@socketsecurity/cli-with-sentry 1.1.146 → 1.1.151

package/dist/utils.js

@@ -3,8 +3,8 @@
 var vendor = require('./vendor.js');
 var logger = require('../external/@socketsecurity/registry/lib/logger');
 var strings = require('../external/@socketsecurity/registry/lib/strings');
-var require$$9 = require('../external/@socketsecurity/registry/lib/debug');
-var require$$11 = require('../external/@socketsecurity/registry/lib/objects');
+var debug$2 = require('../external/@socketsecurity/registry/lib/debug');
+var objects = require('../external/@socketsecurity/registry/lib/objects');
 var constants = require('./constants.js');
 var arrays = require('../external/@socketsecurity/registry/lib/arrays');
 var path$1 = require('../external/@socketsecurity/registry/lib/path');
@@ -18,23 +18,23 @@ var prompts = require('../external/@socketsecurity/registry/lib/prompts');
 var spawn = require('../external/@socketsecurity/registry/lib/spawn');
 var fs = require('node:fs');
 var fs$2 = require('node:fs/promises');
-var promises$1 = require('node:stream/promises');
-var node_zlib = require('node:zlib');
+var require$$9 = require('node:stream/promises');
+var require$$11 = require('node:zlib');
 var fs$1 = require('../external/@socketsecurity/registry/lib/fs');
-var require$$5 = require('node:module');
+var require$$1 = require('node:module');
 var os = require('node:os');
-var require$$3 = require('node:https');
+var require$$13 = require('node:https');
 var web = require('node:stream/web');
-var require$$13 = require('../external/@socketsecurity/registry/lib/url');
+var url = require('../external/@socketsecurity/registry/lib/url');
 var agent = require('../external/@socketsecurity/registry/lib/agent');
 var bin = require('../external/@socketsecurity/registry/lib/bin');
 var packages = require('../external/@socketsecurity/registry/lib/packages');
 var require$$0$1 = require('node:url');
 var globs = require('../external/@socketsecurity/registry/lib/globs');
 var streams = require('../external/@socketsecurity/registry/lib/streams');
-var promises = require('node:timers/promises');
-var require$$1 = require('node:util');
-var require$$2 = require('node:http');
+var require$$7 = require('node:timers/promises');
+var require$$10 = require('node:util');
+var require$$12 = require('node:http');
 var node_tls = require('node:tls');
 var process$1 = require('node:process');
 var require$$0 = require('node:crypto');
@@ -99,13 +99,13 @@ function debugApiResponse(method, endpoint, status, error, duration, headers) {
  */
 function debugFileOp(operation, filepath, error) {
   if (error) {
-    require$$9.debugDir('warn', {
+    debug$2.debugDir('warn', {
       operation,
       filepath,
       error: error instanceof Error ? error.message : 'Unknown error'
     });
-  } else if (require$$9.isDebug('silly')) {
-    require$$9.debugFn('silly', `File ${operation}: ${filepath}`);
+  } else if (debug$2.isDebug('silly')) {
+    debug$2.debugFn('silly', `File ${operation}: ${filepath}`);
   }
 }
 
@@ -117,19 +117,19 @@ function debugScan(phase, packageCount, details) {
   switch (phase) {
     case 'start':
       if (packageCount) {
-        require$$9.debugFn('notice', `Scanning ${packageCount} packages`);
+        debug$2.debugFn('notice', `Scanning ${packageCount} packages`);
       }
       break;
     case 'progress':
-      if (require$$9.isDebug('silly') && packageCount) {
-        require$$9.debugFn('silly', `Scan progress: ${packageCount} packages processed`);
+      if (debug$2.isDebug('silly') && packageCount) {
+        debug$2.debugFn('silly', `Scan progress: ${packageCount} packages processed`);
       }
       break;
     case 'complete':
-      require$$9.debugFn('notice', `Scan complete${packageCount ? `: ${packageCount} packages` : ''}`);
+      debug$2.debugFn('notice', `Scan complete${packageCount ? `: ${packageCount} packages` : ''}`);
       break;
     case 'error':
-      require$$9.debugDir('error', {
+      debug$2.debugDir('error', {
         phase: 'scan_error',
         details
       });
@@ -142,14 +142,14 @@ function debugScan(phase, packageCount, details) {
  */
 function debugConfig(source, found, error) {
   if (error) {
-    require$$9.debugDir('warn', {
+    debug$2.debugDir('warn', {
       source,
       error: error instanceof Error ? error.message : 'Unknown error'
     });
   } else if (found) {
-    require$$9.debugFn('notice', `Config loaded: ${source}`);
-  } else if (require$$9.isDebug('silly')) {
-    require$$9.debugFn('silly', `Config not found: ${source}`);
+    debug$2.debugFn('notice', `Config loaded: ${source}`);
+  } else if (debug$2.isDebug('silly')) {
+    debug$2.debugFn('silly', `Config not found: ${source}`);
   }
 }
 
@@ -159,15 +159,15 @@ function debugConfig(source, found, error) {
  */
 function debugGit(operation, success, details) {
   if (!success) {
-    require$$9.debugDir('warn', {
+    debug$2.debugDir('warn', {
       git_op: operation,
       ...details
     });
-  } else if (require$$9.isDebug('notice') && operation.includes('push') || operation.includes('commit')) {
+  } else if (debug$2.isDebug('notice') && operation.includes('push') || operation.includes('commit')) {
     // Only log important operations like push and commit.
-    require$$9.debugFn('notice', `Git ${operation} succeeded`);
-  } else if (require$$9.isDebug('silly')) {
-    require$$9.debugFn('silly', `Git ${operation}`);
+    debug$2.debugFn('notice', `Git ${operation} succeeded`);
+  } else if (debug$2.isDebug('silly')) {
+    debug$2.debugFn('silly', `Git ${operation}`);
   }
 }
 
@@ -281,7 +281,7 @@ function shouldSave(currentContent, originalContent, originalFileContent, option
   const sortedContent = sort ? sortKeys(content) : content;
   const origContent = originalContent ? stripFormattingSymbols(originalContent) : {};
   if (ignoreWhitespace) {
-    return !require$$1.isDeepStrictEqual(sortedContent, origContent);
+    return !require$$10.isDeepStrictEqual(sortedContent, origContent);
   }
   const formatting = getFormattingFromContent(currentContent);
   const newFileContent = stringifyWithFormatting(sortedContent, formatting);
@@ -298,7 +298,7 @@ async function retryWrite(filepath, content, retries = 3, baseDelay = 10) {
       await fs.promises.writeFile(filepath, content);
       if (process.platform === 'win32') {
         // eslint-disable-next-line no-await-in-loop
-        await promises.setTimeout(50);
+        await require$$7.setTimeout(50);
         let accessRetries = 0;
         const maxAccessRetries = 5;
         while (accessRetries < maxAccessRetries) {
@@ -306,12 +306,12 @@ async function retryWrite(filepath, content, retries = 3, baseDelay = 10) {
             // eslint-disable-next-line no-await-in-loop
             await fs.promises.access(filepath);
             // eslint-disable-next-line no-await-in-loop
-            await promises.setTimeout(10);
+            await require$$7.setTimeout(10);
             break;
           } catch {
             const delay = 20 * (accessRetries + 1);
             // eslint-disable-next-line no-await-in-loop
-            await promises.setTimeout(delay);
+            await require$$7.setTimeout(delay);
             accessRetries++;
           }
         }
@@ -325,7 +325,7 @@ async function retryWrite(filepath, content, retries = 3, baseDelay = 10) {
       }
       const delay = baseDelay * 2 ** attempt;
       // eslint-disable-next-line no-await-in-loop
-      await promises.setTimeout(delay);
+      await require$$7.setTimeout(delay);
     }
   }
 }
@@ -354,7 +354,7 @@ async function readFile(filepath) {
       }
       const delay = process.platform === 'win32' ? 50 * (attempt + 1) : 20;
       // eslint-disable-next-line no-await-in-loop
-      await promises.setTimeout(delay);
+      await require$$7.setTimeout(delay);
     }
   }
   throw new Error('Unreachable code');
@@ -525,7 +525,7 @@ class InputError extends Error {
 async function captureException(exception, hint) {
   const result = captureExceptionSync(exception, hint);
   // "Sleep" for a second, just in case, hopefully enough time to initiate fetch.
-  await promises.setTimeout(1000);
+  await require$$7.setTimeout(1000);
   return result;
 }
 function captureExceptionSync(exception, hint) {
@@ -533,7 +533,7 @@ function captureExceptionSync(exception, hint) {
   if (!Sentry) {
     return '';
   }
-  require$$9.debugFn('notice', 'send: exception to Sentry');
+  debug$2.debugFn('notice', 'send: exception to Sentry');
   return Sentry.captureException(exception, hint);
 }
 
