@visulima/vis 1.0.0-alpha.43 → 1.0.0-alpha.45

package/dist/packem_chunks/handler71.js

@@ -1,4 +1,4 @@
-import{createRequire as Et}from"node:module";import{V as we,E as D,s as ye,q as pt,Q as dt}from"../packem_shared/index.server-J83sowC4.js";import{I as Lt,m as z,f as J,v as be,T as Ze,B as Tt}from"../packem_shared/index-OQZQyN5R.js";import{I as De}from"../packem_shared/index-B0EsgdzO.js";import{whichBin as Pt}from"#native";import{r as zt,R as Wt,b as _t}from"../packem_shared/ai-analysis-Co-b15d_.js";import{N as Ht,O as Ut,B as Ft,T as Gt,u as Ve,p as u,i as Qe}from"./cli-main.js";import"../packem_shared/public-api-WqUCiyIe.js";import{e as Bt,W as Kt,v as qt,a as Jt,N as Yt,f as Zt,b as Qt,O as Xt}from"./catalog.js";import{w as ei,M as ti}from"../packem_shared/pm-runner-CIH0wPh-.js";import{s as L}from"../packem_shared/index-Cg0IHaFI.js";import{c as gt,s as he,p as ii,e as ai,g as ni}from"../packem_shared/index-CkZnT2Fe.js";import{d as ri}from"../packem_shared/anolilab-text-CAM_E6uK.js";import{t as oi,b as si}from"../packem_shared/cyclonedx-BTBzGCBW.js";import{s as pi}from"../packem_shared/scan-progress-RTMsE3Z4.js";import{r as di,A as Xe,q as et}from"../packem_shared/advisories-CefYKEPe.js";import{a as ut}from"../packem_shared/readJsonSync-CvkZyKmL-CY7PZob_.js";import{l as gi,f as fi,a as ui}from"../packem_shared/dependency-scan-DEv-scN6.js";import{r as mi}from"../packem_shared/manifests-pLwnVmCN.js";import{l as bi,p as xi,O as ki}from"../packem_shared/osv-bloom-BsQ-aFiM.js";import{H as tt,h as $i,D as Si,y as Ni}from"../packem_shared/env-XJzocuUP.js";const Ot=Et(import.meta.url),ee=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,Y=e=>{if(typeof ee<"u"&&ee.versions&&ee.versions.node){const[t,i]=ee.versions.node.split(".").map(Number);if(t>22||t===22&&i>=3||t===20&&i>=16)return ee.getBuiltinModule(e)}return Ot(e)},{spawnSync:Dt}=Y("node:child_process"),{createInterface:Mt}=Y("node:readline"),{stripVTControlCharacters:Vt}=Y("node:util"),{createHash:ci}=Y("node:crypto"),{relative:ft,join:li}=Y("node:path"),{readFileSync:mt,existsSync:hi,writeFileSync:vi,renameSync:wi,unlinkSync:yi}=Y("node:fs"),it=(e,t={})=>{Array.isArray(t.extensions)||(t.extensions=["js","mjs","cjs","ts"]);const i=[];for(const a of Lt(e,t))i.push(a.path);return i},xe=e=>`${e.packageName}@${e.packageVersion}:${e.vulnerability.id}`,Ai=e=>e==null||e===!0||e===""||e==="true"||e.toString().toLowerCase()==="all",Ci=(e,t)=>{if(Ai(t))return e;const i=String(t).trim();if(/^\d+$/.test(i)){const n=Number.parseInt(i,10)-1,o=e[n];return o?[o]:[]}const a=i.toLowerCase();return e.filter(n=>{const{aliases:o,id:r}=n.vulnerability;return r.toLowerCase()===a||(o??[]).some(c=>c.toLowerCase()===a)})},Ri=e=>{const{packageName:t,packageVersion:i,vulnerability:a}=e,n=(a.aliases??[]).join(", ")||"none",o=(a.fixedVersions??[]).join(", ")||"no fixed version published";return`You are a security engineer. Explain this dependency vulnerability for a developer triaging it.
