var R=Object.defineProperty;var k=(n,t)=>R(n,"name",{value:t,configurable:!0});import{createRequire as B}from"node:module";import{l as D,B as V}from"../packem_shared/readFileSync-DseCu8sg-DEq4Fn3a.js";import{j as E,E as v}from"./config.js";import{p as e}from"./bin.js";import{A as q}from"../packem_shared/pm-runner-DmKT2FqF.js";import{x as M}from"../packem_shared/build-scripts-DE6U8jVq.js";import{N as F}from"../packem_shared/native-config-sync-DBkJ-hsF.js";const O=B(import.meta.url),$=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,T=k(n=>{if(typeof $<"u"&&$.versions&&$.versions.node){const[t,s]=$.versions.node.split(".").map(Number);if(t>22||t===22&&s>=3||t===20&&s>=16)return $.getBuiltinModule(n)}return O(n)},"__cjs_getBuiltinModule"),{spawnSync:A}=T("node:child_process");var W=Object.defineProperty,x=k((n,t)=>W(n,"name",{value:t,configurable:!0}),"$$1");const z=/(defineConfig\s*\(\s*\{)/,J=/(export\s+default\s+\{)/,w=x((n,t)=>`${t}${JSON.stringify(n)}: true,`,"renderEntry"),G=x((n,t)=>{if(t.length===0)return{added:[],skipped:[],status:"noop"};const s=E(n);if(!s)return{added:[],skipped:t,status:"no-config"};if(!D(s))return{added:[],skipped:t,status:"no-config"};const i=V(s),h=i.search(/installScripts\s*:\s*\{/);let p=null,c=0;if(h!==-1){const a=i.slice(h),d=/(allow\s*:\s*\{)([^}]*)(\})/.exec(a);d?.index!==void 0&&(p=d,c=h+d.index)}if(p){const a=p[2]??"",d=new Set;for(const g of a.matchAll(/["']([^"']+)["']\s*:/g))d.add(g[1]);for(const g of a.matchAll(/(?:^|,|\{)\s*([a-z_$][\w-]*)\s*:/gi))d.add(g[1]);const f=[],S=[];for(const g of t)d.has(g)?S.push(g):f.push(g);if(f.length===0)return{added:[],configPath:s,skipped:S,status:"noop"};const _=/\n([ \t]+)\S/.exec(a)?.[1]??"                ",P=`
${f.map(g=>w(g,_)).join(`
`)}`,y=a.replace(/\s+$/,""),b=a.slice(y.length),N=`${y}${y.endsWith(",")||y===""?"":","}${P}${b.length>0?b:`
`}`,C=`${i.slice(0,c)}${p[1]}${N}${p[3]}${i.slice(c+p[0].length)}`;return v(s,C),{added:f,configPath:s,skipped:S,status:"updated"}}const o=/(installScripts\s*:\s*\{)/;if(o.test(i)){const a=`
                allow: {
${t.map(f=>w(f,"                    ")).join(`
`)}
                },`,d=i.replace(o,`$1${a}`);return v(s,d),{added:t,configPath:s,skipped:[],status:"updated"}}const r=/(policies\s*:\s*\{)/;if(r.test(i)){const a=`
            installScripts: {
                allow: {
${t.map(f=>w(f,"                    ")).join(`
`)}
                },
            },`,d=i.replace(r,`$1${a}`);return v(s,d),{added:t,configPath:s,skipped:[],status:"updated"}}const u=/(security\s*:\s*\{)/;if(u.test(i)){const a=`
        policies: {
            installScripts: {
                allow: {
${t.map(f=>w(f,"                    ")).join(`
`)}
                },
            },
        },`,d=i.replace(u,`$1${a}`);return v(s,d),{added:t,configPath:s,skipped:[],status:"updated"}}const l=z.exec(i)??J.exec(i);if(!l)return{added:[],configPath:s,skipped:t,status:"missing-anchor"};const m=`
    security: {
        policies: {
            installScripts: {
                allow: {
${t.map(a=>w(a,"                    ")).join(`
`)}
                },
            },
        },