@@ -695,8 +695,8 @@ function findSocketYmlSync(dir = process.cwd()) {
           }
         };
       } catch (e) {
-        require$$9.debugFn('error', `Failed to parse config file: ${ymlPath}`);
-        require$$9.debugDir('error', e);
+        debug$2.debugFn('error', `Failed to parse config file: ${ymlPath}`);
+        debug$2.debugDir('error', e);
         return {
           ok: false,
           message: `Found file but was unable to parse ${ymlPath}`,
@@ -760,7 +760,7 @@ let _cachedConfig;
 // When using --config or SOCKET_CLI_CONFIG, do not persist the config.
 let _configFromFlag = false;
 function overrideCachedConfig(jsonConfig) {
-  require$$9.debugFn('notice', 'override: full config (not stored)');
+  debug$2.debugFn('notice', 'override: full config (not stored)');
   let config;
   try {
     config = JSON.parse(String(jsonConfig));
@@ -802,7 +802,7 @@ function overrideCachedConfig(jsonConfig) {
   };
 }
 function overrideConfigApiToken(apiToken) {
-  require$$9.debugFn('notice', 'override: Socket API token (not stored)');
+  debug$2.debugFn('notice', 'override: Socket API token (not stored)');
   if (apiToken === undefined) {
     // SOCKET_CLI_NO_API_TOKEN: operate with no token and lock the config to
     // read-only so nothing is persisted for this run.
@@ -939,7 +939,7 @@ function updateConfigValue(configKey, value) {
  * - Used for permission validation and help text
  */
 
-const require$3 = require$$5.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('utils.js', document.baseURI).href)));
+const require$3 = require$$1.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('utils.js', document.baseURI).href)));
 let _requirements;
 function getRequirements() {
   if (_requirements === undefined) {
@@ -1003,14 +1003,14 @@ function getRequirementsKey(cmdPath) {
  * Wraps debugFn to provide a simpler API.
  */
 const debug$1 = message => {
-  require$$9.debugFn('socket:telemetry:service', message);
+  debug$2.debugFn('socket:telemetry:service', message);
 };
 
 /**
  * DebugDir wrapper for telemetry service.
  */
 const debugDirWrapper = obj => {
-  require$$9.debugDir('socket:telemetry:service', obj);
+  debug$2.debugDir('socket:telemetry:service', obj);
 };
 
 /**
@@ -1375,7 +1375,7 @@ class TelemetryService {
  * Debug wrapper for telemetry integration.
  */
 const debug = message => {
-  require$$9.debugFn('socket:telemetry:integration', message);
+  debug$2.debugFn('socket:telemetry:integration', message);
 };
 
 /**
@@ -1824,6 +1824,20 @@ async function trackSubprocessError(command, startTime, error, exitCode, metadat
  * - Includes CLI version and platform information
  */
 
+// SDK v4 rejects request timeouts outside this range (see the SDK's
+// MIN_HTTP_TIMEOUT / MAX_HTTP_TIMEOUT). The SDK does not re-export those
+// constants, so the bounds are mirrored here.
+const MIN_API_TIMEOUT_MS = 5_000;
+const MAX_API_TIMEOUT_MS = 300_000;
+
+// Clamp a SOCKET_CLI_API_TIMEOUT value into the SDK's accepted range. The SDK
+// throws a TypeError on out-of-range timeouts, so an out-of-range user value
+// would otherwise make every API call fail; clamping preserves intent (a small
+// value maps to the floor, a huge value to the ceiling) while staying valid.
+function clampApiTimeout(timeout) {
+  return Math.min(Math.max(timeout, MIN_API_TIMEOUT_MS), MAX_API_TIMEOUT_MS);
+}
+
 // Lazy-evaluated full CLI user agent for direct (non-SDK) API calls.
 // Includes the CLI product token, Node.js version, and OS platform/arch.
 // e.g. "socket/1.1.96 node/v22.0.0 linux/arm64"
@@ -1843,13 +1857,13 @@ const TOKEN_VISIBLE_LENGTH = 5;
 // The Socket API server that should be used for operations.
 function getDefaultApiBaseUrl$1() {
   const baseUrl = constants.default.ENV.SOCKET_CLI_API_BASE_URL || getConfigValueOrUndef(constants.CONFIG_KEY_API_BASE_URL);
-  return require$$13.isUrl(baseUrl) ? baseUrl : undefined;
+  return url.isUrl(baseUrl) ? baseUrl : undefined;
 }
 
 // The Socket API server that should be used for operations.
 function getDefaultProxyUrl() {
   const apiProxy = constants.default.ENV.SOCKET_CLI_API_PROXY || getConfigValueOrUndef(constants.CONFIG_KEY_API_PROXY);
-  return require$$13.isUrl(apiProxy) ? apiProxy : undefined;
+  return url.isUrl(apiProxy) ? apiProxy : undefined;
 }
 
