@visulima/vis 5.0.0 → 6.0.1

package/dist/packem_chunks/loader.js

@@ -1,4 +1,4 @@
-import{createRequire as f}from"node:module";import{d as p,c as I}from"../packem_shared/pm-runner-3iiQayy-.js";let _;const w=e=>(_??=f(import.meta.url))(e),o=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,g=e=>{if(typeof o<"u"&&o.versions&&o.versions.node){const[t,r]=o.versions.node.split(".").map(Number);if(t>22||t===22&&r>=3||t===20&&r>=16)return o.getBuiltinModule(e)}return w(e)},{createInterface:y}=g("node:readline"),s="sigstore",v=()=>!!process.stdout.isTTY&&process.env.CI!=="true",$=e=>new Promise(t=>{const r=y({input:process.stdin,output:process.stderr});r.question(`${e} (Y/n) `,a=>{r.close();const n=a.trim().toLowerCase();t(n===""||n==="y"||n==="yes")})}),h=e=>{const t=p(e),r=I(t,{exact:!1,filter:[],global:!1,optional:!1,packages:[s],peer:!1,saveDev:!0,workspace:!1,workspaceRoot:!1},e,console);return Promise.resolve({exitCode:r})},C=()=>{try{return import.meta.resolve(s),!0}catch{return!1}},R=e=>{let t="pnpm";try{t=p(e).name}catch{}switch(t){case"bun":return`bun add -d ${s}`;case"npm":return`npm install -D ${s}`;case"yarn":return`yarn add -D ${s}`;default:return`pnpm add -D ${s}`}},D=()=>import("sigstore"),E=async(e={})=>{const t=e.interactive??v(),r=e.prompt??$,a=e.runInstall??h,n=e.importImpl??D,l=e.workspaceRoot??process.cwd(),i=R(l);try{return await n()}catch(d){const{code:u,message:m}=d;if(!(u==="ERR_MODULE_NOT_FOUND"||u==="MODULE_NOT_FOUND")||!m.includes(s))throw d}if(!t)throw new Error(`${s} is not installed. \`vis attest\` needs it for keyless signing/verification. Install it in your repo first:
+import{createRequire as f}from"node:module";import{d as p,c as I}from"../packem_shared/pm-runner-RM72mDZg.js";let _;const w=e=>(_??=f(import.meta.url))(e),o=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,g=e=>{if(typeof o<"u"&&o.versions&&o.versions.node){const[t,r]=o.versions.node.split(".").map(Number);if(t>22||t===22&&r>=3||t===20&&r>=16)return o.getBuiltinModule(e)}return w(e)},{createInterface:y}=g("node:readline"),s="sigstore",v=()=>!!process.stdout.isTTY&&process.env.CI!=="true",$=e=>new Promise(t=>{const r=y({input:process.stdin,output:process.stderr});r.question(`${e} (Y/n) `,a=>{r.close();const n=a.trim().toLowerCase();t(n===""||n==="y"||n==="yes")})}),h=e=>{const t=p(e),r=I(t,{exact:!1,filter:[],global:!1,optional:!1,packages:[s],peer:!1,saveDev:!0,workspace:!1,workspaceRoot:!1},e,console);return Promise.resolve({exitCode:r})},C=()=>{try{return import.meta.resolve(s),!0}catch{return!1}},R=e=>{let t="pnpm";try{t=p(e).name}catch{}switch(t){case"bun":return`bun add -d ${s}`;case"npm":return`npm install -D ${s}`;case"yarn":return`yarn add -D ${s}`;default:return`pnpm add -D ${s}`}},D=()=>import("sigstore"),E=async(e={})=>{const t=e.interactive??v(),r=e.prompt??$,a=e.runInstall??h,n=e.importImpl??D,l=e.workspaceRoot??process.cwd(),i=R(l);try{return await n()}catch(d){const{code:u,message:m}=d;if(!(u==="ERR_MODULE_NOT_FOUND"||u==="MODULE_NOT_FOUND")||!m.includes(s))throw d}if(!t)throw new Error(`${s} is not installed. \`vis attest\` needs it for keyless signing/verification. Install it in your repo first:
