@visulima/vis 4.3.0 → 4.3.1

package/dist/packem_chunks/sync.js

@@ -1,3 +1,3 @@
-import{F as v}from"../packem_shared/index.server-sXNQYpsl.js";import{p as c}from"./cli-main.js";import{s as S}from"../packem_shared/scan-progress-C_zaZjyY.js";import{D as $,s as b,A as D}from"./catalog.js";import{c as w}from"../packem_shared/multi-eco-lockfiles-CUUxUjHK.js";const E=o=>o?.security?.audit?.advisories??{},A=o=>o?o.split(",").map(t=>t.trim()).filter(t=>t.length>0).map(t=>w(t)):["npm"],C=async({logger:o,options:t,visConfig:p,workspaceRoot:d})=>{if(!d)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const l=t.format==="json",u=E(p),m=t.source??u.source??$,f=A(t.ecosystem),y=f.map(s=>({id:s,label:`Sync ${s} advisories`})),n=S(y,{live:!l}),i=[];try{for(const s of f){n.start(s);const e=Date.now();try{const r=await b({allowedHosts:u.allowedHosts,dbPath:t.db,ecosystem:s,force:!!t.force,source:m,workspaceRoot:d});i.push({ecosystem:s,result:r}),r.upToDate?n.finish(s,"ok",`up to date · ${h(Date.now()-e)}`):n.finish(s,"ok",`${r.advisoriesIngested.toLocaleString()} advisories · ${h(r.durationMs)}`)}catch(r){const a=r instanceof Error?r.message:String(r);i.push({ecosystem:s,error:a}),n.finish(s,"error",a)}}}finally{n.stop()}const g=i.find(s=>s.result?.rebuiltFromSchema!==void 0)?.result?.rebuiltFromSchema;if(g!==void 0){const s=`advisory database is schema v${String(g)}; rebuilt to v${String(D)}`;l?process.stderr.write(`${s}
+import{F as v}from"../packem_shared/index.server-sXNQYpsl.js";import{p as c}from"./cli-main.js";import{s as S}from"../packem_shared/scan-progress-CkumcBG-.js";import{D as $,s as b,A as D}from"./catalog.js";import{c as w}from"../packem_shared/multi-eco-lockfiles-B2X3yhyo.js";const E=o=>o?.security?.audit?.advisories??{},A=o=>o?o.split(",").map(t=>t.trim()).filter(t=>t.length>0).map(t=>w(t)):["npm"],C=async({logger:o,options:t,visConfig:p,workspaceRoot:d})=>{if(!d)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const l=t.format==="json",u=E(p),m=t.source??u.source??$,f=A(t.ecosystem),y=f.map(s=>({id:s,label:`Sync ${s} advisories`})),n=S(y,{live:!l}),i=[];try{for(const s of f){n.start(s);const e=Date.now();try{const r=await b({allowedHosts:u.allowedHosts,dbPath:t.db,ecosystem:s,force:!!t.force,source:m,workspaceRoot:d});i.push({ecosystem:s,result:r}),r.upToDate?n.finish(s,"ok",`up to date · ${h(Date.now()-e)}`):n.finish(s,"ok",`${r.advisoriesIngested.toLocaleString()} advisories · ${h(r.durationMs)}`)}catch(r){const a=r instanceof Error?r.message:String(r);i.push({ecosystem:s,error:a}),n.finish(s,"error",a)}}}finally{n.stop()}const g=i.find(s=>s.result?.rebuiltFromSchema!==void 0)?.result?.rebuiltFromSchema;if(g!==void 0){const s=`advisory database is schema v${String(g)}; rebuilt to v${String(D)}`;l?process.stderr.write(`${s}
 `):c.info(s)}if(l){const s={ecosystems:i.map(e=>({advisoriesIngested:e.result?.advisoriesIngested??0,dbPath:e.result?.dbPath??null,durationMs:e.result?.durationMs??0,ecosystem:e.ecosystem,error:e.error??null,upToDate:e.result?.upToDate??!1})),source:m};process.stdout.write(`${JSON.stringify(s,void 0,2)}
 `)}else{const s=i.filter(a=>a.error),e=i.filter(a=>a.result),r=e[0];r?.result?.dbPath&&c.info(v(`DB: ${r.result.dbPath}`)),s.length===0?c.success(`Synced ${e.length} ecosystem${e.length===1?"":"s"}.`):c.error(`${s.length} ecosystem${s.length===1?"":"s"} failed to sync.`)}i.some(s=>s.error)&&(process.exitCode=1)},h=o=>o>=1e3?`${(o/1e3).toFixed(1)}s`:`${Math.round(o)}ms`,M=C;export{M as advisoriesSyncExecute,A as parseEcosystems};

package/dist/packem_chunks/verify-lockfile.js

@@ -1,2 +1,2 @@
-import{p}from"./cli-main.js";import{d as b}from"../packem_shared/pm-runner-CMSml1Bj.js";import{r as m,l as w,L as v}from"../packem_shared/dependency-scan-B8jroa1D.js";import{z as S,e as g}from"../packem_shared/index-BzhrR_iC.js";import{S as $}from"../packem_shared/lockfile-DhHAaHN5.js";import{e as x}from"../packem_shared/index-BO8qIogg.js";import{y as C}from"../packem_shared/isAccessibleSync-DYKTrrvc-C-_5cgwu.js";const E=e=>{const o=e.trim();return o===""?!1:/^(?:git\+|git:\/\/|git@|ssh:\/\/)/i.test(o)||/^(?:github|gitlab|bitbucket|gist):/i.test(o)||/^[\w.-]+\/[\w.-]+(?:#.+)?$/.test(o)&&!o.includes("@")?!0:/^https?:\/\//i.test(o)},M=(e,o)=>{for(const i of o)if(i===e||i.endsWith("*")&&e.startsWith(i.slice(0,-1)))return!0;return!1},L=(e,o,i={})=>{const t=m(e,o);if(!t)return[];let s;try{s=S(g(e,t.file))}catch{return[]}const n=$(s,t.type);if(n.length===0)return[];const r=i.allow??[],l=[],f=new Set;for(const c of n){const a=`${c.name}@${c.version}`;for(const d of[c.dependencies,c.optionalDependencies])if(d){for(const[u,h]of Object.entries(d))if(!M(u,r))for(const k of h){if(!E(k))continue;const y=`${a}->${u}@${k}`;f.has(y)||(f.add(y),l.push({declaredBy:a,packageName:u,source:k}))}}}return l.sort((c,a)=>c.packageName.localeCompare(a.packageName)||c.declaredBy.localeCompare(a.declaredBy))},D=new Set(["firstSeen","publisherChange"]),I=e=>e.severity==="block"&&e.acceptedRisk===void 0,N=e=>{const o=e.security?.policies?.firstSeen?.minutes,i=typeof o=="number"&&o>0,t=e.security?.policies?.publisherChange?.mode==="no-downgrade",s=e.security?.blockExoticSubdeps===!0;return i||t||s},O=async e=>{const{offline:o=!1,packageManager:i,visConfig:t,workspaceRoot:s}=e,n=Date.now();if(!N(t))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!1,status:"skipped"};const r=m(s,i);if(!r||!C(g(s,r.file)))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!0,status:"fail"};const l=w(s,i,{includeDev:!0}),f=l.length,c=await x({offline:o,packageManager:i,packages:l,workspaceRoot:s},"install",{enabledPolicies:new Set(D),visConfig:t}),a=t.security?.blockExoticSubdeps===!0?L(s,i,{allow:t.security.exoticSubdepsAllow}):[],d=c.some(u=>I(u))||a.length>0;return{decisions:c,durationMs:Date.now()-n,entryCount:f,exoticViolations:a,lockfileMissing:!1,status:d?"fail":"pass"}},P=e=>e<1e3?`${String(e)}ms`:`${(e/1e3).toFixed(1)}s`,V=e=>{if(e.status==="skipped")return["– Lockfile supply-chain verification skipped (no firstSeen / publisherChange / blockExoticSubdeps policy configured)"];if(e.lockfileMissing)return["✗ Lockfile supply-chain verification failed — no lockfile found, the resolved closure cannot be attested"];const o=`(${String(e.entryCount)} ${e.entryCount===1?"entry":"entries"}, ${P(e.durationMs)})`;if(e.status==="pass")return[`✓ Lockfile passes supply-chain policies ${o}`];const i=[`✗ Lockfile failed supply-chain policy check ${o}`];for(const t of e.decisions)t.severity==="block"&&t.acceptedRisk===void 0&&i.push(`  [${t.policy}] ${t.reason}`);for(const t of e.exoticViolations)i.push(`  [blockExoticSubdeps] ${t.packageName} pulled from exotic source by ${t.declaredBy}: ${t.source}`);return i},z=async({options:e,visConfig:o,workspaceRoot:i})=>{const t=i??process.cwd(),s=b(t);if(!v[s.name]){p.warn(`Package manager '${s.name}' has no lockfile vis can verify.`);return}const n=await O({offline:!!e.offline,packageManager:s.name,visConfig:o??{},workspaceRoot:t});if(e.json){process.stdout.write(`${JSON.stringify(n,void 0,2)}
+import{p}from"./cli-main.js";import{d as b}from"../packem_shared/pm-runner-CMSml1Bj.js";import{r as m,l as w,L as v}from"../packem_shared/dependency-scan-B8jroa1D.js";import{z as S,e as g}from"../packem_shared/index-BzhrR_iC.js";import{S as $}from"../packem_shared/lockfile-DhHAaHN5.js";import{e as x}from"../packem_shared/index-Chje3u9v.js";import{y as C}from"../packem_shared/isAccessibleSync-DYKTrrvc-C-_5cgwu.js";const E=e=>{const o=e.trim();return o===""?!1:/^(?:git\+|git:\/\/|git@|ssh:\/\/)/i.test(o)||/^(?:github|gitlab|bitbucket|gist):/i.test(o)||/^[\w.-]+\/[\w.-]+(?:#.+)?$/.test(o)&&!o.includes("@")?!0:/^https?:\/\//i.test(o)},M=(e,o)=>{for(const i of o)if(i===e||i.endsWith("*")&&e.startsWith(i.slice(0,-1)))return!0;return!1},L=(e,o,i={})=>{const t=m(e,o);if(!t)return[];let s;try{s=S(g(e,t.file))}catch{return[]}const n=$(s,t.type);if(n.length===0)return[];const r=i.allow??[],l=[],f=new Set;for(const c of n){const a=`${c.name}@${c.version}`;for(const d of[c.dependencies,c.optionalDependencies])if(d){for(const[u,h]of Object.entries(d))if(!M(u,r))for(const k of h){if(!E(k))continue;const y=`${a}->${u}@${k}`;f.has(y)||(f.add(y),l.push({declaredBy:a,packageName:u,source:k}))}}}return l.sort((c,a)=>c.packageName.localeCompare(a.packageName)||c.declaredBy.localeCompare(a.declaredBy))},D=new Set(["firstSeen","publisherChange"]),I=e=>e.severity==="block"&&e.acceptedRisk===void 0,N=e=>{const o=e.security?.policies?.firstSeen?.minutes,i=typeof o=="number"&&o>0,t=e.security?.policies?.publisherChange?.mode==="no-downgrade",s=e.security?.blockExoticSubdeps===!0;return i||t||s},O=async e=>{const{offline:o=!1,packageManager:i,visConfig:t,workspaceRoot:s}=e,n=Date.now();if(!N(t))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!1,status:"skipped"};const r=m(s,i);if(!r||!C(g(s,r.file)))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!0,status:"fail"};const l=w(s,i,{includeDev:!0}),f=l.length,c=await x({offline:o,packageManager:i,packages:l,workspaceRoot:s},"install",{enabledPolicies:new Set(D),visConfig:t}),a=t.security?.blockExoticSubdeps===!0?L(s,i,{allow:t.security.exoticSubdepsAllow}):[],d=c.some(u=>I(u))||a.length>0;return{decisions:c,durationMs:Date.now()-n,entryCount:f,exoticViolations:a,lockfileMissing:!1,status:d?"fail":"pass"}},P=e=>e<1e3?`${String(e)}ms`:`${(e/1e3).toFixed(1)}s`,V=e=>{if(e.status==="skipped")return["– Lockfile supply-chain verification skipped (no firstSeen / publisherChange / blockExoticSubdeps policy configured)"];if(e.lockfileMissing)return["✗ Lockfile supply-chain verification failed — no lockfile found, the resolved closure cannot be attested"];const o=`(${String(e.entryCount)} ${e.entryCount===1?"entry":"entries"}, ${P(e.durationMs)})`;if(e.status==="pass")return[`✓ Lockfile passes supply-chain policies ${o}`];const i=[`✗ Lockfile failed supply-chain policy check ${o}`];for(const t of e.decisions)t.severity==="block"&&t.acceptedRisk===void 0&&i.push(`  [${t.policy}] ${t.reason}`);for(const t of e.exoticViolations)i.push(`  [blockExoticSubdeps] ${t.packageName} pulled from exotic source by ${t.declaredBy}: ${t.source}`);return i},z=async({options:e,visConfig:o,workspaceRoot:i})=>{const t=i??process.cwd(),s=b(t);if(!v[s.name]){p.warn(`Package manager '${s.name}' has no lockfile vis can verify.`);return}const n=await O({offline:!!e.offline,packageManager:s.name,visConfig:o??{},workspaceRoot:t});if(e.json){process.stdout.write(`${JSON.stringify(n,void 0,2)}
 `),n.status==="fail"&&(process.exitCode=1);return}const[r,...l]=V(n);if(n.status==="skipped"){p.info(r);return}if(n.status==="pass"){p.success(r);return}p.error(r);for(const f of l)p.error(f);process.exitCode=1};export{z as default};

package/dist/packem_shared/{affected-selection-BzIbfpA1.js → affected-selection-D4giBK2X.js}

@@ -1 +1 @@
-import{createRequire as T}from"node:module";import{getAffectedProjects as W}from"@visulima/task-runner";import{i as A}from"./index-BjdW45xX.js";import{V as k}from"./vis-user-error-Cpg2FqA4.js";import{r as B}from"./affected-shas-B2V84O0g.js";let I;const R=e=>(I??=T(import.meta.url))(e),f=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,F=e=>{if(typeof f<"u"&&f.versions&&f.versions.node){const[t,s]=f.versions.node.split(".").map(Number);if(t>22||t===22&&s>=3||t===20&&s>=16)return f.getBuiltinModule(e)}return R(e)},{spawnSync:S}=F("node:child_process"),b=new Set(["deep","direct","none"]),O=e=>{const t=[],s=e.split("\0");for(let n=0;n<s.length;n++){const o=s[n];if(!o||o.length<4)continue;const c=o.slice(0,2),p=o.slice(3);if(p&&t.push(p),c.includes("R")||c.includes("C")){n+=1;const l=s[n];l&&t.push(l)}}return t},P=e=>{const t=S("git",["status","--porcelain","-z"],{cwd:e,encoding:"utf8"});return t.error||t.status!==0||typeof t.stdout!="string"?[]:O(t.stdout)},D=async(e,t,s={})=>{const n=e.downstream??"deep",o=e.upstream??"none";if(!b.has(n))throw new k(`Invalid --downstream value: "${n}". Must be "none", "direct", or "deep".`);if(!b.has(o))throw new k(`Invalid --upstream value: "${o}". Must be "none", "direct", or "deep".`);const{fileOwners:c,projectGraph:p,projects:l,workspaceRoot:h}=t,a=[];let{base:g}=e,{head:i}=e;if(!g||!i){const u=B({defaultBase:s.defaultBase,workspaceRoot:h});g=g||u.base,i=i||u.head,a.push(`Resolved affected refs from ${u.provider} (${u.notes.join("; ")})`)}const y=s.runningInCi??A,w=i==="HEAD"||i==="",$=e.uncommitted??(!y&&w);let d=[];if($)if(w){const j=(s.readWorkingTreeChanges??P)(h),C=Object.values(l).map(r=>r.root?.replace(/\/$/,"")).filter(r=>!!r&&r!==".");d=j.filter(r=>c!==void 0&&Object.hasOwn(c,r)||C.some(v=>r===v||r.startsWith(`${v}/`)));const _=j.length-d.length;d.length>0&&a.push(`including ${d.length} uncommitted working-tree file(s)`),_>0&&a.push(`ignoring ${_} uncommitted path(s) outside any project (untracked scratch would otherwise mark every project affected)`)}else a.push(`ignoring --uncommitted: --head=${i} pins the comparison to a commit, not the working tree`);const m=await W({additionalChangedFiles:d,base:g,downstream:n,fileOwners:c,head:i,ignoredFiles:s.affectedIgnore,projectGraph:p,projects:l,upstream:o,workspaceRoot:h});return m.ignoredFiles.length>0&&a.push(`ignoring ${m.ignoredFiles.length} changed path(s) outside any project matching affectedIgnore`),{...m,notes:a,uncommittedFileCount:d.length}};export{D as s};
+import{createRequire as T}from"node:module";import{getAffectedProjects as W}from"@visulima/task-runner";import{i as A}from"./index-BjdW45xX.js";import{V as k}from"./vis-user-error-75VtCwMv.js";import{r as B}from"./affected-shas-B2V84O0g.js";let I;const R=e=>(I??=T(import.meta.url))(e),f=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,F=e=>{if(typeof f<"u"&&f.versions&&f.versions.node){const[t,s]=f.versions.node.split(".").map(Number);if(t>22||t===22&&s>=3||t===20&&s>=16)return f.getBuiltinModule(e)}return R(e)},{spawnSync:S}=F("node:child_process"),b=new Set(["deep","direct","none"]),O=e=>{const t=[],s=e.split("\0");for(let n=0;n<s.length;n++){const o=s[n];if(!o||o.length<4)continue;const c=o.slice(0,2),p=o.slice(3);if(p&&t.push(p),c.includes("R")||c.includes("C")){n+=1;const l=s[n];l&&t.push(l)}}return t},P=e=>{const t=S("git",["status","--porcelain","-z"],{cwd:e,encoding:"utf8"});return t.error||t.status!==0||typeof t.stdout!="string"?[]:O(t.stdout)},D=async(e,t,s={})=>{const n=e.downstream??"deep",o=e.upstream??"none";if(!b.has(n))throw new k(`Invalid --downstream value: "${n}". Must be "none", "direct", or "deep".`);if(!b.has(o))throw new k(`Invalid --upstream value: "${o}". Must be "none", "direct", or "deep".`);const{fileOwners:c,projectGraph:p,projects:l,workspaceRoot:h}=t,a=[];let{base:g}=e,{head:i}=e;if(!g||!i){const u=B({defaultBase:s.defaultBase,workspaceRoot:h});g=g||u.base,i=i||u.head,a.push(`Resolved affected refs from ${u.provider} (${u.notes.join("; ")})`)}const y=s.runningInCi??A,w=i==="HEAD"||i==="",$=e.uncommitted??(!y&&w);let d=[];if($)if(w){const j=(s.readWorkingTreeChanges??P)(h),C=Object.values(l).map(r=>r.root?.replace(/\/$/,"")).filter(r=>!!r&&r!==".");d=j.filter(r=>c!==void 0&&Object.hasOwn(c,r)||C.some(v=>r===v||r.startsWith(`${v}/`)));const _=j.length-d.length;d.length>0&&a.push(`including ${d.length} uncommitted working-tree file(s)`),_>0&&a.push(`ignoring ${_} uncommitted path(s) outside any project (untracked scratch would otherwise mark every project affected)`)}else a.push(`ignoring --uncommitted: --head=${i} pins the comparison to a commit, not the working tree`);const m=await W({additionalChangedFiles:d,base:g,downstream:n,fileOwners:c,head:i,ignoredFiles:s.affectedIgnore,projectGraph:p,projects:l,upstream:o,workspaceRoot:h});return m.ignoredFiles.length>0&&a.push(`ignoring ${m.ignoredFiles.length} changed path(s) outside any project matching affectedIgnore`),{...m,notes:a,uncommittedFileCount:d.length}};export{D as s};