 // Cached extra CA certificates for SSL_CERT_FILE support.
@@ -1882,7 +1896,7 @@ function getExtraCaCerts() {
     _extraCaCerts = [...node_tls.rootCertificates, extraCerts];
     return _extraCaCerts;
   } catch (e) {
-    require$$9.debugFn('warn', `Failed to read certificate file: ${certPath}`, e);
+    debug$2.debugFn('warn', `Failed to read certificate file: ${certPath}`, e);
     return undefined;
   }
 }
@@ -1932,7 +1946,7 @@ async function setupSdk(options) {
   let {
     apiProxy
   } = opts;
-  if (!require$$13.isUrl(apiProxy)) {
+  if (!url.isUrl(apiProxy)) {
     apiProxy = getDefaultProxyUrl();
   }
   const {
@@ -1966,13 +1980,20 @@ async function setupSdk(options) {
           ca
         }
       } : {})
-    }) : isHttp ? new require$$2.Agent() : new require$$3.Agent(ca ? {
+    }) : isHttp ? new require$$12.Agent() : new require$$13.Agent(ca ? {
       ca
     } : undefined),
     ...(apiBaseUrl ? {
       baseUrl: apiBaseUrl
     } : {}),
-    timeout: constants.default.ENV.SOCKET_CLI_API_TIMEOUT,
+    // SDK v4 validates the request timeout to be within [5000, 300000] ms and
+    // throws otherwise. Only forward a truthy timeout; when unset (0) omit it
+    // so the SDK applies its own default instead of rejecting the value. A
+    // truthy-but-out-of-range value is clamped into the accepted range rather
+    // than forwarded, which would make every SDK call throw.
+    ...(constants.default.ENV.SOCKET_CLI_API_TIMEOUT ? {
+      timeout: clampApiTimeout(constants.default.ENV.SOCKET_CLI_API_TIMEOUT)
+    } : {}),
     userAgent: vendor.distExports.createUserAgentFromPkgJson({
       name: constants.default.ENV.INLINED_SOCKET_CLI_NAME,
       version: constants.default.ENV.INLINED_SOCKET_CLI_VERSION,
@@ -2078,9 +2099,9 @@ function getHttpsAgent() {
     return _httpsAgent;
   }
   const ca = getExtraCaCerts();
-  const agent = ca ? new require$$3.Agent({
+  const agent = ca ? new require$$13.Agent({
     ca
-  }) : new require$$3.Agent();
+  }) : new require$$13.Agent();
   _httpsAgent = agent;
   return agent;
 }
@@ -2102,7 +2123,7 @@ function _httpsRequestFetch(url, init, agent, redirectCount) {
     if (init.body) {
       headers['content-length'] = String(Buffer.byteLength(init.body));
     }
-    const req = require$$3.request(url, {
+    const req = require$$13.request(url, {
       method: init.method || 'GET',
       headers,
       agent
@@ -2251,6 +2272,26 @@ async function getErrorMessageForHttpStatusCode(code) {
   }
   return `Server responded with status code ${code}`;
 }
+
+/**
+ * The subset of a Socket SDK result that {@link handleApiCall} reads. Both the
+ * OpenAPI-derived `SocketSdkResult<T>` family and the SDK 4.x strict result
+ * types (`OrganizationsResult`, `RepositoryResult`, `DeleteResult`, ...)
+ * structurally satisfy this shape, so a caller can pass whichever result a
+ * given SDK method returns without forcing a (sometimes stale) operation-key
+ * shape onto the strict return types.
+ */
+
+/**
+ * The success `data` type carried by a Socket SDK result union `R`. The
+ * conditional distributes over `R`'s members, so only the success member(s)
+ * contribute their `data`; the error member resolves to `never` and drops out.
+ * Inferring the whole result `R` and extracting here (rather than inferring a
+ * bare `Data` from a `Promise<{ data: Data } | ...>`) avoids `Data` absorbing
+ * the error branch's `data?: undefined` — which would otherwise widen every
+ * result to `CResult<Data | undefined>`.
+ */
+
 /**
  * Handle Socket SDK API calls with error handling and permission logging.
  */
@@ -2299,25 +2340,25 @@ async function handleApiCall(value, options) {
     if (description && !silence) {
       logger.logger.fail(`An error was thrown while requesting ${description}`);
     }
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       socketSdkErrorResult
     });
     return socketSdkErrorResult;
   }
 
-  // Note: TS can't narrow down the type of result due to generics.
+  // The `success` discriminant is a concrete boolean literal in both branches,
+  // so this narrows the result to its error branch regardless of `R`.
   if (sdkResult.success === false) {
     const endpoint = description || 'Socket API';
     debugApiResponse('API', endpoint, sdkResult.status);
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       sdkResult
     });
-    const errCResult = sdkResult;
-    const errStr = errCResult.error ? String(errCResult.error).trim() : '';
+    const errStr = sdkResult.error ? String(sdkResult.error).trim() : '';
     const message = errStr || NO_ERROR_MESSAGE;
-    const reason = errCResult.cause || NO_ERROR_MESSAGE;
+    const reason = sdkResult.cause || NO_ERROR_MESSAGE;
     const baseCause = reason && message !== reason ? `${message} (reason: ${reason})` : message;
-    const cause = errCResult.url ? `${baseCause} (url: ${errCResult.url})` : baseCause;
+    const cause = sdkResult.url ? `${baseCause} (url: ${sdkResult.url})` : baseCause;
     const socketSdkErrorResult = {
       ok: false,
       message: 'Socket API error',
@@ -2333,6 +2374,9 @@ async function handleApiCall(value, options) {
     }
     return socketSdkErrorResult;
   }
+  // Narrowing a type parameter by its `success` discriminant resolves `.data`
+  // through the constraint's success branch (`unknown`); re-apply the precise
+  // per-call success type the return contract already guarantees.
   const socketSdkSuccessResult = {
     ok: true,
     data: sdkResult.data
@@ -2344,8 +2388,8 @@ async function handleApiCallNoSpinner(value, description) {
   try {
     sdkResult = await value;
   } catch (e) {
-    require$$9.debugFn('error', `API request failed: ${description}`);
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', `API request failed: ${description}`);
+    debug$2.debugDir('error', e);
     const errStr = e ? String(e).trim() : '';
     const message = 'Socket API error';
     const rawCause = errStr || NO_ERROR_MESSAGE;
@@ -2359,18 +2403,18 @@ async function handleApiCallNoSpinner(value, description) {
     };
   }
 
-  // Note: TS can't narrow down the type of result due to generics
+  // The `success` discriminant is a concrete boolean literal in both branches,
+  // so this narrows the result to its error branch regardless of `R`.
   if (sdkResult.success === false) {
-    require$$9.debugFn('error', `fail: ${description} bad response`);
-    require$$9.debugDir('inspect', {
+    debug$2.debugFn('error', `fail: ${description} bad response`);
+    debug$2.debugDir('inspect', {
       sdkResult
     });
-    const sdkErrorResult = sdkResult;
-    const errStr = sdkErrorResult.error ? String(sdkErrorResult.error).trim() : '';
+    const errStr = sdkResult.error ? String(sdkResult.error).trim() : '';
     const message = errStr || NO_ERROR_MESSAGE;
-    const reason = sdkErrorResult.cause || NO_ERROR_MESSAGE;
+    const reason = sdkResult.cause || NO_ERROR_MESSAGE;
     const baseCause = reason && message !== reason ? `${message} (reason: ${reason})` : message;
-    const cause = sdkErrorResult.url ? `${baseCause} (url: ${sdkErrorResult.url})` : baseCause;
+    const cause = sdkResult.url ? `${baseCause} (url: ${sdkResult.url})` : baseCause;
     return {
       ok: false,
       message: 'Socket API error',
@@ -2380,10 +2424,12 @@ async function handleApiCallNoSpinner(value, description) {
       }
     };
   } else {
-    const sdkSuccessResult = sdkResult;
+    // Narrowing a type parameter by its `success` discriminant resolves `.data`
+    // through the constraint's success branch (`unknown`); re-apply the precise
+    // per-call success type the return contract already guarantees.
     return {
       ok: true,
-      data: sdkSuccessResult.data
+      data: sdkResult.data
     };
   }
 }
@@ -2402,11 +2448,13 @@ async function queryApi(path, apiToken) {
   });
   return result;
 }
-
 /**
- * Query Socket API endpoint and return text response with error handling.
+ * Query a Socket API endpoint and return the HTTP status alongside the text
+ * body, with error handling. Unlike queryApiSafeText this surfaces the status
+ * on success (including 2xx statuses like 202 Accepted), so callers can drive
+ * status-dependent flows such as the cached-scan 202 poll loop.
  */
-async function queryApiSafeText(path, description, commandPath) {
+async function queryApiSafeTextWithStatus(path, description, commandPath) {
   const apiToken = getDefaultApiToken();
   if (!apiToken) {
     return {
@@ -2437,8 +2485,8 @@ async function queryApiSafeText(path, description, commandPath) {
       spinner.failAndStop(`An error was thrown while requesting ${description}.`);
       debugApiResponse('GET', path, undefined, e, duration);
     }
-    require$$9.debugFn('error', 'Query API request failed');
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', 'Query API request failed');
+    debug$2.debugDir('error', e);
     const errStr = e ? String(e).trim() : '';
     const message = 'API request failed';
     const rawCause = errStr || NO_ERROR_MESSAGE;
@@ -2464,14 +2512,17 @@ async function queryApiSafeText(path, description, commandPath) {
     };
   }
   try {
-    const data = await result.text();
+    const text = await result.text();
     return {
       ok: true,
-      data
+      data: {
+        status: result.status,
+        text
+      }
     };
   } catch (e) {
-    require$$9.debugFn('error', 'Failed to read API response text');
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', 'Failed to read API response text');
+    debug$2.debugDir('error', e);
     return {
       ok: false,
       message: 'API request failed',
@@ -2480,6 +2531,17 @@ async function queryApiSafeText(path, description, commandPath) {
   }
 }
 
