@socketsecurity/cli-with-sentry 1.1.19 → 1.1.20

package/dist/constants.js

@@ -188,6 +188,9 @@ function getNpmStdioPipeOptions() {
   if (_npmStdioPipeOptions === undefined) {
     _npmStdioPipeOptions = {
       cwd: process.cwd(),
+      // On Windows, npm is often a .cmd file that requires shell execution.
+      // The spawn function from @socketsecurity/registry will handle this properly
+      // when shell is true.
       shell: constants.WIN32
     };
   }
@@ -268,10 +271,10 @@ const LAZY_ENV = () => {
     INLINED_SOCKET_CLI_SYNP_VERSION: envAsString("1.9.14"),
     // Comp-time inlined Socket package version.
     // The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_VERSION']".
-    INLINED_SOCKET_CLI_VERSION: envAsString("1.1.19"),
+    INLINED_SOCKET_CLI_VERSION: envAsString("1.1.20"),
     // Comp-time inlined Socket package version hash.
     // The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_VERSION_HASH']".
-    INLINED_SOCKET_CLI_VERSION_HASH: envAsString("1.1.19:8c4fe5b:5f8a1a3d:pub"),
+    INLINED_SOCKET_CLI_VERSION_HASH: envAsString("1.1.20:092bf7f:324ffae9:pub"),
     // Enable the module compile cache for the Node.js instance.
     // https://nodejs.org/api/cli.html#node_compile_cachedir
     NODE_COMPILE_CACHE: constants.SUPPORTS_NODE_COMPILE_CACHE_ENV_VAR ? constants.socketCachePath : '',
@@ -814,5 +817,5 @@ exports.YARN_BERRY = YARN_BERRY;
 exports.YARN_CLASSIC = YARN_CLASSIC;
 exports.YARN_LOCK = YARN_LOCK;
 exports.default = constants;
-//# debugId=2ef361f8-a635-4a7e-ae8d-4b7917ed6566
+//# debugId=c1920328-8086-4fc1-a542-3b0b654e3cc8
 //# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sources":["../src/constants.mts"],"sourcesContent":["import { realpathSync } from 'node:fs'\nimport { createRequire } from 'node:module'\nimport os from 'node:os'\nimport path from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nimport registryConstants from '@socketsecurity/registry/lib/constants'\n\nimport type { Agent } from './utils/package-environment.mts'\nimport type { Remap } from '@socketsecurity/registry/lib/objects'\nimport type { SpawnOptions } from '@socketsecurity/registry/lib/spawn'\n\nconst require = createRequire(import.meta.url)\nconst __filename = fileURLToPath(import.meta.url)\n// Using `path.dirname(__filename)` to resolve `__dirname` works for both 'dist'\n// AND 'src' directories because constants.js and constants.mts respectively are\n// in the root of each.\nconst __dirname = path.dirname(__filename)\n\nconst {\n  AT_LATEST,\n  BIOME_JSON,\n  BUN,\n  CI,\n  COLUMN_LIMIT,\n  DOT_GIT_DIR,\n  DOT_SOCKET_DIR,\n  EMPTY_FILE,\n  EMPTY_VALUE,\n  ESLINT_CONFIG_JS,\n  ESNEXT,\n  EXT_CJS,\n  EXT_CMD,\n  EXT_CTS,\n  EXT_DTS,\n  EXT_JS,\n  EXT_JSON,\n  EXT_LOCK,\n  EXT_LOCKB,\n  EXT_MD,\n  EXT_MJS,\n  EXT_MTS,\n  EXT_PS1,\n  EXT_YAML,\n  EXT_YML,\n  EXTENSIONS,\n  EXTENSIONS_JSON,\n  GITIGNORE,\n  DOT_PACKAGE_LOCK_JSON,\n  LATEST,\n  LICENSE,\n  LICENSE_GLOB,\n  LICENSE_GLOB_RECURSIVE,\n  LICENSE_ORIGINAL,\n  LICENSE_ORIGINAL_GLOB,\n  LICENSE_ORIGINAL_GLOB_RECURSIVE,\n  LOOP_SENTINEL,\n  MANIFEST_JSON,\n  MIT,\n  NODE_AUTH_TOKEN,\n  NODE_ENV,\n  NODE_MODULES,\n  NODE_MODULES_GLOB_RECURSIVE,\n  NPM,\n  NPX,\n  OVERRIDES,\n  PACKAGE_DEFAULT_VERSION,\n  PACKAGE_JSON,\n  PACKAGE_LOCK_JSON,\n  PNPM,\n  PNPM_LOCK_YAML,\n  PRE_COMMIT,\n  README_GLOB,\n  README_GLOB_RECURSIVE,\n  REGISTRY_SCOPE_DELIMITER,\n  README_MD,\n  REGISTRY,\n  RESOLUTIONS,\n  SOCKET_GITHUB_ORG,\n  SOCKET_IPC_HANDSHAKE,\n  SOCKET_OVERRIDE_SCOPE,\n  SOCKET_PUBLIC_API_TOKEN,\n  SOCKET_REGISTRY_NPM_ORG,\n  SOCKET_REGISTRY_PACKAGE_NAME,\n  SOCKET_REGISTRY_REPO_NAME,\n  SOCKET_REGISTRY_SCOPE,\n  SOCKET_SECURITY_SCOPE,\n  TSCONFIG_JSON,\n  UNKNOWN_ERROR,\n  UNKNOWN_VALUE,\n  UNLICENCED,\n  UNLICENSED,\n  UTF8,\n  VITEST,\n  VLT,\n  YARN,\n  YARN_BERRY,\n  YARN_CLASSIC,\n  YARN_LOCK,\n  kInternalsSymbol,\n  [kInternalsSymbol as unknown as 'Symbol(kInternalsSymbol)']: {\n    attributes: registryConstantsAttribs,\n    createConstantsObject,\n    getIpc,\n  },\n} = registryConstants\n\nexport type RegistryEnv = typeof registryConstants.ENV\n\nexport type RegistryInternals =\n  (typeof registryConstants)['Symbol(kInternalsSymbol)']\n\nexport type Sentry = any\n\nexport type Internals = Remap<\n  Omit<RegistryInternals, 'getIpc'> &\n    Readonly<{\n      getIpc: {\n        (): Promise<IpcObject>\n        <K extends keyof IpcObject | undefined>(\n          key?: K | undefined,\n        ): Promise<K extends keyof IpcObject ? IpcObject[K] : IpcObject>\n      }\n      getSentry: () => Sentry\n      setSentry(Sentry: Sentry): boolean\n    }>\n>\n\nexport type ENV = Remap<\n  RegistryEnv &\n    Readonly<{\n      DISABLE_GITHUB_CACHE: boolean\n      GITHUB_API_URL: string\n      GITHUB_BASE_REF: string\n      GITHUB_REF_NAME: string\n      GITHUB_REF_TYPE: string\n      GITHUB_REPOSITORY: string\n      GITHUB_SERVER_URL: string\n      GITHUB_TOKEN: string\n      INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION: string\n      INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION: string\n      INLINED_SOCKET_CLI_HOMEPAGE: string\n      INLINED_SOCKET_CLI_LEGACY_BUILD: string\n      INLINED_SOCKET_CLI_NAME: string\n      INLINED_SOCKET_CLI_PUBLISHED_BUILD: string\n      INLINED_SOCKET_CLI_SENTRY_BUILD: string\n      INLINED_SOCKET_CLI_VERSION: string\n      INLINED_SOCKET_CLI_VERSION_HASH: string\n      INLINED_SOCKET_CLI_SYNP_VERSION: string\n      LOCALAPPDATA: string\n      NODE_COMPILE_CACHE: string\n      NODE_EXTRA_CA_CERTS: string\n      PATH: string\n      SOCKET_CLI_ACCEPT_RISKS: boolean\n      SOCKET_CLI_API_BASE_URL: string\n      SOCKET_CLI_API_PROXY: string\n      SOCKET_CLI_API_TIMEOUT: number\n      SOCKET_CLI_API_TOKEN: string\n      SOCKET_CLI_CONFIG: string\n      SOCKET_CLI_GIT_USER_EMAIL: string\n      SOCKET_CLI_GIT_USER_NAME: string\n      SOCKET_CLI_GITHUB_TOKEN: string\n      SOCKET_CLI_NO_API_TOKEN: boolean\n      SOCKET_CLI_NPM_PATH: string\n      SOCKET_CLI_ORG_SLUG: string\n      SOCKET_CLI_VIEW_ALL_RISKS: boolean\n      TERM: string\n      XDG_DATA_HOME: string\n    }>\n>\n\nexport type IpcObject = Readonly<{\n  SOCKET_CLI_FIX?: string | undefined\n  SOCKET_CLI_OPTIMIZE?: boolean | undefined\n  SOCKET_CLI_SHADOW_ACCEPT_RISKS?: boolean | undefined\n  SOCKET_CLI_SHADOW_API_TOKEN?: string | undefined\n  SOCKET_CLI_SHADOW_BIN?: string | undefined\n  SOCKET_CLI_SHADOW_PROGRESS?: boolean | undefined\n  SOCKET_CLI_SHADOW_SILENT?: boolean | undefined\n}>\n\nexport type ProcessEnv = {\n  [K in keyof ENV]?: string | undefined\n}\n\n// Socket CLI specific constants that are not in socket-registry.