package/dist/packem_shared/{ai-analysis-Cfj24UAy.js → ai-analysis-pldoS_N4.js}

@@ -1,5 +1,5 @@
-import{createRequire as Z}from"node:module";import{E as ie,R as v,X as ce,o as k,q as de}from"../packem_chunks/catalog.js";import{a0 as le,a1 as ue,a2 as pe,a3 as me}from"../packem_chunks/cli-main.js";let ee;const te=e=>(ee??=Z(import.meta.url))(e),y=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,E=e=>{if(typeof y<"u"&&y.versions&&y.versions.node){const[n,t]=y.versions.node.split(".").map(Number);if(n>22||n===22&&t>=3||n===20&&t>=16)return y.getBuiltinModule(e)}return te(e)},{spawn:ne,execFileSync:G,execFile:se}=E("node:child_process"),{existsSync:_,readFileSync:oe}=E("node:fs"),{platform:re,homedir:q}=E("node:os"),{join:h,win32:R}=E("node:path"),{StringDecoder:D}=E("node:string_decoder"),{promisify:ae}=E("node:util"),fe=/v?(\d+\.\d+\.\d+(?:-[\w.]+)?)/,he=5e3,ge=1e4,ve=3e5,be=4096,T=re()==="win32",U=["amp","claude","codex","copilot","crush","cursor","droid","gemini","kimi","opencode","qwen"],ke={alternateCommands:[],buildArgs:(e,{dangerous:n})=>{const t=["-x",e];return n&&t.push("--dangerously-allow-all"),t},command:"amp",defaultModel:"",displayName:"Amp",envVariable:"AMP_PATH",sessionMarkers:[{confidence:"definite",variable:"AMP_CURRENT_THREAD_ID"},{confidence:"definite",equals:"amp",variable:"AGENT"}],supportsMaxTokens:!1,supportsModel:!1},Ae={alternateCommands:[],buildArgs:(e,{dangerous:n,model:t})=>{const s=[];return n&&s.push("--dangerously-skip-permissions"),t&&s.push("--model",t),s.push("--output-format","text","-p",e),s},command:"claude",defaultModel:"",displayName:"Claude Code",envVariable:"CLAUDE_PATH",sessionMarkers:[{confidence:"definite",variable:"CLAUDECODE"},{confidence:"definite",variable:"CLAUDE_CODE"}],supportsMaxTokens:!1,supportsModel:!0},Ee={alternateCommands:["openai-codex"],buildArgs:(e,{dangerous:n,model:t})=>{const s=["exec"];return t&&s.push("--model",t),n&&s.push("--dangerously-bypass-approvals-and-sandbox"),s.push("--",e),s},command:"codex",defaultModel:"",displayName:"Codex",envVariable:"CODEX_PATH",sessionMarkers:[{confidence:"definite",variable:"CODEX_SANDBOX"},{confidence:"definite",variable:"CODEX_THREAD_ID"},{confidence:"definite",variable:"CODEX_CI"}],supportsMaxTokens:!1,supportsModel:!0},Ce={alternateCommands:[],buildArgs:(e,{dangerous:n,model:t})=>{const s=["-p",e];return n&&s.push("--allow-all-tools"),t&&s.push("--model",t),s},command:"copilot",defaultModel:"",displayName:"GitHub Copilot CLI",envVariable:"COPILOT_PATH",sessionMarkers:[{confidence:"definite",variable:"COPILOT_MODEL"},{confidence:"definite",variable:"COPILOT_ALLOW_ALL"},{confidence:"definite",variable:"COPILOT_GITHUB_TOKEN"},{agent:"GitHub Copilot in VS Code",confidence:"definite",label:"TERM_PROGRAM+GIT_PAGER",match:{all:[["TERM_PROGRAM","vscode"],["GIT_PAGER","cat"]],none:["CURSOR_TRACE_ID"]}}],supportsMaxTokens:!1,supportsModel:!0},ye={alternateCommands:[],buildArgs:(e,{dangerous:n,model:t})=>{const s=["run"];return n&&s.push("--yolo"),t&&s.push("-m",t),s.push("--",e),s},command:"crush",defaultModel:"",displayName:"Crush",envVariable:"CRUSH_PATH",sessionMarkers:[{confidence:"definite",equals:"1",variable:"CRUSH"},{confidence:"definite",equals:"crush",variable:"AGENT"}],supportsMaxTokens:!1,supportsModel:!0},we={alternateCommands:["cursor"],buildArgs:(e,{dangerous:n,model:t})=>{const s=["-p"];return n&&s.push("--force"),s.push("--output-format","text"),t&&s.push("--model",t),s.push("--",e),s},command:"agent",defaultModel:"",displayName:"Cursor Agent",envVariable:"CURSOR_PATH",sessionMarkers:[{confidence:"definite",variable:"CURSOR_AGENT"},{confidence:"definite",label:"CURSOR_TRACE_ID+PAGER",match:{all:["CURSOR_TRACE_ID",["PAGER","head -n 10000 | cat"]]}},{agent:"Cursor editor",confidence:"ambient",variable:"CURSOR_TRACE_ID"}],supportsMaxTokens:!1,supportsModel:!0},Se={alternateCommands:[],buildArgs:(e,{dangerous:n,model:t})=>{const s=[];return n&&s.push("--skip-permissions-unsafe"),s.push("-o","text"),t&&s.push("-m",t),s.push("--",e),s},command:"droid",defaultModel:"",displayName:"Droid",envVariable:"DROID_PATH",sessionMarkers:[],supportsMaxTokens:!1,supportsModel:!0},Me={alternateCommands:["gemini-cli"],buildArgs:(e,{dangerous:n,maxTokens:t,model:s})=>{const o=[];return n||o.push("--sandbox"),s&&o.push("--model",s),o.push("--max-output-tokens",String(t),"-p",e),o},command:"gemini",defaultModel:"gemini-2.5-pro",displayName:"Gemini CLI",envVariable:"GEMINI_PATH",sessionMarkers:[{confidence:"definite",label:"GEMINI_CLI",match:{all:["GEMINI_CLI"],none:["QWEN_CODE"]}}],supportsMaxTokens:!0,supportsModel:!0},_e={alternateCommands:[],buildArgs:(e,{model:n})=>{const t=["--quiet","-p",e];return n&&t.push("-m",n),t},command:"kimi",defaultModel:"",displayName:"Kimi CLI",envVariable:"KIMI_PATH",sessionMarkers:[],supportsMaxTokens:!1,supportsModel:!0},Re={alternateCommands:[],buildArgs:(e,{model:n})=>{const t=["run"];return n&&t.push("-m",n),t.push("--",e),t},command:"opencode",defaultModel:"",displayName:"opencode",envVariable:"OPENCODE_PATH",sessionMarkers:[{confidence:"definite",label:"OPENCODE",match:{any:["OPENCODE","OPENCODE_BIN_PATH","OPENCODE_SERVER","OPENCODE_APP_INFO","OPENCODE_MODES","OPENCODE_CLIENT"]}}],supportsMaxTokens:!1,supportsModel:!0},Te={alternateCommands:["qwen-code"],buildArgs:(e,{dangerous:n,model:t})=>{const s=["-p",e];return n&&s.push("--yolo"),s.push("-o","text"),t&&s.push("-m",t),s},command:"qwen",defaultModel:"",displayName:"Qwen Code",envVariable:"QWEN_PATH",sessionMarkers:[{confidence:"definite",equals:"1",variable:"QWEN_CODE"}],supportsMaxTokens:!1,supportsModel:!0},F={amp:ke,claude:Ae,codex:Ee,copilot:Ce,crush:ye,cursor:we,droid:Se,gemini:Me,kimi:_e,opencode:Re,qwen:Te};class A extends Error{exitCode;durationMs;provider;stderr;stdout;timedOut;aborted;constructor(n,t){super(n),this.name="AiRunError",this.provider=t.provider,this.exitCode=t.exitCode??null,this.durationMs=t.durationMs,this.stdout=t.stdout??"",this.stderr=t.stderr??"",this.timedOut=t.timedOut??!1,this.aborted=t.aborted??!1}}const Oe=/"%~?dp0%?\\?([^"]+?\.[cm]?js)"/i,Ie=(e,n)=>{const t=Oe.exec(e)?.[1];if(t!==void 0)return R.resolve(R.dirname(n),t)},Ne=e=>{let n;try{n=oe(e,"utf8")}catch{return}const t=Ie(n,e);if(t!==void 0)return _(t)?t:void 0},Le=e=>{const n=R.join(R.dirname(e),"node.exe");return _(n)?n:"node"};ae(se);const xe=/\.(?:bat|cmd)$/i,j=e=>`"${e.replaceAll('"','""')}"`,B=(e,n=T)=>{if(!n||!xe.test(e))return{file:e,mode:"direct",prefixArguments:[]};const t=Ne(e);return t!==void 0?{file:Le(e),mode:"direct",prefixArguments:[t]}:{commandPath:e,mode:"shell"}},K=(e,n)=>e.mode==="shell"?{file:j(e.commandPath),shell:!0,spawnArguments:n.map(t=>j(t))}:{file:e.file,shell:!1,spawnArguments:[...e.prefixArguments,...n]},V=e=>e==="~"||e.startsWith("~/")||T&&e.startsWith("~\\")?h(q(),e.slice(2)):e,Pe=e=>{try{const n=G(T?"where":"which",[e],{encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:he}).trim().split(`
-`)[0]?.trim();return n&&n.length>0?n:void 0}catch{return}},$e=e=>{const n=q();if(T){const t=process.env.APPDATA??"",s=process.env.LOCALAPPDATA??"",o=process.env.ProgramFiles??"";return[h(t,"npm",`${e}.cmd`),h(t,"npm",e),h(s,"Programs",e,`${e}.exe`),h(o,e,`${e}.exe`),h(n,".npm-global","bin",`${e}.cmd`)]}return[`/opt/homebrew/bin/${e}`,`/usr/local/bin/${e}`,h(n,".npm-global","bin",e),h(n,".local","bin",e),h(n,".cargo","bin",e)]},De=e=>{try{const{file:n,shell:t,spawnArguments:s}=K(B(e),["--version"]),o=G(n,s,{encoding:"utf8",shell:t,stdio:["pipe","pipe","pipe"],timeout:ge}),r=fe.exec(o);return r?r[1]:void 0}catch{return}},X=(e,n={})=>{const t=F[e],s={available:!1,name:e},o=n.version!==!1,r=i=>{if(o)return De(i)},a=process.env[t.envVariable];if(a&&_(V(a))){const i=V(a);return{...s,available:!0,detectionMethod:"envvar",path:i,version:r(i)}}const l=[t.command,...t.alternateCommands];for(const i of l){const c=Pe(i);if(c)return{...s,available:!0,detectionMethod:"which",path:c,version:r(c)}}for(const i of l)for(const c of $e(i))if(_(c))return{...s,available:!0,detectionMethod:"known-path",path:c,version:r(c)};return s},je=(e={})=>U.map(n=>X(n,e)),Ve=(e={})=>je(e).filter(n=>n.available),He=(e,n,t={})=>{const s=F[e],o=t.model??s.defaultModel,r=t.maxTokens!==void 0&&Number.isFinite(t.maxTokens)?t.maxTokens:be;return s.buildArgs(n,{dangerous:t.dangerous===!0,maxTokens:r,model:o})},Ge=async(e,n,t={})=>{if(!e.available||!e.path)throw new A(`AI provider "${e.name}" is not available.`,{durationMs:0,provider:e.name});const s=He(e.name,n,t),o=t.timeoutMs!==void 0&&Number.isFinite(t.timeoutMs)?t.timeoutMs:ve,r=e.path,a=K(B(r),s),l=Date.now();if(t.signal?.aborted)throw new A(`${e.name} CLI run was aborted.`,{aborted:!0,durationMs:0,provider:e.name});return new Promise((i,c)=>{const f={cwd:t.cwd,env:{...process.env,...t.env,FORCE_COLOR:"0",NO_COLOR:"1"},shell:a.shell,stdio:["pipe","pipe","pipe"]},d=ne(a.file,a.spawnArguments,f);d.stdin?.end();let m="",g="",b=!1;const N=new D("utf8"),L=new D("utf8");let w,x,S;const O=()=>{clearTimeout(x),S&&t.signal?.removeEventListener("abort",S)},Q=()=>{d.kill("SIGKILL")},P=p=>{if(b)return;b=!0,d.kill("SIGTERM"),w=setTimeout(Q,5e3),w.unref(),O();const u=Date.now()-l,C=p?new A(`${e.name} CLI run was aborted.`,{aborted:!0,durationMs:u,provider:e.name,stderr:g,stdout:m}):new A(`${e.name} CLI timed out after ${String(o)}ms`,{durationMs:u,provider:e.name,stderr:g,stdout:m,timedOut:!0});c(C)};x=setTimeout(P,o,!1),S=()=>{P(!0)},t.signal?.addEventListener("abort",S,{once:!0}),d.stdout?.on("data",p=>{const u=N.write(p);u&&(m+=u,t.onStdout?.(u))}),d.stderr?.on("data",p=>{const u=L.write(p);u&&(g+=u,t.onStderr?.(u))}),d.on("close",p=>{clearTimeout(w);const u=N.end();u&&(m+=u,t.onStdout?.(u));const C=L.end();if(C&&(g+=C,t.onStderr?.(C)),b)return;b=!0,O();const $=Date.now()-l;p===0?i({durationMs:$,exitCode:p,provider:e.name,stderr:g,stdout:m}):c(new A(`${e.name} CLI exited with code ${String(p)}: ${g||m}`,{durationMs:$,exitCode:p,provider:e.name,stderr:g,stdout:m}))}),d.on("error",p=>{clearTimeout(w),!b&&(b=!0,O(),c(new A(`Failed to spawn ${e.name} CLI: ${p.message}`,{durationMs:Date.now()-l,provider:e.name,stderr:g,stdout:m})))})})},qe=12e4,Ue=2,Fe=1e3,Be=e=>new Promise(n=>{setTimeout(n,e)}),J=async(e,n,t=Ue)=>{let s;for(let o=0;o<=t;o+=1)try{return(await Ge(e,n,{timeoutMs:qe})).stdout}catch(r){if(s=r instanceof Error?r:new Error(String(r)),s.message.includes("timed out"))throw s;if(o<t){const a=Fe*2**o;await Be(a)}}throw s??new Error("AI request failed after retries")},Ke={amp:30,claude:80,codex:60,copilot:50,crush:35,cursor:40,droid:20,gemini:100,kimi:25,opencode:35,qwen:30},Xe=e=>{if(e?.provider){if(!U.includes(e.provider))return;const s=X(e.provider);return s.available?s:void 0}const n=Ve();if(n.length===0)return;const t={...Ke,...e?.priority};return n.toSorted((s,o)=>(t[o.name]??0)-(t[s.name]??0))[0]},Je=new Set(["defer","review","skip","update"]),We=new Set(["critical","high","low","medium"]),Ye=new Set(["high","low","medium"]),ze=50,I=30,Qe=e=>e.map(n=>{const t=n.vulnerabilities&&n.vulnerabilities.length>0?` [VULNERABILITIES: ${n.vulnerabilities.map(o=>`${o.severity} ${o.id}`).join(", ")}]`:"";let s="";if(n.socketReport){const o=Math.round(n.socketReport.score.overall*100),r=[`score:${String(o)}%`];if(n.socketReport.alerts.length>0){const a={};for(const i of n.socketReport.alerts)a[i.severity]=(a[i.severity]??0)+1;const l=Object.entries(a).map(([i,c])=>`${String(c)} ${i}`).join(", ");r.push(`alerts: ${l}`)}r.push(`supply-chain:${String(Math.round(n.socketReport.score.supplyChain*100))}%`),r.push(`quality:${String(Math.round(n.socketReport.score.quality*100))}%`),s=` [SOCKET.DEV: ${r.join(", ")}]`}return`- ${n.packageName}: ${n.currentRange} → ${n.newRange} (${n.updateType})${t}${s}`}).join(`
+import{createRequire as Z}from"node:module";import{O as ie,R as v,X as ce,o as k,q as de}from"../packem_chunks/catalog.js";import{a0 as le,a1 as ue,a2 as pe,a3 as me}from"../packem_chunks/cli-main.js";let ee;const te=e=>(ee??=Z(import.meta.url))(e),y=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,E=e=>{if(typeof y<"u"&&y.versions&&y.versions.node){const[n,t]=y.versions.node.split(".").map(Number);if(n>22||n===22&&t>=3||n===20&&t>=16)return y.getBuiltinModule(e)}return te(e)},{spawn:ne,execFileSync:G,execFile:se}=E("node:child_process"),{existsSync:_,readFileSync:oe}=E("node:fs"),{platform:re,homedir:q}=E("node:os"),{join:h,win32:R}=E("node:path"),{StringDecoder:$}=E("node:string_decoder"),{promisify:ae}=E("node:util"),fe=/v?(\d+\.\d+\.\d+(?:-[\w.]+)?)/,he=5e3,ge=1e4,ve=3e5,be=4096,O=re()==="win32",U=["amp","claude","codex","copilot","crush","cursor","droid","gemini","kimi","opencode","qwen"],ke={alternateCommands:[],buildArgs:(e,{dangerous:n})=>{const t=["-x",e];return n&&t.push("--dangerously-allow-all"),t},command:"amp",defaultModel:"",displayName:"Amp",envVariable:"AMP_PATH",sessionMarkers:[{confidence:"definite",variable:"AMP_CURRENT_THREAD_ID"},{confidence:"definite",equals:"amp",variable:"AGENT"}],supportsMaxTokens:!1,supportsModel:!1},Ae={alternateCommands:[],buildArgs:(e,{dangerous:n,model:t})=>{const s=[];return n&&s.push("--dangerously-skip-permissions"),t&&s.push("--model",t),s.push("--output-format","text","-p",e),s},command:"claude",defaultModel:"",displayName:"Claude Code",envVariable:"CLAUDE_PATH",sessionMarkers:[{confidence:"definite",variable:"CLAUDECODE"},{confidence:"definite",variable:"CLAUDE_CODE"}],supportsMaxTokens:!1,supportsModel:!0},Ee={alternateCommands:["openai-codex"],buildArgs:(e,{dangerous:n,model:t})=>{const s=["exec"];return t&&s.push("--model",t),n&&s.push("--dangerously-bypass-approvals-and-sandbox"),s.push("--",e),s},command:"codex",defaultModel:"",displayName:"Codex",envVariable:"CODEX_PATH",sessionMarkers:[{confidence:"definite",variable:"CODEX_SANDBOX"},{confidence:"definite",variable:"CODEX_THREAD_ID"},{confidence:"definite",variable:"CODEX_CI"}],supportsMaxTokens:!1,supportsModel:!0},Ce={alternateCommands:[],buildArgs:(e,{dangerous:n,model:t})=>{const s=["-p",e];return n&&s.push("--allow-all-tools"),t&&s.push("--model",t),s},command:"copilot",defaultModel:"",displayName:"GitHub Copilot CLI",envVariable:"COPILOT_PATH",sessionMarkers:[{confidence:"definite",variable:"COPILOT_MODEL"},{confidence:"definite",variable:"COPILOT_ALLOW_ALL"},{confidence:"definite",variable:"COPILOT_GITHUB_TOKEN"},{agent:"GitHub Copilot in VS Code",confidence:"definite",label:"TERM_PROGRAM+GIT_PAGER",match:{all:[["TERM_PROGRAM","vscode"],["GIT_PAGER","cat"]],none:["CURSOR_TRACE_ID"]}}],supportsMaxTokens:!1,supportsModel:!0},ye={alternateCommands:[],buildArgs:(e,{dangerous:n,model:t})=>{const s=["run"];return n&&s.push("--yolo"),t&&s.push("-m",t),s.push("--",e),s},command:"crush",defaultModel:"",displayName:"Crush",envVariable:"CRUSH_PATH",sessionMarkers:[{confidence:"definite",equals:"1",variable:"CRUSH"},{confidence:"definite",equals:"crush",variable:"AGENT"}],supportsMaxTokens:!1,supportsModel:!0},we={alternateCommands:["cursor"],buildArgs:(e,{dangerous:n,model:t})=>{const s=["-p"];return n&&s.push("--force"),s.push("--output-format","text"),t&&s.push("--model",t),s.push("--",e),s},command:"agent",defaultModel:"",displayName:"Cursor Agent",envVariable:"CURSOR_PATH",sessionMarkers:[{confidence:"definite",variable:"CURSOR_AGENT"},{confidence:"definite",label:"CURSOR_TRACE_ID+PAGER",match:{all:["CURSOR_TRACE_ID",["PAGER","head -n 10000 | cat"]]}},{agent:"Cursor editor",confidence:"ambient",variable:"CURSOR_TRACE_ID"}],supportsMaxTokens:!1,supportsModel:!0},Se={alternateCommands:[],buildArgs:(e,{dangerous:n,model:t})=>{const s=[];return n&&s.push("--skip-permissions-unsafe"),s.push("-o","text"),t&&s.push("-m",t),s.push("--",e),s},command:"droid",defaultModel:"",displayName:"Droid",envVariable:"DROID_PATH",sessionMarkers:[],supportsMaxTokens:!1,supportsModel:!0},Me={alternateCommands:["gemini-cli"],buildArgs:(e,{dangerous:n,maxTokens:t,model:s})=>{const o=[];return n||o.push("--sandbox"),s&&o.push("--model",s),o.push("--max-output-tokens",String(t),"-p",e),o},command:"gemini",defaultModel:"gemini-2.5-pro",displayName:"Gemini CLI",envVariable:"GEMINI_PATH",sessionMarkers:[{confidence:"definite",label:"GEMINI_CLI",match:{all:["GEMINI_CLI"],none:["QWEN_CODE"]}}],supportsMaxTokens:!0,supportsModel:!0},_e={alternateCommands:[],buildArgs:(e,{model:n})=>{const t=["--quiet","-p",e];return n&&t.push("-m",n),t},command:"kimi",defaultModel:"",displayName:"Kimi CLI",envVariable:"KIMI_PATH",sessionMarkers:[],supportsMaxTokens:!1,supportsModel:!0},Re={alternateCommands:[],buildArgs:(e,{model:n})=>{const t=["run"];return n&&t.push("-m",n),t.push("--",e),t},command:"opencode",defaultModel:"",displayName:"opencode",envVariable:"OPENCODE_PATH",sessionMarkers:[{confidence:"definite",label:"OPENCODE",match:{any:["OPENCODE","OPENCODE_BIN_PATH","OPENCODE_SERVER","OPENCODE_APP_INFO","OPENCODE_MODES","OPENCODE_CLIENT"]}}],supportsMaxTokens:!1,supportsModel:!0},Oe={alternateCommands:["qwen-code"],buildArgs:(e,{dangerous:n,model:t})=>{const s=["-p",e];return n&&s.push("--yolo"),s.push("-o","text"),t&&s.push("-m",t),s},command:"qwen",defaultModel:"",displayName:"Qwen Code",envVariable:"QWEN_PATH",sessionMarkers:[{confidence:"definite",equals:"1",variable:"QWEN_CODE"}],supportsMaxTokens:!1,supportsModel:!0},F={amp:ke,claude:Ae,codex:Ee,copilot:Ce,crush:ye,cursor:we,droid:Se,gemini:Me,kimi:_e,opencode:Re,qwen:Oe};class A extends Error{exitCode;durationMs;provider;stderr;stdout;timedOut;aborted;constructor(n,t){super(n),this.name="AiRunError",this.provider=t.provider,this.exitCode=t.exitCode??null,this.durationMs=t.durationMs,this.stdout=t.stdout??"",this.stderr=t.stderr??"",this.timedOut=t.timedOut??!1,this.aborted=t.aborted??!1}}const Te=/"%~?dp0%?\\?([^"]+?\.[cm]?js)"/i,Ie=(e,n)=>{const t=Te.exec(e)?.[1];if(t!==void 0)return R.resolve(R.dirname(n),t)},Ne=e=>{let n;try{n=oe(e,"utf8")}catch{return}const t=Ie(n,e);if(t!==void 0)return _(t)?t:void 0},Le=e=>{const n=R.join(R.dirname(e),"node.exe");return _(n)?n:"node"};ae(se);const xe=/\.(?:bat|cmd)$/i,j=e=>`"${e.replaceAll('"','""')}"`,B=(e,n=O)=>{if(!n||!xe.test(e))return{file:e,mode:"direct",prefixArguments:[]};const t=Ne(e);return t!==void 0?{file:Le(e),mode:"direct",prefixArguments:[t]}:{commandPath:e,mode:"shell"}},K=(e,n)=>e.mode==="shell"?{file:j(e.commandPath),shell:!0,spawnArguments:n.map(t=>j(t))}:{file:e.file,shell:!1,spawnArguments:[...e.prefixArguments,...n]},V=e=>e==="~"||e.startsWith("~/")||O&&e.startsWith("~\\")?h(q(),e.slice(2)):e,Pe=e=>{try{const n=G(O?"where":"which",[e],{encoding:"utf8",stdio:["pipe","pipe","pipe"],timeout:he}).trim().split(`
+`)[0]?.trim();return n&&n.length>0?n:void 0}catch{return}},De=e=>{const n=q();if(O){const t=process.env.APPDATA??"",s=process.env.LOCALAPPDATA??"",o=process.env.ProgramFiles??"";return[h(t,"npm",`${e}.cmd`),h(t,"npm",e),h(s,"Programs",e,`${e}.exe`),h(o,e,`${e}.exe`),h(n,".npm-global","bin",`${e}.cmd`)]}return[`/opt/homebrew/bin/${e}`,`/usr/local/bin/${e}`,h(n,".npm-global","bin",e),h(n,".local","bin",e),h(n,".cargo","bin",e)]},$e=e=>{try{const{file:n,shell:t,spawnArguments:s}=K(B(e),["--version"]),o=G(n,s,{encoding:"utf8",shell:t,stdio:["pipe","pipe","pipe"],timeout:ge}),r=fe.exec(o);return r?r[1]:void 0}catch{return}},X=(e,n={})=>{const t=F[e],s={available:!1,name:e},o=n.version!==!1,r=i=>{if(o)return $e(i)},a=process.env[t.envVariable];if(a&&_(V(a))){const i=V(a);return{...s,available:!0,detectionMethod:"envvar",path:i,version:r(i)}}const l=[t.command,...t.alternateCommands];for(const i of l){const c=Pe(i);if(c)return{...s,available:!0,detectionMethod:"which",path:c,version:r(c)}}for(const i of l)for(const c of De(i))if(_(c))return{...s,available:!0,detectionMethod:"known-path",path:c,version:r(c)};return s},je=(e={})=>U.map(n=>X(n,e)),Ve=(e={})=>je(e).filter(n=>n.available),He=(e,n,t={})=>{const s=F[e],o=t.model??s.defaultModel,r=t.maxTokens!==void 0&&Number.isFinite(t.maxTokens)?t.maxTokens:be;return s.buildArgs(n,{dangerous:t.dangerous===!0,maxTokens:r,model:o})},Ge=async(e,n,t={})=>{if(!e.available||!e.path)throw new A(`AI provider "${e.name}" is not available.`,{durationMs:0,provider:e.name});const s=He(e.name,n,t),o=t.timeoutMs!==void 0&&Number.isFinite(t.timeoutMs)?t.timeoutMs:ve,r=e.path,a=K(B(r),s),l=Date.now();if(t.signal?.aborted)throw new A(`${e.name} CLI run was aborted.`,{aborted:!0,durationMs:0,provider:e.name});return new Promise((i,c)=>{const f={cwd:t.cwd,env:{...process.env,...t.env,FORCE_COLOR:"0",NO_COLOR:"1"},shell:a.shell,stdio:["pipe","pipe","pipe"]},d=ne(a.file,a.spawnArguments,f);d.stdin?.end();let m="",g="",b=!1;const N=new $("utf8"),L=new $("utf8");let w,x,S;const T=()=>{clearTimeout(x),S&&t.signal?.removeEventListener("abort",S)},Q=()=>{d.kill("SIGKILL")},P=p=>{if(b)return;b=!0,d.kill("SIGTERM"),w=setTimeout(Q,5e3),w.unref(),T();const u=Date.now()-l,C=p?new A(`${e.name} CLI run was aborted.`,{aborted:!0,durationMs:u,provider:e.name,stderr:g,stdout:m}):new A(`${e.name} CLI timed out after ${String(o)}ms`,{durationMs:u,provider:e.name,stderr:g,stdout:m,timedOut:!0});c(C)};x=setTimeout(P,o,!1),S=()=>{P(!0)},t.signal?.addEventListener("abort",S,{once:!0}),d.stdout?.on("data",p=>{const u=N.write(p);u&&(m+=u,t.onStdout?.(u))}),d.stderr?.on("data",p=>{const u=L.write(p);u&&(g+=u,t.onStderr?.(u))}),d.on("close",p=>{clearTimeout(w);const u=N.end();u&&(m+=u,t.onStdout?.(u));const C=L.end();if(C&&(g+=C,t.onStderr?.(C)),b)return;b=!0,T();const D=Date.now()-l;p===0?i({durationMs:D,exitCode:p,provider:e.name,stderr:g,stdout:m}):c(new A(`${e.name} CLI exited with code ${String(p)}: ${g||m}`,{durationMs:D,exitCode:p,provider:e.name,stderr:g,stdout:m}))}),d.on("error",p=>{clearTimeout(w),!b&&(b=!0,T(),c(new A(`Failed to spawn ${e.name} CLI: ${p.message}`,{durationMs:Date.now()-l,provider:e.name,stderr:g,stdout:m})))})})},qe=12e4,Ue=2,Fe=1e3,Be=e=>new Promise(n=>{setTimeout(n,e)}),J=async(e,n,t=Ue)=>{let s;for(let o=0;o<=t;o+=1)try{return(await Ge(e,n,{timeoutMs:qe})).stdout}catch(r){if(s=r instanceof Error?r:new Error(String(r)),s.message.includes("timed out"))throw s;if(o<t){const a=Fe*2**o;await Be(a)}}throw s??new Error("AI request failed after retries")},Ke={amp:30,claude:80,codex:60,copilot:50,crush:35,cursor:40,droid:20,gemini:100,kimi:25,opencode:35,qwen:30},Xe=e=>{if(e?.provider){if(!U.includes(e.provider))return;const s=X(e.provider);return s.available?s:void 0}const n=Ve();if(n.length===0)return;const t={...Ke,...e?.priority};return n.toSorted((s,o)=>(t[o.name]??0)-(t[s.name]??0))[0]},Je=new Set(["defer","review","skip","update"]),We=new Set(["critical","high","low","medium"]),Ye=new Set(["high","low","medium"]),ze=50,I=30,Qe=e=>e.map(n=>{const t=n.vulnerabilities&&n.vulnerabilities.length>0?` [VULNERABILITIES: ${n.vulnerabilities.map(o=>`${o.severity} ${o.id}`).join(", ")}]`:"";let s="";if(n.socketReport){const o=Math.round(n.socketReport.score.overall*100),r=[`score:${String(o)}%`];if(n.socketReport.alerts.length>0){const a={};for(const i of n.socketReport.alerts)a[i.severity]=(a[i.severity]??0)+1;const l=Object.entries(a).map(([i,c])=>`${String(c)} ${i}`).join(", ");r.push(`alerts: ${l}`)}r.push(`supply-chain:${String(Math.round(n.socketReport.score.supplyChain*100))}%`),r.push(`quality:${String(Math.round(n.socketReport.score.quality*100))}%`),s=` [SOCKET.DEV: ${r.join(", ")}]`}return`- ${n.packageName}: ${n.currentRange} → ${n.newRange} (${n.updateType})${t}${s}`}).join(`
 `),M=`Respond ONLY with valid JSON in this exact structure:
 {
   "summary": "Brief overall summary",