+/**
+ * Query Socket API endpoint and return text response with error handling.
+ */
+async function queryApiSafeText(path, description, commandPath) {
+  const result = await queryApiSafeTextWithStatus(path, description);
+  return result.ok ? {
+    ok: true,
+    data: result.data.text
+  } : result;
+}
+
 /**
  * Query Socket API endpoint and return parsed JSON response.
  */
@@ -2557,8 +2619,8 @@ async function sendApiRequest(path, options) {
     if (description) {
       spinner.failAndStop(`An error was thrown while requesting ${description}.`);
     }
-    require$$9.debugFn('error', `API ${method} request failed`);
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', `API ${method} request failed`);
+    debug$2.debugDir('error', e);
     const errStr = e ? String(e).trim() : '';
     const message = 'API request failed';
     const rawCause = errStr || NO_ERROR_MESSAGE;
@@ -2594,8 +2656,8 @@ async function sendApiRequest(path, options) {
       data: data
     };
   } catch (e) {
-    require$$9.debugFn('error', 'Failed to parse API response JSON');
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', 'Failed to parse API response JSON');
+    debug$2.debugDir('error', e);
     return {
       ok: false,
       message: 'API request failed',
@@ -2726,9 +2788,9 @@ cols) {
 // Serialize the final result object before printing it
 // All commands that support the --json flag should call this before printing
 function serializeResultJson(data) {
-  if (!require$$11.isObject(data)) {
+  if (!objects.isObject(data)) {
     process.exitCode = 1;
-    require$$9.debugFn('inspect', {
+    debug$2.debugFn('inspect', {
       data
     });
 
@@ -2746,8 +2808,8 @@ function serializeResultJson(data) {
     process.exitCode = 1;
     const message = 'There was a problem converting the data set to JSON. Please try again without --json';
     logger.logger.fail(message);
-    require$$9.debugFn('error', 'JSON serialization failed');
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', 'JSON serialization failed');
+    debug$2.debugDir('error', e);
 
     // This could be caused by circular references, which is an "us" problem.
     return `${JSON.stringify({
@@ -3012,7 +3074,7 @@ function getHelpListOutput(list, options) {
   const names = Object.keys(list).sort(sorts.naturalCompare);
   for (const name of names) {
     const entry = list[name];
-    const entryIsObj = require$$11.isObject(entry);
+    const entryIsObj = objects.isObject(entry);
     if (entryIsObj && 'hidden' in entry && entry?.hidden) {
       continue;
     }
@@ -3110,9 +3172,9 @@ function getAsciiHeader(command, orgFlag, compactMode = false) {
   // Version display: show hash in debug mode, otherwise show semantic version.
   const fullVersion = constants.default.ENV.INLINED_SOCKET_CLI_VERSION;
   const versionHash = constants.default.ENV.INLINED_SOCKET_CLI_VERSION_HASH;
-  const cliVersion = redacting ? REDACTED : require$$9.isDebug() ? versionHash : `v${fullVersion}`;
+  const cliVersion = redacting ? REDACTED : debug$2.isDebug() ? versionHash : `v${fullVersion}`;
   const nodeVersion = redacting ? REDACTED : process.version;
-  const showNodeVersion = !redacting && require$$9.isDebug();
+  const showNodeVersion = !redacting && debug$2.isDebug();
   const defaultOrg = getConfigValueOrUndef(constants.CONFIG_KEY_DEFAULT_ORG);
   const configFromFlagDot = isConfigFromFlag() ? '*' : '.';
 
@@ -3230,7 +3292,7 @@ async function meowWithSubcommands(config, options) {
       hidden: true,
       description: 'Print the app version'
     },
-    ...require$$11.getOwn(additionalOptions, 'flags')
+    ...objects.getOwn(additionalOptions, 'flags')
   };
   const [commandOrAliasName_, ...rawCommandArgv] = argv;
   let commandOrAliasName = commandOrAliasName_;
@@ -3265,7 +3327,7 @@ async function meowWithSubcommands(config, options) {
     }
   }
   if (isRootCommand) {
-    const hiddenDebugFlag = !require$$9.isDebug();
+    const hiddenDebugFlag = !debug$2.isDebug();
     flags$1['compactHeader'] = {
       ...flags$1['compactHeader'],
       hidden: false
@@ -3328,7 +3390,7 @@ async function meowWithSubcommands(config, options) {
     spinner: spinnerFlag
   } = cli1.flags;
   const compactMode = compactHeaderFlag || constants.default.ENV.CI && !constants.default.ENV.VITEST;
-  const noSpinner = spinnerFlag === false || require$$9.isDebug();
+  const noSpinner = spinnerFlag === false || debug$2.isDebug();
 
   // Use CI spinner style when --no-spinner is passed or debug mode is enabled.
   // This prevents the spinner from interfering with debug output.
@@ -3428,10 +3490,10 @@ async function meowWithSubcommands(config, options) {
   } else {
     lines.push('Commands');
     lines.push(`  ${getHelpListOutput({
-      ...require$$11.toSortedObject(Object.fromEntries(Object.entries(subcommands).filter(({
+      ...objects.toSortedObject(Object.fromEntries(Object.entries(subcommands).filter(({
         1: subcommand
       }) => !subcommand.hidden))),
-      ...require$$11.toSortedObject(Object.fromEntries(Object.entries(aliases).filter(({
+      ...objects.toSortedObject(Object.fromEntries(Object.entries(aliases).filter(({
         1: alias
       }) => {
         const {
@@ -3576,7 +3638,7 @@ function meowOrExit(config, options) {
     version: versionFlag
   } = cli.flags;
   const compactMode = compactHeaderFlag || constants.default.ENV.CI && !constants.default.ENV.VITEST;
-  const noSpinner = spinnerFlag === false || require$$9.isDebug();
+  const noSpinner = spinnerFlag === false || debug$2.isDebug();
 
   // Use CI spinner style when --no-spinner is passed.
   // This prevents the spinner from interfering with debug output.
@@ -3613,7 +3675,7 @@ function meowOrExit(config, options) {
   }
 