\nconst ALERT_TYPE_CRITICAL_CVE = 'criticalCVE'\nconst ALERT_TYPE_CVE = 'cve'\nconst ALERT_TYPE_MEDIUM_CVE = 'mediumCVE'\nconst ALERT_TYPE_MILD_CVE = 'mildCVE'\nconst API_V0_URL = 'https://api.socket.dev/v0/'\nconst CONFIG_KEY_API_BASE_URL = 'apiBaseUrl'\nconst CONFIG_KEY_API_PROXY = 'apiProxy'\nconst CONFIG_KEY_API_TOKEN = 'apiToken'\nconst CONFIG_KEY_DEFAULT_ORG = 'defaultOrg'\nconst CONFIG_KEY_ENFORCED_ORGS = 'enforcedOrgs'\nconst CONFIG_KEY_ORG = 'org'\nconst DOT_SOCKET_DOT_FACTS_JSON = `${DOT_SOCKET_DIR}.facts.json`\nconst DRY_RUN_LABEL = '[DryRun]'\nconst DRY_RUN_BAILING_NOW = `${DRY_RUN_LABEL}: Bailing now`\nconst DRY_RUN_NOT_SAVING = `${DRY_RUN_LABEL}: Not saving`\nconst ENVIRONMENT_YAML = 'environment.yaml'\nconst ENVIRONMENT_YML = 'environment.yml'\nconst ERROR_NO_MANIFEST_FILES = 'No manifest files found'\nconst ERROR_NO_PACKAGE_JSON = 'No package.json found'\nconst ERROR_NO_REPO_FOUND = 'No repo found'\nconst ERROR_NO_SOCKET_DIR = 'No .socket directory found'\nconst ERROR_UNABLE_RESOLVE_ORG =\n  'Unable to resolve a Socket account organization'\nconst FLAG_CONFIG = '--config'\nconst FLAG_DRY_RUN = '--dry-run'\nconst FLAG_HELP = '--help'\nconst FLAG_ID = '--id'\nconst FLAG_JSON = '--json'\nconst FLAG_MARKDOWN = '--markdown'\nconst FLAG_ORG = '--org'\nconst FLAG_PIN = '--pin'\nconst FLAG_PROD = '--prod'\nconst FLAG_QUIET = '--quiet'\nconst FLAG_SILENT = '--silent'\nconst FLAG_TEXT = '--text'\nconst FLAG_VERBOSE = '--verbose'\nconst FLAG_VERSION = '--version'\nconst FOLD_SETTING_FILE = 'file'\nconst FOLD_SETTING_NONE = 'none'\nconst FOLD_SETTING_PKG = 'pkg'\nconst FOLD_SETTING_VERSION = 'version'\nconst GQL_PAGE_SENTINEL = 100\nconst GQL_PR_STATE_CLOSED = 'CLOSED'\nconst GQL_PR_STATE_MERGED = 'MERGED'\nconst GQL_PR_STATE_OPEN = 'OPEN'\nconst HTTP_STATUS_BAD_REQUEST = 400\nconst HTTP_STATUS_FORBIDDEN = 403\nconst HTTP_STATUS_INTERNAL_SERVER_ERROR = 500\nconst HTTP_STATUS_NOT_FOUND = 404\nconst HTTP_STATUS_UNAUTHORIZED = 401\nconst NPM_BUGGY_OVERRIDES_PATCHED_VERSION = '11.2.0'\nconst NPM_REGISTRY_URL = 'https://registry.npmjs.org'\nconst OUTPUT_JSON = 'json'\nconst OUTPUT_MARKDOWN = 'markdown'\nconst OUTPUT_TEXT = 'text'\nconst PNPM_WORKSPACE_YAML = 'pnpm-workspace.yaml'\nconst REDACTED = '<redacted>'\nconst REPORT_LEVEL_DEFER = 'defer'\nconst REPORT_LEVEL_ERROR = 'error'\nconst REPORT_LEVEL_IGNORE = 'ignore'\nconst REPORT_LEVEL_MONITOR = 'monitor'\nconst REPORT_LEVEL_WARN = 'warn'\nconst REQUIREMENTS_TXT = 'requirements.txt'\nconst SOCKET_CLI_ACCEPT_RISKS = 'SOCKET_CLI_ACCEPT_RISKS'\nconst SOCKET_CLI_BIN_NAME = 'socket'\nconst SOCKET_CLI_ISSUES_URL = 'https://github.com/SocketDev/socket-cli/issues'\nconst SOCKET_CLI_SHADOW_ACCEPT_RISKS = 'SOCKET_CLI_SHADOW_ACCEPT_RISKS'\nconst SOCKET_CLI_SHADOW_API_TOKEN = 'SOCKET_CLI_SHADOW_API_TOKEN'\nconst SOCKET_CLI_SHADOW_BIN = 'SOCKET_CLI_SHADOW_BIN'\nconst SOCKET_CLI_SHADOW_PROGRESS = 'SOCKET_CLI_SHADOW_PROGRESS'\nconst SOCKET_CLI_SHADOW_SILENT = 'SOCKET_CLI_SHADOW_SILENT'\nconst SOCKET_CLI_VIEW_ALL_RISKS = 'SOCKET_CLI_VIEW_ALL_RISKS'\nconst SOCKET_DEFAULT_BRANCH = 'socket-default-branch'\nconst SOCKET_DEFAULT_REPOSITORY = 'socket-default-repository'\nconst SOCKET_JSON = 'socket.json'\nconst SOCKET_WEBSITE_URL = 'https://socket.dev'\nconst SOCKET_YAML = 'socket.yaml'\nconst SOCKET_YML = 'socket.yml'\nconst V1_MIGRATION_GUIDE_URL = 'https://docs.socket.dev/docs/v1-migration-guide'\n\nexport type Constants = Remap<\n  Omit<\n    typeof registryConstants,\n    'Symbol(kInternalsSymbol)' | 'ENV' | 'ipcObject'\n  > & {\n    readonly 'Symbol(kInternalsSymbol)': Internals\n    readonly ALERT_TYPE_CRITICAL_CVE: typeof ALERT_TYPE_CRITICAL_CVE\n    readonly ALERT_TYPE_CVE: typeof ALERT_TYPE_CVE\n    readonly ALERT_TYPE_MEDIUM_CVE: typeof ALERT_TYPE_MEDIUM_CVE\n    readonly ALERT_TYPE_MILD_CVE: typeof ALERT_TYPE_MILD_CVE\n    readonly API_V0_URL: typeof API_V0_URL\n    readonly BUN: typeof BUN\n    readonly CONFIG_KEY_API_BASE_URL: typeof CONFIG_KEY_API_BASE_URL\n    readonly CONFIG_KEY_API_PROXY: typeof CONFIG_KEY_API_PROXY\n    readonly CONFIG_KEY_API_TOKEN: typeof CONFIG_KEY_API_TOKEN\n    readonly CONFIG_KEY_DEFAULT_ORG: typeof CONFIG_KEY_DEFAULT_ORG\n    readonly CONFIG_KEY_ENFORCED_ORGS: typeof CONFIG_KEY_ENFORCED_ORGS\n    readonly CONFIG_KEY_ORG: typeof CONFIG_KEY_ORG\n    readonly DOT_GIT_DIR: typeof DOT_GIT_DIR\n    readonly DOT_SOCKET_DIR: typeof DOT_SOCKET_DIR\n    readonly DOT_SOCKET_DOT_FACTS_JSON: typeof DOT_SOCKET_DOT_FACTS_JSON\n    readonly DRY_RUN_BAILING_NOW: typeof DRY_RUN_BAILING_NOW\n    readonly DRY_RUN_LABEL: typeof DRY_RUN_LABEL\n    readonly DRY_RUN_NOT_SAVING: typeof DRY_RUN_NOT_SAVING\n    readonly EMPTY_VALUE: typeof EMPTY_VALUE\n    readonly ENV: ENV\n    readonly ENVIRONMENT_YAML: typeof ENVIRONMENT_YAML\n    readonly ENVIRONMENT_YML: typeof ENVIRONMENT_YML\n    readonly ERROR_NO_MANIFEST_FILES: typeof ERROR_NO_MANIFEST_FILES\n    readonly ERROR_NO_PACKAGE_JSON: typeof ERROR_NO_PACKAGE_JSON\n    readonly ERROR_NO_REPO_FOUND: typeof ERROR_NO_REPO_FOUND\n    readonly ERROR_NO_SOCKET_DIR: typeof ERROR_NO_SOCKET_DIR\n    readonly ERROR_UNABLE_RESOLVE_ORG: typeof ERROR_UNABLE_RESOLVE_ORG\n    readonly EXT_YAML: typeof EXT_YAML\n    readonly EXT_YML: typeof EXT_YML\n    readonly FLAG_CONFIG: typeof FLAG_CONFIG\n    readonly FLAG_DRY_RUN: typeof FLAG_DRY_RUN\n    readonly FLAG_HELP: typeof FLAG_HELP\n    readonly FLAG_ID: typeof FLAG_ID\n    readonly FLAG_JSON: typeof FLAG_JSON\n    readonly FLAG_MARKDOWN: typeof FLAG_MARKDOWN\n    readonly FLAG_ORG: typeof FLAG_ORG\n    readonly FLAG_PIN: typeof FLAG_PIN\n    readonly FLAG_PROD: typeof FLAG_PROD\n    readonly FLAG_QUIET: typeof FLAG_QUIET\n    readonly FLAG_SILENT: typeof FLAG_SILENT\n    readonly FLAG_TEXT: typeof FLAG_TEXT\n    readonly FLAG_VERBOSE: typeof FLAG_VERBOSE\n    readonly FLAG_VERSION: typeof FLAG_VERSION\n    readonly FOLD_SETTING_FILE: typeof FOLD_SETTING_FILE\n    readonly FOLD_SETTING_NONE: typeof FOLD_SETTING_NONE\n    readonly FOLD_SETTING_PKG: typeof FOLD_SETTING_PKG\n    readonly FOLD_SETTING_VERSION: typeof FOLD_SETTING_VERSION\n    readonly GQL_PAGE_SENTINEL: typeof GQL_PAGE_SENTINEL\n    readonly GQL_PR_STATE_CLOSED: typeof GQL_PR_STATE_CLOSED\n    readonly GQL_PR_STATE_MERGED: typeof GQL_PR_STATE_MERGED\n    readonly GQL_PR_STATE_OPEN: typeof GQL_PR_STATE_OPEN\n    readonly HTTP_STATUS_BAD_REQUEST: typeof HTTP_STATUS_BAD_REQUEST\n    readonly HTTP_STATUS_FORBIDDEN: typeof HTTP_STATUS_FORBIDDEN\n    readonly HTTP_STATUS_INTERNAL_SERVER_ERROR: typeof HTTP_STATUS_INTERNAL_SERVER_ERROR\n    readonly HTTP_STATUS_NOT_FOUND: typeof HTTP_STATUS_NOT_FOUND\n    readonly HTTP_STATUS_UNAUTHORIZED: typeof HTTP_STATUS_UNAUTHORIZED\n    readonly NODE_MODULES: typeof NODE_MODULES\n    readonly NPM: typeof NPM\n    readonly NPM_BUGGY_OVERRIDES_PATCHED_VERSION: typeof NPM_BUGGY_OVERRIDES_PATCHED_VERSION\n    readonly NPM_REGISTRY_URL: typeof NPM_REGISTRY_URL\n    readonly NPX: typeof NPX\n    readonly OUTPUT_JSON: typeof OUTPUT_JSON\n    readonly OUTPUT_MARKDOWN: typeof OUTPUT_MARKDOWN\n    readonly OUTPUT_TEXT: typeof OUTPUT_TEXT\n    readonly PACKAGE_JSON: typeof PACKAGE_JSON\n    readonly PACKAGE_LOCK_JSON: typeof PACKAGE_LOCK_JSON\n    readonly PNPM: typeof PNPM\n    readonly PNPM_LOCK_YAML: typeof PNPM_LOCK_YAML\n    readonly PNPM_WORKSPACE_YAML: typeof PNPM_WORKSPACE_YAML\n    readonly REDACTED: typeof REDACTED\n    readonly REPORT_LEVEL_DEFER: typeof REPORT_LEVEL_DEFER\n    readonly REPORT_LEVEL_ERROR: typeof REPORT_LEVEL_ERROR\n    readonly REPORT_LEVEL_IGNORE: typeof REPORT_LEVEL_IGNORE\n    readonly REPORT_LEVEL_MONITOR: typeof REPORT_LEVEL_MONITOR\n    readonly REPORT_LEVEL_WARN: typeof REPORT_LEVEL_WARN\n    readonly REQUIREMENTS_TXT: typeof REQUIREMENTS_TXT\n    readonly SOCKET_CLI_ACCEPT_RISKS: typeof SOCKET_CLI_ACCEPT_RISKS\n    readonly SOCKET_CLI_BIN_NAME: typeof SOCKET_CLI_BIN_NAME\n    readonly SOCKET_CLI_ISSUES_URL: typeof SOCKET_CLI_ISSUES_URL\n    readonly SOCKET_CLI_SHADOW_ACCEPT_RISKS: typeof SOCKET_CLI_SHADOW_ACCEPT_RISKS\n    readonly SOCKET_CLI_SHADOW_API_TOKEN: typeof SOCKET_CLI_SHADOW_API_TOKEN\n    readonly SOCKET_CLI_SHADOW_BIN: typeof SOCKET_CLI_SHADOW_BIN\n    readonly SOCKET_CLI_SHADOW_PROGRESS: typeof SOCKET_CLI_SHADOW_PROGRESS\n    readonly SOCKET_CLI_SHADOW_SILENT: typeof SOCKET_CLI_SHADOW_SILENT\n    readonly SOCKET_CLI_VIEW_ALL_RISKS: typeof SOCKET_CLI_VIEW_ALL_RISKS\n    readonly SOCKET_DEFAULT_BRANCH: typeof SOCKET_DEFAULT_BRANCH\n    readonly SOCKET_DEFAULT_REPOSITORY: typeof SOCKET_DEFAULT_REPOSITORY\n    readonly SOCKET_JSON: typeof SOCKET_JSON\n    readonly SOCKET_WEBSITE_URL: typeof SOCKET_WEBSITE_URL\n    readonly SOCKET_YAML: typeof SOCKET_YAML\n    readonly SOCKET_YML: typeof SOCKET_YML\n    readonly TSCONFIG_JSON: typeof TSCONFIG_JSON\n    readonly UNKNOWN_ERROR: typeof UNKNOWN_ERROR\n    readonly UNKNOWN_VALUE: typeof UNKNOWN_VALUE\n    readonly V1_MIGRATION_GUIDE_URL: typeof