@socketsecurity/cli-with-sentry 1.0.110 → 1.1.0

package/dist/constants.js

@@ -15,6 +15,7 @@ const __filename$1 = require$$0.fileURLToPath(require('node:url').pathToFileURL(
 // in the root of each.
 const __dirname$1 = path.dirname(__filename$1);
 const {
+  NPM,
   kInternalsSymbol,
   [kInternalsSymbol]: {
     attributes: registryConstantsAttribs,
@@ -120,7 +121,7 @@ const LAZY_ENV = () => {
     GITHUB_TOKEN,
     // Comp-time inlined @coana-tech/cli package version.
     // The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION']".
-    INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION: envAsString("14.12.16"),
+    INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION: envAsString("14.12.17"),
     // Comp-time inlined @cyclonedx/cdxgen package version.
     // The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION']".
     INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION: envAsString("11.7.0"),
@@ -144,10 +145,10 @@ const LAZY_ENV = () => {
     INLINED_SOCKET_CLI_SYNP_VERSION: envAsString("1.9.14"),
     // Comp-time inlined Socket package version.
     // The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_VERSION']".
-    INLINED_SOCKET_CLI_VERSION: envAsString("1.0.110"),
+    INLINED_SOCKET_CLI_VERSION: envAsString("1.1.0"),
     // Comp-time inlined Socket package version hash.
     // The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_VERSION_HASH']".
-    INLINED_SOCKET_CLI_VERSION_HASH: envAsString("1.0.110:824eb6b:1b9c3802:pub"),
+    INLINED_SOCKET_CLI_VERSION_HASH: envAsString("1.1.0:cb6f6bb:96e51517:pub"),
     // The absolute location of the %localappdata% folder on Windows used to store
     // user-specific, non-roaming application data, like temporary files, cached
     // data, and program settings, that are specific to the current machine and user.
@@ -248,7 +249,7 @@ const lazyMinimumVersionByAgent = () => new Map([
 [BUN, '1.1.39'],
 // The npm version bundled with Node 18.
 // https://nodejs.org/en/about/previous-releases#looking-for-the-latest-release-of-a-version-branch
-['npm', '10.8.2'],
+[NPM, '10.8.2'],
 // 8.x is the earliest version to support Node 18.
 // https://pnpm.io/installation#compatibility
 // https://www.npmjs.com/package/pnpm?activeTab=versions
@@ -473,5 +474,5 @@ const constants = createConstantsObject({
 });
 
 module.exports = constants;
-//# debugId=4d9cfcdb-a32b-4892-9fc7-8ac5c237f94a
+//# debugId=31999698-2c4b-47f0-b5a0-e4ad2d266451
 //# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sources":["../src/constants.mts"],"sourcesContent":["import { realpathSync } from 'node:fs'\nimport { createRequire } from 'node:module'\nimport os from 'node:os'\nimport path from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nimport registryConstants from '@socketsecurity/registry/lib/constants'\n\nimport type { Agent } from './utils/package-environment.mts'\nimport type { Remap } from '@socketsecurity/registry/lib/objects'\nimport type { SpawnOptions } from '@socketsecurity/registry/lib/spawn'\n\nconst require = createRequire(import.meta.url)\nconst __filename = fileURLToPath(import.meta.url)\n// Using `path.dirname(__filename)` to resolve `__dirname` works for both 'dist'\n// AND 'src' directories because constants.js and constants.mts respectively are\n// in the root of each.\nconst __dirname = path.dirname(__filename)\n\nconst {\n  kInternalsSymbol,\n  [kInternalsSymbol as unknown as 'Symbol(kInternalsSymbol)']: {\n    attributes: registryConstantsAttribs,\n    createConstantsObject,\n    getIpc,\n  },\n} = registryConstants\n\nexport type RegistryEnv = typeof registryConstants.ENV\n\nexport type RegistryInternals =\n  (typeof registryConstants)['Symbol(kInternalsSymbol)']\n\nexport type Sentry = any\n\nexport type Internals = Remap<\n  Omit<RegistryInternals, 'getIpc'> &\n    Readonly<{\n      getIpc: {\n        (): Promise<IPC>\n        <K extends keyof IPC | undefined>(\n          key?: K | undefined,\n        ): Promise<K extends keyof IPC ? IPC[K] : IPC>\n      }\n      getSentry: () => Sentry\n      setSentry(Sentry: Sentry): boolean\n    }>\n>\n\nexport type ENV = Remap<\n  RegistryEnv &\n    Readonly<{\n      DISABLE_GITHUB_CACHE: boolean\n      GITHUB_API_URL: string\n      GITHUB_BASE_REF: string\n      GITHUB_REF_NAME: string\n      GITHUB_REF_TYPE: string\n      GITHUB_REPOSITORY: string\n      GITHUB_SERVER_URL: string\n      GITHUB_TOKEN: string\n      INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION: string\n      INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION: string\n      INLINED_SOCKET_CLI_HOMEPAGE: string\n      INLINED_SOCKET_CLI_LEGACY_BUILD: string\n      INLINED_SOCKET_CLI_NAME: string\n      INLINED_SOCKET_CLI_PUBLISHED_BUILD: string\n      INLINED_SOCKET_CLI_SENTRY_BUILD: string\n      INLINED_SOCKET_CLI_VERSION: string\n      INLINED_SOCKET_CLI_VERSION_HASH: string\n      INLINED_SOCKET_CLI_SYNP_VERSION: string\n      LOCALAPPDATA: string\n      NODE_COMPILE_CACHE: string\n      NODE_EXTRA_CA_CERTS: string\n      PATH: string\n      SOCKET_CLI_ACCEPT_RISKS: boolean\n      SOCKET_CLI_API_BASE_URL: string\n      SOCKET_CLI_API_PROXY: string\n      SOCKET_CLI_API_TIMEOUT: number\n      SOCKET_CLI_API_TOKEN: string\n      SOCKET_CLI_CONFIG: string\n      SOCKET_CLI_GIT_USER_EMAIL: string\n      SOCKET_CLI_GIT_USER_NAME: string\n      SOCKET_CLI_GITHUB_TOKEN: string\n      SOCKET_CLI_NO_API_TOKEN: boolean\n      SOCKET_CLI_NPM_PATH: string\n      SOCKET_CLI_ORG_SLUG: string\n      SOCKET_CLI_VIEW_ALL_RISKS: boolean\n      TERM: string\n      XDG_DATA_HOME: string\n    }>\n>\n\nexport type ProcessEnv = {\n  [K in keyof ENV]?: string\n}\n\nexport type IPC = Readonly<{\n  SOCKET_CLI_FIX?: string | undefined\n  SOCKET_CLI_OPTIMIZE?: boolean | undefined\n  SOCKET_CLI_SHADOW_ACCEPT_RISKS?: boolean | undefined\n  SOCKET_CLI_SHADOW_API_TOKEN?: string | undefined\n  SOCKET_CLI_SHADOW_BIN?: string | undefined\n  SOCKET_CLI_SHADOW_PROGRESS?: boolean | undefined\n  SOCKET_CLI_SHADOW_SILENT?: boolean | undefined\n}>\n\nexport type Constants = Remap<\n  Omit<typeof registryConstants, 'Symbol(kInternalsSymbol)' | 'ENV' | 'IPC'> & {\n    readonly 'Symbol(kInternalsSymbol)': Internals\n    readonly ALERT_TYPE_CRITICAL_CVE: 'criticalCVE'\n    readonly ALERT_TYPE_CVE: 'cve'\n    readonly ALERT_TYPE_MEDIUM_CVE: 'mediumCVE'\n    readonly ALERT_TYPE_MILD_CVE: 'mildCVE'\n    readonly API_V0_URL: 'https://api.socket.dev/v0/'\n    readonly BINARY_LOCK_EXT: '.lockb'\n    readonly BUN: 'bun'\n    readonly ENV: ENV\n    readonly DOT_SOCKET_DOT_FACTS_JSON: '.socket.facts.json'\n    readonly DRY_RUN_LABEL: '[DryRun]'\n    readonly DRY_RUN_BAILING_NOW: '[DryRun] Bailing now'\n    readonly DRY_RUN_NOT_SAVING: '[DryRun] Not saving'\n    readonly IPC: IPC\n    readonly LOCK_EXT: '.lock'\n    readonly NPM_BUGGY_OVERRIDES_PATCHED_VERSION: '11.2.0'\n    readonly NPM_REGISTRY_URL: 'https://registry.npmjs.org'\n    readonly PNPM: 'pnpm'\n    readonly REDACTED: '<redacted>'\n    readonly SOCKET_CLI_ACCEPT_RISKS: 'SOCKET_CLI_ACCEPT_RISKS'\n    readonly SOCKET_CLI_BIN_NAME: 'socket'\n    readonly SOCKET_CLI_CONFIG: 'SOCKET_CLI_CONFIG'\n    readonly SOCKET_CLI_FIX: 'SOCKET_CLI_FIX'\n    readonly SOCKET_CLI_ISSUES_URL: 'https://github.com/SocketDev/socket-cli/issues'\n    readonly SOCKET_CLI_OPTIMIZE: 'SOCKET_CLI_OPTIMIZE'\n    readonly SOCKET_CLI_SHADOW_ACCEPT_RISKS: 'SOCKET_CLI_SHADOW_ACCEPT_RISKS'\n    readonly SOCKET_CLI_SHADOW_API_TOKEN: 'SOCKET_CLI_SHADOW_API_TOKEN'\n    readonly SOCKET_CLI_SHADOW_BIN: 'SOCKET_CLI_SHADOW_BIN'\n    readonly SOCKET_CLI_SHADOW_PROGRESS: 'SOCKET_CLI_SHADOW_PROGRESS'\n    readonly SOCKET_CLI_SHADOW_SILENT: 'SOCKET_CLI_SHADOW_SILENT'\n    readonly SOCKET_CLI_VIEW_ALL_RISKS: 'SOCKET_CLI_VIEW_ALL_RISKS'\n    readonly SOCKET_DEFAULT_BRANCH: 'socket-default-branch'\n    readonly SOCKET_DEFAULT_REPOSITORY: 'socket-default-repository'\n    readonly SOCKET_WEBSITE_URL: 'https://socket.dev'\n    readonly VLT: 'vlt'\n    readonly YARN: 'yarn'\n    readonly YARN_BERRY: 'yarn/berry'\n    readonly YARN_CLASSIC: 'yarn/classic'\n    readonly YARN_LOCK: 'yarn.lock'\n    readonly bashRcPath: string\n    readonly binCliPath: string\n    readonly binPath: string\n    readonly blessedContribPath: string\n    readonly blessedOptions: {\n      smartCSR: boolean\n      term: string\n      useBCE: boolean\n    }\n    readonly blessedPath: string\n    readonly coanaBinPath: string\n    readonly coanaPath: string\n    readonly distCliPath: string\n    readonly distPath: string\n    readonly externalPath: string\n    readonly githubCachePath: string\n    readonly homePath: string\n    readonly instrumentWithSentryPath: string\n    readonly minimumVersionByAgent: Map<Agent, string>\n    readonly nmBinPath: string\n    readonly nodeDebugFlags: string[]\n    readonly nodeHardenFlags: string[]\n    readonly nodeMemoryFlags: string[]\n    readonly npmCachePath: string\n    readonly npmGlobalPrefix: string\n    readonly npmNmNodeGypPath: string\n    readonly processEnv: ProcessEnv\n    readonly rootPath: string\n    readonly shadowBinPath: string\n    readonly shadowNpmBinPath: string\n    readonly shadowNpmInjectPath: string\n    readonly socketAppDataPath: string\n    readonly socketCachePath: string\n    readonly socketRegistryPath: string\n    readonly zshRcPath: string\n  }\n>\n\nconst ALERT_TYPE_CRITICAL_CVE = 'criticalCVE'\nconst ALERT_TYPE_CVE = 'cve'\nconst ALERT_TYPE_MEDIUM_CVE = 'mediumCVE'\nconst ALERT_TYPE_MILD_CVE = 'mildCVE'\nconst API_V0_URL = 'https://api.socket.dev/v0/'\nconst BINARY_LOCK_EXT = '.lockb'\nconst BUN = 'bun'\nconst DOT_SOCKET_DOT_FACTS_JSON = '.socket.facts.json'\nconst DRY_RUN_LABEL = '[DryRun]'\nconst DRY_RUN_BAILING_NOW = `${DRY_RUN_LABEL}: Bailing now`\nconst DRY_RUN_NOT_SAVING = `${DRY_RUN_LABEL}: Not saving`\nconst LOCALAPPDATA = 'LOCALAPPDATA'\nconst LOCK_EXT = '.lock'\nconst NPM_BUGGY_OVERRIDES_PATCHED_VERSION = '11.2.0'\nconst NPM_REGISTRY_URL = 'https://registry.npmjs.org'\nconst PNPM = 'pnpm'\nconst REDACTED = '<redacted>'\nconst SOCKET_CLI_ACCEPT_RISKS = 'SOCKET_CLI_ACCEPT_RISKS'\nconst SOCKET_CLI_BIN_NAME = 'socket'\nconst SOCKET_CLI_FIX = 'SOCKET_CLI_FIX'\nconst SOCKET_CLI_ISSUES_URL = 'https://github.com/SocketDev/socket-cli/issues'\nconst SOCKET_CLI_OPTIMIZE = 'SOCKET_CLI_OPTIMIZE'\nconst SOCKET_CLI_SHADOW_ACCEPT_RISKS = 'SOCKET_CLI_SHADOW_ACCEPT_RISKS'\nconst SOCKET_CLI_SHADOW_API_TOKEN = 'SOCKET_CLI_SHADOW_API_TOKEN'\nconst SOCKET_CLI_SHADOW_BIN = 'SOCKET_CLI_SHADOW_BIN'\nconst SOCKET_CLI_SHADOW_PROGRESS = 'SOCKET_CLI_SHADOW_PROGRESS'\nconst SOCKET_CLI_SHADOW_SILENT = 'SOCKET_CLI_SHADOW_SILENT'\nconst SOCKET_CLI_VIEW_ALL_RISKS = 'SOCKET_CLI_VIEW_ALL_RISKS'\nconst SOCKET_DEFAULT_BRANCH = 'socket-default-branch'\nconst SOCKET_DEFAULT_REPOSITORY = 'socket-default-repository'\nconst SOCKET_WEBSITE_URL = 'https://socket.dev'\nconst VLT = 'vlt'\nconst YARN = 'yarn'\nconst YARN_BERRY = 'yarn/berry'\nconst YARN_CLASSIC = 'yarn/classic'\nconst YARN_LOCK = 'yarn.lock'\n\nlet _Sentry: any\n\nlet _npmStdioPipeOptions: SpawnOptions | undefined\nfunction getNpmStdioPipeOptions() {\n  if (_npmStdioPipeOptions === undefined) {\n    _npmStdioPipeOptions = {\n      cwd: process.cwd(),\n      shell: constants.WIN32,\n    }\n  }\n  return _npmStdioPipeOptions\n}\n\nconst LAZY_ENV = () => {\n  const { env } = process\n  const envHelpers = /*@__PURE__*/ require('@socketsecurity/registry/lib/env')\n  const utils = /*@__PURE__*/ require(\n    path.join(constants.rootPath, 'dist/utils.js'),\n  )\n  const envAsBoolean = envHelpers.envAsBoolean\n  const envAsNumber = envHelpers.envAsNumber\n  const envAsString = envHelpers.envAsString\n  const getConfigValueOrUndef = utils.getConfigValueOrUndef\n  const readOrDefaultSocketJson = utils.readOrDefaultSocketJson\n  const GITHUB_TOKEN = envAsString(env['GITHUB_TOKEN'])\n  const INLINED_SOCKET_CLI_PUBLISHED_BUILD = envAsBoolean(\n    process.env['INLINED_SOCKET_CLI_PUBLISHED_BUILD'],\n  )\n  // We inline some environment values so that they CANNOT be influenced by user\n  // provided environment variables.