   // Meow doesn't detect 'version' as an unknown flag, so we do the leg work here.
-  if (versionFlag && !require$$11.hasOwn(cliConfig.flags, 'version')) {
+  if (versionFlag && !objects.hasOwn(cliConfig.flags, 'version')) {
     // Use `console.error` here instead of `logger.error` to match Meow behavior.
     console.error('Unknown flag\n--version');
     // eslint-disable-next-line n/no-process-exit
@@ -3684,7 +3746,7 @@ async function fetchOrganization(options) {
     }
     sockSdk = sockSdkCResult.data;
   }
-  const orgsCResult = await handleApiCall(sockSdk.getOrganizations(), {
+  const orgsCResult = await handleApiCall(sockSdk.listOrganizations(), {
     description,
     silence
   });
@@ -3813,7 +3875,7 @@ async function determineOrgSlug(orgFlag, interactive, dryRun) {
 async function getDefaultOrgSlug(silence) {
   const defaultOrgResult = getConfigValueOrUndef('defaultOrg');
   if (defaultOrgResult) {
-    require$$9.debugFn('notice', 'use: org from "defaultOrg" value of socket/settings local app data', defaultOrgResult);
+    debug$2.debugFn('notice', 'use: org from "defaultOrg" value of socket/settings local app data', defaultOrgResult);
     return {
       ok: true,
       data: defaultOrgResult
@@ -3821,7 +3883,7 @@ async function getDefaultOrgSlug(silence) {
   }
   const envOrgSlug = constants.default.ENV.SOCKET_CLI_ORG_SLUG;
   if (envOrgSlug) {
-    require$$9.debugFn('notice', 'use: org from SOCKET_CLI_ORG_SLUG environment variable', envOrgSlug);
+    debug$2.debugFn('notice', 'use: org from SOCKET_CLI_ORG_SLUG environment variable', envOrgSlug);
     return {
       ok: true,
       data: envOrgSlug
@@ -3857,7 +3919,7 @@ async function getDefaultOrgSlug(silence) {
       data: `Cannot determine the default organization for the API token. Unable to continue.`
     };
   }
-  require$$9.debugFn('notice', 'resolve: org from Socket API', slug);
+  debug$2.debugFn('notice', 'resolve: org from Socket API', slug);
   return {
     ok: true,
     message: 'Retrieved default org from server',
@@ -3994,14 +4056,14 @@ async function getRepoInfo(cwd = process.cwd()) {
     })).stdout;
     info = parseGitRemoteUrl(remoteUrl);
     if (!info) {
-      require$$9.debugFn('warn', `Unmatched git remote URL format: ${remoteUrl}`);
-      require$$9.debugDir('warn', {
+      debug$2.debugFn('warn', `Unmatched git remote URL format: ${remoteUrl}`);
+      debug$2.debugDir('warn', {
         remoteUrl
       });
     }
   } catch (e) {
     // Expected failure when not in a git repo.
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       message: 'git remote get-url failed',
       error: e
     });
@@ -4027,7 +4089,7 @@ async function gitBranch(cwd = process.cwd()) {
     return gitSymbolicRefResult.stdout;
   } catch (e) {
     // Expected in detached HEAD state, fallback to rev-parse.
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       message: 'In detached HEAD state',
       error: e
     });
@@ -4039,7 +4101,7 @@ async function gitBranch(cwd = process.cwd()) {
     return gitRevParseResult.stdout;
   } catch (e) {
     // Both methods failed, likely not in a git repo.
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       message: 'Unable to determine git branch',
       error: e
     });
@@ -4071,7 +4133,7 @@ async function detectDefaultBranch(cwd = process.cwd()) {
 async function gitCleanFdx(cwd = process.cwd()) {
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     await spawn.spawn('git', ['clean', '-fdx'], stdioIgnoreOptions);
@@ -4087,7 +4149,7 @@ async function gitCleanFdx(cwd = process.cwd()) {
 async function gitCheckoutBranch(branch, cwd = process.cwd()) {
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     await spawn.spawn('git', ['checkout', branch], stdioIgnoreOptions);
@@ -4106,7 +4168,7 @@ async function gitCreateBranch(branch, cwd = process.cwd()) {
   }
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     await spawn.spawn('git', ['branch', branch], stdioIgnoreOptions);
@@ -4122,7 +4184,7 @@ async function gitCreateBranch(branch, cwd = process.cwd()) {
 async function gitPushBranch(branch, cwd = process.cwd()) {
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     await spawn.spawn('git', ['push', '--force', '--set-upstream', 'origin', branch], stdioIgnoreOptions);
@@ -4130,9 +4192,9 @@ async function gitPushBranch(branch, cwd = process.cwd()) {
     return true;
   } catch (e) {
     if (spawn.isSpawnError(e) && e.code === 128) {
-      require$$9.debugFn('error', "Push denied: token requires write permissions for 'contents' and 'pull-requests'");
-      require$$9.debugDir('error', e);
-      require$$9.debugDir('inspect', {
+      debug$2.debugFn('error', "Push denied: token requires write permissions for 'contents' and 'pull-requests'");
+      debug$2.debugDir('error', e);
+      debug$2.debugDir('inspect', {
         branch
       });
     } else {
@@ -4145,7 +4207,7 @@ async function gitPushBranch(branch, cwd = process.cwd()) {
 }
 async function gitCommit(commitMsg, filepaths, options) {
   if (!filepaths.length) {
-    require$$9.debugFn('notice', `miss: no filepaths to add`);
+    debug$2.debugFn('notice', `miss: no filepaths to add`);
     return false;
   }
   const {
@@ -4159,7 +4221,7 @@ async function gitCommit(commitMsg, filepaths, options) {
   await gitEnsureIdentity(user, email, cwd);
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     await spawn.spawn('git', ['add', ...filepaths], stdioIgnoreOptions);
@@ -4170,7 +4232,7 @@ async function gitCommit(commitMsg, filepaths, options) {
     debugGit('add', false, {
       error: e
     });
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       filepaths
     });
     return false;
@@ -4183,7 +4245,7 @@ async function gitCommit(commitMsg, filepaths, options) {
     debugGit('commit', false, {
       error: e
     });
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       commitMsg
     });
   }
@@ -4192,7 +4254,7 @@ async function gitCommit(commitMsg, filepaths, options) {
 async function gitDeleteBranch(branch, cwd = process.cwd()) {
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     // Will throw with exit code 1 if branch does not exist.
@@ -4200,7 +4262,7 @@ async function gitDeleteBranch(branch, cwd = process.cwd()) {
     return true;
   } catch (e) {
     // Expected failure when branch doesn't exist.
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       message: `Branch deletion failed (may not exist): ${branch}`,
       error: e
     });
@@ -4210,7 +4272,7 @@ async function gitDeleteBranch(branch, cwd = process.cwd()) {
 async function gitDeleteRemoteBranch(branch, cwd = process.cwd()) {
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     // Will throw with exit code 1 if branch does not exist.
@@ -4218,7 +4280,7 @@ async function gitDeleteRemoteBranch(branch, cwd = process.cwd()) {
     return true;
   } catch (e) {
     // Expected failure when remote branch doesn't exist.
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       message: `Remote branch deletion failed (may not exist): ${branch}`,
       error: e
     });
@@ -4241,7 +4303,7 @@ async function gitEnsureIdentity(name, email, cwd = process.cwd()) {
       configValue = gitConfigResult.stdout;
     } catch (e) {
       // Expected when config property is not set.
-      require$$9.debugDir('inspect', {
+      debug$2.debugDir('inspect', {
         message: `Git config property not set: ${prop}`,
         error: e
       });
@@ -4249,14 +4311,14 @@ async function gitEnsureIdentity(name, email, cwd = process.cwd()) {
     if (configValue !== value) {
       const stdioIgnoreOptions = {
         cwd,
-        stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+        stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
       };
       try {
         await spawn.spawn('git', ['config', prop, value], stdioIgnoreOptions);
       } catch (e) {
-        require$$9.debugFn('warn', `Failed to set git config: ${prop}`);
-        require$$9.debugDir('warn', e);
-        require$$9.debugDir('inspect', {
+        debug$2.debugFn('warn', `Failed to set git config: ${prop}`);
+        debug$2.debugDir('warn', e);
+        debug$2.debugDir('inspect', {
           value
         });
       }
@@ -4266,7 +4328,7 @@ async function gitEnsureIdentity(name, email, cwd = process.cwd()) {
 async function gitLocalBranchExists(branch, cwd = process.cwd()) {
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     // Will throw with exit code 1 if the branch does not exist.
@@ -4286,7 +4348,7 @@ async function gitRemoteBranchExists(branch, cwd = process.cwd()) {
     return lsRemoteResult.stdout.length > 0;
   } catch (e) {
     // Expected when remote is not accessible or branch doesn't exist.
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       message: `Remote branch check failed: ${branch}`,
       error: e
     });
@@ -4302,7 +4364,7 @@ async function gitResetAndClean(branch = 'HEAD', cwd = process.cwd()) {
 async function gitResetHard(branch = 'HEAD', cwd = process.cwd()) {
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   try {
     await spawn.spawn('git', ['reset', '--hard', branch], stdioIgnoreOptions);
@@ -4328,8 +4390,8 @@ async function gitUnstagedModifiedFiles(cwd = process.cwd()) {
       data: relPaths.map(p => path$1.normalizePath(p))
     };
   } catch (e) {
-    require$$9.debugFn('error', 'Failed to get unstaged modified files');
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', 'Failed to get unstaged modified files');
+    debug$2.debugDir('error', e);
     return {
       ok: false,
       message: 'Git Error',
@@ -4691,14 +4753,14 @@ function pathsToGlobPatterns(paths, cwd) {
 
