0;padding:0}html,:host{-webkit-text-size-adjust:100%;tab-size:4;line-height:1.5;font-family:var(--default-font-family,ui-sans-serif, system-ui, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji");font-feature-settings:var(--default-font-feature-settings,normal);font-variation-settings:var(--default-font-variation-settings,normal);-webkit-tap-highlight-color:transparent}hr{height:0;color:inherit;border-top-width:1px}abbr:where([title]){-webkit-text-decoration:underline dotted;text-decoration:underline dotted}h1,h2,h3,h4,h5,h6{font-size:inherit;font-weight:inherit}a{color:inherit;-webkit-text-decoration:inherit;-webkit-text-decoration:inherit;-webkit-text-decoration:inherit;text-decoration:inherit}b,strong{font-weight:bolder}code,kbd,samp,pre{font-family:var(--default-mono-font-family,ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace);font-feature-settings:var(--default-mono-font-feature-settings,normal);font-variation-settings:var(--default-mono-font-variation-settings,normal);font-size:1em}small{font-size:80%}sub,sup{vertical-align:baseline;font-size:75%;line-height:0;position:relative}sub{bottom:-.25em}sup{top:-.5em}table{text-indent:0;border-color:inherit;border-collapse:collapse}:-moz-focusring{outline:auto}progress{vertical-align:baseline}summary{display:list-item}ol,ul,menu{list-style:none}img,svg,video,canvas,audio,iframe,embed,object{vertical-align:middle;display:block}img,video{max-width:100%;height:auto}button,input,select,optgroup,textarea{font:inherit;font-feature-settings:inherit;font-variation-settings:inherit;letter-spacing:inherit;color:inherit;opacity:1;background-color:#0000;border-radius:0}::file-selector-button{font:inherit;font-feature-settings:inherit;font-variation-settings:inherit;letter-spacing:inherit;color:inherit;opacity:1;background-color:#0000;border-radius:0}:where(select:is([multiple],[size])) optgroup{font-weight:bolder}:where(select:is([multiple],[size])) optgroup option{padding-inline-start:20px}::file-selector-button{margin-inline-end:4px}::placeholder{opacity:1}@supports (not ((-webkit-appearance:-apple-pay-button))) or (contain-intrinsic-size:1px){::placeholder{color:currentColor}@supports (color:color-mix(in lab, red, red)){::placeholder{color:color-mix(in oklab, currentcolor 50%, transparent)}}}textarea{resize:vertical}::-webkit-search-decoration{-webkit-appearance:none}::-webkit-date-and-time-value{min-height:1lh;text-align:inherit}::-webkit-datetime-edit{padding-block:0}::-webkit-datetime-edit-year-field{padding-block:0}::-webkit-datetime-edit-month-field{padding-block:0}::-webkit-datetime-edit-day-field{padding-block:0}::-webkit-datetime-edit-hour-field{padding-block:0}::-webkit-datetime-edit-minute-field{padding-block:0}::-webkit-datetime-edit-second-field{padding-block:0}::-webkit-datetime-edit-millisecond-field{padding-block:0}::-webkit-datetime-edit-meridiem-field{padding-block:0}::-webkit-calendar-picker-indicator{line-height:1}:-moz-ui-invalid{box-shadow:none}button,input:where([type=button],[type=reset],[type=submit]){appearance:button}::file-selector-button{appearance:button}::-webkit-inner-spin-button{height:auto}::-webkit-outer-spin-button{height:auto}[hidden]:where(:not([hidden=until-found])){display:none!important}:root{--bg:#f5f5f5;--panel:#fff;--panel2:#f0f0f0;--fg:#000;--muted:#555;--faint:#707070;--border:#e0e0e0;--border2:#bdbdbd;--row-hover:#f0f0f0;--accent:#d71921;--accent-soft:#d719210d;--link:#0050c0;--critical:#d71921;--high:#8a5a00;--medium:#555;--low:#707070;--unknown:#707070;--major:#d71921;--minor:#1f7a3d;--mono:ui-monospace, "SF Mono", "JetBrains Mono", "Cascadia Mono", "Roboto Mono", Menlo, Consolas, monospace;--sans:system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", sans-serif}@media (prefers-color-scheme:dark){:root{--bg:#141414;--panel:#1c1c1c;--panel2:#242424;--fg:#fff;--muted:#b8b8b8;--faint:#8a8a8a;--border:#2e2e2e;--border2:#3e3e3e;--row-hover:#1f1f1f;--accent:#ff4d54;--accent-soft:#ff4d5414;--link:#7eb0f9;--critical:#ff4d54;--high:#e0b860;--medium:#b8b8b8;--low:#8a8a8a;--unknown:#8a8a8a;--major:#ff4d54;--minor:#6dbf80}}html[data-theme=light]{--bg:#f5f5f5;--panel:#fff;--panel2:#f0f0f0;--fg:#000;--muted:#555;--faint:#707070;--border:#e0e0e0;--border2:#bdbdbd;--row-hover:#f0f0f0;--accent:#d71921;--accent-soft:#d719210d;--link:#0050c0;--critical:#d71921;--high:#8a5a00;--medium:#555;--low:#707070;--unknown:#707070;--major:#d71921;--minor:#1f7a3d}html[data-theme=dark]{--bg:#141414;--panel:#1c1c1c;--panel2:#242424;--fg:#fff;--muted:#b8b8b8;--faint:#8a8a8a;--border:#2e2e2e;--border2:#3e3e3e;--row-hover:#1f1f1f;--accent:#ff4d54;--accent-soft:#ff4d5414;--link:#7eb0f9;--critical:#ff4d54;--high:#e0b860;--medium:#b8b8b8;--low:#8a8a8a;--unknown:#8a8a8a;--major:#ff4d54;--minor:#6dbf80}*{box-sizing:border-box}html{-webkit-text-size-adjust:100%}body{font-family:var(--sans);background-color:var(--bg);background-image:radial-gradient(circle, var(--border) .5px, transparent .5px);color:var(--fg);-webkit-font-smoothing:antialiased;font-feature-settings:"ss01";background-size:14px 14px;margin:0;padding:24px;line-height:1.5}a{color:var(--link);text-decoration:none}code{font-family:var(--mono);font-size:12px}h2{font-family:var(--mono);letter-spacing:.16em;text-transform:uppercase;color:var(--muted);margin:48px 0 14px;font-size:11px;font-weight:500}input:where([type=text]),input:where(:not([type])),input:where([type=email]),input:where([type=url]),input:where([type=password]),input:where([type=number]),input:where([type=date]),input:where([type=datetime-local]),input:where([type=month]),input:where([type=search]),input:where([type=tel]),input:where([type=time]),input:where([type=week]),select:where([multiple]),textarea,select{appearance:none;--tw-shadow:0 0 #0000;background-color:#fff;border-width:1px;border-color:oklch(55.1% .027 264.364);border-radius:0;padding:.5rem .75rem;font-size:1rem;line-height:1.5rem}:is(input:where([type=text]),input:where(:not([type])),input:where([type=email]),input:where([type=url]),input:where([type=password]),input:where([type=number]),input:where([type=date]),input:where([type=datetime-local]),input:where([type=month]),input:where([type=search]),input:where([type=tel]),input:where([type=time]),input:where([type=week]),select:where([multiple]),textarea,select):focus{outline-offset:2px;--tw-ring-inset:var(--tw-empty, );--tw-ring-offset-width:0px;--tw-ring-offset-color:#fff;--tw-ring-color:oklch(54.6% .245 262.881);--tw-ring-offset-shadow:var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);--tw-ring-shadow:var(--tw-ring-inset) 0 0 0 calc(1px + var(--tw-ring-offset-width)) var(--tw-ring-color);box-shadow:var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow);border-color:oklch(54.6% .245 262.881);outline:2px solid #0000}input::placeholder,textarea::placeholder{color:oklch(55.1% .027 264.364);opacity:1}::-webkit-datetime-edit-fields-wrapper{padding:0}::-webkit-date-and-time-value{min-height:1.5em}::-webkit-date-and-time-value{text-align:inherit}::-webkit-datetime-edit{display:inline-flex}::-webkit-datetime-edit{padding-top:0;padding-bottom:0}::-webkit-datetime-edit-year-field{padding-top:0;padding-bottom:0}::-webkit-datetime-edit-month-field{padding-top:0;padding-bottom:0}::-webkit-datetime-edit-day-field{padding-top:0;padding-bottom:0}::-webkit-datetime-edit-hour-field{padding-top:0;padding-bottom:0}::-webkit-datetime-edit-minute-field{padding-top:0;padding-bottom:0}::-webkit-datetime-edit-second-field{padding-top:0;padding-bottom:0}::-webkit-datetime-edit-millisecond-field{padding-top:0;padding-bottom:0}::-webkit-datetime-edit-meridiem-field{padding-top:0;padding-bottom:0}select{-webkit-print-color-adjust:exact;print-color-adjust:exact;background-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' fill='none' viewBox='0 0 20 20'%3e%3cpath stroke='oklch(55.1%25 0.027 264.364)' stroke-linecap='round' stroke-linejoin='round' stroke-width='1.5' d='M6 8l4 4 4-4'/%3e%3c/svg%3e");background-position:right .5rem center;background-repeat:no-repeat;background-size:1.5em 1.5em;padding-right:2.5rem}select:where([multiple]),select:where([size]:not([size="1"])){background-image:initial;background-position:initial;background-repeat:unset;background-size:initial;print-color-adjust:unset;padding-right:.75rem}input:where([type=checkbox]),input:where([type=radio]){appearance:none;-webkit-print-color-adjust:exact;print-color-adjust:exact;vertical-align:middle;-webkit-user-select:none;user-select:none;color:oklch(54.6% .245 262.881);--tw-shadow:0 0 #0000;background-color:#fff;background-origin:border-box;border-width:1px;border-color:oklch(55.1% .027 264.364);flex-shrink:0;width:1rem;height:1rem;padding:0;display:inline-block}input:where([type=checkbox]){border-radius:0}input:where([type=radio]){border-radius:100%}input:where([type=checkbox]):focus,input:where([type=radio]):focus{outline-offset:2px;--tw-ring-inset:var(--tw-empty, );--tw-ring-offset-width:2px;--tw-ring-offset-color:#fff;--tw-ring-color:oklch(54.6% .245 262.881);--tw-ring-offset-shadow:var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);--tw-ring-shadow:var(--tw-ring-inset) 0 0 0 calc(2px + var(--tw-ring-offset-width)) var(--tw-ring-color);box-shadow:var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow);outline:2px solid #0000}input:where([type=checkbox]):checked,input:where([type=radio]):checked{background-color:currentColor;background-position:50%;background-repeat:no-repeat;background-size:100% 100%;border-color:#0000}input:where([type=checkbox]):checked{background-image:url("data:image/svg+xml,%3csvg viewBox='0 0 16 16' fill='white' xmlns='http://www.w3.org/2000/svg'%3e%3cpath d='M12.207 4.793a1 1 0 010 1.414l-5 5a1 1 0 01-1.414 0l-2-2a1 1 0 011.414-1.414L6.5 9.086l4.293-4.293a1 1 0 011.414 0z'/%3e%3c/svg%3e")}@media (forced-colors:active){input:where([type=checkbox]):checked{appearance:auto}}input:where([type=radio]):checked{background-image:url("data:image/svg+xml,%3csvg viewBox='0 0 16 16' fill='white' xmlns='http://www.w3.org/2000/svg'%3e%3ccircle cx='8' cy='8' r='3'/%3e%3c/svg%3e")}@media (forced-colors:active){input:where([type=radio]):checked{appearance:auto}}input:where([type=checkbox]):checked:hover,input:where([type=checkbox]):checked:focus,input:where([type=radio]):checked:hover,input:where([type=radio]):checked:focus{background-color:currentColor;border-color:#0000}input:where([type=checkbox]):indeterminate{background-color:currentColor;background-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' fill='none' viewBox='0 0 16 16'%3e%3cpath stroke='white' stroke-linecap='round' stroke-linejoin='round' stroke-width='2' d='M4 8h8'/%3e%3c/svg%3e");background-position:50%;background-repeat:no-repeat;background-size:100% 100%;border-color:#0000}@media (forced-colors:active){input:where([type=checkbox]):indeterminate{appearance:auto}}input:where([type=checkbox]):indeterminate:hover,input:where([type=checkbox]):indeterminate:focus{background-color:currentColor;border-color:#0000}input:where([type=file]){background:unset;border-color:inherit;font-size:unset;line-height:inherit;border-width:0;border-radius:0;padding:0}input:where([type=file]):focus{outline:1px solid buttontext;outline:1px auto -webkit-focus-ring-color}}@layer components{.masthead{border-bottom:1px solid var(--border)}.brand{font-family:var(--sans);color:var(--fg);font-size:clamp(30px,5vw,52px);font-weight:600}.brand .slash{color:var(--accent)}.brand .sub{font-family:var(--mono);letter-spacing:.22em;color:var(--faint)}.chip{font-family:var(--mono);letter-spacing:.08em;color:var(--muted);border:1px solid var(--border2)}.tbtn{font-family:var(--mono);letter-spacing:.08em;color:var(--muted);border:1px solid var(--border2);transition:border-color .2s,color .2s}.tbtn:hover{color:var(--fg);border-color:var(--fg)}.tbtn-theme{min-width:28px}.tbtn-theme .ticon{line-height:0}.tbtn-theme .ticon-sun{display:none}@media (prefers-color-scheme:dark){.tbtn-theme .ticon-moon{display:none}.tbtn-theme .ticon-sun{display:inline-flex}}html[data-theme=light] .tbtn-theme .ticon-moon{display:inline-flex}html[data-theme=light] .tbtn-theme .ticon-sun,html[data-theme=dark] .tbtn-theme .ticon-moon{display:none}html[data-theme=dark] .tbtn-theme .ticon-sun{display:inline-flex}.verdict{padding:56px 0 36px}.verdict .vnum{font-family:var(--mono);letter-spacing:-.04em;color:var(--fg);font-variant-numeric:tabular-nums;font-size:clamp(64px,14vw,148px);line-height:.85}.verdict .vsub{font-family:var(--mono);letter-spacing:.16em;color:var(--faint)}.verdict-crit .vnum{color:var(--accent)}.verdict-high .vnum{color:var(--high)}.debugbar{border-bottom:1px solid var(--border)}.dseg+.dseg{border-left:1px solid var(--border);padding-left:1.75rem}.dseg .dk{font-family:var(--mono);letter-spacing:.13em;color:var(--faint)}.dseg .dv{font-family:var(--mono);color:var(--fg);font-variant-numeric:tabular-nums;letter-spacing:-.01em;font-weight:400}.dseg .dvsep{color:var(--faint)}.dseg .dot{background:var(--unknown)}.dseg-critical .dv{color:var(--critical)}.dseg-high .dv{color:var(--high)}.dseg-moderate .dv{color:var(--medium)}.dseg-low .dv{color:var(--low)}.dseg-ok .dot{background:var(--minor)}.dseg-ok .dv,.dseg-fixable .dv{color:var(--minor)}.field{border-bottom:1px solid var(--border2);background:0 0;transition:border-color .2s}.field:focus-within{border-bottom-color:var(--fg)}.field .prompt{font-family:var(--mono);letter-spacing:.12em;color:var(--faint)}.field input,.field select{font-family:var(--mono);color:var(--fg)}.field.sel{margin-left:32px}.field select{text-transform:uppercase;letter-spacing:.06em;font-size:11px}.field select option{background:var(--panel);color:var(--fg);text-transform:none;letter-spacing:0}.field input::placeholder{color:var(--faint);text-transform:uppercase;letter-spacing:.06em;font-size:11px}#findings{border-collapse:collapse}#findings thead th{font-family:var(--mono);letter-spacing:.11em;color:var(--faint);background:var(--bg);border-bottom:1px solid var(--border2)}#findings td,#findings tbody tr:last-child td{border-bottom:1px solid var(--border)}.finding-row:hover td{background:var(--row-hover)}.sev-cell{box-shadow:inset 2px 0 0 var(--border2)}tr[data-severity=CRITICAL] .sev-cell{box-shadow:inset 2px 0 0 var(--critical)}tr[data-severity=HIGH] .sev-cell{box-shadow:inset 2px 0 0 var(--high)}tr[data-severity=MODERATE] .sev-cell{box-shadow:inset 2px 0 0 var(--medium)}tr[data-severity=LOW] .sev-cell{box-shadow:inset 2px 0 0 var(--low)}tr[data-severity=UNKNOWN] .sev-cell{box-shadow:inset 2px 0 0 var(--unknown)}.ack-row td{opacity:.4}.ack-row .summary-cell,.ack-row a{color:var(--muted)}code.pkg{color:var(--fg)}code.ver,code.fix{color:var(--muted)}code.fix{color:var(--minor)}code.copyable{cursor:copy;padding-inline:calc(var(--spacing) * 2);padding-block:calc(var(--spacing) * 1);white-space:nowrap;color:var(--fg);border:1px solid var(--border2);background:0 0;border-radius:3px;font-size:12px;transition:border-color .2s,color .2s;display:inline-block}code.copyable:hover{border-color:var(--fg)}code.copyable.copied{color:var(--minor);border-color:var(--minor)}.adv-cell a{font-family:var(--mono);color:var(--link);border-bottom:1px solid #0000;transition:border-color .2s}.adv-cell a:hover{border-bottom-color:var(--link)}.summary-cell{font-family:var(--sans);color:var(--muted);line-height:1.5}.muted{font-family:var(--mono);letter-spacing:.06em;color:var(--faint)}.ack{font-family:var(--mono);letter-spacing:.12em;color:var(--faint);border:1px solid var(--border2)}.badge{font-family:var(--mono);letter-spacing:.1em;border:1px solid}.badge:before{content:"";background:currentColor;width:5px;height:5px}.badge-critical{color:var(--critical)}.badge-high{color:var(--high)}.badge-moderate{color:var(--medium)}.badge-low{color:var(--low)}.badge-unknown{color:var(--unknown)}.marker{font-family:var(--mono);letter-spacing:.09em}.marker-major{color:var(--major)}.marker-minor-patch{color:var(--minor)}.marker-unknown{color:var(--unknown)}.empty{font-family:var(--mono);letter-spacing:.1em;color:var(--faint);border-top:1px solid var(--border);border-bottom:1px solid var(--border)}.clean{padding-top:96px;padding-bottom:96px}.clean .big{font-family:var(--mono);letter-spacing:-.03em;color:var(--fg);font-size:clamp(56px,12vw,128px);line-height:1}.clean .sub{font-family:var(--mono);letter-spacing:.16em;color:var(--faint)}#policies{border-collapse:collapse}#policies th{font-family:var(--mono);letter-spacing:.12em;color:var(--faint);background:var(--bg);border-bottom:1px solid var(--border2)}#policies td,#policies tr:last-child td{border-bottom:1px solid var(--border)}#policies code{letter-spacing:.04em;color:var(--muted)}.policy-badge{font-family:var(--mono);letter-spacing:.1em;border:1px solid}.policy-badge:before{content:"";background:currentColor;width:5px;height:5px}.policy-block{color:var(--accent)}.policy-warn{color:var(--high)}.policy-info{color:var(--muted)}.hint{font-family:var(--mono);letter-spacing:.1em;color:var(--faint)}.kbd{font-family:var(--mono);letter-spacing:.06em;color:var(--muted);background:var(--panel2);border:1px solid var(--border2)}.explain-row td{border-top:1px dotted var(--accent);border-bottom:1px solid var(--border);box-shadow:inset 2px 0 0 var(--accent);background:0 0}.finding-row:has(+.explain-row) td{border-bottom:none}.explain-row details{background:0 0}.explain-row summary::-webkit-details-marker{display:none}.intel-tag{font-family:var(--mono);letter-spacing:.16em;color:var(--accent)}.intel-hint{font-family:var(--mono);letter-spacing:.1em;color:var(--muted)}.explain-row details[open] summary .intel-hint:after{content:" [-]"}.explain-row details:not([open]) summary .intel-hint:after{content:" [+]"}.explain-body{animation:.2s both rise}.intel-key{font-family:var(--mono);letter-spacing:.12em;color:var(--accent)}.intel-val{font-family:var(--sans);color:var(--fg);line-height:1.55}.intel-prose{color:var(--muted);grid-template-columns:1fr}.intel-prose .intel-val{color:var(--muted)}.sig{font-family:var(--mono);letter-spacing:.1em;color:var(--faint);border-top:1px solid var(--border)}.sig b{color:var(--muted);font-weight:500}.sig-by{color:var(--muted)}.anolilab-logo{width:auto;height:13px;fill:var(--fg)}.anolilab-accent{fill:#dfff1b}@keyframes rise{0%{opacity:0;transform:translateY(4px)}to{opacity:1;transform:none}}@media (prefers-reduced-motion:reduce){.explain-body{animation:none}}}@layer utilities{.pointer-events-auto{pointer-events:auto}.pointer-events-none{pointer-events:none}.collapse{visibility:collapse}.invisible{visibility:hidden}.visible{visibility:visible}.absolute{position:absolute}.fixed{position:fixed}.relative{position:relative}.static{position:static}.sticky{position:sticky}.inset-0{inset:calc(var(--spacing) * 0)}.inset-x-0{inset-inline:calc(var(--spacing) * 0)}.top-0{top:calc(var(--spacing) * 0)}.top-3{top:calc(var(--spacing) * 3)}.top-4{top:calc(var(--spacing) * 4)}.top-full{top:100%}.right-0{right:calc(var(--spacing) * 0)}.right-4{right:calc(var(--spacing) * 4)}.bottom-4{bottom:calc(var(--spacing) * 4)}.bottom-5{bottom:calc(var(--spacing) * 5)}.left-0{left:calc(var(--spacing) * 0)}.left-4{left:calc(var(--spacing) * 4)}.isolate{isolation:isolate}.z-20{z-index:20}.z-30{z-index:30}.z-\\[2\\]{z-index:2}.container{width:100%}@media (min-width:40rem){.container{max-width:40rem}}@media (min-width:48rem){.container{max-width:48rem}}@media (min-width:64rem){.container{max-width:64rem}}@media (min-width:80rem){.container{max-width:80rem}}@media (min-width:96rem){.container{max-width:96rem}}.mx-1{margin-inline:calc(var(--spacing) * 1)}.mx-12{margin-inline:calc(var(--spacing) * 12)}.mx-\\[0\\.12em\\]{margin-inline:.12em}.mx-auto{margin-inline:auto}.mt-1{margin-top:calc(var(--spacing) * 1)}.mt-2{margin-top:calc(var(--spacing) * 2)}.mt-3{margin-top:calc(var(--spacing) * 3)}.mt-4{margin-top:calc(var(--spacing) * 4)}.mt-6{margin-top:calc(var(--spacing) * 6)}.mt-12{margin-top:calc(var(--spacing) * 12)}.mb-1{margin-bottom:calc(var(--spacing) * 1)}.mb-2{margin-bottom:calc(var(--spacing) * 2)}.mb-3{margin-bottom:calc(var(--spacing) * 3)}.mb-4{margin-bottom:calc(var(--spacing) * 4)}.mb-6{margin-bottom:calc(var(--spacing) * 6)}.mb-10{margin-bottom:calc(var(--spacing) * 10)}.ml-2{margin-left:calc(var(--spacing) * 2)}.ml-8{margin-left:calc(var(--spacing) * 8)}.ml-auto{margin-left:auto}.block{display:block}.contents{display:contents}.flex{display:flex}.grid{display:grid}.hidden{display:none}.inline{display:inline}.inline-block{display:inline-block}.inline-flex{display:inline-flex}.table{display:table}.size-\\[7px\\]{width:7px;height:7px}.h-2{height:calc(var(--spacing) * 2)}.h-5{height:calc(var(--spacing) * 5)}.h-7{height:calc(var(--spacing) * 7)}.h-9{height:calc(var(--spacing) * 9)}.h-10{height:calc(var(--spacing) * 10)}.h-11{height:calc(var(--spacing) * 11)}.h-\\[6px\\]{height:6px}.h-\\[7px\\]{height:7px}.h-\\[8px\\]{height:8px}.h-\\[10px\\]{height:10px}.h-\\[18px\\]{height:18px}.h-full{height:100%}.h-px{height:1px}.max-h-72{max-height:calc(var(--spacing) * 72)}.min-h-\\[400px\\]{min-height:400px}.min-h-\\[480px\\]{min-height:480px}.min-h-screen{min-height:100vh}.w-2{width:calc(var(--spacing) * 2)}.w-3{width:calc(var(--spacing) * 3)}.w-4{width:calc(var(--spacing) * 4)}.w-7{width:calc(var(--spacing) * 7)}.w-9{width:calc(var(--spacing) * 9)}.w-\\[7px\\]{width:7px}.w-\\[8px\\]{width:8px}.w-full{width:100%}.w-px{width:1px}.max-w-\\[380px\\]{max-width:380px}.max-w-\\[1080px\\]{max-width:1080px}.min-w-0{min-width:calc(var(--spacing) * 0)}.min-w-5{min-width:calc(var(--spacing) * 5)}.min-w-\\[200px\\]{min-width:200px}.min-w-\\[220px\\]{min-width:220px}.min-w-\\[260px\\]{min-width:260px}.flex-1{flex:1}.flex-\\[1_1_280px\\]{flex:280px}.flex-auto{flex:auto}.flex-none{flex:none}.shrink{flex-shrink:1}.shrink-0{flex-shrink:0}.grow{flex-grow:1}.caption-bottom{caption-side:bottom}.border-collapse{border-collapse:collapse}.transform{transform:var(--tw-rotate-x,) var(--tw-rotate-y,) var(--tw-rotate-z,) var(--tw-skew-x,) var(--tw-skew-y,)}.cursor-move{cursor:move}.cursor-pointer{cursor:pointer}.resize{resize:both}.grid-cols-2{grid-template-columns:repeat(2,minmax(0,1fr))}.grid-cols-\\[72px_1fr\\]{grid-template-columns:72px 1fr}.flex-col{flex-direction:column}.flex-wrap{flex-wrap:wrap}.items-baseline{align-items:baseline}.items-center{align-items:center}.items-end{align-items:flex-end}.items-start{align-items:flex-start}.items-stretch{align-items:stretch}.justify-between{justify-content:space-between}.justify-center{justify-content:center}.gap-0{gap:calc(var(--spacing) * 0)}.gap-1{gap:calc(var(--spacing) * 1)}.gap-1\\.5{gap:calc(var(--spacing) * 1.5)}.gap-2{gap:calc(var(--spacing) * 2)}.gap-3{gap:calc(var(--spacing) * 3)}.gap-4{gap:calc(var(--spacing) * 4)}.gap-6{gap:calc(var(--spacing) * 6)}.gap-8{gap:calc(var(--spacing) * 8)}.gap-12{gap:calc(var(--spacing) * 12)}.gap-16{gap:calc(var(--spacing) * 16)}.gap-\\[0\\.65rem\\]{gap:.65rem}.gap-\\[2px\\]{gap:2px}.gap-\\[7px\\]{gap:7px}.gap-px{gap:1px}:where(.space-y-0\\.5>:not(:last-child)){--tw-space-y-reverse:0;margin-block-start:calc(calc(var(--spacing) * .5) * var(--tw-space-y-reverse));margin-block-end:calc(calc(var(--spacing) * .5) * calc(1 - var(--tw-space-y-reverse)))}.gap-x-3{column-gap:calc(var(--spacing) * 3)}.gap-x-6{column-gap:calc(var(--spacing) * 6)}.gap-y-1{row-gap:calc(var(--spacing) * 1)}.gap-y-2{row-gap:calc(var(--spacing) * 2)}.gap-y-3{row-gap:calc(var(--spacing) * 3)}.self-center{align-self:center}.truncate{text-overflow:ellipsis;white-space:nowrap;overflow:hidden}.overflow-auto{overflow:auto}.overflow-y-auto{overflow-y:auto}.rounded{border-radius:.25rem}.rounded-\\[3px\\]{border-radius:3px}.rounded-\\[4px\\]{border-radius:4px}.rounded-full{border-radius:3.40282e38px}.rounded-sm{border-radius:var(--radius-sm)}.border{border-style:var(--tw-border-style);border-width:1px}.border-0{border-style:var(--tw-border-style);border-width:0}.border-t{border-top-style:var(--tw-border-style);border-top-width:1px}.border-b{border-bottom-style:var(--tw-border-style);border-bottom-width:1px}.border-l-2{border-left-style:var(--tw-border-style);border-left-width:2px}.border-dashed{--tw-border-style:dashed;border-style:dashed}.bg-transparent{background-color:#0000}.p-0{padding:calc(var(--spacing) * 0)}.p-5{padding:calc(var(--spacing) * 5)}.p-6{padding:calc(var(--spacing) * 6)}.px-0{padding-inline:calc(var(--spacing) * 0)}.px-0\\.5{padding-inline:calc(var(--spacing) * .5)}.px-1{padding-inline:calc(var(--spacing) * 1)}.px-1\\.5{padding-inline:calc(var(--spacing) * 1.5)}.px-2{padding-inline:calc(var(--spacing) * 2)}.px-3{padding-inline:calc(var(--spacing) * 3)}.px-4{padding-inline:calc(var(--spacing) * 4)}.px-5{padding-inline:calc(var(--spacing) * 5)}.px-6{padding-inline:calc(var(--spacing) * 6)}.px-8{padding-inline:calc(var(--spacing) * 8)}.px-12{padding-inline:calc(var(--spacing) * 12)}.px-\\[5px\\]{padding-inline:5px}.px-\\[6px\\]{padding-inline:6px}.py-0\\.5{padding-block:calc(var(--spacing) * .5)}.py-1{padding-block:calc(var(--spacing) * 1)}.py-2{padding-block:calc(var(--spacing) * 2)}.py-2\\.5{padding-block:calc(var(--spacing) * 2.5)}.py-3{padding-block:calc(var(--spacing) * 3)}.py-4{padding-block:calc(var(--spacing) * 4)}.py-5{padding-block:calc(var(--spacing) * 5)}.py-6{padding-block:calc(var(--spacing) * 6)}.py-8{padding-block:calc(var(--spacing) * 8)}.py-12{padding-block:calc(var(--spacing) * 12)}.py-16{padding-block:calc(var(--spacing) * 16)}.py-\\[3px\\]{padding-block:3px}.py-px{padding-block:1px}.pt-0\\.5{padding-top:calc(var(--spacing) * .5)}.pt-1{padding-top:calc(var(--spacing) * 