   ${i}`);if(!await r(`${s} isn't installed. Install it now?`))throw new Error(`${s} install declined. Re-run \`vis attest\` after installing manually:
   ${i}`);const c=await a(l);if(c.exitCode!==0)throw new Error(`Install of ${s} failed (exit ${String(c.exitCode)}). Install manually and retry:
   ${i}`);return await n()};export{R as installCommandFor,C as isSigstoreInstalled,E as loadOptionalSigstore};

package/dist/packem_chunks/prompts.js

@@ -1,4 +1,4 @@
-import{createRequire as p}from"node:module";import{F as i}from"../packem_shared/index.server-sXNQYpsl.js";let m;const d=r=>(m??=p(import.meta.url))(r),c=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,w=r=>{if(typeof c<"u"&&c.versions&&c.versions.node){const[e,t]=c.versions.node.split(".").map(Number);if(e>22||e===22&&t>=3||e===20&&t>=16)return c.getBuiltinModule(r)}return d(r)},{createInterface:a}=w("node:readline"),l=(r,e)=>new Promise(t=>{r.question(e,n=>{t(n.trim())})}),y=async(r,e=!0)=>{const t=a({input:process.stdin,output:process.stdout});try{const s=await l(t,`${r} ${i(e?"[Y/n]":"[y/N]")} `);return s===""?e:/^y(?:es)?$/i.test(s)}finally{t.close()}},$=async(r,e="")=>{const t=a({input:process.stdin,output:process.stdout});try{const n=e?` ${i(`(${e})`)}`:"",s=await l(t,`${r}${n} `);return s===""?e:s}finally{t.close()}},_=async(r,e)=>{if(e.length===0)throw new Error("selectPrompt called with no options.");const t=a({input:process.stdin,output:process.stdout});try{process.stdout.write(`${r}
+import{createRequire as p}from"node:module";import{F as i}from"../packem_shared/index.server-Ca_EEVfw.js";let m;const d=r=>(m??=p(import.meta.url))(r),c=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,w=r=>{if(typeof c<"u"&&c.versions&&c.versions.node){const[e,t]=c.versions.node.split(".").map(Number);if(e>22||e===22&&t>=3||e===20&&t>=16)return c.getBuiltinModule(r)}return d(r)},{createInterface:a}=w("node:readline"),l=(r,e)=>new Promise(t=>{r.question(e,n=>{t(n.trim())})}),y=async(r,e=!0)=>{const t=a({input:process.stdin,output:process.stdout});try{const s=await l(t,`${r} ${i(e?"[Y/n]":"[y/N]")} `);return s===""?e:/^y(?:es)?$/i.test(s)}finally{t.close()}},$=async(r,e="")=>{const t=a({input:process.stdin,output:process.stdout});try{const n=e?` ${i(`(${e})`)}`:"",s=await l(t,`${r}${n} `);return s===""?e:s}finally{t.close()}},_=async(r,e)=>{if(e.length===0)throw new Error("selectPrompt called with no options.");const t=a({input:process.stdin,output:process.stdout});try{process.stdout.write(`${r}
 `);for(const[n,s]of e.entries())process.stdout.write(`  ${n+1}) ${s.label}
 `);for(;;){const n=await l(t,i(`  [1-${e.length}] `)),s=Number.parseInt(n,10);if(!Number.isNaN(s)&&s>=1&&s<=e.length)return e[s-1].value;process.stdout.write(i(`  Please enter a number between 1 and ${e.length}.