package/dist/packem_shared/{ai-fix-DeRUtT-s.js → ai-fix-BC6aIRJT.js}

@@ -1,5 +1,5 @@
-import{createRequire as T}from"node:module";import{readLastRunSummary as _}from"@visulima/task-runner";import{a as $}from"./failure-log-D2x5BT8S.js";import{n as v,o as P,q as D,f as j,s as E,t as N,u as A}from"../packem_chunks/cli-main.js";import{c as R}from"./formatBytes-BHAzNIrn-CrusHOew.js";import{v as x,U as y,e as B,a as H}from"./index-BzhrR_iC.js";import{a as q,b as C,e as U}from"./ai-analysis-Cfj24UAy.js";let I;const F=e=>(I??=T(import.meta.url))(e),h=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,O=e=>{if(typeof h<"u"&&h.versions&&h.versions.node){const[t,n]=h.versions.node.split(".").map(Number);if(t>22||t===22&&n>=3||t===20&&n>=16)return h.getBuiltinModule(e)}return F(e)},{readFile:L,writeFile:M}=O("node:fs/promises"),k=32*1024,W=(e,t)=>{if(e.length<=t)return e;const n=e.slice(-t),o=e.length-n.length;return`[…${String(o)} bytes truncated from head…]
-${n}`},J=async(e,t)=>t===void 0?_(e,{dataDirectory:R(e)}):j(e,t),pe=async(e,t,n={})=>{const o=n.terminalOutputLimit??k,[r,i]=await Promise.all([$(e,t),J(e,n.runId)]),s=i?v(i,t):void 0;if(!r&&!s)return;let a,c;if(i&&s){const u=await P(e,i.id),f=u?v(u,t):void 0;a=D(s.hashDetails,f?.hashDetails),c=u?.id}const d=r?.terminalOutput??"";return{command:r?.command??void 0,cwd:r?.cwd??void 0,dependencies:s?.dependencies??[],duration:s?.duration,exitCode:r?.exitCode??s?.exitCode,hash:s?.hash??r?.hash,hashDetails:s?.hashDetails,hashDiff:a,previousRunId:c,project:s?.target.project,runId:i?.id??r?.runId,status:r?.status??(s?K(s):void 0),target:s?.target.target,taskId:t,terminalOutput:W(d,o),terminalOutputCaptured:!!r,timestamp:r?.timestamp??s?.endTime??s?.startTime}},K=e=>{if(e.exitCode!==void 0&&e.exitCode!==0)return"failure";switch(e.cacheStatus){case"HIT":return"local-cache";case"REMOTE_HIT":return"remote-cache";case"SKIPPED":return"skipped";default:return e.exitCode===0?"success":void 0}},Y=3600*1e3,w=80,V=new Set(["high","low","medium"]),X=()=>`You are an expert software engineer helping fix a failing build/test/lint task.
+import{createRequire as T}from"node:module";import{readLastRunSummary as _}from"@visulima/task-runner";import{a as $}from"./failure-log-D2x5BT8S.js";import{m as v,n as P,o as D,d as j,s as E,t as N,u as A}from"../packem_chunks/cli-main.js";import{c as R}from"./formatBytes-BHAzNIrn-CrusHOew.js";import{v as x,U as y,e as B,a as H}from"./index-BzhrR_iC.js";import{a as C,b as U,e as k}from"./ai-analysis-pldoS_N4.js";let I;const F=e=>(I??=T(import.meta.url))(e),h=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,O=e=>{if(typeof h<"u"&&h.versions&&h.versions.node){const[t,n]=h.versions.node.split(".").map(Number);if(t>22||t===22&&n>=3||t===20&&n>=16)return h.getBuiltinModule(e)}return F(e)},{readFile:L,writeFile:M}=O("node:fs/promises"),q=32*1024,W=(e,t)=>{if(e.length<=t)return e;const n=e.slice(-t),o=e.length-n.length;return`[…${String(o)} bytes truncated from head…]
+${n}`},J=async(e,t)=>t===void 0?_(e,{dataDirectory:R(e)}):j(e,t),pe=async(e,t,n={})=>{const o=n.terminalOutputLimit??q,[r,i]=await Promise.all([$(e,t),J(e,n.runId)]),s=i?v(i,t):void 0;if(!r&&!s)return;let a,c;if(i&&s){const u=await P(e,i.id),f=u?v(u,t):void 0;a=D(s.hashDetails,f?.hashDetails),c=u?.id}const d=r?.terminalOutput??"";return{command:r?.command??void 0,cwd:r?.cwd??void 0,dependencies:s?.dependencies??[],duration:s?.duration,exitCode:r?.exitCode??s?.exitCode,hash:s?.hash??r?.hash,hashDetails:s?.hashDetails,hashDiff:a,previousRunId:c,project:s?.target.project,runId:i?.id??r?.runId,status:r?.status??(s?K(s):void 0),target:s?.target.target,taskId:t,terminalOutput:W(d,o),terminalOutputCaptured:!!r,timestamp:r?.timestamp??s?.endTime??s?.startTime}},K=e=>{if(e.exitCode!==void 0&&e.exitCode!==0)return"failure";switch(e.cacheStatus){case"HIT":return"local-cache";case"REMOTE_HIT":return"remote-cache";case"SKIPPED":return"skipped";default:return e.exitCode===0?"success":void 0}},Y=3600*1e3,w=80,V=new Set(["high","low","medium"]),X=()=>`You are an expert software engineer helping fix a failing build/test/lint task.
 