V1_MIGRATION_GUIDE_URL\n    readonly VLT: typeof VLT\n    readonly YARN: typeof YARN\n    readonly YARN_BERRY: typeof YARN_BERRY\n    readonly YARN_CLASSIC: typeof YARN_CLASSIC\n    readonly bashRcPath: string\n    readonly binCliPath: string\n    readonly binPath: string\n    readonly blessedContribPath: string\n    readonly blessedOptions: {\n      smartCSR: boolean\n      term: string\n      useBCE: boolean\n    }\n    readonly blessedPath: string\n    readonly distCliPath: string\n    readonly distPath: string\n    readonly externalPath: string\n    readonly githubCachePath: string\n    readonly homePath: string\n    readonly instrumentWithSentryPath: string\n    readonly ipcObject: IpcObject\n    readonly minimumVersionByAgent: Map<Agent, string>\n    readonly nmBinPath: string\n    readonly nodeDebugFlags: string[]\n    readonly nodeHardenFlags: string[]\n    readonly nodeMemoryFlags: string[]\n    readonly npmCachePath: string\n    readonly npmGlobalPrefix: string\n    readonly npmNmNodeGypPath: string\n    readonly processEnv: ProcessEnv\n    readonly rootPath: string\n    readonly shadowBinPath: string\n    readonly shadowNpmBinPath: string\n    readonly shadowNpmInjectPath: string\n    readonly shadowNpxBinPath: string\n    readonly shadowPnpmBinPath: string\n    readonly shadowYarnBinPath: string\n    readonly socketAppDataPath: string\n    readonly socketCachePath: string\n    readonly socketRegistryPath: string\n    readonly zshRcPath: string\n  }\n>\n\nlet _Sentry: any\n\nlet _npmStdioPipeOptions: SpawnOptions | undefined\nfunction getNpmStdioPipeOptions() {\n  if (_npmStdioPipeOptions === undefined) {\n    _npmStdioPipeOptions = {\n      cwd: process.cwd(),\n      shell: constants.WIN32,\n    }\n  }\n  return _npmStdioPipeOptions\n}\n\nconst LAZY_ENV = () => {\n  const { env } = process\n  const envHelpers = /*@__PURE__*/ require('@socketsecurity/registry/lib/env')\n  const utils = /*@__PURE__*/ require(\n    path.join(constants.rootPath, 'dist/utils.js'),\n  )\n  const envAsBoolean = envHelpers.envAsBoolean\n  const envAsNumber = envHelpers.envAsNumber\n  const envAsString = envHelpers.envAsString\n  const getConfigValueOrUndef = utils.getConfigValueOrUndef\n  const readOrDefaultSocketJson = utils.readOrDefaultSocketJson\n  const GITHUB_TOKEN = envAsString(env['GITHUB_TOKEN'])\n  const INLINED_SOCKET_CLI_PUBLISHED_BUILD = envAsBoolean(\n    process.env['INLINED_SOCKET_CLI_PUBLISHED_BUILD'],\n  )\n  // We inline some environment values so that they CANNOT be influenced by user\n  // provided environment variables.\n  return Object.freeze({\n    __proto__: null,\n    // Lazily access registryConstants.ENV.\n    ...registryConstants.ENV,\n    // Disable using GitHub's workflow actions/cache.\n    // https://github.com/actions/cache\n    DISABLE_GITHUB_CACHE: envAsBoolean(env['DISABLE_GITHUB_CACHE']),\n    // The API URL. For example, https://api.github.com.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_API_URL:\n      envAsString(env['GITHUB_API_URL']) || 'https://api.github.com',\n    // The name of the base ref or target branch of the pull request in a workflow\n    // run. This is only set when the event that triggers a workflow run is either\n    // pull_request or pull_request_target. For example, main.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_BASE_REF: envAsString(env['GITHUB_BASE_REF']),\n    // The short ref name of the branch or tag that triggered the GitHub workflow\n    // run. This value matches the branch or tag name shown on GitHub. For example,\n    // feature-branch-1. For pull requests, the format is <pr_number>/merge.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_REF_NAME: envAsString(env['GITHUB_REF_NAME']),\n    // The type of ref that triggered the workflow run. Valid values are branch or tag.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_REF_TYPE: envAsString(env['GITHUB_REF_TYPE']),\n    // The owner and repository name. For example, octocat/Hello-World.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_REPOSITORY: envAsString(env['GITHUB_REPOSITORY']),\n    // The URL of the GitHub server. For example, https://github.com.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_SERVER_URL:\n      envAsString(env['GITHUB_SERVER_URL']) || 'https://github.com',\n    // The GITHUB_TOKEN secret is a GitHub App installation access token.\n    // The token's permissions are limited to the repository that contains the\n    // workflow.\n    // https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#about-the-github_token-secret\n    GITHUB_TOKEN,\n    // Comp-time inlined @coana-tech/cli package version.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION']\".\n    INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION: envAsString(\n      process.env['INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION'],\n    ),\n    // Comp-time inlined @cyclonedx/cdxgen package version.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION']\".\n    INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION: envAsString(\n      process.env['INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION'],\n    ),\n    // Comp-time inlined Socket package homepage.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_HOMEPAGE']\".\n    INLINED_SOCKET_CLI_HOMEPAGE: envAsString(\n      process.env['INLINED_SOCKET_CLI_HOMEPAGE'],\n    ),\n    // Comp-time inlined flag to determine if this is the Legacy build.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_LEGACY_BUILD']\".\n    INLINED_SOCKET_CLI_LEGACY_BUILD: envAsBoolean(\n      process.env['INLINED_SOCKET_CLI_LEGACY_BUILD'],\n    ),\n    // Comp-time inlined Socket package name.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_NAME']\".\n    INLINED_SOCKET_CLI_NAME: envAsString(\n      process.env['INLINED_SOCKET_CLI_NAME'],\n    ),\n    // Comp-time inlined flag to determine if this is a published build.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_PUBLISHED_BUILD']\".\n    INLINED_SOCKET_CLI_PUBLISHED_BUILD,\n    // Comp-time inlined flag to determine if this is the Sentry build.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_SENTRY_BUILD']\".\n    INLINED_SOCKET_CLI_SENTRY_BUILD: envAsBoolean(\n      process.env['INLINED_SOCKET_CLI_SENTRY_BUILD'],\n    ),\n    // Comp-time inlined synp package version.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_SYNP_VERSION']\".\n    INLINED_SOCKET_CLI_SYNP_VERSION: envAsString(\n      process.env['INLINED_SOCKET_CLI_SYNP_VERSION'],\n    ),\n    // Comp-time inlined Socket package version.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_VERSION']\".\n    INLINED_SOCKET_CLI_VERSION: envAsString(\n      process.env['INLINED_SOCKET_CLI_VERSION'],\n    ),\n    // Comp-time inlined Socket package version hash.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_VERSION_HASH']\".\n    INLINED_SOCKET_CLI_VERSION_HASH: envAsString(\n      process.env['INLINED_SOCKET_CLI_VERSION_HASH'],\n    ),\n    // Enable the module compile cache for the Node.js instance.\n    // https://nodejs.org/api/cli.html#node_compile_cachedir\n    NODE_COMPILE_CACHE: constants.SUPPORTS_NODE_COMPILE_CACHE_ENV_VAR\n      ? constants.socketCachePath\n      : '',\n    // Redefine registryConstants.ENV.NODE_ENV to account for the\n    // INLINED_SOCKET_CLI_PUBLISHED_BUILD environment variable.\n    NODE_ENV:\n      envAsString(env['NODE_ENV']).toLowerCase() === 'production'\n        ? 'production'\n        : INLINED_SOCKET_CLI_PUBLISHED_BUILD\n          ? ''\n          : 'development',\n    // Well known \"root\" CAs (like VeriSign) will be extended with the extra\n    // certificates in file. The file should consist of one or more trusted\n    // certificates in PEM format.