 `))}}finally{t.close()}},b=async(r,e)=>{if(e.length===0)throw new Error("multiSelectPrompt called with no options.");const t=a({input:process.stdin,output:process.stdout});try{process.stdout.write(`${r}

package/dist/packem_chunks/status.js

@@ -1,2 +1,2 @@
-import{b as d,F as i,J as l}from"../packem_shared/index.server-sXNQYpsl.js";import{p as a}from"./cli-main.js";import{r as y,g}from"./catalog.js";const h=n=>{if(n===0)return"0 B";const r=["B","KB","MB","GB"],o=Math.min(Math.floor(Math.log(n)/Math.log(1024)),r.length-1),s=n/1024**o;return`${s.toFixed(s<10&&o>0?1:0)} ${r[o]}`},v=n=>{if(!n)return"never";const r=Date.parse(n);if(Number.isNaN(r))return n;const o=Date.now()-r;if(o<0)return n;const s=Math.floor(o/6e4);if(s<1)return"just now";if(s<60)return`${s}m ago`;const t=Math.floor(s/60);return t<24?`${t}h ago`:`${Math.floor(t/24)}d ago`},$=async({logger:n,options:r,workspaceRoot:o})=>{if(!o)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const s=r.db??y(o),t=await g(o,s);if(r.format==="json"){process.stdout.write(`${JSON.stringify({dbPath:s,ecosystems:t.ecosystems.map(e=>({advisoryCount:e.advisoryCount,lastSyncIso:e.lastSyncIso,manifestEtag:e.manifestEtag??null,name:e.name})),exists:t.exists,schemaVersion:t.schemaVersion,sizeBytes:t.sizeBytes},void 0,2)}
+import{b as d,F as i,J as l}from"../packem_shared/index.server-Ca_EEVfw.js";import{p as a}from"./cli-main.js";import{r as y,g}from"./catalog.js";const h=n=>{if(n===0)return"0 B";const r=["B","KB","MB","GB"],o=Math.min(Math.floor(Math.log(n)/Math.log(1024)),r.length-1),s=n/1024**o;return`${s.toFixed(s<10&&o>0?1:0)} ${r[o]}`},v=n=>{if(!n)return"never";const r=Date.parse(n);if(Number.isNaN(r))return n;const o=Date.now()-r;if(o<0)return n;const s=Math.floor(o/6e4);if(s<1)return"just now";if(s<60)return`${s}m ago`;const t=Math.floor(s/60);return t<24?`${t}h ago`:`${Math.floor(t/24)}d ago`},$=async({logger:n,options:r,workspaceRoot:o})=>{if(!o)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const s=r.db??y(o),t=await g(o,s);if(r.format==="json"){process.stdout.write(`${JSON.stringify({dbPath:s,ecosystems:t.ecosystems.map(e=>({advisoryCount:e.advisoryCount,lastSyncIso:e.lastSyncIso,manifestEtag:e.manifestEtag??null,name:e.name})),exists:t.exists,schemaVersion:t.schemaVersion,sizeBytes:t.sizeBytes},void 0,2)}
 `);return}if(a.info(`DB: ${s}`),!t.exists){a.warn(`No advisory DB yet. Run ${d("vis advisories sync")} to populate.`);return}if(a.info(`Schema: v${t.schemaVersion}   Size: ${h(t.sizeBytes)}`),t.ecosystems.length===0){a.warn("DB exists but contains no ecosystems. Run `vis advisories sync`.");return}a.info(""),a.info("Ecosystem    Advisories   Last sync           ETag"),a.info(i("──────────   ──────────   ─────────────────   ──────"));for(const e of t.ecosystems){const c=e.name.padEnd(10),u=e.advisoryCount.toLocaleString().padStart(10),m=`${e.lastSyncIso||"never"} (${v(e.lastSyncIso)})`.padEnd(19),f=e.manifestEtag??i("—");a.info(`${l(c)}   ${u}   ${m}   ${f}`)}},E=$;export{E as advisoriesStatusExecute};

package/dist/packem_chunks/sync.js

@@ -1,3 +1,3 @@