1)}.pt-2{padding-top:calc(var(--spacing) * 2)}.pt-5{padding-top:calc(var(--spacing) * 5)}.pt-7{padding-top:calc(var(--spacing) * 7)}.pt-8{padding-top:calc(var(--spacing) * 8)}.pt-12{padding-top:calc(var(--spacing) * 12)}.pr-0{padding-right:calc(var(--spacing) * 0)}.pr-2{padding-right:calc(var(--spacing) * 2)}.pr-3{padding-right:calc(var(--spacing) * 3)}.pr-6{padding-right:calc(var(--spacing) * 6)}.pb-1{padding-bottom:calc(var(--spacing) * 1)}.pb-1\\.5{padding-bottom:calc(var(--spacing) * 1.5)}.pb-4{padding-bottom:calc(var(--spacing) * 4)}.pb-5{padding-bottom:calc(var(--spacing) * 5)}.pb-6{padding-bottom:calc(var(--spacing) * 6)}.pb-8{padding-bottom:calc(var(--spacing) * 8)}.pb-12{padding-bottom:calc(var(--spacing) * 12)}.pl-0{padding-left:calc(var(--spacing) * 0)}.pl-3{padding-left:calc(var(--spacing) * 3)}.pl-4{padding-left:calc(var(--spacing) * 4)}.pl-\\[7px\\]{padding-left:7px}.text-center{text-align:center}.text-left{text-align:left}.text-right{text-align:right}.align-middle{vertical-align:middle}.align-top{vertical-align:top}.font-mono{font-family:var(--font-mono)}.font-sans{font-family:var(--font-sans)}.text-sm{font-size:var(--text-sm);line-height:var(--tw-leading,var(--text-sm--line-height))}.text-\\[9px\\]{font-size:9px}.text-\\[10px\\]{font-size:10px}.text-\\[11px\\]{font-size:11px}.text-\\[12px\\]{font-size:12px}.text-\\[13px\\]{font-size:13px}.text-\\[14px\\]{font-size:14px}.text-\\[15px\\]{font-size:15px}.text-\\[22px\\]{font-size:22px}.text-\\[28px\\]{font-size:28px}.text-\\[44px\\]{font-size:44px}.text-\\[72px\\]{font-size:72px}.text-\\[clamp\\(28px\\,5vw\\,52px\\)\\]{font-size:clamp(28px,5vw,52px)}.leading-\\[0\\.9\\]{--tw-leading:.9;line-height:.9}.leading-none{--tw-leading:1;line-height:1}.leading-snug{--tw-leading:var(--leading-snug);line-height:var(--leading-snug)}.leading-tight{--tw-leading:var(--leading-tight);line-height:var(--leading-tight)}.font-bold{--tw-font-weight:var(--font-weight-bold);font-weight:var(--font-weight-bold)}.font-light{--tw-font-weight:var(--font-weight-light);font-weight:var(--font-weight-light)}.font-medium{--tw-font-weight:var(--font-weight-medium);font-weight:var(--font-weight-medium)}.font-semibold{--tw-font-weight:var(--font-weight-semibold);font-weight:var(--font-weight-semibold)}.tracking-\\[-0\\.02em\\]{--tw-tracking:-.02em;letter-spacing:-.02em}.tracking-\\[0\\.1em\\]{--tw-tracking:.1em;letter-spacing:.1em}.tracking-\\[0\\.05em\\]{--tw-tracking:.05em;letter-spacing:.05em}.tracking-\\[0\\.08em\\]{--tw-tracking:.08em;letter-spacing:.08em}.tracking-\\[0\\.11em\\]{--tw-tracking:.11em;letter-spacing:.11em}.tracking-\\[0\\.12em\\]{--tw-tracking:.12em;letter-spacing:.12em}.tracking-\\[0\\.15em\\]{--tw-tracking:.15em;letter-spacing:.15em}.tracking-\\[0\\.16em\\]{--tw-tracking:.16em;letter-spacing:.16em}.tracking-\\[0\\.22em\\]{--tw-tracking:.22em;letter-spacing:.22em}.tracking-normal{--tw-tracking:var(--tracking-normal);letter-spacing:var(--tracking-normal)}.tracking-tight{--tw-tracking:var(--tracking-tight);letter-spacing:var(--tracking-tight)}.break-words{overflow-wrap:break-word}.break-all{word-break:break-all}.whitespace-nowrap{white-space:nowrap}.capitalize{text-transform:capitalize}.lowercase{text-transform:lowercase}.normal-case{text-transform:none}.uppercase{text-transform:uppercase}.italic{font-style:italic}.tabular-nums{--tw-numeric-spacing:tabular-nums;font-variant-numeric:var(--tw-ordinal,) var(--tw-slashed-zero,) var(--tw-numeric-figure,) var(--tw-numeric-spacing,) var(--tw-numeric-fraction,)}.no-underline{text-decoration-line:none}.opacity-40{opacity:.4}.opacity-70{opacity:.7}.shadow{--tw-shadow:0 1px 3px 0 var(--tw-shadow-color,#0000001a), 0 1px 2px -1px var(--tw-shadow-color,#0000001a);box-shadow:var(--tw-inset-shadow), var(--tw-inset-ring-shadow), var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow)}.shadow-\\[0_4px_12px_rgba\\(0\\,0\\,0\\,0\\.08\\)\\]{--tw-shadow:0 4px 12px var(--tw-shadow-color,#00000014);box-shadow:var(--tw-inset-shadow), var(--tw-inset-ring-shadow), var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow)}.shadow-\\[0_8px_24px_rgba\\(0\\,0\\,0\\,0\\.12\\)\\]{--tw-shadow:0 8px 24px var(--tw-shadow-color,#0000001f);box-shadow:var(--tw-inset-shadow), var(--tw-inset-ring-shadow), var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow)}.ring{--tw-ring-shadow:var(--tw-ring-inset,) 0 0 0 calc(1px + var(--tw-ring-offset-width)) var(--tw-ring-color,currentcolor);box-shadow:var(--tw-inset-shadow), var(--tw-inset-ring-shadow), var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow)}.outline{outline-style:var(--tw-outline-style);outline-width:1px}.outline-0{outline-style:var(--tw-outline-style);outline-width:0}.blur{--tw-blur:blur(8px);filter:var(--tw-blur,) var(--tw-brightness,) var(--tw-contrast,) var(--tw-grayscale,) var(--tw-hue-rotate,) var(--tw-invert,) var(--tw-saturate,) var(--tw-sepia,) var(--tw-drop-shadow,)}.invert{--tw-invert:invert(100%);filter:var(--tw-blur,) var(--tw-brightness,) var(--tw-contrast,) var(--tw-grayscale,) var(--tw-hue-rotate,) var(--tw-invert,) var(--tw-saturate,) var(--tw-sepia,) var(--tw-drop-shadow,)}.filter{filter:var(--tw-blur,) var(--tw-brightness,) var(--tw-contrast,) var(--tw-grayscale,) var(--tw-hue-rotate,) var(--tw-invert,) var(--tw-saturate,) var(--tw-sepia,) var(--tw-drop-shadow,)}.backdrop-blur-sm{--tw-backdrop-blur:blur(var(--blur-sm));-webkit-backdrop-filter:var(--tw-backdrop-blur,) var(--tw-backdrop-brightness,) var(--tw-backdrop-contrast,) var(--tw-backdrop-grayscale,) var(--tw-backdrop-hue-rotate,) var(--tw-backdrop-invert,) var(--tw-backdrop-opacity,) var(--tw-backdrop-saturate,) var(--tw-backdrop-sepia,);backdrop-filter:var(--tw-backdrop-blur,) var(--tw-backdrop-brightness,) var(--tw-backdrop-contrast,) var(--tw-backdrop-grayscale,) var(--tw-backdrop-hue-rotate,) var(--tw-backdrop-invert,) var(--tw-backdrop-opacity,) var(--tw-backdrop-saturate,) var(--tw-backdrop-sepia,)}.transition{transition-property:color,background-color,border-color,outline-color,text-decoration-color,fill,stroke,--tw-gradient-from,--tw-gradient-via,--tw-gradient-to,opacity,box-shadow,transform,translate,scale,rotate,filter,-webkit-backdrop-filter,backdrop-filter,display,content-visibility,overlay,pointer-events;transition-timing-function:var(--tw-ease,var(--default-transition-timing-function));transition-duration:var(--tw-duration,var(--default-transition-duration))}.transition-colors{transition-property:color,background-color,border-color,outline-color,text-decoration-color,fill,stroke,--tw-gradient-from,--tw-gradient-via,--tw-gradient-to;transition-timing-function:var(--tw-ease,var(--default-transition-timing-function));transition-duration:var(--tw-duration,var(--default-transition-duration))}.duration-150{--tw-duration:.15s;transition-duration:.15s}.select-none{-webkit-user-select:none;user-select:none}.group-data-\\[state\\=off\\]\\:opacity-30:is(:where(.group)[data-state=off] *){opacity:.3}.before\\:absolute:before{content:var(--tw-content);position:absolute}.before\\:left-0:before{content:var(--tw-content);left:calc(var(--spacing) * 0)}.before\\:content-\\[\\'→\\'\\]:before{--tw-content:"→";content:var(--tw-content)}.after\\:ml-auto:after{content:var(--tw-content);margin-left:auto}.after\\:font-mono:after{content:var(--tw-content);font-family:var(--font-mono)}.after\\:text-\\[9px\\]:after{content:var(--tw-content);font-size:9px}.after\\:tracking-\\[0\\.1em\\]:after{content:var(--tw-content);--tw-tracking:.1em;letter-spacing:.1em}.after\\:content-\\[\\'ON\\'\\]:after{--tw-content:"ON";content:var(--tw-content)}.last\\:border-b-0:last-child{border-bottom-style:var(--tw-border-style);border-bottom-width:0}@media (hover:hover){.hover\\:text-white:hover{color:var(--color-white)}.hover\\:opacity-90:hover{opacity:.9}}.focus-visible\\:ring-1:focus-visible{--tw-ring-shadow:var(--tw-ring-inset,) 0 0 0 calc(1px + var(--tw-ring-offset-width)) var(--tw-ring-color,currentcolor);box-shadow:var(--tw-inset-shadow), var(--tw-inset-ring-shadow), var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow)}.focus-visible\\:outline-none:focus-visible{--tw-outline-style:none;outline-style:none}.disabled\\:pointer-events-none:disabled{pointer-events:none}.disabled\\:opacity-40:disabled{opacity:.4}.data-\\[open\\=false\\]\\:hidden[data-open=false]{display:none}.data-\\[pinned\\=true\\]\\:pointer-events-auto[data-pinned=true]{pointer-events:auto}.data-\\[state\\=off\\]\\:line-through[data-state=off]{text-decoration-line:line-through}.data-\\[state\\=off\\]\\:after\\:content-\\[\\'OFF\\'\\][data-state=off]:after{--tw-content:"OFF";content:var(--tw-content)}@media (min-width:40rem){.sm\\:min-w-\\[320px\\]{min-width:320px}}@media (min-width:48rem){.md\\:grid-cols-2{grid-template-columns:repeat(2,minmax(0,1fr))}.md\\:grid-cols-4{grid-template-columns:repeat(4,minmax(0,1fr))}.md\\:grid-cols-\\[1\\.4fr_1fr\\]{grid-template-columns:1.4fr 1fr}}.\\[\\&_svg\\]\\:size-\\[14px\\] svg{width:14px;height:14px}.\\[\\&_svg\\]\\:shrink-0 svg{flex-shrink:0}.\\[\\&_tr\\]\\:border-b-0 tr{border-bottom-style:var(--tw-border-style);border-bottom-width:0}.\\[\\&\\>\\*\\+\\*\\]\\:ml-6>*+*{margin-left:calc(var(--spacing) * 6)}.\\[\\&\\>\\*\\+\\*\\]\\:border-l>*+*{border-left-style:var(--tw-border-style);border-left-width:1px}.\\[\\&\\>\\*\\+\\*\\]\\:pl-6>*+*{padding-left:calc(var(--spacing) * 6)}.\\[\\&\\>td\\]\\:border-b>td{border-bottom-style:var(--tw-border-style);border-bottom-width:1px}}@property --tw-rotate-x{syntax:"*";inherits:false}@property --tw-rotate-y{syntax:"*";inherits:false}@property --tw-rotate-z{syntax:"*";inherits:false}@property --tw-skew-x{syntax:"*";inherits:false}@property --tw-skew-y{syntax:"*";inherits:false}@property --tw-space-y-reverse{syntax:"*";inherits:false;initial-value:0}@property --tw-border-style{syntax:"*";inherits:false;initial-value:solid}@property --tw-leading{syntax:"*";inherits:false}@property --tw-font-weight{syntax:"*";inherits:false}@property --tw-tracking{syntax:"*";inherits:false}@property --tw-ordinal{syntax:"*";inherits:false}@property --tw-slashed-zero{syntax:"*";inherits:false}@property --tw-numeric-figure{syntax:"*";inherits:false}@property --tw-numeric-spacing{syntax:"*";inherits:false}@property --tw-numeric-fraction{syntax:"*";inherits:false}@property --tw-shadow{syntax:"*";inherits:false;initial-value:0 0 #0000}@property --tw-shadow-color{syntax:"*";inherits:false}@property --tw-shadow-alpha{syntax:"<percentage>";inherits:false;initial-value:100%}@property --tw-inset-shadow{syntax:"*";inherits:false;initial-value:0 0 #0000}@property --tw-inset-shadow-color{syntax:"*";inherits:false}@property --tw-inset-shadow-alpha{syntax:"<percentage>";inherits:false;initial-value:100%}@property --tw-ring-color{syntax:"*";inherits:false}@property --tw-ring-shadow{syntax:"*";inherits:false;initial-value:0 0 #0000}@property --tw-inset-ring-color{syntax:"*";inherits:false}@property --tw-inset-ring-shadow{syntax:"*";inherits:false;initial-value:0 0 #0000}@property --tw-ring-inset{syntax:"*";inherits:false}@property --tw-ring-offset-width{syntax:"<length>";inherits:false;initial-value:0}@property --tw-ring-offset-color{syntax:"*";inherits:false;initial-value:#fff}@property --tw-ring-offset-shadow{syntax:"*";inherits:false;initial-value:0 0 #0000}@property --tw-outline-style{syntax:"*";inherits:false;initial-value:solid}@property --tw-blur{syntax:"*";inherits:false}@property --tw-brightness{syntax:"*";inherits:false}@property --tw-contrast{syntax:"*";inherits:false}@property --tw-grayscale{syntax:"*";inherits:false}@property --tw-hue-rotate{syntax:"*";inherits:false}@property --tw-invert{syntax:"*";inherits:false}@property --tw-opacity{syntax:"*";inherits:false}@property --tw-saturate{syntax:"*";inherits:false}@property --tw-sepia{syntax:"*";inherits:false}@property --tw-drop-shadow{syntax:"*";inherits:false}@property --tw-drop-shadow-color{syntax:"*";inherits:false}@property --tw-drop-shadow-alpha{syntax:"<percentage>";inherits:false;initial-value:100%}@property --tw-drop-shadow-size{syntax:"*";inherits:false}@property --tw-backdrop-blur{syntax:"*";inherits:false}@property --tw-backdrop-brightness{syntax:"*";inherits:false}@property --tw-backdrop-contrast{syntax:"*";inherits:false}@property --tw-backdrop-grayscale{syntax:"*";inherits:false}@property --tw-backdrop-hue-rotate{syntax:"*";inherits:false}@property --tw-backdrop-invert{syntax:"*";inherits:false}@property --tw-backdrop-opacity{syntax:"*";inherits:false}@property --tw-backdrop-saturate{syntax:"*";inherits:false}@property --tw-backdrop-sepia{syntax:"*";inherits:false}@property --tw-duration{syntax:"*";inherits:false}@property --tw-content{syntax:"*";inherits:false;initial-value:""}`;const qi=Ki,S=e=>e.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&#39;"),Ji={major:"major bump","minor-patch":"safe",unknown:"no fix"},Yi=(e,t)=>{if(t.length===0)return{kind:"unknown",label:"no fix"};const i=L.coerce(e);if(!i)return{kind:"unknown",label:"non-semver"};let a,n;for(const o of t){const r=L.coerce(o);if(!r)continue;const l=L.diff(i,r);l==="major"||l==="premajor"?a||(a=o):(l==="minor"||l==="patch"||l==="preminor"||l==="prepatch")&&!n&&(n=o)}return n?{kind:"minor-patch",label:`safe to ${n}`}:a?{kind:"major",label:`requires major bump to ${a}`}:{kind:"unknown",label:"no usable fix"}},Zi=new Map([["are you at risk","RISK"],["what it is","VECTOR"],["what to do","ACTION"]]),Qi=e=>e.split(`
