"use strict";
/* Socket Lib - Built with rolldown */
Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
const require_primordials_error = require('../primordials/error.js');
const require_primordials_string = require('../primordials/string.js');
const require_primordials_map_set = require('../primordials/map-set.js');
const require_primordials_promise = require('../primordials/promise.js');
const require_http_request_user_agent = require('../http-request/user-agent.js');
const require_http_request_node = require('../http-request/node.js');

//#region src/dlx/firewall.ts
const FIREWALL_API_URL = "https://firewall-api.socket.dev/purl";
const FIREWALL_TIMEOUT = 1e4;
const FIREWALL_BLOCK_SEVERITIES = new require_primordials_map_set.SetCtor(["critical", "high"]);
/**
* Check all resolved packages in an Arborist ideal tree against the Socket
* Firewall API (public, no auth required). Throws if any dependency has
* critical or high severity alerts.
*
* @private
*
* @param arb - Arborist instance with populated idealTree.
* @param requestedPackage - Top-level package name (for error messages)
*/
async function checkFirewallPurls(arb, requestedPackage) {
	const idealTree = arb.idealTree;
	if (!idealTree) return;
	const purls = [];
	for (const node of idealTree.inventory.values()) {
		if (node.isProjectRoot) continue;
		const { name, version } = node.package;
		if (!name || !version) continue;
		purls.push({
			purl: npmPurl(name, version),
			name,
			version
		});
	}
	if (purls.length === 0) return;
	const blocked = [];
	await require_primordials_promise.PromiseAllSettled(purls.map(async ({ name, purl, version }) => {
		try {
			const blocking = ((await require_http_request_node.httpJson(`${FIREWALL_API_URL}/${encodeURIComponent(purl)}`, {
				headers: { "User-Agent": require_http_request_user_agent.getSocketCallerUserAgent() },
				timeout: FIREWALL_TIMEOUT,
				retries: 1,
				retryDelay: 500
			})).alerts ?? []).filter((a) => a.severity && FIREWALL_BLOCK_SEVERITIES.has(a.severity));
			if (blocking.length > 0) blocked.push({
				name,
				version,
				alerts: blocking.map((a) => `${a.severity}: ${a.type ?? a.key ?? "unknown"}`)
			});
		} catch {}
	}));
	if (blocked.length > 0) throw new require_primordials_error.ErrorCtor(`Socket Firewall blocked installation of "${requestedPackage}".\nThe following dependencies have security alerts:\n${blocked.map((b) => `  ${b.name}@${b.version}: ${b.alerts.join(", ")}`).join("\n")}\n\nVisit https://socket.dev for more information.`);
}
/**
* Build a PURL string for an npm package. Follows the PURL spec for the npm
* type: - Scoped: `@scope/pkg` → `pkg:npm/%40scope/pkg@version` - Unscoped:
* `pkg` → `pkg:npm/pkg@version`
*/
function npmPurl(name, version) {
	return `pkg:npm/${require_primordials_string.StringPrototypeStartsWith(name, "@") ? `%40${require_primordials_string.StringPrototypeSlice(name, 1)}` : name}@${require_primordials_string.StringPrototypeReplace(version, /\+/g, "%2B")}`;
}

//#endregion
exports.checkFirewallPurls = checkFirewallPurls;
exports.npmPurl = npmPurl;