-import{F as v}from"../packem_shared/index.server-sXNQYpsl.js";import{p as c}from"./cli-main.js";import{s as S}from"../packem_shared/scan-progress-CkumcBG-.js";import{D as $,s as b,A as D}from"./catalog.js";import{c as w}from"../packem_shared/multi-eco-lockfiles-B2X3yhyo.js";const E=o=>o?.security?.audit?.advisories??{},A=o=>o?o.split(",").map(t=>t.trim()).filter(t=>t.length>0).map(t=>w(t)):["npm"],C=async({logger:o,options:t,visConfig:p,workspaceRoot:d})=>{if(!d)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const l=t.format==="json",u=E(p),m=t.source??u.source??$,f=A(t.ecosystem),y=f.map(s=>({id:s,label:`Sync ${s} advisories`})),n=S(y,{live:!l}),i=[];try{for(const s of f){n.start(s);const e=Date.now();try{const r=await b({allowedHosts:u.allowedHosts,dbPath:t.db,ecosystem:s,force:!!t.force,source:m,workspaceRoot:d});i.push({ecosystem:s,result:r}),r.upToDate?n.finish(s,"ok",`up to date · ${h(Date.now()-e)}`):n.finish(s,"ok",`${r.advisoriesIngested.toLocaleString()} advisories · ${h(r.durationMs)}`)}catch(r){const a=r instanceof Error?r.message:String(r);i.push({ecosystem:s,error:a}),n.finish(s,"error",a)}}}finally{n.stop()}const g=i.find(s=>s.result?.rebuiltFromSchema!==void 0)?.result?.rebuiltFromSchema;if(g!==void 0){const s=`advisory database is schema v${String(g)}; rebuilt to v${String(D)}`;l?process.stderr.write(`${s}
+import{F as v}from"../packem_shared/index.server-Ca_EEVfw.js";import{p as c}from"./cli-main.js";import{s as S}from"../packem_shared/scan-progress-RwCRxJdX.js";import{D as $,s as b,A as D}from"./catalog.js";import{c as w}from"../packem_shared/multi-eco-lockfiles-B2X3yhyo.js";const E=o=>o?.security?.audit?.advisories??{},A=o=>o?o.split(",").map(t=>t.trim()).filter(t=>t.length>0).map(t=>w(t)):["npm"],C=async({logger:o,options:t,visConfig:p,workspaceRoot:d})=>{if(!d)throw new Error("Could not determine workspace root. Run this command inside a workspace.");const l=t.format==="json",u=E(p),m=t.source??u.source??$,f=A(t.ecosystem),y=f.map(s=>({id:s,label:`Sync ${s} advisories`})),n=S(y,{live:!l}),i=[];try{for(const s of f){n.start(s);const e=Date.now();try{const r=await b({allowedHosts:u.allowedHosts,dbPath:t.db,ecosystem:s,force:!!t.force,source:m,workspaceRoot:d});i.push({ecosystem:s,result:r}),r.upToDate?n.finish(s,"ok",`up to date · ${h(Date.now()-e)}`):n.finish(s,"ok",`${r.advisoriesIngested.toLocaleString()} advisories · ${h(r.durationMs)}`)}catch(r){const a=r instanceof Error?r.message:String(r);i.push({ecosystem:s,error:a}),n.finish(s,"error",a)}}}finally{n.stop()}const g=i.find(s=>s.result?.rebuiltFromSchema!==void 0)?.result?.rebuiltFromSchema;if(g!==void 0){const s=`advisory database is schema v${String(g)}; rebuilt to v${String(D)}`;l?process.stderr.write(`${s}
 `):c.info(s)}if(l){const s={ecosystems:i.map(e=>({advisoriesIngested:e.result?.advisoriesIngested??0,dbPath:e.result?.dbPath??null,durationMs:e.result?.durationMs??0,ecosystem:e.ecosystem,error:e.error??null,upToDate:e.result?.upToDate??!1})),source:m};process.stdout.write(`${JSON.stringify(s,void 0,2)}
 `)}else{const s=i.filter(a=>a.error),e=i.filter(a=>a.result),r=e[0];r?.result?.dbPath&&c.info(v(`DB: ${r.result.dbPath}`)),s.length===0?c.success(`Synced ${e.length} ecosystem${e.length===1?"":"s"}.`):c.error(`${s.length} ecosystem${s.length===1?"":"s"} failed to sync.`)}i.some(s=>s.error)&&(process.exitCode=1)},h=o=>o>=1e3?`${(o/1e3).toFixed(1)}s`:`${Math.round(o)}ms`,M=C;export{M as advisoriesSyncExecute,A as parseEcosystems};

package/dist/packem_chunks/sync2.js

@@ -1,2 +1,2 @@