 You will be given:
 - The terminal output (stdout/stderr) from the failed task.
@@ -36,8 +36,8 @@ ${n.join(`
 `)},G=e=>{const t=[`Task: ${e.taskId}`];return e.project&&t.push(`Project: ${e.project}`),e.target&&t.push(`Target: ${e.target}`),e.command&&t.push(`Command: ${e.command}`),e.cwd&&t.push(`CWD: ${e.cwd}`),e.exitCode!==void 0&&t.push(`Exit code: ${String(e.exitCode)}`),e.hash&&t.push(`Task hash: ${e.hash}`),t.push("","Hash-diff since previous run:",z(e),""),e.terminalOutputCaptured?t.push("Terminal output:","```",e.terminalOutput,"```"):t.push("Terminal output: <no failure log was captured for this task>",'Set "cannotFix" and tell the user to re-run with `vis run` so logs can be captured.'),t.join(`
 `)},Q=e=>`${X()}
 
-${G(e)}`,Z=(e,t)=>{const n=Array.isArray(e.patches)?e.patches:[],o=[];for(const i of n)typeof i.file!="string"||i.file.length===0||typeof i.oldString!="string"||i.oldString.length===0||typeof i.newString=="string"&&o.push({file:i.file,newString:i.newString,oldString:i.oldString,reason:typeof i.reason=="string"&&i.reason.length>0?i.reason:void 0});const r=typeof e.cannotFix=="string"&&e.cannotFix.length>0?e.cannotFix:void 0;return{cannotFix:r,confidence:V.has(e.confidence)?e.confidence:"low",explanation:typeof e.explanation=="string"?e.explanation:"",patches:r?[]:o,provider:t}},ee=(e,t)=>{const n=U(e);return!n||typeof n!="object"?{cannotFix:"AI response was not valid JSON.",confidence:"low",explanation:"Failed to parse AI response.",patches:[],provider:t}:Z(n,t)},te=(e,t)=>A({cwd:t.cwd??null,flow:"ai-fix",hash:t.hash??null,provider:e,taskId:t.taskId,terminalOutput:t.terminalOutput,terminalOutputCaptured:t.terminalOutputCaptured}),le=async(e,t,n={})=>{const o=q(n.config);if(!o){t.warn(`No AI provider available — install one of: claude, gemini, copilot, codex.
+${G(e)}`,Z=(e,t)=>{const n=Array.isArray(e.patches)?e.patches:[],o=[];for(const i of n)typeof i.file!="string"||i.file.length===0||typeof i.oldString!="string"||i.oldString.length===0||typeof i.newString=="string"&&o.push({file:i.file,newString:i.newString,oldString:i.oldString,reason:typeof i.reason=="string"&&i.reason.length>0?i.reason:void 0});const r=typeof e.cannotFix=="string"&&e.cannotFix.length>0?e.cannotFix:void 0;return{cannotFix:r,confidence:V.has(e.confidence)?e.confidence:"low",explanation:typeof e.explanation=="string"?e.explanation:"",patches:r?[]:o,provider:t}},ee=(e,t)=>{const n=k(e);return!n||typeof n!="object"?{cannotFix:"AI response was not valid JSON.",confidence:"low",explanation:"Failed to parse AI response.",patches:[],provider:t}:Z(n,t)},te=(e,t)=>A({cwd:t.cwd??null,flow:"ai-fix",hash:t.hash??null,provider:e,taskId:t.taskId,terminalOutput:t.terminalOutput,terminalOutputCaptured:t.terminalOutputCaptured}),le=async(e,t,n={})=>{const o=C(n.config);if(!o){t.warn(`No AI provider available — install one of: claude, gemini, copilot, codex.
 `);return}const r=n.cache!==!1,i=te(o.name,e);if(r){const s=E(i);if(s)return t.info(`Using cached fix proposal from ${s.provider}.
 `),s}t.info(`Generating fix proposal with ${o.name}...
-`);try{const s=await C(o,Q(e)),a=ee(s,o.name);return r&&a.patches.length>0&&!a.cannotFix&&N(i,a,Y),a}catch(s){const a=s instanceof Error?s.message:String(s);t.warn(`AI fix proposal failed (${a}).
+`);try{const s=await U(o,Q(e)),a=ee(s,o.name);return r&&a.patches.length>0&&!a.cannotFix&&N(i,a,Y),a}catch(s){const a=s instanceof Error?s.message:String(s);t.warn(`AI fix proposal failed (${a}).
 `);return}},ne=(e,t,n)=>x(n)?y(n):y(B(t??e,n)),se=(e,t)=>{const n=H(e,t);return n===""?!0:!n.startsWith("..")&&!x(n)},ie=(e,t,n)=>{const o=e.indexOf(t),r=Math.max(0,o-w),i=Math.min(e.length,o+t.length+w),s=e.slice(r,i);return{previewAfter:`${e.slice(r,o)}${n}${e.slice(o+t.length,i)}`,previewBefore:s}},fe=async(e,t,n,o={})=>{const r=o.dryRun===!0,i=new Map,s=[];for(const a of n.patches){const c=ne(e,t,a.file);if(!se(e,c)){s.push({absolutePath:c,patch:a,status:"outside-workspace"});continue}let d=i.get(c);if(d===void 0){try{d=await L(c,"utf8")}catch(p){const g=p.code;s.push({absolutePath:c,error:g==="ENOENT"?void 0:p.message,patch:a,status:g==="ENOENT"?"missing-file":"error"});continue}i.set(c,d)}const u=d.indexOf(a.oldString);if(u===-1){s.push({absolutePath:c,patch:a,status:"no-match"});continue}if(d.indexOf(a.oldString,u+a.oldString.length)!==-1){s.push({absolutePath:c,patch:a,status:"ambiguous-match"});continue}const{previewAfter:S,previewBefore:b}=ie(d,a.oldString,a.newString),m=`${d.slice(0,u)}${a.newString}${d.slice(u+a.oldString.length)}`;if(!r)try{await M(c,m,"utf8")}catch(p){i.delete(c),s.push({absolutePath:c,error:p.message,patch:a,status:"error"});continue}i.set(c,m),s.push({absolutePath:c,patch:a,previewAfter:S,previewBefore:b,status:"applied"})}return s};export{pe as a,fe as b,ne as c,le as r};

package/dist/packem_shared/{bin-D9TsVhq2.js → bin-C1XKj-O-.js}

@@ -1 +1 @@
-import{createRequire as v}from"node:module";import{t as T}from"./compile-cache-DoMHRsRZ.js";import{l as w,i as R,a as j,b as M,c as m,g as S}from"./package-version-DUcG-b7S.js";import{i as $}from"./index-BjdW45xX.js";let _;const x=s=>(_??=v(import.meta.url))(s),t=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,b=s=>{if(typeof t<"u"&&t.versions&&t.versions.node){const[e,o]=t.versions.node.split(".").map(Number);if(e>22||e===22&&o>=3||e===20&&o>=16)return t.getBuiltinModule(s)}return x(s)},{createRequire:y}=b("node:module");let N;const O=s=>(N??=y(import.meta.url))(s),r=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,f=s=>{if(typeof r<"u"&&r.versions&&r.versions.node){const[e,o]=r.versions.node.split(".").map(Number);if(e>22||e===22&&o>=3||e===20&&o>=16)return r.getBuiltinModule(s)}return O(s)},{execFileSync:C}=f("node:child_process"),{totalmem:I}=f("node:os"),q=/--max-old-space-size=(\d+)/,z=/--max-semi-space-size=(\d+)/,E=s=>Math.floor(I()/1024/1024*s),P=s=>s<=512?4:s<=1024?8:s<=2048?16:s<=4096?32:s<=8192?64:Math.floor(Math.log2(s))*8,d=(s,e)=>{for(const o of e){const n=s.exec(o);if(n)return Number.parseInt(n[1],10)}},B=s=>{const o=[...w()],n=[...R()],a=d(q,o),p=d(z,o);if(a!==void 0&&p!==void 0)return;const l=a??E(.75),g=p??P(l),c=[];if(a===void 0&&c.push(`--max-old-space-size=${String(l)}`),p===void 0&&c.push(`--max-semi-space-size=${String(g)}`),c.length!==0)try{C(j(),[...c,...o,...n.slice(1)],{env:M(),stdio:"inherit"}),m(0)}catch(h){const u=h.status;m(typeof u=="number"?u:1)}},V=()=>{process.env.VIS_VERSION=S()},H=s=>{!process.stdout.isTTY||$||process.env.TERM==="dumb"||process.stdout.write(`\x1B]0;${s}\x07`)},L=new Set(["","--help","--version","-h","-v","completion","dlx","exec","x"]),i=process.argv[2]??"";!L.has(i)&&!process.argv.includes("--help")&&!process.argv.includes("-h")&&B();process.argv.includes("--no-color")&&(process.env.NO_COLOR="1",process.env.FORCE_COLOR="0");V();T();(async()=>{if(i==="__pm-shim"){const{dispatchShim:e}=await import("../packem_chunks/dispatch.js");e(process.argv[3]??"",process.argv.slice(4));return}if(i==="x"){const{runLeanX:e}=await import("../packem_chunks/lean.js");await e(process.argv.slice(3));return}if(i==="exec"||i==="dlx"){const{runExecCli:e}=await import("../packem_chunks/cli-exec.js");await e();return}const{runCli:s}=await import("../packem_chunks/cli-main.js").then(e=>e.ax);await s()})();export{H as s};
+import{createRequire as v}from"node:module";import{t as T}from"./compile-cache-DoMHRsRZ.js";import{l as w,i as R,a as j,b as M,c as m,g as S}from"./package-version-Dxirp-UO.js";import{i as $}from"./index-BjdW45xX.js";let _;const x=s=>(_??=v(import.meta.url))(s),t=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,b=s=>{if(typeof t<"u"&&t.versions&&t.versions.node){const[e,o]=t.versions.node.split(".").map(Number);if(e>22||e===22&&o>=3||e===20&&o>=16)return t.getBuiltinModule(s)}return x(s)},{createRequire:y}=b("node:module");let N;const O=s=>(N??=y(import.meta.url))(s),r=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,f=s=>{if(typeof r<"u"&&r.versions&&r.versions.node){const[e,o]=r.versions.node.split(".").map(Number);if(e>22||e===22&&o>=3||e===20&&o>=16)return r.getBuiltinModule(s)}return O(s)},{execFileSync:C}=f("node:child_process"),{totalmem:I}=f("node:os"),q=/--max-old-space-size=(\d+)/,z=/--max-semi-space-size=(\d+)/,E=s=>Math.floor(I()/1024/1024*s),P=s=>s<=512?4:s<=1024?8:s<=2048?16:s<=4096?32:s<=8192?64:Math.floor(Math.log2(s))*8,d=(s,e)=>{for(const o of e){const n=s.exec(o);if(n)return Number.parseInt(n[1],10)}},B=s=>{const o=[...w()],n=[...R()],a=d(q,o),p=d(z,o);if(a!==void 0&&p!==void 0)return;const l=a??E(.75),g=p??P(l),c=[];if(a===void 0&&c.push(`--max-old-space-size=${String(l)}`),p===void 0&&c.push(`--max-semi-space-size=${String(g)}`),c.length!==0)try{C(j(),[...c,...o,...n.slice(1)],{env:M(),stdio:"inherit"}),m(0)}catch(h){const u=h.status;m(typeof u=="number"?u:1)}},V=()=>{process.env.VIS_VERSION=S()},H=s=>{!process.stdout.isTTY||$||process.env.TERM==="dumb"||process.stdout.write(`\x1B]0;${s}\x07`)},L=new Set(["","--help","--version","-h","-v","completion","dlx","exec","x"]),i=process.argv[2]??"";!L.has(i)&&!process.argv.includes("--help")&&!process.argv.includes("-h")&&B();process.argv.includes("--no-color")&&(process.env.NO_COLOR="1",process.env.FORCE_COLOR="0");V();T();(async()=>{if(i==="__pm-shim"){const{dispatchShim:e}=await import("../packem_chunks/dispatch.js");e(process.argv[3]??"",process.argv.slice(4));return}if(i==="x"){const{runLeanX:e}=await import("../packem_chunks/lean.js");await e(process.argv.slice(3));return}if(i==="exec"||i==="dlx"){const{runExecCli:e}=await import("../packem_chunks/cli-exec.js");await e();return}const{runCli:s}=await import("../packem_chunks/cli-main.js").then(e=>e.ax);await s()})();export{H as s};

package/dist/packem_shared/{ecosystem-gate-1M3wnsTr.js → ecosystem-gate-ddru_hOg.js}