+import{createRequire as Et}from"node:module";import{V as we,E as D,s as ye,q as pt,Q as dt}from"../packem_shared/index.server-J83sowC4.js";import{I as Lt,m as z,f as J,v as be,T as Ze,B as Tt}from"../packem_shared/index-CE6MsgcV.js";import{I as De}from"../packem_shared/index-B0EsgdzO.js";import{whichBin as Pt}from"#native";import{r as zt,R as Wt,b as _t}from"../packem_shared/ai-analysis-rC48NLfB.js";import{N as Ht,O as Ut,B as Ft,M as Gt,p as u,i as Qe}from"./cli-main.js";import"../packem_shared/public-api-WqUCiyIe.js";import{u as Ve}from"./ts-loader.js";import{e as Bt,W as Kt,v as qt,c as Jt,N as Yt,f as Zt,b as Qt,O as Xt}from"./catalog.js";import{A as ei,j as ti}from"../packem_shared/pm-runner-CQcraCcu.js";import{s as L}from"../packem_shared/index-Cg0IHaFI.js";import{c as gt,s as he,p as ii,e as ai,g as ni}from"../packem_shared/index-Cntyu-w8.js";import{d as ri}from"../packem_shared/anolilab-text-CAM_E6uK.js";import{t as oi,b as si}from"../packem_shared/cyclonedx-BeUmPgfO.js";import{s as pi}from"../packem_shared/scan-progress-YRpDs90j.js";import{r as di,A as Xe,q as et}from"../packem_shared/advisories-CefYKEPe.js";import{a as ut}from"../packem_shared/readJsonSync-CvkZyKmL-ihoybKvs.js";import{l as gi,f as fi,a as ui}from"../packem_shared/dependency-scan-DpOFiZuI.js";import{r as mi}from"../packem_shared/manifests-WBnsV_Eb.js";import{l as bi,p as xi,O as ki}from"../packem_shared/osv-bloom-DVMlkcAO.js";import{H as tt,h as $i,D as Si,y as Ni}from"../packem_shared/env-Ct3hMEYB.js";const Ot=Et(import.meta.url),ee=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,Y=e=>{if(typeof ee<"u"&&ee.versions&&ee.versions.node){const[t,i]=ee.versions.node.split(".").map(Number);if(t>22||t===22&&i>=3||t===20&&i>=16)return ee.getBuiltinModule(e)}return Ot(e)},{spawnSync:Dt}=Y("node:child_process"),{createInterface:Mt}=Y("node:readline"),{stripVTControlCharacters:Vt}=Y("node:util"),{createHash:ci}=Y("node:crypto"),{relative:ft,join:li}=Y("node:path"),{readFileSync:mt,existsSync:hi,writeFileSync:vi,renameSync:wi,unlinkSync:yi}=Y("node:fs"),it=(e,t={})=>{Array.isArray(t.extensions)||(t.extensions=["js","mjs","cjs","ts"]);const i=[];for(const a of Lt(e,t))i.push(a.path);return i},xe=e=>`${e.packageName}@${e.packageVersion}:${e.vulnerability.id}`,Ai=e=>e==null||e===!0||e===""||e==="true"||e.toString().toLowerCase()==="all",Ci=(e,t)=>{if(Ai(t))return e;const i=String(t).trim();if(/^\d+$/.test(i)){const n=Number.parseInt(i,10)-1,o=e[n];return o?[o]:[]}const a=i.toLowerCase();return e.filter(n=>{const{aliases:o,id:r}=n.vulnerability;return r.toLowerCase()===a||(o??[]).some(c=>c.toLowerCase()===a)})},Ri=e=>{const{packageName:t,packageVersion:i,vulnerability:a}=e,n=(a.aliases??[]).join(", ")||"none",o=(a.fixedVersions??[]).join(", ")||"no fixed version published";return`You are a security engineer. Explain this dependency vulnerability for a developer triaging it.