-import{p as n}from"./cli-main.js";import{d as u}from"../packem_shared/pm-runner-3iiQayy-.js";import{s as p}from"../packem_shared/native-config-sync-TdTWjVgI.js";import{s as g}from"../packem_shared/min-release-age-JViyQuBM.js";const y=new Set(["bun","npm","pnpm","yarn"]),S=({options:c,visConfig:a,workspaceRoot:l})=>{const i=l??process.cwd(),e=u(i);if(!y.has(e.name)){n.warn(`Package manager '${e.name}' has no native security config to sync.`);return}if(!a?.security){n.warn("vis.config has no `security` block — nothing to sync.");return}const t=a.security.policies??{},r=Object.fromEntries(Object.entries(t.installScripts?.allow??{}).filter(([,o])=>o)),f=t.firstSeen?.minutes,m=t.firstSeen?.exclude??[],s=[];if(Object.keys(r).length>0&&!c.skipAllowBuilds&&s.push(...p(e.name,i,r)),c.skipMinReleaseAge||s.push(...g(e.name,i,f,m)),s.length===0){n.success("Nothing to sync — vis.config and native PM config are aligned.");return}n.info(`Syncing vis.config security settings to ${e.name} native config…
+import{p as n}from"./cli-main.js";import{d as u}from"../packem_shared/pm-runner-RM72mDZg.js";import{s as p}from"../packem_shared/native-config-sync-TdTWjVgI.js";import{s as g}from"../packem_shared/min-release-age-JViyQuBM.js";const y=new Set(["bun","npm","pnpm","yarn"]),S=({options:c,visConfig:a,workspaceRoot:l})=>{const i=l??process.cwd(),e=u(i);if(!y.has(e.name)){n.warn(`Package manager '${e.name}' has no native security config to sync.`);return}if(!a?.security){n.warn("vis.config has no `security` block — nothing to sync.");return}const t=a.security.policies??{},r=Object.fromEntries(Object.entries(t.installScripts?.allow??{}).filter(([,o])=>o)),f=t.firstSeen?.minutes,m=t.firstSeen?.exclude??[],s=[];if(Object.keys(r).length>0&&!c.skipAllowBuilds&&s.push(...p(e.name,i,r)),c.skipMinReleaseAge||s.push(...g(e.name,i,f,m)),s.length===0){n.success("Nothing to sync — vis.config and native PM config are aligned.");return}n.info(`Syncing vis.config security settings to ${e.name} native config…
 `);for(const o of s)n.success(`  ${o}`)};export{S as default};

package/dist/packem_chunks/tripwire.js

@@ -1,2 +1,2 @@
-import{createRequire as g}from"node:module";import{e as p}from"../packem_shared/index-BzhrR_iC.js";import{p as e}from"./cli-main.js";import{d as _}from"../packem_shared/pm-runner-3iiQayy-.js";import{y as u}from"../packem_shared/isAccessibleSync-DYKTrrvc-C-_5cgwu.js";import{p as m}from"../packem_shared/readJsonSync-CbryXYxN-EWl7_7KX.js";import{U as $}from"../packem_shared/writeFileSync-DJoHk3Ks-BPRoepNw.js";let y;const w=r=>(y??=g(import.meta.url))(r),c=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,v=r=>{if(typeof c<"u"&&c.versions&&c.versions.node){const[n,s]=c.versions.node.split(".").map(Number);if(n>22||n===22&&s>=3||n===20&&s>=16)return c.getBuiltinModule(r)}return w(r)},{spawnSync:h}=v("node:child_process"),t="@lavamoat/preinstall-always-fail",d=r=>{const n=p(r,"package.json");if(!u(n))return"no-package-json";try{const s=m(n);if(s.devDependencies?.[t]||s.dependencies?.[t])return"installed"}catch{}return"missing"},k=r=>{const n=p(r,"package.json");if(!u(n))return!1;try{const s=m(n);let i=!1;const l=a=>!a||!(t in a)?a:(i=!0,Object.fromEntries(Object.entries(a).filter(([o])=>o!==t)));return s.devDependencies=l(s.devDependencies),s.dependencies=l(s.dependencies),i&&$(n,`${JSON.stringify(s,null,2)}