\n  return Object.freeze({\n    __proto__: null,\n    // Lazily access registryConstants.ENV.\n    ...registryConstants.ENV,\n    // Disable using GitHub's workflow actions/cache.\n    // https://github.com/actions/cache\n    DISABLE_GITHUB_CACHE: envAsBoolean(env['DISABLE_GITHUB_CACHE']),\n    // The API URL. For example, https://api.github.com.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_API_URL:\n      envAsString(env['GITHUB_API_URL']) || 'https://api.github.com',\n    // The name of the base ref or target branch of the pull request in a workflow\n    // run. This is only set when the event that triggers a workflow run is either\n    // pull_request or pull_request_target. For example, main.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_BASE_REF: envAsString(env['GITHUB_BASE_REF']),\n    // The short ref name of the branch or tag that triggered the GitHub workflow\n    // run. This value matches the branch or tag name shown on GitHub. For example,\n    // feature-branch-1. For pull requests, the format is <pr_number>/merge.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_REF_NAME: envAsString(env['GITHUB_REF_NAME']),\n    // The type of ref that triggered the workflow run. Valid values are branch or tag.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_REF_TYPE: envAsString(env['GITHUB_REF_TYPE']),\n    // The owner and repository name. For example, octocat/Hello-World.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_REPOSITORY: envAsString(env['GITHUB_REPOSITORY']),\n    // The URL of the GitHub server. For example, https://github.com.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_SERVER_URL:\n      envAsString(env['GITHUB_SERVER_URL']) || 'https://github.com',\n    // The GITHUB_TOKEN secret is a GitHub App installation access token.\n    // The token's permissions are limited to the repository that contains the\n    // workflow.\n    // https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#about-the-github_token-secret\n    GITHUB_TOKEN,\n    // Comp-time inlined @coana-tech/cli package version.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION']\".\n    INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION: envAsString(\n      process.env['INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION'],\n    ),\n    // Comp-time inlined @cyclonedx/cdxgen package version.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION']\".\n    INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION: envAsString(\n      process.env['INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION'],\n    ),\n    // Comp-time inlined Socket package homepage.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_HOMEPAGE']\".\n    INLINED_SOCKET_CLI_HOMEPAGE: envAsString(\n      process.env['INLINED_SOCKET_CLI_HOMEPAGE'],\n    ),\n    // Comp-time inlined flag to determine if this is the Legacy build.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_LEGACY_BUILD']\".\n    INLINED_SOCKET_CLI_LEGACY_BUILD: envAsBoolean(\n      process.env['INLINED_SOCKET_CLI_LEGACY_BUILD'],\n    ),\n    // Comp-time inlined Socket package name.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_NAME']\".\n    INLINED_SOCKET_CLI_NAME: envAsString(\n      process.env['INLINED_SOCKET_CLI_NAME'],\n    ),\n    // Comp-time inlined flag to determine if this is a published build.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_PUBLISHED_BUILD']\".\n    INLINED_SOCKET_CLI_PUBLISHED_BUILD,\n    // Comp-time inlined flag to determine if this is the Sentry build.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_SENTRY_BUILD']\".\n    INLINED_SOCKET_CLI_SENTRY_BUILD: envAsBoolean(\n      process.env['INLINED_SOCKET_CLI_SENTRY_BUILD'],\n    ),\n    // Comp-time inlined synp package version.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_SYNP_VERSION']\".\n    INLINED_SOCKET_CLI_SYNP_VERSION: envAsString(\n      process.env['INLINED_SOCKET_CLI_SYNP_VERSION'],\n    ),\n    // Comp-time inlined Socket package version.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_VERSION']\".\n    INLINED_SOCKET_CLI_VERSION: envAsString(\n      process.env['INLINED_SOCKET_CLI_VERSION'],\n    ),\n    // Comp-time inlined Socket package version hash.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_VERSION_HASH']\".\n    INLINED_SOCKET_CLI_VERSION_HASH: envAsString(\n      process.env['INLINED_SOCKET_CLI_VERSION_HASH'],\n    ),\n    // The absolute location of the %localappdata% folder on Windows used to store\n    // user-specific, non-roaming application data, like temporary files, cached\n    // data, and program settings, that are specific to the current machine and user.\n    LOCALAPPDATA: envAsString(env[LOCALAPPDATA]),\n    // Enable the module compile cache for the Node.js instance.\n    // https://nodejs.org/api/cli.html#node_compile_cachedir\n    NODE_COMPILE_CACHE: constants.SUPPORTS_NODE_COMPILE_CACHE_ENV_VAR\n      ? constants.socketCachePath\n      : '',\n    // Redefine registryConstants.ENV.NODE_ENV to account for the\n    // INLINED_SOCKET_CLI_PUBLISHED_BUILD environment variable.\n    NODE_ENV:\n      envAsString(env['NODE_ENV']).toLowerCase() === 'production'\n        ? 'production'\n        : INLINED_SOCKET_CLI_PUBLISHED_BUILD\n          ? ''\n          : 'development',\n    // Well known \"root\" CAs (like VeriSign) will be extended with the extra\n    // certificates in file. The file should consist of one or more trusted\n    // certificates in PEM format.\n    // https://nodejs.org/api/cli.html#node_extra_ca_certsfile\n    NODE_EXTRA_CA_CERTS:\n      envAsString(env['NODE_EXTRA_CA_CERTS']) ||\n      // Commonly used environment variable to specify the path to a single\n      // PEM-encoded certificate file.\n      envAsString(env['SSL_CERT_FILE']),\n    // PATH is an environment variable that lists directories where executable\n    // programs are located. When a command is run, the system searches these\n    // directories to find the executable.\n    PATH: envAsString(env['PATH']),\n    // Accept risks of a Socket wrapped npm/npx run.\n    SOCKET_CLI_ACCEPT_RISKS: envAsBoolean(env[SOCKET_CLI_ACCEPT_RISKS]),\n    // Change the base URL for Socket API calls.\n    // https://github.com/SocketDev/socket-cli?tab=readme-ov-file#environment-variables-for-development\n    SOCKET_CLI_API_BASE_URL:\n      envAsString(env['SOCKET_CLI_API_BASE_URL']) ||\n      // TODO: Remove legacy environment variable name.\n      envAsString(env['SOCKET_SECURITY_API_BASE_URL']) ||\n      getConfigValueOrUndef('apiBaseUrl') ||\n      'https://api.socket.dev/v0/',\n    // Set the proxy that all requests are routed through.\n    // https://github.com/SocketDev/socket-cli?tab=readme-ov-file#environment-variables-for-development\n    SOCKET_CLI_API_PROXY:\n      envAsString(env['SOCKET_CLI_API_PROXY']) ||\n      // TODO: Remove legacy environment variable name.\n      envAsString(env['SOCKET_SECURITY_API_PROXY']) ||\n      // Commonly used environment variables to specify routing requests through\n      // a proxy server.\n      envAsString(env['HTTPS_PROXY']) ||\n      envAsString(env['https_proxy']) ||\n      envAsString(env['HTTP_PROXY']) ||\n      envAsString(env['http_proxy']),\n    // Set the timeout in milliseconds for Socket API requests.\n    // https://nodejs.org/api/http.html#httprequesturl-options-callback\n    SOCKET_CLI_API_TIMEOUT: envAsNumber(env['SOCKET_CLI_API_TOKEN']),\n    // Set the Socket API token.\n    // https://github.com/SocketDev/socket-cli?tab=readme-ov-file#environment-variables\n    SOCKET_CLI_API_TOKEN:\n      envAsString(env['SOCKET_CLI_API_TOKEN']) ||\n      // TODO: Remove legacy environment variable names.\n      envAsString(env['SOCKET_CLI_API_KEY']) ||\n      envAsString(env['SOCKET_SECURITY_API_TOKEN']) ||\n      envAsString(env['SOCKET_SECURITY_API_KEY']),\n    // A JSON stringified Socket configuration object.\n    SOCKET_CLI_CONFIG: envAsString(env['SOCKET_CLI_CONFIG']),\n    // The git config user.email used by Socket CLI.\n    SOCKET_CLI_GIT_USER_EMAIL:\n      envAsString(env['SOCKET_CLI_GIT_USER_EMAIL']) ||\n      'github-actions[bot]@users.noreply.github.com',\n    // The git config user.name used by Socket CLI.\n    SOCKET_CLI_GIT_USER_NAME:\n      envAsString(env['SOCKET_CLI_GIT_USER_NAME']) ||\n      envAsString(env['SOCKET_CLI_GIT_USERNAME']) ||\n      'github-actions[bot]',\n    // Change the base URL for GitHub REST API calls.\n    // https://docs.github.com/en/rest\n    SOCKET_CLI_GITHUB_API_URL:\n      envAsString(env['SOCKET_CLI_GITHUB_API_URL']) ||\n      readOrDefaultSocketJson(process.cwd())?.defaults?.scan?.github\n        ?.githubApiUrl ||\n      'https://api.github.com',\n    // A classic GitHub personal access token with the \"repo\" scope or a\n    // fine-grained access token with at least read/write permissions set for\n    // \"Contents\" and \"Pull Request\".\n    // https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens\n    SOCKET_CLI_GITHUB_TOKEN:\n      envAsString(env['SOCKET_CLI_GITHUB_TOKEN']) ||\n      // TODO: Remove undocumented legacy environment variable name.\n      envAsString(env['SOCKET_SECURITY_GITHUB_PAT']) ||\n      GITHUB_TOKEN,\n    // Make the default API token `undefined`.\n    SOCKET_CLI_NO_API_TOKEN: envAsBoolean(\n      env['SOCKET_CLI_NO_API_TOKEN'],\n    ),\n    // The absolute location of the npm directory.\n    SOCKET_CLI_NPM_PATH: envAsString(env['SOCKET_CLI_NPM_PATH']),\n    // Specify the Socket organization slug.\n    SOCKET_CLI_ORG_SLUG:\n      envAsString(env['SOCKET_CLI_ORG_SLUG']) ||\n      // Coana CLI accepts the SOCKET_ORG_SLUG environment variable.\n      envAsString(env['SOCKET_ORG_SLUG']),\n    // View all risks of a Socket wrapped npm/npx run.\n    SOCKET_CLI_VIEW_ALL_RISKS: envAsBoolean(\n      env[SOCKET_CLI_VIEW_ALL_RISKS],\n    ),\n    // Specifies the type of terminal or terminal emulator being used by the process.\n    TERM: envAsString(env['TERM']),\n    // The location of the base directory on Linux and MacOS used to store\n    // user-specific data files, defaulting to $HOME/.local/share if not set or empty.\n    XDG_DATA_HOME: envAsString(env['XDG_DATA_HOME']),\n  })\n}\n\nconst lazyBashRcPath = () => path.join(constants.homePath, '.bashrc')\n\nconst lazyBinPath = () => path.join(constants.rootPath, 'bin')\n\nconst lazyBinCliPath = () => path.join(constants.binPath, 'cli.js')\n\nconst lazyBlessedContribPath = () =>\n  path.join(constants.externalPath, 'blessed-contrib')\n\nconst lazyBlessedOptions = () =>\n  Object.freeze({\n    smartCSR: true,\n    term: constants.WIN32 ? 'windows-ansi' : 'xterm',\n    useBCE: true,\n  })\n\nconst lazyBlessedPath = () => path.join(constants.externalPath, 'blessed')\n\nconst lazyDistCliPath = () => path.join(constants.distPath, 'cli.js')\n\nconst lazyDistPath = () => path.join(constants.rootPath, 'dist')\n\nconst lazyExternalPath = () => path.join(constants.rootPath, 'external')\n\nconst lazyGithubCachePath = () => path.join(constants.socketCachePath, 'github')\n\nconst lazyHomePath = () => os.homedir()\n\nconst lazyInstrumentWithSentryPath = () =>\n  path.join(constants.distPath, 'instrument-with-sentry.js')\n\nconst lazyMinimumVersionByAgent = () =>\n  new Map([\n    // Bun >=1.1.39 supports the text-based lockfile.\n    // https://bun.sh/blog/bun-lock-text-lockfile\n    [BUN, '1.1.39'],\n    // The npm version bundled with Node 18.