\n    // https://nodejs.org/api/cli.html#node_extra_ca_certsfile\n    NODE_EXTRA_CA_CERTS:\n      envAsString(env['NODE_EXTRA_CA_CERTS']) ||\n      // Commonly used environment variable to specify the path to a single\n      // PEM-encoded certificate file.\n      envAsString(env['SSL_CERT_FILE']),\n    // PATH is an environment variable that lists directories where executable\n    // programs are located. When a command is run, the system searches these\n    // directories to find the executable.\n    PATH: envAsString(env['PATH']),\n    // Accept risks of a Socket wrapped npm/npx run.\n    SOCKET_CLI_ACCEPT_RISKS: envAsBoolean(env[SOCKET_CLI_ACCEPT_RISKS]),\n    // Change the base URL for Socket API calls.\n    // https://github.com/SocketDev/socket-cli?tab=readme-ov-file#environment-variables-for-development\n    SOCKET_CLI_API_BASE_URL:\n      envAsString(env['SOCKET_CLI_API_BASE_URL']) ||\n      // TODO: Remove legacy environment variable name.\n      envAsString(env['SOCKET_SECURITY_API_BASE_URL']) ||\n      getConfigValueOrUndef('apiBaseUrl') ||\n      API_V0_URL,\n    // Set the proxy that all requests are routed through.\n    // https://github.com/SocketDev/socket-cli?tab=readme-ov-file#environment-variables-for-development\n    SOCKET_CLI_API_PROXY:\n      envAsString(env['SOCKET_CLI_API_PROXY']) ||\n      // TODO: Remove legacy environment variable name.\n      envAsString(env['SOCKET_SECURITY_API_PROXY']) ||\n      // Commonly used environment variables to specify routing requests through\n      // a proxy server.\n      envAsString(env['HTTPS_PROXY']) ||\n      envAsString(env['https_proxy']) ||\n      envAsString(env['HTTP_PROXY']) ||\n      envAsString(env['http_proxy']),\n    // Set the timeout in milliseconds for Socket API requests.\n    // https://nodejs.org/api/http.html#httprequesturl-options-callback\n    SOCKET_CLI_API_TIMEOUT: envAsNumber(env['SOCKET_CLI_API_TIMEOUT']),\n    // Set the Socket API token.\n    // https://github.com/SocketDev/socket-cli?tab=readme-ov-file#environment-variables\n    SOCKET_CLI_API_TOKEN:\n      envAsString(env['SOCKET_CLI_API_TOKEN']) ||\n      // TODO: Remove legacy environment variable names.\n      envAsString(env['SOCKET_CLI_API_KEY']) ||\n      envAsString(env['SOCKET_SECURITY_API_TOKEN']) ||\n      envAsString(env['SOCKET_SECURITY_API_KEY']),\n    // A JSON stringified Socket configuration object.\n    SOCKET_CLI_CONFIG: envAsString(env['SOCKET_CLI_CONFIG']),\n    // The git config user.email used by Socket CLI.\n    SOCKET_CLI_GIT_USER_EMAIL:\n      envAsString(env['SOCKET_CLI_GIT_USER_EMAIL']) ||\n      'github-actions[bot]@users.noreply.github.com',\n    // The git config user.name used by Socket CLI.\n    SOCKET_CLI_GIT_USER_NAME:\n      envAsString(env['SOCKET_CLI_GIT_USER_NAME']) ||\n      envAsString(env['SOCKET_CLI_GIT_USERNAME']) ||\n      'github-actions[bot]',\n    // Change the base URL for GitHub REST API calls.\n    // https://docs.github.com/en/rest\n    SOCKET_CLI_GITHUB_API_URL:\n      envAsString(env['SOCKET_CLI_GITHUB_API_URL']) ||\n      readOrDefaultSocketJson(process.cwd())?.defaults?.scan?.github\n        ?.githubApiUrl ||\n      'https://api.github.com',\n    // A classic GitHub personal access token with the \"repo\" scope or a\n    // fine-grained access token with at least read/write permissions set for\n    // \"Contents\" and \"Pull Request\".\n    // https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens\n    SOCKET_CLI_GITHUB_TOKEN:\n      envAsString(env['SOCKET_CLI_GITHUB_TOKEN']) ||\n      // TODO: Remove undocumented legacy environment variable name.\n      envAsString(env['SOCKET_SECURITY_GITHUB_PAT']) ||\n      GITHUB_TOKEN,\n    // Make the default API token `undefined`.\n    SOCKET_CLI_NO_API_TOKEN: envAsBoolean(env['SOCKET_CLI_NO_API_TOKEN']),\n    // The absolute location of the npm directory.\n    SOCKET_CLI_NPM_PATH: envAsString(env['SOCKET_CLI_NPM_PATH']),\n    // Specify the Socket organization slug.\n    SOCKET_CLI_ORG_SLUG:\n      envAsString(env['SOCKET_CLI_ORG_SLUG']) ||\n      // Coana CLI accepts the SOCKET_ORG_SLUG environment variable.\n      envAsString(env['SOCKET_ORG_SLUG']),\n    // View all risks of a Socket wrapped npm/npx run.\n    SOCKET_CLI_VIEW_ALL_RISKS: envAsBoolean(env[SOCKET_CLI_VIEW_ALL_RISKS]),\n    // Specifies the type of terminal or terminal emulator being used by the process.\n    TERM: envAsString(env['TERM']),\n  })\n}\n\nconst lazyBashRcPath = () => path.join(constants.homePath, '.bashrc')\n\nconst lazyBinPath = () => path.join(constants.rootPath, 'bin')\n\nconst lazyBinCliPath = () => path.join(constants.binPath, 'cli.js')\n\nconst lazyBlessedContribPath = () =>\n  path.join(constants.externalPath, 'blessed-contrib')\n\nconst lazyBlessedOptions = () =>\n  Object.freeze({\n    smartCSR: true,\n    term: constants.WIN32 ? 'windows-ansi' : 'xterm',\n    useBCE: true,\n  })\n\nconst lazyBlessedPath = () => path.join(constants.externalPath, 'blessed')\n\nconst lazyDistCliPath = () => path.join(constants.distPath, 'cli.js')\n\nconst lazyDistPath = () => path.join(constants.rootPath, 'dist')\n\nconst lazyExternalPath = () => path.join(constants.rootPath, 'external')\n\nconst lazyGithubCachePath = () => path.join(constants.socketCachePath, 'github')\n\nconst lazyHomePath = () => os.homedir()\n\nconst lazyInstrumentWithSentryPath = () =>\n  path.join(constants.distPath, 'instrument-with-sentry.js')\n\nconst lazyMinimumVersionByAgent = () =>\n  new Map([\n    // Bun >=1.1.39 supports the text-based lockfile.\n    // https://bun.sh/blog/bun-lock-text-lockfile\n    [BUN, '1.1.39'],\n    // The npm version bundled with Node 18.\n    // https://nodejs.org/en/about/previous-releases#looking-for-the-latest-release-of-a-version-branch\n    [NPM, '10.8.2'],\n    // 8.x is the earliest version to support Node 18.\n    // https://pnpm.io/installation#compatibility\n    // https://www.npmjs.com/package/pnpm?activeTab=versions\n    [PNPM, '8.15.7'],\n    // 4.x supports >= Node 18.12.0\n    // https://github.com/yarnpkg/berry/blob/%40yarnpkg/core/4.1.0/CHANGELOG.md#400\n    [YARN_BERRY, '4.0.0'],\n    // Latest 1.x.\n    // https://www.npmjs.com/package/yarn?activeTab=versions\n    [YARN_CLASSIC, '1.22.22'],\n    // vlt does not support overrides so we don't gate on it.\n    [VLT, '*'],\n  ])\n\nconst lazyNmBinPath = () => path.join(constants.rootPath, 'node_modules/.bin')\n\nconst lazyNodeDebugFlags = () =>\n  constants.ENV.SOCKET_CLI_DEBUG ? ['--trace-uncaught', '--trace-warnings'] : []\n\n// Redefine registryConstants.nodeHardenFlags to account for the\n// INLINED_SOCKET_CLI_SENTRY_BUILD environment variable.\nconst lazyNodeHardenFlags = () =>\n  Object.freeze(\n    // Harden Node security.\n    // https://nodejs.org/en/learn/getting-started/security-best-practices\n    constants.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD || constants.WIN32\n      ? [\n          // https://nodejs.org/api/cli.html#--disallow-code-generation-from-strings\n          // '--disallow-code-generation-from-strings'\n        ]\n      : [\n          // '--disallow-code-generation-from-strings',\n          // https://nodejs.org/api/cli.html#--disable-protomode\n          // '--disable-proto',\n          // 'throw',\n          // https://nodejs.org/api/cli.html#--frozen-intrinsics\n          // We have contributed the following patches to our dependencies to make\n          // Node's --frozen-intrinsics workable.