 
 Package: ${t}@${i}
 Advisory: ${a.id} (aliases: ${n})
@@ -319,4 +319,4 @@ ${a}`},pn=(e,t,i,a)=>{const n=qt(e,t.length>0?t:void 0),o=t.length>0?JSON.parse(
 ── Duplicate Dependencies (${String(G.length)}) ──`);for(const s of G){const p=s.versions.join(", ");u.info(`  ${s.name} — ${String(s.versions.length)} versions: ${ye(p)}`)}}const Je=new Set;for(const s of["CRITICAL","HIGH","MODERATE","LOW"]){const p=Z[s];if(p)for(const{vuln:f}of p)Je.add(f.id)}const Ee=j.filter(s=>{if(s.policy!=="vulnerability")return!0;const p=typeof s.data?.advisoryId=="string"?s.data.advisoryId:void 0;return s.severity==="block"&&p!==void 0&&!Je.has(p)});if(Ee.length>0){u.info(`
 ── Policy Decisions (${String(Ee.length)}) ──`);for(const s of Ee){const p=!!s.acceptedRisk;if(p&&!ne)continue;const f=s.severity==="block"?we:s.severity==="warn"?ye:D,w=p?` ${D("[acknowledged]")}`:"";u.info(`  ${f(`[${s.severity}]`)} ${s.policy} — ${s.reason}${w}`)}}const fe=s=>!!s.acceptedRisk||s.vulnerabilities.length>0&&s.vulnerabilities.every(p=>ae(p.id,C,p.aliases)),Ye=R.filter(s=>!fe(s)).length;if(u.info(""),u.info("─ Audit Summary"),u.info(`  ${String(P.length)} packages scanned`),C.ignoredAdvisories.length>0&&u.info(`  ${String(C.ignoredAdvisories.length)} ${O.name} audit exclusion${C.ignoredAdvisories.length===1?"":"s"} applied`),ge>0){const s=Z.CRITICAL?.filter(f=>!fe(f.entry)).length??0,p=Z.HIGH?.filter(f=>!fe(f.entry)).length??0;u.error(`  ${String(ge)} vulnerabilit${ge===1?"y":"ies"} found`),s>0&&u.error(`    ${String(s)} critical`),p>0&&u.warn(`    ${String(p)} high`)}else u.success("  No vulnerabilities found");if(Q.length>0){const s=Q.filter(p=>!fe(p)).length;u.warn(`  ${String(s)} package${s===1?"":"s"} with Socket.dev supply chain issues`)}G.length>0&&(u.warn(`  ${String(G.length)} package${G.length===1?"":"s"} with duplicate versions`),u.notice("  Run 'vis dedupe' or your package manager's dedupe command to reduce duplicates."));const ue=j.filter(s=>s.severity==="block"&&!s.acceptedRisk);if(ue.length>0&&u.error(`  ${String(ue.length)} policy block${ue.length===1?"":"s"}`),je>0&&(u.info(`  ${String(je)} acknowledged (accepted risks)`),ne||u.notice("  Use --show-accepted to see acknowledged issues.")),Ye===0&&u.success(`
   All issues are acknowledged. No action required.`),i.sync&&$e){const s=new Set;for(const f of le)if(f.acceptedRisk){for(const w of f.vulnerabilities)if((w.id.startsWith("CVE-")||w.id.startsWith("GHSA-"))&&s.add(w.id),w.aliases)for(const k of w.aliases)(k.startsWith("CVE-")||k.startsWith("GHSA-"))&&s.add(k)}const p=[...s];if(p.length>0){u.info("");const f=Pi(O.name,t,p);for(const w of f)u.success(`  ${w}`)}else u.info(`
-No advisory IDs to sync to native PM config.`)}i.exitCode&&(Ye>0||ue.length>0)&&(process.exitCode=1),Pe(R,C,M,j)},kt=e=>!e||e.length===0?!1:e.some(t=>t.severity==="block"&&!t.acceptedRisk),Pe=(e,t,i,a)=>{kt(a)&&(process.exitCode=1),i&&e.some(n=>n.vulnerabilities.some(o=>n.acceptedRisk||ae(o.id,t,o.aliases)?!1:he(o.severity,i)))&&(process.exitCode=1)},ie=(e,t,i,a,n)=>{i&&(e.filter(o=>!o.acceptedRisk&&o.vulnerabilities.some(r=>!ae(r.id,t,r.aliases))).length>0||kt(n))&&(process.exitCode=1),Pe(e,t,a,n)},$t=async(e,t)=>{if(!process.stdin.isTTY)return t;const i=Mt({input:process.stdin,output:process.stderr});try{const a="[y/N]",n=await new Promise(o=>{i.question(`${e} ${D(a)} `,r=>{o(r.trim())})});return n.length===0?t:n.toLowerCase().startsWith("y")}finally{i.close()}},Sn=e=>e==="pnpm"||e==="npm"||e==="yarn"||e==="bun",Nn=async