\n    // https://nodejs.org/en/about/previous-releases#looking-for-the-latest-release-of-a-version-branch\n    ['npm', '10.8.2'],\n    // 8.x is the earliest version to support Node 18.\n    // https://pnpm.io/installation#compatibility\n    // https://www.npmjs.com/package/pnpm?activeTab=versions\n    [PNPM, '8.15.7'],\n    // 4.x supports >= Node 18.12.0\n    // https://github.com/yarnpkg/berry/blob/%40yarnpkg/core/4.1.0/CHANGELOG.md#400\n    [YARN_BERRY, '4.0.0'],\n    // Latest 1.x.\n    // https://www.npmjs.com/package/yarn?activeTab=versions\n    [YARN_CLASSIC, '1.22.22'],\n    // vlt does not support overrides so we don't gate on it.\n    [VLT, '*'],\n  ])\n\nconst lazyNmBinPath = () => path.join(constants.rootPath, 'node_modules/.bin')\n\nconst lazyNodeDebugFlags = () =>\n  constants.ENV.SOCKET_CLI_DEBUG ? ['--trace-uncaught', '--trace-warnings'] : []\n\n// Redefine registryConstants.nodeHardenFlags to account for the\n// INLINED_SOCKET_CLI_SENTRY_BUILD environment variable.\nconst lazyNodeHardenFlags = () =>\n  Object.freeze(\n    // Harden Node security.\n    // https://nodejs.org/en/learn/getting-started/security-best-practices\n    constants.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD || constants.WIN32\n      ? [\n          // https://nodejs.org/api/cli.html#--disallow-code-generation-from-strings\n          // '--disallow-code-generation-from-strings'\n        ]\n      : [\n          // '--disallow-code-generation-from-strings',\n          // https://nodejs.org/api/cli.html#--disable-protomode\n          // '--disable-proto',\n          // 'throw',\n          // https://nodejs.org/api/cli.html#--frozen-intrinsics\n          // We have contributed the following patches to our dependencies to make\n          // Node's --frozen-intrinsics workable.\n          // √ https://github.com/SBoudrias/Inquirer.js/pull/1683\n          // √ https://github.com/pnpm/components/pull/23\n          // '--frozen-intrinsics',\n          // https://nodejs.org/api/cli.html#--no-deprecation\n          // '--no-deprecation',\n        ],\n  )\n\nconst lazyNodeMemoryFlags = () => {\n  const flags = /*@__PURE__*/ require(\n    path.join(constants.rootPath, 'dist/flags.js'),\n  )\n  const getMaxOldSpaceSizeFlag = flags.getMaxOldSpaceSizeFlag\n  const getMaxSemiSpaceSizeFlag = flags.getMaxSemiSpaceSizeFlag\n  return Object.freeze([\n    `--max-old-space-size=${getMaxOldSpaceSizeFlag()}`,\n    `--max-semi-space-size=${getMaxSemiSpaceSizeFlag()}`,\n  ])\n}\n\nconst lazyNpmCachePath = () => {\n  const spawnHelpers = /*@__PURE__*/ require('@socketsecurity/registry/lib/spawn')\n  const spawnSync = spawnHelpers.spawnSync\n  return spawnSync(\n    constants.npmExecPath,\n    ['config', 'get', 'cache'],\n    getNpmStdioPipeOptions(),\n  ).stdout\n}\n\nconst lazyNpmGlobalPrefix = () => {\n  const spawnHelpers = /*@__PURE__*/ require('@socketsecurity/registry/lib/spawn')\n  const spawnSync = spawnHelpers.spawnSync\n  return spawnSync(\n    constants.npmExecPath,\n    ['prefix', '-g'],\n    getNpmStdioPipeOptions(),\n  ).stdout\n}\n\nconst lazyNpmNmNodeGypPath = () =>\n  path.join(\n    constants.npmRealExecPath,\n    '../../node_modules/node-gyp/bin/node-gyp.js',\n  )\n\nconst lazyProcessEnv = () =>\n  Object.setPrototypeOf(\n    Object.fromEntries(\n      Object.entries(constants.ENV).reduce(\n        (entries, entry) => {\n          const { 0: key, 1: value } = entry\n          if (key.startsWith('INLINED_SOCKET_CLI_')) {\n            return entries\n          }\n          if (typeof value === 'string') {\n            if (value) {\n              entries.push(entry as [string, string])\n            }\n          } else if (typeof value === 'boolean' && value) {\n            entries.push([key, '1'])\n          }\n          return entries\n        },\n        [] as Array<[string, string]>,\n      ),\n    ),\n    null,\n  )\n\nconst lazyRootPath = () => path.join(realpathSync.native(__dirname), '..')\n\nconst lazyShadowBinPath = () => path.join(constants.rootPath, 'shadow-npm-bin')\n\nconst lazyShadowNpmBinPath = () =>\n  path.join(constants.distPath, 'shadow-npm-bin.js')\n\nconst lazyShadowNpmInjectPath = () =>\n  path.join(constants.distPath, 'shadow-npm-inject.js')\n\nconst lazySocketAppDataPath = (): string | undefined => {\n  // Get the OS app data directory:\n  // - Win: %LOCALAPPDATA% or fail?\n  // - Mac: %XDG_DATA_HOME% or fallback to \"~/Library/Application Support/\"\n  // - Linux: %XDG_DATA_HOME% or fallback to \"~/.local/share/\"\n  // Note: LOCALAPPDATA is typically: C:\\Users\\USERNAME\\AppData\n  // Note: XDG stands for \"X Desktop Group\", nowadays \"freedesktop.org\"\n  //       On most systems that path is: $HOME/.local/share\n  // Then append `socket/settings`, so:\n  // - Win: %LOCALAPPDATA%\\socket\\settings or return undefined\n  // - Mac: %XDG_DATA_HOME%/socket/settings or \"~/Library/Application Support/socket/settings\"\n  // - Linux: %XDG_DATA_HOME%/socket/settings or \"~/.local/share/socket/settings\"\n  const { WIN32 } = constants\n  let dataHome: string | undefined = WIN32\n    ? constants.ENV.LOCALAPPDATA\n    : constants.ENV.XDG_DATA_HOME\n  if (!dataHome) {\n    if (WIN32) {\n      const logger = /*@__PURE__*/ require('@socketsecurity/registry/lib/logger')\n      logger.warn(`Missing %${LOCALAPPDATA}%`)\n    } else {\n      dataHome = path.join(\n        constants.homePath,\n        constants.DARWIN ? 'Library/Application Support' : '.local/share',\n      )\n    }\n  }\n  return dataHome ? path.join(dataHome, 'socket/settings') : undefined\n}\n\nconst lazySocketCachePath = () => path.join(constants.rootPath, '.cache')\n\nconst lazySocketRegistryPath = () =>\n  path.join(constants.externalPath, '@socketsecurity/registry')\n\nconst lazyZshRcPath = () => path.join(constants.homePath, '.zshrc')\n\nconst constants: Constants = createConstantsObject(\n  {\n    ...registryConstantsAttribs.props,\n    ALERT_TYPE_CRITICAL_CVE,\n    ALERT_TYPE_CVE,\n    ALERT_TYPE_MEDIUM_CVE,\n    ALERT_TYPE_MILD_CVE,\n    API_V0_URL,\n    BINARY_LOCK_EXT,\n    BUN,\n    DOT_SOCKET_DOT_FACTS_JSON,\n    DRY_RUN_LABEL,\n    DRY_RUN_BAILING_NOW,\n    DRY_RUN_NOT_SAVING,\n    ENV: undefined,\n    LOCK_EXT,\n    NPM_BUGGY_OVERRIDES_PATCHED_VERSION,\n    NPM_REGISTRY_URL,\n    PNPM,\n    REDACTED,\n    SOCKET_CLI_ACCEPT_RISKS,\n    SOCKET_CLI_BIN_NAME,\n    SOCKET_CLI_FIX,\n    SOCKET_CLI_ISSUES_URL,\n    SOCKET_CLI_OPTIMIZE,\n    SOCKET_CLI_SHADOW_ACCEPT_RISKS,\n    SOCKET_CLI_SHADOW_API_TOKEN,\n    SOCKET_CLI_SHADOW_BIN,\n    SOCKET_CLI_SHADOW_PROGRESS,\n    SOCKET_CLI_SHADOW_SILENT,\n    SOCKET_CLI_VIEW_ALL_RISKS,\n    SOCKET_DEFAULT_BRANCH,\n    SOCKET_DEFAULT_REPOSITORY,\n    SOCKET_WEBSITE_URL,\n    VLT,\n    YARN,\n    YARN_BERRY,\n    YARN_CLASSIC,\n    YARN_LOCK,\n    bashRcPath: undefined,\n    binPath: undefined,\n    binCliPath: undefined,\n    blessedContribPath: undefined,\n    blessedOptions: undefined,\n    blessedPath: undefined,\n    coanaBinPath: undefined,\n    coanaPath: undefined,\n    distCliPath: undefined,\n    distPath: undefined,\n    externalPath: undefined,\n    githubCachePath: undefined,\n    homePath: undefined,\n    instrumentWithSentryPath: undefined,\n    minimumVersionByAgent: undefined,\n    nmBinPath: undefined,\n    nodeHardenFlags: undefined,\n    nodeDebugFlags: undefined,\n    nodeMemoryFlags: undefined,\n    npmCachePath: undefined,\n    npmGlobalPrefix: undefined,\n    npmNmNodeGypPath: undefined,\n    processEnv: undefined,\n    rootPath: undefined,\n    shadowBinPath: undefined,\n    shadowNpmInjectPath: undefined,\n    shadowNpmBinPath: undefined,\n    socketAppDataPath: undefined,\n    socketCachePath: undefined,\n    socketRegistryPath: undefined,\n    zshRcPath: undefined,\n  },\n  {\n    getters: {\n      ...registryConstantsAttribs.getters,\n      ENV: LAZY_ENV,\n      bashRcPath: lazyBashRcPath,\n      binCliPath: lazyBinCliPath,\n      binPath: lazyBinPath,\n      blessedContribPath: lazyBlessedContribPath,\n      blessedOptions: lazyBlessedOptions,\n      blessedPath: lazyBlessedPath,\n      distCliPath: lazyDistCliPath,\n      distPath: lazyDistPath,\n      externalPath: lazyExternalPath,\n      githubCachePath: lazyGithubCachePath,\n      homePath: lazyHomePath,\n      instrumentWithSentryPath: lazyInstrumentWithSentryPath,\n      minimumVersionByAgent: lazyMinimumVersionByAgent,\n      nmBinPath: lazyNmBinPath,\n      nodeDebugFlags: lazyNodeDebugFlags,\n      nodeHardenFlags: lazyNodeHardenFlags,\n      nodeMemoryFlags: lazyNodeMemoryFlags,\n      npmCachePath: lazyNpmCachePath,\n      npmGlobalPrefix: lazyNpmGlobalPrefix,\n      npmNmNodeGypPath: lazyNpmNmNodeGypPath,\n      processEnv: lazyProcessEnv,\n      rootPath: lazyRootPath,\n      shadowBinPath: lazyShadowBinPath,\n      shadowNpmBinPath: lazyShadowNpmBinPath,\n      shadowNpmInjectPath: lazyShadowNpmInjectPath,\n      socketAppDataPath: lazySocketAppDataPath,\n      socketCachePath: lazySocketCachePath,\n      socketRegistryPath: lazySocketRegistryPath,\n      zshRcPath: lazyZshRcPath,\n    },\n    internals: {\n      ...registryConstantsAttribs.internals,\n      getIpc,\n      getSentry() {\n        return _Sentry\n      },\n      setSentry(Sentry: Sentry): boolean {\n        if (_Sentry === undefined) {\n          _Sentry = Sentry\n          return true\n        }\n        return false\n      },\n    },\n  },\n) as Constants\n\nexport default constants\n"],"names":["attributes","getIpc","_npmStdioPipeOptions","cwd","env","__proto__","DISABLE_GITHUB_CACHE","GITHUB_BASE_REF","GITHUB_REF_NAME","GITHUB_REF_TYPE","GITHUB_REPOSITORY","LOCALAPPDATA","NODE_EXTRA_CA_CERTS","envAsString","PATH","SOCKET_CLI_ACCEPT_RISKS","SOCKET_CLI_API_BASE_URL","SOCKET_CLI_API_PROXY","SOCKET_CLI_API_TIMEOUT","SOCKET_CLI_API_TOKEN","SOCKET_CLI_CONFIG","SOCKET_CLI_GIT_USER_NAME","SOCKET_CLI_GITHUB_TOKEN","SOCKET_CLI_NO_API_TOKEN","SOCKET_CLI_NPM_PATH","SOCKET_CLI_ORG_SLUG","SOCKET_CLI_VIEW_ALL_RISKS","TERM","XDG_DATA_HOME","smartCSR","term","useBCE","constants","entries","WIN32","logger","dataHome","ENV","bashRcPath","binPath","binCliPath","blessedContribPath","blessedOptions","blessedPath","coanaBinPath","coanaPath","distCliPath","distPath","externalPath","githubCachePath","homePath","instrumentWithSentryPath","minimumVersionByAgent","nmBinPath","nodeHardenFlags","nodeDebugFlags","nodeMemoryFlags","npmCachePath","npmGlobalPrefix","npmNmNodeGypPath","processEnv","rootPath","shadowBinPath","shadowNpmInjectPath","shadowNpmBinPath","socketAppDataPath","socketCachePath","socketRegistryPath","zshRcPath","getters","internals","getSentry","_Sentry"],"mappings":";;;;;;;;;;AAYA;AACA;AACA;AACA;AACA;AACA;AAEA;;AAEE;AACEA;;AAEAC;AACF;AACF;AA+JA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AAEA;AACA;;AAEIC;AACEC;;;AAGJ;AACA;AACF;AAEA;;AACUC;AAAI;AACZ;AACA;AAGA;AACA;AACA;AACA;AACA;;;AAKA;AACA;;AAEEC;AACA;;AAEA;AACA;AACAC;AACA;AACA;;AAGA;AACA;AACA;AACA;AACAC;AACA;AACA;AACA;AACA;AACAC;AACA;AACA;AACAC;AACA;AACA;AACAC;AACA;AACA;;AAGA;AACA;AACA;AACA;;AAEA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAEA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;AACA;AACAC;AACA;AACA;;AAIA;AACA;;AAOA;AACA;AACA;AACA;AACAC;AAEE;AACA;AACAC;AACF;AACA;AACA;AACAC;AACA;AACAC;AACA;AACA;AACAC;AAEE;AACAH;AAGF;AACA;AACAI;AAEE;AACAJ;AACA;AACA;AACAA;AAIF;AACA;AACAK;AACA;AACA;AACAC;AAEE;;AAIF;AACAC;AACA;;AAIA;AACAC;AAIA;AACA;;AAMA;AACA;AACA;AACA;AACAC;AAEE;AACAT;AAEF;AACAU;AAGA;AACAC;AACA;AACAC;AAEE;AACAZ;AACF;AACAa;AAGA;AACAC;AACA;AACA;AACAC;AACF;AACF;AAEA;AAEA;AAEA;AAEA;AAGA;AAEIC;AACAC;AACAC;AACF;AAEF;AAEA;AAEA;AAEA;AAEA;AAEA;AAEA;AAGA;AAEI;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGJ;AAEA;;AAGA;AACA;AACA;AAEI;AACA;AACAC;AAEM;AACA;AAAA;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAAA;AAIV;AACE;AAGA;AACA;AACA;AAIF;AAEA;AACE;AACA;AACA;AAKF;AAEA;AACE;AACA;AACA;AAKF;AAEA;AAMA;;AAKkB;AAAQ;AAAS;AACzB;AACE;AACF;AACA;AACE;AACEC;AACF;;;AAGF;AACA;AACF;AAOR;AAEA;AAEA;AAGA;AAGA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACQC;AAAM;AACd;;AAIE;AACE;AACAC;AACF;AACEC;AAIF;AACF;;AAEF;AAEA;AAEA;AAGA;AAEA;;;;;;;;;;;;;AAcIC;;;;;;;;;;;;;;;;;;;;;;;;;AAyBAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACF;AAEEC;;AAEEhC;AACAC;AACAE;AACAD;AACAE;AACAC;AACAC;AACAG;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAE;AACAD;AACAE;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAE;AACAD;AACAE;AACAC;AACAC;AACAC;;AAEFE;;;AAGEC;AACE;;;;AAIEC;AACA;AACF;AACA;AACF;AACF;AACF;;","debugId":"4d9cfcdb-a32b-4892-9fc7-8ac5c237f94a"}