\n          // √ https://github.com/SBoudrias/Inquirer.js/pull/1683\n          // √ https://github.com/pnpm/components/pull/23\n          // '--frozen-intrinsics',\n          // https://nodejs.org/api/cli.html#--no-deprecation\n          // '--no-deprecation',\n        ],\n  )\n\nconst lazyNodeMemoryFlags = () => {\n  const flags = /*@__PURE__*/ require(\n    path.join(constants.rootPath, 'dist/flags.js'),\n  )\n  const getMaxOldSpaceSizeFlag = flags.getMaxOldSpaceSizeFlag\n  const getMaxSemiSpaceSizeFlag = flags.getMaxSemiSpaceSizeFlag\n  return Object.freeze([\n    `--max-old-space-size=${getMaxOldSpaceSizeFlag()}`,\n    `--max-semi-space-size=${getMaxSemiSpaceSizeFlag()}`,\n  ])\n}\n\nconst lazyNpmCachePath = () => {\n  const spawnHelpers = /*@__PURE__*/ require('@socketsecurity/registry/lib/spawn')\n  const spawnSync = spawnHelpers.spawnSync\n  return spawnSync(\n    constants.npmExecPath,\n    ['config', 'get', 'cache'],\n    getNpmStdioPipeOptions(),\n  ).stdout\n}\n\nconst lazyNpmGlobalPrefix = () => {\n  const spawnHelpers = /*@__PURE__*/ require('@socketsecurity/registry/lib/spawn')\n  const spawnSync = spawnHelpers.spawnSync\n  return spawnSync(\n    constants.npmExecPath,\n    ['prefix', '-g'],\n    getNpmStdioPipeOptions(),\n  ).stdout\n}\n\nconst lazyNpmNmNodeGypPath = () =>\n  path.join(\n    constants.npmRealExecPath,\n    '../../node_modules/node-gyp/bin/node-gyp.js',\n  )\n\nconst lazyProcessEnv = () =>\n  Object.setPrototypeOf(\n    Object.fromEntries(\n      Object.entries(constants.ENV).reduce(\n        (entries, entry) => {\n          const { 0: key, 1: value } = entry\n          if (key.startsWith('INLINED_SOCKET_CLI_')) {\n            return entries\n          }\n          if (typeof value === 'string') {\n            if (value) {\n              entries.push(entry as [string, string])\n            }\n          } else if (typeof value === 'boolean' && value) {\n            entries.push([key, '1'])\n          }\n          return entries\n        },\n        [] as Array<[string, string]>,\n      ),\n    ),\n    null,\n  )\n\nconst lazyRootPath = () => path.join(realpathSync.native(__dirname), '..')\n\nconst lazyShadowBinPath = () => path.join(constants.rootPath, 'shadow-npm-bin')\n\nconst lazyShadowNpmBinPath = () =>\n  path.join(constants.distPath, 'shadow-npm-bin.js')\n\nconst lazyShadowNpmInjectPath = () =>\n  path.join(constants.distPath, 'shadow-npm-inject.js')\n\nconst lazyShadowNpxBinPath = () =>\n  path.join(constants.distPath, 'shadow-npx-bin.js')\n\nconst lazyShadowPnpmBinPath = () =>\n  path.join(constants.distPath, 'shadow-pnpm-bin.js')\n\nconst lazyShadowYarnBinPath = () =>\n  path.join(constants.distPath, 'shadow-yarn-bin.js')\n\nconst lazySocketAppDataPath = (): string | undefined => {\n  // Get the OS app data directory:\n  // - Win: %LOCALAPPDATA% or fail?\n  // - Mac: %XDG_DATA_HOME% or fallback to \"~/Library/Application Support/\"\n  // - Linux: %XDG_DATA_HOME% or fallback to \"~/.local/share/\"\n  // Note: LOCALAPPDATA is typically: C:\\Users\\USERNAME\\AppData\n  // Note: XDG stands for \"X Desktop Group\", nowadays \"freedesktop.org\"\n  //       On most systems that path is: $HOME/.local/share\n  // Then append `socket/settings`, so:\n  // - Win: %LOCALAPPDATA%\\socket\\settings or return undefined\n  // - Mac: %XDG_DATA_HOME%/socket/settings or \"~/Library/Application Support/socket/settings\"\n  // - Linux: %XDG_DATA_HOME%/socket/settings or \"~/.local/share/socket/settings\"\n  const { WIN32 } = constants\n  let dataHome: string | undefined = WIN32\n    ? constants.ENV.LOCALAPPDATA\n    : constants.ENV.XDG_DATA_HOME\n  if (!dataHome) {\n    if (WIN32) {\n      const logger = /*@__PURE__*/ require('@socketsecurity/registry/lib/logger')\n      logger.warn(`Missing %LOCALAPPDATA%.`)\n    } else {\n      dataHome = path.join(\n        constants.homePath,\n        constants.DARWIN ? 'Library/Application Support' : '.local/share',\n      )\n    }\n  }\n  return dataHome ? path.join(dataHome, 'socket/settings') : undefined\n}\n\nconst lazySocketCachePath = () => path.join(constants.rootPath, '.cache')\n\nconst lazySocketRegistryPath = () =>\n  path.join(constants.externalPath, '@socketsecurity/registry')\n\nconst lazyZshRcPath = () => path.join(constants.homePath, '.zshrc')\n\nconst constants: Constants = createConstantsObject(\n  {\n    ...registryConstantsAttribs.props,\n    ALERT_TYPE_CRITICAL_CVE,\n    ALERT_TYPE_CVE,\n    ALERT_TYPE_MEDIUM_CVE,\n    ALERT_TYPE_MILD_CVE,\n    API_V0_URL,\n    BUN,\n    CONFIG_KEY_API_BASE_URL,\n    CONFIG_KEY_API_PROXY,\n    CONFIG_KEY_API_TOKEN,\n    CONFIG_KEY_DEFAULT_ORG,\n    CONFIG_KEY_ENFORCED_ORGS,\n    CONFIG_KEY_ORG,\n    DOT_GIT_DIR,\n    DOT_SOCKET_DIR,\n    DOT_SOCKET_DOT_FACTS_JSON,\n    DRY_RUN_BAILING_NOW,\n    DRY_RUN_LABEL,\n    DRY_RUN_NOT_SAVING,\n    ENV: undefined,\n    ENVIRONMENT_YAML,\n    ENVIRONMENT_YML,\n    ERROR_NO_MANIFEST_FILES,\n    ERROR_NO_PACKAGE_JSON,\n    ERROR_NO_REPO_FOUND,\n    ERROR_NO_SOCKET_DIR,\n    ERROR_UNABLE_RESOLVE_ORG,\n    EXT_YAML,\n    EXT_YML,\n    FLAG_CONFIG,\n    FLAG_DRY_RUN,\n    FLAG_HELP,\n    FLAG_ID,\n    FLAG_JSON,\n    FLAG_MARKDOWN,\n    FLAG_ORG,\n    FLAG_PIN,\n    FLAG_PROD,\n    FLAG_QUIET,\n    FLAG_SILENT,\n    FLAG_TEXT,\n    FLAG_VERBOSE,\n    FLAG_VERSION,\n    FOLD_SETTING_FILE,\n    FOLD_SETTING_NONE,\n    FOLD_SETTING_PKG,\n    FOLD_SETTING_VERSION,\n    GQL_PAGE_SENTINEL,\n    GQL_PR_STATE_CLOSED,\n    GQL_PR_STATE_MERGED,\n    GQL_PR_STATE_OPEN,\n    HTTP_STATUS_BAD_REQUEST,\n    HTTP_STATUS_FORBIDDEN,\n    HTTP_STATUS_INTERNAL_SERVER_ERROR,\n    HTTP_STATUS_NOT_FOUND,\n    HTTP_STATUS_UNAUTHORIZED,\n    NODE_MODULES,\n    NPM_BUGGY_OVERRIDES_PATCHED_VERSION,\n    NPM_REGISTRY_URL,\n    NPX,\n    OUTPUT_JSON,\n    OUTPUT_MARKDOWN,\n    OUTPUT_TEXT,\n    PACKAGE_JSON,\n    PACKAGE_LOCK_JSON,\n    PNPM,\n    PNPM_LOCK_YAML,\n    PNPM_WORKSPACE_YAML,\n    REDACTED,\n    REPORT_LEVEL_DEFER,\n    REPORT_LEVEL_ERROR,\n    REPORT_LEVEL_IGNORE,\n    REPORT_LEVEL_MONITOR,\n    REPORT_LEVEL_WARN,\n    REQUIREMENTS_TXT,\n    SOCKET_CLI_ACCEPT_RISKS,\n    SOCKET_CLI_BIN_NAME,\n    SOCKET_CLI_ISSUES_URL,\n    SOCKET_CLI_SHADOW_ACCEPT_RISKS,\n    SOCKET_CLI_SHADOW_API_TOKEN,\n    SOCKET_CLI_SHADOW_BIN,\n    SOCKET_CLI_SHADOW_PROGRESS,\n    SOCKET_CLI_SHADOW_SILENT,\n    SOCKET_CLI_VIEW_ALL_RISKS,\n    SOCKET_DEFAULT_BRANCH,\n    SOCKET_DEFAULT_REPOSITORY,\n    SOCKET_JSON,\n    SOCKET_WEBSITE_URL,\n    SOCKET_YAML,\n    SOCKET_YML,\n    TSCONFIG_JSON,\n    UNKNOWN_ERROR,\n    UNKNOWN_VALUE,\n    V1_MIGRATION_GUIDE_URL,\n    VLT,\n    YARN,\n    YARN_BERRY,\n    YARN_CLASSIC,\n    bashRcPath: undefined,\n    binPath: undefined,\n    binCliPath: undefined,\n    blessedContribPath: undefined,\n    blessedOptions: undefined,\n    blessedPath: undefined,\n    distCliPath: undefined,\n    distPath: undefined,\n    externalPath: undefined,\n    githubCachePath: undefined,\n    homePath: undefined,\n    instrumentWithSentryPath: undefined,\n    minimumVersionByAgent: undefined,\n    nmBinPath: undefined,\n    nodeHardenFlags: undefined,\n    nodeDebugFlags: undefined,\n    nodeMemoryFlags: undefined,\n    npmCachePath: undefined,\n    npmGlobalPrefix: undefined,\n    npmNmNodeGypPath: undefined,\n    processEnv: undefined,\n    rootPath: undefined,\n    shadowBinPath: undefined,\n    shadowNpmInjectPath: undefined,\n    shadowNpmBinPath: undefined,\n    shadowPnpmBinPath: undefined,\n    shadowYarnBinPath: undefined,\n    socketAppDataPath: undefined,\n    socketCachePath: undefined,\n    socketRegistryPath: undefined,\n    zshRcPath: undefined,\n  },\n  {\n    getters: {\n      ...registryConstantsAttribs.getters,\n      ENV: LAZY_ENV,\n      bashRcPath: lazyBashRcPath,\n      binCliPath: lazyBinCliPath,\n      binPath: lazyBinPath,\n      blessedContribPath: lazyBlessedContribPath,\n      blessedOptions: lazyBlessedOptions,\n      blessedPath: lazyBlessedPath,\n      distCliPath: lazyDistCliPath,\n      distPath: lazyDistPath,\n      externalPath: lazyExternalPath,\n      githubCachePath: lazyGithubCachePath,\n      homePath: lazyHomePath,\n      instrumentWithSentryPath: lazyInstrumentWithSentryPath,\n      minimumVersionByAgent: lazyMinimumVersionByAgent,\n      nmBinPath: lazyNmBinPath,\n      nodeDebugFlags: lazyNodeDebugFlags,\n      nodeHardenFlags: lazyNodeHardenFlags,\n      nodeMemoryFlags: lazyNodeMemoryFlags,\n      npmCachePath: lazyNpmCachePath,\n      npmGlobalPrefix: lazyNpmGlobalPrefix,\n      npmNmNodeGypPath: lazyNpmNmNodeGypPath,\n      processEnv: lazyProcessEnv,\n      rootPath: lazyRootPath,\n      shadowBinPath: lazyShadowBinPath,\n      shadowNpmBinPath: lazyShadowNpmBinPath,\n      shadowNpmInjectPath: lazyShadowNpmInjectPath,\n      shadowNpxBinPath: lazyShadowNpxBinPath,\n      shadowPnpmBinPath: lazyShadowPnpmBinPath,\n      shadowYarnBinPath: lazyShadowYarnBinPath,\n      socketAppDataPath: lazySocketAppDataPath,\n      socketCachePath: lazySocketCachePath,\n      socketRegistryPath: lazySocketRegistryPath,\n      zshRcPath: lazyZshRcPath,\n    },\n    internals: {\n      ...registryConstantsAttribs.internals,\n      getIpc,\n      getSentry() {\n        return _Sentry\n      },\n      setSentry(Sentry: Sentry): boolean {\n        if (_Sentry === undefined) {\n          _Sentry = Sentry\n          return true\n        }\n        return false\n      },\n    },\n  },\n) as Constants\n\nexport {\n  // Re-exported from socket-registry.\n  AT_LATEST,\n  BIOME_JSON,\n  BUN,\n  CI,\n  COLUMN_LIMIT,\n  DOT_GIT_DIR,\n  DOT_PACKAGE_LOCK_JSON,\n  DOT_SOCKET_DIR,\n  EMPTY_FILE,\n  EMPTY_VALUE,\n  ESLINT_CONFIG_JS,\n  ESNEXT,\n  EXTENSIONS,\n  EXTENSIONS_JSON,\n  EXT_CJS,\n  EXT_CMD,\n  EXT_CTS,\n  EXT_DTS,\n  EXT_JS,\n  EXT_JSON,\n  EXT_LOCK,\n  EXT_LOCKB,\n  EXT_MD,\n  EXT_MJS,\n  EXT_MTS,\n  EXT_PS1,\n  EXT_YAML,\n  EXT_YML,\n  GITIGNORE,\n  LATEST,\n  LICENSE,\n  LICENSE_GLOB,\n  LICENSE_GLOB_RECURSIVE,\n  LICENSE_ORIGINAL,\n  LICENSE_ORIGINAL_GLOB,\n  LICENSE_ORIGINAL_GLOB_RECURSIVE,\n  LOOP_SENTINEL,\n  MANIFEST_JSON,\n  MIT,\n  NODE_AUTH_TOKEN,\n  NODE_ENV,\n  NODE_MODULES,\n  NODE_MODULES_GLOB_RECURSIVE,\n  NPM,\n  NPX,\n  OVERRIDES,\n  PACKAGE_DEFAULT_VERSION,\n  PACKAGE_JSON,\n  PACKAGE_LOCK_JSON,\n  PNPM,\n  PNPM_LOCK_YAML,\n  PRE_COMMIT,\n  README_GLOB,\n  README_GLOB_RECURSIVE,\n  README_MD,\n  REGISTRY,\n  REGISTRY_SCOPE_DELIMITER,\n  RESOLUTIONS,\n  SOCKET_GITHUB_ORG,\n  SOCKET_IPC_HANDSHAKE,\n  SOCKET_OVERRIDE_SCOPE,\n  SOCKET_PUBLIC_API_TOKEN,\n  SOCKET_REGISTRY_NPM_ORG,\n  SOCKET_REGISTRY_PACKAGE_NAME,\n  SOCKET_REGISTRY_REPO_NAME,\n  SOCKET_REGISTRY_SCOPE,\n  SOCKET_SECURITY_SCOPE,\n  TSCONFIG_JSON,\n  UNKNOWN_ERROR,\n  UNKNOWN_VALUE,\n  UNLICENCED,\n  UNLICENSED,\n  UTF8,\n  VITEST,\n  VLT,\n  YARN,\n  YARN_BERRY,\n  YARN_CLASSIC,\n  YARN_LOCK,\n  // Socket CLI specific constants.\n  ALERT_TYPE_CRITICAL_CVE,\n  ALERT_TYPE_CVE,\n  ALERT_TYPE_MEDIUM_CVE,\n  ALERT_TYPE_MILD_CVE,\n  API_V0_URL,\n  CONFIG_KEY_API_BASE_URL,\n  CONFIG_KEY_API_PROXY,\n  CONFIG_KEY_API_TOKEN,\n  CONFIG_KEY_DEFAULT_ORG,\n  CONFIG_KEY_ENFORCED_ORGS,\n  CONFIG_KEY_ORG,\n  DOT_SOCKET_DOT_FACTS_JSON,\n  DRY_RUN_BAILING_NOW,\n  DRY_RUN_LABEL,\n  DRY_RUN_NOT_SAVING,\n  ENVIRONMENT_YAML,\n  ENVIRONMENT_YML,\n  ERROR_NO_MANIFEST_FILES,\n  ERROR_NO_PACKAGE_JSON,\n  ERROR_NO_REPO_FOUND,\n  ERROR_NO_SOCKET_DIR,\n  ERROR_UNABLE_RESOLVE_ORG,\n  FLAG_CONFIG,\n  FLAG_DRY_RUN,\n  FLAG_HELP,\n  FLAG_ID,\n  FLAG_JSON,\n  FLAG_MARKDOWN,\n  FLAG_ORG,\n  FLAG_PIN,\n  FLAG_PROD,\n  FLAG_QUIET,\n  FLAG_SILENT,\n  FLAG_TEXT,\n  FLAG_VERBOSE,\n  FLAG_VERSION,\n  FOLD_SETTING_FILE,\n  FOLD_SETTING_NONE,\n  FOLD_SETTING_PKG,\n  FOLD_SETTING_VERSION,\n  GQL_PAGE_SENTINEL,\n  GQL_PR_STATE_CLOSED,\n  GQL_PR_STATE_MERGED,\n  GQL_PR_STATE_OPEN,\n  HTTP_STATUS_BAD_REQUEST,\n  HTTP_STATUS_FORBIDDEN,\n  HTTP_STATUS_INTERNAL_SERVER_ERROR,\n  HTTP_STATUS_NOT_FOUND,\n  HTTP_STATUS_UNAUTHORIZED,\n  NPM_BUGGY_OVERRIDES_PATCHED_VERSION,\n  NPM_REGISTRY_URL,\n  OUTPUT_JSON,\n  OUTPUT_MARKDOWN,\n  OUTPUT_TEXT,\n  PNPM_WORKSPACE_YAML,\n  REDACTED,\n  REPORT_LEVEL_DEFER,\n  REPORT_LEVEL_ERROR,\n  REPORT_LEVEL_IGNORE,\n  REPORT_LEVEL_MONITOR,\n  REPORT_LEVEL_WARN,\n  REQUIREMENTS_TXT,\n  SOCKET_CLI_ACCEPT_RISKS,\n  SOCKET_CLI_BIN_NAME,\n  SOCKET_CLI_ISSUES_URL,\n  SOCKET_CLI_SHADOW_ACCEPT_RISKS,\n  SOCKET_CLI_SHADOW_API_TOKEN,\n  SOCKET_CLI_SHADOW_BIN,\n  SOCKET_CLI_SHADOW_PROGRESS,\n  SOCKET_CLI_SHADOW_SILENT,\n  SOCKET_CLI_VIEW_ALL_RISKS,\n  SOCKET_DEFAULT_BRANCH,\n  SOCKET_DEFAULT_REPOSITORY,\n  SOCKET_JSON,\n  SOCKET_WEBSITE_URL,\n  SOCKET_YAML,\n  SOCKET_YML,\n  V1_MIGRATION_GUIDE_URL,\n}\n\nexport default constants\n"],"names":["attributes","getIpc","_npmStdioPipeOptions","cwd","env","__proto__","DISABLE_GITHUB_CACHE","GITHUB_BASE_REF","GITHUB_REF_NAME","GITHUB_REF_TYPE","GITHUB_REPOSITORY","NODE_EXTRA_CA_CERTS","envAsString","PATH","SOCKET_CLI_ACCEPT_RISKS","SOCKET_CLI_API_BASE_URL","SOCKET_CLI_API_PROXY","SOCKET_CLI_API_TIMEOUT","SOCKET_CLI_API_TOKEN","SOCKET_CLI_CONFIG","SOCKET_CLI_GIT_USER_NAME","SOCKET_CLI_GITHUB_TOKEN","SOCKET_CLI_NO_API_TOKEN","SOCKET_CLI_NPM_PATH","SOCKET_CLI_ORG_SLUG","SOCKET_CLI_VIEW_ALL_RISKS","TERM","smartCSR","term","useBCE","constants","entries","WIN32","logger","dataHome","ENV","bashRcPath","binPath","binCliPath","blessedContribPath","blessedOptions","blessedPath","distCliPath","distPath","externalPath","githubCachePath","homePath","instrumentWithSentryPath","minimumVersionByAgent","nmBinPath","nodeHardenFlags","nodeDebugFlags","nodeMemoryFlags","npmCachePath","npmGlobalPrefix","npmNmNodeGypPath","processEnv","rootPath","shadowBinPath","shadowNpmInjectPath","shadowNpmBinPath","shadowPnpmBinPath","shadowYarnBinPath","socketAppDataPath","socketCachePath","socketRegistryPath","zshRcPath","getters","shadowNpxBinPath","internals","getSentry","_Sentry"],"mappings":";;;;;;;;;;;;AAYA;AACA;AACA;AACA;AACA;AACA;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiFE;AACEA;;AAEAC;AACF;AACF;AAgFA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAmJA;AAEA;AACA;;AAEIC;AACEC;;;AAGJ;AACA;AACF;AAEA;;AACUC;AAAI;AACZ;AACA;AAGA;AACA;AACA;AACA;AACA;;;AAKA;AACA;;AAEEC;AACA;;AAEA;AACA;AACAC;AACA;AACA;;AAGA;AACA;AACA;AACA;AACAC;AACA;AACA;AACA;AACA;AACAC;AACA;AACA;AACAC;AACA;AACA;AACAC;AACA;AACA;;AAGA;AACA;AACA;AACA;;AAEA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAEA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAOA;AACA;AACA;AACA;AACAC;AAEE;AACA;AACAC;AACF;AACA;AACA;AACAC;AACA;AACAC;AACA;AACA;AACAC;AAEE;AACAH;AAGF;AACA;AACAI;AAEE;AACAJ;AACA;AACA;AACAA;AAIF;AACA;AACAK;AACA;AACA;AACAC;AAEE;;AAIF;AACAC;AACA;;AAIA;AACAC;AAIA;AACA;;AAMA;AACA;AACA;AACA;AACAC;AAEE;AACAT;AAEF;AACAU;AACA;AACAC;AACA;AACAC;AAEE;AACAZ;AACF;AACAa;AACA;AACAC;AACF;AACF;AAEA;AAEA;AAEA;AAEA;AAGA;AAEIC;AACAC;AACAC;AACF;AAEF;AAEA;AAEA;AAEA;AAEA;AAEA;AAEA;AAGA;AAEI;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGJ;AAEA;;AAGA;AACA;AACA;AAEI;AACA;AACAC;AAEM;AACA;AAAA;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAAA;AAIV;AACE;AAGA;AACA;AACA;AAIF;AAEA;AACE;AACA;AACA;AAKF;AAEA;AACE;AACA;AACA;AAKF;AAEA;AAMA;;AAKkB;AAAQ;AAAS;AACzB;AACE;AACF;AACA;AACE;AACEC;AACF;;;AAGF;AACA;AACF;AAOR;AAEA;AAEA;AAGA;AAGA;AAGA;AAGA;AAGA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACQC;AAAM;AACd;;AAIE;AACE;AACAC;AACF;AACEC;AAIF;AACF;;AAEF;AAEA;AAEA;AAGA;AAEA;;;;;;;;;;;;;;;;;;;;AAqBIC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+EAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACF;AAEEC;;AAEEhC;AACAC;AACAE;AACAD;AACAE;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAE;AACAD;AACAE;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAE;AACAD;AACAS;AACAP;AACAC;AACAC;AACAC;AACAC;AACAC;;AAEFG;;;AAGEC;AACE;;;;AAIEC;AACA;AACF;AACA;AACF;AACF;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;","debugId":"2ef361f8-a635-4a7e-ae8d-4b7917ed6566"}
