@socketsecurity/cli-with-sentry 0.15.24 → 0.15.25

package/dist/shadow-inject.js.map

@@ -1 +1 @@
-{"version":3,"file":"shadow-inject.js","sources":["../src/shadow/npm/arborist/lib/arborist/types.mts","../src/shadow/npm/paths.mts","../src/shadow/npm/arborist/lib/dep-valid.mts","../src/shadow/npm/proc-log/index.mts","../src/shadow/npm/arborist/lib/override-set.mts","../src/shadow/npm/arborist/lib/node.mts","../src/shadow/npm/arborist/lib/edge.mts","../src/shadow/npm/arborist-helpers.mts","../src/shadow/npm/arborist/lib/arborist/index.mts","../src/shadow/npm/arborist/index.mts","../src/shadow/npm/inject.mts"],"sourcesContent":["import { createEnum } from '../../../../../utils/objects.mts'\n\nimport type { SafeNode } from '../node.mts'\nimport type {\n  Options as ArboristOptions,\n  Advisory as BaseAdvisory,\n  Arborist as BaseArborist,\n  AuditReport as BaseAuditReport,\n  Diff as BaseDiff,\n  BuildIdealTreeOptions,\n  ReifyOptions,\n} from '@npmcli/arborist'\n\nexport type ArboristClass = ArboristInstance & {\n  new (...args: any): ArboristInstance\n}\n\nexport type ArboristInstance = Omit<\n  typeof BaseArborist,\n  | 'actualTree'\n  | 'auditReport'\n  | 'buildIdealTree'\n  | 'diff'\n  | 'idealTree'\n  | 'loadActual'\n  | 'loadVirtual'\n  | 'reify'\n> & {\n  auditReport?: AuditReportInstance | null | undefined\n  actualTree?: SafeNode | null | undefined\n  diff: Diff | null\n  idealTree?: SafeNode | null | undefined\n  buildIdealTree(options?: BuildIdealTreeOptions): Promise<SafeNode>\n  loadActual(options?: ArboristOptions): Promise<SafeNode>\n  loadVirtual(options?: ArboristOptions): Promise<SafeNode>\n  reify(options?: ArboristReifyOptions): Promise<SafeNode>\n}\n\nexport type ArboristReifyOptions = ReifyOptions & ArboristOptions\n\nexport type AuditReportInstance = Omit<BaseAuditReport, 'report'> & {\n  report: { [dependency: string]: AuditAdvisory[] }\n}\n\nexport type AuditAdvisory = Omit<BaseAdvisory, 'id'> & {\n  id: number\n  cwe: string[]\n  cvss: {\n    score: number\n    vectorString: string\n  }\n  vulnerable_versions: string\n}\n\nexport const DiffAction = createEnum({\n  add: 'ADD',\n  change: 'CHANGE',\n  remove: 'REMOVE',\n})\n\nexport type Diff = Omit<\n  BaseDiff,\n  | 'actual'\n  | 'children'\n  | 'filterSet'\n  | 'ideal'\n  | 'leaves'\n  | 'removed'\n  | 'shrinkwrapInflated'\n  | 'unchanged'\n> & {\n  actual: SafeNode\n  children: Diff[]\n  filterSet: Set<SafeNode>\n  ideal: SafeNode\n  leaves: SafeNode[]\n  parent: Diff | null\n  removed: SafeNode[]\n  shrinkwrapInflated: Set<SafeNode>\n  unchanged: SafeNode[]\n}\n","import path from 'node:path'\n\nimport { normalizePath } from '@socketsecurity/registry/lib/path'\n\nimport constants from '../../constants.mts'\nimport { getNpmRequire } from '../../utils/npm-paths.mts'\n\nlet _arboristPkgPath: string | undefined\nexport function getArboristPackagePath() {\n  if (_arboristPkgPath === undefined) {\n    const pkgName = '@npmcli/arborist'\n    const mainPathWithForwardSlashes = normalizePath(\n      getNpmRequire().resolve(pkgName),\n    )\n    const arboristPkgPathWithForwardSlashes = mainPathWithForwardSlashes.slice(\n      0,\n      mainPathWithForwardSlashes.lastIndexOf(pkgName) + pkgName.length,\n    )\n    // Lazily access constants.WIN32.\n    _arboristPkgPath = constants.WIN32\n      ? path.normalize(arboristPkgPathWithForwardSlashes)\n      : arboristPkgPathWithForwardSlashes\n  }\n  return _arboristPkgPath\n}\n\nlet _arboristClassPath: string | undefined\nexport function getArboristClassPath() {\n  if (_arboristClassPath === undefined) {\n    _arboristClassPath = path.join(\n      getArboristPackagePath(),\n      'lib/arborist/index.js',\n    )\n  }\n  return _arboristClassPath\n}\n\nlet _arboristDepValidPath: string | undefined\nexport function getArboristDepValidPath() {\n  if (_arboristDepValidPath === undefined) {\n    _arboristDepValidPath = path.join(\n      getArboristPackagePath(),\n      'lib/dep-valid.js',\n    )\n  }\n  return _arboristDepValidPath\n}\n\nlet _arboristEdgeClassPath: string | undefined\nexport function getArboristEdgeClassPath() {\n  if (_arboristEdgeClassPath === undefined) {\n    _arboristEdgeClassPath = path.join(getArboristPackagePath(), 'lib/edge.js')\n  }\n  return _arboristEdgeClassPath\n}\n\nlet _arboristNodeClassPath: string | undefined\nexport function getArboristNodeClassPath() {\n  if (_arboristNodeClassPath === undefined) {\n    _arboristNodeClassPath = path.join(getArboristPackagePath(), 'lib/node.js')\n  }\n  return _arboristNodeClassPath\n}\n\nlet _arboristOverrideSetClassPath: string | undefined\nexport function getArboristOverrideSetClassPath() {\n  if (_arboristOverrideSetClassPath === undefined) {\n    _arboristOverrideSetClassPath = path.join(\n      getArboristPackagePath(),\n      'lib/override-set.js',\n    )\n  }\n  return _arboristOverrideSetClassPath\n}\n","import { createRequire } from 'node:module'\n\nimport { getArboristDepValidPath } from '../../paths.mts'\n\nimport type { SafeNode } from './node.mts'\n\nconst require = createRequire(import.meta.url)\n\ntype DepValidFn = (\n  child: SafeNode,\n  requested: string,\n  accept: string | undefined,\n  requester: SafeNode,\n) => boolean\n\nlet _depValid: DepValidFn | undefined\nexport function depValid(\n  child: SafeNode,\n  requested: string,\n  accept: string | undefined,\n  requester: SafeNode,\n) {\n  if (_depValid === undefined) {\n    _depValid = require(getArboristDepValidPath()) as DepValidFn\n  }\n  return _depValid(child, requested, accept, requester)\n}\n","import constants from '../../../constants.mts'\nimport { getNpmRequire } from '../../../utils/npm-paths.mts'\n\nconst { UNDEFINED_TOKEN } = constants\n\ninterface RequireKnownModules {\n  npmlog: typeof import('npmlog')\n  // The DefinitelyTyped definition of 'proc-log' does NOT have the log method.\n  // The return type of the log method is the same as `typeof import('proc-log')`.\n  'proc-log': typeof import('proc-log')\n}\n\ntype RequireTransformer<T extends keyof RequireKnownModules> = (\n  mod: RequireKnownModules[T],\n) => RequireKnownModules[T]\n\nfunction tryRequire<T extends keyof RequireKnownModules>(\n  req: NodeJS.Require,\n  ...ids: Array<T | [T, RequireTransformer<T>]>\n): RequireKnownModules[T] | undefined {\n  for (const data of ids) {\n    let id: string | undefined\n    let transformer: RequireTransformer<T> | undefined\n    if (Array.isArray(data)) {\n      id = data[0]\n      transformer = data[1] as RequireTransformer<T>\n    } else {\n      id = data as keyof RequireKnownModules\n      transformer = mod => mod\n    }\n    try {\n      // Check that the transformed value isn't `undefined` because older\n      // versions of packages like 'proc-log' may not export a `log` method.\n      const exported = transformer(req(id))\n      if (exported !== undefined) {\n        return exported\n      }\n    } catch {}\n  }\n  return undefined\n}\n\nexport type Logger =\n  | typeof import('npmlog')\n  | typeof import('proc-log')\n  | undefined\n\nlet _log: Logger | {} | undefined = UNDEFINED_TOKEN\nexport function getLogger(): Logger {\n  if (_log === UNDEFINED_TOKEN) {\n    _log = tryRequire(\n      getNpmRequire(),\n      [\n        'proc-log/lib/index.js' as 'proc-log',\n        // The proc-log DefinitelyTyped definition is incorrect. The type definition\n        // is really that of its export log.\n        mod => (mod as any).log as RequireKnownModules['proc-log'],\n      ],\n      'npmlog/lib/log.js' as 'npmlog',\n    )\n  }\n  return _log as Logger | undefined\n}\n","import { createRequire } from 'node:module'\n\nimport npa from 'npm-package-arg'\nimport semver from 'semver'\n\nimport { getArboristOverrideSetClassPath } from '../../paths.mts'\nimport { getLogger } from '../../proc-log/index.mts'\n\nimport type { SafeEdge } from './edge.mts'\nimport type { SafeNode } from './node.mts'\nimport type { AliasResult, RegistryResult } from 'npm-package-arg'\n\nconst require = createRequire(import.meta.url)\n\ninterface OverrideSetClass {\n  children: Map<string, SafeOverrideSet>\n  key: string | undefined\n  keySpec: string | undefined\n  name: string | undefined\n  parent: SafeOverrideSet | undefined\n  value: string | undefined\n  version: string | undefined\n  // eslint-disable-next-line @typescript-eslint/no-misused-new\n  new (...args: any[]): OverrideSetClass\n  get isRoot(): boolean\n  get ruleset(): Map<string, SafeOverrideSet>\n  ancestry(): Generator<SafeOverrideSet>\n  childrenAreEqual(otherOverrideSet: SafeOverrideSet | undefined): boolean\n  getEdgeRule(edge: SafeEdge): SafeOverrideSet\n  getNodeRule(node: SafeNode): SafeOverrideSet\n  getMatchingRule(node: SafeNode): SafeOverrideSet | null\n  isEqual(otherOverrideSet: SafeOverrideSet | undefined): boolean\n}\n\nconst OverrideSet: OverrideSetClass = require(getArboristOverrideSetClassPath())\n\n// Implementation code not related to patch https://github.com/npm/cli/pull/8089\n// is based on https://github.com/npm/cli/blob/v11.0.0/workspaces/arborist/lib/override-set.js:\nexport class SafeOverrideSet extends OverrideSet {\n  // Patch adding doOverrideSetsConflict is based on\n  // https://github.com/npm/cli/pull/8089.\n  static doOverrideSetsConflict(\n    first: SafeOverrideSet | undefined,\n    second: SafeOverrideSet | undefined,\n  ) {\n    // If override sets contain one another then we can try to use the more\n    // specific one. If neither one is more specific, then we consider them to\n    // be in conflict.\n    return this.findSpecificOverrideSet(first, second) === undefined\n  }\n\n  // Patch adding findSpecificOverrideSet is based on\n  // https://github.com/npm/cli/pull/8089.\n  static findSpecificOverrideSet(\n    first: SafeOverrideSet | undefined,\n    second: SafeOverrideSet | undefined,\n  ) {\n    for (\n      let overrideSet = second;\n      overrideSet;\n      overrideSet = overrideSet.parent\n    ) {\n      if (overrideSet.isEqual(first)) {\n        return second\n      }\n    }\n    for (\n      let overrideSet = first;\n      overrideSet;\n      overrideSet = overrideSet.parent\n    ) {\n      if (overrideSet.isEqual(second)) {\n        return first\n      }\n    }\n    // The override sets are incomparable. Neither one contains the other.\n    const log = getLogger()\n    log?.silly('Conflicting override sets', first, second)\n    return undefined\n  }\n\n  // Patch adding childrenAreEqual is based on\n  // https://github.com/npm/cli/pull/8089.\n  override childrenAreEqual(otherOverrideSet: SafeOverrideSet) {\n    if (this.children.size !== otherOverrideSet.children.size) {\n      return false\n    }\n    for (const { 0: key, 1: childOverrideSet } of this.children) {\n      const otherChildOverrideSet = otherOverrideSet.children.get(key)\n      if (!otherChildOverrideSet) {\n        return false\n      }\n      if (childOverrideSet.value !== otherChildOverrideSet.value) {\n        return false\n      }\n      if (!childOverrideSet.childrenAreEqual(otherChildOverrideSet)) {\n        return false\n      }\n    }\n    return true\n  }\n\n  override getEdgeRule(edge: SafeEdge): SafeOverrideSet {\n    for (const rule of this.ruleset.values()) {\n      if (rule.name !== edge.name) {\n        continue\n      }\n      // If keySpec is * we found our override.\n      if (rule.keySpec === '*') {\n        return rule\n      }\n      // Patch replacing\n      // let spec = npa(`${edge.name}@${edge.spec}`)\n      // is based on https://github.com/npm/cli/pull/8089.\n      //\n      // We need to use the rawSpec here, because the spec has the overrides\n      // applied to it already. The rawSpec can be undefined, so we need to use\n      // the fallback value of spec if it is.\n      let spec = npa(`${edge.name}@${edge.rawSpec || edge.spec}`)\n      if (spec.type === 'alias') {\n        spec = (spec as AliasResult).subSpec\n      }\n      if (spec.type === 'git') {\n        if (spec.gitRange && semver.intersects(spec.gitRange, rule.keySpec!)) {\n          return rule\n        }\n        continue\n      }\n      if (spec.type === 'range' || spec.type === 'version') {\n        if (\n          semver.intersects((spec as RegistryResult).fetchSpec, rule.keySpec!)\n        ) {\n          return rule\n        }\n        continue\n      }\n      // If we got this far, the spec type is one of tag, directory or file\n      // which means we have no real way to make version comparisons, so we\n      // just accept the override.\n      return rule\n    }\n    return this\n  }\n\n  // Patch adding isEqual is based on\n  // https://github.com/npm/cli/pull/8089.\n  override isEqual(otherOverrideSet: SafeOverrideSet | undefined): boolean {\n    if (this === otherOverrideSet) {\n      return true\n    }\n    if (!otherOverrideSet) {\n      return false\n    }\n    if (\n      this.key !