+{"version":3,"file":"constants.js","sources":["../src/constants.mts"],"sourcesContent":["import { realpathSync } from 'node:fs'\nimport { createRequire } from 'node:module'\nimport os from 'node:os'\nimport path from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nimport registryConstants from '@socketsecurity/registry/lib/constants'\n\nimport type { Agent } from './utils/package-environment.mts'\nimport type { Remap } from '@socketsecurity/registry/lib/objects'\nimport type { SpawnOptions } from '@socketsecurity/registry/lib/spawn'\n\nconst require = createRequire(import.meta.url)\nconst __filename = fileURLToPath(import.meta.url)\n// Using `path.dirname(__filename)` to resolve `__dirname` works for both 'dist'\n// AND 'src' directories because constants.js and constants.mts respectively are\n// in the root of each.\nconst __dirname = path.dirname(__filename)\n\nconst {\n  NPM,\n  kInternalsSymbol,\n  [kInternalsSymbol as unknown as 'Symbol(kInternalsSymbol)']: {\n    attributes: registryConstantsAttribs,\n    createConstantsObject,\n    getIpc,\n  },\n} = registryConstants\n\nexport type RegistryEnv = typeof registryConstants.ENV\n\nexport type RegistryInternals =\n  (typeof registryConstants)['Symbol(kInternalsSymbol)']\n\nexport type Sentry = any\n\nexport type Internals = Remap<\n  Omit<RegistryInternals, 'getIpc'> &\n    Readonly<{\n      getIpc: {\n        (): Promise<IPC>\n        <K extends keyof IPC | undefined>(\n          key?: K | undefined,\n        ): Promise<K extends keyof IPC ? IPC[K] : IPC>\n      }\n      getSentry: () => Sentry\n      setSentry(Sentry: Sentry): boolean\n    }>\n>\n\nexport type ENV = Remap<\n  RegistryEnv &\n    Readonly<{\n      DISABLE_GITHUB_CACHE: boolean\n      GITHUB_API_URL: string\n      GITHUB_BASE_REF: string\n      GITHUB_REF_NAME: string\n      GITHUB_REF_TYPE: string\n      GITHUB_REPOSITORY: string\n      GITHUB_SERVER_URL: string\n      GITHUB_TOKEN: string\n      INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION: string\n      INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION: string\n      INLINED_SOCKET_CLI_HOMEPAGE: string\n      INLINED_SOCKET_CLI_LEGACY_BUILD: string\n      INLINED_SOCKET_CLI_NAME: string\n      INLINED_SOCKET_CLI_PUBLISHED_BUILD: string\n      INLINED_SOCKET_CLI_SENTRY_BUILD: string\n      INLINED_SOCKET_CLI_VERSION: string\n      INLINED_SOCKET_CLI_VERSION_HASH: string\n      INLINED_SOCKET_CLI_SYNP_VERSION: string\n      LOCALAPPDATA: string\n      NODE_COMPILE_CACHE: string\n      NODE_EXTRA_CA_CERTS: string\n      PATH: string\n      SOCKET_CLI_ACCEPT_RISKS: boolean\n      SOCKET_CLI_API_BASE_URL: string\n      SOCKET_CLI_API_PROXY: string\n      SOCKET_CLI_API_TIMEOUT: number\n      SOCKET_CLI_API_TOKEN: string\n      SOCKET_CLI_CONFIG: string\n      SOCKET_CLI_GIT_USER_EMAIL: string\n      SOCKET_CLI_GIT_USER_NAME: string\n      SOCKET_CLI_GITHUB_TOKEN: string\n      SOCKET_CLI_NO_API_TOKEN: boolean\n      SOCKET_CLI_NPM_PATH: string\n      SOCKET_CLI_ORG_SLUG: string\n      SOCKET_CLI_VIEW_ALL_RISKS: boolean\n      TERM: string\n      XDG_DATA_HOME: string\n    }>\n>\n\nexport type ProcessEnv = {\n  [K in keyof ENV]?: string\n}\n\nexport type IPC = Readonly<{\n  SOCKET_CLI_FIX?: string | undefined\n  SOCKET_CLI_OPTIMIZE?: boolean | undefined\n  SOCKET_CLI_SHADOW_ACCEPT_RISKS?: boolean | undefined\n  SOCKET_CLI_SHADOW_API_TOKEN?: string | undefined\n  SOCKET_CLI_SHADOW_BIN?: string | undefined\n  SOCKET_CLI_SHADOW_PROGRESS?: boolean | undefined\n  SOCKET_CLI_SHADOW_SILENT?: boolean | undefined\n}>\n\nexport type Constants = Remap<\n  Omit<typeof registryConstants, 'Symbol(kInternalsSymbol)' | 'ENV' | 'IPC'> & {\n    readonly 'Symbol(kInternalsSymbol)': Internals\n    readonly ALERT_TYPE_CRITICAL_CVE: 'criticalCVE'\n    readonly ALERT_TYPE_CVE: 'cve'\n    readonly ALERT_TYPE_MEDIUM_CVE: 'mediumCVE'\n    readonly ALERT_TYPE_MILD_CVE: 'mildCVE'\n    readonly API_V0_URL: 'https://api.socket.dev/v0/'\n    readonly BINARY_LOCK_EXT: '.lockb'\n    readonly BUN: 'bun'\n    readonly ENV: ENV\n    readonly DOT_SOCKET_DOT_FACTS_JSON: '.socket.facts.json'\n    readonly DRY_RUN_LABEL: '[DryRun]'\n    readonly DRY_RUN_BAILING_NOW: '[DryRun] Bailing now'\n    readonly DRY_RUN_NOT_SAVING: '[DryRun] Not saving'\n    readonly IPC: IPC\n    readonly LOCK_EXT: '.lock'\n    readonly NPM_BUGGY_OVERRIDES_PATCHED_VERSION: '11.2.0'\n    readonly NPM_REGISTRY_URL: 'https://registry.npmjs.org'\n    readonly PNPM: 'pnpm'\n    readonly REDACTED: '<redacted>'\n    readonly SOCKET_CLI_ACCEPT_RISKS: 'SOCKET_CLI_ACCEPT_RISKS'\n    readonly SOCKET_CLI_BIN_NAME: 'socket'\n    readonly SOCKET_CLI_CONFIG: 'SOCKET_CLI_CONFIG'\n    readonly SOCKET_CLI_FIX: 'SOCKET_CLI_FIX'\n    readonly SOCKET_CLI_ISSUES_URL: 'https://github.com/SocketDev/socket-cli/issues'\n    readonly SOCKET_CLI_OPTIMIZE: 'SOCKET_CLI_OPTIMIZE'\n    readonly SOCKET_CLI_SHADOW_ACCEPT_RISKS: 'SOCKET_CLI_SHADOW_ACCEPT_RISKS'\n    readonly SOCKET_CLI_SHADOW_API_TOKEN: 'SOCKET_CLI_SHADOW_API_TOKEN'\n    readonly SOCKET_CLI_SHADOW_BIN: 'SOCKET_CLI_SHADOW_BIN'\n    readonly SOCKET_CLI_SHADOW_PROGRESS: 'SOCKET_CLI_SHADOW_PROGRESS'\n    readonly SOCKET_CLI_SHADOW_SILENT: 'SOCKET_CLI_SHADOW_SILENT'\n    readonly SOCKET_CLI_VIEW_ALL_RISKS: 'SOCKET_CLI_VIEW_ALL_RISKS'\n    readonly SOCKET_DEFAULT_BRANCH: 'socket-default-branch'\n    readonly SOCKET_DEFAULT_REPOSITORY: 'socket-default-repository'\n    readonly SOCKET_WEBSITE_URL: 'https://socket.dev'\n    readonly VLT: 'vlt'\n    readonly YARN: 'yarn'\n    readonly YARN_BERRY: 'yarn/berry'\n    readonly YARN_CLASSIC: 'yarn/classic'\n    readonly YARN_LOCK: 'yarn.lock'\n    readonly bashRcPath: string\n    readonly binCliPath: string\n    readonly binPath: string\n    readonly blessedContribPath: string\n    readonly blessedOptions: {\n      smartCSR: boolean\n      term: string\n      useBCE: boolean\n    }\n    readonly blessedPath: string\n    readonly coanaBinPath: string\n    readonly coanaPath: string\n    readonly distCliPath: string\n    readonly distPath: string\n    readonly externalPath: string\n    readonly githubCachePath: string\n    readonly homePath: string\n    readonly instrumentWithSentryPath: string\n    readonly minimumVersionByAgent: Map<Agent, string>\n    readonly nmBinPath: string\n    readonly nodeDebugFlags: string[]\n    readonly nodeHardenFlags: string[]\n    readonly nodeMemoryFlags: string[]\n    readonly npmCachePath: string\n    readonly npmGlobalPrefix: string\n    readonly npmNmNodeGypPath: string\n    readonly processEnv: ProcessEnv\n    readonly rootPath: string\n    readonly shadowBinPath: string\n    readonly shadowNpmBinPath: string\n    readonly shadowNpmInjectPath: string\n    readonly socketAppDataPath: string\n    readonly socketCachePath: string\n    readonly socketRegistryPath: string\n    readonly zshRcPath: string\n  }\n>\n\nconst ALERT_TYPE_CRITICAL_CVE = 'criticalCVE'\nconst ALERT_TYPE_CVE = 'cve'\nconst ALERT_TYPE_MEDIUM_CVE = 'mediumCVE'\nconst ALERT_TYPE_MILD_CVE = 'mildCVE'\nconst API_V0_URL = 'https://api.socket.dev/v0/'\nconst BINARY_LOCK_EXT = '.lockb'\nconst BUN = 'bun'\nconst DOT_SOCKET_DOT_FACTS_JSON = '.socket.facts.json'\nconst DRY_RUN_LABEL = '[DryRun]'\nconst DRY_RUN_BAILING_NOW = `${DRY_RUN_LABEL}: Bailing now`\nconst DRY_RUN_NOT_SAVING = `${DRY_RUN_LABEL}: Not saving`\nconst LOCALAPPDATA = 'LOCALAPPDATA'\nconst LOCK_EXT = '.lock'\nconst NPM_BUGGY_OVERRIDES_PATCHED_VERSION = '11.2.0'\nconst NPM_REGISTRY_URL = 'https://registry.npmjs.org'\nconst PNPM = 'pnpm'\nconst REDACTED = '<redacted>'\nconst SOCKET_CLI_ACCEPT_RISKS = 'SOCKET_CLI_ACCEPT_RISKS'\nconst SOCKET_CLI_BIN_NAME = 'socket'\nconst SOCKET_CLI_FIX = 'SOCKET_CLI_FIX'\nconst SOCKET_CLI_ISSUES_URL = 'https://github.com/SocketDev/socket-cli/issues'\nconst SOCKET_CLI_OPTIMIZE = 'SOCKET_CLI_OPTIMIZE'\nconst SOCKET_CLI_SHADOW_ACCEPT_RISKS = 'SOCKET_CLI_SHADOW_ACCEPT_RISKS'\nconst SOCKET_CLI_SHADOW_API_TOKEN = 'SOCKET_CLI_SHADOW_API_TOKEN'\nconst SOCKET_CLI_SHADOW_BIN = 'SOCKET_CLI_SHADOW_BIN'\nconst SOCKET_CLI_SHADOW_PROGRESS = 'SOCKET_CLI_SHADOW_PROGRESS'\nconst SOCKET_CLI_SHADOW_SILENT = 'SOCKET_CLI_SHADOW_SILENT'\nconst SOCKET_CLI_VIEW_ALL_RISKS = 'SOCKET_CLI_VIEW_ALL_RISKS'\nconst SOCKET_DEFAULT_BRANCH = 'socket-default-branch'\nconst SOCKET_DEFAULT_REPOSITORY = 'socket-default-repository'\nconst SOCKET_WEBSITE_URL = 'https://socket.dev'\nconst VLT = 'vlt'\nconst YARN = 'yarn'\nconst YARN_BERRY = 'yarn/berry'\nconst YARN_CLASSIC = 'yarn/classic'\nconst YARN_LOCK = 'yarn.lock'\n\nlet _Sentry: any\n\nlet _npmStdioPipeOptions: SpawnOptions | undefined\nfunction getNpmStdioPipeOptions() {\n  if (_npmStdioPipeOptions === undefined) {\n    _npmStdioPipeOptions = {\n      cwd: process.cwd(),\n      shell: constants.WIN32,\n    }\n  }\n  return _npmStdioPipeOptions\n}\n\nconst LAZY_ENV = () => {\n  const { env } = process\n  const envHelpers = /*@__PURE__*/ require('@socketsecurity/registry/lib/env')\n  const utils = /*@__PURE__*/ require(\n    path.join(constants.rootPath, 'dist/utils.js'),\n  )\n  const envAsBoolean = envHelpers.envAsBoolean\n  const envAsNumber = envHelpers.envAsNumber\n  const envAsString = envHelpers.envAsString\n  const getConfigValueOrUndef = utils.getConfigValueOrUndef\n  const readOrDefaultSocketJson = utils.readOrDefaultSocketJson\n  const GITHUB_TOKEN = envAsString(env['GITHUB_TOKEN'])\n  const INLINED_SOCKET_CLI_PUBLISHED_BUILD = envAsBoolean(\n    process.env['INLINED_SOCKET_CLI_PUBLISHED_BUILD'],\n  )\n  // We inline some environment values so that they CANNOT be influenced by user\n  // provided environment variables.\n  return Object.freeze({\n    __proto__: null,\n    // Lazily access registryConstants.ENV.\n    ...registryConstants.ENV,\n    // Disable using GitHub's workflow actions/cache.\n    // https://github.com/actions/cache\n    DISABLE_GITHUB_CACHE: envAsBoolean(env['DISABLE_GITHUB_CACHE']),\n    // The API URL. For example, https://api.github.com.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_API_URL:\n      envAsString(env['GITHUB_API_URL']) || 'https://api.github.com',\n    // The name of the base ref or target branch of the pull request in a workflow\n    // run. This is only set when the event that triggers a workflow run is either\n    // pull_request or pull_request_target. For example, main.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_BASE_REF: envAsString(env['GITHUB_BASE_REF']),\n    // The short ref name of the branch or tag that triggered the GitHub workflow\n    // run. This value matches the branch or tag name shown on GitHub. For example,\n    // feature-branch-1. For pull requests, the format is <pr_number>/merge.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_REF_NAME: envAsString(env['GITHUB_REF_NAME']),\n    // The type of ref that triggered the workflow run. Valid values are branch or tag.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_REF_TYPE: envAsString(env['GITHUB_REF_TYPE']),\n    // The owner and repository name. For example, octocat/Hello-World.