var I=Object.defineProperty;var d=(s,e)=>I(s,"name",{value:e,configurable:!0});import{createRequire as $}from"node:module";import{p as j}from"../packem_chunks/config.js";import{advisoriesStatus as E,NATIVE_BINDING_VERSION as A,advisoriesIngest as q,advisoriesQuery as B}from"#native";const T=$(import.meta.url),v=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,l=d(s=>{if(typeof v<"u"&&v.versions&&v.versions.node){const[e,t]=v.versions.node.split(".").map(Number);if(e>22||e===22&&t>=3||e===20&&t>=16)return v.getBuiltinModule(s)}return T(s)},"__cjs_getBuiltinModule"),{randomUUID:O}=l("node:crypto"),{createWriteStream:P,existsSync:k}=l("node:fs"),{mkdir:U,unlink:x,stat:C}=l("node:fs/promises"),{join:w,dirname:L}=l("node:path"),{Readable:M}=l("node:stream"),{pipeline:W}=l("node:stream/promises");var F=Object.defineProperty,r=d((s,e)=>F(s,"name",{value:e,configurable:!0}),"s");const b=5;if(A!==b)throw new Error(`vis native binding ABI mismatch in advisories: expected ${b}, got ${A}. Rebuild via \`pnpm --filter @visulima/vis run build:native\` or reinstall the platform binding package.`);const es="https://osv-vulnerabilities.storage.googleapis.com",V=new Set(["osv-vulnerabilities.storage.googleapis.com"]);class H extends Error{static{d(this,"AdvisoryDbNotFoundError")}static{r(this,"AdvisoryDbNotFoundError")}cause="DB_NOT_FOUND";constructor(e){super(`No local advisory DB at ${e}. Run 'vis advisories sync' first.`),this.name="AdvisoryDbNotFoundError"}}class h extends Error{static{d(this,"AdvisorySourceNotAllowedError")}static{r(this,"AdvisorySourceNotAllowedError")}cause="SOURCE_NOT_ALLOWED";constructor(e){super(`Advisory source host '${e}' is not in the built-in allowlist. Add it to \`security.audit.advisories.allowedHosts\` if intentional.`),this.name="AdvisorySourceNotAllowedError"}}class N extends Error{static{d(this,"AdvisorySyncNetworkError")}static{r(this,"AdvisorySyncNetworkError")}cause="SYNC_NETWORK";constructor(e,t){super(`Advisory sync failed for ${e}: ${t}. Check connectivity, proxy env vars, or --source.`),this.name="AdvisorySyncNetworkError"}}const g=r(s=>{const e=j("vis",{create:!0,cwd:s})??w(s,"node_modules",".cache","vis");return w(e,"advisories","db.sqlite")},"resolveAdvisoryDbPath"),z=r((s,e)=>{let t;try{t=new URL(s)}catch{throw new h(s)}if(t.protocol!=="https:")throw new h(`${t.protocol}//${t.host}`);if(!new Set([...V,...e??[]]).has(t.host))throw new h(t.host);return t},"validateAdvisorySource"),ts=r(async s=>{const e=s.dbPath??g(s.workspaceRoot);await U(L(e),{recursive:!0});const t=z(s.source,s.allowedHosts),u=new URL(`${s.ecosystem}/all.zip`,Q(t.toString())),y=await G(e,s.ecosystem);let i=null;if(!s.force){const n=await S(u,{method:"HEAD"});if(n.ok&&(i=n.headers.get("etag"),i&&y&&i===y))return{advisoriesIngested:0,dbPath:e,durationMs:0,upToDate:!0}}const a=`${e}.${s.ecosystem}.${process.pid}.${O()}.zip.tmp`,o=await S(u,{method:"GET"});if(!o.ok||!o.body)throw new N(u.toString(),o.status);i||(i=o.headers.get("etag"));const m=o.headers.get("content-length"),c=m?Number.parseInt(m,10):null;let p=0;const _=P(a),f=M.fromWeb(o.body);s.onProgress&&c&&f.on("data",n=>{p+=n.byteLength,s.onProgress?.(p,c,"download")}),await W(f,_);try{const n=await q({dbPath:e,ecosystem:s.ecosystem,manifestEtag:i??void 0,zipPath:a},(D,R)=>s.onProgress?.(D,R,"ingest"));return{advisoriesIngested:n.advisoriesIngested,dbPath:e,durationMs:n.durationMs,upToDate:!1}}finally{await x(a).catch(()=>{})}},"syncAdvisories"),rs=r((s,e)=>{if(s.length===0)return new Map;const t=e.dbPath??g(e.workspaceRoot),u=e.ecosystem??"npm";if(!k(t))throw new H(t);const y=s.map(o=>({ecosystem:u,name:o.name,version:o.version})),i=B(t,y),a=new Map;for(const[o,m]of s.entries()){const c=i[o];!c||c.vulnerabilities.length===0||a.set(m.name,c.vulnerabilities.map(p=>K(p)))}return a},"queryAdvisories"),os=r(async(s,e)=>{const t=e??g(s);return E(t)},"getAdvisoryStatus"),G=r(async(s,e)=>{try{await C(s)}catch{return null}return E(s).ecosystems.find(t=>t.name===e)?.manifestEtag??null},"readStoredEtag"),K=r(s=>({aliases:s.aliases.length>0?s.aliases:void 0,cvssScore:s.cvssScore??void 0,fixedVersions:s.fixedVersions,id:s.id,severity:Y(s.severity),summary:s.summary}),"toSecurityVulnerability"),Y=r(s=>{const e=s.toUpperCase();return e==="CRITICAL"||e==="HIGH"||e==="MODERATE"||e==="LOW"?e:"UNKNOWN"},"normalizeSeverity"),Q=r(s=>s.endsWith("/")?s:`${s}/`,"ensureTrailingSlash"),S=r(async(s,e)=>{try{return await fetch(s,e)}catch(t){throw new N(s.toString(),t instanceof Error?t.message:String(t))}},"safeFetch");export{H as A,es as D,os as g,rs as q,g as r,ts as s};