+`).map(t=>{const i=t.trim();if(!i)return"";const a=i.match(/^([^:]{2,40}):\s*(.+)$/u);if(a?.[1]&&a[2]){const n=Zi.get(a[1].trim().toLowerCase())??a[1].trim().toUpperCase();return`<div class="intel-line grid grid-cols-[72px_1fr] items-start gap-4"><span class="intel-key pt-0.5 text-[9px] font-bold uppercase">${S(n)}</span><span class="intel-val text-[13px]">${S(a[2].trim())}</span></div>`}return`<div class="intel-line intel-prose grid items-start gap-4"><span class="intel-val text-[13px]">${S(i)}</span></div>`}).join(""),Xi='<svg class="ticon-svg" viewBox="0 0 24 24" width="14" height="14" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" focusable="false"><path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/></svg>',ea='<svg class="ticon-svg" viewBox="0 0 24 24" width="14" height="14" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" focusable="false"><circle cx="12" cy="12" r="4"/><path d="M12 2v2m0 16v2M4.93 4.93l1.41 1.41m11.32 11.32 1.41 1.41M2 12h2m16 0h2M4.93 19.07l1.41-1.41m11.32-11.32 1.41-1.41"/></svg>',H="px-3 py-3 text-left align-middle",U="sticky top-0 z-[2] px-3 py-3 text-left text-[10px] font-medium uppercase whitespace-nowrap select-none",F="px-3 py-3 text-left text-[10px] font-medium uppercase",ta=e=>`<ul class="dep-paths flex flex-col gap-2 px-3 py-3">${e.map(t=>`<li class="dep-path flex flex-wrap items-center gap-y-1">${t.map((i,a)=>{const n=`${i.name}@${i.version}`,o=a<t.length-1?'<span class="dep-arrow muted px-1">→</span>':"";return`<code class="dep-node text-[12px]">${S(n)}</code>${o}`}).join("")}</li>`).join("")}</ul>`,ia=e=>{const{acknowledged:t,dependencyPaths:i,explanation:a,packageName:n,packageVersion:o,remediation:r,vulnerability:l}=e,{severity:c}=l,d=Yi(o,l.fixedVersions),m=l.fixedVersions.length>0?l.fixedVersions.join(", "):"—",b=r?`<code class="copyable" data-cmd="${S(r)}" title="Click to copy">${S(r)}</code>`:'<span class="muted">advisory only</span>',h=`data-severity="${c}" data-package="${S(n)}" data-advisory="${S(l.id)}"`,v=`<tr class="${t?"finding-row ack-row":"finding-row"}" ${h}>
+  <td class="sev-cell whitespace-nowrap ${H}"><span class="badge badge-${c.toLowerCase()} inline-flex items-center gap-[7px] rounded-[3px] py-1 pr-2 pl-[7px] text-[9px] font-bold uppercase">${c}</span></td>
+  <td class="${H}"><span class="marker marker-${d.kind} inline-block whitespace-nowrap align-middle text-[9px] font-bold uppercase" title="${S(d.label)}">${Ji[d.kind]}</span></td>
+  <td class="${H}"><code class="pkg font-medium">${S(n)}</code></td>
+  <td class="${H}"><code class="ver whitespace-nowrap">${S(o)}</code></td>
+  <td class="adv-cell whitespace-nowrap ${H}"><a href="${S(T(l.id))}" class="text-[12px] no-underline" rel="noreferrer noopener" target="_blank">${S(l.id)}</a>${t?' <span class="ack ml-2 inline-block px-[5px] py-px text-[9px] uppercase">acknowledged</span>':""}</td>
+  <td class="summary-cell ${H} min-w-[220px] text-[13px]">${S(l.summary)}</td>
+  <td class="${H}"><code class="fix whitespace-nowrap">${S(m)}</code></td>
+  <td class="${H}">${b}</td>
+</tr>`,y=i&&i.length>0?`<tr class="paths-row" ${h}>
+  <td colspan="8" class="p-0"><details><summary class="flex cursor-pointer items-center gap-3 px-3 py-2 select-none"><span class="intel-tag text-[9px] font-bold uppercase">[ DEPENDENCY PATHS ]</span><span class="intel-hint text-[9px] uppercase">${String(i.length)} root${i.length===1?"":"s"} reach this finding · click to expand</span></summary>${ta(i)}</details></td>
+</tr>`:"";return a?`${v}${y}
+<tr class="explain-row" ${h}>
+  <td colspan="8" class="p-0"><details><summary class="flex cursor-pointer items-center gap-3 px-3 py-2 select-none"><span class="intel-tag text-[9px] font-bold uppercase">[ AI INTEL ]</span><span class="intel-hint text-[9px] uppercase">threat analysis · click to expand</span></summary><div class="explain-body grid gap-3 px-3 pt-1 pb-4">${Qi(a)}</div></details></td>
+</tr>`:`${v}${y}`},aa=e=>{const t=e.now??new Date,i=[...e.findings].sort(gt),a={CRITICAL:0,HIGH:0,LOW:0,MODERATE:0,UNKNOWN:0};let n=0,o=0;for(const x of i)a[x.vulnerability.severity??"UNKNOWN"]+=1,x.acknowledged||(o+=1,x.vulnerability.fixedVersions.length>0&&(n+=1));const r=i.map(x=>ia(x)).join(`
+`),l=i.length===0,c=Wi.filter(x=>a[x]>0).map(x=>`<div class="dseg dseg-sev dseg-${x.toLowerCase()}"><span class="dk text-[10px] font-medium uppercase">${x}</span><span class="dv text-[22px]">${String(a[x])}</span></div>`),d=!l&&o>0?`<div class="dseg dseg-fixable"><span class="dk text-[10px] font-medium uppercase">fixable</span><span class="dv text-[22px]">${String(n)}<span class="dvsep mx-1 font-light">/</span>${String(o)}</span></div>`:"",m=[`<div class="dseg"><span class="dk text-[10px] font-medium uppercase">scanned</span><span class="dv text-[22px]">${String(e.packagesScanned)}</span></div>`,`<div class="dseg"><span class="dk text-[10px] font-medium uppercase">findings</span><span class="dv text-[22px]"><span id="shown">${String(i.length)}</span>${l?"":`<span class="dvsep mx-1 font-light">/</span>${String(i.length)}`}</span></div>`,d,c.length>0?'<span class="flex-auto"></span>':"",...c,l?'<div class="dseg dseg-ok"><span class="dot inline-block size-[7px] self-center"></span><span class="dk text-[10px] font-medium uppercase">status</span><span class="dv text-[22px]">CLEAN</span></div>':""].join(""),b=l?"ok":a.CRITICAL>0?"crit":a.HIGH>0?"high":"warn",h=[...e.report?.duplicates??[]].sort((x,A)=>x.name.localeCompare(A.name)),v=h.map(x=>`<tr>
+  <td class="px-3 py-3 align-top"><code class="font-medium">${S(x.name)}</code></td>
+  <td class="px-3 py-3 align-top text-[12px] font-medium tabular-nums">${String(x.versionCount)}</td>
+  <td class="px-3 py-3 align-top"><code class="text-[12px]">${x.versions.map(A=>S(A)).join(", ")}</code></td>
+</tr>`).join(`
+`),y=(e.policyDecisions??[]).filter(x=>x.policy!=="vulnerability"),g=[...y].sort((x,A)=>{const q=M=>M==="block"?0:M==="warn"?1:2;return q(x.severity)-q(A.severity)||x.policy.localeCompare(A.policy)||x.packageName.localeCompare(A.packageName)}).map(x=>{const A=x.acceptedRisk?' <span class="ack ml-2 inline-block px-[5px] py-px text-[9px] uppercase">[acknowledged]</span>':"";return`<tr>
+  <td class="px-3 py-3 align-top"><span class="policy-badge policy-${x.severity} inline-flex items-center gap-[7px] rounded-[3px] py-1 pr-2 pl-[7px] text-[10px] font-bold uppercase">${x.severity.toUpperCase()}</span></td>
+  <td class="px-3 py-3 align-top"><code class="uppercase">${S(x.policy)}</code></td>
+  <td class="px-3 py-3 align-top"><code class="uppercase">${S(x.packageName)}</code></td>
+  <td class="px-3 py-3 align-top"><code class="uppercase">${S(x.version)}</code></td>
+  <td class="px-3 py-3 align-top">${S(x.reason)}${A}</td>
+</tr>`}).join(`
+`),$=e.report?`
+<script type="application/json" id="vis-audit-report">${JSON.stringify(e.report).replaceAll("</",String.raw`<\/`)}<\/script>`:"";return`<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>vis audit · ${S(t.toISOString().slice(0,10))}</title>
+<style>${qi}</style>${$}
+</head>
+<body>
+<main class="mx-auto max-w-[1080px]">
+<header class="masthead flex flex-wrap items-end gap-4 px-0 pt-8 pb-5">
+  <div class="brand leading-none tracking-tight">${(()=>{const[x,...A]=e.tool.name.split("-");return A.length>0?`${S(x??e.tool.name)}<span class="slash mx-[0.12em] font-light">/</span>${S(A.join("-"))}`:S(e.tool.name)})()}<span class="sub mt-3 block text-[11px] font-medium uppercase">dependency security report</span></div>
+  <span class="flex-auto"></span>
+  <span class="chip inline-flex h-7 items-center justify-center rounded-[4px] px-3 text-[11px] font-medium uppercase">v${S(e.tool.version)}</span>
+  <button id="theme" class="tbtn tbtn-theme inline-flex h-7 cursor-pointer items-center justify-center rounded-[4px] bg-transparent px-3 text-[11px] font-medium uppercase" type="button" aria-label="Toggle color theme" title="Toggle color theme"><span class="ticon ticon-moon inline-flex items-center justify-center">${Xi}</span><span class="ticon ticon-sun inline-flex items-center justify-center">${ea}</span></button>
+</header>
+${l?"":`<section class="verdict verdict-${b} flex flex-wrap items-baseline gap-x-6 gap-y-1"><span class="vnum font-light">${String(i.length)}</span><span class="vsub text-[12px] uppercase">${i.length===1?"vulnerability detected":"vulnerabilities detected"}</span></section>`}
+<div class="debugbar flex flex-wrap items-stretch gap-0 pt-7 pb-1">${m}</div>
+<div class="pt-8">
+${l?'<div class="clean px-6 text-center"><div class="big font-light">CLEAN</div><div class="sub mt-6 text-[12px] uppercase">No security issues found.</div></div>':`
+<div class="mb-6 flex flex-wrap items-center gap-0">
+  <label class="field flex flex-[1_1_280px] items-center"><span class="prompt pr-3 text-[10px] uppercase select-none">filter:</span><input id="filter" type="search" class="w-full border-0 bg-transparent py-2.5 pr-0 pl-0 text-[13px] outline-0" placeholder="package or advisory id…" aria-label="Filter findings" /></label>
+  <label class="field sel flex flex-none items-center"><span class="prompt pr-3 text-[10px] uppercase select-none">sev</span><select id="severity" class="w-full cursor-pointer border-0 bg-transparent py-2.5 pr-6 pl-0 text-[13px] outline-0" aria-label="Filter by severity">
+    <option value="">all severities</option>
+    <option value="CRITICAL">critical only</option>
+    <option value="HIGH">high and above</option>
+    <option value="MODERATE">moderate and above</option>
+    <option value="LOW">low and above</option>
+  </select></label>
+  <span class="hint ml-8 text-[10px] uppercase"><span class="kbd rounded-[3px] px-[6px] py-px text-[10px] font-medium uppercase">/</span> to search · <span class="kbd rounded-[3px] px-[6px] py-px text-[10px] font-medium uppercase">esc</span> to clear</span>
+</div>
+<table id="findings" class="w-full text-[13px]">
+<thead>
+<tr>
+  <th class="${U}">Severity</th>
+  <th class="${U}">Upgrade</th>
+  <th class="${U}">Package</th>
+  <th class="${U}">Version</th>
+  <th class="${U}">Advisory</th>
+  <th class="${U}">Summary</th>
+  <th class="${U}">Fix</th>
+  <th class="${U}">Remediation</th>
+</tr>
+</thead>
+<tbody>
+${r}
+</tbody>
+</table>
+<div id="empty" class="empty hidden px-5 py-12 text-center text-[12px] uppercase">No findings match the current filter.</div>`}
+${y.length>0?`
+<h2>Policy Decisions (${y.length})</h2>
+<table id="policies" class="w-full text-[13px]">
+<thead>
+<tr>
+  <th class="${F}">Severity</th>
+  <th class="${F}">Policy</th>
+  <th class="${F}">Package</th>
+  <th class="${F}">Version</th>
+  <th class="${F}">Reason</th>
+</tr>
+</thead>
+<tbody>
+${g}
+</tbody>
+</table>`:""}
+${h.length>0?`
+<h2>Duplicate Versions (${h.length})</h2>
+<p class="mt-1 mb-3 text-[12px] uppercase opacity-70">Packages installed at multiple versions. Consolidating these via overrides shrinks the install footprint and the attack surface.</p>
+<table id="duplicates" class="w-full text-[13px]">
+<thead>
+<tr>
+  <th class="${F}">Package</th>
+  <th class="${F}">Versions</th>
+  <th class="${F}">Installed</th>
+</tr>
+</thead>
+<tbody>
+${v}
+</tbody>
+</table>`:""}
+<footer class="sig mt-12 flex flex-wrap items-center justify-between gap-x-6 gap-y-3 pt-5 text-[10px] uppercase"><span class="sig-meta"><b>${S(e.tool.name)}</b> ${S(e.tool.version)} · generated ${S(t.toISOString())} · powered by OSV.dev</span><span class="sig-by inline-flex items-center gap-2"><span class="sig-by-label">built by</span><a class="sig-by-link inline-flex items-center" href="https://anolilab.com" rel="noreferrer noopener" target="_blank" aria-label="Anolilab">${li}</a></span></footer>
+</div>
+</main>
+<script>
+(() => {
+  const root = document.documentElement;
+  const themeBtn = document.getElementById('theme');
+  const mql = window.matchMedia('(prefers-color-scheme: dark)');
+
+  // Theme: persisted choice wins, else follow OS. JS only flips data-theme;
+  // CSS handles the colors and the moon/sun icon swap.