== otherOverrideSet.key ||\n      this.value !== otherOverrideSet.value\n    ) {\n      return false\n    }\n    if (!this.childrenAreEqual(otherOverrideSet)) {\n      return false\n    }\n    if (!this.parent) {\n      return !otherOverrideSet.parent\n    }\n    return this.parent.isEqual(otherOverrideSet.parent)\n  }\n}\n","import { createRequire } from 'node:module'\n\nimport semver from 'semver'\n\nimport { SafeOverrideSet } from './override-set.mts'\nimport { getArboristNodeClassPath } from '../../paths.mts'\nimport { getLogger } from '../../proc-log/index.mts'\n\nimport type { SafeEdge } from './edge.mts'\nimport type { Node as BaseNode } from '@npmcli/arborist'\n\nconst require = createRequire(import.meta.url)\n\ntype NodeClass = Omit<\n  BaseNode,\n  | 'addEdgeIn'\n  | 'addEdgeOut'\n  | 'canDedupe'\n  | 'canReplace'\n  | 'canReplaceWith'\n  | 'children'\n  | 'deleteEdgeIn'\n  | 'edgesIn'\n  | 'edgesOut'\n  | 'from'\n  | 'hasShrinkwrap'\n  | 'inDepBundle'\n  | 'inShrinkwrap'\n  | 'integrity'\n  | 'isTop'\n  | 'matches'\n  | 'meta'\n  | 'name'\n  | 'overrides'\n  | 'packageName'\n  | 'parent'\n  | 'recalculateOutEdgesOverrides'\n  | 'resolve'\n  | 'resolveParent'\n  | 'root'\n  | 'target'\n  | 'updateOverridesEdgeInAdded'\n  | 'updateOverridesEdgeInRemoved'\n  | 'version'\n  | 'versions'\n> & {\n  name: string\n  version: string\n  children: Map<string, SafeNode | LinkClass>\n  edgesIn: Set<SafeEdge>\n  edgesOut: Map<string, SafeEdge>\n  from: SafeNode | null\n  hasShrinkwrap: boolean\n  inShrinkwrap: boolean | undefined\n  integrity?: string | null\n  isTop: boolean | undefined\n  meta: BaseNode['meta'] & {\n    addEdge(edge: SafeEdge): void\n  }\n  overrides: SafeOverrideSet | undefined\n  target: SafeNode\n  versions: string[]\n  get inDepBundle(): boolean\n  get packageName(): string | null\n  get parent(): SafeNode | null\n  set parent(value: SafeNode | null)\n  get resolveParent(): SafeNode | null\n  get root(): SafeNode | null\n  set root(value: SafeNode | null)\n  new (...args: any): NodeClass\n  addEdgeIn(edge: SafeEdge): void\n  addEdgeOut(edge: SafeEdge): void\n  canDedupe(preferDedupe?: boolean): boolean\n  canReplace(node: SafeNode, ignorePeers?: string[]): boolean\n  canReplaceWith(node: SafeNode, ignorePeers?: string[]): boolean\n  deleteEdgeIn(edge: SafeEdge): void\n  matches(node: SafeNode): boolean\n  recalculateOutEdgesOverrides(): void\n  resolve(name: string): SafeNode\n  updateOverridesEdgeInAdded(\n    otherOverrideSet: SafeOverrideSet | undefined,\n  ): boolean\n  updateOverridesEdgeInRemoved(otherOverrideSet: SafeOverrideSet): boolean\n}\n\nexport type LinkClass = Omit<NodeClass, 'isLink'> & {\n  readonly isLink: true\n}\n\nconst Node: NodeClass = require(getArboristNodeClassPath())\n\n// Implementation code not related to patch https://github.com/npm/cli/pull/8089\n// is based on https://github.com/npm/cli/blob/v11.0.0/workspaces/arborist/lib/node.js:\nexport class SafeNode extends Node {\n  // Return true if it's safe to remove this node, because anything that is\n  // depending on it would be fine with the thing that they would resolve to if\n  // it was removed, or nothing is depending on it in the first place.\n  override canDedupe(preferDedupe = false) {\n    // Not allowed to mess with shrinkwraps or bundles.\n    if (this.inDepBundle || this.inShrinkwrap) {\n      return false\n    }\n    // It's a top level pkg, or a dep of one.\n    if (!this.resolveParent?.resolveParent) {\n      return false\n    }\n    // No one wants it, remove it.\n    if (this.edgesIn.size === 0) {\n      return true\n    }\n    const other = this.resolveParent.resolveParent.resolve(this.name)\n    // Nothing else, need this one.\n    if (!other) {\n      return false\n    }\n    // If it's the same thing, then always fine to remove.\n    if (other.matches(this)) {\n      return true\n    }\n    // If the other thing can't replace this, then skip it.\n    if (!other.canReplace(this)) {\n      return false\n    }\n    // Patch replacing\n    // if (preferDedupe || semver.gte(other.version, this.version)) {\n    //   return true\n    // }\n    // is based on https://github.com/npm/cli/pull/8089.\n    //\n    // If we prefer dedupe, or if the version is equal, take the other.\n    if (preferDedupe || semver.eq(other.version, this.version)) {\n      return true\n    }\n    // If our current version isn't the result of an override, then prefer to\n    // take the greater version.\n    if (!this.overridden && semver.gt(other.version, this.version)) {\n      return true\n    }\n    return false\n  }\n\n  // Is it safe to replace one node with another?  check the edges to\n  // make sure no one will get upset.  Note that the node might end up\n  // having its own unmet dependencies, if the new node has new deps.\n  // Note that there are cases where Arborist will opt to insert a node\n  // into the tree even though this function returns false!  This is\n  // necessary when a root dependency is added or updated, or when a\n  // root dependency brings peer deps along with it.  In that case, we\n  // will go ahead and create the invalid state, and then try to resolve\n  // it with more tree construction, because it's a user request.\n  override canReplaceWith(node: SafeNode, ignorePeers?: string[]): boolean {\n    if (this.name !== node.name || this.packageName !== node.packageName) {\n      return false\n    }\n    // Patch replacing\n    // if (node.overrides !== this.overrides) {\n    //   return false\n    // }\n    // is based on https://github.com/npm/cli/pull/8089.\n    //\n    // If this node has no dependencies, then it's irrelevant to check the\n    // override rules of the replacement node.\n    if (this.edgesOut.size) {\n      // XXX need to check for two root nodes?\n      if (node.overrides) {\n        if (!node.overrides.isEqual(this.overrides)) {\n          return false\n        }\n      } else {\n        if (this.overrides) {\n          return false\n        }\n      }\n    }\n    // To satisfy the patch we ensure `node.overrides === this.overrides`\n    // so that the condition we want to replace,\n    // if (this.overrides !== node.overrides) {\n    // , is not hit.`\n    const oldOverrideSet = this.overrides\n    let result = true\n    if (oldOverrideSet !== node.overrides) {\n      this.overrides = node.overrides\n    }\n    try {\n      result = super.canReplaceWith(node, ignorePeers)\n      this.overrides = oldOverrideSet\n    } catch (e) {\n      this.overrides = oldOverrideSet\n      throw e\n    }\n    return result\n  }\n\n  // Patch adding deleteEdgeIn is based on https://github.com/npm/cli/pull/8089.\n  override deleteEdgeIn(edge: SafeEdge) {\n    this.edgesIn.delete(edge)\n    const { overrides } = edge\n    if (overrides) {\n      this.updateOverridesEdgeInRemoved(overrides)\n    }\n  }\n\n  override addEdgeIn(edge: SafeEdge): void {\n    // Patch replacing\n    // if (edge.overrides) {\n    //   this.overrides = edge.overrides\n    // }\n    // is based on https://github.com/npm/cli/pull/8089.\n    //\n    // We need to handle the case where the new edge in has an overrides field\n    // which is different from the current value.\n    if (!this.overrides || !this.overrides.isEqual(edge.overrides)) {\n      this.updateOverridesEdgeInAdded(edge.overrides)\n    }\n    this.edgesIn.add(edge)\n    // Try to get metadata from the yarn.lock file.\n    this.root.meta?.addEdge(edge)\n  }\n\n  // @ts-ignore: Incorrectly typed as a property instead of an accessor.\n  override get overridden() {\n    // Patch replacing\n    // return !!(this.overrides && this.overrides.value && this.overrides.name === this.name)\n    // is based on https://github.com/npm/cli/pull/8089.\n    if (\n      !this.overrides ||\n      !this.overrides.value ||\n      this.overrides.name !== this.name\n    ) {\n      return false\n    }\n    // The overrides rule is for a package with this name, but some override\n    // rules only apply to specific versions. To make sure this package was\n    // actually overridden, we check whether any edge going in had the rule\n    // applied to it, in which case its overrides set is different than its\n    // source node.\n    for (const edge of this.edgesIn) {\n      if (\n        edge.overrides &&\n        edge.overrides.name === this.name &&\n        edge.overrides.value === this.version\n      ) {\n        if (!edge.overrides.isEqual(edge.from?.overrides)) {\n          return true\n        }\n      }\n    }\n    return false\n  }\n\n  override set parent(newParent: SafeNode) {\n    // Patch removing\n    // if (parent.overrides) {\n    //   this.overrides = parent.overrides.getNodeRule(this)\n    // }\n    // is based on https://github.com/npm/cli/pull/8089.\n    //\n    // The \"parent\" setter is a really large and complex function. To satisfy\n    // the patch we hold on to the old overrides value and set `this.overrides`\n    // to `undefined` so that the condition we want to remove is not hit.\n    const { overrides } = this\n    if (overrides) {\n      this.overrides = undefined\n    }\n    try {\n      super.parent = newParent\n      this.overrides = overrides\n    } catch (e) {\n      this.overrides = overrides\n      throw e\n    }\n  }\n\n  // Patch adding recalculateOutEdgesOverrides is based on\n  // https://github.com/npm/cli/pull/8089.\n  override recalculateOutEdgesOverrides() {\n    // For each edge out propagate the new overrides through.\n    for (const edge of this.edgesOut.values()) {\n      edge.reload(true)\n      if (edge.to) {\n        edge.to.updateOverridesEdgeInAdded(edge.overrides)\n      }\n    }\n  }\n\n  // @ts-ignore: Incorrectly typed to accept null.\n  override set root(newRoot: SafeNode) {\n    // Patch removing\n    // if (!this.overrides && this.parent && this.parent.overrides) {\n    //   this.overrides = this.parent.overrides.getNodeRule(this)\n    // }\n    // is based on https://github.com/npm/cli/pull/8089.\n    //\n    // The \"root\" setter is a really large and complex function. To satisfy the\n    // patch we add a dummy value to `this.overrides` so that the condition we\n    // want to remove is not hit.\n    if (!this.overrides) {\n      this.overrides = new SafeOverrideSet({ overrides: '' })\n    }\n    try {\n      super.root = newRoot\n      this.overrides = undefined\n    } catch (e) {\n      this.overrides = undefined\n      throw e\n    }\n  }\n\n  // Patch adding updateOverridesEdgeInAdded is based on\n  // https://github.com/npm/cli/pull/7025.\n  //\n  // This logic isn't perfect either. When we have two edges in that have\n  // different override sets, then we have to decide which set is correct. This\n  // function assumes the more specific override set is applicable, so if we have\n  // dependencies A->B->C and A->C and an override set that specifies what happens\n  // for C under A->B, this will work even if the new A->C edge comes along and\n  // tries to change the override set. The strictly correct logic is not to allow\n  // two edges with different overrides to point to the same node, because even\n  // if this node can satisfy both, one of its dependencies might need to be\n  // different depending on the edge leading to it. However, this might cause a\n  // lot of duplication, because the conflict in the dependencies might never\n  // actually happen.\n  override updateOverridesEdgeInAdded(\n    otherOverrideSet: SafeOverrideSet | undefined,\n  ) {\n    if (!otherOverrideSet) {\n      // Assuming there are any overrides at all, the overrides field is never\n      // undefined for any node at the end state of the tree. So if the new edge's\n      // overrides is undefined it will be updated later. So we can wait with\n      // updating the node's overrides field.\n      return false\n    }\n    if (!this.overrides) {\n      this.overrides = otherOverrideSet\n      this.recalculateOutEdgesOverrides()\n      return true\n    }\n    if (this.overrides.isEqual(otherOverrideSet)) {\n      return false\n    }\n    const newOverrideSet = SafeOverrideSet.findSpecificOverrideSet(\n      this.overrides,\n      otherOverrideSet,\n    )\n    if (newOverrideSet) {\n      if (this.overrides.isEqual(newOverrideSet)) {\n        return false\n      }\n      this.overrides = newOverrideSet\n      this.recalculateOutEdgesOverrides()\n      return true\n    }\n    // This is an error condition. We can only get here if the new override set\n    // is in conflict with the existing.\n    const log = getLogger()\n    log?.silly('Conflicting override sets', this.name)\n    return false\n  }\n\n  // Patch adding updateOverridesEdgeInRemoved is based on\n  // https://github.com/npm/cli/pull/7025.