 function createPurlObject(type, name, options) {
   let opts;
-  if (require$$11.isObjectObject(type)) {
+  if (objects.isObjectObject(type)) {
     opts = {
       __proto__: null,
       ...type
     };
     type = opts.type;
     name = opts.name;
-  } else if (require$$11.isObjectObject(name)) {
+  } else if (objects.isObjectObject(name)) {
     opts = {
       __proto__: null,
       ...name
@@ -4895,7 +4957,7 @@ async function compressSocketFactsForUpload(scanPaths) {
     // `rm({ force: true })` no-ops on missing files, so tracking before
     // creation is safe.
     brPaths.push(brPath);
-    await promises$1.pipeline(fs.createReadStream(p), node_zlib.createBrotliCompress(), fs.createWriteStream(brPath));
+    await require$$9.pipeline(fs.createReadStream(p), require$$11.createBrotliCompress(), fs.createWriteStream(brPath));
     return brPath;
   }));
   const failure = results.find(r => r.status === 'rejected');
@@ -5013,6 +5075,17 @@ async function findUp(name, options) {
   }
   return undefined;
 }
+async function withTmpDir(prefix, fn) {
+  const tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), prefix));
+  try {
+    return await fn(tmpDir);
+  } finally {
+    await fs.promises.rm(tmpDir, {
+      recursive: true,
+      force: true
+    }).catch(() => {});
+  }
+}
 
 function findBinPathDetailsSync(binName) {
   const rawBinPaths = bin.whichBinSync(binName, {
@@ -5209,7 +5282,7 @@ function isYarnBerry() {
  * - Configures environment for third-party tools
  */
 
-const require$2 = require$$5.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('utils.js', document.baseURI).href)));
+const require$2 = require$$1.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('utils.js', document.baseURI).href)));
 const {
   PACKAGE_LOCK_JSON,
   PNPM_LOCK_YAML,
@@ -5280,7 +5353,7 @@ async function spawnDlx(packageSpec, args, options, spawnExtra) {
     // this only as a config setting, not as a `dlx` CLI flag, so it must be set
     // via the npm_config_ env var. See: https://pnpm.io/npmrc#settings
     const pnpmEnv = {
-      ...require$$11.getOwn(finalShadowOptions, 'env'),
+      ...objects.getOwn(finalShadowOptions, 'env'),
       npm_config_ignore_pnpmfile: 'true'
     };
     if (force) {
@@ -5308,7 +5381,7 @@ async function spawnDlx(packageSpec, args, options, spawnExtra) {
     finalShadowOptions = {
       ...finalShadowOptions,
       env: {
-        ...require$$11.getOwn(finalShadowOptions, 'env'),
+        ...objects.getOwn(finalShadowOptions, 'env'),
         YARN_NODE_LINKER: 'node-modules'
       }
     };
@@ -5547,7 +5620,7 @@ async function spawnCoanaDlx(args, orgSlug, options, spawnExtra) {
   // requested stdio from either argument and honor it on every launch path:
   // dlx, local-path, and npm-install (e.g. `socket fix --silence` requests
   // `stdio: 'pipe'` via options).
-  const requestedStdio = spawnExtra?.['stdio'] ?? require$$11.getOwn(dlxOptions, 'stdio');
+  const requestedStdio = spawnExtra?.['stdio'] ?? objects.getOwn(dlxOptions, 'stdio');
   const localCoanaPath = process.env['SOCKET_CLI_COANA_LOCAL_PATH'];
   // Use local Coana CLI if path is provided.
   if (localCoanaPath) {
@@ -5836,7 +5909,7 @@ function getDefaultSocketJson() {
 function readSocketJsonSync(cwd, defaultOnError = false) {
   const sockJsonPath = path.join(cwd, constants.SOCKET_JSON);
   if (!fs.existsSync(sockJsonPath)) {
-    require$$9.debugFn('notice', `miss: ${constants.SOCKET_JSON} not found at ${cwd}`);
+    debug$2.debugFn('notice', `miss: ${constants.SOCKET_JSON} not found at ${cwd}`);
     return {
       ok: true,
       data: getDefaultSocketJson()
@@ -5848,16 +5921,16 @@ function readSocketJsonSync(cwd, defaultOnError = false) {
   } catch (e) {
     if (defaultOnError) {
       logger.logger.warn(`Failed to read ${constants.SOCKET_JSON}, using default`);
-      require$$9.debugFn('warn', `Failed to read ${constants.SOCKET_JSON} sync`);
-      require$$9.debugDir('warn', e);
+      debug$2.debugFn('warn', `Failed to read ${constants.SOCKET_JSON} sync`);
+      debug$2.debugDir('warn', e);
       return {
         ok: true,
         data: getDefaultSocketJson()
       };
     }
     const cause = formatErrorWithDetail(`An error occurred while trying to read ${constants.SOCKET_JSON}`, e);
-    require$$9.debugFn('error', `Failed to read ${constants.SOCKET_JSON} sync`);
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', `Failed to read ${constants.SOCKET_JSON} sync`);
+    debug$2.debugDir('error', e);
     return {
       ok: false,
       message: `Failed to read ${constants.SOCKET_JSON}`,
@@ -5868,11 +5941,11 @@ function readSocketJsonSync(cwd, defaultOnError = false) {
   try {
     jsonObj = JSON.parse(jsonContent);
   } catch (e) {
-    require$$9.debugFn('error', `Failed to parse ${constants.SOCKET_JSON} as JSON (sync)`);
-    require$$9.debugDir('inspect', {
+    debug$2.debugFn('error', `Failed to parse ${constants.SOCKET_JSON} as JSON (sync)`);
+    debug$2.debugDir('inspect', {
       jsonContent
     });
-    require$$9.debugDir('error', e);
+    debug$2.debugDir('error', e);
     if (defaultOnError) {
       logger.logger.warn(`Failed to parse ${constants.SOCKET_JSON}, using default`);
       return {
@@ -5906,11 +5979,11 @@ async function writeSocketJson(cwd, sockJson) {
   try {
     jsonContent = JSON.stringify(sockJson, null, 2);
   } catch (e) {
-    require$$9.debugFn('error', `Failed to serialize ${constants.SOCKET_JSON} to JSON`);
-    require$$9.debugDir('inspect', {
+    debug$2.debugFn('error', `Failed to serialize ${constants.SOCKET_JSON} to JSON`);
+    debug$2.debugDir('inspect', {
       sockJson
     });
-    require$$9.debugDir('error', e);
+    debug$2.debugDir('error', e);
     return {
       ok: false,
       message: 'Failed to serialize to JSON',
@@ -6026,12 +6099,12 @@ async function fetchGhsaDetails(ids) {
       if (advisory && advisory.ghsaId) {
         results.set(id, advisory);
       } else {
-        require$$9.debugFn('notice', `miss: no advisory found for ${id}`);
+        debug$2.debugFn('notice', `miss: no advisory found for ${id}`);
       }
     }
   } catch (e) {
-    require$$9.debugFn('error', formatErrorWithDetail('Failed to fetch GHSA details', e));
-    require$$9.debugDir('error', e);
+    debug$2.debugFn('error', formatErrorWithDetail('Failed to fetch GHSA details', e));
+    debug$2.debugDir('error', e);
   }
   return results;
 }
@@ -6042,13 +6115,13 @@ function getOctokit() {
       SOCKET_CLI_GITHUB_TOKEN
     } = constants.default.ENV;
     if (!SOCKET_CLI_GITHUB_TOKEN) {
-      require$$9.debugFn('notice', 'miss: SOCKET_CLI_GITHUB_TOKEN env var');
+      debug$2.debugFn('notice', 'miss: SOCKET_CLI_GITHUB_TOKEN env var');
     }
     const octokitOptions = {
       auth: SOCKET_CLI_GITHUB_TOKEN,
       baseUrl: constants.default.ENV.GITHUB_API_URL
     };
-    require$$9.debugDir('inspect', {
+    debug$2.debugDir('inspect', {
       octokitOptions
     });
     _octokit = new vendor.Octokit(octokitOptions);
@@ -6062,7 +6135,7 @@ function getOctokitGraphql() {
       SOCKET_CLI_GITHUB_TOKEN
     } = constants.default.ENV;
     if (!SOCKET_CLI_GITHUB_TOKEN) {
-      require$$9.debugFn('notice', 'miss: SOCKET_CLI_GITHUB_TOKEN env var');
+      debug$2.debugFn('notice', 'miss: SOCKET_CLI_GITHUB_TOKEN env var');
     }
     _octokitGraphql = vendor.graphql2.defaults({
       headers: {
@@ -6115,31 +6188,31 @@ async function setGitRemoteGithubRepoUrl(owner, repo, token, cwd = process.cwd()
   const {
     GITHUB_SERVER_URL
   } = constants.default.ENV;
-  const urlObj = require$$13.parseUrl(GITHUB_SERVER_URL);
+  const urlObj = url.parseUrl(GITHUB_SERVER_URL);
   const host = urlObj?.host;
   if (!host) {
-    require$$9.debugFn('error', 'invalid: GITHUB_SERVER_URL env var');
-    require$$9.debugDir('inspect', {
+    debug$2.debugFn('error', 'invalid: GITHUB_SERVER_URL env var');
+    debug$2.debugDir('inspect', {
       GITHUB_SERVER_URL
     });
     return false;
   }
-  const url = `https://x-access-token:${token}@${host}/${owner}/${repo}`;
+  const url$1 = `https://x-access-token:${token}@${host}/${owner}/${repo}`;
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$9.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: debug$2.isDebug('stdio') ? 'inherit' : 'ignore'
   };
-  const quotedCmd = `\`git remote set-url origin ${url}\``;
-  require$$9.debugFn('stdio', `spawn: ${quotedCmd}`);
+  const quotedCmd = `\`git remote set-url origin ${url$1}\``;
+  debug$2.debugFn('stdio', `spawn: ${quotedCmd}`);
   try {
-    await spawn.spawn('git', ['remote', 'set-url', 'origin', url], stdioIgnoreOptions);
+    await spawn.spawn('git', ['remote', 'set-url', 'origin', url$1], stdioIgnoreOptions);
     return true;
   } catch (e) {
-    require$$9.debugFn('error', `Git command failed: ${quotedCmd}`);
-    require$$9.debugDir('inspect', {
+    debug$2.debugFn('error', `Git command failed: ${quotedCmd}`);
+    debug$2.debugDir('inspect', {
       cmd: quotedCmd
     });
-    require$$9.debugDir('error', e);
+    debug$2.debugDir('error', e);
   }
   return false;
 }
@@ -6432,7 +6505,7 @@ function isPnpmLockfileScanCommand(command) {
 // export type _Check_EcosystemString_has_all_purl_types =
 //   ExpectNever<MissingInEcosystemString>
 