+  try {
+    const stored = localStorage.getItem('vis-audit-theme');
+    if (stored === 'light' || stored === 'dark') {
+      root.dataset.theme = stored;
+    }
+  } catch {}
+
+  themeBtn?.addEventListener('click', () => {
+    const isDark = root.dataset.theme ? root.dataset.theme === 'dark' : mql.matches;
+    const next = isDark ? 'light' : 'dark';
+    root.dataset.theme = next;
+    try {
+      localStorage.setItem('vis-audit-theme', next);
+    } catch {}
+  });
+
+  // Filter index: read each row's data-* once, lowercase strings ahead of
+  // time, and pre-rank severity. Subsequent keystrokes only compare cached
+  // primitives — no per-row getAttribute / toLowerCase in the hot loop.
+  const RANK = { CRITICAL: 0, HIGH: 1, MODERATE: 2, LOW: 3, UNKNOWN: 4 };
+  const UNKNOWN = RANK.UNKNOWN;
+  const filterInput = document.getElementById('filter');
+  const sevSelect = document.getElementById('severity');
+  const shown = document.getElementById('shown');
+  const empty = document.getElementById('empty');
+  const index = [];
+  for (const el of document.querySelectorAll('#findings tbody tr')) {
+    const d = el.dataset;
+    index.push({
+      el,
+      pkg: (d.package || '').toLowerCase(),
+      adv: (d.advisory || '').toLowerCase(),
+      rank: RANK[d.severity] ?? UNKNOWN,
+      finding: el.classList.contains('finding-row'),
+      hidden: false,
+    });
+  }
+  let emptyShown = false;
+
+  const apply = () => {
+    const q = (filterInput?.value || '').toLowerCase().trim();
+    const sevValue = sevSelect?.value || '';
+    const cap = sevValue ? (RANK[sevValue] ?? UNKNOWN) : UNKNOWN;
+    let visible = 0;
+    for (const row of index) {
+      const queryHit = !q || row.pkg.includes(q) || row.adv.includes(q);
+      const sevHit = !sevValue || row.rank <= cap;
+      const visibleNow = queryHit && sevHit;
+      if (visibleNow && row.finding) {
+        visible += 1;
+      }
+      // Only touch the DOM when this row's state actually changes — keeps
+      // continued typing from re-laying out every row on every keystroke.
+      if (visibleNow === !row.hidden) {
+        continue;
+      }
+      row.el.style.display = visibleNow ? '' : 'none';
+      row.hidden = !visibleNow;
+    }
+    if (shown) {
+      shown.textContent = String(visible);
+    }
+    const showEmpty = visible === 0;
+    if (empty && showEmpty !== emptyShown) {
+      empty.style.display = showEmpty ? 'block' : 'none';
+      emptyShown = showEmpty;
+    }
+  };
+
+  // Coalesce typing-driven updates to one pass per frame; rapid keystrokes
+  // (paste, IME) collapse into a single filter sweep.
+  let pending = 0;
+  const scheduleApply = () => {
+    if (pending) {
+      return;
+    }
+    pending = requestAnimationFrame(() => {
+      pending = 0;
+      apply();
+    });
+  };
+
+  filterInput?.addEventListener('input', scheduleApply);
+  sevSelect?.addEventListener('change', apply);
+
+  // Keyboard: "/" focuses the filter, Esc clears every active filter.
+  document.addEventListener('keydown', (event) => {
+    if (event.key === '/' && document.activeElement !== filterInput) {
+      event.preventDefault();
+      filterInput?.focus();
+      return;
+    }
+    if (event.key === 'Escape') {
+      if (filterInput) {
+        filterInput.value = '';
+      }
+      if (sevSelect) {
+        sevSelect.value = '';
+      }
+      apply();
+      filterInput?.blur();
+    }
+  });
+
+  // Click-to-copy on remediation command bars (event-delegated).
+  document.addEventListener('click', (event) => {
+    const target = event.target?.closest?.('.copyable');
+    // Guard re-entry during the 1s revert: a second click would otherwise
+    // capture "✓ copied to clipboard" as the original and never restore it.
+    if (!target || target.classList.contains('copied')) {
+      return;
+    }
+    const cmd = target.dataset.cmd ?? target.textContent ?? '';
+    navigator.clipboard?.writeText(cmd).then(() => {
+      const orig = target.textContent;
+      target.classList.add('copied');
+      target.textContent = '✓ copied to clipboard';
+      setTimeout(() => {
+        target.textContent = orig;
+        target.classList.remove('copied');
+      }, 1000);
+    }).catch(() => {});
+  });
+
+  apply();
+})();
+<\/script>
+</body>
+</html>
+`},na={CRITICAL:"CRITICAL",HIGH:"HIGH",LOW:"LOW",MODERATE:"MEDIUM",UNKNOWN:"NONE"},Oe=(e,t)=>`pkg:npm/${e}@${t}`,at=(e,t)=>{const i=new Map;for(const a of e){const n=t(a),o=i.get(n);o?o.push(a):i.set(n,[a])}return i},ra=e=>{const t=e.now??new Date,i=t.toISOString(),a=e.trackingId??`vis-audit-${t.toISOString().slice(0,10)}`,n=[...at(e.findings,r=>r.packageName).entries()].sort(([r],[l])=>r.localeCompare(l)).map(([r,l])=>({branches:[...new Set(l.map(c=>c.packageVersion))].sort().map(c=>{const d=Oe(r,c);return{category:"product_version",name:c,product:{name:`${r}@${c}`,product_id:d,product_identification_helper:{purl:d}}}}),category:"product_name",name:r})),o=[...at(e.findings,r=>r.vulnerability.id).entries()].sort(([r],[l])=>r.localeCompare(l)).map(([r,l])=>{const c=l[0].vulnerability,d=[...new Set(l.map($=>Oe($.packageName,$.packageVersion)))].sort(),m=r.startsWith("CVE-"),b=[r,...c.aliases??[]],h=m?r:b.find($=>$.startsWith("CVE-")),v=b.filter($=>$!==h).map($=>({system_name:$.startsWith("GHSA-")?"GitHub Security Advisory":"OSV",text:$})),y=ze(c),g=l.filter($=>$.acknowledged).map($=>Oe($.packageName,$.packageVersion));return{...h?{cve:h}:{},...v.length>0?{ids:v}:{},notes:[{category:"description",text:c.summary||`Advisory ${r}`,title:"Advisory description"}],product_status:{known_affected:d},references:[{category:"external",summary:`${r} advisory record`,url:T(r)}],scores:[{cvss_v3:{baseScore:y,baseSeverity:na[c.severity]??"NONE",vectorString:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",version:"3.1"},products:d}],title:c.summary.split(`
+`)[0]?.slice(0,200)||r,...g.length>0?{flags:[{label:"inline_mitigations_already_exist",product_ids:g}]}:{}}});return{document:{category:"csaf_vex",csaf_version:"2.0",distribution:{tlp:{label:"WHITE"}},publisher:{category:"vendor",name:e.tool.name,namespace:e.tool.informationUri},title:`vis audit · ${a}`,tracking:{current_release_date:i,id:a,initial_release_date:i,revision_history:[{date:i,number:"1",summary:"Initial audit emission"}],status:"final",version:"1"}},...n.length>0?{product_tree:{branches:n}}:{},...o.length>0?{vulnerabilities:o}:{}}},oa={CRITICAL:"critical",HIGH:"high",LOW:"low",MODERATE:"medium",UNKNOWN:"unknown"},nt=(e,t)=>{const i=new Map;for(const a of e){const n=t(a),o=i.get(n);o?o.push(a):i.set(n,[a])}return i},sa=(e,t=new Date)=>{const i=nt(e,n=>n.vulnerability.id),a=t.toISOString();return[...i.entries()].sort(([n],[o])=>n.localeCompare(o)).map(([n,o])=>{const r=o[0].vulnerability,l=oa[r.severity]??"unknown",c=ze(r),d=[...nt(o,y=>y.packageName).entries()].sort(([y],[g])=>y.localeCompare(g)).map(([y,g])=>{const $=[...new Set(g.map(x=>x.packageVersion))].sort();return{ref:ci(y,$[0]),versions:$.map(x=>({status:"affected",version:x}))}}),m=(r.aliases??[]).filter(y=>y!==n).map(y=>({id:y,source:{name:ve(y),url:T(y)}})),b=o.some(y=>y.acknowledged),h=o.every(y=>y.acknowledged)?{justification:"code_not_reachable",response:["will_not_fix"],state:"not_affected"}:b?{state:"in_triage"}:void 0,v=r.fixedVersions??[];return{"bom-ref":`vuln:${n}`,id:n,source:{name:ve(n),url:T(n)},...m.length>0?{references:m}:{},description:r.summary||`Advisory ${n}`,ratings:[{method:"CVSSv31",score:c,severity:l,source:{name:ve(n),url:T(n)}}],...v.length>0?{recommendation:`Upgrade to one of: ${v.join(", ")}`}:{},affects:d,created:a,published:a,...h?{analysis:h}:{}}})},la=e=>{const t=sa(e.findings,e.now);return{...e.bom,vulnerabilities:t}},wt="15.2.1",ca=`https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/raw/v${wt}/dist/dependency-scanning-report-format.json`,pa={CRITICAL:"Critical",HIGH:"High",LOW:"Low",MODERATE:"Medium",UNKNOWN:"Unknown"},da={block:"High",info:"Info",warn:"Medium"},ga=Uint8Array.from([107,167,184,18,157,173,17,209,128,180,0,192,79,212,48,200]),rt=e=>{const t=di("sha1");t.update(ga),t.update(e,"utf8");const i=t.digest();i[6]=(i[6]??0)&15|80,i[8]=(i[8]??0)&63|128;const a=i.subarray(0,16).toString("hex");return`${a.slice(0,8)}-${a.slice(8,12)}-${a.slice(12,16)}-${a.slice(16,20)}-${a.slice(20,32)}`},ot=e=>e.startsWith("CVE-")?{name:e,type:"cve",url:T(e),value:e}:e.startsWith("GHSA-")?{name:e,type:"ghsa",url:T(e),value:e}:{name:e,type:"osv",url:T(e),value:e},fa=e=>{const t=(e.now??new Date).toISOString().replace(/\.\d{3}Z$/,""),i=e.artifactUri??(ft(e.workspaceRoot,`${e.workspaceRoot}/package.json`)||"package.json"),a=[];for(const n of e.findings){const{acknowledged:o,packageName:r,packageVersion:l,vulnerability:c}=n,d=[ot(c.id)];for(const v of c.aliases??[])v!==c.id&&d.push(ot(v));const m=[{name:`${ve(c.id)} advisory`,url:T(c.id)}],b=c.summary||`Advisory ${c.id}`,h=c.fixedVersions.length>0?`Upgrade ${r} to ${c.fixedVersions.join(" or ")}`:void 0;a.push({description:b,...o?{flags:[{description:"Acknowledged via vis accepted-risks",origin:"vis",type:"flagged-as-likely-false-positive"}]}:{},id:rt(`vis-audit|${c.id}|${r}@${l}`),identifiers:d,links:m,location:{dependency:{package:{name:r},version:l},file:i},name:`${c.id}: ${r}@${l}`,severity:pa[c.severity],...h?{solution:h}:{}})}for(const n of e.policyDecisions??[]){if(n.policy==="vulnerability")continue;const o=`vis.policy.${n.policy}`;a.push({description:n.reason,...n.acceptedRisk?{flags:[{description:"Acknowledged via vis accepted-risks",origin:"vis",type:"flagged-as-likely-false-positive"}]}:{},id:rt(`vis-audit|${o}|${n.packageName}@${n.version}`),identifiers:[{name:o,type:"vis_policy",url:`https://visulima.com/packages/vis/commands/audit#policy-${n.policy}`,value:o}],links:[{name:`vis policy: ${n.policy}`,url:`https://visulima.com/packages/vis/commands/audit#policy-${n.policy}`}],location:{dependency:{package:{name:n.packageName},version:n.version},file:i},name:`vis policy '${n.policy}': ${n.packageName}@${n.version}`,severity:da[n.severity]})}return{scan:{analyzer:{id:e.tool.name,name:e.tool.name,url:e.tool.informationUri,vendor:{name:"Visulima"},version:e.tool.version},end_time:t,scanner:{id:e.tool.name,name:e.tool.name,url:e.tool.informationUri,vendor:{name:"Visulima"},version:e.tool.version},start_time:t,status:"success",type:"dependency_scanning"},schema:ca,version:wt,vulnerabilities:a}},K=e=>e.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&apos;"),st=e=>`<![CDATA[${e.replaceAll("]]>","]]]]><![CDATA[>")}]]>`,ua=e=>{let t="";return e.status==="skipped"?t=`      <skipped/>
+`:e.status==="failure"?t=`      <failure type="${K(e.failureType)}" message="${K(e.failureMessage)}">${st(e.failureText)}</failure>
+`:e.systemOut!==void 0&&(t=`      <system-out>${st(e.systemOut)}</system-out>
+`),`    <testcase classname="${K(e.classname)}" name="${K(e.name)}">
+${t}    </testcase>
+`},lt=(e,t,i)=>{const a=t.filter(l=>l.status==="failure").length,n=t.filter(l=>l.status==="skipped").length,o=t.length,r=t.map(l=>ua(l)).join("");return`  <testsuite name="${K(e)}" tests="${String(o)}" failures="${String(a)}" skipped="${String(n)}" errors="0" timestamp="${K(i)}" time="0">
+${r}  </testsuite>
+`},ma=e=>{const t=(e.now??new Date).toISOString().replace(/\.\d{3}Z$/,""),i=e.suiteName??"vis-audit",a=e.findings.map(d=>{const{acknowledged:m,packageName:b,packageVersion:h,vulnerability:v}=d,y=v.fixedVersions.length>0?` (fix: ${v.fixedVersions.join(", ")})`:"";return{classname:`${b}@${h}`,failureMessage:`${Le(v.severity).toUpperCase()} ${v.id} — ${v.summary.split(`
+`)[0]?.slice(0,200)??v.id}`,failureText:`${v.id}: ${b}@${h}