+import{createRequire as g}from"node:module";import{e as p}from"../packem_shared/index-BzhrR_iC.js";import{p as e}from"./cli-main.js";import{d as _}from"../packem_shared/pm-runner-RM72mDZg.js";import{y as u}from"../packem_shared/isAccessibleSync-DYKTrrvc-C-_5cgwu.js";import{p as m}from"../packem_shared/readJsonSync-CbryXYxN-EWl7_7KX.js";import{U as $}from"../packem_shared/writeFileSync-DJoHk3Ks-BPRoepNw.js";let y;const w=r=>(y??=g(import.meta.url))(r),c=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,v=r=>{if(typeof c<"u"&&c.versions&&c.versions.node){const[n,s]=c.versions.node.split(".").map(Number);if(n>22||n===22&&s>=3||n===20&&s>=16)return c.getBuiltinModule(r)}return w(r)},{spawnSync:h}=v("node:child_process"),t="@lavamoat/preinstall-always-fail",d=r=>{const n=p(r,"package.json");if(!u(n))return"no-package-json";try{const s=m(n);if(s.devDependencies?.[t]||s.dependencies?.[t])return"installed"}catch{}return"missing"},k=r=>{const n=p(r,"package.json");if(!u(n))return!1;try{const s=m(n);let i=!1;const l=a=>!a||!(t in a)?a:(i=!0,Object.fromEntries(Object.entries(a).filter(([o])=>o!==t)));return s.devDependencies=l(s.devDependencies),s.dependencies=l(s.dependencies),i&&$(n,`${JSON.stringify(s,null,2)}
 `),i}catch{return!1}},I=({options:r,workspaceRoot:n})=>{const s=n??process.cwd();if(r.status){switch(d(s)){case"installed":{e.success(`Preinstall tripwire is installed (${t}).`),e.info("Removing 'ignore-scripts=true' will cause future installs to fail loudly.");break}case"missing":{e.warn("Preinstall tripwire is not installed."),e.info(`Run 'vis security tripwire' to add ${t} as a devDependency.`);break}default:e.error("No package.json found at the workspace root."),process.exitCode=1}return}if(r.remove){k(s)?e.success(`Removed ${t} from package.json. Run your PM's install to clean node_modules.`):e.info(`${t} was not present in package.json.`);return}if(d(s)==="installed"){e.info(`${t} is already installed.`);return}const i=_(s),a={bun:["add","-d",t],npm:["install","--save-dev",t],pnpm:["add","-D","-w",t],yarn:["add","-D",t]}[i.name];if(!a){e.error(`Cannot install tripwire — unsupported package manager '${i.name}'.`),process.exitCode=1;return}e.info(`Installing ${t} via ${i.name}…`);const o=h(i.name,a,{cwd:s,stdio:"inherit"});if(o.error){e.error(`Failed to install tripwire: ${o.error.message}`),process.exitCode=1;return}if(o.signal!==null){e.error(`${i.name} was terminated by signal ${o.signal}`),process.exitCode=1;return}if(o.status!==0){e.error(`${i.name} exited with code ${String(o.status)}`),process.exitCode=o.status??1;return}e.success(`Installed ${t} as a devDependency.`),e.notice(""),e.notice("How the tripwire works:"),e.notice(`  ${t} declares a preinstall script that always fails.`),e.notice("  When 'ignore-scripts=true' is set (.npmrc / bunfig.toml / .yarnrc.yml),"),e.notice("  the script is skipped and installs succeed normally. If someone deletes"),e.notice("  that setting, the next install fails — loudly — instead of silently"),e.notice("  running every dependency's lifecycle scripts.")};export{I as default};

package/dist/packem_chunks/verify-lockfile.js

@@ -1,2 +1,2 @@