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_REPOSITORY: envAsString(env['GITHUB_REPOSITORY']),\n    // The URL of the GitHub server. For example, https://github.com.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_SERVER_URL:\n      envAsString(env['GITHUB_SERVER_URL']) || 'https://github.com',\n    // The GITHUB_TOKEN secret is a GitHub App installation access token.\n    // The token's permissions are limited to the repository that contains the\n    // workflow.\n    // https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#about-the-github_token-secret\n    GITHUB_TOKEN,\n    // Comp-time inlined @coana-tech/cli package version.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION']\".\n    INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION: envAsString(\n      process.env['INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION'],\n    ),\n    // Comp-time inlined @cyclonedx/cdxgen package version.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION']\".\n    INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION: envAsString(\n      process.env['INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION'],\n    ),\n    // Comp-time inlined Socket package homepage.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_HOMEPAGE']\".\n    INLINED_SOCKET_CLI_HOMEPAGE: envAsString(\n      process.env['INLINED_SOCKET_CLI_HOMEPAGE'],\n    ),\n    // Comp-time inlined flag to determine if this is the Legacy build.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_LEGACY_BUILD']\".\n    INLINED_SOCKET_CLI_LEGACY_BUILD: envAsBoolean(\n      process.env['INLINED_SOCKET_CLI_LEGACY_BUILD'],\n    ),\n    // Comp-time inlined Socket package name.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_NAME']\".\n    INLINED_SOCKET_CLI_NAME: envAsString(\n      process.env['INLINED_SOCKET_CLI_NAME'],\n    ),\n    // Comp-time inlined flag to determine if this is a published build.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_PUBLISHED_BUILD']\".\n    INLINED_SOCKET_CLI_PUBLISHED_BUILD,\n    // Comp-time inlined flag to determine if this is the Sentry build.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_SENTRY_BUILD']\".\n    INLINED_SOCKET_CLI_SENTRY_BUILD: envAsBoolean(\n      process.env['INLINED_SOCKET_CLI_SENTRY_BUILD'],\n    ),\n    // Comp-time inlined synp package version.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_SYNP_VERSION']\".\n    INLINED_SOCKET_CLI_SYNP_VERSION: envAsString(\n      process.env['INLINED_SOCKET_CLI_SYNP_VERSION'],\n    ),\n    // Comp-time inlined Socket package version.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_VERSION']\".\n    INLINED_SOCKET_CLI_VERSION: envAsString(\n      process.env['INLINED_SOCKET_CLI_VERSION'],\n    ),\n    // Comp-time inlined Socket package version hash.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_VERSION_HASH']\".\n    INLINED_SOCKET_CLI_VERSION_HASH: envAsString(\n      process.env['INLINED_SOCKET_CLI_VERSION_HASH'],\n    ),\n    // The absolute location of the %localappdata% folder on Windows used to store\n    // user-specific, non-roaming application data, like temporary files, cached\n    // data, and program settings, that are specific to the current machine and user.\n    LOCALAPPDATA: envAsString(env[LOCALAPPDATA]),\n    // Enable the module compile cache for the Node.js instance.\n    // https://nodejs.org/api/cli.html#node_compile_cachedir\n    NODE_COMPILE_CACHE: constants.SUPPORTS_NODE_COMPILE_CACHE_ENV_VAR\n      ? constants.socketCachePath\n      : '',\n    // Redefine registryConstants.ENV.NODE_ENV to account for the\n    // INLINED_SOCKET_CLI_PUBLISHED_BUILD environment variable.\n    NODE_ENV:\n      envAsString(env['NODE_ENV']).toLowerCase() === 'production'\n        ? 'production'\n        : INLINED_SOCKET_CLI_PUBLISHED_BUILD\n          ? ''\n          : 'development',\n    // Well known \"root\" CAs (like VeriSign) will be extended with the extra\n    // certificates in file. The file should consist of one or more trusted\n    // certificates in PEM format.\n    // https://nodejs.org/api/cli.html#node_extra_ca_certsfile\n    NODE_EXTRA_CA_CERTS:\n      envAsString(env['NODE_EXTRA_CA_CERTS']) ||\n      // Commonly used environment variable to specify the path to a single\n      // PEM-encoded certificate file.\n      envAsString(env['SSL_CERT_FILE']),\n    // PATH is an environment variable that lists directories where executable\n    // programs are located. When a command is run, the system searches these\n    // directories to find the executable.\n    PATH: envAsString(env['PATH']),\n    // Accept risks of a Socket wrapped npm/npx run.\n    SOCKET_CLI_ACCEPT_RISKS: envAsBoolean(env[SOCKET_CLI_ACCEPT_RISKS]),\n    // Change the base URL for Socket API calls.\n    // https://github.com/SocketDev/socket-cli?tab=readme-ov-file#environment-variables-for-development\n    SOCKET_CLI_API_BASE_URL:\n      envAsString(env['SOCKET_CLI_API_BASE_URL']) ||\n      // TODO: Remove legacy environment variable name.\n      envAsString(env['SOCKET_SECURITY_API_BASE_URL']) ||\n      getConfigValueOrUndef('apiBaseUrl') ||\n      'https://api.socket.dev/v0/',\n    // Set the proxy that all requests are routed through.\n    // https://github.com/SocketDev/socket-cli?tab=readme-ov-file#environment-variables-for-development\n    SOCKET_CLI_API_PROXY:\n      envAsString(env['SOCKET_CLI_API_PROXY']) ||\n      // TODO: Remove legacy environment variable name.\n      envAsString(env['SOCKET_SECURITY_API_PROXY']) ||\n      // Commonly used environment variables to specify routing requests through\n      // a proxy server.\n      envAsString(env['HTTPS_PROXY']) ||\n      envAsString(env['https_proxy']) ||\n      envAsString(env['HTTP_PROXY']) ||\n      envAsString(env['http_proxy']),\n    // Set the timeout in milliseconds for Socket API requests.\n    // https://nodejs.org/api/http.html#httprequesturl-options-callback\n    SOCKET_CLI_API_TIMEOUT: envAsNumber(env['SOCKET_CLI_API_TOKEN']),\n    // Set the Socket API token.\n    // https://github.com/SocketDev/socket-cli?tab=readme-ov-file#environment-variables\n    SOCKET_CLI_API_TOKEN:\n      envAsString(env['SOCKET_CLI_API_TOKEN']) ||\n      // TODO: Remove legacy environment variable names.\n      envAsString(env['SOCKET_CLI_API_KEY']) ||\n      envAsString(env['SOCKET_SECURITY_API_TOKEN']) ||\n      envAsString(env['SOCKET_SECURITY_API_KEY']),\n    // A JSON stringified Socket configuration object.\n    SOCKET_CLI_CONFIG: envAsString(env['SOCKET_CLI_CONFIG']),\n    // The git config user.email used by Socket CLI.\n    SOCKET_CLI_GIT_USER_EMAIL:\n      envAsString(env['SOCKET_CLI_GIT_USER_EMAIL']) ||\n      'github-actions[bot]@users.noreply.github.com',\n    // The git config user.name used by Socket CLI.\n    SOCKET_CLI_GIT_USER_NAME:\n      envAsString(env['SOCKET_CLI_GIT_USER_NAME']) ||\n      envAsString(env['SOCKET_CLI_GIT_USERNAME']) ||\n      'github-actions[bot]',\n    // Change the base URL for GitHub REST API calls.\n    // https://docs.github.com/en/rest\n    SOCKET_CLI_GITHUB_API_URL:\n      envAsString(env['SOCKET_CLI_GITHUB_API_URL']) ||\n      readOrDefaultSocketJson(process.cwd())?.defaults?.scan?.github\n        ?.githubApiUrl ||\n      'https://api.github.com',\n    // A classic GitHub personal access token with the \"repo\" scope or a\n    // fine-grained access token with at least read/write permissions set for\n    // \"Contents\" and \"Pull Request\".\n    // https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens\n    SOCKET_CLI_GITHUB_TOKEN:\n      envAsString(env['SOCKET_CLI_GITHUB_TOKEN']) ||\n      // TODO: Remove undocumented legacy environment variable name.\n      envAsString(env['SOCKET_SECURITY_GITHUB_PAT']) ||\n      GITHUB_TOKEN,\n    // Make the default API token `undefined`.\n    SOCKET_CLI_NO_API_TOKEN: envAsBoolean(env['SOCKET_CLI_NO_API_TOKEN']),\n    // The absolute location of the npm directory.\n    SOCKET_CLI_NPM_PATH: envAsString(env['SOCKET_CLI_NPM_PATH']),\n    // Specify the Socket organization slug.\n    SOCKET_CLI_ORG_SLUG:\n      envAsString(env['SOCKET_CLI_ORG_SLUG']) ||\n      // Coana CLI accepts the SOCKET_ORG_SLUG environment variable.\n      envAsString(env['SOCKET_ORG_SLUG']),\n    // View all risks of a Socket wrapped npm/npx run.\n    SOCKET_CLI_VIEW_ALL_RISKS: envAsBoolean(env[SOCKET_CLI_VIEW_ALL_RISKS]),\n    // Specifies the type of terminal or terminal emulator being used by the process.\n    TERM: envAsString(env['TERM']),\n    // The location of the base directory on Linux and MacOS used to store\n    // user-specific data files, defaulting to $HOME/.local/share if not set or empty.\n    XDG_DATA_HOME: envAsString(env['XDG_DATA_HOME']),\n  })\n}\n\nconst lazyBashRcPath = () => path.join(constants.homePath, '.bashrc')\n\nconst lazyBinPath = () => path.join(constants.rootPath, 'bin')\n\nconst lazyBinCliPath = () => path.join(constants.binPath, 'cli.js')\n\nconst lazyBlessedContribPath = () =>\n  path.join(constants.externalPath, 'blessed-contrib')\n\nconst lazyBlessedOptions = () =>\n  Object.freeze({\n    smartCSR: true,\n    term: constants.WIN32 ? 'windows-ansi' : 'xterm',\n    useBCE: true,\n  })\n\nconst lazyBlessedPath = () => path.join(constants.externalPath, 'blessed')\n\nconst lazyDistCliPath = () => path.join(constants.distPath, 'cli.js')\n\nconst lazyDistPath = () => path.join(constants.rootPath, 'dist')\n\nconst lazyExternalPath = () => path.join(constants.rootPath, 'external')\n\nconst lazyGithubCachePath = () => path.join(constants.socketCachePath, 'github')\n\nconst lazyHomePath = () => os.homedir()\n\nconst lazyInstrumentWithSentryPath = () =>\n  path.join(constants.distPath, 'instrument-with-sentry.js')\n\nconst lazyMinimumVersionByAgent = () =>\n  new Map([\n    // Bun >=1.1.39 supports the text-based lockfile.\n    // https://bun.sh/blog/bun-lock-text-lockfile\n    [BUN, '1.1.39'],\n    // The npm version bundled with Node 18.\n    // https://nodejs.org/en/about/previous-releases#looking-for-the-latest-release-of-a-version-branch\n    [NPM, '10.8.2'],\n    // 8.x is the earliest version to support Node 18.\n    // https://pnpm.io/installation#compatibility\n    // https://www.npmjs.com/package/pnpm?activeTab=versions\n    [PNPM, '8.15.7'],\n    // 4.x supports >= Node 18.12.0\n    // https://github.com/yarnpkg/berry/blob/%40yarnpkg/core/4.1.0/CHANGELOG.md#400\n    [YARN_BERRY, '4.0.0'],\n    // Latest 1.x.\n    // https://www.npmjs.com/package/yarn?activeTab=versions\n    [YARN_CLASSIC, '1.22.22'],\n    // vlt does not support overrides so we don't gate on it.\n    [VLT, '*'],\n  ])\n\nconst lazyNmBinPath = () => path.join(constants.rootPath, 'node_modules/.bin')\n\nconst lazyNodeDebugFlags = () =>\n  constants.ENV.SOCKET_CLI_DEBUG ? ['--trace-uncaught', '--trace-warnings'] : []\n\n// Redefine registryConstants.nodeHardenFlags to account for the\n// INLINED_SOCKET_CLI_SENTRY_BUILD environment variable.\nconst lazyNodeHardenFlags = () =>\n  Object.freeze(\n    // Harden Node security.\n    // https://nodejs.org/en/learn/getting-started/security-best-practices\n    constants.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD || constants.WIN32\n      ? [\n          // https://nodejs.org/api/cli.html#--disallow-code-generation-from-strings\n          // '--disallow-code-generation-from-strings'\n        ]\n      : [\n          // '--disallow-code-generation-from-strings',\n          // https://nodejs.org/api/cli.html#--disable-protomode\n          // '--disable-proto',\n          // 'throw',\n          // https://nodejs.org/api/cli.html#--frozen-intrinsics\n          // We have contributed the following patches to our dependencies to make\n          // Node's --frozen-intrinsics workable.