e=>{const t=yt({allowMajor:e.allowMajor,findings:e.actionableFindings,workspaceRoot:e.workspaceRoot});if(u.info(""),u.info("─ Apply (direct deps)"),u.info(ka(t)),t.apply.length===0){u.info("Nothing to apply for direct deps.");return}if(De&&!e.yes)return u.error("Refusing to run --fix in CI without --yes. Re-run with --yes once the plan above looks right."),1;if(!e.yes&&!await $t("Apply these direct-dep upgrades?",!1))return u.info("Aborted — no changes made."),0;const i=new Map;for(const a of t.apply){const n=a.workspaceName??"",o=i.get(n);o?o.push(a):i.set(n,[a])}for(const[a,n]of i){const o=n.map(l=>`${l.packageName}@${l.targetSpec}`),r=a.length>0?[a]:[];u.info(`Running ${e.pm.name} add ${o.join(" ")}${a.length>0?` --filter ${a}`:""}`);const c=ti(e.pm,{exact:!1,filter:r,global:!1,optional:!1,packages:o,peer:!1,saveDev:!1,workspace:!1,workspaceRoot:!1},e.workspaceRoot,console);if(c!==0)return u.error(`${e.pm.name} add exited ${String(c)} — aborting before rescan.`),c}return u.success("Direct-dep upgrades applied. Re-run `vis audit` to confirm the fixes landed."),0},An=async e=>{if(!Sn(e.pm.name))return u.error(`--fix-transitive is not supported for package manager "${e.pm.name}". Use pnpm, npm, yarn, or bun.`),1;const t=!!e.visConfig?.security?.audit?.apply?.transitive?.enabled;if(De&&(!e.yes||!t))return u.error("Refusing to run --fix-transitive in CI without both --yes and security.audit.apply.transitive.enabled = true. Overrides have a higher blast radius than direct bumps — gate on config."),1;const i=new Set(yt({findings:e.actionableFindings,workspaceRoot:e.workspaceRoot}).apply.map(r=>r.packageName)),a=e.actionableFindings.filter(r=>!i.has(r.packageName)),n=fn(a);if(n.entries.length===0){u.info(""),u.info("─ Apply transitive (overrides)"),u.info("Nothing to override — all vulnerable packages are direct deps or have no fixed version.");return}const o=dn(e.workspaceRoot,n,{name:e.pm.name,version:e.pm.version});u.info(""),u.info("─ Apply transitive (overrides)"),u.info(`Target: ${o.filePath} (${o.surface})`);for(const r of o.entries){const c=r.status==="added"?"+":r.status==="updated"?"~":"·",l=r.previousSpec?` (was ${r.previousSpec})`:"";u.info(`  ${c} ${r.packageName}: ${r.spec}${l}`)}if(!o.changed){u.info("No changes — overrides already match the plan.");return}if(!e.yes){if(De)return 1;if(!await $t("Write these overrides?",!1))return u.info("Aborted — no changes made."),0}try{gn(o)}catch(r){const c=r instanceof Error?r.message:String(r);return u.error(`Failed to write overrides: ${c}`),1}return u.success(`Wrote ${String(o.entries.filter(r=>r.status!=="unchanged").length)} override${o.entries.length===1?"":"s"}. Run \`${e.pm.name} install\` then re-run \`vis audit\` to confirm the fixes landed.`),0},qn=async({fs:e,logger:t,options:i,visConfig:a,workspaceRoot:n})=>{if(!n)throw new Error("Could not determine workspace root. Run this command inside a monorepo.");await $n(e,n,i,a)};export{qn as default,xn as mapSeverityToAube,bn as resolveAuditBackend};