\n  override updateOverridesEdgeInRemoved(otherOverrideSet: SafeOverrideSet) {\n    // If this edge's overrides isn't equal to this node's overrides,\n    // then removing it won't change newOverrideSet later.\n    if (!this.overrides || !this.overrides.isEqual(otherOverrideSet)) {\n      return false\n    }\n    let newOverrideSet\n    for (const edge of this.edgesIn) {\n      const { overrides: edgeOverrides } = edge\n      if (newOverrideSet && edgeOverrides) {\n        newOverrideSet = SafeOverrideSet.findSpecificOverrideSet(\n          edgeOverrides,\n          newOverrideSet,\n        )\n      } else {\n        newOverrideSet = edgeOverrides\n      }\n    }\n    if (this.overrides.isEqual(newOverrideSet)) {\n      return false\n    }\n    this.overrides = newOverrideSet\n    if (newOverrideSet) {\n      // Optimization: If there's any override set at all, then no non-extraneous\n      // node has an empty override set. So if we temporarily have no override set\n      // (for example, we removed all the edges in), there's no use updating all\n      // the edges out right now. Let's just wait until we have an actual override\n      // set later.\n      this.recalculateOutEdgesOverrides()\n    }\n    return true\n  }\n}\n","import { createRequire } from 'node:module'\n\nimport { depValid } from './dep-valid.mts'\nimport { SafeNode } from './node.mts'\nimport { SafeOverrideSet } from './override-set.mts'\nimport { getArboristEdgeClassPath } from '../../paths.mts'\n\nimport type { Edge as BaseEdge, DependencyProblem } from '@npmcli/arborist'\n\nconst require = createRequire(import.meta.url)\n\ntype EdgeClass = Omit<\n  BaseEdge,\n  | 'accept'\n  | 'detach'\n  | 'optional'\n  | 'overrides'\n  | 'peer'\n  | 'peerConflicted'\n  | 'rawSpec'\n  | 'reload'\n  | 'satisfiedBy'\n  | 'spec'\n  | 'to'\n> & {\n  optional: boolean\n  overrides: SafeOverrideSet | undefined\n  peer: boolean\n  peerConflicted: boolean\n  rawSpec: string\n  get accept(): string | undefined\n  get spec(): string\n  get to(): SafeNode | null\n  new (...args: any): EdgeClass\n  detach(): void\n  reload(hard?: boolean): void\n  satisfiedBy(node: SafeNode): boolean\n}\n\nexport type EdgeOptions = {\n  type: string\n  name: string\n  spec: string\n  from: SafeNode\n  accept?: string | undefined\n  overrides?: SafeOverrideSet | undefined\n  to?: SafeNode | undefined\n}\n\nexport type ErrorStatus = DependencyProblem | 'OK'\n\nexport type Explanation = {\n  type: string\n  name: string\n  spec: string\n  bundled: boolean\n  overridden: boolean\n  error: ErrorStatus | undefined\n  rawSpec: string | undefined\n  from: object | undefined\n} | null\n\nexport const Edge: EdgeClass = require(getArboristEdgeClassPath())\n\n// The Edge class makes heavy use of private properties which subclasses do NOT\n// have access to. So we have to recreate any functionality that relies on those\n// private properties and use our own \"safe\" prefixed non-conflicting private\n// properties. Implementation code not related to patch https://github.com/npm/cli/pull/8089\n// is based on https://github.com/npm/cli/blob/v11.0.0/workspaces/arborist/lib/edge.js.\n//\n// The npm application\n// Copyright (c) npm, Inc. and Contributors\n// Licensed on the terms of The Artistic License 2.0\n//\n// An edge in the dependency graph.\n// Represents a dependency relationship of some kind.\nexport class SafeEdge extends Edge {\n  #safeError: ErrorStatus | null\n  #safeExplanation: Explanation | undefined\n  #safeFrom: SafeNode | null\n  #safeTo: SafeNode | null\n\n  constructor(options: EdgeOptions) {\n    const { from } = options\n    // Defer to supper to validate options and assign non-private values.\n    super(options)\n    if (from.constructor !== SafeNode) {\n      Reflect.setPrototypeOf(from, SafeNode.prototype)\n    }\n    this.#safeError = null\n    this.#safeExplanation = null\n    this.#safeFrom = from\n    this.#safeTo = null\n    this.reload(true)\n  }\n\n  override get bundled() {\n    return !!this.#safeFrom?.package?.bundleDependencies?.includes(this.name)\n  }\n\n  override get error() {\n    if (!this.#safeError) {\n      if (!this.#safeTo) {\n        if (this.optional) {\n          this.#safeError = null\n        } else {\n          this.#safeError = 'MISSING'\n        }\n      } else if (\n        this.peer &&\n        this.#safeFrom === this.#safeTo.parent &&\n        // Patch adding \"?.\" use based on\n        // https://github.com/npm/cli/pull/8089.\n        !this.#safeFrom?.isTop\n      ) {\n        this.#safeError = 'PEER LOCAL'\n      } else if (!this.satisfiedBy(this.#safeTo)) {\n        this.#safeError = 'INVALID'\n      }\n      // Patch adding \"else if\" condition is based on\n      // https://github.com/npm/cli/pull/8089.\n      else if (\n        this.overrides &&\n        this.#safeTo.edgesOut.size &&\n        SafeOverrideSet.doOverrideSetsConflict(\n          this.overrides,\n          this.#safeTo.overrides,\n        )\n      ) {\n        // Any inconsistency between the edge's override set and the target's\n        // override set is potentially problematic. But we only say the edge is\n        // in error if the override sets are plainly conflicting. Note that if\n        // the target doesn't have any dependencies of their own, then this\n        // inconsistency is irrelevant.\n        this.#safeError = 'INVALID'\n      } else {\n        this.#safeError = 'OK'\n      }\n    }\n    if (this.#safeError === 'OK') {\n      return null\n    }\n    return this.#safeError\n  }\n\n  // @ts-ignore: Incorrectly typed as a property instead of an accessor.\n  override get from() {\n    return this.#safeFrom\n  }\n\n  // @ts-ignore: Incorrectly typed as a property instead of an accessor.\n  override get spec(): string {\n    if (\n      this.overrides?.value &&\n      this.overrides.value !== '*' &&\n      this.overrides.name === this.name\n    ) {\n      if (this.overrides.value.startsWith('$')) {\n        const ref = this.overrides.value.slice(1)\n        // We may be a virtual root, if we are we want to resolve reference\n        // overrides from the real root, not the virtual one.\n        //\n        // Patch adding \"?.\" use based on\n        // https://github.com/npm/cli/pull/8089.\n        const pkg = this.#safeFrom?.sourceReference\n          ? this.#safeFrom?.sourceReference.root.package\n          : this.#safeFrom?.root?.package\n        if (pkg?.devDependencies?.[ref]) {\n          return pkg.devDependencies[ref] as string\n        }\n        if (pkg?.optionalDependencies?.[ref]) {\n          return pkg.optionalDependencies[ref] as string\n        }\n        if (pkg?.dependencies?.[ref]) {\n          return pkg.dependencies[ref] as string\n        }\n        if (pkg?.peerDependencies?.[ref]) {\n          return pkg.peerDependencies[ref] as string\n        }\n        throw new Error(`Unable to resolve reference ${this.overrides.value}`)\n      }\n      return this.overrides.value\n    }\n    return this.rawSpec\n  }\n\n  // @ts-ignore: Incorrectly typed as a property instead of an accessor.\n  override get to() {\n    return this.#safeTo\n  }\n\n  override detach() {\n    this.#safeExplanation = null\n    // Patch replacing\n    // if (this.#to) {\n    //   this.#to.edgesIn.delete(this)\n    // }\n    // this.#from.edgesOut.delete(this.#name)\n    // is based on https://github.com/npm/cli/pull/8089.\n    this.#safeTo?.deleteEdgeIn(this)\n    this.#safeFrom?.edgesOut.delete(this.name)\n    this.#safeTo = null\n    this.#safeError = 'DETACHED'\n    this.#safeFrom = null\n  }\n\n  // Return the edge data, and an explanation of how that edge came to be here.\n  // @ts-ignore: Edge#explain is defined with an unused `seen = []` param.\n  override explain() {\n    if (!this.#safeExplanation) {\n      const explanation: Explanation = {\n        type: this.type,\n        name: this.name,\n        spec: this.spec,\n        bundled: false,\n        overridden: false,\n        error: undefined,\n        from: undefined,\n        rawSpec: undefined,\n      }\n      if (this.rawSpec !== this.spec) {\n        explanation.rawSpec = this.rawSpec\n        explanation.overridden = true\n      }\n      if (this.bundled) {\n        explanation.bundled = this.bundled\n      }\n      if (this.error) {\n        explanation.error = this.error\n      }\n      if (this.#safeFrom) {\n        explanation.from = this.#safeFrom.explain()\n      }\n      this.#safeExplanation = explanation\n    }\n    return this.#safeExplanation\n  }\n\n  override reload(hard = false) {\n    this.#safeExplanation = null\n    // Patch replacing\n    // if (this.#from.overrides) {\n    // is based on https://github.com/npm/cli/pull/8089.\n    let needToUpdateOverrideSet = false\n    let newOverrideSet\n    let oldOverrideSet\n    if (this.#safeFrom?.overrides) {\n      newOverrideSet = this.#safeFrom.overrides.getEdgeRule(this)\n      if (newOverrideSet && !newOverrideSet.isEqual(this.overrides)) {\n        // If there's a new different override set we need to propagate it to\n        // the nodes. If we're deleting the override set then there's no point\n        // propagating it right now since it will be filled with another value\n        // later.\n        needToUpdateOverrideSet = true\n        oldOverrideSet = this.overrides\n        this.overrides = newOverrideSet\n      }\n    } else {\n      this.overrides = undefined\n    }\n    // Patch adding \"?.\" use based on\n    // https://github.com/npm/cli/pull/8089.\n    const newTo = this.#safeFrom?.resolve(this.name)\n    if (newTo !== this.#safeTo) {\n      // Patch replacing\n      // this.#to.edgesIn.delete(this)\n      // is based on https://github.com/npm/cli/pull/8089.\n      this.#safeTo?.deleteEdgeIn(this)\n      this.#safeTo = (newTo as SafeNode) ?? null\n      this.#safeError = null\n      this.#safeTo?.addEdgeIn(this)\n    } else if (hard) {\n      this.#safeError = null\n    }\n    // Patch adding \"else if\" condition based on\n    // https://github.com/npm/cli/pull/8089.\n    else if (needToUpdateOverrideSet && this.#safeTo) {\n      // Propagate the new override set to the target node.\n      this.#safeTo.updateOverridesEdgeInRemoved(oldOverrideSet!)\n      this.#safeTo.updateOverridesEdgeInAdded(newOverrideSet)\n    }\n  }\n\n  override satisfiedBy(node: SafeNode) {\n    // Patch replacing\n    // if (node.name !== this.#name) {\n    //   return false\n    // }\n    // is based on https://github.com/npm/cli/pull/8089.\n    if (node.name !== this.name || !this.#safeFrom) {\n      return false\n    }\n    // NOTE: this condition means we explicitly do not support overriding\n    // bundled or shrinkwrapped dependencies\n    if (node.hasShrinkwrap || node.inShrinkwrap || node.inBundle) {\n      return depValid(node, this.rawSpec, this.accept, this.#safeFrom)\n    }\n    // Patch replacing\n    // return depValid(node, this.spec, this.#accept, this.#from)\n    // is based on https://github.com/npm/cli/pull/8089.\n    //\n    // If there's no override we just use the spec.\n    if (!this.overrides?.keySpec) {\n      return depValid(node, this.spec, this.accept, this.#safeFrom)\n    }\n    // There's some override. If the target node satisfies the overriding spec\n    // then it's okay.\n    if (depValid(node, this.spec, this.accept, this.#safeFrom)) {\n      return true\n    }\n    // If it doesn't, then it should at least satisfy the original spec.\n    if (!depValid(node, this.rawSpec, this.accept, this.#safeFrom)) {\n      return false\n    }\n    // It satisfies the original spec, not the overriding spec. We need to make\n    // sure it doesn't use the overridden spec.\n    // For example:\n    //   we might have an ^8.0.0 rawSpec, and an override that makes\n    //   keySpec=8.23.0 and the override value spec=9.0.0.\n    //   If the node is 9.0.0, then it's okay because it's consistent with spec.\n    //   If the node is 8.24.0, then it's okay because it's consistent with the rawSpec.\n    //   If the node is 8.23.0, then it's not okay because even though it's consistent\n    //   with the rawSpec, it's also consistent with the keySpec.\n    //   So we're looking for ^8.0.0 or 9.0.0 and not 8.23.0.\n    return !depValid(node, this.overrides.keySpec, this.accept, this.