\n          // √ https://github.com/SBoudrias/Inquirer.js/pull/1683\n          // √ https://github.com/pnpm/components/pull/23\n          // '--frozen-intrinsics',\n          // https://nodejs.org/api/cli.html#--no-deprecation\n          // '--no-deprecation',\n        ],\n  )\n\nconst lazyNodeMemoryFlags = () => {\n  const flags = /*@__PURE__*/ require(\n    path.join(constants.rootPath, 'dist/flags.js'),\n  )\n  const getMaxOldSpaceSizeFlag = flags.getMaxOldSpaceSizeFlag\n  const getMaxSemiSpaceSizeFlag = flags.getMaxSemiSpaceSizeFlag\n  return Object.freeze([\n    `--max-old-space-size=${getMaxOldSpaceSizeFlag()}`,\n    `--max-semi-space-size=${getMaxSemiSpaceSizeFlag()}`,\n  ])\n}\n\nconst lazyNpmCachePath = () => {\n  const spawnHelpers = /*@__PURE__*/ require('@socketsecurity/registry/lib/spawn')\n  const spawnSync = spawnHelpers.spawnSync\n  return spawnSync(\n    constants.npmExecPath,\n    ['config', 'get', 'cache'],\n    getNpmStdioPipeOptions(),\n  ).stdout\n}\n\nconst lazyNpmGlobalPrefix = () => {\n  const spawnHelpers = /*@__PURE__*/ require('@socketsecurity/registry/lib/spawn')\n  const spawnSync = spawnHelpers.spawnSync\n  return spawnSync(\n    constants.npmExecPath,\n    ['prefix', '-g'],\n    getNpmStdioPipeOptions(),\n  ).stdout\n}\n\nconst lazyNpmNmNodeGypPath = () =>\n  path.join(\n    constants.npmRealExecPath,\n    '../../node_modules/node-gyp/bin/node-gyp.js',\n  )\n\nconst lazyProcessEnv = () =>\n  Object.setPrototypeOf(\n    Object.fromEntries(\n      Object.entries(constants.ENV).reduce(\n        (entries, entry) => {\n          const { 0: key, 1: value } = entry\n          if (key.startsWith('INLINED_SOCKET_CLI_')) {\n            return entries\n          }\n          if (typeof value === 'string') {\n            if (value) {\n              entries.push(entry as [string, string])\n            }\n          } else if (typeof value === 'boolean' && value) {\n            entries.push([key, '1'])\n          }\n          return entries\n        },\n        [] as Array<[string, string]>,\n      ),\n    ),\n    null,\n  )\n\nconst lazyRootPath = () => path.join(realpathSync.native(__dirname), '..')\n\nconst lazyShadowBinPath = () => path.join(constants.rootPath, 'shadow-npm-bin')\n\nconst lazyShadowNpmBinPath = () =>\n  path.join(constants.distPath, 'shadow-npm-bin.js')\n\nconst lazyShadowNpmInjectPath = () =>\n  path.join(constants.distPath, 'shadow-npm-inject.js')\n\nconst lazySocketAppDataPath = (): string | undefined => {\n  // Get the OS app data directory:\n  // - Win: %LOCALAPPDATA% or fail?\n  // - Mac: %XDG_DATA_HOME% or fallback to \"~/Library/Application Support/\"\n  // - Linux: %XDG_DATA_HOME% or fallback to \"~/.local/share/\"\n  // Note: LOCALAPPDATA is typically: C:\\Users\\USERNAME\\AppData\n  // Note: XDG stands for \"X Desktop Group\", nowadays \"freedesktop.org\"\n  //       On most systems that path is: $HOME/.local/share\n  // Then append `socket/settings`, so:\n  // - Win: %LOCALAPPDATA%\\socket\\settings or return undefined\n  // - Mac: %XDG_DATA_HOME%/socket/settings or \"~/Library/Application Support/socket/settings\"\n  // - Linux: %XDG_DATA_HOME%/socket/settings or \"~/.local/share/socket/settings\"\n  const { WIN32 } = constants\n  let dataHome: string | undefined = WIN32\n    ? constants.ENV.LOCALAPPDATA\n    : constants.ENV.XDG_DATA_HOME\n  if (!dataHome) {\n    if (WIN32) {\n      const logger = /*@__PURE__*/ require('@socketsecurity/registry/lib/logger')\n      logger.warn(`Missing %${LOCALAPPDATA}%`)\n    } else {\n      dataHome = path.join(\n        constants.homePath,\n        constants.DARWIN ? 'Library/Application Support' : '.local/share',\n      )\n    }\n  }\n  return dataHome ? path.join(dataHome, 'socket/settings') : undefined\n}\n\nconst lazySocketCachePath = () => path.join(constants.rootPath, '.cache')\n\nconst lazySocketRegistryPath = () =>\n  path.join(constants.externalPath, '@socketsecurity/registry')\n\nconst lazyZshRcPath = () => path.join(constants.homePath, '.zshrc')\n\nconst constants: Constants = createConstantsObject(\n  {\n    ...registryConstantsAttribs.props,\n    ALERT_TYPE_CRITICAL_CVE,\n    ALERT_TYPE_CVE,\n    ALERT_TYPE_MEDIUM_CVE,\n    ALERT_TYPE_MILD_CVE,\n    API_V0_URL,\n    BINARY_LOCK_EXT,\n    BUN,\n    DOT_SOCKET_DOT_FACTS_JSON,\n    DRY_RUN_LABEL,\n    DRY_RUN_BAILING_NOW,\n    DRY_RUN_NOT_SAVING,\n    ENV: undefined,\n    LOCK_EXT,\n    NPM_BUGGY_OVERRIDES_PATCHED_VERSION,\n    NPM_REGISTRY_URL,\n    PNPM,\n    REDACTED,\n    SOCKET_CLI_ACCEPT_RISKS,\n    SOCKET_CLI_BIN_NAME,\n    SOCKET_CLI_FIX,\n    SOCKET_CLI_ISSUES_URL,\n    SOCKET_CLI_OPTIMIZE,\n    SOCKET_CLI_SHADOW_ACCEPT_RISKS,\n    SOCKET_CLI_SHADOW_API_TOKEN,\n    SOCKET_CLI_SHADOW_BIN,\n    SOCKET_CLI_SHADOW_PROGRESS,\n    SOCKET_CLI_SHADOW_SILENT,\n    SOCKET_CLI_VIEW_ALL_RISKS,\n    SOCKET_DEFAULT_BRANCH,\n    SOCKET_DEFAULT_REPOSITORY,\n    SOCKET_WEBSITE_URL,\n    VLT,\n    YARN,\n    YARN_BERRY,\n    YARN_CLASSIC,\n    YARN_LOCK,\n    bashRcPath: undefined,\n    binPath: undefined,\n    binCliPath: undefined,\n    blessedContribPath: undefined,\n    blessedOptions: undefined,\n    blessedPath: undefined,\n    coanaBinPath: undefined,\n    coanaPath: undefined,\n    distCliPath: undefined,\n    distPath: undefined,\n    externalPath: undefined,\n    githubCachePath: undefined,\n    homePath: undefined,\n    instrumentWithSentryPath: undefined,\n    minimumVersionByAgent: undefined,\n    nmBinPath: undefined,\n    nodeHardenFlags: undefined,\n    nodeDebugFlags: undefined,\n    nodeMemoryFlags: undefined,\n    npmCachePath: undefined,\n    npmGlobalPrefix: undefined,\n    npmNmNodeGypPath: undefined,\n    processEnv: undefined,\n    rootPath: undefined,\n    shadowBinPath: undefined,\n    shadowNpmInjectPath: undefined,\n    shadowNpmBinPath: undefined,\n    socketAppDataPath: undefined,\n    socketCachePath: undefined,\n    socketRegistryPath: undefined,\n    zshRcPath: undefined,\n  },\n  {\n    getters: {\n      ...registryConstantsAttribs.getters,\n      ENV: LAZY_ENV,\n      bashRcPath: lazyBashRcPath,\n      binCliPath: lazyBinCliPath,\n      binPath: lazyBinPath,\n      blessedContribPath: lazyBlessedContribPath,\n      blessedOptions: lazyBlessedOptions,\n      blessedPath: lazyBlessedPath,\n      distCliPath: lazyDistCliPath,\n      distPath: lazyDistPath,\n      externalPath: lazyExternalPath,\n      githubCachePath: lazyGithubCachePath,\n      homePath: lazyHomePath,\n      instrumentWithSentryPath: lazyInstrumentWithSentryPath,\n      minimumVersionByAgent: lazyMinimumVersionByAgent,\n      nmBinPath: lazyNmBinPath,\n      nodeDebugFlags: lazyNodeDebugFlags,\n      nodeHardenFlags: lazyNodeHardenFlags,\n      nodeMemoryFlags: lazyNodeMemoryFlags,\n      npmCachePath: lazyNpmCachePath,\n      npmGlobalPrefix: lazyNpmGlobalPrefix,\n      npmNmNodeGypPath: lazyNpmNmNodeGypPath,\n      processEnv: lazyProcessEnv,\n      rootPath: lazyRootPath,\n      shadowBinPath: lazyShadowBinPath,\n      shadowNpmBinPath: lazyShadowNpmBinPath,\n      shadowNpmInjectPath: lazyShadowNpmInjectPath,\n      socketAppDataPath: lazySocketAppDataPath,\n      socketCachePath: lazySocketCachePath,\n      socketRegistryPath: lazySocketRegistryPath,\n      zshRcPath: lazyZshRcPath,\n    },\n    internals: {\n      ...registryConstantsAttribs.internals,\n      getIpc,\n      getSentry() {\n        return _Sentry\n      },\n      setSentry(Sentry: Sentry): boolean {\n        if (_Sentry === undefined) {\n          _Sentry = Sentry\n          return true\n        }\n        return false\n      },\n    },\n  },\n) as Constants\n\nexport default constants\n"],"names":["attributes","getIpc","_npmStdioPipeOptions","cwd","env","__proto__","DISABLE_GITHUB_CACHE","GITHUB_BASE_REF","GITHUB_REF_NAME","GITHUB_REF_TYPE","GITHUB_REPOSITORY","LOCALAPPDATA","NODE_EXTRA_CA_CERTS","envAsString","PATH","SOCKET_CLI_ACCEPT_RISKS","SOCKET_CLI_API_BASE_URL","SOCKET_CLI_API_PROXY","SOCKET_CLI_API_TIMEOUT","SOCKET_CLI_API_TOKEN","SOCKET_CLI_CONFIG","SOCKET_CLI_GIT_USER_NAME","SOCKET_CLI_GITHUB_TOKEN","SOCKET_CLI_NO_API_TOKEN","SOCKET_CLI_NPM_PATH","SOCKET_CLI_ORG_SLUG","SOCKET_CLI_VIEW_ALL_RISKS","TERM","XDG_DATA_HOME","smartCSR","term","useBCE","constants","entries","WIN32","logger","dataHome","ENV","bashRcPath","binPath","binCliPath","blessedContribPath","blessedOptions","blessedPath","coanaBinPath","coanaPath","distCliPath","distPath","externalPath","githubCachePath","homePath","instrumentWithSentryPath","minimumVersionByAgent","nmBinPath","nodeHardenFlags","nodeDebugFlags","nodeMemoryFlags","npmCachePath","npmGlobalPrefix","npmNmNodeGypPath","processEnv","rootPath","shadowBinPath","shadowNpmInjectPath","shadowNpmBinPath","socketAppDataPath","socketCachePath","socketRegistryPath","zshRcPath","getters","internals","getSentry","_Sentry"],"mappings":";;;;;;;;;;AAYA;AACA;AACA;AACA;AACA;AACA;AAEA;;;AAGE;AACEA;;AAEAC;AACF;AACF;AA+JA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AAEA;AACA;;AAEIC;AACEC;;;AAGJ;AACA;AACF;AAEA;;AACUC;AAAI;AACZ;AACA;AAGA;AACA;AACA;AACA;AACA;;;AAKA;AACA;;AAEEC;AACA;;AAEA;AACA;AACAC;AACA;AACA;;AAGA;AACA;AACA;AACA;AACAC;AACA;AACA;AACA;AACA;AACAC;AACA;AACA;AACAC;AACA;AACA;AACAC;AACA;AACA;;AAGA;AACA;AACA;AACA;;AAEA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAEA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;AACA;AACAC;AACA;AACA;;AAIA;AACA;;AAOA;AACA;AACA;AACA;AACAC;AAEE;AACA;AACAC;AACF;AACA;AACA;AACAC;AACA;AACAC;AACA;AACA;AACAC;AAEE;AACAH;AAGF;AACA;AACAI;AAEE;AACAJ;AACA;AACA;AACAA;AAIF;AACA;AACAK;AACA;AACA;AACAC;AAEE;;AAIF;AACAC;AACA;;AAIA;AACAC;AAIA;AACA;;AAMA;AACA;AACA;AACA;AACAC;AAEE;AACAT;AAEF;AACAU;AACA;AACAC;AACA;AACAC;AAEE;AACAZ;AACF;AACAa;AACA;AACAC;AACA;AACA;AACAC;AACF;AACF;AAEA;AAEA;AAEA;AAEA;AAGA;AAEIC;AACAC;AACAC;AACF;AAEF;AAEA;AAEA;AAEA;AAEA;AAEA;AAEA;AAGA;AAEI;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGJ;AAEA;;AAGA;AACA;AACA;AAEI;AACA;AACAC;AAEM;AACA;AAAA;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAAA;AAIV;AACE;AAGA;AACA;AACA;AAIF;AAEA;AACE;AACA;AACA;AAKF;AAEA;AACE;AACA;AACA;AAKF;AAEA;AAMA;;AAKkB;AAAQ;AAAS;AACzB;AACE;AACF;AACA;AACE;AACEC;AACF;;;AAGF;AACA;AACF;AAOR;AAEA;AAEA;AAGA;AAGA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACQC;AAAM;AACd;;AAIE;AACE;AACAC;AACF;AACEC;AAIF;AACF;;AAEF;AAEA;AAEA;AAGA;AAEA;;;;;;;;;;;;;AAcIC;;;;;;;;;;;;;;;;;;;;;;;;;AAyBAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACF;AAEEC;;AAEEhC;AACAC;AACAE;AACAD;AACAE;AACAC;AACAC;AACAG;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAE;AACAD;AACAE;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAE;AACAD;AACAE;AACAC;AACAC;AACAC;;AAEFE;;;AAGEC;AACE;;;;AAIEC;AACA;AACF;AACA;AACF;AACF;AACF;;","debugId":"31999698-2c4b-47f0-b5a0-e4ad2d266451"}

package/dist/shadow-npm-bin.js

@@ -43,10 +43,10 @@ async function shadowBin(binName, args = process.argv.slice(2), options, extra)
     __proto__: null,
     ...options
   };
+  const cwd = require$$10.getOwn(spawnOpts, 'cwd') ?? process.cwd();
   const isShadowNpm = binName === 'npm';
   const terminatorPos = args.indexOf('--');
   const rawBinArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos);
-  const binArgs = rawBinArgs.filter(a => !npm.isNpmProgressFlag(a) && !npm.isNpmNodeOptionsFlag(a));
   const nodeOptionsArg = rawBinArgs.findLast(npm.isNpmNodeOptionsFlag);
   const progressArg = rawBinArgs.findLast(npm.isNpmProgressFlag) !== '--no-progress';
   const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos);
@@ -55,13 +55,19 @@ async function shadowBin(binName, args = process.argv.slice(2), options, extra)
   // '--allow-wasi',
   // Allow all reads because npm walks up directories looking for config
   // and package.json files.
