/* Socket Lib - Built with esbuild */
var u=Object.defineProperty;var v=Object.getOwnPropertyDescriptor;var S=Object.getOwnPropertyNames;var A=Object.prototype.hasOwnProperty;var R=(e,t)=>{for(var n in t)u(e,n,{get:t[n],enumerable:!0})},x=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of S(t))!A.call(e,o)&&o!==n&&u(e,o,{get:()=>t[o],enumerable:!(r=v(t,o))||r.enumerable});return e};var E=e=>x(u({},"__esModule",{value:!0}),e);var V={};R(V,{fetchPackageProvenance:()=>I,getProvenanceDetails:()=>k});module.exports=E(V);var w=require("#constants/agents"),p=require("../abort"),d=require("../url");const T=Array.isArray,D="https://slsa.dev/provenance/v0.2",U="https://slsa.dev/provenance/v1";let l;function C(){if(l===void 0){const e=require("../external/make-fetch-happen"),{getPacoteCachePath:t}=require("../constants/packages");l=e.defaults({cachePath:t(),cache:"force-cache"})}return l}function N(e){const t=e;return!t.attestations||!T(t.attestations)?[]:t.attestations.filter(n=>{const r=n;return r.predicateType===D||r.predicateType===U})}function O(e){for(const t of e){const n=t;try{let r=n.predicate;if(!r&&n.bundle?.dsseEnvelope?.payload)try{const s=Buffer.from(n.bundle.dsseEnvelope.payload,"base64").toString("utf8");r=JSON.parse(s).predicate}catch{continue}const o=r;if(o?.buildDefinition?.externalParameters)return{predicate:r,externalParameters:o.buildDefinition.externalParameters}}catch{}}}function f(e){if(typeof e!="string"||!e)return!1;let t=(0,d.parseUrl)(e),n=t?.hostname;if(!t&&e.includes("@")){const r=e.split("@")[0];r&&(t=(0,d.parseUrl)(r)),t&&(n=t.hostname)}if(!t){const r=(0,d.parseUrl)(`https://${e}`);r&&(n=r.hostname)}return n?n==="github.com"||n.endsWith(".github.com")||n==="gitlab.com"||n.endsWith(".gitlab.com"):e.includes("github")||e.includes("gitlab")}function k(e){const t=N(e);if(!t.length)return;const n=O(t);if(!n)return{level:"attested"};const r=n,{externalParameters:o,predicate:s}=r,c=s?.buildDefinition,i=o?.workflow,a=i?.ref||o?.workflow_ref,m=o?.context,g=c?.buildType,h=i?.repository||o?.repository,y=o?.ref||i?.ref,P=o?.sha,b=o?.run_id,_=f(a)||f(m)||f(g)||f(h);return{commitSha:P,gitRef:y,level:_?"trusted":"attested",repository:h,workflowRef:a,workflowUrl:m,workflowPlatform:g,workflowRunId:b}}async function I(e,t,n){const{signal:r,timeout:o=1e4}={__proto__:null,...n};if(r?.aborted)return;const s=(0,p.createTimeoutSignal)(o),c=(0,p.createCompositeAbortSignal)(r,s),i=C();try{const a=await i(`${w.NPM_REGISTRY_URL}/-/npm/v1/attestations/${encodeURIComponent(e)}@${encodeURIComponent(t)}`,{method:"GET",signal:c,headers:{"User-Agent":"socket-registry"}});if(a.ok)return k(await a.json())}catch{}}0&&(module.exports={fetchPackageProvenance,getProvenanceDetails});
//# sourceMappingURL=provenance.js.map
