var X=Object.defineProperty;var j=(c,o)=>X(c,"name",{value:o,configurable:!0});import{e as q,g as H,p as m,T as K,h as V,a as Z,G as f,i as A,c as _,j as Q,k as U,R as i,l as W,d as ee,n as y,X as D,B as te,J as oe,s as se}from"./bin.js";import{H as re,e as ae,Z as ne}from"../packem_shared/ai-analysis-3QD_RS6F.js";import{A as ie}from"../packem_shared/pm-runner-DmKT2FqF.js";import{U as ce,C as le,a as J}from"../packem_shared/vis-update-app-D0QyGneK.js";var de=Object.defineProperty,ue=j((c,o)=>de(c,"name",{value:o,configurable:!0}),"A");const ve=ue(async({argument:c,logger:o,options:e,visConfig:n,workspaceRoot:R})=>{if(!R)throw new Error("Could not determine workspace root. Run this command inside a monorepo.");const u=R;if(e.securityConfig){const t=ie(u);if(q(n??{},t.name),e.sync&&t.name==="pnpm"){const s=H(n??{});if(s.length>0){m.info(`
Settings that would sync to pnpm-workspace.yaml:`);for(const x of s)m.success(`  ${x}`)}else m.info("No security settings to sync.")}else e.sync&&t.name!=="pnpm"&&(m.info(`--sync is only available for pnpm projects. Your project uses ${t.name}.`),m.info("vis enforces security settings at the vis layer for non-pnpm projects."));if(!e.security&&!c?.length)return}const{packageManager:M}=K(u),N=V(u),l=n?.update??{},v=Z(u,M,{dev:e.dev,includeInternal:e["include-internal"],peer:e.peer,prod:e.prod});if(v.size===0){o.info("No catalogs found.");return}const h=e.target??l.target??"latest";if(!["latest","minor","patch"].includes(h))throw new Error(`Invalid target "${h}". Use: latest, minor, or patch.`);const z={exclude:[...f(e.exclude),...f(l.exclude)],ignore:f(l.ignore),include:[...f(e.include),...f(l.include),...c],includeLocked:!!e.includeLocked,includePrerelease:e.prerelease||l.prerelease||!1,security:e.security!==!1,target:h};let $=0;for(const t of v.values())$+=t.size;const w=!!process.stdout.isTTY&&!se;let d;const B=w?(t,s)=>{d?d.rerender(i.createElement(J,{current:t,total:s})):d=U(i.createElement(J,{current:t,total:s}),{interactive:!0,patchConsole:!1})}:(t,s)=>{o.info(`Checking ${String(t)}/${String(s)} dependencies...`)};w||o.info(`Checking ${String($)} catalog dependencies against npm registry...
`);const C=new Set;A("socket")&&C.add("socket"),A("depsDev")&&C.add("deps-dev");const k=n?.security?.policies?.score?.minimum,I=_(n?.security,{disabled:C,minimumScore:k}),{failed:E,outdated:a}=await Q(v,z,N,B,u,I,n?.security?.acceptedRisks);if(d&&(d.clear(),d.unmount()),E.length>0&&o.warn(`Failed to fetch: ${E.join(", ")}`),a.length===0){o.info("All catalog dependencies are up to date.");return}const b=e.format??l.format??"table",L=re(e.aiType??"impact"),p=e.ai?await ae(a,o,n?.ai,L):void 0;if(w&&b==="table"){const t=new ce(a,p??null),s=n?.tui?.autoExit??!1,x=s===!0?3:typeof s=="number"?s:0;await U(i.createElement(le,{autoExitSeconds:x,isDryRun:!0,store:t}),{alternateScreen:!0,exitOnCtrlC:!1,interactive:!0,patchConsole:!0}).waitUntilExit();const O=process.stdout.columns||80;process.stdout.write(`
`);for(const r of a){const P=r.vulnerabilities?.length||r.socketReport&&r.socketReport.alerts.length>0,S=!!r.acceptedRisk,Y=P?S?"✓":"⚠":"✓",F=S?"gray":r.updateType==="major"?"red":r.updateType==="minor"?"yellow":"green",g=r.socketReport?.score.overall,G=g===void 0?"":` [${String(Math.round(g*100))}%]`,T=g===void 0?void 0:W(g);process.stdout.write(`${ee(i.createElement(y,null,"   ",i.createElement(y,{color:F},Y),`  ${r.packageName}  ${r.currentRange} → ${r.newRange}`,i.createElement(y,{dimColor:!0},`  ${r.updateType}`),T?i.createElement(y,{color:T},G):null),{columns:O})}
`)}process.stdout.write(`
`),o.info(D(a,k))}else if(b==="json"){const t={failed:E,outdated:a};p&&(t.aiAnalysis=p),process.stdout.write(`${JSON.stringify(t,void 0,2)}
`)}else b==="minimal"?process.stdout.write(`${te(a)}
`):(oe(a,o),o.info(D(a,k)),p&&(o.info(""),o.info(ne(p))));e.exitCode&&a.length>0&&(process.exitCode=1)},"execute");export{ve as default};