@@ -1,4 +1,4 @@
-import{createRequire as ze}from"node:module";import{e as M,z as Fe}from"./index-BzhrR_iC.js";import{r as qe}from"./docker-DXqV-07f.js";import{parse as We}from"../packem_chunks/index4.js";import Re from"../packem_chunks/index.js";import{b as fe,l as Ke,a as Ze,d as Qe,e as en,f as nn,g as tn}from"./multi-eco-lockfiles-CUUxUjHK.js";import{p as ke,r as ue,c as sn}from"./composer-DR3D-Psb.js";import{p as Ie}from"./readJsonSync-CbryXYxN-EWl7_7KX.js";import{e as on}from"./license-DvlYdo6T.js";import{S as rn}from"./lockfile-DhHAaHN5.js";import{a as cn}from"./index-B4AjSxHU.js";import{V as Le}from"./vis-user-error-Cpg2FqA4.js";import{w as an,r as pn,Z as Ce}from"./zig-manifest-P7ydLEOa.js";let He;const Ve=e=>(He??=ze(import.meta.url))(e),ee=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,be=e=>{if(typeof ee<"u"&&ee.versions&&ee.versions.node){const[t,n]=ee.versions.node.split(".").map(Number);if(t>22||t===22&&n>=3||t===20&&n>=16)return ee.getBuiltinModule(e)}return Ve(e)},{randomUUID:Be}=be("node:crypto"),{readFileSync:G,readdirSync:Pe,statSync:Xe,existsSync:Je}=be("node:fs"),{join:A,relative:$e,resolve:De,basename:Ye}=be("node:path"),ne=e=>e.replaceAll(/[^\w.~-]/g,t=>`%${(t.codePointAt(0)??0).toString(16).toUpperCase().padStart(2,"0")}`),j=(e,t)=>{const n=e.toLowerCase();if(n.startsWith("@")){const s=n.indexOf("/");if(s>0){const o=n.slice(0,s),r=n.slice(s+1);return`pkg:npm/${ne(o)}/${ne(r)}@${ne(t)}`}}return`pkg:npm/${ne(n)}@${ne(t)}`},_={ARRAY:"array",BOOLEAN:"boolean",DATE:"date",FUNCTION:"function",JSTOXML_OBJECT:"jstoxml-object",NULL:"null",NUMBER:"number",OBJECT:"object",STRING:"string"},ln=[_.STRING,_.NUMBER,_.BOOLEAN],un='<?xml version="1.0" encoding="UTF-8"?>',Ee=["_selfCloseTag","_attrs"],fn=(e="",t=0)=>e.repeat(t),pe=e=>Array.isArray(e)&&_.ARRAY||typeof e===_.OBJECT&&e!==null&&e._name&&_.JSTOXML_OBJECT||e instanceof Date&&_.DATE||e===null&&_.NULL||typeof e,Ue=e=>e.startsWith("<![CDATA["),je=(e="",t={},n)=>{let s=e;if(typeof e===_.STRING){if(Ue(e))return e;const o=new RegExp(`(${Object.keys(t).join("|")})(?!(\\w|#)*;)`,"g");s=String(e).replace(o,(r,l)=>t[l]||"")}return typeof n=="function"?n(s):s},dn=(e={},t,n,s)=>(Array.isArray(e)?e:Object.entries(e).map(([r,l])=>({[r]:l}))).reduce((r,l)=>{const c=Object.keys(l)[0],i=l[c];if(typeof n===_.FUNCTION&&n(c,i))return r;const a=t?je(i,t):i,f=!s&&a===!0?"":`="${a}"`;return r.push(`${c}${f}`),r},[]),mn=(e={},t,n,s)=>{const o=dn(e,t,n,s);return o.length===0?"":` ${o.join(" ")}`},hn=(e={})=>Object.keys(e).map(t=>({_name:t,_content:e[t]})),gn=e=>ln.includes(pe(e)),vn=e=>!e.match("<"),yn=({header:e,isOutputStart:t})=>e&&t?typeof e===_.BOOLEAN?un:e:"",Ae={"<":"&lt;",">":"&gt;","&":"&amp;",'"':"&quot;"},q=(e={},t={})=>{const{depth:n=0,indent:s,_isFirstItem:o,_isOutputStart:r=!0,header:l,attributeReplacements:c={},attributeFilter:i,attributeExplicitTrue:a=!1,contentReplacements:f={},contentMap:g,selfCloseTags:y=!0}=t,X=typeof c=="boolean"&&!c?{}:{...Ae,...c},z=typeof f=="boolean"&&!f?{}:{...Ae,...f},N=typeof s=="string",H=fn(s,n),J=pe(e),Y=yn({header:l,isOutputStart:r}),O=r&&!Y&&o&&n===0,V=N&&!O?`
+import{createRequire as ze}from"node:module";import{e as M,z as Fe}from"./index-BzhrR_iC.js";import{r as qe}from"./docker-DXqV-07f.js";import{parse as We}from"../packem_chunks/index4.js";import Re from"../packem_chunks/index.js";import{b as fe,l as Ke,a as Ze,d as Qe,e as en,f as nn,g as tn}from"./multi-eco-lockfiles-B2X3yhyo.js";import{p as ke,r as ue,c as sn}from"./composer-DR3D-Psb.js";import{p as Ie}from"./readJsonSync-CbryXYxN-EWl7_7KX.js";import{e as on}from"./license-DvlYdo6T.js";import{S as rn}from"./lockfile-DhHAaHN5.js";import{a as cn}from"./index-B4AjSxHU.js";import{V as Le}from"./vis-user-error-75VtCwMv.js";import{w as an,r as pn,Z as Ce}from"./zig-manifest-P7ydLEOa.js";let He;const Ve=e=>(He??=ze(import.meta.url))(e),ee=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,be=e=>{if(typeof ee<"u"&&ee.versions&&ee.versions.node){const[t,n]=ee.versions.node.split(".").map(Number);if(t>22||t===22&&n>=3||t===20&&n>=16)return ee.getBuiltinModule(e)}return Ve(e)},{randomUUID:Be}=be("node:crypto"),{readFileSync:G,readdirSync:Pe,statSync:Xe,existsSync:Je}=be("node:fs"),{join:A,relative:$e,resolve:De,basename:Ye}=be("node:path"),ne=e=>e.replaceAll(/[^\w.~-]/g,t=>`%${(t.codePointAt(0)??0).toString(16).toUpperCase().padStart(2,"0")}`),j=(e,t)=>{const n=e.toLowerCase();if(n.startsWith("@")){const s=n.indexOf("/");if(s>0){const o=n.slice(0,s),r=n.slice(s+1);return`pkg:npm/${ne(o)}/${ne(r)}@${ne(t)}`}}return`pkg:npm/${ne(n)}@${ne(t)}`},_={ARRAY:"array",BOOLEAN:"boolean",DATE:"date",FUNCTION:"function",JSTOXML_OBJECT:"jstoxml-object",NULL:"null",NUMBER:"number",OBJECT:"object",STRING:"string"},ln=[_.STRING,_.NUMBER,_.BOOLEAN],un='<?xml version="1.0" encoding="UTF-8"?>',Ee=["_selfCloseTag","_attrs"],fn=(e="",t=0)=>e.repeat(t),pe=e=>Array.isArray(e)&&_.ARRAY||typeof e===_.OBJECT&&e!==null&&e._name&&_.JSTOXML_OBJECT||e instanceof Date&&_.DATE||e===null&&_.NULL||typeof e,Ue=e=>e.startsWith("<![CDATA["),je=(e="",t={},n)=>{let s=e;if(typeof e===_.STRING){if(Ue(e))return e;const o=new RegExp(`(${Object.keys(t).join("|")})(?!(\\w|#)*;)`,"g");s=String(e).replace(o,(r,l)=>t[l]||"")}return typeof n=="function"?n(s):s},dn=(e={},t,n,s)=>(Array.isArray(e)?e:Object.entries(e).map(([r,l])=>({[r]:l}))).reduce((r,l)=>{const c=Object.keys(l)[0],i=l[c];if(typeof n===_.FUNCTION&&n(c,i))return r;const a=t?je(i,t):i,f=!s&&a===!0?"":`="${a}"`;return r.push(`${c}${f}`),r},[]),mn=(e={},t,n,s)=>{const o=dn(e,t,n,s);return o.length===0?"":` ${o.join(" ")}`},hn=(e={})=>Object.keys(e).map(t=>({_name:t,_content:e[t]})),gn=e=>ln.includes(pe(e)),vn=e=>!e.match("<"),yn=({header:e,isOutputStart:t})=>e&&t?typeof e===_.BOOLEAN?un:e:"",Ae={"<":"&lt;",">":"&gt;","&":"&amp;",'"':"&quot;"},q=(e={},t={})=>{const{depth:n=0,indent:s,_isFirstItem:o,_isOutputStart:r=!0,header:l,attributeReplacements:c={},attributeFilter:i,attributeExplicitTrue:a=!1,contentReplacements:f={},contentMap:g,selfCloseTags:y=!0}=t,X=typeof c=="boolean"&&!c?{}:{...Ae,...c},z=typeof f=="boolean"&&!f?{}:{...Ae,...f},N=typeof s=="string",H=fn(s,n),J=pe(e),Y=yn({header:l,isOutputStart:r}),O=r&&!Y&&o&&n===0,V=N&&!O?`
 `:"";let k="";switch(J){case _.JSTOXML_OBJECT:{const{_name:b,_content:S}=e;if(S===null&&typeof g!="function"){k=`${V}${H}${b}`;break}if(Array.isArray(S)&&S.every(gn))return S.map(ae=>q({_name:b,_content:ae},{...t,depth:n,_isOutputStart:!1})).join("");if(Ee.includes(b))break;const $=q(S,{...t,depth:n+1,_isOutputStart:O}),B=pe($),E=vn($),oe=Ue($),T=`${V}${H}`;if(b==="_comment"){k+=`${T}<!-- ${S} -->`;break}const R=B==="undefined"||$==="",D=y,W=e._selfCloseTag,K=typeof W===_.BOOLEAN?R&&W:R&&D,I=K?"/":"",re=mn(e._attrs,X,i,a),Z=`<${b}${re}${I}>`,ce=N&&!E&&!oe?`
 ${H}`:"",ie=K?"":`${$}${ce}</${b}>`;k+=`${T}${Z}${ie}`;break}case _.OBJECT:{const b=Object.keys(e);k=b.map((v,$)=>{const B={...t,_isFirstItem:$===0,_isLastItem:$+1===b.length,_isOutputStart:O},E={_name:v};if(pe(e[v])===_.OBJECT&&(Ee.forEach(R=>{const D=e[v][R];typeof D<"u"&&(E[R]=D,delete e[v][R])}),typeof e[v]._content<"u"&&Object.keys(e[v]).length>1)){const R=Object.assign({},e[v]);delete R._content,E._content=[...hn(R),e[v]._content]}return typeof E._content>"u"&&(E._content=e[v]),q(E,B)},t).join("");break}case _.FUNCTION:{const b=e(t);k=q(b,t);break}case _.ARRAY:{k=e.map((S,v)=>{const $={...t,_isFirstItem:v===0,_isLastItem:v+1===e.length,_isOutputStart:O};return q(S,$)}).join("");break}default:{k=je(e,z,g);break}}return`${Y}${k}`},_n=(e,t)=>`pkg:cargo/${encodeURIComponent(e)}@${encodeURIComponent(t)}`,se=e=>e,bn=e=>{const t=e.split(" ")[0];if(t===void 0||t==="")return;const n=/^\S+\s+(\d[^\s(]*)/.exec(e)?.[1],s=/\(([^)]+)\)/.exec(e)?.[1];return{kind:"main",name:t,source:s,version:n}},$n=e=>{const t=[];let n,s=!1;const o=()=>{n?.name!==void 0&&n.version!==void 0&&t.push({deps:n.deps,member:n.source===void 0,name:n.name,source:n.source,version:n.version})};for(const r of e.split(`
 `)){const l=r.trim();if(l==="[[package]]"){o(),n={deps:[]},s=!1;continue}if(n===void 0)continue;if(s){const i=/^"([^"]+)",?$/.exec(l);if(i){const a=bn(i[1]);a!==void 0&&n.deps.push(a)}else l==="]"&&(s=!1);continue}if(l==="dependencies = ["){s=!0;continue}const c=/^(name|version|source)\s*=\s*"([^"]*)"$/.exec(l);if(c){const[,i="",a=""]=c;i==="name"?n.name=a:i==="version"?n.version=a:n.source=a}}return o(),t},Cn=(e,t)=>{const n=typeof t=="object"&&t!==null?t.package:void 0;return typeof n=="string"?n:e},Sn=(e,t)=>{const n=Array.isArray(t.workspace?.members)?t.workspace.members.filter(r=>typeof r=="string"):[],s=Array.isArray(t.workspace?.exclude)?t.workspace.exclude.filter(r=>typeof r=="string"):[],o=new Set;for(const r of n){let l=[e];for(const c of r.split("/").filter(i=>i!==""&&i!==".")){const i=[];for(const a of l){if(!/[*?[{]/.test(c)){i.push(A(a,c));continue}let f;try{f=Pe(a)}catch{f=[]}for(const g of f){const y=A(a,g);Re(c,g)&&Xe(y).isDirectory()&&i.push(y)}}l=i}for(const c of l){const i=c.slice(e.length+1).split("\\").join("/");s.some(a=>Re(a,i))||o.add(c)}}return[...o]},Rn=e=>{const t=new Map;let n;try{n=Oe(G(A(e,"Cargo.toml"),"utf8"))}catch{return t}const s=Sn(e,n);n.package?.name!==void 0&&s.push(e);for(const o of s){let r;try{r=Oe(G(A(o,"Cargo.toml"),"utf8"))}catch{continue}if(typeof r.package?.name!="string")continue;const l=new Set,c=i=>{for(const[a,f]of Object.entries(i??{}))l.add(se(Cn(a,f)))};c(r.dependencies),c(r["build-dependencies"]);for(const i of Object.values(r.target??{}))c(i.dependencies),c(i["build-dependencies"]);t.set(se(r.package.name),l)}return t},Oe=e=>We(e),kn=(e,t={})=>{let n;try{n=G(A(e,"Cargo.lock"),"utf8")}catch{return{components:[],dependencies:[]}}const s=Rn(e),o=$n(n).map(r=>{const l=r.member?s.get(se(r.name)):void 0;return l===void 0?r:{...r,deps:r.deps.map(c=>l.has(se(c.name))?c:{...c,kind:"dev"})}});return fe(o,{focusNames:t.focusNames,includeDev:t.includeDev,normalize:se,purl:_n})},En=(e,t)=>`pkg:composer/${e.split("/").map(n=>encodeURIComponent(n)).join("/")}@${encodeURIComponent(t)}`,te=e=>e.toLowerCase(),An=e=>{const t=[];for(const[n,s]of[["packages",!1],["packages-dev",!0]]){const o=e[n];if(Array.isArray(o))for(const r of o){if(typeof r.name!="string"||typeof r.version!="string")continue;const l=[...ue(r,"require").map(c=>({kind:s?"dev":"main",name:c})),...ue(r,"require-dev").map(c=>({kind:"dev",name:c}))];t.push({deps:l,member:!1,name:r.name,version:sn(r.version)})}}return t},On=(e,t={})=>{const n={components:[],dependencies:[]};let s,o;try{s=ke(G(A(e,"composer.lock"),"utf8")),o=ke(G(A(e,"composer.json"),"utf8"))}catch{return n}const r=typeof o.name=="string"?te(o.name):void 0;if(t.focusNames!==void 0&&!t.focusNames.some(i=>te(i)===r))return n;const l=new Set([...ue(o,"require"),...t.includeDev?ue(o,"require-dev"):[]].map(i=>te(i))),c=An(s).map(i=>({...i,member:l.has(te(i.name))}));return fe(c,{includeDev:t.includeDev,normalize:te,purl:En})},Te=e=>e.split("/").map(t=>encodeURIComponent(t)).join("/"),Tn={Go:(e,t)=>`pkg:golang/${Te(e)}@${encodeURIComponent(t)}`,Pub:(e,t)=>`pkg:pub/${encodeURIComponent(e)}@${encodeURIComponent(t)}`,SwiftURL:(e,t)=>`pkg:swift/${Te(e)}@${encodeURIComponent(t)}`},wn=(e,t)=>{const n=Ke(e,t).map(s=>{const o=Tn[t](s.name,s.version);return{"bom-ref":o,name:s.name,purl:o,type:"library",version:s.version}}).sort((s,o)=>(s["bom-ref"]??"").localeCompare(o["bom-ref"]??""));return{components:n,dependencies:n.map(s=>({ref:s["bom-ref"]??""}))}},xn=(e,t)=>`pkg:gem/${encodeURIComponent(e)}@${encodeURIComponent(t)}`,Nn=/^ {4}(\S+) \(([^()]+)\)\s*$/,Pn=/^ {6}(\S+)(?: \(.*\))?\s*$/,Dn=e=>{const t=new Map;let n,s,o;for(const r of e.split(/\r?\n/)){if(r.length>0&&!r.startsWith(" ")){n=r.trim(),s=void 0,o=void 0;continue}if(n!=="PATH"&&n!=="GEM"&&n!=="GIT")continue;const l=/^ {2}remote: (.+)$/.exec(r);if(l?.[1]!==void 0){s=l[1].trim();continue}const c=Nn.exec(r);if(c?.[1]!==void 0&&c[2]!==void 0){const a=c[1],f=c[2].split("-")[0]??c[2],g=n==="GIT"&&s!==void 0?`git:${s}`:void 0,y=`${a}\0${f}\0${g??""}`;o=t.get(y)??{deps:[],member:n==="PATH",name:a,source:g,version:f},t.set(y,o);continue}const i=Pn.exec(r);i?.[1]!==void 0&&o!==void 0&&o.deps.push({kind:"main",name:i[1]})}return[...t.values()]},In=(e,t={})=>{let n;try{n=G(A(e,"Gemfile.lock"),"utf8")}catch{return{components:[],dependencies:[]}}return fe(Dn(n),{focusNames:t.focusNames,includeDev:t.includeDev,normalize:s=>s,purl:xn})},ye=e=>{try{return Ie(e)}catch{return}},Ln=e=>{if(e.length===0||e.includes("..")||e.startsWith(".")||e.includes("\0")||e.includes("\\"))return!1;if(e.startsWith("@")){const t=e.indexOf("/");return t>1&&!e.includes("/",t+1)}return!e.includes("/")},Un=e=>e.length>0&&!e.includes("/")&&!e.includes("\\")&&!e.includes("..")&&!e.includes("\0"),jn=(e,t,n)=>{const o=`${t.replaceAll("/","+")}@${n}`,r=M(e,"node_modules",".pnpm"),l=ye(M(r,o,"node_modules",t,"package.json"));if(l)return l;let c;try{c=Pe(r)}catch{return}const i=`${o}_`;for(const a of c){if(!a.startsWith(i))continue;const f=ye(M(r,a,"node_modules",t,"package.json"));if(f)return f}},Mn=(e,t,n)=>{const s=ye(M(e,"node_modules",t,"package.json"));return s?.version===n?s:void 0},Gn=(e,t,n)=>{if(!(!Ln(t)||!Un(n)))return jn(e,t,n)??Mn(e,t,n)},zn={sha256:"SHA-256",sha384:"SHA-384",sha512:"SHA-512"},Hn={sha256:64,sha384:96,sha512:128},Vn=e=>{const t={name:e.name,version:e.version},{integrity:n}=e;return n&&n.hex.length===Hn[n.algorithm]&&(t.hash={alg:zn[n.algorithm],content:n.hex}),e.dependencies&&(t.dependencies=e.dependencies),e.peerDependencies&&(t.peerDependencies=e.peerDependencies),e.optionalDependencies&&(t.optionalDependencies=e.optionalDependencies),t},Bn=[{file:"pnpm-lock.yaml",type:"pnpm"},{file:"npm-shrinkwrap.json",type:"npm"},{file:"package-lock.json",type:"npm"},{file:"yarn.lock",type:"yarn"},{file:"bun.lock",type:"bun"}],Fn=e=>{for(const{file:t,type:n}of Bn){let s;try{s=Fe(M(e,t))}catch{continue}const o=new Map;for(const r of rn(s,n))o.set(`${r.name}@${r.version}`,Vn(r));return{packages:o,type:n}}},Me=e=>e.toLowerCase().replaceAll(/[-_.]+/g,"-"),qn=(e,t)=>`pkg:pypi/${encodeURIComponent(Me(e))}@${encodeURIComponent(t)}`,Xn=/^source\s*=\s*\{\s*(?:editable|virtual|directory)\s*=/,Jn=/\{\s*name\s*=\s*"([^"]+)"([^}]*)\}/,Yn=e=>{const t=[];let n,s="none",o=!1;const r=()=>{n?.name!==void 0&&n.version!==void 0&&t.push({deps:n.deps,member:n.member,name:n.name,source:n.source,version:n.version})};for(const l of e.split(`