-  '--allow-fs-read=*', `--allow-fs-write=${process.cwd()}/*`, `--allow-fs-write=${constants.npmGlobalPrefix}/*`, `--allow-fs-write=${constants.npmCachePath}/*`] : [];
+  '--allow-fs-read=*', `--allow-fs-write=${cwd}/*`, `--allow-fs-write=${constants.npmGlobalPrefix}/*`, `--allow-fs-write=${constants.npmCachePath}/*`] : [];
+  const useAudit = rawBinArgs.includes('--audit');
   const useDebug = require$$9.isDebug('stdio');
   const useNodeOptions = nodeOptionsArg || permArgs.length;
+  const binArgs = rawBinArgs.filter(a => !npm.isNpmAuditFlag(a) && !npm.isNpmProgressFlag(a));
   const isSilent = !useDebug && !binArgs.some(npm.isNpmLoglevelFlag);
   // The default value of loglevel is "notice". We default to "error" which is
   // two levels quieter.
   const logLevelArgs = isSilent ? ['--loglevel', 'error'] : [];
+  const noAuditArgs = useAudit || !(await utils.findUp('node_modules', {
+    cwd,
+    onlyDirectories: true
+  })) ? [] : ['--no-audit'];
   let stdio = require$$10.getOwn(spawnOpts, 'stdio');
   if (typeof stdio === 'string') {
     stdio = [stdio, stdio, stdio, 'ipc'];
@@ -73,7 +79,7 @@ async function shadowBin(binName, args = process.argv.slice(2), options, extra)
     stdio = ['pipe', 'pipe', 'pipe', 'ipc'];
   }
   const realBinPath = await installLinks(constants.shadowBinPath, binName);
-  const spawnPromise = spawn.spawn(constants.execPath, [...constants.nodeNoWarningsFlags, ...constants.nodeDebugFlags, ...constants.nodeHardenFlags, ...constants.nodeMemoryFlags, ...(constants.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD ? ['--require', constants.instrumentWithSentryPath] : []), '--require', constants.shadowNpmInjectPath, realBinPath, ...(useNodeOptions ? [`--node-options='${nodeOptionsArg ? nodeOptionsArg.slice(15) : ''}${utils.cmdFlagsToString(permArgs)}'`] : []),
+  const spawnPromise = spawn.spawn(constants.execPath, [...constants.nodeNoWarningsFlags, ...constants.nodeDebugFlags, ...constants.nodeHardenFlags, ...constants.nodeMemoryFlags, ...(constants.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD ? ['--require', constants.instrumentWithSentryPath] : []), '--require', constants.shadowNpmInjectPath, realBinPath, ...noAuditArgs, ...(useNodeOptions ? [`--node-options='${nodeOptionsArg ? nodeOptionsArg.slice(15) : ''}${utils.cmdFlagsToString(permArgs)}'`] : []), '--no-fund',
   // Add '--no-progress' to fix input being swallowed by the npm spinner.
   '--no-progress',
   // Add '--loglevel=error' if a loglevel flag is not provided and the
@@ -101,5 +107,5 @@ async function shadowBin(binName, args = process.argv.slice(2), options, extra)
 }
 
 module.exports = shadowBin;
-//# debugId=1e1c698d-984e-4263-9b61-fbc7a35a257e
+//# debugId=fe0a3202-8243-4366-9da8-ec21d25cb3a7
 //# sourceMappingURL=shadow-npm-bin.js.map

package/dist/shadow-npm-bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"shadow-npm-bin.js","sources":["../src/shadow/npm/link.mts","../src/shadow/npm/bin.mts"],"sourcesContent":["import path from 'node:path'\n\nimport cmdShim from 'cmd-shim'\n\nimport constants from '../../constants.mts'\nimport {\n  getNpmBinPath,\n  getNpxBinPath,\n  isNpmBinPathShadowed,\n  isNpxBinPathShadowed,\n} from '../../utils/npm-paths.mts'\n\nexport async function installLinks(\n  shadowBinPath: string,\n  binName: 'npm' | 'npx',\n): Promise<string> {\n  const isNpx = binName === 'npx'\n  // Find package manager being shadowed by this process.\n  const binPath = isNpx ? getNpxBinPath() : getNpmBinPath()\n  const { WIN32 } = constants\n  // TODO: Is this early exit needed?\n  if (WIN32 && binPath) {\n    return binPath\n  }\n  const shadowed = isNpx ? isNpxBinPathShadowed() : isNpmBinPathShadowed()\n  // Move our bin directory to front of PATH so its found first.\n  if (!shadowed) {\n    if (WIN32) {\n      await cmdShim(\n        path.join(constants.distPath, `${binName}-cli.js`),\n        path.join(shadowBinPath, binName),\n      )\n    }\n    const { env } = process\n    env['PATH'] = `${shadowBinPath}${path.delimiter}${env['PATH']}`\n  }\n  return binPath\n}\n","import { isDebug } from '@socketsecurity/registry/lib/debug'\nimport {\n  isNpmLoglevelFlag,\n  isNpmNodeOptionsFlag,\n  isNpmProgressFlag,\n} from '@socketsecurity/registry/lib/npm'\nimport { getOwn } from '@socketsecurity/registry/lib/objects'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport { installLinks } from './link.mts'\nimport constants from '../../constants.mts'\nimport { cmdFlagsToString } from '../../utils/cmd.mts'\nimport { getPublicApiToken } from '../../utils/sdk.mts'\n\nimport type { IPC } from '../../constants.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowBinOptions = SpawnOptions & {\n  ipc?: IPC | undefined\n}\n\nexport type ShadowBinResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nexport default async function shadowBin(\n  binName: 'npm' | 'npx',\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowBinOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowBinResult> {\n  const {\n    env: spawnEnv,\n    ipc,\n    ...spawnOpts\n  } = { __proto__: null, ...options } as ShadowBinOptions\n  const isShadowNpm = binName === 'npm'\n  const terminatorPos = args.indexOf('--')\n  const rawBinArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n  const binArgs = rawBinArgs.filter(\n    a => !isNpmProgressFlag(a) && !isNpmNodeOptionsFlag(a),\n  )\n  const nodeOptionsArg = rawBinArgs.findLast(isNpmNodeOptionsFlag)\n  const progressArg = rawBinArgs.findLast(isNpmProgressFlag) !== '--no-progress'\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n  const permArgs =\n    isShadowNpm && constants.SUPPORTS_NODE_PERMISSION_FLAG\n      ? [\n          '--permission',\n          '--allow-child-process',\n          // '--allow-addons',\n          // '--allow-wasi',\n          // Allow all reads because npm walks up directories looking for config\n          // and package.json files.\n          '--allow-fs-read=*',\n          `--allow-fs-write=${process.cwd()}/*`,\n          `--allow-fs-write=${constants.npmGlobalPrefix}/*`,\n          `--allow-fs-write=${constants.npmCachePath}/*`,\n        ]\n      : []\n  const useDebug = isDebug('stdio')\n  const useNodeOptions = nodeOptionsArg || permArgs.length\n  const isSilent = !useDebug && !binArgs.some(isNpmLoglevelFlag)\n  // The default value of loglevel is \"notice\". We default to \"error\" which is\n  // two levels quieter.\n  const logLevelArgs = isSilent ? ['--loglevel', 'error'] : []\n\n  let stdio = getOwn(spawnOpts, 'stdio')\n  if (typeof stdio === 'string') {\n    stdio = [stdio, stdio, stdio, 'ipc']\n  } else if (Array.isArray(stdio)) {\n    if (!stdio.includes('ipc')) {\n      stdio = stdio.concat('ipc')\n    }\n  } else {\n    stdio = ['pipe', 'pipe', 'pipe', 'ipc']\n  }\n\n  const realBinPath = await installLinks(constants.shadowBinPath, binName)\n\n  const spawnPromise = spawn(\n    constants.execPath,\n    [\n      ...constants.nodeNoWarningsFlags,\n      ...constants.nodeDebugFlags,\n      ...constants.nodeHardenFlags,\n      ...constants.nodeMemoryFlags,\n      ...(constants.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD\n        ? ['--require', constants.instrumentWithSentryPath]\n        : []),\n      '--require',\n      constants.shadowNpmInjectPath,\n      realBinPath,\n      ...(useNodeOptions\n        ? [\n            `--node-options='${nodeOptionsArg ? nodeOptionsArg.slice(15) : ''}${cmdFlagsToString(permArgs)}'`,\n          ]\n        : []),\n      // Add '--no-progress' to fix input being swallowed by the npm spinner.\n      '--no-progress',\n      // Add '--loglevel=error' if a loglevel flag is not provided and the\n      // SOCKET_CLI_DEBUG environment variable is not truthy.\n      ...logLevelArgs,\n      ...binArgs,\n      ...otherArgs,\n    ],\n    {\n      ...spawnOpts,\n      env: {\n        ...process.env,\n        ...constants.processEnv,\n        ...spawnEnv,\n      },\n      stdio,\n    },\n    extra,\n  )\n\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: binName,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: progressArg,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n"],"names":["WIN32","env","__proto__","stdio","spawnPromise"],"mappings":";;;;;;;;;;;AAYO;AAIL;AACA;;;AAEQA;AAAM;AACd;;AAEE;AACF;;AAEA;;AAEE;;AAKA;;AACQC;AAAI;AACZA;AACF;AACA;AACF;;ACRe;;AAOXA;;;AAGF;AAAMC;;;AACN;AACA;AACA;AACA;AAGA;;AAEA;;AAMQ;AACA;AACA;AACA;;AAOR;AACA;;AAEA;AACA;;AAGA;AACA;;;AAGE;AACEC;AACF;AACF;;AAEA;;AAIA;AAkBI;;AAEA;AACA;;AAMA;AACAF;;;;;AAKAE;;AAKJC;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;","debugId":"1e1c698d-984e-4263-9b61-fbc7a35a257e"}
+{"version":3,"file":"shadow-npm-bin.js","sources":["../src/shadow/npm/link.mts","../src/shadow/npm/bin.mts"],"sourcesContent":["import path from 'node:path'\n\nimport cmdShim from 'cmd-shim'\n\nimport constants from '../../constants.mts'\nimport {\n  getNpmBinPath,\n  getNpxBinPath,\n  isNpmBinPathShadowed,\n  isNpxBinPathShadowed,\n} from '../../utils/npm-paths.mts'\n\nexport async function installLinks(\n  shadowBinPath: string,\n  binName: 'npm' | 'npx',\n): Promise<string> {\n  const isNpx = binName === 'npx'\n  // Find package manager being shadowed by this process.\n  const binPath = isNpx ? getNpxBinPath() : getNpmBinPath()\n  const { WIN32 } = constants\n  // TODO: Is this early exit needed?\n  if (WIN32 && binPath) {\n    return binPath\n  }\n  const shadowed = isNpx ? isNpxBinPathShadowed() : isNpmBinPathShadowed()\n  // Move our bin directory to front of PATH so its found first.\n  if (!shadowed) {\n    if (WIN32) {\n      await cmdShim(\n        path.join(constants.distPath, `${binName}-cli.js`),\n        path.join(shadowBinPath, binName),\n      )\n    }\n    const { env } = process\n    env['PATH'] = `${shadowBinPath}${path.delimiter}${env['PATH']}`\n  }\n  return binPath\n}\n","import { isDebug } from '@socketsecurity/registry/lib/debug'\nimport {\n  isNpmAuditFlag,\n  isNpmLoglevelFlag,\n  isNpmNodeOptionsFlag,\n  isNpmProgressFlag,\n} from '@socketsecurity/registry/lib/npm'\nimport { getOwn } from '@socketsecurity/registry/lib/objects'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport { installLinks } from './link.mts'\nimport constants from '../../constants.mts'\nimport { cmdFlagsToString } from '../../utils/cmd.mts'\nimport { findUp } from '../../utils/fs.mts'\nimport { getPublicApiToken } from '../../utils/sdk.mts'\n\nimport type { IPC } from '../../constants.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowBinOptions = SpawnOptions & {\n  ipc?: IPC | undefined\n}\n\nexport type ShadowBinResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nexport default async function shadowBin(\n  binName: 'npm' | 'npx',\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowBinOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowBinResult> {\n  const {\n    env: spawnEnv,\n    ipc,\n    ...spawnOpts\n  } = { __proto__: null, ...options } as ShadowBinOptions\n  const cwd = getOwn(spawnOpts, 'cwd') ?? process.cwd()\n  const isShadowNpm = binName === 'npm'\n  const terminatorPos = args.indexOf('--')\n  const rawBinArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n  const nodeOptionsArg = rawBinArgs.findLast(isNpmNodeOptionsFlag)\n  const progressArg = rawBinArgs.findLast(isNpmProgressFlag) !== '--no-progress'\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n  const permArgs =\n    isShadowNpm && constants.SUPPORTS_NODE_PERMISSION_FLAG\n      ? [\n          '--permission',\n          '--allow-child-process',\n          // '--allow-addons',\n          // '--allow-wasi',\n          // Allow all reads because npm walks up directories looking for config\n          // and package.json files.\n          '--allow-fs-read=*',\n          `--allow-fs-write=${cwd}/*`,\n          `--allow-fs-write=${constants.npmGlobalPrefix}/*`,\n          `--allow-fs-write=${constants.npmCachePath}/*`,\n        ]\n      : []\n\n  const useAudit = rawBinArgs.includes('--audit')\n  const useDebug = isDebug('stdio')\n  const useNodeOptions = nodeOptionsArg || permArgs.length\n  const binArgs = rawBinArgs.filter(\n    a => !isNpmAuditFlag(a) && !isNpmProgressFlag(a),\n  )\n  const isSilent = !useDebug && !binArgs.some(isNpmLoglevelFlag)\n  // The default value of loglevel is \"notice\". We default to \"error\" which is\n  // two levels quieter.\n  const logLevelArgs = isSilent ? ['--loglevel', 'error'] : []\n  const noAuditArgs =\n    useAudit || !(await findUp('node_modules', { cwd, onlyDirectories: true }))\n      ? []\n      : ['--no-audit']\n\n  let stdio = getOwn(spawnOpts, 'stdio')\n  if (typeof stdio === 'string') {\n    stdio = [stdio, stdio, stdio, 'ipc']\n  } else if (Array.isArray(stdio)) {\n    if (!stdio.includes('ipc')) {\n      stdio = stdio.concat('ipc')\n    }\n  } else {\n    stdio = ['pipe', 'pipe', 'pipe', 'ipc']\n  }\n\n  const realBinPath = await installLinks(constants.shadowBinPath, binName)\n\n  const spawnPromise = spawn(\n    constants.execPath,\n    [\n      ...constants.nodeNoWarningsFlags,\n      ...constants.nodeDebugFlags,\n      ...constants.nodeHardenFlags,\n      ...constants.nodeMemoryFlags,\n      ...(constants.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD\n        ? ['--require', constants.instrumentWithSentryPath]\n        : []),\n      '--require',\n      constants.shadowNpmInjectPath,\n      realBinPath,\n      ...noAuditArgs,\n      ...(useNodeOptions\n        ? [\n            `--node-options='${nodeOptionsArg ? nodeOptionsArg.slice(15) : ''}${cmdFlagsToString(permArgs)}'`,\n          ]\n        : []),\n      '--no-fund',\n      // Add '--no-progress' to fix input being swallowed by the npm spinner.\n      '--no-progress',\n      // Add '--loglevel=error' if a loglevel flag is not provided and the\n      // SOCKET_CLI_DEBUG environment variable is not truthy.\n      ...logLevelArgs,\n      ...binArgs,\n      ...otherArgs,\n    ],\n    {\n      ...spawnOpts,\n      env: {\n        ...process.env,\n        ...constants.processEnv,\n        ...spawnEnv,\n      },\n      stdio,\n    },\n    extra,\n  )\n\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: binName,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: progressArg,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n"],"names":["WIN32","env","__proto__","onlyDirectories","stdio","spawnPromise"],"mappings":";;;;;;;;;;;AAYO;AAIL;AACA;;;AAEQA;AAAM;AACd;;AAEE;AACF;;AAEA;;AAEE;;AAKA;;AACQC;AAAI;AACZA;AACF;AACA;AACF;;ACNe;;AAOXA;;;AAGF;AAAMC;;;AACN;AACA;AACA;AACA;AACA;;AAEA;;AAMQ;AACA;AACA;AACA;AACA;AAOR;AACA;AACA;AACA;;AAIA;AACA;;;;AAGoDC;AAAsB;AAI1E;AACA;;;AAGE;AACEC;AACF;AACF;;AAEA;;AAIA;AAoBI;;AAEA;AACA;;AAMA;AACAH;;;;;AAKAG;;AAKJC;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;","debugId":"fe0a3202-8243-4366-9da8-ec21d25cb3a7"}

package/dist/shadow-npm-inject.js

@@ -8,7 +8,6 @@ var constants = require('./constants.js');
 var utils = require('./utils.js');
 var require$$9 = require('../external/@socketsecurity/registry/lib/debug');
 var logger = require('../external/@socketsecurity/registry/lib/logger');
-var registry = require('../external/@socketsecurity/registry');
 var require$$10 = require('../external/@socketsecurity/registry/lib/objects');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -66,108 +65,7 @@ function getUrlOrigin(input) {
   } catch {}
   return '';
 }
-function findBestPatchVersion(node, availableVersions, options) {
-  const {
-    minSatisfying = false,
-    vulnerableVersionRange
-  } = {
-    __proto__: null,
-    ...options
-  };
-  const manifestData = registry.getManifestData('npm', node.name);
-  let eligibleVersions;
-  if (manifestData && manifestData.name === manifestData.package) {
-    const major = utils.getMajor(manifestData.version);
-    if (typeof major !== 'number') {
-      return null;
-    }
-    eligibleVersions = availableVersions.filter(v => utils.getMajor(v) === major);
-  } else {
-    const major = utils.getMajor(node.version);
-    if (typeof major !== 'number') {
-      return null;
-    }
-    eligibleVersions = availableVersions.filter(v =>
-    // Filter for versions that are within the current major version and
-    // are NOT in the vulnerable range.