+{"version":3,"file":"constants.js","sources":["../src/constants.mts"],"sourcesContent":["import { realpathSync } from 'node:fs'\nimport { createRequire } from 'node:module'\nimport os from 'node:os'\nimport path from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nimport registryConstants from '@socketsecurity/registry/lib/constants'\n\nimport type { Agent } from './utils/package-environment.mts'\nimport type { Remap } from '@socketsecurity/registry/lib/objects'\nimport type { SpawnOptions } from '@socketsecurity/registry/lib/spawn'\n\nconst require = createRequire(import.meta.url)\nconst __filename = fileURLToPath(import.meta.url)\n// Using `path.dirname(__filename)` to resolve `__dirname` works for both 'dist'\n// AND 'src' directories because constants.js and constants.mts respectively are\n// in the root of each.\nconst __dirname = path.dirname(__filename)\n\nconst {\n  AT_LATEST,\n  BIOME_JSON,\n  BUN,\n  CI,\n  COLUMN_LIMIT,\n  DOT_GIT_DIR,\n  DOT_SOCKET_DIR,\n  EMPTY_FILE,\n  EMPTY_VALUE,\n  ESLINT_CONFIG_JS,\n  ESNEXT,\n  EXT_CJS,\n  EXT_CMD,\n  EXT_CTS,\n  EXT_DTS,\n  EXT_JS,\n  EXT_JSON,\n  EXT_LOCK,\n  EXT_LOCKB,\n  EXT_MD,\n  EXT_MJS,\n  EXT_MTS,\n  EXT_PS1,\n  EXT_YAML,\n  EXT_YML,\n  EXTENSIONS,\n  EXTENSIONS_JSON,\n  GITIGNORE,\n  DOT_PACKAGE_LOCK_JSON,\n  LATEST,\n  LICENSE,\n  LICENSE_GLOB,\n  LICENSE_GLOB_RECURSIVE,\n  LICENSE_ORIGINAL,\n  LICENSE_ORIGINAL_GLOB,\n  LICENSE_ORIGINAL_GLOB_RECURSIVE,\n  LOOP_SENTINEL,\n  MANIFEST_JSON,\n  MIT,\n  NODE_AUTH_TOKEN,\n  NODE_ENV,\n  NODE_MODULES,\n  NODE_MODULES_GLOB_RECURSIVE,\n  NPM,\n  NPX,\n  OVERRIDES,\n  PACKAGE_DEFAULT_VERSION,\n  PACKAGE_JSON,\n  PACKAGE_LOCK_JSON,\n  PNPM,\n  PNPM_LOCK_YAML,\n  PRE_COMMIT,\n  README_GLOB,\n  README_GLOB_RECURSIVE,\n  REGISTRY_SCOPE_DELIMITER,\n  README_MD,\n  REGISTRY,\n  RESOLUTIONS,\n  SOCKET_GITHUB_ORG,\n  SOCKET_IPC_HANDSHAKE,\n  SOCKET_OVERRIDE_SCOPE,\n  SOCKET_PUBLIC_API_TOKEN,\n  SOCKET_REGISTRY_NPM_ORG,\n  SOCKET_REGISTRY_PACKAGE_NAME,\n  SOCKET_REGISTRY_REPO_NAME,\n  SOCKET_REGISTRY_SCOPE,\n  SOCKET_SECURITY_SCOPE,\n  TSCONFIG_JSON,\n  UNKNOWN_ERROR,\n  UNKNOWN_VALUE,\n  UNLICENCED,\n  UNLICENSED,\n  UTF8,\n  VITEST,\n  VLT,\n  YARN,\n  YARN_BERRY,\n  YARN_CLASSIC,\n  YARN_LOCK,\n  kInternalsSymbol,\n  [kInternalsSymbol as unknown as 'Symbol(kInternalsSymbol)']: {\n    attributes: registryConstantsAttribs,\n    createConstantsObject,\n    getIpc,\n  },\n} = registryConstants\n\nexport type RegistryEnv = typeof registryConstants.ENV\n\nexport type RegistryInternals =\n  (typeof registryConstants)['Symbol(kInternalsSymbol)']\n\nexport type Sentry = any\n\nexport type Internals = Remap<\n  Omit<RegistryInternals, 'getIpc'> &\n    Readonly<{\n      getIpc: {\n        (): Promise<IpcObject>\n        <K extends keyof IpcObject | undefined>(\n          key?: K | undefined,\n        ): Promise<K extends keyof IpcObject ? IpcObject[K] : IpcObject>\n      }\n      getSentry: () => Sentry\n      setSentry(Sentry: Sentry): boolean\n    }>\n>\n\nexport type ENV = Remap<\n  RegistryEnv &\n    Readonly<{\n      DISABLE_GITHUB_CACHE: boolean\n      GITHUB_API_URL: string\n      GITHUB_BASE_REF: string\n      GITHUB_REF_NAME: string\n      GITHUB_REF_TYPE: string\n      GITHUB_REPOSITORY: string\n      GITHUB_SERVER_URL: string\n      GITHUB_TOKEN: string\n      INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION: string\n      INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION: string\n      INLINED_SOCKET_CLI_HOMEPAGE: string\n      INLINED_SOCKET_CLI_LEGACY_BUILD: string\n      INLINED_SOCKET_CLI_NAME: string\n      INLINED_SOCKET_CLI_PUBLISHED_BUILD: string\n      INLINED_SOCKET_CLI_SENTRY_BUILD: string\n      INLINED_SOCKET_CLI_VERSION: string\n      INLINED_SOCKET_CLI_VERSION_HASH: string\n      INLINED_SOCKET_CLI_SYNP_VERSION: string\n      LOCALAPPDATA: string\n      NODE_COMPILE_CACHE: string\n      NODE_EXTRA_CA_CERTS: string\n      PATH: string\n      SOCKET_CLI_ACCEPT_RISKS: boolean\n      SOCKET_CLI_API_BASE_URL: string\n      SOCKET_CLI_API_PROXY: string\n      SOCKET_CLI_API_TIMEOUT: number\n      SOCKET_CLI_API_TOKEN: string\n      SOCKET_CLI_CONFIG: string\n      SOCKET_CLI_GIT_USER_EMAIL: string\n      SOCKET_CLI_GIT_USER_NAME: string\n      SOCKET_CLI_GITHUB_TOKEN: string\n      SOCKET_CLI_NO_API_TOKEN: boolean\n      SOCKET_CLI_NPM_PATH: string\n      SOCKET_CLI_ORG_SLUG: string\n      SOCKET_CLI_VIEW_ALL_RISKS: boolean\n      TERM: string\n      XDG_DATA_HOME: string\n    }>\n>\n\nexport type IpcObject = Readonly<{\n  SOCKET_CLI_FIX?: string | undefined\n  SOCKET_CLI_OPTIMIZE?: boolean | undefined\n  SOCKET_CLI_SHADOW_ACCEPT_RISKS?: boolean | undefined\n  SOCKET_CLI_SHADOW_API_TOKEN?: string | undefined\n  SOCKET_CLI_SHADOW_BIN?: string | undefined\n  SOCKET_CLI_SHADOW_PROGRESS?: boolean | undefined\n  SOCKET_CLI_SHADOW_SILENT?: boolean | undefined\n}>\n\nexport type ProcessEnv = {\n  [K in keyof ENV]?: string | undefined\n}\n\n// Socket CLI specific constants that are not in socket-registry.\nconst ALERT_TYPE_CRITICAL_CVE = 'criticalCVE'\nconst ALERT_TYPE_CVE = 'cve'\nconst ALERT_TYPE_MEDIUM_CVE = 'mediumCVE'\nconst ALERT_TYPE_MILD_CVE = 'mildCVE'\nconst API_V0_URL = 'https://api.socket.dev/v0/'\nconst CONFIG_KEY_API_BASE_URL = 'apiBaseUrl'\nconst CONFIG_KEY_API_PROXY = 'apiProxy'\nconst CONFIG_KEY_API_TOKEN = 'apiToken'\nconst CONFIG_KEY_DEFAULT_ORG = 'defaultOrg'\nconst CONFIG_KEY_ENFORCED_ORGS = 'enforcedOrgs'\nconst CONFIG_KEY_ORG = 'org'\nconst DOT_SOCKET_DOT_FACTS_JSON = `${DOT_SOCKET_DIR}.facts.json`\nconst DRY_RUN_LABEL = '[DryRun]'\nconst DRY_RUN_BAILING_NOW = `${DRY_RUN_LABEL}: Bailing now`\nconst DRY_RUN_NOT_SAVING = `${DRY_RUN_LABEL}: Not saving`\nconst ENVIRONMENT_YAML = 'environment.yaml'\nconst ENVIRONMENT_YML = 'environment.yml'\nconst ERROR_NO_MANIFEST_FILES = 'No manifest files found'\nconst ERROR_NO_PACKAGE_JSON = 'No package.json found'\nconst ERROR_NO_REPO_FOUND = 'No repo found'\nconst ERROR_NO_SOCKET_DIR = 'No .socket directory found'\nconst ERROR_UNABLE_RESOLVE_ORG =\n  'Unable to resolve a Socket account organization'\nconst FLAG_CONFIG = '--config'\nconst FLAG_DRY_RUN = '--dry-run'\nconst FLAG_HELP = '--help'\nconst FLAG_ID = '--id'\nconst FLAG_JSON = '--json'\nconst FLAG_MARKDOWN = '--markdown'\nconst FLAG_ORG = '--org'\nconst FLAG_PIN = '--pin'\nconst FLAG_PROD = '--prod'\nconst FLAG_QUIET = '--quiet'\nconst FLAG_SILENT = '--silent'\nconst FLAG_TEXT = '--text'\nconst FLAG_VERBOSE = '--verbose'\nconst FLAG_VERSION = '--version'\nconst FOLD_SETTING_FILE = 'file'\nconst FOLD_SETTING_NONE = 'none'\nconst FOLD_SETTING_PKG = 'pkg'\nconst FOLD_SETTING_VERSION = 'version'\nconst GQL_PAGE_SENTINEL = 100\nconst GQL_PR_STATE_CLOSED = 'CLOSED'\nconst GQL_PR_STATE_MERGED = 'MERGED'\nconst GQL_PR_STATE_OPEN = 'OPEN'\nconst HTTP_STATUS_BAD_REQUEST = 400\nconst HTTP_STATUS_FORBIDDEN = 403\nconst HTTP_STATUS_INTERNAL_SERVER_ERROR = 500\nconst HTTP_STATUS_NOT_FOUND = 404\nconst HTTP_STATUS_UNAUTHORIZED = 401\nconst NPM_BUGGY_OVERRIDES_PATCHED_VERSION = '11.2.0'\nconst NPM_REGISTRY_URL = 'https://registry.npmjs.org'\nconst OUTPUT_JSON = 'json'\nconst OUTPUT_MARKDOWN = 'markdown'\nconst OUTPUT_TEXT = 'text'\nconst PNPM_WORKSPACE_YAML = 'pnpm-workspace.yaml'\nconst REDACTED = '<redacted>'\nconst REPORT_LEVEL_DEFER = 'defer'\nconst REPORT_LEVEL_ERROR = 'error'\nconst REPORT_LEVEL_IGNORE = 'ignore'\nconst REPORT_LEVEL_MONITOR = 'monitor'\nconst REPORT_LEVEL_WARN = 'warn'\nconst REQUIREMENTS_TXT = 'requirements.txt'\nconst SOCKET_CLI_ACCEPT_RISKS = 'SOCKET_CLI_ACCEPT_RISKS'\nconst SOCKET_CLI_BIN_NAME = 'socket'\nconst SOCKET_CLI_ISSUES_URL = 'https://github.com/SocketDev/socket-cli/issues'\nconst SOCKET_CLI_SHADOW_ACCEPT_RISKS = 'SOCKET_CLI_SHADOW_ACCEPT_RISKS'\nconst SOCKET_CLI_SHADOW_API_TOKEN = 'SOCKET_CLI_SHADOW_API_TOKEN'\nconst