-const ALL_ECOSYSTEMS = ['alpm', 'apk', 'bitbucket', 'cargo', 'chrome', 'cocoapods', 'composer', 'conan', 'conda', 'cran', 'deb', 'docker', 'gem', 'generic', 'github', 'golang', 'hackage', 'hex', 'huggingface', 'maven', 'mlflow', constants.NPM, 'nuget', 'oci', 'pub', 'pypi', 'qpkg', 'rpm', 'swift', 'swid', 'unknown', 'vscode'];
+const ALL_ECOSYSTEMS = ['alpm', 'apk', 'bitbucket', 'cargo', 'chrome', 'clawhub', 'cocoapods', 'composer', 'conan', 'conda', 'cran', 'deb', 'docker', 'gem', 'generic', 'github', 'golang', 'hackage', 'hex', 'huggingface', 'maven', 'mlflow', constants.NPM, 'nuget', 'oci', 'pub', 'pypi', 'qpkg', 'rpm', 'socket', 'swift', 'swid', 'unknown', 'vscode'];
 new Set(ALL_ECOSYSTEMS);
 
 // Purl types accepted by Coana's reachability `--purl-types` gate
@@ -6635,7 +6708,7 @@ function getNpmRequire() {
   if (_npmRequire === undefined) {
     const npmDirPath = getNpmDirPath();
     const npmNmPath = path.join(npmDirPath, `${constants.NODE_MODULES}/npm`);
-    _npmRequire = require$$5.createRequire(path.join(fs.existsSync(npmNmPath) ? npmNmPath : npmDirPath, '<dummy-basename>'));
+    _npmRequire = require$$1.createRequire(path.join(fs.existsSync(npmNmPath) ? npmNmPath : npmDirPath, '<dummy-basename>'));
   }
   return _npmRequire;
 }
@@ -6687,7 +6760,7 @@ function shadowNpmInstall(options) {
     __proto__: null,
     ...options
   };
-  const useDebug = require$$9.isDebug('stdio');
+  const useDebug = debug$2.isDebug('stdio');
   const terminatorPos = args.indexOf('--');
   const rawBinArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos);
   const binArgs = rawBinArgs.filter(a => !agent.isNpmAuditFlag(a) && !agent.isNpmFundFlag(a) && !agent.isNpmProgressFlag(a));
@@ -6695,12 +6768,12 @@ function shadowNpmInstall(options) {
   const progressArg = rawBinArgs.findLast(agent.isNpmProgressFlag) !== '--no-progress';
   const isSilent = !useDebug && !binArgs.some(agent.isNpmLoglevelFlag);
   const logLevelArgs = isSilent ? [constants.FLAG_LOGLEVEL, 'silent'] : [];
-  const useIpc = require$$11.isObject(ipc);
+  const useIpc = objects.isObject(ipc);
 