#safeFrom)\n  }\n}\n","import semver from 'semver'\n\nimport { PackageURL } from '@socketregistry/packageurl-js'\nimport { getManifestData } from '@socketsecurity/registry'\nimport { hasOwn } from '@socketsecurity/registry/lib/objects'\nimport { fetchPackagePackument } from '@socketsecurity/registry/lib/packages'\nimport { isNonEmptyString } from '@socketsecurity/registry/lib/strings'\n\nimport constants from '../../constants.mts'\nimport { applyRange, getMajor } from '../../utils/semver.mts'\nimport { idToPurl } from '../../utils/spec.mts'\nimport { DiffAction } from './arborist/lib/arborist/types.mts'\nimport { Edge } from './arborist/lib/edge.mts'\nimport { getAlertsMapFromPurls } from '../../utils/alerts-map.mts'\n\nimport type { RangeStyle } from '../../utils/semver.mts'\nimport type { SafeArborist } from './arborist/lib/arborist/index.mts'\nimport type { Diff } from './arborist/lib/arborist/types.mts'\nimport type { SafeEdge } from './arborist/lib/edge.mts'\nimport type { LinkClass, SafeNode } from './arborist/lib/node.mts'\nimport type {\n  AlertIncludeFilter,\n  AlertsByPkgId,\n} from '../../utils/socket-package-alert.mts'\nimport type { EditablePackageJson } from '@socketsecurity/registry/lib/packages'\nimport type { Spinner } from '@socketsecurity/registry/lib/spinner'\n\nconst { LOOP_SENTINEL, NPM, NPM_REGISTRY_URL } = constants\n\nfunction getUrlOrigin(input: string): string {\n  try {\n    // TODO: URL.parse is available in Node 22.1.0. We can use it when we drop Node 18.\n    // https://nodejs.org/docs/latest-v22.x/api/url.html#urlparseinput-base\n    // return URL.parse(input)?.origin ?? ''\n    return new URL(input).origin ?? ''\n  } catch {}\n  return ''\n}\n\nexport function findBestPatchVersion(\n  node: SafeNode,\n  availableVersions: string[],\n  vulnerableVersionRange?: string,\n  _firstPatchedVersionIdentifier?: string | undefined,\n): string | null {\n  const manifestData = getManifestData(NPM, node.name)\n  let eligibleVersions\n  if (manifestData && manifestData.name === manifestData.package) {\n    const major = getMajor(manifestData.version)\n    if (typeof major !== 'number') {\n      return null\n    }\n    eligibleVersions = availableVersions.filter(v => getMajor(v) === major)\n  } else {\n    const major = getMajor(node.version)\n    if (typeof major !== 'number') {\n      return null\n    }\n    eligibleVersions = availableVersions.filter(\n      v =>\n        // Filter for versions that are within the current major version and\n        // are NOT in the vulnerable range.\n        getMajor(v) === major &&\n        (!vulnerableVersionRange ||\n          !semver.satisfies(v, vulnerableVersionRange)),\n    )\n  }\n  return eligibleVersions ? semver.maxSatisfying(eligibleVersions, '*') : null\n}\n\nexport function findPackageNode(\n  tree: SafeNode,\n  name: string,\n  version?: string | undefined,\n): SafeNode | undefined {\n  const queue: Array<SafeNode | LinkClass> = [tree]\n  const visited = new Set<SafeNode>()\n  let sentinel = 0\n  while (queue.length) {\n    if (sentinel++ === LOOP_SENTINEL) {\n      throw new Error('Detected infinite loop in findPackageNode')\n    }\n    const nodeOrLink = queue.pop()!\n    const node = getTargetNode(nodeOrLink)\n    if (visited.has(node)) {\n      continue\n    }\n    visited.add(node)\n    if (\n      node.name === name &&\n      (typeof version !== 'string' || node.version === version)\n    ) {\n      return node\n    }\n    for (const child of node.children.values()) {\n      queue.push(child)\n    }\n    for (const edge of node.edgesOut.values()) {\n      const { to } = edge\n      if (to) {\n        queue.push(to)\n      }\n    }\n  }\n  return undefined\n}\n\nexport function findPackageNodes(\n  tree: SafeNode,\n  name: string,\n  version?: string | undefined,\n): SafeNode[] {\n  const matches: SafeNode[] = []\n  const queue: Array<SafeNode | LinkClass> = [tree]\n  const visited = new Set<SafeNode>()\n  let sentinel = 0\n  while (queue.length) {\n    if (sentinel++ === LOOP_SENTINEL) {\n      throw new Error('Detected infinite loop in findPackageNodes')\n    }\n    const nodeOrLink = queue.pop()!\n    const node = getTargetNode(nodeOrLink)\n    if (visited.has(node)) {\n      continue\n    }\n    visited.add(node)\n    if (\n      node.name === name &&\n      (typeof version !== 'string' || node.version === version)\n    ) {\n      matches.push(node)\n    }\n    for (const child of node.children.values()) {\n      queue.push(child)\n    }\n    for (const edge of node.edgesOut.values()) {\n      const { to } = edge\n      if (to) {\n        queue.push(to)\n      }\n    }\n  }\n  return matches\n}\n\nexport type GetAlertsMapFromArboristOptions = {\n  consolidate?: boolean | undefined\n  include?: AlertIncludeFilter | undefined\n  nothrow?: boolean | undefined\n  spinner?: Spinner | undefined\n}\n\nexport async function getAlertsMapFromArborist(\n  arb: SafeArborist,\n  options_?: GetAlertsMapFromArboristOptions | undefined,\n): Promise<AlertsByPkgId> {\n  const options = {\n    __proto__: null,\n    consolidate: false,\n    include: undefined,\n    limit: Infinity,\n    nothrow: false,\n    ...options_,\n  } as GetAlertsMapFromArboristOptions\n\n  options.include = {\n    __proto__: null,\n    // Leave 'actions' unassigned so it can be given a default value in\n    // subsequent functions where `options` is passed.\n    // actions: undefined,\n    blocked: true,\n    critical: true,\n    cve: true,\n    existing: false,\n    unfixable: true,\n    upgradable: false,\n    ...options.include,\n  } as AlertIncludeFilter\n\n  const needInfoOn = getDetailsFromDiff(arb.diff, {\n    include: {\n      unchanged: options.include.existing,\n    },\n  })\n\n  const purls = needInfoOn.map(d => idToPurl(d.node.pkgid))\n\n  let overrides: { [key: string]: string } | undefined\n  const overridesMap = (\n    arb.actualTree ??\n    arb.idealTree ??\n    (await arb.loadActual())\n  )?.overrides?.children\n  if (overridesMap) {\n    overrides = Object.fromEntries(\n      [...overridesMap.entries()].map(([key, overrideSet]) => {\n        return [key, overrideSet.value!]\n      }),\n    )\n  }\n\n  return await getAlertsMapFromPurls(purls, {\n    overrides,\n    ...options,\n  })\n}\n\nexport type DiffQueryIncludeFilter = {\n  unchanged?: boolean | undefined\n  unknownOrigin?: boolean | undefined\n}\n\nexport type DiffQueryOptions = {\n  include?: DiffQueryIncludeFilter | undefined\n}\n\nexport type PackageDetail = {\n  node: SafeNode\n  existing?: SafeNode | undefined\n}\n\nexport function getDetailsFromDiff(\n  diff_: Diff | null,\n  options?: DiffQueryOptions | undefined,\n): PackageDetail[] {\n  const details: PackageDetail[] = []\n  // `diff_` is `null` when `npm install --package-lock-only` is passed.\n  if (!diff_) {\n    return details\n  }\n\n  const include = {\n    __proto__: null,\n    unchanged: false,\n    unknownOrigin: false,\n    ...({ __proto__: null, ...options } as DiffQueryOptions).include,\n  } as DiffQueryIncludeFilter\n\n  const queue: Diff[] = [...diff_.children]\n  let pos = 0\n  let { length: queueLength } = queue\n  while (pos < queueLength) {\n    if (pos === LOOP_SENTINEL) {\n      throw new Error('Detected infinite loop while walking Arborist diff')\n    }\n    const diff = queue[pos++]!\n    const { action } = diff\n    if (action) {\n      // The `pkgNode`, i.e. the `ideal` node, will be `undefined` if the diff\n      // action is 'REMOVE'\n      // The `oldNode`, i.e. the `actual` node, will be `undefined` if the diff\n      // action is 'ADD'.\n      const { actual: oldNode, ideal: pkgNode } = diff\n      let existing: SafeNode | undefined\n      let keep = false\n      if (action === DiffAction.change) {\n        if (pkgNode?.package.version !== oldNode?.package.version) {\n          keep = true\n          if (\n            oldNode?.package.name &&\n            oldNode.package.name === pkgNode?.package.name\n          ) {\n            existing = oldNode\n          }\n        } else {\n          // TODO: This debug log has too much information. We should narrow it down.\n          // debugLog('SKIPPING META CHANGE ON', diff)\n        }\n      } else {\n        keep = action !== DiffAction.remove\n      }\n      if (keep && pkgNode?.resolved && (!oldNode || oldNode.resolved)) {\n        if (\n          include.unknownOrigin ||\n          getUrlOrigin(pkgNode.resolved) === NPM_REGISTRY_URL\n        ) {\n          details.push({\n            node: pkgNode,\n            existing,\n          })\n        }\n      }\n    }\n    for (const child of diff.children) {\n      queue[queueLength++] = child\n    }\n  }\n  if (include.unchanged) {\n    const { unchanged } = diff_!\n    for (let i = 0, { length } = unchanged; i < length; i += 1) {\n      const pkgNode = unchanged[i]!\n      if (\n        include.unknownOrigin ||\n        getUrlOrigin(pkgNode.resolved!) === NPM_REGISTRY_URL\n      ) {\n        details.push({\n          node: pkgNode,\n          existing: pkgNode,\n        })\n      }\n    }\n  }\n  return details\n}\n\nexport function getTargetNode(nodeOrLink: SafeNode | LinkClass): SafeNode\nexport function getTargetNode<T>(nodeOrLink: T): SafeNode | null\nexport function getTargetNode(nodeOrLink: any): SafeNode | null {\n  return nodeOrLink?.isLink ? nodeOrLink.target : (nodeOrLink ?? null)\n}\n\nexport function isTopLevel(tree: SafeNode, node: SafeNode): boolean {\n  return getTargetNode(tree.children.get(node.name)) === node\n}\n\nexport type Packument = Exclude<\n  Awaited<ReturnType<typeof fetchPackagePackument>>,\n  null\n>\n\nexport function updateNode(\n  node: SafeNode,\n  newVersion: string,\n  newVersionPackument: Packument['versions'][number],\n): void {\n  // Object.defineProperty is needed to set the version property and replace\n  // the old value with newVersion.\n  Object.defineProperty(node, 'version', {\n    configurable: true,\n    enumerable: true,\n    get: () => newVersion,\n  })\n  // Update package.version associated with the node.\n  node.package.version = newVersion\n  // Update node.resolved.\n  const purlObj = PackageURL.fromString(idToPurl(node.name))\n  node.resolved = `${NPM_REGISTRY_URL}/${node.name}/-/${purlObj.name}-${newVersion}.tgz`\n  // Update node.integrity with the targetPackument.dist.integrity value if available\n  // else delete node.integrity so a new value is resolved for the target version.\n  const { integrity } = newVersionPackument.dist\n  if (integrity) {\n    node.integrity = integrity\n  } else {\n    delete node.integrity\n  }\n  // Update node.package.deprecated based on targetPackument.deprecated.\n  if (hasOwn(newVersionPackument, 'deprecated')) {\n    node.package['deprecated'] = newVersionPackument.deprecated as string\n  } else {\n    delete node.package['deprecated']\n  }\n  // Update node.package.dependencies.\n  const newDeps = { ...newVersionPackument.dependencies }\n  const { dependencies: oldDeps } = node.package\n  node.package.dependencies = newDeps\n  if (oldDeps) {\n    for (const oldDepName of Object.keys(oldDeps)) {\n      if (!hasOwn(newDeps, oldDepName)) {\n        // Detach old edges for dependencies that don't exist on the updated\n        // node.package.dependencies.\n        node.edgesOut.get(oldDepName)?.detach()\n      }\n    }\n  }\n  for (const newDepName of Object.keys(newDeps)) {\n    if (!hasOwn(oldDeps, newDepName)) {\n      // Add new edges for dependencies that don't exist on the old\n      // node.package.dependencies.\n      node.addEdgeOut(\n        new Edge({\n          from: node,\n          name: newDepName,\n          spec: newDeps[newDepName],\n          type: 'prod',\n        }) as unknown as SafeEdge,\n      )\n    }\n  }\n}\n\nexport function updatePackageJsonFromNode(\n  editablePkgJson: EditablePackageJson,\n  tree: SafeNode,\n  node: SafeNode,\n  newVersion: string,\n  rangeStyle?: RangeStyle | undefined,\n): boolean {\n  let result = false\n  if (!isTopLevel(tree, node)) {\n    return result\n  }\n  const { name } = node\n  for (const depField of [\n    'dependencies',\n    'optionalDependencies',\n    'peerDependencies',\n  ]) {\n    const depObject = editablePkgJson.content[depField] as\n      | { [key: string]: string }\n      | undefined\n    const oldRange = hasOwn(depObject, name) ? depObject[name] : undefined\n    const oldMin = isNonEmptyString(oldRange)\n      ? semver.minVersion(oldRange)\n      : null\n    const newRange =\n      oldMin &&\n      // Ensure we're on the same major version...\n      semver.major(newVersion) === semver.major(oldMin.version) &&\n      // and not a downgrade.\n      semver.gte(newVersion, oldMin.version)\n        ? applyRange(oldRange!, newVersion, rangeStyle)\n        : oldRange!\n    if (oldRange !