var $=Object.defineProperty;var w=(s,e)=>$(s,"name",{value:e,configurable:!0});import{createRequire as _}from"node:module";import{d as R,R as I,y as C}from"./bin.js";import{A as P}from"../packem_shared/pm-runner-DmKT2FqF.js";import{l as T}from"../packem_shared/dependency-scan-B70azq4x.js";import{r as D}from"../packem_shared/provenance-Cu6VR1Hy.js";import{r as x}from"../packem_shared/signatures-FGbYV5QE.js";import{loadOptionalSigstore as q}from"./loader.js";const N=_(import.meta.url),d=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,y=w(s=>{if(typeof d<"u"&&d.versions&&d.versions.node){const[e,o]=d.versions.node.split(".").map(Number);if(e>22||e===22&&o>=3||e===20&&o>=16)return d.getBuiltinModule(s)}return N(s)},"__cjs_getBuiltinModule"),{createHash:O}=y("node:crypto"),{readFileSync:E,writeFileSync:j}=y("node:fs"),{isAbsolute:k,resolve:S,basename:v}=y("node:path");var J=Object.defineProperty,u=w((s,e)=>J(s,"name",{value:e,configurable:!0}),"d");const U=u(s=>(s??"").split(",").map(e=>e.trim()).filter(e=>e.length>0),"splitList"),W=u(async({logger:s,options:e,workspaceRoot:o})=>{if(!o)throw new Error("Could not determine workspace root. Run this command inside a monorepo.");const i=e.format??"table",p=e.prodOnly??!1,m=e.failOn==="error"?"error":"warning",n=U(e.allowlist),h=P(o),l=T(o,h.name,{includeDev:!p}).map(({name:t,version:r})=>({name:t,version:r})),[g,c]=await Promise.all([D(l,{allowlist:n,workspaceRoot:o}),x(l,{allowlist:n,workspaceRoot:o})]),a=[...g.map(t=>({code:"provenance-regression",message:`Resolved ${t.packageName}@${t.version} has no published provenance attestation, but ${t.packageName}@${t.priorVersionWithProvenance} did — a provenance regression.`,packageName:t.packageName,severity:"warning",version:t.version})),...c.map(t=>({code:t.code,message:t.message,packageName:t.packageName,severity:t.severity,version:t.version}))],f=a.filter(t=>m==="error"?t.severity==="error":!0);if(i==="json")process.stdout.write(`${JSON.stringify({findings:a,ok:f.length===0},void 0,2)}
`);else if(i==="ndjson")for(const t of a)process.stdout.write(`${JSON.stringify(t)}
`);else if(a.length===0)s.info(`No provenance regressions or signature problems across ${String(l.length)} locked packages.`);else{const t=process.stdout.columns||80;s.info(R(I.createElement(C,{data:a.map(r=>({code:r.code,package:`${r.packageName}@${r.version}`,severity:r.severity}))}),{columns:t}));for(const r of a)s.warn(`${r.packageName}@${r.version}: ${r.message}`)}f.length>0&&(process.exitCode=1)},"attestVerifyExecute"),A=u(()=>process.env.CI==="true"||typeof process.env.ACTIONS_ID_TOKEN_REQUEST_URL=="string"||typeof process.env.SIGSTORE_ID_TOKEN=="string","detectAmbientOidc"),B=u((s,e,o)=>({_type:"https://in-toto.io/Statement/v1",predicate:{buildDefinition:{buildType:"https://visulima.com/vis/attest/v1",externalParameters:{workspaceRoot:o},internalParameters:{},resolvedDependencies:[]},runDetails:{builder:{id:"https://visulima.com/vis"},metadata:{invocationId:process.env.GITHUB_RUN_ID??"",startedOn:new Date().toISOString()}}},predicateType:"https://slsa.dev/provenance/v1",subject:[{digest:{sha256:e},name:s}]}),"buildSlsaStatement"),z=u(async({argument:s,logger:e,options:o,workspaceRoot:i})=>{if(!i)throw new Error("Could not determine workspace root. Run this command inside a monorepo.");const p=s[0];if(!p)throw new Error("Missing subject. Usage: vis attest <path-to-artifact>");const m=o.predicate??"slsaProvenance";if(m!=="slsaProvenance")throw new Error(`Unsupported predicate '${m}'. Only 'slsaProvenance' is supported.`);const n=k(p)?p:S(i,p),h=o.requireSigning??!1,l=o.format??"table";let g;try{g=E(n)}catch{throw new Error(`Cannot read subject artifact at ${n}.`)}const c=O("sha256").update(g).digest("hex");if(!A()){const b="No ambient OIDC token (not running in CI). Keyless signing needs a Fulcio identity from CI OIDC.";if(h)throw new Error(`${b} Re-run in CI or drop --require-signing.`);if(l==="json"){process.stdout.write(`${JSON.stringify({ok:!1,reason:"no-ambient-oidc",sha256:c,skipped:!0,subject:v(n)},void 0,2)}
`);return}e.warn(`${b} Skipping signing (subject sha256: ${c}). Pass --require-signing to make this fatal.`);return}const a=B(v(n),c,i),f=Buffer.from(JSON.stringify(a)),t=await(await q({workspaceRoot:i})).attest(f,"application/vnd.in-toto+json"),r=o.output?k(o.output)?o.output:S(i,o.output):`${n}.sigstore`;if(j(r,`${JSON.stringify(t,void 0,2)}
`),l==="json"){process.stdout.write(`${JSON.stringify({bundle:r,ok:!0,sha256:c,subject:v(n)},void 0,2)}
`);return}e.info(`Signed SLSA v1 provenance for ${v(n)} (sha256 ${c.slice(0,16)}…).`),e.info(`Bundle written to ${r}.`)},"attestEmitExecute");export{z as attestEmitExecute,W as attestVerifyExecute};
