"use strict";
/**
 * Migration: Add security overrides
 *
 * Adds npm overrides for high/critical transitive dependency vulnerabilities
 * that can be resolved without breaking changes:
 * - shell-quote (critical): unescaped newlines in .op values
 * - undici (high): TLS bypass, header injection, DoS, etc.
 * - ws (high): memory disclosure + exhaustion DoS
 * - qs (high): prototype pollution
 * - axios (high): update existing override from vulnerable ^1.15.1 to ^1.16.0
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.default = update;
const devkit_1 = require("@nx/devkit");
const SECURITY_OVERRIDES = {
    'shell-quote': '>=1.9.0',
    undici: '>=7.28.0',
    ws: '>=8.21.0',
    qs: '>=6.14.0',
    axios: '^1.16.0',
};
async function update(tree) {
    devkit_1.logger.info('🔄 Adding security overrides for high/critical vulnerabilities...');
    const packageJsonPath = 'package.json';
    if (!tree.exists(packageJsonPath)) {
        devkit_1.logger.warn('⚠️ No package.json found, skipping');
        return;
    }
    const added = [];
    const updated = [];
    (0, devkit_1.updateJson)(tree, packageJsonPath, (packageJson) => {
        if (!packageJson.overrides) {
            packageJson.overrides = {};
        }
        for (const [pkg, version] of Object.entries(SECURITY_OVERRIDES)) {
            if (packageJson.overrides[pkg]) {
                if (packageJson.overrides[pkg] !== version) {
                    packageJson.overrides[pkg] = version;
                    updated.push(`${pkg}@${version}`);
                }
            }
            else {
                packageJson.overrides[pkg] = version;
                added.push(`${pkg}@${version}`);
            }
        }
        return packageJson;
    });
    if (added.length > 0) {
        devkit_1.logger.info(`📦 Added overrides: ${added.join(', ')}`);
    }
    if (updated.length > 0) {
        devkit_1.logger.info(`📦 Updated overrides: ${updated.join(', ')}`);
    }
    if (added.length === 0 && updated.length === 0) {
        devkit_1.logger.info('ℹ️ All security overrides already present');
    }
    devkit_1.logger.info('✅ Security overrides applied');
}