+${v.summary||`Advisory ${v.id}`}${y}`,failureType:Le(v.severity).toUpperCase(),name:v.id,status:m?"skipped":"failure"}}),n=(e.policyDecisions??[]).filter(d=>d.policy!=="vulnerability").map(d=>{let m;return d.acceptedRisk?m="skipped":d.severity==="info"?m="passing":m="failure",{classname:`${d.packageName}@${d.version}`,failureMessage:`${d.severity.toUpperCase()} vis.policy.${d.policy}`,failureText:d.reason,failureType:d.severity.toUpperCase(),name:`vis.policy.${d.policy}`,status:m,...m==="passing"?{systemOut:d.reason}:{}}}),o=a.length+n.length,r=a.filter(d=>d.status==="failure").length+n.filter(d=>d.status==="failure").length,l=a.filter(d=>d.status==="skipped").length+n.filter(d=>d.status==="skipped").length;let c=`<?xml version="1.0" encoding="UTF-8"?>
+<testsuites name="${K(i)}" tests="${String(o)}" failures="${String(r)}" skipped="${String(l)}" errors="0" time="0">
+`;return c+=lt("vulnerabilities",a,t),n.length>0&&(c+=lt("policies",n,t)),c+=`</testsuites>
+`,c},ha=e=>{const t=new Map,i=[],a=e.artifactUri??(ft(e.workspaceRoot,gi(e.workspaceRoot,"package.json"))||"package.json");for(const r of e.findings){const{acknowledged:l,packageName:c,packageVersion:d,vulnerability:m}=r,b=Fi(m.severity),h=Le(m.severity);t.has(m.id)||t.set(m.id,{defaultConfiguration:{level:b},fullDescription:{text:m.summary||`Advisory ${m.id}`},helpUri:T(m.id),id:m.id,name:m.id,properties:{precision:"very-high","security-severity":Bi(m),"severity-label":h,tags:["security","vulnerability","supply-chain",`severity:${h}`]},shortDescription:{text:(m.summary.split(`
+`)[0]??m.id).slice(0,200)}}),i.push({level:b,locations:[{logicalLocations:[{kind:"package",name:`${c}@${d}`}],physicalLocation:{artifactLocation:{uri:a}}}],message:{text:`${m.id}: ${c}@${d} — ${m.summary||"no summary"}${m.fixedVersions.length>0?` (fix: ${m.fixedVersions.join(", ")})`:""}`},partialFingerprints:{advisoryId:m.id,package:c,version:d},properties:{...l?{acknowledged:!0}:{},...m.aliases&&m.aliases.length>0?{aliases:m.aliases}:{},...typeof m.cvssScore=="number"?{cvssScore:m.cvssScore}:{},...m.fixedVersions.length>0?{fixedVersions:m.fixedVersions}:{},packageName:c,packageVersion:d,severityLabel:h},ruleId:m.id})}const n={block:"error",info:"note",warn:"warning"},o={block:"high",info:"none",warn:"medium"};for(const r of e.policyDecisions??[]){if(r.policy==="vulnerability")continue;const l=`vis.policy.${r.policy}`,c=n[r.severity],d=o[r.severity];t.has(l)||t.set(l,{defaultConfiguration:{level:c},fullDescription:{text:`vis policy '${r.policy}' (Socket.dev-style supply-chain gate)`},helpUri:`https://visulima.com/packages/vis/commands/audit#policy-${r.policy}`,id:l,name:l,properties:{precision:"high","security-severity":r.severity==="block"?"8.0":r.severity==="warn"?"5.5":"0.0","severity-label":d,tags:["security","supply-chain","policy",`policy:${r.policy}`]},shortDescription:{text:`vis policy: ${r.policy}`}}),i.push({level:c,locations:[{logicalLocations:[{kind:"package",name:`${r.packageName}@${r.version}`}],physicalLocation:{artifactLocation:{uri:a}}}],message:{text:r.reason},partialFingerprints:{package:r.packageName,policy:r.policy,version:r.version},properties:{...r.acceptedRisk?{acknowledged:!0}:{},packageName:r.packageName,packageVersion:r.version,severityLabel:d},ruleId:l})}return{$schema:"https://json.schemastore.org/sarif-2.1.0.json",runs:[{results:i,tool:{driver:{informationUri:e.tool.informationUri,name:e.tool.name,rules:[...t.values()],version:e.tool.version}}}],version:"2.1.0"}},va=["dependencies","devDependencies","optionalDependencies","peerDependencies"],ct=e=>{try{return{path:e,pkg:ut(e)}}catch{return}},wa=e=>{const t=[],i=ct(z(e,"package.json"));i&&t.push({path:i.path,pkg:i.pkg,workspaceName:i.pkg.name});const a=_t(e);let n;if(a?n=a:i?.pkg.workspaces&&(Array.isArray(i.pkg.workspaces)?n=i.pkg.workspaces:i.pkg.workspaces.packages&&(n=i.pkg.workspaces.packages)),!n)return t;for(const o of Ht(e,n)){const r=ct(z(e,o,"package.json"));r&&t.push({path:r.path,pkg:r.pkg,workspaceName:r.pkg.name})}return t},ya=(e,t)=>{const i=[];for(const a of e)for(const n of va){const o=a.pkg[n]?.[t];typeof o=="string"&&i.push({field:n,manifest:a,range:o})}return i},yt=e=>{const t=wa(e.workspaceRoot),i=[],a=[],n=[],o=new Set;for(const r of e.findings){const l=r.vulnerability.fixedVersions[0];if(!l){n.push({packageName:r.packageName,reason:"no-fixed-version"});continue}const c=ya(t,r.packageName);if(c.length===0){n.push({packageName:r.packageName,reason:"transitive-only"});continue}const d=L.coerce(l),m=d?`^${d.version}`:l,b=d?d.version:l;for(const h of c){const v=`${h.manifest.path}::${h.field}::${r.packageName}::${b}`;if(o.has(v))continue;o.add(v);const y=xa(b,h.range),g={currentRange:h.range,field:h.field,inRange:y,manifestPath:h.manifest.path,packageName:r.packageName,targetSpec:m,targetVersion:b,workspaceName:h.manifest.workspaceName};y||e.allowMajor===!0?i.push(g):a.push(g)}}return{apply:i,skippedMajor:a,unmatched:n}},ba=/^(?:workspace|file|link|portal|patch|git\+|git:|github:|npm:|catalog|jsr|http|https):/i,xa=(e,t)=>{if(ba.test(t))return!0;const i=L.coerce(e)?.version??e;try{return L.satisfies(i,t)}catch{return!0}},ka=e=>{const t=[];if(e.apply.length>0){t.push(`Apply (${String(e.apply.length)}):`);for(const i of e.apply){const a=i.workspaceName?` [${i.workspaceName}]`:"";t.push(`  + ${i.packageName}: ${i.currentRange} → ${i.targetSpec}${a}`)}}if(e.skippedMajor.length>0){t.push(`Skipped — major bump (${String(e.skippedMajor.length)}, requires --allow-major):`);for(const i of e.skippedMajor){const a=i.workspaceName?` [${i.workspaceName}]`:"";t.push(`  ! ${i.packageName}: ${i.currentRange} → ${i.targetSpec}${a}`)}}if(e.unmatched.length>0){const i=e.unmatched.filter(n=>n.reason==="transitive-only"),a=e.unmatched.filter(n=>n.reason==="no-fixed-version");if(i.length>0){t.push(`Transitive only (${String(i.length)}, requires --fix-transitive):`);for(const n of i)t.push(`  · ${n.packageName}`)}if(a.length>0){t.push(`No fixed version available (${String(a.length)}):`);for(const n of a)t.push(`  · ${n.packageName}`)}}return t.length===0?"No direct-dep fixes to apply.":t.join(`
+`)},$a=5,Sa=64,Na=(e,t)=>{if(t.length===0)return[];const i=new Set;for(const a of e){if(t.includes(a)){i.add(a);continue}let n=!1;for(const o of t)try{L.satisfies(o,a)&&(i.add(o),n=!0)}catch{}!n&&t.length===1&&i.add(t[0])}return[...i]},Aa=e=>{const t=new Map;for(const n of e.entries){let o=t.get(n.name);o||(o=[],t.set(n.name,o)),o.includes(n.version)||o.push(n.version)}const i=new Map;for(const n of e.entries){const o=`${n.name}@${n.version}`;let r=i.get(o);r||(r=new Map,i.set(o,r));for(const l of[n.dependencies,n.peerDependencies,n.optionalDependencies])if(l)for(const[c,d]of Object.entries(l)){const m=t.get(c)??[],b=Na(d,m);for(const h of b){const v=`${c}@${h}`;r.has(v)||r.set(v,{name:c,version:h})}}}const a=new Map;for(const[n,o]of i)a.set(n,{children:[...o.values()]});return{adjacency:a,versionsByName:t}},Ca=(e,t)=>{const i=t.get(e.name);if(!(!i||i.length===0)){if(i.includes(e.version))return{name:e.name,version:e.version};for(const a of i)try{if(L.satisfies(a,e.version))return{name:e.name,version:a}}catch{}if(i.length===1)return{name:e.name,version:i[0]}}},Ra=(e,t,i={})=>{const a=i.maxPathsPerTarget??$a,n=i.maxDepth??Sa;if(a<=0)return[];const{adjacency:o,versionsByName:r}=Aa(e),l=`${t.name}@${t.version}`,c=[],d=[],m=new Set;for(const v of e.roots){const y=Ca(v,r);if(!y)continue;const g=`${y.name}@${y.version}`;m.has(g)||(m.add(g),d.push(y))}const b=[];for(const v of d){const y=`${v.name}@${v.version}`;if(y===l){if(c.push([v]),c.length>=a)return c;continue}b.push({node:v,path:[v],visited:new Set([y])})}let h=0;for(;h<b.length&&c.length<a;){const v=b[h];if(h+=1,v.path.length>=n)continue;const y=o.get(`${v.node.name}@${v.node.version}`)?.children??[];for(const g of y){const $=`${g.name}@${g.version}`;if(v.visited.has($))continue;const x=[...v.path,g];if($===l){if(c.push(x),c.length>=a)return c;continue}const A=new Set(v.visited);A.add($),b.push({node:g,path:x,visited:A})}}return c},Ia={"crates.io":["Cargo.lock"],Go:["go.sum"],Maven:["gradle.lockfile","pom.xml"],PyPI:["uv.lock","poetry.lock","Pipfile.lock"],RubyGems:["Gemfile.lock"]},ja={cargo:"crates.io","crates.io":"crates.io",go:"Go",maven:"Maven",npm:"npm",pypi:"PyPI",rubygems:"RubyGems"},bt=e=>ja[e.toLowerCase()]??e,Ea=(e,t)=>{const i=bt(t),a=Ia[i]??[];for(const n of a){const o=z(e,n);if(yi(o))return o}},Oa=e=>{const t=new Set,i=[];for(const a of e){const n=`${a.name}@${a.version}`;t.has(n)||(t.add(n),i.push(a))}return i},Da=/\[\[package\]\]([\s\S]*?)(?=\[\[|$)/g,Ma=/^\s*name\s*=\s*"([^"]+)"\s*$/m,La=/^\s*version\s*=\s*"([^"]+)"\s*$/m,Ta=e=>{const t=[];for(const i of e.matchAll(Da)){const a=i[1]??"",n=Ma.exec(a)?.[1],o=La.exec(a)?.[1];n&&o&&t.push({isDev:!1,name:n,version:o})}return t},Pa=e=>{let t;try{t=JSON.parse(e)}catch{return[]}if(typeof t!="object"||t===null)return[];const i=[];for(const a of["default","develop"]){const n=t[a];if(!(typeof n!="object"||n===null))for(const[o,r]of Object.entries(n)){if(typeof r!="object"||r===null)continue;const l=r.version;if(typeof l!="string")continue;const c=l.replace(/^==/,"").trim();c.length>0&&i.push({isDev:!1,name:o,version:c})}}return i},Va=/<dependency>([\s\S]*?)<\/dependency>/g,za=/<groupId>\s*([^<\s]+)\s*<\/groupId>/,Wa=/<artifactId>\s*([^<\s]+)\s*<\/artifactId>/,_a=/<version>\s*([^<\s]+)\s*<\/version>/,Ha=e=>{const t=[];for(const i of e.matchAll(Va)){const a=i[1]??"",n=za.exec(a)?.[1],o=Wa.exec(a)?.[1],r=_a.exec(a)?.[1];!n||!o||!r||r.startsWith("${")||t.push({isDev:!1,name:`${n}:${o}`,version:r})}return t},Ua=e=>{const t=[];for(const i of e.split(/\r?\n/)){const a=i.trim();if(a.length===0||a.startsWith("#"))continue;const n=a.indexOf("="),o=(n===-1?a:a.slice(0,n)).split(":");if(o.length<3)continue;const[r,l,c]=o;!r||!l||!c||t.push({isDev:!1,name:`${r}:${l}`,version:c})}return t},Fa=e=>{const t=[];for(const i of e.split(/\r?\n/)){const a=i.trim();if(a.length===0)continue;const n=a.split(/\s+/);if(n.length<3)continue;const[o,r]=n;if(!o||!r?.endsWith("/go.mod"))continue;const l=r.slice(0,-7);l.length!==0&&t.push({isDev:!1,name:o,version:l})}return t},Ga=/^ {4}([^ ()]+) \(([^()]+)\)\s*$/,Ba=e=>{const t=[];let i=!1,a=!1;for(const n of e.split(/\r?\n/)){if(n.startsWith("GEM")){i=!0,a=!1;continue}if(i&&/^[A-Z]/.test(n)){i=!1,a=!1;continue}if(i&&n.trim()==="specs:"){a=!0;continue}if(a){const o=Ga.exec(n);if(o){const[,r,l]=o;r&&l&&t.push({isDev:!1,name:r,version:l})}}}return t},Ka=(e,t)=>{const i=Ea(e,t);if(!i)return[];let a;try{a=mt(i,"utf8")}catch{return[]}const n=i.split(/[/\\]/).pop()??"";let o;switch(n){case"Cargo.lock":case"poetry.lock":case"uv.lock":{o=Ta(a);break}case"Gemfile.lock":{o=Ba(a);break}case"go.sum":{o=Fa(a);break}case"gradle.lockfile":{o=Ua(a);break}case"Pipfile.lock":{o=Pa(a);break}case"pom.xml":{o=Ha(a);break}default:return[]}return Oa(o)},qa=["ts","tsx","js","jsx","mjs","cjs","mts","cts"],Ja=[/node_modules/,/\.git/,/\.next/,/\.cache/,/dist/,/build/,/coverage/,/\.turbo/,/\.nx/,/\.parcel-cache/],Ya=["dependencies","devDependencies","peerDependencies","optionalDependencies"],Za=/(?:import|export)\s+(?:[\s\S]*?from\s+)?["']([^"'\n]+)["']/g,Qa=/(?:^|[^.\w$])require\s*\(\s*["']([^"'\n]+)["']\s*\)/g,Xa=/\bimport\s*\(\s*["']([^"'\n]+)["']\s*\)/g,en=e=>{if(e.startsWith(".")||e.startsWith("/")||/^[a-z][a-z0-9+.-]*:/i.test(e))return;const t=e.trim();if(t.length!==0){if(t.startsWith("@")){const i=t.split("/");return i.length<2?void 0:`${i[0]}/${i[1]}`}return t.split("/")[0]}},tn=e=>{const t=new Set,i=e.replaceAll(/\/\*[\s\S]*?\*\//g,"").replaceAll(/(^|[^:])\/\/.*$/gm,"$1"),a=n=>{n.lastIndex=0;let o;for(;(o=n.exec(i))!==null;){const r=en(o[1]);r&&t.add(r)}};return a(Za),a(Qa),a(Xa),t},an=e=>{const t=new Set;try{const i=ut(e);for(const a of Ya){const n=i[a];if(n&&typeof n=="object"&&!Array.isArray(n))for(const o of Object.keys(n))t.add(o)}}catch{}return t},nn=e=>{const t=e.skip??Ja,i=e.extensions??qa,a=new Set;let n=0;const o=it(e.workspaceRoot,{extensions:i,includeDirs:!1,skip:t});for(const c of o){n+=1;try{const d=mt(c,"utf8");for(const m of tn(d))a.add(m)}catch{}}const r=it(e.workspaceRoot,{extensions:["json"],includeDirs:!1,skip:t}).filter(c=>c.endsWith("/package.json")||c.endsWith(String.raw`\package.json`)||c.endsWith("package.json"));for(const c of r)for(const d of an(c))a.add(d);if(e.alwaysAssumeUsed)for(const c of e.alwaysAssumeUsed)a.add(c);const l=new Set;for(const c of e.vulnerablePackages)a.has(c)&&l.add(c);return{filesScanned:n,importedTotal:a,reachable:l}},rn=e=>{const t=L.coerce(e)?.major;return t!==void 0&&t>=10},on=e=>Object.fromEntries(Object.entries(e).sort(([t],[i])=>t.localeCompare(i))),sn=(e,t)=>`${JSON.stringify(e,void 0,t)}