+No advisory IDs to sync to native PM config.`)}i.exitCode&&(Ye>0||ue.length>0)&&(process.exitCode=1),Pe(R,C,M,j)},kt=e=>!e||e.length===0?!1:e.some(t=>t.severity==="block"&&!t.acceptedRisk),Pe=(e,t,i,a)=>{kt(a)&&(process.exitCode=1),i&&e.some(n=>n.vulnerabilities.some(o=>n.acceptedRisk||ae(o.id,t,o.aliases)?!1:he(o.severity,i)))&&(process.exitCode=1)},ie=(e,t,i,a,n)=>{i&&(e.filter(o=>!o.acceptedRisk&&o.vulnerabilities.some(r=>!ae(r.id,t,r.aliases))).length>0||kt(n))&&(process.exitCode=1),Pe(e,t,a,n)},$t=async(e,t)=>{if(!process.stdin.isTTY)return t;const i=Mt({input:process.stdin,output:process.stderr});try{const a="[y/N]",n=await new Promise(o=>{i.question(`${e} ${D(a)} `,r=>{o(r.trim())})});return n.length===0?t:n.toLowerCase().startsWith("y")}finally{i.close()}},Sn=e=>e==="pnpm"||e==="npm"||e==="yarn"||e==="bun",Nn=async e=>{const t=yt({allowMajor:e.allowMajor,findings:e.actionableFindings,workspaceRoot:e.workspaceRoot});if(u.info(""),u.info("─ Apply (direct deps)"),u.info(ka(t)),t.apply.length===0){u.info("Nothing to apply for direct deps.");return}if(De&&!e.yes)return u.error("Refusing to run --fix in CI without --yes. Re-run with --yes once the plan above looks right."),1;if(!e.yes&&!await $t("Apply these direct-dep upgrades?",!1))return u.info("Aborted — no changes made."),0;const i=new Map;for(const a of t.apply){const n=a.workspaceName??"",o=i.get(n);o?o.push(a):i.set(n,[a])}for(const[a,n]of i){const o=n.map(l=>`${l.packageName}@${l.targetSpec}`),r=a.length>0?[a]:[];u.info(`Running ${e.pm.name} add ${o.join(" ")}${a.length>0?` --filter ${a}`:""}`);const c=ti(e.pm,{exact:!1,filter:r,global:!1,optional:!1,packages:o,peer:!1,saveDev:!1,workspace:!1,workspaceRoot:!1},e.workspaceRoot,console);if(c!==0)return u.error(`${e.pm.name} add exited ${String(c)} — aborting before rescan.`),c}return u.success("Direct-dep upgrades applied. Re-run `vis audit` to confirm the fixes landed."),0},An=async e=>{if(!Sn(e.pm.name))return u.error(`--fix-transitive is not supported for package manager "${e.pm.name}". Use pnpm, npm, yarn, or bun.`),1;const t=!!e.visConfig?.security?.audit?.apply?.transitive?.enabled;if(De&&(!e.yes||!t))return u.error("Refusing to run --fix-transitive in CI without both --yes and security.audit.apply.transitive.enabled = true. Overrides have a higher blast radius than direct bumps — gate on config."),1;const i=new Set(yt({findings:e.actionableFindings,workspaceRoot:e.workspaceRoot}).apply.map(r=>r.packageName)),a=e.actionableFindings.filter(r=>!i.has(r.packageName)),n=fn(a);if(n.entries.length===0){u.info(""),u.info("─ Apply transitive (overrides)"),u.info("Nothing to override — all vulnerable packages are direct deps or have no fixed version.");return}const o=dn(e.workspaceRoot,n,{name:e.pm.name,version:e.pm.version});u.info(""),u.info("─ Apply transitive (overrides)"),u.info(`Target: ${o.filePath} (${o.surface})`);for(const r of o.entries){const c=r.status==="added"?"+":r.status==="updated"?"~":"·",l=r.previousSpec?` (was ${r.previousSpec})`:"";u.info(`  ${c} ${r.packageName}: ${r.spec}${l}`)}if(!o.changed){u.info("No changes — overrides already match the plan.");return}if(!e.yes){if(De)return 1;if(!await $t("Write these overrides?",!1))return u.info("Aborted — no changes made."),0}try{gn(o)}catch(r){const c=r instanceof Error?r.message:String(r);return u.error(`Failed to write overrides: ${c}`),1}return u.success(`Wrote ${String(o.entries.filter(r=>r.status!=="unchanged").length)} override${o.entries.length===1?"":"s"}. Run \`${e.pm.name} install\` then re-run \`vis audit\` to confirm the fixes landed.`),0},Jn=async({fs:e,logger:t,options:i,visConfig:a,workspaceRoot:n})=>{if(!n)throw new Error("Could not determine workspace root. Run this command inside a monorepo.");await $n(e,n,i,a)};export{Jn as default,xn as mapSeverityToAube,bn as resolveAuditBackend};