package/dist/packem_shared/{index-BO8qIogg.js → index-Chje3u9v.js}

@@ -1 +1 @@
-import{m as k,D as S,f as L}from"./provenance-DyF0b6KX.js";import{g as $}from"./packument-CyGSNquL.js";import{f}from"./formatBytes-BHAzNIrn-CrusHOew.js";import{a as E}from"./build-scripts-CEDx_nJp.js";import{n as h}from"./license-DvlYdo6T.js";import{v as A,U as P,z as x}from"./index-BzhrR_iC.js";import{S as O}from"./lockfile-DhHAaHN5.js";import{L as b}from"./dependency-scan-B8jroa1D.js";import{N as M}from"../packem_chunks/catalog.js";const C=2,m=4,y={CRITICAL:0,HIGH:1,LOW:3,MODERATE:C,UNKNOWN:m},le=(e,s)=>{const n=y[(e.vulnerability.severity??"UNKNOWN").toUpperCase()]??m,t=y[(s.vulnerability.severity??"UNKNOWN").toUpperCase()]??m;return n-t||e.packageName.localeCompare(s.packageName)||e.packageVersion.localeCompare(s.packageVersion)},D=(e,s)=>{const n=y[s.toUpperCase()]??C;return(y[e.toUpperCase()]??m)<=n},N=["firstSeen","installScripts","license","malware","publisherChange","score","unexpectedDeps","vulnerability"],w=6e4,W=(e,s,n)=>{for(const t of n)if(t===e||t===`${e}@${s}`||t.endsWith("*")&&e.startsWith(t.slice(0,-1)))return!0;return!1},U=async(e,s)=>{const n=s.security?.policies?.firstSeen;if(n?.minutes===void 0||n.minutes<=0)return[];const{minutes:t}=n,r=n.exclude??[],c=s.security?.acceptedRisks,a=t*w,o=Date.now();return(await k(e.packages,S,async l=>{if(W(l.name,l.version,r))return;const p=await $(l.name,{workspaceRoot:e.workspaceRoot});if(p===void 0)return;const u=p.time?.[l.version];if(u===void 0)return;const d=Date.parse(u);if(Number.isNaN(d))return;const v=o-d;if(v>=a)return;const g=Math.max(0,Math.floor(v/w));return{acceptedRisk:f(l.name,l.version,c,"firstSeen"),data:{ageMinutes:g,minimumMinutes:t,publishedAt:u},packageName:l.name,policy:"firstSeen",reason:`${l.name}@${l.version} was published ${String(g)} min ago — below the ${String(t)} min firstSeen cooldown.`,severity:"block",version:l.version}})).filter(l=>l!==void 0)},_=(e,s)=>{const n=s.security?.policies?.installScripts;if(!n)return[];const t=n.allow??{},r=n.strict===!0;if(!r&&Object.keys(t).length===0)return[];const c=E(e.workspaceRoot,t,{pinVersions:s.security?.pinVersions===!0});if(c.unapproved.length===0)return[];const a=s.security?.acceptedRisks,o=r?"block":"warn";return c.unapproved.map(i=>({acceptedRisk:f(i.name,i.version??"*",a,"installScripts"),data:{hooks:i.hooks},packageName:i.name,policy:"installScripts",reason:`${i.name}${i.version?`@${i.version}`:""} declares unapproved build script(s): ${i.hooks.join(", ")}`,severity:o,version:i.version??"*"}))},I=new Set(["AND","OR"]),F=e=>{const s=e.replaceAll("("," ").replaceAll(")"," ").split(/\s+/).map(r=>r.trim()).filter(r=>r.length>0),n=[];let t=!1;for(const r of s){const c=r.toUpperCase();if(t){t=!1;continue}if(c==="WITH"){t=!0;continue}if(I.has(c))continue;const a=r.endsWith("+"),o=a?r.slice(0,-1):r,i=h(o)??o;n.push(i),a&&n.push(`${i}-or-later`)}return n},T=e=>{if(typeof e.license=="string"){const s=e.license.trim();return s.length>0?s:void 0}if(e.license&&typeof e.license=="object"&&typeof e.license.type=="string"){const s=e.license.type.trim();if(s.length>0)return s}if(Array.isArray(e.licenses)&&e.licenses.length>0){const s=e.licenses.map(n=>n&&typeof n.type=="string"?n.type.trim():"").filter(n=>n.length>0);if(s.length>0)return s.length===1?s[0]:`(${s.join(" OR ")})`}},V=(e,s)=>{if(s.length===0)return;const n=new Set(s.map(t=>h(t)??t).map(t=>t.toLowerCase()));for(const t of e)if(n.has(t.toLowerCase()))return t},K=(e,s)=>{if(s.length===0)return;const n=new Set(s.map(t=>h(t)??t).map(t=>t.toLowerCase()));for(const t of e)if(!n.has(t.toLowerCase()))return t},j=(e,s)=>{const n=s.security?.policies?.license;if(!n)return[];const t=n.allow??[],r=n.deny??[];if(t.length===0&&r.length===0)return[];const c=s.security?.acceptedRisks,a=[];for(const o of e.packages){const i=e.manifestData?.get(`${o.name}@${o.version}`),l=i?T(i):void 0;if(!l){t.length>0&&a.push({acceptedRisk:f(o.name,o.version,c,"license"),data:{declaredLicense:null},packageName:o.name,policy:"license",reason:`${o.name}@${o.version} declares no license; allow-list mode requires one of: ${t.join(", ")}`,severity:"block",version:o.version});continue}const p=F(l),u=V(p,r);if(u){a.push({acceptedRisk:f(o.name,o.version,c,"license"),data:{declaredLicense:l,deniedLicense:u},packageName:o.name,policy:"license",reason:`${o.name}@${o.version} uses denied license '${u}' (declared: ${l})`,severity:"block",version:o.version});continue}const d=K(p,t);d&&a.push({acceptedRisk:f(o.name,o.version,c,"license"),data:{allowList:t,declaredLicense:l,unallowedLicense:d},packageName:o.name,policy:"license",reason:`${o.name}@${o.version} uses license '${d}' which is not on the allow-list (declared: ${l})`,severity:"block",version:o.version})}return a},z=6e4,B=(e,s,n)=>{for(const t of n)if(t===e||t===`${e}@${s}`||t.endsWith("*")&&e.startsWith(t.slice(0,-1)))return!0;return!1},Y=async(e,s)=>{const n=s.security?.policies?.publisherChange;if(n?.mode!=="no-downgrade")return[];const t=n.exclude??[],r=typeof n.ignoreAfter=="number"?n.ignoreAfter*z:void 0,c=s.security?.acceptedRisks,a=Date.now();return(await k(e.packages,S,async i=>{if(B(i.name,i.version,t))return;const l=await $(i.name,{workspaceRoot:e.workspaceRoot});if(l===void 0)return;if(r!==void 0){const d=l.time?.[i.version],v=d===void 0?Number.NaN:Date.parse(d);if(!Number.isNaN(v)&&a-v>r)return}if(l.versions[i.version]?.dist?.attestations?.provenance!==void 0)return;const u=L(l,i.version);if(u!==void 0)return{acceptedRisk:f(i.name,i.version,c,"publisherChange"),data:{priorVersionWithProvenance:u},packageName:i.name,policy:"publisherChange",reason:`${i.name}@${i.version} dropped the provenance attestation that ${i.name}@${u} carried — publisher trust downgrade.`,severity:"block",version:i.version}})).filter(i=>i!==void 0)},H=e=>{for(const s of Object.values(b))for(const n of[s.file,...s.aliases??[]])if(e===n||e.endsWith(`/${n}`)||e.endsWith(`.${n}`))return s.type},q=(e,s,n)=>{const t=A(s)?s:P(e,s);let r;try{r=x(t)}catch{return}const c=H(t)??b[n]?.type;if(!c)return;const a=O(r,c);if(a.length===0)return;const o=new Set;for(const i of a)o.add(`${i.name}@${i.version}`);return o},G=(e,s)=>{for(const n of s)if(n===e||n.endsWith("*")&&e.startsWith(n.slice(0,-1)))return!0;return!1},X=(e,s)=>{const n=s.security?.policies?.unexpectedDeps;if(!n)return[];const t=n.allow??[],r=n.baselineLockfile;if(t.length===0&&!r)return[];const c=r?q(e.workspaceRoot,r,e.packageManager):void 0,a=s.security?.acceptedRisks,o=[];for(const i of e.packages){const l=t.length===0||G(i.name,t),p=c?c.has(`${i.name}@${i.version}`):!0;if(l&&p)continue;const u=[],d={};l||(u.push(`not on allow-list (${t.length} entr${t.length===1?"y":"ies"})`),d.allowList=t),!p&&c&&(u.push(`not present in baseline lockfile (${r})`),d.baselineLockfile=r),o.push({acceptedRisk:f(i.name,i.version,a,"unexpectedDeps"),data:d,packageName:i.name,policy:"unexpectedDeps",reason:`${i.name}@${i.version} is unexpected: ${u.join("; ")}`,severity:"block",version:i.version})}return o},J=(e,s)=>{if(!e.osvFindings||e.osvFindings.size===0)return[];const t=s.security?.policies?.vulnerability?.failOn,r=s.security?.acceptedRisks,c=[];for(const a of e.packages){const o=e.osvFindings.get(M(a.name,a.version))??e.osvFindings.get(a.name);if(!(!o||o.length===0))for(const i of o){const l=t?D(i.severity,t)?"block":"warn":"info";c.push({acceptedRisk:f(a.name,a.version,r,"vulnerability"),data:{advisoryId:i.id,aliases:i.aliases??[],cvssScore:i.cvssScore,fixedVersions:i.fixedVersions,severity:i.severity,summary:i.summary},packageName:a.name,policy:"vulnerability",reason:`${i.severity} ${i.id} affects ${a.name}@${a.version}: ${i.summary}`,severity:l,version:a.version})}}return c},R=[{evaluate:J,isConfigured:e=>e.security?.policies?.vulnerability!==void 0,name:"vulnerability",offlineSupported:!0,surfaces:["audit","doctor"]},{evaluate:j,isConfigured:e=>{const s=e.security?.policies?.license;return!!(s&&(s.allow&&s.allow.length>0||s.deny&&s.deny.length>0))},name:"license",offlineSupported:!0,surfaces:["audit","doctor","install"]},{evaluate:_,isConfigured:e=>{const s=e.security?.policies?.installScripts;return!!(s&&(s.allow&&Object.keys(s.allow).length>0||s.strict===!0))},name:"installScripts",offlineSupported:!0,surfaces:["audit","doctor","install"]},{evaluate:X,isConfigured:e=>{const s=e.security?.policies?.unexpectedDeps;return!!(s&&(s.allow&&s.allow.length>0||typeof s.baselineLockfile=="string"))},name:"unexpectedDeps",offlineSupported:!0,surfaces:["audit","doctor","install"]},{evaluate:U,isConfigured:e=>{const s=e.security?.policies?.firstSeen?.minutes;return typeof s=="number"&&s>0},name:"firstSeen",offlineSupported:!1,surfaces:["audit","doctor","install"]},{evaluate:Y,isConfigured:e=>e.security?.policies?.publisherChange?.mode==="no-downgrade",name:"publisherChange",offlineSupported:!1,surfaces:["audit","doctor","install"]}],Q=(e,s,n)=>R.filter(t=>t.surfaces.includes(e)?n!==void 0?n.has(t.name):t.isConfigured(s):!1),ue=async(e,s,n)=>{const t=Q(s,n.visConfig,n.enabledPolicies),r=[];for(const c of t){if(e.offline&&!c.offlineSupported){r.push({packageName:"*",policy:c.name,reason:`policy.${c.name} skipped: requires network (--offline)`,severity:"info",version:"*"});continue}try{const a=await c.evaluate(e,n.visConfig);r.push(...a)}catch(a){const o=a instanceof Error?a.message:String(a);r.push({packageName:"*",policy:c.name,reason:`policy.${c.name} failed: ${o}`,severity:"info",version:"*"})}}return r},Z=(()=>{const e=new Map;for(const s of N)e.set(s.toLowerCase(),s);return e})(),de=()=>R.map(e=>e.name),pe=(e,s)=>{if(e===void 0)return;const n=e.trim().toLowerCase();if(n===""||n==="none")return new Set;if(n==="all")return new Set(N);const t=new Set;for(const r of e.split(",").map(c=>c.trim()).filter(c=>c.length>0)){const c=r.replace(/^_+/,"").replaceAll(/_+([a-z])/g,(o,i)=>i.toUpperCase()),a=Z.get(c.toLowerCase());a===void 0?s?.(r):t.add(a)}return t};export{le as c,ue as e,de as g,pe as p,D as s};
+import{m as k,D as S,f as L}from"./provenance-DNyVMxNv.js";import{g as $}from"./packument-BQv4je9m.js";import{f}from"./formatBytes-BHAzNIrn-CrusHOew.js";import{a as E}from"./build-scripts-CEDx_nJp.js";import{n as h}from"./license-DvlYdo6T.js";import{v as A,U as P,z as x}from"./index-BzhrR_iC.js";import{S as M}from"./lockfile-DhHAaHN5.js";import{L as b}from"./dependency-scan-B8jroa1D.js";import{M as O}from"../packem_chunks/catalog.js";const C=2,m=4,y={CRITICAL:0,HIGH:1,LOW:3,MODERATE:C,UNKNOWN:m},le=(e,s)=>{const n=y[(e.vulnerability.severity??"UNKNOWN").toUpperCase()]??m,t=y[(s.vulnerability.severity??"UNKNOWN").toUpperCase()]??m;return n-t||e.packageName.localeCompare(s.packageName)||e.packageVersion.localeCompare(s.packageVersion)},D=(e,s)=>{const n=y[s.toUpperCase()]??C;return(y[e.toUpperCase()]??m)<=n},R=["firstSeen","installScripts","license","malware","publisherChange","score","unexpectedDeps","vulnerability"],w=6e4,W=(e,s,n)=>{for(const t of n)if(t===e||t===`${e}@${s}`||t.endsWith("*")&&e.startsWith(t.slice(0,-1)))return!0;return!1},U=async(e,s)=>{const n=s.security?.policies?.firstSeen;if(n?.minutes===void 0||n.minutes<=0)return[];const{minutes:t}=n,r=n.exclude??[],c=s.security?.acceptedRisks,a=t*w,o=Date.now();return(await k(e.packages,S,async l=>{if(W(l.name,l.version,r))return;const p=await $(l.name,{workspaceRoot:e.workspaceRoot});if(p===void 0)return;const u=p.time?.[l.version];if(u===void 0)return;const d=Date.parse(u);if(Number.isNaN(d))return;const v=o-d;if(v>=a)return;const g=Math.max(0,Math.floor(v/w));return{acceptedRisk:f(l.name,l.version,c,"firstSeen"),data:{ageMinutes:g,minimumMinutes:t,publishedAt:u},packageName:l.name,policy:"firstSeen",reason:`${l.name}@${l.version} was published ${String(g)} min ago — below the ${String(t)} min firstSeen cooldown.`,severity:"block",version:l.version}})).filter(l=>l!==void 0)},_=(e,s)=>{const n=s.security?.policies?.installScripts;if(!n)return[];const t=n.allow??{},r=n.strict===!0;if(!r&&Object.keys(t).length===0)return[];const c=E(e.workspaceRoot,t,{pinVersions:s.security?.pinVersions===!0});if(c.unapproved.length===0)return[];const a=s.security?.acceptedRisks,o=r?"block":"warn";return c.unapproved.map(i=>({acceptedRisk:f(i.name,i.version??"*",a,"installScripts"),data:{hooks:i.hooks},packageName:i.name,policy:"installScripts",reason:`${i.name}${i.version?`@${i.version}`:""} declares unapproved build script(s): ${i.hooks.join(", ")}`,severity:o,version:i.version??"*"}))},I=new Set(["AND","OR"]),F=e=>{const s=e.replaceAll("("," ").replaceAll(")"," ").split(/\s+/).map(r=>r.trim()).filter(r=>r.length>0),n=[];let t=!1;for(const r of s){const c=r.toUpperCase();if(t){t=!1;continue}if(c==="WITH"){t=!0;continue}if(I.has(c))continue;const a=r.endsWith("+"),o=a?r.slice(0,-1):r,i=h(o)??o;n.push(i),a&&n.push(`${i}-or-later`)}return n},T=e=>{if(typeof e.license=="string"){const s=e.license.trim();return s.length>0?s:void 0}if(e.license&&typeof e.license=="object"&&typeof e.license.type=="string"){const s=e.license.type.trim();if(s.length>0)return s}if(Array.isArray(e.licenses)&&e.licenses.length>0){const s=e.licenses.map(n=>n&&typeof n.type=="string"?n.type.trim():"").filter(n=>n.length>0);if(s.length>0)return s.length===1?s[0]:`(${s.join(" OR ")})`}},V=(e,s)=>{if(s.length===0)return;const n=new Set(s.map(t=>h(t)??t).map(t=>t.toLowerCase()));for(const t of e)if(n.has(t.toLowerCase()))return t},K=(e,s)=>{if(s.length===0)return;const n=new Set(s.map(t=>h(t)??t).map(t=>t.toLowerCase()));for(const t of e)if(!n.has(t.toLowerCase()))return t},j=(e,s)=>{const n=s.security?.policies?.license;if(!n)return[];const t=n.allow??[],r=n.deny??[];if(t.length===0&&r.length===0)return[];const c=s.security?.acceptedRisks,a=[];for(const o of e.packages){const i=e.manifestData?.get(`${o.name}@${o.version}`),l=i?T(i):void 0;if(!l){t.length>0&&a.push({acceptedRisk:f(o.name,o.version,c,"license"),data:{declaredLicense:null},packageName:o.name,policy:"license",reason:`${o.name}@${o.version} declares no license; allow-list mode requires one of: ${t.join(", ")}`,severity:"block",version:o.version});continue}const p=F(l),u=V(p,r);if(u){a.push({acceptedRisk:f(o.name,o.version,c,"license"),data:{declaredLicense:l,deniedLicense:u},packageName:o.name,policy:"license",reason:`${o.name}@${o.version} uses denied license '${u}' (declared: ${l})`,severity:"block",version:o.version});continue}const d=K(p,t);d&&a.push({acceptedRisk:f(o.name,o.version,c,"license"),data:{allowList:t,declaredLicense:l,unallowedLicense:d},packageName:o.name,policy:"license",reason:`${o.name}@${o.version} uses license '${d}' which is not on the allow-list (declared: ${l})`,severity:"block",version:o.version})}return a},z=6e4,B=(e,s,n)=>{for(const t of n)if(t===e||t===`${e}@${s}`||t.endsWith("*")&&e.startsWith(t.slice(0,-1)))return!0;return!1},Y=async(e,s)=>{const n=s.security?.policies?.publisherChange;if(n?.mode!=="no-downgrade")return[];const t=n.exclude??[],r=typeof n.ignoreAfter=="number"?n.ignoreAfter*z:void 0,c=s.security?.acceptedRisks,a=Date.now();return(await k(e.packages,S,async i=>{if(B(i.name,i.version,t))return;const l=await $(i.name,{workspaceRoot:e.workspaceRoot});if(l===void 0)return;if(r!==void 0){const d=l.time?.[i.version],v=d===void 0?Number.NaN:Date.parse(d);if(!Number.isNaN(v)&&a-v>r)return}if(l.versions[i.version]?.dist?.attestations?.provenance!==void 0)return;const u=L(l,i.version);if(u!==void 0)return{acceptedRisk:f(i.name,i.version,c,"publisherChange"),data:{priorVersionWithProvenance:u},packageName:i.name,policy:"publisherChange",reason:`${i.name}@${i.version} dropped the provenance attestation that ${i.name}@${u} carried — publisher trust downgrade.`,severity:"block",version:i.version}})).filter(i=>i!==void 0)},H=e=>{for(const s of Object.values(b))for(const n of[s.file,...s.aliases??[]])if(e===n||e.endsWith(`/${n}`)||e.endsWith(`.${n}`))return s.type},q=(e,s,n)=>{const t=A(s)?s:P(e,s);let r;try{r=x(t)}catch{return}const c=H(t)??b[n]?.type;if(!c)return;const a=M(r,c);if(a.length===0)return;const o=new Set;for(const i of a)o.add(`${i.name}@${i.version}`);return o},G=(e,s)=>{for(const n of s)if(n===e||n.endsWith("*")&&e.startsWith(n.slice(0,-1)))return!0;return!1},X=(e,s)=>{const n=s.security?.policies?.unexpectedDeps;if(!n)return[];const t=n.allow??[],r=n.baselineLockfile;if(t.length===0&&!r)return[];const c=r?q(e.workspaceRoot,r,e.packageManager):void 0,a=s.security?.acceptedRisks,o=[];for(const i of e.packages){const l=t.length===0||G(i.name,t),p=c?c.has(`${i.name}@${i.version}`):!0;if(l&&p)continue;const u=[],d={};l||(u.push(`not on allow-list (${t.length} entr${t.length===1?"y":"ies"})`),d.allowList=t),!p&&c&&(u.push(`not present in baseline lockfile (${r})`),d.baselineLockfile=r),o.push({acceptedRisk:f(i.name,i.version,a,"unexpectedDeps"),data:d,packageName:i.name,policy:"unexpectedDeps",reason:`${i.name}@${i.version} is unexpected: ${u.join("; ")}`,severity:"block",version:i.version})}return o},J=(e,s)=>{if(!e.osvFindings||e.osvFindings.size===0)return[];const t=s.security?.policies?.vulnerability?.failOn,r=s.security?.acceptedRisks,c=[];for(const a of e.packages){const o=e.osvFindings.get(O(a.name,a.version))??e.osvFindings.get(a.name);if(!(!o||o.length===0))for(const i of o){const l=t?D(i.severity,t)?"block":"warn":"info";c.push({acceptedRisk:f(a.name,a.version,r,"vulnerability"),data:{advisoryId:i.id,aliases:i.aliases??[],cvssScore:i.cvssScore,fixedVersions:i.fixedVersions,severity:i.severity,summary:i.summary},packageName:a.name,policy:"vulnerability",reason:`${i.severity} ${i.id} affects ${a.name}@${a.version}: ${i.summary}`,severity:l,version:a.version})}}return c},N=[{evaluate:J,isConfigured:e=>e.security?.policies?.vulnerability!==void 0,name:"vulnerability",offlineSupported:!0,surfaces:["audit","doctor"]},{evaluate:j,isConfigured:e=>{const s=e.security?.policies?.license;return!!(s&&(s.allow&&s.allow.length>0||s.deny&&s.deny.length>0))},name:"license",offlineSupported:!0,surfaces:["audit","doctor","install"]},{evaluate:_,isConfigured:e=>{const s=e.security?.policies?.installScripts;return!!(s&&(s.allow&&Object.keys(s.allow).length>0||s.strict===!0))},name:"installScripts",offlineSupported:!0,surfaces:["audit","doctor","install"]},{evaluate:X,isConfigured:e=>{const s=e.security?.policies?.unexpectedDeps;return!!(s&&(s.allow&&s.allow.length>0||typeof s.baselineLockfile=="string"))},name:"unexpectedDeps",offlineSupported:!0,surfaces:["audit","doctor","install"]},{evaluate:U,isConfigured:e=>{const s=e.security?.policies?.firstSeen?.minutes;return typeof s=="number"&&s>0},name:"firstSeen",offlineSupported:!1,surfaces:["audit","doctor","install"]},{evaluate:Y,isConfigured:e=>e.security?.policies?.publisherChange?.mode==="no-downgrade",name:"publisherChange",offlineSupported:!1,surfaces:["audit","doctor","install"]}],Q=(e,s,n)=>N.filter(t=>t.surfaces.includes(e)?n!==void 0?n.has(t.name):t.isConfigured(s):!1),ue=async(e,s,n)=>{const t=Q(s,n.visConfig,n.enabledPolicies),r=[];for(const c of t){if(e.offline&&!c.offlineSupported){r.push({packageName:"*",policy:c.name,reason:`policy.${c.name} skipped: requires network (--offline)`,severity:"info",version:"*"});continue}try{const a=await c.evaluate(e,n.visConfig);r.push(...a)}catch(a){const o=a instanceof Error?a.message:String(a);r.push({packageName:"*",policy:c.name,reason:`policy.${c.name} failed: ${o}`,severity:"info",version:"*"})}}return r},Z=(()=>{const e=new Map;for(const s of R)e.set(s.toLowerCase(),s);return e})(),de=()=>N.map(e=>e.name),pe=(e,s)=>{if(e===void 0)return;const n=e.trim().toLowerCase();if(n===""||n==="none")return new Set;if(n==="all")return new Set(R);const t=new Set;for(const r of e.split(",").map(c=>c.trim()).filter(c=>c.length>0)){const c=r.replace(/^_+/,"").replaceAll(/_+([a-z])/g,(o,i)=>i.toUpperCase()),a=Z.get(c.toLowerCase());a===void 0?s?.(r):t.add(a)}return t};export{le as c,ue as e,de as g,pe as p,D as s};

package/dist/packem_shared/{index-CNYv9D8g.js → index-DQ2GJzmy.js}

@@ -1 +1 @@
-import{b as e}from"./vis-user-error-Cpg2FqA4.js";const o={filter:{alias:"F",description:"Filter packages by name pattern",multiple:!0,type:String},parallel:{defaultValue:!1,description:"Run concurrently without topological ordering",type:Boolean},recursive:{alias:"r",defaultValue:!1,description:"Run in every workspace package",type:Boolean},reverse:{defaultValue:!1,description:"Reverse topological execution order",type:Boolean},"shell-mode":{alias:"c",defaultValue:!1,description:"Execute within shell environment",type:Boolean},"workspace-root":{alias:"w",defaultValue:!1,description:"Run on workspace root only",type:Boolean}},l=e({argument:{description:"Command to execute followed by arguments",name:"command",type:String},description:"Execute a local node_modules/.bin command (no remote fallback)",examples:[["vis exec eslint .","Run local eslint"],["vis exec tsc --noEmit","Run local TypeScript check"],["vis exec -r -- eslint .","Run in all workspace packages"],["vis exec -c 'echo $PATH'","Shell mode"]],group:"Run & Execute",loader:()=>import("../packem_chunks/handler.js"),name:"exec",options:o});export{l as e};
+import{b as e}from"./vis-user-error-75VtCwMv.js";const o={filter:{alias:"F",description:"Filter packages by name pattern",multiple:!0,type:String},parallel:{defaultValue:!1,description:"Run concurrently without topological ordering",type:Boolean},recursive:{alias:"r",defaultValue:!1,description:"Run in every workspace package",type:Boolean},reverse:{defaultValue:!1,description:"Reverse topological execution order",type:Boolean},"shell-mode":{alias:"c",defaultValue:!1,description:"Execute within shell environment",type:Boolean},"workspace-root":{alias:"w",defaultValue:!1,description:"Run on workspace root only",type:Boolean}},l=e({argument:{description:"Command to execute followed by arguments",name:"command",type:String},description:"Execute a local node_modules/.bin command (no remote fallback)",examples:[["vis exec eslint .","Run local eslint"],["vis exec tsc --noEmit","Run local TypeScript check"],["vis exec -r -- eslint .","Run in all workspace packages"],["vis exec -c 'echo $PATH'","Shell mode"]],group:"Run & Execute",loader:()=>import("../packem_chunks/handler.js"),name:"exec",options:o});export{l as e};

package/dist/packem_shared/{missing-package-json-DnHMxRnG.js → missing-package-json-Cu5YVAot.js}