   // Include 'ipc' in the spawnOpts.stdio when an options.ipc object is provided.
   // See https://github.com/nodejs/node/blob/v23.6.0/lib/child_process.js#L161-L166
   // and https://github.com/nodejs/node/blob/v23.6.0/lib/internal/child_process.js#L238.
-  let stdio = require$$11.getOwn(spawnOpts, 'stdio');
+  let stdio = objects.getOwn(spawnOpts, 'stdio');
   if (typeof stdio === 'string') {
     stdio = useIpc ? [stdio, stdio, stdio, 'ipc'] : [stdio, stdio, stdio];
   } else if (Array.isArray(stdio)) {
@@ -6722,7 +6795,7 @@ function shadowNpmInstall(options) {
     env: {
       ...process.env,
       ...constants.default.processEnv,
-      ...require$$11.getOwn(spawnOpts, 'env')
+      ...objects.getOwn(spawnOpts, 'env')
     },
     spinner,
     stdio
@@ -6803,7 +6876,7 @@ function runAgentInstall(pkgEnvDetails, options) {
         CI: '1'
       } : {}),
       NODE_OPTIONS: cmdFlagsToString([...(skipNodeHardenFlags ? [] : constants.default.nodeHardenFlags), ...constants.default.nodeNoWarningsFlags]),
-      ...require$$11.getOwn(spawnOpts, 'env')
+      ...objects.getOwn(spawnOpts, 'env')
     }
   });
 }
@@ -6985,7 +7058,7 @@ async function getAgentExecPath(agent) {
 async function getAgentVersion(agent, agentExecPath, cwd) {
   let result;
   const quotedCmd = `\`${agent} ${constants.FLAG_VERSION}\``;
-  require$$9.debugFn('stdio', `spawn: ${quotedCmd}`);
+  debug$2.debugFn('stdio', `spawn: ${quotedCmd}`);
   try {
     let stdout;
 
@@ -7001,8 +7074,8 @@ async function getAgentVersion(agent, agentExecPath, cwd) {
           shouldRunWithNode = resolved;
         }
       } catch (e) {
-        require$$9.debugFn('warn', `Failed to resolve bin path for ${agentExecPath}, falling back to direct spawn.`);
-        require$$9.debugDir('error', e);
+        debug$2.debugFn('warn', `Failed to resolve bin path for ${agentExecPath}, falling back to direct spawn.`);
+        debug$2.debugDir('error', e);
       }
     }
     if (shouldRunWithNode) {
@@ -7024,11 +7097,11 @@ async function getAgentVersion(agent, agentExecPath, cwd) {
     // and tildes (~).
     vendor.semverExports.coerce(stdout) ?? undefined;
   } catch (e) {
-    require$$9.debugFn('error', `Package manager command failed: ${quotedCmd}`);
-    require$$9.debugDir('inspect', {
+    debug$2.debugFn('error', `Package manager command failed: ${quotedCmd}`);
+    debug$2.debugDir('inspect', {
       cmd: quotedCmd
     });
-    require$$9.debugDir('error', e);
+    debug$2.debugDir('error', e);
   }
   return result;
 }
@@ -7557,7 +7630,7 @@ function toFilterConfig(obj) {
   const normalized = {
     __proto__: null
   };
-  const keys = require$$11.isObject(obj) ? Object.keys(obj) : [];
+  const keys = objects.isObject(obj) ? Object.keys(obj) : [];
   for (const key of keys) {
     const value = obj[key];
     if (typeof value === 'boolean' || Array.isArray(value)) {
@@ -7610,7 +7683,7 @@ function parsePnpmLockfile(lockfileContent) {
       result = vendor.jsYaml.load(strings.stripBom(lockfileContent));
     } catch {}
   }
-  return require$$11.isObjectObject(result) ? result : null;
+  return objects.isObjectObject(result) ? result : null;
 }
 async function readPnpmLockfile(lockfilePath) {
   return fs.existsSync(lockfilePath) ? await fs$1.readFileUtf8(lockfilePath) : undefined;
@@ -7711,7 +7784,7 @@ class ColorOrMarkdown {
   }
 }
 
-const require$1 = require$$5.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('utils.js', document.baseURI).href)));
+const require$1 = require$$1.createRequire((typeof document === 'undefined' ? require$$0$1.pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('utils.js', document.baseURI).href)));
 let _translations;
 function getTranslations() {
   if (_translations === undefined) {
@@ -7821,8 +7894,13 @@ async function addArtifactToAlertsMap(artifact, alertsByPurl, options) {
     blocked: true,
     critical: true,
     cve: true,
-    ...require$$11.getOwn(options, 'filter')
+    ...objects.getOwn(options, 'filter')
   });
+
+  // `issueRules` is a user-provided YAML map typed as
+  // `{ [issueName: string]: boolean }`, so key by `string` here. A string
+  // index signature also keeps the `enabledState[alert.type]` lookup below
+  // well-typed regardless of how `alert.type` resolves.
   const enabledState = {
     __proto__: null,
     ...socketYml?.issueRules
@@ -7841,7 +7919,7 @@ async function addArtifactToAlertsMap(artifact, alertsByPurl, options) {
     const fixableCve = fixType === ALERT_FIX_TYPE.cve;
     const fixableUpgrade = fixType === ALERT_FIX_TYPE.upgrade;
     const fixable = fixableCve || fixableUpgrade;
-    const upgradable = fixableUpgrade && !require$$11.hasOwn(overrides, name);
+    const upgradable = fixableUpgrade && !objects.hasOwn(overrides, name);
     if (filterConfig.blocked && blocked || filterConfig.critical && critical || filterConfig.cve && cve || filterConfig.fixable && fixable || filterConfig.upgradable && upgradable) {
       sockPkgAlerts.push({
         name,
@@ -8115,7 +8193,7 @@ async function getAlertsMapFromPnpmLockfile(lockfile, options) {
 }
 async function getAlertsMapFromPurls(purls, options) {
   const uniqPurls = arrays.arrayUnique(purls);
-  require$$9.debugDir('silly', {
+  debug$2.debugDir('silly', {
     purls: uniqPurls
   });
   let {
@@ -8130,7 +8208,7 @@ async function getAlertsMapFromPurls(purls, options) {
     consolidate: false,
     nothrow: false,
     ...options,
-    filter: toFilterConfig(require$$11.getOwn(options, 'filter'))
+    filter: toFilterConfig(objects.getOwn(options, 'filter'))
   };
   if (opts.onlyFixable) {
     opts.filter.fixable = true;
@@ -8188,7 +8266,7 @@ async function getAlertsMapFromPurls(purls, options) {
       } else {
         spinner?.stop();
         logger.logger.fail(`Received a ${batchResult.status} response from Socket API which we consider a permanent failure:`, batchResult.error, batchResult.cause ? `( ${batchResult.cause} )` : '');
-        require$$9.debugDir('inspect', {
+        debug$2.debugDir('inspect', {
           batchResult
         });
         break;
@@ -8444,6 +8522,7 @@ exports.parsePnpmLockfile = parsePnpmLockfile;
 exports.parseReachEcosystems = parseReachEcosystems;
 exports.queryApiSafeJson = queryApiSafeJson;
 exports.queryApiSafeText = queryApiSafeText;
+exports.queryApiSafeTextWithStatus = queryApiSafeTextWithStatus;
 exports.readOrDefaultSocketJson = readOrDefaultSocketJson;
 exports.readOrDefaultSocketJsonUp = readOrDefaultSocketJsonUp;
 exports.readPnpmLockfile = readPnpmLockfile;
@@ -8475,6 +8554,7 @@ exports.trackSubprocessStart = trackSubprocessStart;
 exports.updateConfigValue = updateConfigValue;
 exports.walkNestedMap = walkNestedMap;
 exports.webLink = webLink;
+exports.withTmpDir = withTmpDir;
 exports.writeSocketJson = writeSocketJson;
-//# debugId=bf048db6-ceb2-4c98-8a9a-6ee5233d9cc5
+//# debugId=42fc0b13-4cfc-491d-a46f-94274b113cbc
 //# sourceMappingURL=utils.js.map