    },`,j=`${i.slice(0,l.index+l[0].length)}${m}${i.slice(l.index+l[0].length)}`;return v(s,j),{added:t,configPath:s,skipped:[],status:"updated"}},"writeApprovedBuildsToVisConfig");var H=Object.defineProperty,I=k((n,t)=>H(n,"name",{value:t,configurable:!0}),"d");const te=I(async({options:n,visConfig:t,workspaceRoot:s})=>{const i=s??process.cwd(),h=q(i);if(h.name==="pnpm"&&!n.scan){e.info("Delegating to pnpm approve-builds...");const p=["approve-builds"];n.all&&p.push("--all");const c=A("pnpm",p,{cwd:i,stdio:"inherit"});if(c.error)throw new Error(`Failed to run pnpm approve-builds: ${c.error.message}`);if(c.status!==0&&c.status!==null&&(e.error(`pnpm approve-builds exited with code ${c.status}`),process.exitCode=c.status),!n.syncNative){e.notice(""),e.notice("Tip: vis.config.ts security.policies.installScripts.allow may now be out of sync with pnpm-workspace.yaml."),e.notice("Run 'vis check --security-config' to compare, or copy the new entries into vis.config.ts.");return}}else{const p=t?.security?.policies?.installScripts?.allow??{},c=t?.security?.pinVersions===!0,o=M(i,p,{pinVersions:c});if(o.unapproved.length===0)e.success("No unapproved build scripts found."),n.write&&(e.info(""),e.info("Nothing to write — there are no unapproved build scripts."));else{e.warn(`Found ${o.unapproved.length} package${o.unapproved.length===1?"":"s"} with unapproved build scripts:
`);for(const r of o.unapproved)e.info(`  ${r.name} (${r.hooks.join(", ")})`);e.notice(""),e.notice("To approve these packages, add them to vis.config.ts:"),e.notice(""),e.notice("  security: {"),e.notice("    policies: {"),e.notice("      installScripts: {"),e.notice("        allow: {");for(const r of o.unapproved){const u=c&&r.version?`${r.name}@${r.version}`:r.name;e.notice(`          "${u}": true,`)}if(e.notice("        },"),e.notice("      },"),e.notice("    },"),e.notice("  },"),h.name==="pnpm"&&(e.notice(""),e.notice("Or run 'pnpm approve-builds' to update pnpm-workspace.yaml directly.")),n.write){const r=t?.security?.pinVersions===!0,u=o.unapproved.map(m=>r&&m.version?`${m.name}@${m.version}`:m.name),l=G(i,u);switch(e.info(""),l.status){case"missing-anchor":{e.warn(`Could not locate 'defineConfig({' or 'export default {' in ${String(l.configPath)} — please add entries manually.`);break}case"no-config":{e.warn("No vis.config.ts found. Run 'vis init' first, then re-run with --write.");break}case"noop":{e.info(`All ${String(u.length)} entr${u.length===1?"y":"ies"} were already present in vis.config.ts security.policies.installScripts.allow.`);break}default:e.success(`Wrote ${String(l.added.length)} entr${l.added.length===1?"y":"ies"} to ${String(l.configPath)}.`),l.skipped.length>0&&e.info(`Skipped ${String(l.skipped.length)} already-present entr${l.skipped.length===1?"y":"ies"}.`)}}}if(o.excess.length>0){e.notice(""),e.warn(`Stale installScripts.allow entries — ${String(o.excess.length)} pattern${o.excess.length===1?"":"s"} no longer match any installed package:`);for(const r of o.excess)e.info(`  ${r}`);e.notice("Consider removing these entries from vis.config.ts security.policies.installScripts.allow.")}if(o.versionDrift.length>0){e.notice(""),e.warn(`Version drift — ${String(o.versionDrift.length)} entr${o.versionDrift.length===1?"y":"ies"} pinned to an outdated version:`);for(const{from:r,to:u}of o.versionDrift)e.info(`  ${r}  →  ${u}`);e.notice("Rename the keys in vis.config.ts security.policies.installScripts.allow to migrate.")}}if(n.syncNative){const p=t?.security?.policies?.installScripts?.allow??{};if(Object.keys(p).length===0)e.warn("No security.policies.installScripts.allow configured in vis.config.ts. Nothing to sync.");else{const c=F(h.name,i,p);e.info("");for(const o of c)e.success(o)}}},"execute");export{te as default};