@@ -1 +1 @@
-import{e as d,U as u}from"./index-BzhrR_iC.js";import{k as m,y as E,B as y,L as o}from"../packem_chunks/catalog.js";import{y as l}from"./isAccessibleSync-DYKTrrvc-C-_5cgwu.js";const D=/\/+$/,f=/node_modules/,p=/\.git/,S=/[$()+.?[\\\]^{|}]/g,_=/\/\*\*$|\/\*\/\*$/,P=t=>{for(const r of o(t,{includeDirs:!1,includeSymlinks:!1,skip:[f,p]}))if(r.name==="package.json")return!0;return!1},h=(t,r,n)=>{for(const e of o(t,{includeFiles:!1,includeSymlinks:!1,maxDepth:1,skip:[f,p]})){if(e.path===t||e.name.startsWith(".")||l(d(e.path,"package.json")))continue;const i=`${r}/${e.name}`;P(e.path)?h(e.path,i,n):n.push(i)}},g=(t,r)=>{const n=r.replace(D,"");if(n.startsWith("!"))return[];const e=[];if(n.endsWith("/*")&&!n.endsWith("/*/*")){const a=n.slice(0,-2),s=u(t,a);if(!l(s))return[];for(const c of o(s,{includeFiles:!1,includeSymlinks:!1,maxDepth:1,skip:[f,p]}))c.path===s||c.name.startsWith(".")||e.push(d(a,c.name));return e}if(n.endsWith("/**")||n.endsWith("/*/*")){const a=n.replace(_,""),s=u(t,a);return l(s)&&h(s,a,e),e}if(!n.includes("/")&&n.includes("*")){const a=n.replaceAll(S,String.raw`\$&`).replaceAll("*",".*"),s=new RegExp(`^${a}$`);for(const c of o(t,{includeFiles:!1,includeSymlinks:!1,maxDepth:1,skip:[f,p]}))c.path!==t&&s.test(c.name)&&e.push(c.name);return e}const i=u(t,n);return l(i)&&e.push(n),e},x=t=>{const n=m(t)??E(t)??[],e=new Set,i=[];for(const a of n)for(const s of g(t,a))s==="."||e.has(s)||(e.add(s),y(d(t,s))||i.push({packageDir:s}));return i};export{x as l};
+import{e as d,U as u}from"./index-BzhrR_iC.js";import{k as m,z as E,B as D,L as o}from"../packem_chunks/catalog.js";import{y as l}from"./isAccessibleSync-DYKTrrvc-C-_5cgwu.js";const S=/\/+$/,f=/node_modules/,p=/\.git/,_=/[$()+.?[\\\]^{|}]/g,y=/\/\*\*$|\/\*\/\*$/,P=t=>{for(const r of o(t,{includeDirs:!1,includeSymlinks:!1,skip:[f,p]}))if(r.name==="package.json")return!0;return!1},h=(t,r,n)=>{for(const e of o(t,{includeFiles:!1,includeSymlinks:!1,maxDepth:1,skip:[f,p]})){if(e.path===t||e.name.startsWith(".")||l(d(e.path,"package.json")))continue;const i=`${r}/${e.name}`;P(e.path)?h(e.path,i,n):n.push(i)}},g=(t,r)=>{const n=r.replace(S,"");if(n.startsWith("!"))return[];const e=[];if(n.endsWith("/*")&&!n.endsWith("/*/*")){const a=n.slice(0,-2),s=u(t,a);if(!l(s))return[];for(const c of o(s,{includeFiles:!1,includeSymlinks:!1,maxDepth:1,skip:[f,p]}))c.path===s||c.name.startsWith(".")||e.push(d(a,c.name));return e}if(n.endsWith("/**")||n.endsWith("/*/*")){const a=n.replace(y,""),s=u(t,a);return l(s)&&h(s,a,e),e}if(!n.includes("/")&&n.includes("*")){const a=n.replaceAll(_,String.raw`\$&`).replaceAll("*",".*"),s=new RegExp(`^${a}$`);for(const c of o(t,{includeFiles:!1,includeSymlinks:!1,maxDepth:1,skip:[f,p]}))c.path!==t&&s.test(c.name)&&e.push(c.name);return e}const i=u(t,n);return l(i)&&e.push(n),e},x=t=>{const n=m(t)??E(t)??[],e=new Set,i=[];for(const a of n)for(const s of g(t,a))s==="."||e.has(s)||(e.add(s),D(d(t,s))||i.push({packageDir:s}));return i};export{x as l};

package/dist/packem_shared/{multi-eco-lockfiles-CUUxUjHK.js → multi-eco-lockfiles-B2X3yhyo.js}