== newRange) {\n      result = true\n      editablePkgJson.update({\n        [depField]: {\n          ...depObject,\n          [name]: newRange,\n        },\n      })\n    }\n  }\n  return result\n}\n","import { createRequire } from 'node:module'\n\nimport { logger } from '@socketsecurity/registry/lib/logger'\n\nimport constants from '../../../../../constants.mts'\nimport { logAlertsMap } from '../../../../../utils/socket-package-alert.mts'\nimport { getAlertsMapFromArborist } from '../../../arborist-helpers.mts'\nimport { getArboristClassPath } from '../../../paths.mts'\n\nimport type { ArboristClass, ArboristReifyOptions } from './types.mts'\nimport type { SafeNode } from '../node.mts'\n\nconst require = createRequire(import.meta.url)\n\nconst {\n  NPM,\n  NPX,\n  SOCKET_CLI_ACCEPT_RISKS,\n  SOCKET_CLI_SAFE_BIN,\n  SOCKET_CLI_SAFE_PROGRESS,\n  SOCKET_CLI_VIEW_ALL_RISKS,\n  kInternalsSymbol,\n  [kInternalsSymbol as unknown as 'Symbol(kInternalsSymbol)']: { getIpc },\n} = constants\n\nexport const SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES = {\n  __proto__: null,\n  audit: false,\n  dryRun: true,\n  fund: false,\n  ignoreScripts: true,\n  progress: false,\n  save: false,\n  saveBundle: false,\n  silent: true,\n}\n\nexport const kCtorArgs = Symbol('ctorArgs')\n\nexport const kRiskyReify = Symbol('riskyReify')\n\nexport const Arborist: ArboristClass = require(getArboristClassPath())\n\n// Implementation code not related to our custom behavior is based on\n// https://github.com/npm/cli/blob/v11.0.0/workspaces/arborist/lib/arborist/index.js:\nexport class SafeArborist extends Arborist {\n  constructor(...ctorArgs: ConstructorParameters<ArboristClass>) {\n    super(\n      {\n        path:\n          (ctorArgs.length ? ctorArgs[0]?.path : undefined) ?? process.cwd(),\n        ...(ctorArgs.length ? ctorArgs[0] : undefined),\n        ...SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES,\n      },\n      ...ctorArgs.slice(1),\n    )\n    ;(this as any)[kCtorArgs] = ctorArgs\n  }\n\n  async [kRiskyReify](\n    ...args: Parameters<InstanceType<ArboristClass>['reify']>\n  ): Promise<SafeNode> {\n    const ctorArgs = (this as any)[kCtorArgs]\n    const arb = new Arborist(\n      {\n        ...(ctorArgs.length ? ctorArgs[0] : undefined),\n        progress: false,\n      },\n      ...ctorArgs.slice(1),\n    )\n    const ret = await (arb.reify as (...args: any[]) => Promise<SafeNode>)(\n      {\n        ...(args.length ? args[0] : undefined),\n        progress: false,\n      },\n      ...args.slice(1),\n    )\n    Object.assign(this, arb)\n    return ret\n  }\n\n  // @ts-ignore Incorrectly typed.\n  override async reify(\n    this: SafeArborist,\n    ...args: Parameters<InstanceType<ArboristClass>['reify']>\n  ): Promise<SafeNode> {\n    const options = {\n      __proto__: null,\n      ...(args.length ? args[0] : undefined),\n    } as ArboristReifyOptions\n    const ipc = await getIpc()\n    const binName = ipc[SOCKET_CLI_SAFE_BIN]\n    if (!binName) {\n      return await this[kRiskyReify](...args)\n    }\n    await super.reify(\n      {\n        ...options,\n        ...SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES,\n        progress: false,\n      },\n      // @ts-ignore: TypeScript gets grumpy about rest parameters.\n      ...args.slice(1),\n    )\n    // Lazily access constants.ENV.SOCKET_CLI_ACCEPT_RISKS.\n    const acceptRisks = constants.ENV.SOCKET_CLI_ACCEPT_RISKS\n    const progress = ipc[SOCKET_CLI_SAFE_PROGRESS]\n    const spinner =\n      options['silent'] || !progress\n        ? undefined\n        : // Lazily access constants.spinner.\n          constants.spinner\n    const isSafeNpm = binName === NPM\n    const isSafeNpx = binName === NPX\n    const alertsMap = await getAlertsMapFromArborist(this, {\n      spinner,\n      include:\n        acceptRisks || options.dryRun || options['yes']\n          ? {\n              actions: ['error'],\n              blocked: true,\n              critical: false,\n              cve: false,\n              existing: true,\n              unfixable: false,\n            }\n          : {\n              existing: isSafeNpx,\n              unfixable: isSafeNpm,\n            },\n    })\n    if (alertsMap.size) {\n      process.exitCode = 1\n      // Lazily access constants.ENV.SOCKET_CLI_VIEW_ALL_RISKS.\n      const viewAllRisks = constants.ENV.SOCKET_CLI_VIEW_ALL_RISKS\n      logAlertsMap(alertsMap, {\n        hideAt: viewAllRisks ? 'none' : 'middle',\n        output: process.stderr,\n      })\n      throw new Error(\n        `\n          Socket ${binName} exiting due to risks.${\n            viewAllRisks\n              ? ''\n              : `\\nView all risks - Rerun with environment variable ${SOCKET_CLI_VIEW_ALL_RISKS}=1.`\n          }${\n            acceptRisks\n              ? ''\n              : `\\nAccept risks - Rerun with environment variable ${SOCKET_CLI_ACCEPT_RISKS}=1.`\n          }\n        `.trim(),\n      )\n    } else if (!options['silent']) {\n      logger.success(\n        `Socket ${binName} ${acceptRisks ? 'accepted' : 'found no'} risks`,\n      )\n      if (binName === NPX) {\n        logger.log(`Running ${options.add![0]}`)\n      }\n    }\n    return await this[kRiskyReify](...args)\n  }\n}\n","import { createRequire } from 'node:module'\n\nimport {\n  getArboristClassPath,\n  getArboristEdgeClassPath,\n  getArboristNodeClassPath,\n  getArboristOverrideSetClassPath,\n} from '../paths.mts'\nimport { SafeArborist } from './lib/arborist/index.mts'\nimport { SafeEdge } from './lib/edge.mts'\nimport { SafeNode } from './lib/node.mts'\nimport { SafeOverrideSet } from './lib/override-set.mts'\n\nconst require = createRequire(import.meta.url)\n\nexport function installSafeArborist() {\n  // Override '@npmcli/arborist' module exports with patched variants based on\n  // https://github.com/npm/cli/pull/8089.\n  const cache: { [key: string]: any } = require.cache\n  cache[getArboristClassPath()] = { exports: SafeArborist }\n  cache[getArboristEdgeClassPath()] = { exports: SafeEdge }\n  cache[getArboristNodeClassPath()] = { exports: SafeNode }\n  cache[getArboristOverrideSetClassPath()] = { exports: SafeOverrideSet }\n}\n","import { installSafeArborist } from './arborist/index.mts'\n\ninstallSafeArborist()\n"],"names":["add","change","remove","_arboristPkgPath","_depValid","UNDEFINED_TOKEN","id","transformer","mod","canDedupe","canReplaceWith","overrides","recalculateOutEdgesOverrides","edge","newOverrideSet","from","detach","explain","bundled","overridden","error","rawSpec","explanation","reload","needToUpdateOverrideSet","NPM_REGISTRY_URL","eligibleVersions","getMajor","visited","queue","to","matches","__proto__","consolidate","include","limit","nothrow","blocked","critical","cve","existing","unfixable","upgradable","unchanged","unknownOrigin","length","action","actual","ideal","keep","node","Object","configurable","enumerable","integrity","dependencies","name","spec","type","semver","result","getIpc","audit","dryRun","fund","ignoreScripts","progress","save","saveBundle","silent","path","constants","hideAt","logger","cache","exports","installSafeArborist"],"mappings":";;;;;;;;;;;;;;AAsDO;AACLA;AACAC;AACAC;AACF;;ACnDA;AACO;;;AAGH;AAGA;AAIA;AACAC;AAGF;AACA;AACF;AAEA;AACO;;;AAML;AACA;AACF;AAEA;AACO;;;AAML;AACA;AACF;AAEA;AACO;;;AAGL;AACA;AACF;AAEA;AACO;;;AAGL;AACA;AACF;AAEA;AACO;;;AAML;AACA;AACF;;ACnEA,iBAAA;AASA;AACO;;AAOHC;AACF;;AAEF;;ACvBA;AAAQC;AAAgB;AAaxB;AAIE;AACE;AACA;AACA;AACEC;AACAC;AACF;AACED;;AAEF;;AAEE;AACA;;;AAGE;AACF;;AAEJ;AACA;AACF;AAOA;AACO;;;AAMC;AACA;AACAE;AAIN;AACA;AACF;;AClDA,iBAAA;AAsBA;;AAEA;AACA;AACO;AACL;AACA;AACA;AAIE;AACA;AACA;;AAEF;;AAEA;AACA;AACA;AAIE;AAKE;AACE;AACF;AACF;AACA;AAKE;AACE;AACF;AACF;AACA;AACA;;AAEA;AACF;;AAEA;AACA;;;AAGI;AACF;AACA;AAAa;AAAQ;AAAoB;;;AAGrC;AACF;AACA;AACE;AACF;AACA;AACE;AACF;AACF;AACA;AACF;;;AAII;AACE;AACF;AACA;AACA;AACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACE;AACE;AACF;AACA;AACF;;AAEE;AAGE;AACF;AACA;AACF;AACA;AACA;AACA;AACA;AACF;AACA;AACF;;AAEA;AACA;;;AAGI;AACF;;AAEE;AACF;AACA;AAIE;AACF;AACA;AACE;AACF;AACA;;AAEA;;AAEF;AACF;;AC5JA,iBAAA;AA8EA;;AAEA;AACA;AACO;AACL;AACA;AACA;AACSC;AACP;AACA;AACE;AACF;AACA;AACA;AACE;AACF;AACA;AACA;AACE;AACF;AACA;AACA;;AAEE;AACF;AACA;AACA;AACE;AACF;AACA;AACA;AACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACE;AACF;AACA;AACA;AACA;AACE;AACF;AACA;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACSC;AACP;AACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACE;;;AAGI;AACF;AACF;;AAEI;AACF;AACF;AACF;AACA;AACA;AACA;AACA;AACA;;AAEA;AACE;AACF;;;;;;AAME;AACF;AACA;AACF;;AAEA;;AAEE;;AACQC;AAAU;AAClB;AACE;AACF;AACF;;AAGE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACE;AACF;AACA;AACA;;AAEF;;AAEA;;AAEE;AACA;AACA;;AAME;AACF;AACA;AACA;AACA;AACA;AACA;AACA;;AAMI;AACE;AACF;AACF;AACF;AACA;AACF;;AAGE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACQA;AAAU;AAClB;;AAEA;;;;;;AAME;AACF;AACF;;AAEA;AACA;AACSC;AACP;;AAEEC;;;AAGA;AACF;AACF;;AAEA;;AAEE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACE;AAAuCF;AAAc;AACvD;;;;;;AAME;AACF;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;;AAKI;AACA;AACA;AACA;AACA;AACF;AACA;;;AAGE;AACF;;AAEE;AACF;;AAKA;;AAEI;AACF;;;AAGA;AACF;AACA;AACA;AACA;;AAEA;AACF;;AAEA;AACA;;AAEE;AACA;AACA;AACE;AACF;AACA;AACA;;AACUA;AAAyB;;;AAMjC;AACEG;AACF;AACF;;AAEE;AACF;;AAEA;AACE;AACA;AACA;AACA;AACA;;AAEF;AACA;AACF;AACF;;AChYA,iBAAA;AAqDO;;AAEP;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO;AACL;AACA;AACA;AACA;;;AAGUC;AAAK;AACb;;AAEA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACF;;AAGE;AACF;;AAGE;AACE;;AAEI;AACF;AACE;AACF;AACF;AAGE;AACA;AACA;AAEA;AACF;AACE;AACF;AACA;AACA;AAAA;AASE;AACA;AACA;AACA;AACA;AACA;AACF;AACE;AACF;AACF;AACA;AACE;AACF;;AAEF;;AAEA;;;AAGA;;AAEA;;;;;AASM;AACA;AACA;AACA;AACA;;AAIA;AACE;AACF;AACA;AACE;AACF;AACA;AACE;AACF;AACA;AACE;AACF;;AAEF;AACA;AACF;;AAEF;;AAEA;;;AAGA;AAESC;AACP;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACF;;AAEA;AACA;AACSC;AACP;AACE;;;;AAIEC;AACAC;AACAC;AACAL;AACAM;;AAEF;AACEC;;AAEF;;AAEEA;AACF;;AAEEA;AACF;AACA;;AAEA;AACA;AACF;;AAEF;AAESC;AACP;AACA;AACA;AACA;;AAEA;AACA;AACA;;;AAGI;AACA;AACA;AACA;AACAC;;;AAGF;AACF;;AAEA;AACA;AACA;AACA;AACA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACF;AACA;AACA;AAAA;AAEE;AACA;AACA;AACF;AACF;;AAGE;AACA;AACA;AACA;AACA;AACA;AACE;AACF;AACA;AACA;;AAEE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACE;AACF;AACA;AACA;AACA;AACE;AACF;AACA;AACA;AACE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF;AACF;;AC3SA;;;AAA4BC;AAAiB;AAE7C;;AAEI;AACA;AACA;;;AAGF;AACF;AAEO;;AAOL;;AAEE;AACA;AACE;AACF;AACAC;AACF;AACE;AACA;AACE;AACF;AACAA;AAEI;AACA;AACAC;AAIN;;AAEF;AAEO;AAKL;AACA;;;AAGE;AACE;AACF;AACA;AACA;AACA;AACE;AACF;AACAC;AACA;AAIE;AACF;;AAEEC;AACF;;;AAEUC;AAAG;AACX;AACED;AACF;AACF;AACF;AACA;AACF;AAEO;;AAML;AACA;;;AAGE;AACE;AACF;AACA;AACA;AACA;AACE;AACF;AACAD;AACA;AAIEG;AACF;;AAEEF;AACF;;;AAEUC;AAAG;AACX;AACED;AACF;AACF;AACF;AACA;AACF;AASO;AAIL;AACEG;AACAC;AACAC;AACAC;AACAC;;;;AAKAJ;AACA;AACA;AACA;AACAK;AACAC;AACAC;AACAC;AACAC;AACAC;AACA;;AAGF;AACER;AACES;AACF;AACF;AAEA;AAEA;;AAMA;;AAGM;AACF;AAEJ;AAEA;;;AAGA;AACF;AAgBO;;AAKL;;AAEE;AACF;AAEA;AACEX;AACAW;AACAC;;AACMZ;;AAA4B;;AAGpC;;;AAEMa;AAAoB;;;AAGtB;AACF;AACA;;AACQC;AAAO;AACf;AACE;AACA;AACA;AACA;;AACQC;AAAiBC;AAAe;AACxC;;AAEA;;AAEIC;AACA;AAIET;AACF;AACF;AAIF;AACES;AACF;AACA;AACE;;AAKIC;AACAV;AACF;AACF;AACF;AACF;AACA;AACEX;AACF;AACF;;;AAEUc;AAAU;AAClB;AAAkBE;;AAChB;AACA;;AAKIK;AACAV;AACF;AACF;AACF;AACF;AACA;AACF;AAIO;;AAEP;AAEO;AACL;AACF;AAOO;AAKL;AACA;AACAW;AACEC;AACAC;;AAEF;AACA;AACAH;AACA;AACA;AACAA;AACA;AACA;;AACQI;;AACR;;AAEA;;AAEA;AACA;AACA;;AAEA;AACE;AACF;AACA;AACA;AAAkB;;;AACVC;;AACRL;AACA;;AAEI;AACE;AACA;;AAEF;AACF;AACF;;AAEE;AACE;AACA;AACAA;AAEInC;AACAyC;AACAC;AACAC;AACF;AAEJ;AACF;AACF;AAEO;;AAQL;AACE;AACF;;AACQF;AAAK;;AAMX;AAGA;AACA;;AAKE;AACAG;AACA;AACAA;;AAIAC;;AAEE;AACE;AACA;AACF;AACF;AACF;AACF;AACA;AACF;;AC3ZA,iBAAA;AAEA;;;;;;;;AAQE;AAA+DC;AAAO;AACxE;AAEO;AACL7B;AACA8B;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACF;AAEO;AAEA;AAEA;;AAEP;AACA;AACO;;AAEH;AAEIC;;;;AAOF;AACJ;AAEA;AAGE;AACA;;AAGIJ;;AAIJ;;AAGIA;;AAIJf;AACA;AACF;;AAEA;AACA;AAIE;AACEnB;;;AAGF;AACA;;;AAGA;;AAGI;AACA;AACAkC;;AAEF;AACA;AAEF;AACA;AACA;;AAIM;AACAK;AACN;AACA;AACA;;;;AAMUlC;AACAC;AACAC;AACAC;AACAC;AACF;AAEED;AACAC;AACF;AACR;;;AAGE;AACA;;AAEE+B;;AAEF;;AAGN;AAQA;AAGI;AACEC;;;AAKA;AACF;;AAEF;AACF;;ACrJA,iBAAA;AAEO;AACL;AACA;AACA;AACAC;AAAkCC;;AAClCD;AAAsCC;;AACtCD;AAAsCC;;AACtCD;AAA6CC;;AAC/C;;ACrBAC;;;;;;;;;;","debugId":"aa999c00-ac0b-4e97-b4fe-41280eca7c7b"}