+`,xt=(e,t)=>{if(t.name==="pnpm"&&rn(t.version))return{filePath:z(e,"pnpm-workspace.yaml"),surface:"pnpm-workspace.yaml"};const i=z(e,"package.json");return t.name==="pnpm"?{filePath:i,surface:"package.json#pnpm.overrides"}:t.name==="yarn"?{filePath:i,surface:"package.json#resolutions"}:{filePath:i,surface:"package.json#overrides"}},ln=(e,t)=>{const{filePath:i,surface:a}=xt(e,t);if(!J(i))return{};if(a==="pnpm-workspace.yaml")try{return Ve(i)?.overrides??{}}catch{return{}}try{const n=JSON.parse(be(i));return a==="package.json#pnpm.overrides"?(n.pnpm??{}).overrides??{}:a==="package.json#resolutions"?n.resolutions??{}:n.overrides??{}}catch{return{}}},cn=(e,t)=>{const i=Object.keys(t).sort();if(i.length===0&&!/^overrides\s*:/m.test(e))return e;const a=`overrides:
+${i.map(n=>`  '${n}': '${t[n]}'`).join(`
+`)}
+`;if(e.length===0)return a;if(/^overrides\s*:/m.test(e)){const n=e.replace(/^overrides\s*:[^\n]*\n(?:[ \t][^\n]*\n)*/m,a);return n.endsWith(`
+`)?n:`${n}
+`}return`${e.endsWith(`
+`)?e:`${e}
+`}
+${a}`},pn=(e,t,i,a)=>{const n=Ut(e,t.length>0?t:void 0),o=t.length>0?JSON.parse(t):{};if(i==="package.json#pnpm.overrides"){const r=o.pnpm??{};r.overrides=a,o.pnpm=r}else i==="package.json#resolutions"?o.resolutions=a:o.overrides=a;return sn(o,n)},dn=(e,t,i)=>{const{filePath:a,surface:n}=xt(e,i),o=ln(e,i),r=J(a)?be(a):"",l=[],c={...o};for(const h of t.entries){const v=o[h.packageName];if(v===h.spec){l.push({...h,previousSpec:v,status:"unchanged"});continue}v===void 0?l.push({...h,status:"added"}):l.push({...h,previousSpec:v,status:"updated"}),c[h.packageName]=h.spec}const d=on(c),m=l.some(h=>h.status!=="unchanged"),b=n==="pnpm-workspace.yaml"?cn(r,d):pn(a,r,n,d);return{changed:m,entries:l,filePath:a,nextContent:b,previousContent:r,surface:n}},gn=e=>{if(!e.changed)return e;if(e.surface==="pnpm-workspace.yaml"&&e.previousContent.length===0)throw new Error(`${e.filePath} not found. Run \`pnpm init\` or create pnpm-workspace.yaml before applying overrides for pnpm v10+.`);const t=`${e.filePath}.tmp`;try{bi(t,e.nextContent),xi(t,e.filePath)}catch(i){try{ki(t)}catch{}throw i}return e},fn=e=>{const t=new Map;for(const i of e){const a=i.vulnerability.fixedVersions[0];if(!a)continue;const n=L.coerce(a),o=n?`^${n.version}`:a;t.set(i.packageName,o)}return{entries:[...t.entries()].sort(([i],[a])=>i.localeCompare(a)).map(([i,a])=>({packageName:i,spec:a}))}},un={critical:we,high:dt,low:pt,medium:ye},Te=new Set(["cargo","crates.io","go","maven","npm","pypi","rubygems"]),mn=e=>{const t=(e??"npm").split(",").map(n=>n.trim()).filter(n=>n.length>0),i=t.length>0?t:["npm"],a=i.filter(n=>!Te.has(n.toLowerCase()));return{all:i,unsupported:a}},hn={CRITICAL:we,HIGH:dt,LOW:pt,MODERATE:ye,UNKNOWN:D},vn=(e,t,i,a)=>{const n=hn[i.severity]??D,o=a?` ${D("[acknowledged]")}`:"",r=i.fixedVersions??[],l=r.length>0?` (fix: ${r.join(", ")})`:"";return`  ${n(i.severity)} ${i.id} — ${e}@${t}${o}
+    ${i.summary}${l}`},wn=(e,t)=>{const i=Zt(e),a=`${String(Math.round(e.score.overall*100))}%`,n=t?` ${D("[acknowledged]")}`:"",o=e.alerts.length>0?`, ${String(e.alerts.length)} alert${e.alerts.length===1?"":"s"}`:"";return`  ${a} ${i}@${e.version} (${Yt(e.score.overall)}${o})${n}`},yn=new Set(["aube","auto","vis"]),te=e=>e!==void 0&&yn.has(e),bn=(e,t,i)=>{if(e!==void 0&&!te(e))throw new Error(`Invalid --backend value '${e}'. Expected one of: aube, auto, vis.`);const a=process.env.VIS_AUDIT_BACKEND;if(a!==void 0&&a!==""&&!te(a))throw new Error(`Invalid VIS_AUDIT_BACKEND value '${a}'. Expected one of: aube, auto, vis.`);const n=te(a)?a:void 0,o=te(t)?t:void 0,r=(te(e)?e:void 0)??n??o??"auto";return r==="aube"?"aube":r==="vis"?"vis":(i?.install?.backend??process.env.VIS_INSTALLER)==="aube"&&Qt("aube")!==null?"aube":"vis"},xn=e=>{if(e!==void 0)switch(e){case"critical":return"critical";case"high":return"high";case"low":return"low";case"medium":return"moderate";default:return e}},kn=(e,t,i)=>{const a=["audit"],n=xn(t.severity);n!==void 0&&a.push("--audit-level",n),(t.prodOnly===!0||t.prod===!0)&&a.push("--prod"),(t.json===!0||t.format==="json")&&a.push("--json");const o=t.fix===!0;t["fix-transitive"]===!0||t.fixTransitive===!0?a.push("--fix=override"):o&&a.push("--fix=update");const r=[];t.offline===!0&&r.push("--offline (aube has its own offline cache)"),(t.format==="sarif"||t.format==="csaf"||t.format==="cyclonedx"||t.format==="cyclonedx-vex"||t.format==="gitlab"||t.format==="junit")&&r.push(`--format=${String(t.format)} (only json/text is forwarded to aube)`),r.length>0&&u.warn(`Delegating to 'aube audit'. Skipping vis-only flags: ${r.join(", ")}`);const l=Dt("aube",a,{cwd:e,stdio:"inherit"});if(l.error){const{code:c}=l.error;return c==="ENOENT"?u.error("Backend 'aube' selected but the 'aube' binary was not found on PATH. Install aube or run with --backend vis."):u.error(`Failed to spawn aube: ${l.error.message}`),1}return l.status??1},$n=async(e,t,i,a,n)=>{if(bn(i.backend,a?.security?.audit?.backend,a)==="aube"){process.exitCode=kn(t,i);return}const o=i.severity??"low",r=i.format??"table",l=r==="sarif",c=r==="csaf",d=r==="cyclonedx-vex"||r==="cyclonedx",m=r==="gitlab",b=r==="junit",h=r==="json"||!!i.json,v=i.report,y=a?.security?.audit,g=a?.security?.policies,$=i.offline===void 0?!!y?.offlineByDefault:!!i.offline,x=i.db,A=mn(i.ecosystem),q=!!i.prodOnly,M=i.failOn??g?.vulnerability?.failOn,St=!!i.showFixes,ne=!!i.showAccepted,$e=a?.security?.acceptedRisks,We=g?.vulnerability?.usage,Nt=i.noUsage?!1:i.usage===void 0?!!We?.enabled:!!i.usage,I=h||l||c||d||m||b,_e=i.explain,Se=_e!==void 0,He=Se&&!l&&!c&&!d&&!m&&!b;if(Se&&$){u.error("`--explain` needs network access and cannot run in offline mode (--offline or security.audit.offlineByDefault)."),process.exitCode=1;return}Se&&!He&&u.warn(`\`--explain\` has no effect with --format=${r}; explanations are only rendered in table, json, and HTML output.`);const O=ai(t),C=Li(t,O.name);if($){const s=x??ui(t);if(!await e.access(s).then(()=>!0).catch(()=>!1)){const p=new et(s);I?process.stderr.write(`${p.message}
+`):u.error(p.message),process.exitCode=1;return}}!I&&(C.ignoredAdvisories.length>0||C.excludedPackages.length>0)&&u.info(`Loaded ${String(C.ignoredAdvisories.length)} ignored advisor${C.ignoredAdvisories.length===1?"y":"ies"} and ${String(C.excludedPackages.length)} excluded package${C.excludedPackages.length===1?"":"s"} from ${O.name} config.`),!I&&A.unsupported.length>0&&u.warn(`Ecosystems ${A.unsupported.map(s=>`'${s}'`).join(", ")} are not yet supported by the audit matcher. Supported: npm, pypi, crates.io, cargo, maven, go, rubygems.`);const P=mi(t,O.name,{includeDev:!q});if(P.length===0){u.info(`No ${O.name} lockfile entries found. Run ${O.name} install first.`);return}if(!I){const s=q?"production-only packages":"installed packages";u.info(`Scanning ${String(P.length)} ${s}${$?" (offline)":""}…`)}const re=P.map(s=>({name:s.name,version:s.version})),oe=a?.security?.audit?.advisories?.bloom?.mode??"off";let W=[];if(oe!=="off")try{const s=await $i(t,{softFail:oe==="on"});if(s){if(W=Si(s,re).map(p=>({name:p.name,version:p.version})),!I&&W.length>0){u.warn(`osv-bloom prefilter flagged ${String(W.length)} package${W.length===1?"":"s"} as possibly malicious (MAL-*). Confirming via the advisory query path…`);const p=10;for(const f of W.slice(0,p))u.warn(`  ${we("[bloom]")} ${f.name}@${f.version}`);W.length>p&&u.warn(`  …and ${String(W.length-p)} more (full list in --format json output)`)}}else I||u.info(D("osv-bloom cache absent — skipping prefilter (run `vis advisories bloom sync` to enable)."))}catch(s){if(s instanceof Ni&&oe==="required"){const f=`${s.message} (security.audit.advisories.bloom.mode = "required")`;I?process.stderr.write(`${f}
+`):u.error(f),process.exitCode=1;return}const p=s instanceof Error?s.message:String(s);if(oe==="required"){I?process.stderr.write(`osv-bloom prefilter failed: ${p}
+`):u.error(`osv-bloom prefilter failed: ${p}`),process.exitCode=1;return}I||u.warn(`osv-bloom prefilter failed (continuing): ${p}`)}const se=new Set;$?se.add("socket").add("deps-dev"):(Qe("socket")&&se.add("socket"),Qe("depsDev")&&se.add("deps-dev"));const Ne=Ft(a?.security,{disabled:se,minimumScore:g?.score?.minimum}),Ae=Ne.length>0,At=Ne.map(s=>s.displayName).join(" + "),le=g?.score?.minimum??Jt,G=hi(t,O.name),Ct=[{id:"vulnerabilities",label:$?"Known vulnerabilities (offline OSV cache)":"Known vulnerabilities (OSV)"},...Ae?[{id:"security",label:`Supply-chain reports (${At})`}]:[]],V=fi(Ct,{live:!I}),Rt=Date.now(),B=s=>{const p=Date.now()-s;return p>=1e3?`${(p/1e3).toFixed(1)}s`:`${String(Math.round(p))}ms`};let Ce,Re;try{const s=Date.now(),p=Date.now();V.start("vulnerabilities"),Ae&&V.start("security");const f=$?Promise.resolve().then(()=>tt(re,{dbPath:x,ecosystem:A.all.find(w=>Te.has(w.toLowerCase()))??"npm",workspaceRoot:t})).then(w=>{let k=0;for(const N of w.values())k+=N.length;return V.finish("vulnerabilities",k>0?"warn":"ok",k>0?`${String(k)} found · ${B(s)}`:`none found · ${B(s)}`),w}).catch(w=>{const k=w instanceof Error?w.message:String(w);if(V.finish("vulnerabilities","error",k),w instanceof et)throw w;return new Map}):Gt(re).then(w=>{let k=0;for(const N of w.values())k+=N.length;return V.finish("vulnerabilities",k>0?"warn":"ok",k>0?`${String(k)} found · ${B(s)}`:`none found · ${B(s)}`),w}).catch(w=>{const k=w instanceof Error?w.message:String(w);return V.finish("vulnerabilities","error",k),new Map});[Ce,Re]=await Promise.all([f,Ae?Bt(Ne,re).then(w=>{let k=0,N=0;for(const X of w.values())k+=X.alerts.length,X.score.overall<le&&(N+=1);const E=k+N;return V.finish("security",E>0?"warn":"ok",E>0?`${String(k)} alert${k===1?"":"s"}, ${String(N)} low-score · ${B(p)}`:`clean · ${B(p)}`),w}).catch(w=>{const k=w instanceof Error?w.message:String(w);return V.finish("security","error",k),new Map}):Promise.resolve(new Map)])}finally{V.stop()}h||u.info(D(`Scan completed in ${B(Rt)}`));const ce=[];for(const s of P){if(Ti(s.name,C))continue;const p=Ce.get(s.name)??[],f=Re.get(`${s.name}@${s.version}`),w=Xe(s.name,s.version,$e),k=p.length>0,N=f?f.score.overall<le:!1,E=f?f.alerts.length>0:!1;(k||N||E)&&ce.push({acceptedRisk:w,name:s.name,socketReport:f,version:s.version,vulnerabilities:p})}if($){const s=A.all.filter(p=>Te.has(p.toLowerCase())&&p.toLowerCase()!=="npm");for(const p of s){const f=bt(p),w=Ka(t,f);if(w.length!==0){I||u.info(D(`Scanning ${String(w.length)} ${f} packages…`));try{const k=tt(w.map(N=>({name:N.name,version:N.version})),{dbPath:x,ecosystem:f,workspaceRoot:t});for(const N of w){const E=k.get(N.name)??[];E.length!==0&&ce.push({acceptedRisk:Xe(N.name,N.version,$e),name:N.name,version:N.version,vulnerabilities:E})}}catch(k){const N=k instanceof Error?k.message:String(k);u.warn(`Failed to scan ${f}: ${N}`)}}}}let R=ce.filter(s=>{const p=s.vulnerabilities.some(k=>he(k.severity,o)),f=s.socketReport?.alerts.some(k=>he(k.severity==="medium"?"MODERATE":k.severity.toUpperCase(),o)),w=s.socketReport&&s.socketReport.score.overall<le;return p||f||w});const It=i.policies,Ue=[],j=await(async()=>{const s=si().map(E=>`'${E}'`).join(", "),p=ri(It,E=>{Ue.push(E);const X=`Unknown policy '${E}' — ignoring. Available: ${s}.`;I?process.stderr.write(`vis audit: ${X}