-import{p}from"./cli-main.js";import{d as b}from"../packem_shared/pm-runner-3iiQayy-.js";import{r as m,l as w,L as v}from"../packem_shared/dependency-scan-B8jroa1D.js";import{z as S,e as g}from"../packem_shared/index-BzhrR_iC.js";import{S as $}from"../packem_shared/lockfile-DhHAaHN5.js";import{e as x}from"../packem_shared/index-nEyN71oX.js";import{y as C}from"../packem_shared/isAccessibleSync-DYKTrrvc-C-_5cgwu.js";const E=e=>{const o=e.trim();return o===""?!1:/^(?:git\+|git:\/\/|git@|ssh:\/\/)/i.test(o)||/^(?:github|gitlab|bitbucket|gist):/i.test(o)||/^[\w.-]+\/[\w.-]+(?:#.+)?$/.test(o)&&!o.includes("@")?!0:/^https?:\/\//i.test(o)},M=(e,o)=>{for(const i of o)if(i===e||i.endsWith("*")&&e.startsWith(i.slice(0,-1)))return!0;return!1},L=(e,o,i={})=>{const t=m(e,o);if(!t)return[];let s;try{s=S(g(e,t.file))}catch{return[]}const n=$(s,t.type);if(n.length===0)return[];const r=i.allow??[],l=[],f=new Set;for(const c of n){const a=`${c.name}@${c.version}`;for(const d of[c.dependencies,c.optionalDependencies])if(d){for(const[u,h]of Object.entries(d))if(!M(u,r))for(const k of h){if(!E(k))continue;const y=`${a}->${u}@${k}`;f.has(y)||(f.add(y),l.push({declaredBy:a,packageName:u,source:k}))}}}return l.sort((c,a)=>c.packageName.localeCompare(a.packageName)||c.declaredBy.localeCompare(a.declaredBy))},D=new Set(["firstSeen","publisherChange"]),I=e=>e.severity==="block"&&e.acceptedRisk===void 0,N=e=>{const o=e.security?.policies?.firstSeen?.minutes,i=typeof o=="number"&&o>0,t=e.security?.policies?.publisherChange?.mode==="no-downgrade",s=e.security?.blockExoticSubdeps===!0;return i||t||s},O=async e=>{const{offline:o=!1,packageManager:i,visConfig:t,workspaceRoot:s}=e,n=Date.now();if(!N(t))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!1,status:"skipped"};const r=m(s,i);if(!r||!C(g(s,r.file)))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!0,status:"fail"};const l=w(s,i,{includeDev:!0}),f=l.length,c=await x({offline:o,packageManager:i,packages:l,workspaceRoot:s},"install",{enabledPolicies:new Set(D),visConfig:t}),a=t.security?.blockExoticSubdeps===!0?L(s,i,{allow:t.security.exoticSubdepsAllow}):[],d=c.some(u=>I(u))||a.length>0;return{decisions:c,durationMs:Date.now()-n,entryCount:f,exoticViolations:a,lockfileMissing:!1,status:d?"fail":"pass"}},P=e=>e<1e3?`${String(e)}ms`:`${(e/1e3).toFixed(1)}s`,V=e=>{if(e.status==="skipped")return["– Lockfile supply-chain verification skipped (no firstSeen / publisherChange / blockExoticSubdeps policy configured)"];if(e.lockfileMissing)return["✗ Lockfile supply-chain verification failed — no lockfile found, the resolved closure cannot be attested"];const o=`(${String(e.entryCount)} ${e.entryCount===1?"entry":"entries"}, ${P(e.durationMs)})`;if(e.status==="pass")return[`✓ Lockfile passes supply-chain policies ${o}`];const i=[`✗ Lockfile failed supply-chain policy check ${o}`];for(const t of e.decisions)t.severity==="block"&&t.acceptedRisk===void 0&&i.push(`  [${t.policy}] ${t.reason}`);for(const t of e.exoticViolations)i.push(`  [blockExoticSubdeps] ${t.packageName} pulled from exotic source by ${t.declaredBy}: ${t.source}`);return i},z=async({options:e,visConfig:o,workspaceRoot:i})=>{const t=i??process.cwd(),s=b(t);if(!v[s.name]){p.warn(`Package manager '${s.name}' has no lockfile vis can verify.`);return}const n=await O({offline:!!e.offline,packageManager:s.name,visConfig:o??{},workspaceRoot:t});if(e.json){process.stdout.write(`${JSON.stringify(n,void 0,2)}