+{"version":3,"file":"shadow-inject.js","sources":["../src/shadow/npm/paths.mts","../src/shadow/npm/arborist/types.mts","../src/shadow/npm/arborist-helpers.mts","../src/shadow/npm/arborist/lib/arborist/index.mts","../src/shadow/npm/arborist/index.mts","../src/shadow/npm/inject.mts"],"sourcesContent":["import path from 'node:path'\n\nimport { normalizePath } from '@socketsecurity/registry/lib/path'\n\nimport constants from '../../constants.mts'\nimport { getNpmRequire } from '../../utils/npm-paths.mts'\n\nlet _arboristPkgPath: string | undefined\nexport function getArboristPackagePath() {\n  if (_arboristPkgPath === undefined) {\n    const pkgName = '@npmcli/arborist'\n    const mainPathWithForwardSlashes = normalizePath(\n      getNpmRequire().resolve(pkgName),\n    )\n    const arboristPkgPathWithForwardSlashes = mainPathWithForwardSlashes.slice(\n      0,\n      mainPathWithForwardSlashes.lastIndexOf(pkgName) + pkgName.length,\n    )\n    // Lazily access constants.WIN32.\n    _arboristPkgPath = constants.WIN32\n      ? path.normalize(arboristPkgPathWithForwardSlashes)\n      : arboristPkgPathWithForwardSlashes\n  }\n  return _arboristPkgPath\n}\n\nlet _arboristClassPath: string | undefined\nexport function getArboristClassPath() {\n  if (_arboristClassPath === undefined) {\n    _arboristClassPath = path.join(\n      getArboristPackagePath(),\n      'lib/arborist/index.js',\n    )\n  }\n  return _arboristClassPath\n}\n\nlet _arboristDepValidPath: string | undefined\nexport function getArboristDepValidPath() {\n  if (_arboristDepValidPath === undefined) {\n    _arboristDepValidPath = path.join(\n      getArboristPackagePath(),\n      'lib/dep-valid.js',\n    )\n  }\n  return _arboristDepValidPath\n}\n\nlet _arboristEdgeClassPath: string | undefined\nexport function getArboristEdgeClassPath() {\n  if (_arboristEdgeClassPath === undefined) {\n    _arboristEdgeClassPath = path.join(getArboristPackagePath(), 'lib/edge.js')\n  }\n  return _arboristEdgeClassPath\n}\n\nlet _arboristNodeClassPath: string | undefined\nexport function getArboristNodeClassPath() {\n  if (_arboristNodeClassPath === undefined) {\n    _arboristNodeClassPath = path.join(getArboristPackagePath(), 'lib/node.js')\n  }\n  return _arboristNodeClassPath\n}\n\nlet _arboristOverrideSetClassPath: string | undefined\nexport function getArboristOverrideSetClassPath() {\n  if (_arboristOverrideSetClassPath === undefined) {\n    _arboristOverrideSetClassPath = path.join(\n      getArboristPackagePath(),\n      'lib/override-set.js',\n    )\n  }\n  return _arboristOverrideSetClassPath\n}\n","import { createEnum } from '../../../utils/objects.mts'\n\nimport type {\n  Options as ArboristOptions,\n  Advisory as BaseAdvisory,\n  Arborist as BaseArborist,\n  AuditReport as BaseAuditReport,\n  Diff as BaseDiff,\n  Edge as BaseEdge,\n  Node as BaseNode,\n  BaseOverrideSet,\n  BuildIdealTreeOptions,\n  ReifyOptions,\n} from '@npmcli/arborist'\n\nexport type ArboristClass = ArboristInstance & {\n  new (...args: any): ArboristInstance\n}\n\nexport type ArboristInstance = Omit<\n  typeof BaseArborist,\n  | 'actualTree'\n  | 'auditReport'\n  | 'buildIdealTree'\n  | 'diff'\n  | 'idealTree'\n  | 'loadActual'\n  | 'loadVirtual'\n  | 'reify'\n> & {\n  auditReport?: AuditReportInstance | null | undefined\n  actualTree?: NodeClass | null | undefined\n  diff: Diff | null\n  idealTree?: NodeClass | null | undefined\n  buildIdealTree(options?: BuildIdealTreeOptions): Promise<NodeClass>\n  loadActual(options?: ArboristOptions): Promise<NodeClass>\n  loadVirtual(options?: ArboristOptions): Promise<NodeClass>\n  reify(options?: ArboristReifyOptions): Promise<NodeClass>\n}\n\nexport type ArboristReifyOptions = ReifyOptions & ArboristOptions\n\nexport type AuditAdvisory = Omit<BaseAdvisory, 'id'> & {\n  id: number\n  cwe: string[]\n  cvss: {\n    score: number\n    vectorString: string\n  }\n  vulnerable_versions: string\n}\n\nexport type AuditReportInstance = Omit<BaseAuditReport, 'report'> & {\n  report: { [dependency: string]: AuditAdvisory[] }\n}\n\nexport const DiffAction = createEnum({\n  add: 'ADD',\n  change: 'CHANGE',\n  remove: 'REMOVE',\n})\n\nexport type Diff = Omit<\n  BaseDiff,\n  | 'actual'\n  | 'children'\n  | 'filterSet'\n  | 'ideal'\n  | 'leaves'\n  | 'removed'\n  | 'shrinkwrapInflated'\n  | 'unchanged'\n> & {\n  actual: NodeClass\n  children: Diff[]\n  filterSet: Set<NodeClass>\n  ideal: NodeClass\n  leaves: NodeClass[]\n  parent: Diff | null\n  removed: NodeClass[]\n  shrinkwrapInflated: Set<NodeClass>\n  unchanged: NodeClass[]\n}\n\nexport type EdgeClass = Omit<\n  BaseEdge,\n  | 'accept'\n  | 'detach'\n  | 'optional'\n  | 'overrides'\n  | 'peer'\n  | 'peerConflicted'\n  | 'rawSpec'\n  | 'reload'\n  | 'satisfiedBy'\n  | 'spec'\n  | 'to'\n> & {\n  optional: boolean\n  overrides: OverrideSetClass | undefined\n  peer: boolean\n  peerConflicted: boolean\n  rawSpec: string\n  get accept(): string | undefined\n  get spec(): string\n  get to(): NodeClass | null\n  new (...args: any): EdgeClass\n  detach(): void\n  reload(hard?: boolean): void\n  satisfiedBy(node: NodeClass): boolean\n}\n\nexport type LinkClass = Omit<NodeClass, 'isLink'> & {\n  readonly isLink: true\n}\n\nexport type NodeClass = Omit<\n  BaseNode,\n  | 'addEdgeIn'\n  | 'addEdgeOut'\n  | 'canDedupe'\n  | 'canReplace'\n  | 'canReplaceWith'\n  | 'children'\n  | 'deleteEdgeIn'\n  | 'edgesIn'\n  | 'edgesOut'\n  | 'from'\n  | 'hasShrinkwrap'\n  | 'inDepBundle'\n  | 'inShrinkwrap'\n  | 'integrity'\n  | 'isTop'\n  | 'matches'\n  | 'meta'\n  | 'name'\n  | 'overrides'\n  | 'packageName'\n  | 'parent'\n  | 'recalculateOutEdgesOverrides'\n  | 'resolve'\n  | 'resolveParent'\n  | 'root'\n  | 'target'\n  | 'updateOverridesEdgeInAdded'\n  | 'updateOverridesEdgeInRemoved'\n  | 'version'\n  | 'versions'\n> & {\n  name: string\n  version: string\n  children: Map<string, NodeClass | LinkClass>\n  edgesIn: Set<EdgeClass>\n  edgesOut: Map<string, EdgeClass>\n  from: NodeClass | null\n  hasShrinkwrap: boolean\n  inShrinkwrap: boolean | undefined\n  integrity?: string | null\n  isTop: boolean | undefined\n  meta: BaseNode['meta'] & {\n    addEdge(edge: EdgeClass): void\n  }\n  overrides: OverrideSetClass | undefined\n  target: NodeClass\n  versions: string[]\n  get inDepBundle(): boolean\n  get packageName(): string | null\n  get parent(): NodeClass | null\n  set parent(value: NodeClass | null)\n  get resolveParent(): NodeClass | null\n  get root(): NodeClass | null\n  set root(value: NodeClass | null)\n  new (...args: any): NodeClass\n  addEdgeIn(edge: EdgeClass): void\n  addEdgeOut(edge: EdgeClass): void\n  canDedupe(preferDedupe?: boolean): boolean\n  canReplace(node: NodeClass, ignorePeers?: string[]): boolean\n  canReplaceWith(node: NodeClass, ignorePeers?: string[]): boolean\n  deleteEdgeIn(edge: EdgeClass): void\n  matches(node: NodeClass): boolean\n  recalculateOutEdgesOverrides(): void\n  resolve(name: string): NodeClass\n  updateOverridesEdgeInAdded(\n    otherOverrideSet: OverrideSetClass | undefined,\n  ): boolean\n  updateOverridesEdgeInRemoved(otherOverrideSet: OverrideSetClass): boolean\n}\n\nexport interface OverrideSetClass\n  extends Omit<\n    BaseOverrideSet,\n    | 'ancestry'\n    | 'children'\n    | 'getEdgeRule'\n    | 'getMatchingRule'\n    | 'getNodeRule'\n    | 'parent'\n    | 'ruleset'\n  > {\n  children: Map<string, OverrideSetClass>\n  key: string | undefined\n  keySpec: string | undefined\n  name: string | undefined\n  parent: OverrideSetClass | undefined\n  value: string | undefined\n  version: string | undefined\n  // eslint-disable-next-line @typescript-eslint/no-misused-new\n  new (...args: any[]): OverrideSetClass\n  get isRoot(): boolean\n  get ruleset(): Map<string, OverrideSetClass>\n  ancestry(): Generator<OverrideSetClass>\n  childrenAreEqual(otherOverrideSet: OverrideSetClass | undefined): boolean\n  getEdgeRule(edge: EdgeClass): OverrideSetClass\n  getMatchingRule(node: NodeClass): OverrideSetClass | null\n  getNodeRule(node: NodeClass): OverrideSetClass\n  isEqual(otherOverrideSet: OverrideSetClass | undefined): boolean\n}\n","import semver from 'semver'\n\nimport { PackageURL } from '@socketregistry/packageurl-js'\nimport { getManifestData } from '@socketsecurity/registry'\nimport { hasOwn } from '@socketsecurity/registry/lib/objects'\nimport { fetchPackagePackument } from '@socketsecurity/registry/lib/packages'\n\nimport constants from '../../constants.mts'\nimport { Edge } from './arborist/index.mts'\nimport { DiffAction } from './arborist/types.mts'\nimport { getAlertsMapFromPurls } from '../../utils/alerts-map.mts'\nimport { type AliasResult, npa } from '../../utils/npm-package-arg.mts'\nimport { applyRange, getMajor, getMinVersion } from '../../utils/semver.mts'\nimport { idToPurl } from '../../utils/spec.mts'\n\nimport type {\n  ArboristInstance,\n  Diff,\n  EdgeClass,\n  LinkClass,\n  NodeClass,\n} from './arborist/types.mts'\nimport type { RangeStyle } from '../../utils/semver.mts'\nimport type {\n  AlertIncludeFilter,\n  AlertsByPkgId,\n} from '../../utils/socket-package-alert.mts'\nimport type { EditablePackageJson } from '@socketsecurity/registry/lib/packages'\nimport type { Spinner } from '@socketsecurity/registry/lib/spinner'\n\nconst { LOOP_SENTINEL, NPM, NPM_REGISTRY_URL } = constants\n\nfunction getUrlOrigin(input: string): string {\n  try {\n    // TODO: URL.parse is available in Node 22.1.0. We can use it when we drop Node 18.\n    // https://nodejs.org/docs/latest-v22.x/api/url.html#urlparseinput-base\n    // return URL.parse(input)?.origin ?? ''\n    return new URL(input).origin ?? ''\n  } catch {}\n  return ''\n}\n\nexport function findBestPatchVersion(\n  node: NodeClass,\n  availableVersions: string[],\n  vulnerableVersionRange?: string,\n  _firstPatchedVersionIdentifier?: string | undefined,\n): string | null {\n  const manifestData = getManifestData(NPM, node.name)\n  let eligibleVersions\n  if (manifestData && manifestData.name === manifestData.package) {\n    const major = getMajor(manifestData.version)\n    if (typeof major !== 'number') {\n      return null\n    }\n    eligibleVersions = availableVersions.filter(v => getMajor(v) === major)\n  } else {\n    const major = getMajor(node.version)\n    if (typeof major !== 'number') {\n      return null\n    }\n    eligibleVersions = availableVersions.filter(\n      v =>\n        // Filter for versions that are within the current major version and\n        // are NOT in the vulnerable range.\n        getMajor(v) === major &&\n        (!vulnerableVersionRange ||\n          !semver.satisfies(v, vulnerableVersionRange)),\n    )\n  }\n  return eligibleVersions ? semver.maxSatisfying(eligibleVersions, '*') : null\n}\n\nexport function findPackageNode(\n  tree: NodeClass,\n  name: string,\n  version?: string | undefined,\n): NodeClass | undefined {\n  const queue: Array<NodeClass | LinkClass> = [tree]\n  const visited = new Set<NodeClass>()\n  let sentinel = 0\n  while (queue.length) {\n    if (sentinel++ === LOOP_SENTINEL) {\n      throw new Error('Detected infinite loop in findPackageNode')\n    }\n    const nodeOrLink = queue.pop()!\n    const node = getTargetNode(nodeOrLink)\n    if (visited.has(node)) {\n      continue\n    }\n    visited.add(node)\n    if (\n      node.name === name &&\n      (typeof version !== 'string' || node.version === version)\n    ) {\n      return node\n    }\n    for (const child of node.children.values()) {\n      queue.push(child)\n    }\n    for (const edge of node.edgesOut.values()) {\n      const { to } = edge\n      if (to) {\n        queue.push(to)\n      }\n    }\n  }\n  return undefined\n}\n\nexport function findPackageNodes(\n  tree: NodeClass,\n  name: string,\n  version?: string | undefined,\n): NodeClass[] {\n  const matches: NodeClass[] = []\n  const queue: Array<NodeClass | LinkClass> = [tree]\n  const visited = new Set<NodeClass>()\n  let sentinel = 0\n  while (queue.length) {\n    if (sentinel++ === LOOP_SENTINEL) {\n      throw new Error('Detected infinite loop in findPackageNodes')\n    }\n    const nodeOrLink = queue.pop()!\n    const node = getTargetNode(nodeOrLink)\n    if (visited.has(node)) {\n      continue\n    }\n    visited.add(node)\n    if (\n      node.name === name &&\n      (typeof version !== 'string' || node.version === version)\n    ) {\n      matches.push(node)\n    }\n    for (const child of node.children.values()) {\n      queue.push(child)\n    }\n    for (const edge of node.edgesOut.values()) {\n      const { to } = edge\n      if (to) {\n        queue.push(to)\n      }\n    }\n  }\n  return matches\n}\n\nexport type GetAlertsMapFromArboristOptions = {\n  consolidate?: boolean | undefined\n  include?: AlertIncludeFilter | undefined\n  nothrow?: boolean | undefined\n  spinner?: Spinner | undefined\n}\n\nexport async function getAlertsMapFromArborist(\n  arb: ArboristInstance,\n  options_?: GetAlertsMapFromArboristOptions | undefined,\n): Promise<AlertsByPkgId> {\n  const options = {\n    __proto__: null,\n    consolidate: false,\n    include: undefined,\n    limit: Infinity,\n    nothrow: false,\n    ...options_,\n  } as GetAlertsMapFromArboristOptions\n\n  options.include = {\n    __proto__: null,\n    // Leave 'actions' unassigned so it can be given a default value in\n    // subsequent functions where `options` is passed.