-    utils.getMajor(v) === major && (!vulnerableVersionRange || !vendor.semverExports.satisfies(v, vulnerableVersionRange)));
-  }
-  if (eligibleVersions) {
-    const satisfying = minSatisfying ? vendor.semverExports.minSatisfying : vendor.semverExports.maxSatisfying;
-    return satisfying(eligibleVersions, '*');
-  }
-  return null;
-}
-function findPackageNode(tree, name, version) {
-  const queue = [tree];
-  const visited = new Set();
-  let sentinel = 0;
-  while (queue.length) {
-    if (sentinel++ === constants.LOOP_SENTINEL) {
-      throw new Error('Detected infinite loop in findPackageNode');
-    }
-    const nodeOrLink = queue.pop();
-    const node = getTargetNode(nodeOrLink);
-    if (visited.has(node)) {
-      continue;
-    }
-    visited.add(node);
-    if (node.name === name && (typeof version !== 'string' || node.version === version)) {
-      return node;
-    }
-    for (const child of node.children.values()) {
-      queue.push(child);
-    }
-    for (const edge of node.edgesOut.values()) {
-      const {
-        to
-      } = edge;
-      if (to) {
-        queue.push(to);
-      }
-    }
-  }
-  return undefined;
-}
-function findPackageNodes(tree, name, version) {
-  const matches = [];
-  const queue = [tree];
-  const visited = new Set();
-  let sentinel = 0;
-  while (queue.length) {
-    if (sentinel++ === constants.LOOP_SENTINEL) {
-      throw new Error('Detected infinite loop in findPackageNodes');
-    }
-    const nodeOrLink = queue.pop();
-    const node = getTargetNode(nodeOrLink);
-    if (visited.has(node)) {
-      continue;
-    }
-    visited.add(node);
-    const {
-      version: targetVersion
-    } = node;
-    if (!targetVersion && Array.isArray(node.errors) && node.errors.length) {
-      require$$9.debugFn('notice', `miss: version for ${node.name} due to errors:\n`, node.errors);
-    }
-    if (node.name === name && ("undefined" !== 'string')) {
-      matches.push(node);
-    }
-    for (const child of node.children.values()) {
-      queue.push(child);
-    }
-    for (const edge of node.edgesOut.values()) {
-      const {
-        to
-      } = edge;
-      if (to) {
-        queue.push(to);
-      }
-    }
-  }
-  return matches;
-}
-async function getAlertsMapFromArborist(arb, options) {
+async function getAlertsMapFromArborist(arb, needInfoOn, options) {
   const opts = {
     __proto__: null,
     consolidate: false,
@@ -175,11 +73,6 @@ async function getAlertsMapFromArborist(arb, options) {
     ...options,
     filter: utils.toFilterConfig(require$$10.getOwn(options, 'filter'))
   };
-  const needInfoOn = getDetailsFromDiff(arb.diff, {
-    filter: {
-      existing: opts.filter.existing
-    }
-  });
   const purls = needInfoOn.map(d => utils.idToNpmPurl(d.node.pkgid));
   let overrides;
   const overridesMap = (arb.actualTree ?? arb.idealTree ?? (await arb.loadActual()))?.overrides?.children;
@@ -273,112 +166,6 @@ function getDetailsFromDiff(diff, options) {
   }
   return details;
 }
-function getTargetNode(nodeOrLink) {
-  return nodeOrLink?.isLink ? nodeOrLink.target : nodeOrLink ?? null;
-}
-function isTopLevel(tree, node) {
-  return getTargetNode(tree.children.get(node.name)) === node;
-}
-function updateNode(node, newVersion, newVersionPackument) {
-  // Object.defineProperty is needed to set the version property and replace
-  // the old value with newVersion.
-  Object.defineProperty(node, 'version', {
-    configurable: true,
-    enumerable: true,
-    get: () => newVersion
-  });
-  // Update package.version associated with the node.
-  node.package.version = newVersion;
-  // Update node.resolved.
-  const purlObj = vendor.packageurlJsExports.PackageURL.fromString(utils.idToNpmPurl(node.name));
-  node.resolved = `${constants.NPM_REGISTRY_URL}/${node.name}/-/${purlObj.name}-${newVersion}.tgz`;
-  // Update node.integrity with the targetPackument.dist.integrity value if available
-  // else delete node.integrity so a new value is resolved for the target version.
-  const {
-    integrity
-  } = newVersionPackument.dist;
-  if (integrity) {
-    node.integrity = integrity;
-  } else {
-    delete node.integrity;
-  }
-  // Update node.package.deprecated based on targetPackument.deprecated.
-  if (require$$10.hasOwn(newVersionPackument, 'deprecated')) {
-    node.package['deprecated'] = newVersionPackument.deprecated;
-  } else {
-    delete node.package['deprecated'];
-  }
-  // Update node.package.dependencies.
-  const newDeps = {
-    ...newVersionPackument.dependencies
-  };
-  const {
-    dependencies: oldDeps
-  } = node.package;
-  node.package.dependencies = newDeps;
-  if (oldDeps) {
-    for (const oldDepName of Object.keys(oldDeps)) {
-      if (!require$$10.hasOwn(newDeps, oldDepName)) {
-        // Detach old edges for dependencies that don't exist on the updated
-        // node.package.dependencies.
-        node.edgesOut.get(oldDepName)?.detach();
-      }
-    }
-  }
-  for (const newDepName of Object.keys(newDeps)) {
-    if (!require$$10.hasOwn(oldDeps, newDepName)) {
-      // Add new edges for dependencies that don't exist on the old
-      // node.package.dependencies.
-      node.addEdgeOut(new Edge({
-        from: node,
-        name: newDepName,
-        spec: newDeps[newDepName],
-        type: 'prod'
-      }));
-    }
-  }
-}
-function updatePackageJsonFromNode(editablePkgJson, tree, node, newVersion, rangeStyle) {
-  let result = false;
-  if (!isTopLevel(tree, node)) {
-    return result;
-  }
-  const {
-    name
-  } = node;
-  for (const depField of ['dependencies', 'optionalDependencies', 'peerDependencies']) {
-    const depObject = editablePkgJson.content[depField];
-    const depValue = require$$10.hasOwn(depObject, name) ? depObject[name] : undefined;
-    if (typeof depValue !== 'string' || depValue.startsWith('catalog:')) {
-      continue;
-    }
-    let oldRange = depValue;
-    // Use npa if depValue looks like more than just a semver range.
-    if (depValue.includes(':')) {
-      const npaResult = utils.npa(depValue);
-      if (!npaResult || npaResult.subSpec) {
-        continue;
-      }
-      oldRange = npaResult.rawSpec;
-    }
-    const oldMin = utils.getMinVersion(oldRange);
-    const newRange = oldMin &&
-    // Ensure we're on the same major version...
-    utils.getMajor(newVersion) === oldMin.major &&
-    // and not a downgrade.
-    vendor.semverExports.gte(newVersion, oldMin.version) ? utils.applyRange(oldRange, newVersion, rangeStyle) : oldRange;
-    if (oldRange !== newRange) {
-      result = true;
-      editablePkgJson.update({
-        [depField]: {
-          ...depObject,
-          [name]: newRange
-        }
-      });
-    }
-  }
-  return result;
-}
 
 // @ts-ignore
 const {
@@ -398,13 +185,6 @@ const SAFE_NO_SAVE_ARBORIST_REIFY_OPTIONS_OVERRIDES = {
   saveBundle: false,
   silent: true
 };
-const SAFE_WITH_SAVE_ARBORIST_REIFY_OPTIONS_OVERRIDES = {
-  // @ts-ignore
-  __proto__: null,
-  ...SAFE_NO_SAVE_ARBORIST_REIFY_OPTIONS_OVERRIDES,
-  dryRun: false,
-  save: true
-};
 const kCtorArgs = Symbol('ctorArgs');
 const kRiskyReify = Symbol('riskyReify');
 const Arborist = vendor.arboristExports;
@@ -455,23 +235,34 @@ class SafeArborist extends Arborist {
     },
     // @ts-ignore: TypeScript gets grumpy about rest parameters.
     ...args.slice(1));
-    const shadowAcceptRisks = ipc[constants.SOCKET_CLI_SHADOW_ACCEPT_RISKS];
-    const shadowProgress = ipc[constants.SOCKET_CLI_SHADOW_PROGRESS];
-    const shadowSilent = ipc[constants.SOCKET_CLI_SHADOW_SILENT];
+    const shadowAcceptRisks = !!ipc[constants.SOCKET_CLI_SHADOW_ACCEPT_RISKS];
+    const shadowProgress = !!ipc[constants.SOCKET_CLI_SHADOW_PROGRESS];
+    const shadowSilent = !!ipc[constants.SOCKET_CLI_SHADOW_SILENT];
     const acceptRisks = shadowAcceptRisks || constants.ENV.SOCKET_CLI_ACCEPT_RISKS;
+    const reportOnlyBlocking = acceptRisks || options.dryRun || options['yes'];
     const silent = !!options['silent'];
     const spinner = silent || !shadowProgress ? undefined : constants.spinner;
     const isShadowNpx = binName === 'npx';
-    const alertsMap = await getAlertsMapFromArborist(this, {
+    const hasExisting = await utils.findUp('node_modules', {
+      cwd: process.cwd(),
+      onlyDirectories: true
+    });
+    const shouldCheckExisting = reportOnlyBlocking ? true : isShadowNpx;
+    const needInfoOn = getDetailsFromDiff(this.diff, {
+      filter: {
+        existing: shouldCheckExisting
+      }
+    });
+    const alertsMap = await getAlertsMapFromArborist(this, needInfoOn, {
       apiToken: ipc[constants.SOCKET_CLI_SHADOW_API_TOKEN],
       spinner,
-      filter: acceptRisks || options.dryRun || options['yes'] ? {
+      filter: reportOnlyBlocking ? {
         actions: ['error'],
         blocked: true,
-        existing: true
+        existing: shouldCheckExisting
       } : {
         actions: ['error', 'monitor', 'warn'],
-        existing: isShadowNpx
+        existing: shouldCheckExisting
       }
     });
     if (alertsMap.size) {
@@ -485,7 +276,7 @@ class SafeArborist extends Arborist {
           Socket ${binName} exiting due to risks.${viewAllRisks ? '' : `\nView all risks - Rerun with environment variable ${constants.SOCKET_CLI_VIEW_ALL_RISKS}=1.`}${acceptRisks ? '' : `\nAccept risks - Rerun with environment variable ${constants.SOCKET_CLI_ACCEPT_RISKS}=1.`}
         `.trim());
     } else if (!silent && !shadowSilent) {
-      logger.logger.success(`Socket ${binName} ${acceptRisks ? 'accepted' : 'found no'} risks`);
+      logger.logger.success(`Socket ${binName} ${acceptRisks ? 'accepted' : 'found no'}${hasExisting ? ' new' : ''} risks`);
       if (isShadowNpx) {
         logger.logger.log(`Running ${options.add[0]}`);
       }
@@ -517,15 +308,5 @@ function installSafeArborist() {
 }
 
 installSafeArborist();
-
-exports.Arborist = Arborist;
-exports.SAFE_NO_SAVE_ARBORIST_REIFY_OPTIONS_OVERRIDES = SAFE_NO_SAVE_ARBORIST_REIFY_OPTIONS_OVERRIDES;
-exports.SAFE_WITH_SAVE_ARBORIST_REIFY_OPTIONS_OVERRIDES = SAFE_WITH_SAVE_ARBORIST_REIFY_OPTIONS_OVERRIDES;
-exports.findBestPatchVersion = findBestPatchVersion;
-exports.findPackageNode = findPackageNode;
-exports.findPackageNodes = findPackageNodes;
-exports.getAlertsMapFromArborist = getAlertsMapFromArborist;
-exports.updateNode = updateNode;
-exports.updatePackageJsonFromNode = updatePackageJsonFromNode;
-//# debugId=ef09cd0e-acf2-43e3-8f8e-3dff17a3741b
+//# debugId=44a0aaa3-4b99-476e-824c-10525f74b23d
 //# sourceMappingURL=shadow-npm-inject.js.map