@@ -1 +1 @@
-import{createRequire as J}from"node:module";import{e as K}from"./index-BzhrR_iC.js";import{H as X}from"../packem_chunks/catalog.js";import{e as L,i as Z,s as Q}from"./maven-pom-B0KG9kJQ.js";import{c as ee}from"./composer-DR3D-Psb.js";let Y;const B=e=>(Y??=J(import.meta.url))(e),S=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,G=e=>{if(typeof S<"u"&&S.versions&&S.versions.node){const[n,t]=S.versions.node.split(".").map(Number);if(n>22||n===22&&t>=3||n===20&&t>=16)return S.getBuiltinModule(e)}return B(e)},{existsSync:E,readFileSync:_}=G("node:fs"),{resolve:w,dirname:M,join:x}=G("node:path"),oe=8,ne=8,te="vis:maven:version-unresolved",N=(e,n,t)=>`pkg:maven/${encodeURIComponent(e)}/${encodeURIComponent(n)}${t===void 0?"":`@${encodeURIComponent(t)}`}`,A=e=>{if(E(e))try{return{path:e,scan:Q(_(e,"utf8"))}}catch{return}},D=e=>{const n=e.scan.parent;if(!n)return;const t=n.relativePath||"../pom.xml",o=t.endsWith(".xml")?w(M(e.path),t):w(M(e.path),t,"pom.xml"),s=A(o);return s&&s.scan.artifactId?.value===n.artifactId?.value&&L(s.scan)===n.groupId?.value?s:void 0},se=e=>{const n=[e];let t=D(e);for(;t&&n.length<oe;)n.push(t),t=D(t);return n},P=(e,n,t=0)=>{if(e===""||t>ne)return;let o=!1;const s=e.replaceAll(/\$\{([^}]+)\}/g,(c,r)=>{const i=n(r),a=i===void 0?void 0:P(i,n,t+1);return a===void 0?(o=!0,""):a});return o||s.includes("${")?void 0:s},C=(e,n)=>{if(e===void 0)return{unresolved:""};const t=P(e,n);return t===void 0||!Z(t)?{unresolved:e}:{version:t}},re=e=>{const n=[],t=new Set,o=s=>{const c=w(s),r=A(c);if(!(!r||t.has(c))){t.add(c),n.push(se(r));for(const i of r.scan.modules)o(i.endsWith(".xml")?w(M(c),i):w(M(c),i,"pom.xml"))}};return o(e),n},T=e=>{const n=[];for(const t of re(w(e,"pom.xml"))){const o=t[0].scan,s=new Map;for(const m of t)for(const[y,b]of m.scan.properties)s.has(y)||s.set(y,b.value);const c=L(o),r=o.artifactId?.value,i=o.version?.value??o.parent?.version?.value,a=o.parent?.version?.value,l=m=>{switch(m){case"artifactId":case"pom.artifactId":case"project.artifactId":return r;case"groupId":case"pom.groupId":case"project.groupId":return c;case"pom.version":case"project.version":case"version":return i;case"project.parent.version":return a;default:return s.get(m)}},u=c===void 0?void 0:P(c,l),g=r===void 0?void 0:P(r,l),h=C(i,l),v=new Map;for(const m of t)for(const y of m.scan.dependencies){const b=y.groupId?.value??"",d=y.artifactId?.value??"",p=`${b}:${d}`;if(v.has(p))continue;const f=P(b,l),k=P(d,l),j=f===void 0||k===void 0?{unresolved:y.version?.value??""}:C(y.version?.value,l);v.set(p,{artifact:k,group:f,scope:y.scope?.value??"compile",unresolved:f===void 0||k===void 0?p:j.unresolved,version:j.version})}n.push({artifact:g,dependencies:[...v.values()],group:u,path:t[0].path,unresolved:h.unresolved,version:h.version})}return n},O=e=>e==="test"||e==="provided",ce=(e,n)=>{const t=new Set(n),o=new Map;for(const r of e)r.group!==void 0&&r.artifact!==void 0&&o.set(`${r.group}:${r.artifact}`,r);const s=new Set(e.filter(r=>r.artifact!==void 0&&t.has(r.artifact))),c=[...s];for(;c.length>0;){const r=c.shift();for(const i of r.dependencies){const a=o.get(`${i.group}:${i.artifact}`);a!==void 0&&!s.has(a)&&(s.add(a),c.push(a))}}return e.filter(r=>s.has(r))},De=(e,n={})=>{const t=n.includeDev??!1,o=new Map,s=new Map,c=(a,l,u,g,h)=>{const v=N(a,l,u);if(!o.has(v)){const m={"bom-ref":v,group:a,name:l,purl:v,type:"library"};u!==void 0&&(m.version=u),g!==void 0&&(m.properties=[{name:te,value:g}]),h!==void 0&&(m.scope=h),o.set(v,m)}return v},r=T(e);for(const a of n.focusNames===void 0?r:ce(r,n.focusNames)){const l=a.group!==void 0&&a.artifact!==void 0?c(a.group,a.artifact,a.version,a.unresolved):void 0;for(const u of a.dependencies){if(O(u.scope)&&!t||u.group===void 0||u.artifact===void 0)continue;const g=c(u.group,u.artifact,u.version,u.unresolved,O(u.scope)?"optional":"required");l!==void 0&&s.set(l,(s.get(l)??new Set).add(g))}}const i=[...o.values()].sort((a,l)=>(a["bom-ref"]??"").localeCompare(l["bom-ref"]??""));return{components:i,dependencies:i.map(a=>{const l=a["bom-ref"]??"",u=[...s.get(l)??[]].sort();return u.length>0?{dependsOn:u,ref:l}:{ref:l}})}},ie=e=>{const n=[];for(const t of e.split(/\r?\n/)){const o=t.trim();if(o.length===0||o.startsWith("#"))continue;const s=o.indexOf("="),c=(s===-1?o:o.slice(0,s)).split(":");if(c.length<3||!c[0]||!c[1]||!c[2])continue;const r=s===-1?[]:o.slice(s+1).split(",").map(i=>i.trim()).filter(i=>i.length>0);n.push({artifact:c[1],configurations:r,group:c[0],version:c[2]})}return n},ae=e=>["",...X(e,[])].map(t=>x(e,t,"gradle.lockfile")).filter(t=>E(t)),U=e=>{const n=[];for(const t of ae(e))try{n.push(...ie(_(t,"utf8")))}catch{}return n},de=e=>e.configurations.length>0&&e.configurations.every(n=>/test/i.test(n)),Ce=(e,n={})=>{const t=n.includeDev??!1,o=new Map;for(const r of U(e)){const i=N(r.group,r.artifact,r.version),a=o.get(i),l=de(r);o.set(i,{dev:(a?.dev??!0)&&l,entry:r})}const s=[...o.keys()].filter(r=>t||!o.get(r).dev).sort();return{components:s.map(r=>{const{dev:i,entry:a}=o.get(r);return{"bom-ref":r,group:a.group,name:a.artifact,purl:r,scope:i?"optional":"required",type:"library",version:a.version}}),dependencies:s.map(r=>({ref:r}))}},V=(e,n)=>{const{focusNames:t,includeDev:o=!1,normalize:s,purl:c}=n,r=new Map;for(const d of e){const p=`${s(d.name)}@${d.version}`;r.set(p,(r.get(p)??0)+1)}const i=d=>{const p=(r.get(`${s(d.name)}@${d.version}`)??0)>1,f=c(d.name,d.version);return p&&d.source!==void 0?`${f}?source=${encodeURIComponent(d.source)}`:f},a=new Map;for(const d of e){const p=s(d.name);a.set(p,[...a.get(p)??[],d])}const l=d=>{const p=(a.get(s(d.name))??[]).filter(f=>(d.version===void 0||f.version===d.version)&&(d.source===void 0||f.source===d.source));return p.length===1?p[0]:void 0},u=t===void 0?void 0:new Set(t.map(d=>s(d))),g=e.filter(d=>d.member&&(u===void 0||u.has(s(d.name)))),h=new Set(g),v=[...g];for(;v.length>0;){const d=v.shift();for(const p of d.deps){if(p.kind==="dev"&&!o)continue;const f=l(p);f!==void 0&&!h.has(f)&&(h.add(f),v.push(f))}}const m=[...h],y=m.map(d=>{const p=i(d);return{"bom-ref":p,name:d.name,purl:p,type:"library",version:d.version}}).sort((d,p)=>(d["bom-ref"]??"").localeCompare(p["bom-ref"]??"")),b=m.map(d=>{const p=[...new Set(d.deps.filter(k=>o||k.kind!=="dev").map(k=>l(k)).filter(k=>k!==void 0&&h.has(k)).map(k=>i(k)))].sort(),f=i(d);return p.length>0?{dependsOn:p,ref:f}:{ref:f}}).sort((d,p)=>d.ref.localeCompare(p.ref));return{components:y,dependencies:b}},le=(e,n)=>`pkg:hex/${encodeURIComponent(e)}@${encodeURIComponent(n)}`,ue=/^\s*"[^"]+":\s*\{:hex,\s*:([a-z_]\w*),\s*"([^"]+)"/,q=e=>{const n=[];for(const t of e.split(/\r?\n/)){const o=ue.exec(t);if(o?.[1]===void 0||o[2]===void 0)continue;const s=[];for(const c of t.matchAll(/\{:([a-z_]\w*),\s*"/g))s.push({kind:"main",name:c[1]});n.push({deps:s,member:!0,name:o[1],version:o[2]})}return n},Oe=(e,n={})=>{let t;try{t=_(x(e,"mix.lock"),"utf8")}catch{return{components:[],dependencies:[]}}return V(q(t),{includeDev:n.includeDev,normalize:o=>o,purl:le})},pe=(e,n)=>`pkg:nuget/${encodeURIComponent(e)}@${encodeURIComponent(n)}`,$=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),I=e=>e.toLowerCase(),z=e=>{let n;try{n=JSON.parse(e)}catch{return[]}if(!$(n)||!$(n.dependencies))return[];const t=[];for(const i of Object.values(n.dependencies)){if(!$(i))continue;const a=new Map;for(const[l,u]of Object.entries(i))$(u)&&a.set(l,{depIds:$(u.dependencies)?Object.keys(u.dependencies):[],resolved:typeof u.resolved=="string"?u.resolved:void 0,type:typeof u.type=="string"?u.type:""});t.push(a)}const o=new Set;let s=!1;for(const i of t)for(const a of i.values())if(a.type==="Direct"&&(s=!0),a.type==="Project")for(const l of a.depIds)o.add(I(l));const c=new Map;for(const i of t)for(const[a,l]of i){if(l.type==="Project"||l.resolved===void 0)continue;const u=`${I(a)}\0${l.resolved}`,g=c.get(u)??{deps:[],member:!1,name:a,version:l.resolved};c.set(u,g),l.type==="Direct"&&(g.member=!0);for(const h of l.depIds){const v=i.get(h)?.resolved;v!==void 0&&g.deps.push({kind:"main",name:h,version:v})}}const r=!s&&o.size===0;return[...c.values()].map(i=>({...i,member:r||i.member||o.has(I(i.name))}))},Ge=e=>{let n;try{n=_(x(e,"packages.lock.json"),"utf8")}catch{return{components:[],dependencies:[]}}return V(z(n),{normalize:I,purl:pe})},H={"crates.io":["Cargo.lock"],Go:["go.sum"],Hex:["mix.lock"],Maven:["gradle.lockfile","pom.xml"],NuGet:["packages.lock.json"],Packagist:["composer.lock"],Pub:["pubspec.lock"],PyPI:["uv.lock","poetry.lock","Pipfile.lock"],RubyGems:["Gemfile.lock"],SwiftURL:["Package.resolved"]},fe={cargo:"crates.io",composer:"Packagist","crates.io":"crates.io",dart:"Pub",go:"Go",gradle:"Maven",hex:"Hex",maven:"Maven",npm:"npm",nuget:"NuGet",packagist:"Packagist",pub:"Pub",pypi:"PyPI",rubygems:"RubyGems",swift:"SwiftURL",swifturl:"SwiftURL"},R=e=>fe[e.toLowerCase()]??e,Le=e=>H[R(e)]??[],ve=(e,n)=>{const t=R(n),o=H[t]??[];for(const s of o){const c=K(e,s);if(E(c))return c}},F=e=>{const n=new Set,t=[];for(const o of e){const s=`${o.name}@${o.version}`;n.has(s)||(n.add(s),t.push(o))}return t},me=/\[\[package\]\]([\s\S]*?)(?=\[\[|$)/g,ge=/^\s*name\s*=\s*"([^"]+)"\s*$/m,he=/^\s*version\s*=\s*"([^"]+)"\s*$/m,ke=e=>{const n=[];for(const t of e.matchAll(me)){const o=t[1]??"",s=ge.exec(o)?.[1],c=he.exec(o)?.[1];s&&c&&n.push({isDev:!1,name:s,version:c})}return n},ye=e=>{let n;try{n=JSON.parse(e)}catch{return[]}if(typeof n!="object"||n===null)return[];const t=[];for(const o of["default","develop"]){const s=n[o];if(!(typeof s!="object"||s===null))for(const[c,r]of Object.entries(s)){if(typeof r!="object"||r===null)continue;const i=r.version;if(typeof i!="string")continue;const a=i.replace(/^==/,"").trim();a.length>0&&t.push({isDev:!1,name:c,version:a})}}return t},be=e=>{const n=[];let t;try{t=JSON.parse(e)}catch{return n}for(const[o,s]of[["packages",!1],["packages-dev",!0]]){const c=t[o];if(Array.isArray(c))for(const r of c)typeof r.name=="string"&&typeof r.version=="string"&&n.push({isDev:s,name:r.name,version:ee(r.version)})}return n},Pe=e=>{const n=[];for(const t of e.split(/\r?\n/)){const o=t.trim();if(o.length===0)continue;const s=o.split(/\s+/);if(s.length<3)continue;const[c,r]=s;if(!c||!r?.endsWith("/go.mod"))continue;const i=r.slice(0,-7);i.length!==0&&n.push({isDev:!1,name:c,version:i})}return n},we=/^ {4}([^ ()]+) \(([^()]+)\)\s*$/,Se=e=>{const n=[];let t=!1,o=!1;for(const s of e.split(/\r?\n/)){if(s.startsWith("GEM")){t=!0,o=!1;continue}if(t&&/^[A-Z]/.test(s)){t=!1,o=!1;continue}if(t&&s.trim()==="specs:"){o=!0;continue}if(o){const c=we.exec(s);if(c){const[,r,i]=c,a=i?.split("-")[0];r&&a&&n.push({isDev:!1,name:r,version:a})}}}return n},$e=e=>{const n=[];let t=!1;for(const o of e.split(/\r?\n/)){if(/^\S/.test(o)){t=o.trimEnd()==="packages:";continue}const s=n.at(-1),c=/^ {2}(\S+):\s*$/.exec(o);if(t&&c?.[1]!==void 0){n.push({name:c[1]});continue}const[,r,i]=/^ {4}(dependency|source|version): "?([^"]*)"?\s*$/.exec(o)??[];t&&s!==void 0&&r!==void 0&&i!==void 0&&(r==="source"?s.source=i:r==="version"?s.version=i:s.dependency=i)}return n.filter(o=>o.source==="hosted"&&o.version!==void 0&&o.version.length>0).map(o=>({isDev:o.dependency==="direct dev",name:o.name,version:o.version}))},_e=e=>e.trim().replace(/^[a-z+]+:\/\//i,"").replace(/^[^@/]+@([^:/]+):/,"$1/").replace(/\.git$/,"").replace(/\/+$/,""),Ie=e=>{let n;try{n=JSON.parse(e)}catch{return[]}const t=typeof n=="object"&&n!==null?n.pins:void 0;if(!Array.isArray(t))return[];const o=[];for(const s of t)typeof s.location=="string"&&typeof s.state?.version=="string"&&s.state.version.length>0&&o.push({isDev:!1,name:_e(s.location),version:s.state.version});return o},W=e=>{const n=[],t=[];for(const o of T(e))for(const s of o.dependencies){if(s.group===void 0||s.artifact===void 0||s.version===void 0){t.push(s.group!==void 0&&s.artifact!==void 0?`${s.group}:${s.artifact}`:s.unresolved??"");continue}n.push({isDev:!1,name:`${s.group}:${s.artifact}`,version:s.version})}for(const o of U(e))n.push({isDev:!1,name:`${o.group}:${o.artifact}`,version:o.version});return{packages:F(n),unresolved:[...new Set(t)]}},Ne=e=>W(e).unresolved,Ae=(e,n)=>{if(R(n)==="Maven")return W(e).packages;const t=ve(e,n);if(!t)return[];let o;try{o=_(t,"utf8")}catch{return[]}const s=t.split(/[/\\]/).pop()??"";let c;switch(s){case"Cargo.lock":case"poetry.lock":case"uv.lock":{c=ke(o);break}case"composer.lock":{c=be(o);break}case"Gemfile.lock":{c=Se(o);break}case"go.sum":{c=Pe(o);break}case"mix.lock":{c=q(o).map(r=>({isDev:!1,name:r.name,version:r.version}));break}case"Package.resolved":{c=Ie(o);break}case"packages.lock.json":{c=z(o).map(r=>({isDev:!1,name:r.name,version:r.version}));break}case"Pipfile.lock":{c=ye(o);break}case"pubspec.lock":{c=$e(o);break}default:return[]}return F(c)};export{Oe as a,V as b,R as c,De as d,Ce as e,Ge as f,ae as g,ve as h,Le as i,Ae as l,Ne as m};
+import{createRequire as J}from"node:module";import{e as K}from"./index-BzhrR_iC.js";import{G as X}from"../packem_chunks/catalog.js";import{e as L,i as Z,s as Q}from"./maven-pom-B0KG9kJQ.js";import{c as ee}from"./composer-DR3D-Psb.js";let Y;const B=e=>(Y??=J(import.meta.url))(e),S=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,O=e=>{if(typeof S<"u"&&S.versions&&S.versions.node){const[n,t]=S.versions.node.split(".").map(Number);if(n>22||n===22&&t>=3||n===20&&t>=16)return S.getBuiltinModule(e)}return B(e)},{existsSync:E,readFileSync:_}=O("node:fs"),{resolve:w,dirname:M,join:x}=O("node:path"),oe=8,ne=8,te="vis:maven:version-unresolved",N=(e,n,t)=>`pkg:maven/${encodeURIComponent(e)}/${encodeURIComponent(n)}${t===void 0?"":`@${encodeURIComponent(t)}`}`,A=e=>{if(E(e))try{return{path:e,scan:Q(_(e,"utf8"))}}catch{return}},D=e=>{const n=e.scan.parent;if(!n)return;const t=n.relativePath||"../pom.xml",o=t.endsWith(".xml")?w(M(e.path),t):w(M(e.path),t,"pom.xml"),s=A(o);return s&&s.scan.artifactId?.value===n.artifactId?.value&&L(s.scan)===n.groupId?.value?s:void 0},se=e=>{const n=[e];let t=D(e);for(;t&&n.length<oe;)n.push(t),t=D(t);return n},P=(e,n,t=0)=>{if(e===""||t>ne)return;let o=!1;const s=e.replaceAll(/\$\{([^}]+)\}/g,(c,r)=>{const i=n(r),a=i===void 0?void 0:P(i,n,t+1);return a===void 0?(o=!0,""):a});return o||s.includes("${")?void 0:s},C=(e,n)=>{if(e===void 0)return{unresolved:""};const t=P(e,n);return t===void 0||!Z(t)?{unresolved:e}:{version:t}},re=e=>{const n=[],t=new Set,o=s=>{const c=w(s),r=A(c);if(!(!r||t.has(c))){t.add(c),n.push(se(r));for(const i of r.scan.modules)o(i.endsWith(".xml")?w(M(c),i):w(M(c),i,"pom.xml"))}};return o(e),n},T=e=>{const n=[];for(const t of re(w(e,"pom.xml"))){const o=t[0].scan,s=new Map;for(const m of t)for(const[y,b]of m.scan.properties)s.has(y)||s.set(y,b.value);const c=L(o),r=o.artifactId?.value,i=o.version?.value??o.parent?.version?.value,a=o.parent?.version?.value,l=m=>{switch(m){case"artifactId":case"pom.artifactId":case"project.artifactId":return r;case"groupId":case"pom.groupId":case"project.groupId":return c;case"pom.version":case"project.version":case"version":return i;case"project.parent.version":return a;default:return s.get(m)}},u=c===void 0?void 0:P(c,l),g=r===void 0?void 0:P(r,l),h=C(i,l),v=new Map;for(const m of t)for(const y of m.scan.dependencies){const b=y.groupId?.value??"",d=y.artifactId?.value??"",p=`${b}:${d}`;if(v.has(p))continue;const f=P(b,l),k=P(d,l),j=f===void 0||k===void 0?{unresolved:y.version?.value??""}:C(y.version?.value,l);v.set(p,{artifact:k,group:f,scope:y.scope?.value??"compile",unresolved:f===void 0||k===void 0?p:j.unresolved,version:j.version})}n.push({artifact:g,dependencies:[...v.values()],group:u,path:t[0].path,unresolved:h.unresolved,version:h.version})}return n},G=e=>e==="test"||e==="provided",ce=(e,n)=>{const t=new Set(n),o=new Map;for(const r of e)r.group!==void 0&&r.artifact!==void 0&&o.set(`${r.group}:${r.artifact}`,r);const s=new Set(e.filter(r=>r.artifact!==void 0&&t.has(r.artifact))),c=[...s];for(;c.length>0;){const r=c.shift();for(const i of r.dependencies){const a=o.get(`${i.group}:${i.artifact}`);a!==void 0&&!s.has(a)&&(s.add(a),c.push(a))}}return e.filter(r=>s.has(r))},De=(e,n={})=>{const t=n.includeDev??!1,o=new Map,s=new Map,c=(a,l,u,g,h)=>{const v=N(a,l,u);if(!o.has(v)){const m={"bom-ref":v,group:a,name:l,purl:v,type:"library"};u!==void 0&&(m.version=u),g!==void 0&&(m.properties=[{name:te,value:g}]),h!==void 0&&(m.scope=h),o.set(v,m)}return v},r=T(e);for(const a of n.focusNames===void 0?r:ce(r,n.focusNames)){const l=a.group!==void 0&&a.artifact!==void 0?c(a.group,a.artifact,a.version,a.unresolved):void 0;for(const u of a.dependencies){if(G(u.scope)&&!t||u.group===void 0||u.artifact===void 0)continue;const g=c(u.group,u.artifact,u.version,u.unresolved,G(u.scope)?"optional":"required");l!==void 0&&s.set(l,(s.get(l)??new Set).add(g))}}const i=[...o.values()].sort((a,l)=>(a["bom-ref"]??"").localeCompare(l["bom-ref"]??""));return{components:i,dependencies:i.map(a=>{const l=a["bom-ref"]??"",u=[...s.get(l)??[]].sort();return u.length>0?{dependsOn:u,ref:l}:{ref:l}})}},ie=e=>{const n=[];for(const t of e.split(/\r?\n/)){const o=t.trim();if(o.length===0||o.startsWith("#"))continue;const s=o.indexOf("="),c=(s===-1?o:o.slice(0,s)).split(":");if(c.length<3||!c[0]||!c[1]||!c[2])continue;const r=s===-1?[]:o.slice(s+1).split(",").map(i=>i.trim()).filter(i=>i.length>0);n.push({artifact:c[1],configurations:r,group:c[0],version:c[2]})}return n},ae=e=>["",...X(e,[])].map(t=>x(e,t,"gradle.lockfile")).filter(t=>E(t)),U=e=>{const n=[];for(const t of ae(e))try{n.push(...ie(_(t,"utf8")))}catch{}return n},de=e=>e.configurations.length>0&&e.configurations.every(n=>/test/i.test(n)),Ce=(e,n={})=>{const t=n.includeDev??!1,o=new Map;for(const r of U(e)){const i=N(r.group,r.artifact,r.version),a=o.get(i),l=de(r);o.set(i,{dev:(a?.dev??!0)&&l,entry:r})}const s=[...o.keys()].filter(r=>t||!o.get(r).dev).sort();return{components:s.map(r=>{const{dev:i,entry:a}=o.get(r);return{"bom-ref":r,group:a.group,name:a.artifact,purl:r,scope:i?"optional":"required",type:"library",version:a.version}}),dependencies:s.map(r=>({ref:r}))}},V=(e,n)=>{const{focusNames:t,includeDev:o=!1,normalize:s,purl:c}=n,r=new Map;for(const d of e){const p=`${s(d.name)}@${d.version}`;r.set(p,(r.get(p)??0)+1)}const i=d=>{const p=(r.get(`${s(d.name)}@${d.version}`)??0)>1,f=c(d.name,d.version);return p&&d.source!==void 0?`${f}?source=${encodeURIComponent(d.source)}`:f},a=new Map;for(const d of e){const p=s(d.name);a.set(p,[...a.get(p)??[],d])}const l=d=>{const p=(a.get(s(d.name))??[]).filter(f=>(d.version===void 0||f.version===d.version)&&(d.source===void 0||f.source===d.source));return p.length===1?p[0]:void 0},u=t===void 0?void 0:new Set(t.map(d=>s(d))),g=e.filter(d=>d.member&&(u===void 0||u.has(s(d.name)))),h=new Set(g),v=[...g];for(;v.length>0;){const d=v.shift();for(const p of d.deps){if(p.kind==="dev"&&!o)continue;const f=l(p);f!==void 0&&!h.has(f)&&(h.add(f),v.push(f))}}const m=[...h],y=m.map(d=>{const p=i(d);return{"bom-ref":p,name:d.name,purl:p,type:"library",version:d.version}}).sort((d,p)=>(d["bom-ref"]??"").localeCompare(p["bom-ref"]??"")),b=m.map(d=>{const p=[...new Set(d.deps.filter(k=>o||k.kind!=="dev").map(k=>l(k)).filter(k=>k!==void 0&&h.has(k)).map(k=>i(k)))].sort(),f=i(d);return p.length>0?{dependsOn:p,ref:f}:{ref:f}}).sort((d,p)=>d.ref.localeCompare(p.ref));return{components:y,dependencies:b}},le=(e,n)=>`pkg:hex/${encodeURIComponent(e)}@${encodeURIComponent(n)}`,ue=/^\s*"[^"]+":\s*\{:hex,\s*:([a-z_]\w*),\s*"([^"]+)"/,q=e=>{const n=[];for(const t of e.split(/\r?\n/)){const o=ue.exec(t);if(o?.[1]===void 0||o[2]===void 0)continue;const s=[];for(const c of t.matchAll(/\{:([a-z_]\w*),\s*"/g))s.push({kind:"main",name:c[1]});n.push({deps:s,member:!0,name:o[1],version:o[2]})}return n},Ge=(e,n={})=>{let t;try{t=_(x(e,"mix.lock"),"utf8")}catch{return{components:[],dependencies:[]}}return V(q(t),{includeDev:n.includeDev,normalize:o=>o,purl:le})},pe=(e,n)=>`pkg:nuget/${encodeURIComponent(e)}@${encodeURIComponent(n)}`,$=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),I=e=>e.toLowerCase(),z=e=>{let n;try{n=JSON.parse(e)}catch{return[]}if(!$(n)||!$(n.dependencies))return[];const t=[];for(const i of Object.values(n.dependencies)){if(!$(i))continue;const a=new Map;for(const[l,u]of Object.entries(i))$(u)&&a.set(l,{depIds:$(u.dependencies)?Object.keys(u.dependencies):[],resolved:typeof u.resolved=="string"?u.resolved:void 0,type:typeof u.type=="string"?u.type:""});t.push(a)}const o=new Set;let s=!1;for(const i of t)for(const a of i.values())if(a.type==="Direct"&&(s=!0),a.type==="Project")for(const l of a.depIds)o.add(I(l));const c=new Map;for(const i of t)for(const[a,l]of i){if(l.type==="Project"||l.resolved===void 0)continue;const u=`${I(a)}\0${l.resolved}`,g=c.get(u)??{deps:[],member:!1,name:a,version:l.resolved};c.set(u,g),l.type==="Direct"&&(g.member=!0);for(const h of l.depIds){const v=i.get(h)?.resolved;v!==void 0&&g.deps.push({kind:"main",name:h,version:v})}}const r=!s&&o.size===0;return[...c.values()].map(i=>({...i,member:r||i.member||o.has(I(i.name))}))},Oe=e=>{let n;try{n=_(x(e,"packages.lock.json"),"utf8")}catch{return{components:[],dependencies:[]}}return V(z(n),{normalize:I,purl:pe})},F={"crates.io":["Cargo.lock"],Go:["go.sum"],Hex:["mix.lock"],Maven:["gradle.lockfile","pom.xml"],NuGet:["packages.lock.json"],Packagist:["composer.lock"],Pub:["pubspec.lock"],PyPI:["uv.lock","poetry.lock","Pipfile.lock"],RubyGems:["Gemfile.lock"],SwiftURL:["Package.resolved"]},fe={cargo:"crates.io",composer:"Packagist","crates.io":"crates.io",dart:"Pub",go:"Go",gradle:"Maven",hex:"Hex",maven:"Maven",npm:"npm",nuget:"NuGet",packagist:"Packagist",pub:"Pub",pypi:"PyPI",rubygems:"RubyGems",swift:"SwiftURL",swifturl:"SwiftURL"},R=e=>fe[e.toLowerCase()]??e,Le=e=>F[R(e)]??[],ve=(e,n)=>{const t=R(n),o=F[t]??[];for(const s of o){const c=K(e,s);if(E(c))return c}},H=e=>{const n=new Set,t=[];for(const o of e){const s=`${o.name}@${o.version}`;n.has(s)||(n.add(s),t.push(o))}return t},me=/\[\[package\]\]([\s\S]*?)(?=\[\[|$)/g,ge=/^\s*name\s*=\s*"([^"]+)"\s*$/m,he=/^\s*version\s*=\s*"([^"]+)"\s*$/m,ke=e=>{const n=[];for(const t of e.matchAll(me)){const o=t[1]??"",s=ge.exec(o)?.[1],c=he.exec(o)?.[1];s&&c&&n.push({isDev:!1,name:s,version:c})}return n},ye=e=>{let n;try{n=JSON.parse(e)}catch{return[]}if(typeof n!="object"||n===null)return[];const t=[];for(const o of["default","develop"]){const s=n[o];if(!(typeof s!="object"||s===null))for(const[c,r]of Object.entries(s)){if(typeof r!="object"||r===null)continue;const i=r.version;if(typeof i!="string")continue;const a=i.replace(/^==/,"").trim();a.length>0&&t.push({isDev:!1,name:c,version:a})}}return t},be=e=>{const n=[];let t;try{t=JSON.parse(e)}catch{return n}for(const[o,s]of[["packages",!1],["packages-dev",!0]]){const c=t[o];if(Array.isArray(c))for(const r of c)typeof r.name=="string"&&typeof r.version=="string"&&n.push({isDev:s,name:r.name,version:ee(r.version)})}return n},Pe=e=>{const n=[];for(const t of e.split(/\r?\n/)){const o=t.trim();if(o.length===0)continue;const s=o.split(/\s+/);if(s.length<3)continue;const[c,r]=s;if(!c||!r?.endsWith("/go.mod"))continue;const i=r.slice(0,-7);i.length!==0&&n.push({isDev:!1,name:c,version:i})}return n},we=/^ {4}([^ ()]+) \(([^()]+)\)\s*$/,Se=e=>{const n=[];let t=!1,o=!1;for(const s of e.split(/\r?\n/)){if(s.startsWith("GEM")){t=!0,o=!1;continue}if(t&&/^[A-Z]/.test(s)){t=!1,o=!1;continue}if(t&&s.trim()==="specs:"){o=!0;continue}if(o){const c=we.exec(s);if(c){const[,r,i]=c,a=i?.split("-")[0];r&&a&&n.push({isDev:!1,name:r,version:a})}}}return n},$e=e=>{const n=[];let t=!1;for(const o of e.split(/\r?\n/)){if(/^\S/.test(o)){t=o.trimEnd()==="packages:";continue}const s=n.at(-1),c=/^ {2}(\S+):\s*$/.exec(o);if(t&&c?.[1]!==void 0){n.push({name:c[1]});continue}const[,r,i]=/^ {4}(dependency|source|version): "?([^"]*)"?\s*$/.exec(o)??[];t&&s!==void 0&&r!==void 0&&i!==void 0&&(r==="source"?s.source=i:r==="version"?s.version=i:s.dependency=i)}return n.filter(o=>o.source==="hosted"&&o.version!==void 0&&o.version.length>0).map(o=>({isDev:o.dependency==="direct dev",name:o.name,version:o.version}))},_e=e=>e.trim().replace(/^[a-z+]+:\/\//i,"").replace(/^[^@/]+@([^:/]+):/,"$1/").replace(/\.git$/,"").replace(/\/+$/,""),Ie=e=>{let n;try{n=JSON.parse(e)}catch{return[]}const t=typeof n=="object"&&n!==null?n.pins:void 0;if(!Array.isArray(t))return[];const o=[];for(const s of t)typeof s.location=="string"&&typeof s.state?.version=="string"&&s.state.version.length>0&&o.push({isDev:!1,name:_e(s.location),version:s.state.version});return o},W=e=>{const n=[],t=[];for(const o of T(e))for(const s of o.dependencies){if(s.group===void 0||s.artifact===void 0||s.version===void 0){t.push(s.group!==void 0&&s.artifact!==void 0?`${s.group}:${s.artifact}`:s.unresolved??"");continue}n.push({isDev:!1,name:`${s.group}:${s.artifact}`,version:s.version})}for(const o of U(e))n.push({isDev:!1,name:`${o.group}:${o.artifact}`,version:o.version});return{packages:H(n),unresolved:[...new Set(t)]}},Ne=e=>W(e).unresolved,Ae=(e,n)=>{if(R(n)==="Maven")return W(e).packages;const t=ve(e,n);if(!t)return[];let o;try{o=_(t,"utf8")}catch{return[]}const s=t.split(/[/\\]/).pop()??"";let c;switch(s){case"Cargo.lock":case"poetry.lock":case"uv.lock":{c=ke(o);break}case"composer.lock":{c=be(o);break}case"Gemfile.lock":{c=Se(o);break}case"go.sum":{c=Pe(o);break}case"mix.lock":{c=q(o).map(r=>({isDev:!1,name:r.name,version:r.version}));break}case"Package.resolved":{c=Ie(o);break}case"packages.lock.json":{c=z(o).map(r=>({isDev:!1,name:r.name,version:r.version}));break}case"Pipfile.lock":{c=ye(o);break}case"pubspec.lock":{c=$e(o);break}default:return[]}return H(c)};export{Ge as a,V as b,R as c,De as d,Ce as e,Oe as f,ae as g,ve as h,Le as i,Ae as l,Ne as m};