\n    // actions: undefined,\n    blocked: true,\n    critical: true,\n    cve: true,\n    existing: false,\n    unfixable: true,\n    upgradable: false,\n    ...options.include,\n  } as AlertIncludeFilter\n\n  const needInfoOn = getDetailsFromDiff(arb.diff, {\n    include: {\n      unchanged: options.include.existing,\n    },\n  })\n\n  const purls = needInfoOn.map(d => idToPurl(d.node.pkgid))\n\n  let overrides: { [key: string]: string } | undefined\n  const overridesMap = (\n    arb.actualTree ??\n    arb.idealTree ??\n    (await arb.loadActual())\n  )?.overrides?.children\n  if (overridesMap) {\n    overrides = Object.fromEntries(\n      [...overridesMap.entries()].map(([key, overrideSet]) => {\n        return [key, overrideSet.value!]\n      }),\n    )\n  }\n\n  return await getAlertsMapFromPurls(purls, {\n    overrides,\n    ...options,\n  })\n}\n\nexport type DiffQueryIncludeFilter = {\n  unchanged?: boolean | undefined\n  unknownOrigin?: boolean | undefined\n}\n\nexport type DiffQueryOptions = {\n  include?: DiffQueryIncludeFilter | undefined\n}\n\nexport type PackageDetail = {\n  node: NodeClass\n  existing?: NodeClass | undefined\n}\n\nexport function getDetailsFromDiff(\n  diff_: Diff | null,\n  options?: DiffQueryOptions | undefined,\n): PackageDetail[] {\n  const details: PackageDetail[] = []\n  // `diff_` is `null` when `npm install --package-lock-only` is passed.\n  if (!diff_) {\n    return details\n  }\n\n  const include = {\n    __proto__: null,\n    unchanged: false,\n    unknownOrigin: false,\n    ...({ __proto__: null, ...options } as DiffQueryOptions).include,\n  } as DiffQueryIncludeFilter\n\n  const queue: Diff[] = [...diff_.children]\n  let pos = 0\n  let { length: queueLength } = queue\n  while (pos < queueLength) {\n    if (pos === LOOP_SENTINEL) {\n      throw new Error('Detected infinite loop while walking Arborist diff')\n    }\n    const diff = queue[pos++]!\n    const { action } = diff\n    if (action) {\n      // The `pkgNode`, i.e. the `ideal` node, will be `undefined` if the diff\n      // action is 'REMOVE'\n      // The `oldNode`, i.e. the `actual` node, will be `undefined` if the diff\n      // action is 'ADD'.\n      const { actual: oldNode, ideal: pkgNode } = diff\n      let existing: NodeClass | undefined\n      let keep = false\n      if (action === DiffAction.change) {\n        if (pkgNode?.package.version !== oldNode?.package.version) {\n          keep = true\n          if (\n            oldNode?.package.name &&\n            oldNode.package.name === pkgNode?.package.name\n          ) {\n            existing = oldNode\n          }\n        } else {\n          // TODO: This debug log has too much information. We should narrow it down.\n          // debugLog('SKIPPING META CHANGE ON', diff)\n        }\n      } else {\n        keep = action !== DiffAction.remove\n      }\n      if (keep && pkgNode?.resolved && (!oldNode || oldNode.resolved)) {\n        if (\n          include.unknownOrigin ||\n          getUrlOrigin(pkgNode.resolved) === NPM_REGISTRY_URL\n        ) {\n          details.push({\n            node: pkgNode,\n            existing,\n          })\n        }\n      }\n    }\n    for (const child of diff.children) {\n      queue[queueLength++] = child\n    }\n  }\n  if (include.unchanged) {\n    const { unchanged } = diff_!\n    for (let i = 0, { length } = unchanged; i < length; i += 1) {\n      const pkgNode = unchanged[i]!\n      if (\n        include.unknownOrigin ||\n        getUrlOrigin(pkgNode.resolved!) === NPM_REGISTRY_URL\n      ) {\n        details.push({\n          node: pkgNode,\n          existing: pkgNode,\n        })\n      }\n    }\n  }\n  return details\n}\n\nexport function getTargetNode(nodeOrLink: NodeClass | LinkClass): NodeClass\nexport function getTargetNode<T>(nodeOrLink: T): NodeClass | null\nexport function getTargetNode(nodeOrLink: any): NodeClass | null {\n  return nodeOrLink?.isLink ? nodeOrLink.target : (nodeOrLink ?? null)\n}\n\nexport function isTopLevel(tree: NodeClass, node: NodeClass): boolean {\n  return getTargetNode(tree.children.get(node.name)) === node\n}\n\nexport type Packument = Exclude<\n  Awaited<ReturnType<typeof fetchPackagePackument>>,\n  null\n>\n\nexport function updateNode(\n  node: NodeClass,\n  newVersion: string,\n  newVersionPackument: Packument['versions'][number],\n): void {\n  // Object.defineProperty is needed to set the version property and replace\n  // the old value with newVersion.\n  Object.defineProperty(node, 'version', {\n    configurable: true,\n    enumerable: true,\n    get: () => newVersion,\n  })\n  // Update package.version associated with the node.\n  node.package.version = newVersion\n  // Update node.resolved.\n  const purlObj = PackageURL.fromString(idToPurl(node.name))\n  node.resolved = `${NPM_REGISTRY_URL}/${node.name}/-/${purlObj.name}-${newVersion}.tgz`\n  // Update node.integrity with the targetPackument.dist.integrity value if available\n  // else delete node.integrity so a new value is resolved for the target version.\n  const { integrity } = newVersionPackument.dist\n  if (integrity) {\n    node.integrity = integrity\n  } else {\n    delete node.integrity\n  }\n  // Update node.package.deprecated based on targetPackument.deprecated.\n  if (hasOwn(newVersionPackument, 'deprecated')) {\n    node.package['deprecated'] = newVersionPackument.deprecated as string\n  } else {\n    delete node.package['deprecated']\n  }\n  // Update node.package.dependencies.\n  const newDeps = { ...newVersionPackument.dependencies }\n  const { dependencies: oldDeps } = node.package\n  node.package.dependencies = newDeps\n  if (oldDeps) {\n    for (const oldDepName of Object.keys(oldDeps)) {\n      if (!hasOwn(newDeps, oldDepName)) {\n        // Detach old edges for dependencies that don't exist on the updated\n        // node.package.dependencies.\n        node.edgesOut.get(oldDepName)?.detach()\n      }\n    }\n  }\n  for (const newDepName of Object.keys(newDeps)) {\n    if (!hasOwn(oldDeps, newDepName)) {\n      // Add new edges for dependencies that don't exist on the old\n      // node.package.dependencies.\n      node.addEdgeOut(\n        new Edge({\n          from: node,\n          name: newDepName,\n          spec: newDeps[newDepName],\n          type: 'prod',\n        }) as unknown as EdgeClass,\n      )\n    }\n  }\n}\n\nexport function updatePackageJsonFromNode(\n  editablePkgJson: EditablePackageJson,\n  tree: NodeClass,\n  node: NodeClass,\n  newVersion: string,\n  rangeStyle?: RangeStyle | undefined,\n): boolean {\n  let result = false\n  if (!isTopLevel(tree, node)) {\n    return result\n  }\n  const { name } = node\n  for (const depField of [\n    'dependencies',\n    'optionalDependencies',\n    'peerDependencies',\n  ]) {\n    const depObject = editablePkgJson.content[depField] as\n      | { [key: string]: string }\n      | undefined\n    const oldRange = hasOwn(depObject, name) ? depObject[name] : undefined\n    if (typeof oldRange !== 'string' || oldRange.startsWith('catalog:')) {\n      continue\n    }\n    const npaResult = npa(oldRange)\n    if (!npaResult || (npaResult as AliasResult).subSpec) {\n      continue\n    }\n    const oldMin = getMinVersion(npaResult.rawSpec)\n    const newRange =\n      oldMin &&\n      // Ensure we're on the same major version...\n      getMajor(newVersion) === oldMin.major &&\n      // and not a downgrade.\n      semver.gte(newVersion, oldMin.version)\n        ? applyRange(oldRange!, newVersion, rangeStyle)\n        : oldRange!\n    if (oldRange !== newRange) {\n      result = true\n      editablePkgJson.update({\n        [depField]: {\n          ...depObject,\n          [name]: newRange,\n        },\n      })\n    }\n  }\n  return result\n}\n","// @ts-ignore\nimport UntypedArborist from '@npmcli/arborist/lib/arborist/index.js'\n\nimport { logger } from '@socketsecurity/registry/lib/logger'\n\nimport constants from '../../../../../constants.mts'\nimport { logAlertsMap } from '../../../../../utils/socket-package-alert.mts'\nimport { getAlertsMapFromArborist } from '../../../arborist-helpers.mts'\n\nimport type {\n  ArboristClass,\n  ArboristReifyOptions,\n  NodeClass,\n} from '../../types.mts'\n\nconst {\n  NPM,\n  NPX,\n  SOCKET_CLI_ACCEPT_RISKS,\n  SOCKET_CLI_SAFE_BIN,\n  SOCKET_CLI_SAFE_PROGRESS,\n  SOCKET_CLI_VIEW_ALL_RISKS,\n  kInternalsSymbol,\n  [kInternalsSymbol as unknown as 'Symbol(kInternalsSymbol)']: { getIpc },\n} = constants\n\nexport const SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES = {\n  __proto__: null,\n  audit: false,\n  dryRun: true,\n  fund: false,\n  ignoreScripts: true,\n  progress: false,\n  save: false,\n  saveBundle: false,\n  silent: true,\n}\n\nexport const kCtorArgs = Symbol('ctorArgs')\n\nexport const kRiskyReify = Symbol('riskyReify')\n\nexport const Arborist: ArboristClass = UntypedArborist\n\n// Implementation code not related to our custom behavior is based on\n// https://github.com/npm/cli/blob/v11.0.0/workspaces/arborist/lib/arborist/index.js:\nexport class SafeArborist extends Arborist {\n  constructor(...ctorArgs: ConstructorParameters<ArboristClass>) {\n    super(\n      {\n        path:\n          (ctorArgs.length ? ctorArgs[0]?.path : undefined) ?? process.cwd(),\n        ...(ctorArgs.length ? ctorArgs[0] : undefined),\n        ...SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES,\n      },\n      ...ctorArgs.slice(1),\n    )\n    ;(this as any)[kCtorArgs] = ctorArgs\n  }\n\n  async [kRiskyReify](\n    ...args: Parameters<InstanceType<ArboristClass>['reify']>\n  ): Promise<NodeClass> {\n    const ctorArgs = (this as any)[kCtorArgs]\n    const arb = new Arborist(\n      {\n        ...(ctorArgs.length ? ctorArgs[0] : undefined),\n        progress: false,\n      },\n      ...ctorArgs.slice(1),\n    )\n    const ret = await (arb.reify as (...args: any[]) => Promise<NodeClass>)(\n      {\n        ...(args.length ? args[0] : undefined),\n        progress: false,\n      },\n      ...args.slice(1),\n    )\n    Object.assign(this, arb)\n    return ret\n  }\n\n  // @ts-ignore Incorrectly typed.\n  override async reify(\n    this: SafeArborist,\n    ...args: Parameters<InstanceType<ArboristClass>['reify']>\n  ): Promise<NodeClass> {\n    const options = {\n      __proto__: null,\n      ...(args.length ? args[0] : undefined),\n    } as ArboristReifyOptions\n    const ipc = await getIpc()\n    const binName = ipc[SOCKET_CLI_SAFE_BIN]\n    if (!binName) {\n      return await this[kRiskyReify](...args)\n    }\n    await super.reify(\n      {\n        ...options,\n        ...SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES,\n        progress: false,\n      },\n      // @ts-ignore: TypeScript gets grumpy about rest parameters.\n      ...args.slice(1),\n    )\n    // Lazily access constants.ENV.SOCKET_CLI_ACCEPT_RISKS.\n    const acceptRisks = constants.ENV.SOCKET_CLI_ACCEPT_RISKS\n    const progress = ipc[SOCKET_CLI_SAFE_PROGRESS]\n    const spinner =\n      options['silent'] || !progress\n        ? undefined\n        : // Lazily access constants.spinner.\n          constants.spinner\n    const isSafeNpm = binName === NPM\n    const isSafeNpx = binName === NPX\n    const alertsMap = await getAlertsMapFromArborist(this, {\n      spinner,\n      include:\n        acceptRisks || options.dryRun || options['yes']\n          ? {\n              actions: ['error'],\n              blocked: true,\n              critical: false,\n              cve: false,\n              existing: true,\n              unfixable: false,\n            }\n          : {\n              existing: isSafeNpx,\n              unfixable: isSafeNpm,\n            },\n    })\n    if (alertsMap.size) {\n      process.exitCode = 1\n      // Lazily access constants.ENV.SOCKET_CLI_VIEW_ALL_RISKS.\n      const viewAllRisks = constants.ENV.SOCKET_CLI_VIEW_ALL_RISKS\n      logAlertsMap(alertsMap, {\n        hideAt: viewAllRisks ? 'none' : 'middle',\n        output: process.stderr,\n      })\n      throw new Error(\n        `\n          Socket ${binName} exiting due to risks.${\n            viewAllRisks\n              ? ''\n              : `\\nView all risks - Rerun with environment variable ${SOCKET_CLI_VIEW_ALL_RISKS}=1.`\n          }${\n            acceptRisks\n              ? ''\n              : `\\nAccept risks - Rerun with environment variable ${SOCKET_CLI_ACCEPT_RISKS}=1.`\n          }\n        `.trim(),\n      )\n    } else if (!options['silent']) {\n      logger.success(\n        `Socket ${binName} ${acceptRisks ? 