var $=Object.defineProperty;var k=(e,o)=>$(e,"name",{value:o,configurable:!0});import{p}from"./bin.js";import{A as S}from"../packem_shared/pm-runner-DmKT2FqF.js";import{r as v,l as x,L as C}from"../packem_shared/dependency-scan-B70azq4x.js";import{B as M,M as h,l as L}from"../packem_shared/readFileSync-DseCu8sg-DEq4Fn3a.js";import{S as E}from"../packem_shared/lockfile-CedmXr44.js";import{e as P}from"../packem_shared/index-BpbjpCNL.js";var D=Object.defineProperty,m=k((e,o)=>D(e,"name",{value:o,configurable:!0}),"r");const V=m(e=>{const o=e.trim();return o===""?!1:/^(?:git\+|git:\/\/|git@|ssh:\/\/)/i.test(o)||/^(?:github|gitlab|bitbucket|gist):/i.test(o)||/^[\w.-]+\/[\w.-]+(?:#.+)?$/.test(o)&&!o.includes("@")?!0:/^https?:\/\//i.test(o)},"isExoticSpecifier"),N=m((e,o)=>{for(const s of o)if(s===e||s.endsWith("*")&&e.startsWith(s.slice(0,-1)))return!0;return!1},"matchesAllow"),O=m((e,o,s={})=>{const t=v(e,o);if(!t)return[];let i;try{i=M(h(e,t.file))}catch{return[]}const n=E(i,t.type);if(n.length===0)return[];const c=s.allow??[],l=[],f=new Set;for(const r of n){const a=`${r.name}@${r.version}`;for(const g of[r.dependencies,r.optionalDependencies])if(g){for(const[u,w]of Object.entries(g))if(!N(u,c))for(const y of w){if(!V(y))continue;const b=`${a}->${u}@${y}`;f.has(b)||(f.add(b),l.push({declaredBy:a,packageName:u,source:y}))}}}return l.sort((r,a)=>r.packageName.localeCompare(a.packageName)||r.declaredBy.localeCompare(a.declaredBy))},"scanExoticSubdeps");var R=Object.defineProperty,d=k((e,o)=>R(e,"name",{value:o,configurable:!0}),"n");const j=new Set(["firstSeen","publisherChange"]),B=d(e=>e.severity==="block"&&e.acceptedRisk===void 0,"isGatingDecision"),A=d(e=>{const o=e.security?.policies?.firstSeen?.minutes,s=typeof o=="number"&&o>0,t=e.security?.policies?.publisherChange?.mode==="no-downgrade",i=e.security?.blockExoticSubdeps===!0;return s||t||i},"anyPolicyConfigured"),F=d(async e=>{const{offline:o=!1,packageManager:s,visConfig:t,workspaceRoot:i}=e,n=Date.now();if(!A(t))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!1,status:"skipped"};const c=v(i,s);if(!c||!L(h(i,c.file)))return{decisions:[],durationMs:Date.now()-n,entryCount:0,exoticViolations:[],lockfileMissing:!0,status:"fail"};const l=x(i,s,{includeDev:!0}),f=l.length,r=await P({offline:o,packageManager:s,packages:l,workspaceRoot:i},"install",{enabledPolicies:new Set(j),visConfig:t}),a=t.security?.blockExoticSubdeps===!0?O(i,s,{allow:t.security.exoticSubdepsAllow}):[],g=r.some(u=>B(u))||a.length>0;return{decisions:r,durationMs:Date.now()-n,entryCount:f,exoticViolations:a,lockfileMissing:!1,status:g?"fail":"pass"}},"verifyLockfile"),W=d(e=>e<1e3?`${String(e)}ms`:`${(e/1e3).toFixed(1)}s`,"formatElapsed"),G=d(e=>{if(e.status==="skipped")return["– Lockfile supply-chain verification skipped (no firstSeen / publisherChange / blockExoticSubdeps policy configured)"];if(e.lockfileMissing)return["✗ Lockfile supply-chain verification failed — no lockfile found, the resolved closure cannot be attested"];const o=`(${String(e.entryCount)} ${e.entryCount===1?"entry":"entries"}, ${W(e.durationMs)})`;if(e.status==="pass")return[`✓ Lockfile passes supply-chain policies ${o}`];const s=[`✗ Lockfile failed supply-chain policy check ${o}`];for(const t of e.decisions)t.severity==="block"&&t.acceptedRisk===void 0&&s.push(`  [${t.policy}] ${t.reason}`);for(const t of e.exoticViolations)s.push(`  [blockExoticSubdeps] ${t.packageName} pulled from exotic source by ${t.declaredBy}: ${t.source}`);return s},"formatLockfileVerification");var I=Object.defineProperty,J=k((e,o)=>I(e,"name",{value:o,configurable:!0}),"a");const U=J(async({options:e,visConfig:o,workspaceRoot:s})=>{const t=s??process.cwd(),i=S(t);if(!C[i.name]){p.warn(`Package manager '${i.name}' has no lockfile vis can verify.`);return}const n=await F({offline:!!e.offline,packageManager:i.name,visConfig:o??{},workspaceRoot:t});if(e.json){process.stdout.write(`${JSON.stringify(n,void 0,2)}
`),n.status==="fail"&&(process.exitCode=1);return}const[c,...l]=G(n);if(n.status==="skipped"){p.info(c);return}if(n.status==="pass"){p.success(c);return}p.error(c);for(const f of l)p.error(f);process.exitCode=1},"execute");export{U as default};