+import{p}from"./cli-main.js";import{d as b}from"../packem_shared/pm-runner-RM72mDZg.js";import{r as m,l as w,L as v}from"../packem_shared/dependency-scan-B8jroa1D.js";import{z as S,e as g}from"../packem_shared/index-BzhrR_iC.js";import{S as $}from"../packem_shared/lockfile-DhHAaHN5.js";import{e as x}from"../packem_shared/index-DGdD4w-b.js";import{y as C}from"../packem_shared/isAccessibleSync-DYKTrrvc-C-_5cgwu.js";const E=e=>{const o=e.trim();return o===""?!1:/^(?:git\+|git:\/\/|git@|ssh:\/\/)/i.test(o)||/^(?:github|gitlab|bitbucket|gist):/i.test(o)||/^[\w.-]+\/[\w.-]+(?:#.+)?$/.test(o)&&!o.includes("@")?!0:/^https?:\/\//i.test(o)},M=(e,o)=>{for(const i of o)if(i===e||i.endsWith("*")&&e.startsWith(i.slice(0,-1)))return!0;return!1},L=(e,o,i={})=>{const t=m(e,o);if(!t)return[];let s;try{s=S(g(e,t.file))}catch{return[]}const n=$(s,t.type);if(n.length===0)return[];const r=i.allow??[],l=[],f=new Set;for(const c of n){const a=`${c.name}@${c.version}`;for(const d of[c.dependencies,c.optionalDependencies])if(d){for(const[u,h]of Object.entries(d))if(!M(u,r))for(const k of h){if(!E(k))continue;const y=`${a}->${u}@${k}`;f.has(y)||(f.add(y),l.push({declaredBy:a,packageName:u,source:k}))}}}return l.sort((c,a)=>c.packageName.localeCompare(a.packageName)||c.declaredBy.localeCompare(a.declaredBy))},D=new Set(["firstSeen","publisherChange"]),I=e=>e.severity==="block"&&e.acceptedRisk===void 0,N=e=>{const o=e.security?.policies?.firstSeen?.minutes,i=typeof o=="number"&&o>0,t=e.security?.policies?.publisherChange?.mode==="no-downgrade",s=e.security?.blockExoticSubdeps===!0;return i||t||s},O=async e=>{const{offline:o=!1,packageManager:i,visConfig:t,workspaceRoot:s}=e,n=Date.now();if(!N(t))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!1,status:"skipped"};const r=m(s,i);if(!r||!C(g(s,r.file)))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!0,status:"fail"};const l=w(s,i,{includeDev:!0}),f=l.length,c=await x({offline:o,packageManager:i,packages:l,workspaceRoot:s},"install",{enabledPolicies:new Set(D),visConfig:t}),a=t.security?.blockExoticSubdeps===!0?L(s,i,{allow:t.security.exoticSubdepsAllow}):[],d=c.some(u=>I(u))||a.length>0;return{decisions:c,durationMs:Date.now()-n,entryCount:f,exoticViolations:a,lockfileMissing:!1,status:d?"fail":"pass"}},P=e=>e<1e3?`${String(e)}ms`:`${(e/1e3).toFixed(1)}s`,V=e=>{if(e.status==="skipped")return["– Lockfile supply-chain verification skipped (no firstSeen / publisherChange / blockExoticSubdeps policy configured)"];if(e.lockfileMissing)return["✗ Lockfile supply-chain verification failed — no lockfile found, the resolved closure cannot be attested"];const o=`(${String(e.entryCount)} ${e.entryCount===1?"entry":"entries"}, ${P(e.durationMs)})`;if(e.status==="pass")return[`✓ Lockfile passes supply-chain policies ${o}`];const i=[`✗ Lockfile failed supply-chain policy check ${o}`];for(const t of e.decisions)t.severity==="block"&&t.acceptedRisk===void 0&&i.push(`  [${t.policy}] ${t.reason}`);for(const t of e.exoticViolations)i.push(`  [blockExoticSubdeps] ${t.packageName} pulled from exotic source by ${t.declaredBy}: ${t.source}`);return i},z=async({options:e,visConfig:o,workspaceRoot:i})=>{const t=i??process.cwd(),s=b(t);if(!v[s.name]){p.warn(`Package manager '${s.name}' has no lockfile vis can verify.`);return}const n=await O({offline:!!e.offline,packageManager:s.name,visConfig:o??{},workspaceRoot:t});if(e.json){process.stdout.write(`${JSON.stringify(n,void 0,2)}
 `),n.status==="fail"&&(process.exitCode=1);return}const[r,...l]=V(n);if(n.status==="skipped"){p.info(r);return}if(n.status==="pass"){p.success(r);return}p.error(r);for(const f of l)p.error(f);process.exitCode=1};export{z as default};