var y=Object.defineProperty;var w=(r,e)=>y(r,"name",{value:e,configurable:!0});import{I as N,E as $,T as M,e as R}from"../packem_shared/Table-3pFgIUZ2-DABgc6rj.js";import{p as g}from"./bin.js";import{r as S,M as x,a as A,b,c as P,d as j,e as C,f as E,g as B,h as D}from"../packem_shared/s1ngularity-adnHbyTd.js";import{g as O,a as V,r as F}from"../packem_shared/provenance-Cu6VR1Hy.js";import{r as I}from"../packem_shared/signatures-FGbYV5QE.js";var T=Object.defineProperty,p=w((r,e)=>T(r,"name",{value:e,configurable:!0}),"p");const k=new Set(["archivedRepo","author","downloads","expiredDomains","metadata","newBin","provenance","s1ngularity","signatures"]),U=p(r=>{const e=r.trim();if(e==="")return;if(e.startsWith("@")){const o=e.indexOf("@",1);return o===-1?{name:e,spec:void 0}:{name:e.slice(0,o),spec:e.slice(o+1)||void 0}}const i=e.indexOf("@");return i===-1?{name:e,spec:void 0}:{name:e.slice(0,i),spec:e.slice(i+1)||void 0}},"parsePackageArg"),L=p(r=>{if(r===void 0||r.trim()==="")return;const e=new Set;for(const i of r.split(",")){const o=i.trim();if(!k.has(o))throw new Error(`Unknown marshall in --only: ${o}. Known: ${[...k].sort().join(", ")}.`);e.add(o)}return e},"parseOnlyFlag"),l=p((r,e)=>r===void 0||r.has(e),"should"),J=p(r=>r?.has("signatures")??!1,"shouldRunSignatures"),Q=p(async({argument:r,options:e,workspaceRoot:i})=>{if(!r||r.length===0)throw new Error("No package specified. Usage: vis inspect <package>[@<spec>]");const o=U(r[0]);if(o===void 0)throw new Error(`Invalid package argument: "${String(r[0])}". Usage: vis inspect <package>[@<spec>]`);const t=L(e.only),u=await O(o.name,{workspaceRoot:i});if(u===void 0){g.error(`Package ${o.name} not found in the registry.`),process.exitCode=2;return}const h=V(u,o.spec);if(h===void 0){g.error(`Could not resolve ${o.name}@${o.spec??"latest"} to a published version.`),process.exitCode=2;return}const c=[{name:o.name,version:h}],n=new x;if(l(t,"author")){const s=await S(c,{workspaceRoot:i});for(const a of s)n.add({marshall:"author",message:a.message,packageName:a.packageName,severity:a.severity})}if(l(t,"provenance")){const s=await F(c);for(const a of s)n.add({marshall:"provenance",message:`Prior version ${a.priorVersionWithProvenance} had provenance but ${a.version} does not.`,packageName:a.packageName,severity:"error"})}if(l(t,"s1ngularity")){const s=await A(c,{workspaceRoot:i});for(const a of s){const d=a.hookChanges.map(v=>`${v.hook} (${v.kind})`).join(", "),m=a.hookChanges.length===1;n.add({marshall:"s1ngularity",message:`${a.version} ${m?"has an":"has"} install-script ${m?"change":"changes"} [${d}] AND dropped the provenance attestation that ${a.priorVersion} carried — this is the s1ngularity compromised-publish shape.`,packageName:a.packageName,severity:"error"})}}if(l(t,"newBin")){const s=await b(c);for(const a of s){const d=a.newBins.map(m=>m.command).join(", ");n.add({marshall:"newBin",message:`${a.toVersion} adds new bin script${a.newBins.length===1?"":"s"}: ${d} (prior: ${a.fromVersion}).`,packageName:a.packageName,severity:"warning"})}}if(l(t,"metadata")){const s=await P(c,{workspaceRoot:i});for(const a of s)n.add({marshall:"metadata",message:`Missing/invalid metadata: ${a.issues.join(", ")}.`,packageName:a.packageName,severity:"warning"})}if(l(t,"downloads")){const s=await j([o.name]);for(const a of s){const d=a.downloadsLastMonth===void 0?"unknown":String(a.downloadsLastMonth);n.add({marshall:"downloads",message:a.kind==="no-data"?"npm stats API returned no monthly download data.":`Only ${d} downloads in the past month.`,packageName:a.packageName,severity:a.severity})}}if(l(t,"expiredDomains")){const s=await C(c,{workspaceRoot:i});for(const a of s)n.add({marshall:"expiredDomains",message:a.kind==="expired"?`Maintainer email domain ${a.domain} (${a.maintainer}) is unregistered — potential hijack risk.`:`Could not verify maintainer email domain ${a.domain} (${a.maintainer}).`,packageName:a.packageName,severity:a.severity})}if(J(t)){const s=await I(c,{workspaceRoot:i});for(const a of s)n.add({marshall:"signatures",message:a.message,packageName:a.packageName,severity:a.severity})}if(l(t,"archivedRepo")){const s=await E(c,{workspaceRoot:i});for(const a of s)n.add({marshall:"archivedRepo",message:a.kind==="archived"?`Source repo ${a.owner}/${a.repo} is archived${a.archivedAt===void 0?"":` (since ${a.archivedAt})`}.`:`Source repo ${a.owner}/${a.repo} returned 404 from GitHub.`,packageName:a.packageName,severity:"warning"})}const f=n.all();if(e.json===!0)process.stdout.write(`${JSON.stringify(B(f),void 0,2)}
`);else{const s=`${o.name}@${h}`;if(f.length===0)g.info(`${N("✓")} ${s} — no findings.`);else{g.info(`${$("Inspecting")} ${s}`);for(const m of D(f))process.stdout.write(`${m}
`);const a=n.errors().length,d=n.warnings().length;process.stdout.write(`
${$("Summary:")} ${M(`${String(a)} error${a===1?"":"s"}`)}, ${R(`${String(d)} warning${d===1?"":"s"}`)}.
`)}}(n.hasErrors()||e.strict===!0&&!n.isEmpty())&&(process.exitCode=1)},"execute");export{Q as default,U as parsePackageArg};