'accepted' : 'found no'} risks`,\n      )\n      if (binName === NPX) {\n        logger.log(`Running ${options.add![0]}`)\n      }\n    }\n    return await this[kRiskyReify](...args)\n  }\n}\n","import { createRequire } from 'node:module'\n\n// @ts-ignore\nimport UntypedEdge from '@npmcli/arborist/lib/edge.js'\n// @ts-ignore\nimport UntypedNode from '@npmcli/arborist/lib/node.js'\n// @ts-ignore\nimport UntypedOverrideSet from '@npmcli/arborist/lib/override-set.js'\n\nimport {\n  getArboristClassPath,\n  getArboristEdgeClassPath,\n  getArboristNodeClassPath,\n  getArboristOverrideSetClassPath,\n} from '../paths.mts'\nimport { Arborist, SafeArborist } from './lib/arborist/index.mts'\n\nimport type { EdgeClass, NodeClass, OverrideSetClass } from './types.mts'\n\nconst require = createRequire(import.meta.url)\n\nexport const SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES = {\n  __proto__: null,\n  audit: false,\n  dryRun: true,\n  fund: false,\n  ignoreScripts: true,\n  progress: false,\n  save: false,\n  saveBundle: false,\n  silent: true,\n}\n\nexport { Arborist, SafeArborist }\n\nexport const Edge: EdgeClass = UntypedEdge\n\nexport const Node: NodeClass = UntypedNode\n\nexport const OverrideSet: OverrideSetClass = UntypedOverrideSet\n\nexport function installSafeArborist() {\n  // Override '@npmcli/arborist' module exports with patched variants based on\n  // https://github.com/npm/cli/pull/8089.\n  const cache: { [key: string]: any } = require.cache\n  cache[getArboristClassPath()] = { exports: SafeArborist }\n  cache[getArboristEdgeClassPath()] = { exports: Edge }\n  cache[getArboristNodeClassPath()] = { exports: Node }\n  cache[getArboristOverrideSetClassPath()] = { exports: OverrideSet }\n}\n","import { installSafeArborist } from './arborist/index.mts'\n\ninstallSafeArborist()\n"],"names":["_arboristPkgPath","add","change","remove","NPM_REGISTRY_URL","eligibleVersions","getMajor","visited","queue","to","matches","__proto__","consolidate","include","limit","nothrow","blocked","critical","cve","existing","unfixable","upgradable","unchanged","unknownOrigin","length","action","actual","ideal","keep","node","Object","configurable","enumerable","integrity","dependencies","from","name","spec","type","semver","result","getIpc","audit","dryRun","fund","ignoreScripts","progress","save","saveBundle","silent","path","constants","hideAt","logger","cache","exports","installSafeArborist"],"mappings":";;;;;;;;;;;;;AAOA;AACO;;;AAGH;AAGA;AAIA;AACAA;AAGF;AACA;AACF;AAEA;AACO;;;AAML;AACA;AACF;AAaA;AACO;;;AAGL;AACA;AACF;AAEA;AACO;;;AAGL;AACA;AACF;AAEA;AACO;;;AAML;AACA;AACF;;ACjBO;AACLC;AACAC;AACAC;AACF;;AC9BA;;;AAA4BC;AAAiB;AAE7C;;AAEI;AACA;AACA;;;AAGF;AACF;AAEO;;AAOL;;AAEE;AACA;AACE;AACF;AACAC;AACF;AACE;AACA;AACE;AACF;AACAA;AAEI;AACA;AACAC;AAIN;;AAEF;AAEO;AAKL;AACA;;;AAGE;AACE;AACF;AACA;AACA;AACA;AACE;AACF;AACAC;AACA;AAIE;AACF;;AAEEC;AACF;;;AAEUC;AAAG;AACX;AACED;AACF;AACF;AACF;AACA;AACF;AAEO;;AAML;AACA;;;AAGE;AACE;AACF;AACA;AACA;AACA;AACE;AACF;AACAD;AACA;AAIEG;AACF;;AAEEF;AACF;;;AAEUC;AAAG;AACX;AACED;AACF;AACF;AACF;AACA;AACF;AASO;AAIL;AACEG;AACAC;AACAC;AACAC;AACAC;;;;AAKAJ;AACA;AACA;AACA;AACAK;AACAC;AACAC;AACAC;AACAC;AACAC;AACA;;AAGF;AACER;AACES;AACF;AACF;AAEA;AAEA;;AAMA;;AAGM;AACF;AAEJ;AAEA;;;AAGA;AACF;AAgBO;;AAKL;;AAEE;AACF;AAEA;AACEX;AACAW;AACAC;;AACMZ;;AAA4B;;AAGpC;;;AAEMa;AAAoB;;;AAGtB;AACF;AACA;;AACQC;AAAO;AACf;AACE;AACA;AACA;AACA;;AACQC;AAAiBC;AAAe;AACxC;;AAEA;;AAEIC;AACA;AAIET;AACF;AACF;AAIF;AACES;AACF;AACA;AACE;;AAKIC;AACAV;AACF;AACF;AACF;AACF;AACA;AACEX;AACF;AACF;;;AAEUc;AAAU;AAClB;AAAkBE;;AAChB;AACA;;AAKIK;AACAV;AACF;AACF;AACF;AACF;AACA;AACF;AAIO;;AAEP;AAEO;AACL;AACF;AAOO;AAKL;AACA;AACAW;AACEC;AACAC;;AAEF;AACA;AACAH;AACA;AACA;AACAA;AACA;AACA;;AACQI;;AACR;;AAEA;;AAEA;AACA;AACA;;AAEA;AACE;AACF;AACA;AACA;AAAkB;;;AACVC;;AACRL;AACA;;AAEI;AACE;AACA;;AAEF;AACF;AACF;;AAEE;AACE;AACA;AACAA;AAEIM;AACAC;AACAC;AACAC;AACF;AAEJ;AACF;AACF;AAEO;;AAQL;AACE;AACF;;AACQF;AAAK;;AAMX;AAGA;;AAEE;AACF;AACA;AACA;AACE;AACF;AACA;;AAGE;AACA9B;AACA;AACAiC;;AAIAC;;AAEE;AACE;AACA;AACF;AACF;AACF;AACF;AACA;AACF;;AC/aA;AAeA;;;;;;;;AAQE;AAA+DC;AAAO;AACxE;AAEO;AACL9B;AACA+B;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACF;AAEO;AAEA;AAEA;;AAEP;AACA;AACO;;AAEH;AAEIC;;;;AAOF;AACJ;AAEA;AAGE;AACA;;AAGIJ;;AAIJ;;AAGIA;;AAIJhB;AACA;AACF;;AAEA;AACA;AAIE;AACEnB;;;AAGF;AACA;;;AAGA;;AAGI;AACA;AACAmC;;AAEF;AACA;AAEF;AACA;AACA;;AAIM;AACAK;AACN;AACA;AACA;;;;AAMUnC;AACAC;AACAC;AACAC;AACAC;AACF;AAEED;AACAC;AACF;AACR;;;AAGE;AACA;;AAEEgC;;AAEF;;AAGN;AAQA;AAGI;AACEC;;;AAKA;AACF;;AAEF;AACF;;AChJA,iBAAA;AAEO;AACL1C;AACA+B;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACF;AAIO;AAEA;AAEA;AAEA;AACL;AACA;AACA;AACAK;AAAkCC;;AAClCD;AAAsCC;;AACtCD;AAAsCC;;AACtCD;AAA6CC;;AAC/C;;AC/CAC;;;;;;;;;","debugId":"8064dcdf-3aa8-4cd5-b56c-354d369825da"}

package/dist/utils.js

@@ -1309,7 +1309,7 @@ function getAsciiHeader(command) {
   const shownToken = redacting ? REDACTED : getVisibleTokenPrefix() || 'no';
   const relCwd = redacting ? REDACTED : path$1.normalizePath(process.cwd().replace(new RegExp(`^${regexps.escapeRegExp(constants.homePath)}(?:${path.sep}|$)`, 'i'), '~/'));
   let nodeVerWarn = '';
-  if ((vendor.semverExports.parse(constants.NODE_VERSION)?.major ?? 0) < 20) {
+  if (vendor.semverExports.parse(constants.NODE_VERSION).major < 20) {
     nodeVerWarn += vendor.yoctocolorsCjsExports.bold(`   ${vendor.yoctocolorsCjsExports.red('Warning:')} NodeJS version 19 and lower will be ${vendor.yoctocolorsCjsExports.red('unsupported')} after April 30th, 2025.`);
     nodeVerWarn += '\n';
     nodeVerWarn += '            Soon after the Socket CLI will require NodeJS version 20 or higher.';
@@ -1771,6 +1771,63 @@ class ColorOrMarkdown {
   }
 }
 
+const RangeStyles = ['caret', 'gt', 'lt', 'pin', 'preserve', 'tilde'];
+function applyRange(refRange, version, style = 'preserve') {
+  switch (style) {
+    case 'caret':
+      return `^${version}`;
+    case 'gt':
+      return `>${version}`;
+    case 'gte':
+      return `>=${version}`;
+    case 'lt':
+      return `<${version}`;
+    case 'lte':
+      return `<=${version}`;
+    case 'preserve':
+      {
+        const range = new vendor.semverExports.Range(refRange);
+        const {
+          raw
+        } = range;
+        const comparators = [...range.set].flat();
+        const {
+          length
+        } = comparators;
+        if (length === 1) {
+          const char = /^[<>]=?/.exec(raw)?.[0];
+          if (char) {
+            return `${char}${version}`;
+          }
+        } else if (length === 2) {
+          const char = /^[~^]/.exec(raw)?.[0];
+          if (char) {
+            return `${char}${version}`;
+          }
+        }
+        return version;
+      }
+    case 'tilde':
+      return `~${version}`;
+    case 'pin':
+    default:
+      return version;
+  }
+}
+function getMajor(version) {
+  try {
+    const coerced = vendor.semverExports.coerce(version);
+    return coerced ? vendor.semverExports.major(coerced) : null;
+  } catch {}
+  return null;
+}
+function getMinVersion(range) {
+  try {
+    return vendor.semverExports.minVersion(range);
+  } catch {}
+  return null;
+}
+
 const require$1 =Module.createRequire(require('u' + 'rl').pathToFileURL(__filename).href)
 let _translations;
 function getTranslations() {
@@ -1827,7 +1884,10 @@ function parsePnpmLockfile(lockfileContent) {
   return objects.isObjectObject(result) ? result : null;
 }
 function parsePnpmLockfileVersion(version) {
-  return vendor.semverExports.coerce(version);
+  try {
+    return vendor.semverExports.coerce(version);
+  } catch {}
+  return null;
 }
 async function readPnpmLockfile(lockfilePath) {
   return fs.existsSync(lockfilePath) ? await readFileUtf8(lockfilePath) : null;
@@ -1836,7 +1896,8 @@ function stripLeadingPnpmDepPathSlash(depPath) {
   return isPnpmDepPath(depPath) ? depPath.slice(1) : depPath;
 }
 function stripPnpmPeerSuffix(depPath) {
-  const index = depPath.indexOf('(');
+  const parenIndex = depPath.indexOf('(');
+  const index = parenIndex === -1 ? depPath.indexOf('_') : parenIndex;
   return index === -1 ? depPath : depPath.slice(0, index);
 }
 
@@ -1932,8 +1993,6 @@ async function addArtifactToAlertsMap(artifact, alertsByPkgId, options) {
   const {
     version
   } = artifact;
-  const pkgId = `${name}@${version}`;
-  const major = vendor.semverExports.major(version);
   const enabledState = {
     __proto__: null,
     ...localRules
@@ -1970,6 +2029,8 @@ async function addArtifactToAlertsMap(artifact, alertsByPkgId, options) {
   if (!sockPkgAlerts.length) {
     return alertsByPkgId;
   }
+  const pkgId = `${name}@${version}`;
+  const major = getMajor(version);
   if (consolidate) {
     const highestForCve = new Map();
     const highestForUpgrade = new Map();
@@ -1982,10 +2043,10 @@ async function addArtifactToAlertsMap(artifact, alertsByPkgId, options) {
         // alert.props.firstPatchedVersionIdentifier property value.
         // We're just being cautious.
         const firstPatchedVersionIdentifier = alert.props?.firstPatchedVersionIdentifier;
-        if (firstPatchedVersionIdentifier) {
+        const patchedMajor = firstPatchedVersionIdentifier ? getMajor(firstPatchedVersionIdentifier) : null;
+        if (typeof patchedMajor === 'number') {
           // Consolidate to the highest "first patched version" by each major
           // version number.
-          const patchedMajor = vendor.semverExports.major(firstPatchedVersionIdentifier);
           const highest = highestForCve.get(patchedMajor)?.version ?? '0.0.0';
           if (vendor.semverExports.gt(firstPatchedVersionIdentifier, highest)) {
             highestForCve.set(patchedMajor, {
@@ -2259,61 +2320,6 @@ function logAlertsMap(alertsMap, options) {
   output.write('\n');
 }
 
-const RangeStyles = ['caret', 'gt', 'lt', 'pin', 'preserve', 'tilde'];
-function applyRange(refRange, version, style = 'preserve') {
-  switch (style) {
-    case 'caret':
-      return `^${version}`;
-    case 'gt':
-      return `>${version}`;
-    case 'gte':
-      return `>=${version}`;
-    case 'lt':
-      return `<${version}`;
-    case 'lte':
-      return `<=${version}`;
-    case 'preserve':
-      {
-        const range = new vendor.semverExports.Range(refRange);
-        const {
-          raw
-        } = range;
-        const comparators = [...range.set].flat();
-        const {
-          length
-        } = comparators;
-        if (length === 1) {
-          const char = /^[<>]=?/.exec(raw)?.[0];
-          if (char) {
-            return `${char}${version}`;
-          }
-        } else if (length === 2) {
-          const char = /^[~^]/.exec(raw)?.[0];
-          if (char) {
-            return `${char}${version}`;
-          }
-        }
-        return version;
-      }
-    case 'tilde':
-      return `~${version}`;
-    case 'pin':
-    default:
-      return version;
-  }
-}
-function getMajor(version) {
-  const coerced = vendor.semverExports.coerce(version);
-  if (coerced) {
-    try {
-      return vendor.semverExports.major(coerced);
-    } catch (e) {
-      debug.debugLog(`Error parsing '${version}':\n`, e);
-    }
-  }
-  return null;
-}
-
 async function getAlertsMapFromPnpmLockfile(lockfile, options) {
   const purls = await extractPurlsFromPnpmLockfile(lockfile);
   return await getAlertsMapFromPurls(purls, {
@@ -2397,6 +2403,13 @@ async function getAlertsMapFromPurls(purls, options_) {
   return alertsByPkgId;
 }
 
+function npa(...args) {
+  try {
+    return Reflect.apply(vendor.npaExports, undefined, args);
+  } catch {}
+  return null;
+}
+
 const {
   NPM: NPM$2,
   SOCKET_CLI_SAFE_BIN,
@@ -2561,7 +2574,7 @@ async function getAgentVersion(agentExecPath, cwd) {
       cwd,
       // Lazily access constants.WIN32.
       shell: constants.WIN32
-    })).stdout) ?? undefined;
+    })).stdout.trim()) ?? undefined;
   } catch (e) {
     debug.debugLog('getAgentVersion error:\n', e);
   }
@@ -2916,6 +2929,7 @@ exports.getConfigValueOrUndef = getConfigValueOrUndef;
 exports.getCveInfoFromAlertsMap = getCveInfoFromAlertsMap;
 exports.getFlagListOutput = getFlagListOutput;
 exports.getMajor = getMajor;
+exports.getMinVersion = getMinVersion;
 exports.getNpmBinPath = getNpmBinPath;
 exports.getNpmRequire = getNpmRequire;
 exports.getNpxBinPath = getNpxBinPath;
@@ -2946,6 +2960,7 @@ exports.mdTableOfPairs = mdTableOfPairs;
 exports.mdTableStringNumber = mdTableStringNumber;
 exports.meowOrExit = meowOrExit;
 exports.meowWithSubcommands = meowWithSubcommands;
+exports.npa = npa;
 exports.outputFlags = outputFlags;
 exports.parsePnpmLockfile = parsePnpmLockfile;
 exports.parsePnpmLockfileVersion = parsePnpmLockfileVersion;
@@ -2963,5 +2978,5 @@ exports.supportedConfigKeys = supportedConfigKeys;
 exports.updateConfigValue = updateConfigValue;
 exports.validationFlags = validationFlags;
 exports.walkNestedMap = walkNestedMap;
-//# debugId=f4dc80af-7233-4e8f-a515-fa16ef41df33
+//# debugId=1d7319ed-5161-4320-a3b0-d7abf4b930c5
 //# sourceMappingURL=utils.js.map