+`):u.warn(X)});if(p?.size===0)return[];const f=a?.security?.policies?.license,w=!!(f&&((f.allow?.length??0)>0||(f.deny?.length??0)>0)),k=p===void 0||p.has("license"),N=w&&k?wi(t):void 0;return oi({manifestData:N,offline:$,osvFindings:Ce,packageManager:O.name,packages:P,socketReports:Re,workspaceRoot:t},"audit",{enabledPolicies:p,visConfig:a??{}})})();if(Nt){const s=new Set(R.filter(f=>f.vulnerabilities.length>0).map(f=>f.name)),p=nn({alwaysAssumeUsed:We?.alwaysAssumeUsed,vulnerablePackages:s,workspaceRoot:t});R=R.filter(f=>f.vulnerabilities.length===0?!0:p.reachable.has(f.name)),I||u.info(D(`Reachability filter: ${String(p.reachable.size)}/${String(s.size)} vulnerable packages reachable (${String(p.filesScanned)} files scanned).`))}const Fe=vi(t,O.name),Ge=Fe?R.map(s=>{const p=Ra(Fe,{name:s.name,version:s.version});return{...s,dependencyPaths:p}}):R.map(s=>({...s,dependencyPaths:[]})),_=()=>Ge.flatMap(s=>s.vulnerabilities.map(p=>({acknowledged:!!s.acceptedRisk||ae(p.id,C,p.aliases),dependencyPaths:s.dependencyPaths,packageName:s.name,packageVersion:s.version,vulnerability:p}))),Be=!!i.fix,Ke=!!i.fixTransitive,qe=!!i.yes,jt=!!i.allowMajor;if(Be||Ke){const s=_().filter(p=>!p.acknowledged);if(Be){const p=await Nn({actionableFindings:s,allowMajor:jt,pm:O,workspaceRoot:t,yes:qe});if(p!==void 0){process.exitCode=p;return}}if(Ke){const p=await An({actionableFindings:s,pm:O,visConfig:a,workspaceRoot:t,yes:qe});if(p!==void 0){process.exitCode=p;return}}}const pe=new Map;if(He){const s=Ci(_().filter(f=>!f.acknowledged).map(f=>({packageName:f.packageName,packageVersion:f.packageVersion,vulnerability:f.vulnerability})).sort(gt),_e),p=await Mi(s,a?.ai,{info:f=>{u.info(f)},warn:f=>{u.warn(f)}});for(const[f,w]of p)pe.set(f,w)}if(l){const s=ha({findings:_(),policyDecisions:j,tool:{informationUri:"https://github.com/visulima/visulima",name:"vis-audit",version:"alpha"},workspaceRoot:t});process.stdout.write(`${JSON.stringify(s,void 0,2)}
+`),ie(R,C,i.exitCode,M,j);return}if(c){const s=ra({findings:_(),tool:{informationUri:"https://github.com/visulima/visulima",name:"vis-audit",version:"alpha"}});process.stdout.write(`${JSON.stringify(s,void 0,2)}
+`),ie(R,C,i.exitCode,M,j);return}if(d){const{packageJsons:s,workspace:p}=Kt(t,a),f=qt(t,p,s),w=pi({includeDev:!q,projectGraph:f,workspace:p,workspaceRoot:t}),k=la({bom:w,findings:_()});process.stdout.write(`${JSON.stringify(k,void 0,2)}
+`),ie(R,C,i.exitCode,M,j);return}if(m){const s=fa({findings:_(),policyDecisions:j,tool:{informationUri:"https://github.com/visulima/visulima",name:"vis-audit",version:"alpha"},workspaceRoot:t});process.stdout.write(`${JSON.stringify(s,void 0,2)}
+`),ie(R,C,i.exitCode,M,j);return}if(b){const s=ma({findings:_(),policyDecisions:j});process.stdout.write(s),ie(R,C,i.exitCode,M,j);return}const Ie={informationUri:"https://github.com/visulima/visulima",name:"vis-audit",version:"alpha"},de=zi({bloomHits:W,duplicates:G,explanations:pe,filtered:Ge,packagesScanned:P.length,policyDecisions:j,tool:Ie,unknownPolicyTokens:Ue,workspaceRoot:t});if(v){const s=aa({findings:_().map(f=>{const w=pe.get(xe({packageName:f.packageName,packageVersion:f.packageVersion,vulnerability:f.vulnerability}));return w?{...f,explanation:w}:f}),packagesScanned:P.length,policyDecisions:j,report:de,tool:{name:Ie.name,version:Ie.version}}),p=Tt(t,v);await e.writeFile(p,s,"utf8"),I||u.success(`HTML report written to ${p}`)}if(h){process.stdout.write(`${JSON.stringify(de,void 0,2)}
+`),i.exitCode&&(de.summary.issues>0||de.summary.policyBlocks>0)&&(process.exitCode=1),Pe(R,C,M,j);return}if(R.length===0){u.success(`No security issues found across ${String(P.length)} packages.`);return}const Z={CRITICAL:[],HIGH:[],LOW:[],MODERATE:[]};for(const s of R)for(const p of s.vulnerabilities)if(he(p.severity,o)){const f=p.severity==="UNKNOWN"?"LOW":p.severity;Z[f]?.push({entry:s,vuln:p})}let ge=0,je=0;for(const s of["CRITICAL","HIGH","MODERATE","LOW"]){const p=Z[s];if(!(!p||p.length===0)){u.info(`
+── ${s} (${String(p.length)}) ──`);for(const{entry:f,vuln:w}of p){const k=!!f.acceptedRisk||ae(w.id,C,w.aliases);if(k&&(je++,!ne))continue;ge++,u.info(vn(f.name,f.version,w,k)),St&&(w.fixedVersions??[]).length>0&&u.notice(`    Fix: update to ${w.fixedVersions.at(-1)}`);const N=pe.get(xe({packageName:f.name,packageVersion:f.version,vulnerability:w}));if(N)for(const E of N.split(`
+`))u.info(`    ${E}`)}}}const Q=R.filter(s=>s.socketReport&&(s.socketReport.score.overall<le||s.socketReport.alerts.length>0));if(Q.length>0){u.info(`
+── Socket.dev Supply Chain (${String(Q.length)}) ──`);for(const s of Q){if(!s.socketReport)continue;const p=!!s.acceptedRisk;if(!(p&&!ne)){u.info(wn(s.socketReport,p));for(const f of s.socketReport.alerts){const w=un[f.severity]??D;u.info(`    ${w(`[${f.severity.toUpperCase()}]`)} ${f.type} — ${f.category}`)}}}}if(G.length>0){u.info(`
+── Duplicate Dependencies (${String(G.length)}) ──`);for(const s of G){const p=s.versions.join(", ");u.info(`  ${s.name} — ${String(s.versions.length)} versions: ${ye(p)}`)}}const Je=new Set;for(const s of["CRITICAL","HIGH","MODERATE","LOW"]){const p=Z[s];if(p)for(const{vuln:f}of p)Je.add(f.id)}const Ee=j.filter(s=>{if(s.policy!=="vulnerability")return!0;const p=typeof s.data?.advisoryId=="string"?s.data.advisoryId:void 0;return s.severity==="block"&&p!==void 0&&!Je.has(p)});if(Ee.length>0){u.info(`
+── Policy Decisions (${String(Ee.length)}) ──`);for(const s of Ee){const p=!!s.acceptedRisk;if(p&&!ne)continue;const f=s.severity==="block"?we:s.severity==="warn"?ye:D,w=p?` ${D("[acknowledged]")}`:"";u.info(`  ${f(`[${s.severity}]`)} ${s.policy} — ${s.reason}${w}`)}}const fe=s=>!!s.acceptedRisk||s.vulnerabilities.length>0&&s.vulnerabilities.every(p=>ae(p.id,C,p.aliases)),Ye=R.filter(s=>!fe(s)).length;if(u.info(""),u.info("─ Audit Summary"),u.info(`  ${String(P.length)} packages scanned`),C.ignoredAdvisories.length>0&&u.info(`  ${String(C.ignoredAdvisories.length)} ${O.name} audit exclusion${C.ignoredAdvisories.length===1?"":"s"} applied`),ge>0){const s=Z.CRITICAL?.filter(f=>!fe(f.entry)).length??0,p=Z.HIGH?.filter(f=>!fe(f.entry)).length??0;u.error(`  ${String(ge)} vulnerabilit${ge===1?"y":"ies"} found`),s>0&&u.error(`    ${String(s)} critical`),p>0&&u.warn(`    ${String(p)} high`)}else u.success("  No vulnerabilities found");if(Q.length>0){const s=Q.filter(p=>!fe(p)).length;u.warn(`  ${String(s)} package${s===1?"":"s"} with Socket.dev supply chain issues`)}G.length>0&&(u.warn(`  ${String(G.length)} package${G.length===1?"":"s"} with duplicate versions`),u.notice("  Run 'vis dedupe' or your package manager's dedupe command to reduce duplicates."));const ue=j.filter(s=>s.severity==="block"&&!s.acceptedRisk);if(ue.length>0&&u.error(`  ${String(ue.length)} policy block${ue.length===1?"":"s"}`),je>0&&(u.info(`  ${String(je)} acknowledged (accepted risks)`),ne||u.notice("  Use --show-accepted to see acknowledged issues.")),Ye===0&&u.success(`
+  All issues are acknowledged. No action required.`),i.sync&&$e){const s=new Set;for(const f of ce)if(f.acceptedRisk){for(const w of f.vulnerabilities)if((w.id.startsWith("CVE-")||w.id.startsWith("GHSA-"))&&s.add(w.id),w.aliases)for(const k of w.aliases)(k.startsWith("CVE-")||k.startsWith("GHSA-"))&&s.add(k)}const p=[...s];if(p.length>0){u.info("");const f=Pi(O.name,t,p);for(const w of f)u.success(`  ${w}`)}else u.info(`
+No advisory IDs to sync to native PM config.`)}i.exitCode&&(Ye>0||ue.length>0)&&(process.exitCode=1),Pe(R,C,M,j)},kt=e=>!e||e.length===0?!1:e.some(t=>t.severity==="block"&&!t.acceptedRisk),Pe=(e,t,i,a)=>{kt(a)&&(process.exitCode=1),i&&e.some(n=>n.vulnerabilities.some(o=>n.acceptedRisk||ae(o.id,t,o.aliases)?!1:he(o.severity,i)))&&(process.exitCode=1)},ie=(e,t,i,a,n)=>{i&&(e.filter(o=>!o.acceptedRisk&&o.vulnerabilities.some(r=>!ae(r.id,t,r.aliases))).length>0||kt(n))&&(process.exitCode=1),Pe(e,t,a,n)},$t=async(e,t)=>{if(!process.stdin.isTTY)return t;const i=Mt({input:process.stdin,output:process.stderr});try{const a="[y/N]",n=await new Promise(o=>{i.question(`${e} ${D(a)} `,r=>{o(r.trim())})});return n.length===0?t:n.toLowerCase().startsWith("y")}finally{i.close()}},Sn=e=>e==="pnpm"||e==="npm"||e==="yarn"||e==="bun",Nn=async e=>{const t=yt({allowMajor:e.allowMajor,findings:e.actionableFindings,workspaceRoot:e.workspaceRoot});if(u.info(""),u.info("─ Apply (direct deps)"),u.info(ka(t)),t.apply.length===0){u.info("Nothing to apply for direct deps.");return}if(De&&!e.yes)return u.error("Refusing to run --fix in CI without --yes. Re-run with --yes once the plan above looks right."),1;if(!e.yes&&!await $t("Apply these direct-dep upgrades?",!1))return u.info("Aborted — no changes made."),0;const i=new Map;for(const a of t.apply){const n=a.workspaceName??"",o=i.get(n);o?o.push(a):i.set(n,[a])}for(const[a,n]of i){const o=n.map(c=>`${c.packageName}@${c.targetSpec}`),r=a.length>0?[a]:[];u.info(`Running ${e.pm.name} add ${o.join(" ")}${a.length>0?` --filter ${a}`:""}`);const l=ni(e.pm,{exact:!1,filter:r,global:!1,optional:!1,packages:o,peer:!1,saveDev:!1,workspace:!1,workspaceRoot:!1},e.workspaceRoot,console);if(l!==0)return u.error(`${e.pm.name} add exited ${String(l)} — aborting before rescan.`),l}return u.success("Direct-dep upgrades applied. Re-run `vis audit` to confirm the fixes landed."),0},An=async e=>{if(!Sn(e.pm.name))return u.error(`--fix-transitive is not supported for package manager "${e.pm.name}". Use pnpm, npm, yarn, or bun.`),1;const t=!!e.visConfig?.security?.audit?.apply?.transitive?.enabled;if(De&&(!e.yes||!t))return u.error("Refusing to run --fix-transitive in CI without both --yes and security.audit.apply.transitive.enabled = true. Overrides have a higher blast radius than direct bumps — gate on config."),1;const i=new Set(yt({findings:e.actionableFindings,workspaceRoot:e.workspaceRoot}).apply.map(r=>r.packageName)),a=e.actionableFindings.filter(r=>!i.has(r.packageName)),n=fn(a);if(n.entries.length===0){u.info(""),u.info("─ Apply transitive (overrides)"),u.info("Nothing to override — all vulnerable packages are direct deps or have no fixed version.");return}const o=dn(e.workspaceRoot,n,{name:e.pm.name,version:e.pm.version});u.info(""),u.info("─ Apply transitive (overrides)"),u.info(`Target: ${o.filePath} (${o.surface})`);for(const r of o.entries){const l=r.status==="added"?"+":r.status==="updated"?"~":"·",c=r.previousSpec?` (was ${r.previousSpec})`:"";u.info(`  ${l} ${r.packageName}: ${r.spec}${c}`)}if(!o.changed){u.info("No changes — overrides already match the plan.");return}if(!e.yes){if(De)return 1;if(!await $t("Write these overrides?",!1))return u.info("Aborted — no changes made."),0}try{gn(o)}catch(r){const l=r instanceof Error?r.message:String(r);return u.error(`Failed to write overrides: ${l}`),1}return u.success(`Wrote ${String(o.entries.filter(r=>r.status!=="unchanged").length)} override${o.entries.length===1?"":"s"}. Run \`${e.pm.name} install\` then re-run \`vis audit\` to confirm the fixes landed.`),0},Un=async({fs:e,logger:t,options:i,visConfig:a,workspaceRoot:n})=>{if(!n)throw new Error("Could not determine workspace root. Run this command inside a monorepo.");await $n(e,n,i,a)};export{Un as default,xn as mapSeverityToAube,bn as resolveAuditBackend};