SOCKET_CLI_SHADOW_BIN = 'SOCKET_CLI_SHADOW_BIN'\nconst SOCKET_CLI_SHADOW_PROGRESS = 'SOCKET_CLI_SHADOW_PROGRESS'\nconst SOCKET_CLI_SHADOW_SILENT = 'SOCKET_CLI_SHADOW_SILENT'\nconst SOCKET_CLI_VIEW_ALL_RISKS = 'SOCKET_CLI_VIEW_ALL_RISKS'\nconst SOCKET_DEFAULT_BRANCH = 'socket-default-branch'\nconst SOCKET_DEFAULT_REPOSITORY = 'socket-default-repository'\nconst SOCKET_JSON = 'socket.json'\nconst SOCKET_WEBSITE_URL = 'https://socket.dev'\nconst SOCKET_YAML = 'socket.yaml'\nconst SOCKET_YML = 'socket.yml'\nconst V1_MIGRATION_GUIDE_URL = 'https://docs.socket.dev/docs/v1-migration-guide'\n\nexport type Constants = Remap<\n  Omit<\n    typeof registryConstants,\n    'Symbol(kInternalsSymbol)' | 'ENV' | 'ipcObject'\n  > & {\n    readonly 'Symbol(kInternalsSymbol)': Internals\n    readonly ALERT_TYPE_CRITICAL_CVE: typeof ALERT_TYPE_CRITICAL_CVE\n    readonly ALERT_TYPE_CVE: typeof ALERT_TYPE_CVE\n    readonly ALERT_TYPE_MEDIUM_CVE: typeof ALERT_TYPE_MEDIUM_CVE\n    readonly ALERT_TYPE_MILD_CVE: typeof ALERT_TYPE_MILD_CVE\n    readonly API_V0_URL: typeof API_V0_URL\n    readonly BUN: typeof BUN\n    readonly CONFIG_KEY_API_BASE_URL: typeof CONFIG_KEY_API_BASE_URL\n    readonly CONFIG_KEY_API_PROXY: typeof CONFIG_KEY_API_PROXY\n    readonly CONFIG_KEY_API_TOKEN: typeof CONFIG_KEY_API_TOKEN\n    readonly CONFIG_KEY_DEFAULT_ORG: typeof CONFIG_KEY_DEFAULT_ORG\n    readonly CONFIG_KEY_ENFORCED_ORGS: typeof CONFIG_KEY_ENFORCED_ORGS\n    readonly CONFIG_KEY_ORG: typeof CONFIG_KEY_ORG\n    readonly DOT_GIT_DIR: typeof DOT_GIT_DIR\n    readonly DOT_SOCKET_DIR: typeof DOT_SOCKET_DIR\n    readonly DOT_SOCKET_DOT_FACTS_JSON: typeof DOT_SOCKET_DOT_FACTS_JSON\n    readonly DRY_RUN_BAILING_NOW: typeof DRY_RUN_BAILING_NOW\n    readonly DRY_RUN_LABEL: typeof DRY_RUN_LABEL\n    readonly DRY_RUN_NOT_SAVING: typeof DRY_RUN_NOT_SAVING\n    readonly EMPTY_VALUE: typeof EMPTY_VALUE\n    readonly ENV: ENV\n    readonly ENVIRONMENT_YAML: typeof ENVIRONMENT_YAML\n    readonly ENVIRONMENT_YML: typeof ENVIRONMENT_YML\n    readonly ERROR_NO_MANIFEST_FILES: typeof ERROR_NO_MANIFEST_FILES\n    readonly ERROR_NO_PACKAGE_JSON: typeof ERROR_NO_PACKAGE_JSON\n    readonly ERROR_NO_REPO_FOUND: typeof ERROR_NO_REPO_FOUND\n    readonly ERROR_NO_SOCKET_DIR: typeof ERROR_NO_SOCKET_DIR\n    readonly ERROR_UNABLE_RESOLVE_ORG: typeof ERROR_UNABLE_RESOLVE_ORG\n    readonly EXT_YAML: typeof EXT_YAML\n    readonly EXT_YML: typeof EXT_YML\n    readonly FLAG_CONFIG: typeof FLAG_CONFIG\n    readonly FLAG_DRY_RUN: typeof FLAG_DRY_RUN\n    readonly FLAG_HELP: typeof FLAG_HELP\n    readonly FLAG_ID: typeof FLAG_ID\n    readonly FLAG_JSON: typeof FLAG_JSON\n    readonly FLAG_MARKDOWN: typeof FLAG_MARKDOWN\n    readonly FLAG_ORG: typeof FLAG_ORG\n    readonly FLAG_PIN: typeof FLAG_PIN\n    readonly FLAG_PROD: typeof FLAG_PROD\n    readonly FLAG_QUIET: typeof FLAG_QUIET\n    readonly FLAG_SILENT: typeof FLAG_SILENT\n    readonly FLAG_TEXT: typeof FLAG_TEXT\n    readonly FLAG_VERBOSE: typeof FLAG_VERBOSE\n    readonly FLAG_VERSION: typeof FLAG_VERSION\n    readonly FOLD_SETTING_FILE: typeof FOLD_SETTING_FILE\n    readonly FOLD_SETTING_NONE: typeof FOLD_SETTING_NONE\n    readonly FOLD_SETTING_PKG: typeof FOLD_SETTING_PKG\n    readonly FOLD_SETTING_VERSION: typeof FOLD_SETTING_VERSION\n    readonly GQL_PAGE_SENTINEL: typeof GQL_PAGE_SENTINEL\n    readonly GQL_PR_STATE_CLOSED: typeof GQL_PR_STATE_CLOSED\n    readonly GQL_PR_STATE_MERGED: typeof GQL_PR_STATE_MERGED\n    readonly GQL_PR_STATE_OPEN: typeof GQL_PR_STATE_OPEN\n    readonly HTTP_STATUS_BAD_REQUEST: typeof HTTP_STATUS_BAD_REQUEST\n    readonly HTTP_STATUS_FORBIDDEN: typeof HTTP_STATUS_FORBIDDEN\n    readonly HTTP_STATUS_INTERNAL_SERVER_ERROR: typeof HTTP_STATUS_INTERNAL_SERVER_ERROR\n    readonly HTTP_STATUS_NOT_FOUND: typeof HTTP_STATUS_NOT_FOUND\n    readonly HTTP_STATUS_UNAUTHORIZED: typeof HTTP_STATUS_UNAUTHORIZED\n    readonly NODE_MODULES: typeof NODE_MODULES\n    readonly NPM: typeof NPM\n    readonly NPM_BUGGY_OVERRIDES_PATCHED_VERSION: typeof NPM_BUGGY_OVERRIDES_PATCHED_VERSION\n    readonly NPM_REGISTRY_URL: typeof NPM_REGISTRY_URL\n    readonly NPX: typeof NPX\n    readonly OUTPUT_JSON: typeof OUTPUT_JSON\n    readonly OUTPUT_MARKDOWN: typeof OUTPUT_MARKDOWN\n    readonly OUTPUT_TEXT: typeof OUTPUT_TEXT\n    readonly PACKAGE_JSON: typeof PACKAGE_JSON\n    readonly PACKAGE_LOCK_JSON: typeof PACKAGE_LOCK_JSON\n    readonly PNPM: typeof PNPM\n    readonly PNPM_LOCK_YAML: typeof PNPM_LOCK_YAML\n    readonly PNPM_WORKSPACE_YAML: typeof PNPM_WORKSPACE_YAML\n    readonly REDACTED: typeof REDACTED\n    readonly REPORT_LEVEL_DEFER: typeof REPORT_LEVEL_DEFER\n    readonly REPORT_LEVEL_ERROR: typeof REPORT_LEVEL_ERROR\n    readonly REPORT_LEVEL_IGNORE: typeof REPORT_LEVEL_IGNORE\n    readonly REPORT_LEVEL_MONITOR: typeof REPORT_LEVEL_MONITOR\n    readonly REPORT_LEVEL_WARN: typeof REPORT_LEVEL_WARN\n    readonly REQUIREMENTS_TXT: typeof REQUIREMENTS_TXT\n    readonly SOCKET_CLI_ACCEPT_RISKS: typeof SOCKET_CLI_ACCEPT_RISKS\n    readonly SOCKET_CLI_BIN_NAME: typeof SOCKET_CLI_BIN_NAME\n    readonly SOCKET_CLI_ISSUES_URL: typeof SOCKET_CLI_ISSUES_URL\n    readonly SOCKET_CLI_SHADOW_ACCEPT_RISKS: typeof SOCKET_CLI_SHADOW_ACCEPT_RISKS\n    readonly SOCKET_CLI_SHADOW_API_TOKEN: typeof SOCKET_CLI_SHADOW_API_TOKEN\n    readonly SOCKET_CLI_SHADOW_BIN: typeof SOCKET_CLI_SHADOW_BIN\n    readonly SOCKET_CLI_SHADOW_PROGRESS: typeof SOCKET_CLI_SHADOW_PROGRESS\n    readonly SOCKET_CLI_SHADOW_SILENT: typeof SOCKET_CLI_SHADOW_SILENT\n    readonly SOCKET_CLI_VIEW_ALL_RISKS: typeof SOCKET_CLI_VIEW_ALL_RISKS\n    readonly SOCKET_DEFAULT_BRANCH: typeof SOCKET_DEFAULT_BRANCH\n    readonly SOCKET_DEFAULT_REPOSITORY: typeof SOCKET_DEFAULT_REPOSITORY\n    readonly SOCKET_JSON: typeof SOCKET_JSON\n    readonly SOCKET_WEBSITE_URL: typeof SOCKET_WEBSITE_URL\n    readonly SOCKET_YAML: typeof SOCKET_YAML\n    readonly SOCKET_YML: typeof SOCKET_YML\n    readonly TSCONFIG_JSON: typeof TSCONFIG_JSON\n    readonly UNKNOWN_ERROR: typeof UNKNOWN_ERROR\n    readonly UNKNOWN_VALUE: typeof UNKNOWN_VALUE\n    readonly V1_MIGRATION_GUIDE_URL: typeof V1_MIGRATION_GUIDE_URL\n    readonly VLT: typeof VLT\n    readonly YARN: typeof YARN\n    readonly YARN_BERRY: typeof YARN_BERRY\n    readonly YARN_CLASSIC: typeof YARN_CLASSIC\n    readonly bashRcPath: string\n    readonly binCliPath: string\n    readonly binPath: string\n    readonly blessedContribPath: string\n    readonly blessedOptions: {\n      smartCSR: boolean\n      term: string\n      useBCE: boolean\n    }\n    readonly blessedPath: string\n    readonly distCliPath: string\n    readonly distPath: string\n    readonly externalPath: string\n    readonly githubCachePath: string\n    readonly homePath: string\n    readonly instrumentWithSentryPath: string\n    readonly ipcObject: IpcObject\n    readonly minimumVersionByAgent: Map<Agent, string>\n    readonly nmBinPath: string\n    readonly nodeDebugFlags: string[]\n    readonly nodeHardenFlags: string[]\n    readonly nodeMemoryFlags: string[]\n    readonly npmCachePath: string\n    readonly npmGlobalPrefix: string\n    readonly npmNmNodeGypPath: string\n    readonly processEnv: ProcessEnv\n    readonly rootPath: string\n    readonly shadowBinPath: string\n    readonly shadowNpmBinPath: string\n    readonly shadowNpmInjectPath: string\n    readonly shadowNpxBinPath: string\n    readonly shadowPnpmBinPath: string\n    readonly shadowYarnBinPath: string\n    readonly socketAppDataPath: string\n    readonly socketCachePath: string\n    readonly socketRegistryPath: string\n    readonly zshRcPath: string\n  }\n>\n\nlet _Sentry: any\n\nlet _npmStdioPipeOptions: SpawnOptions | undefined\nfunction getNpmStdioPipeOptions() {\n  if (_npmStdioPipeOptions === undefined) {\n    _npmStdioPipeOptions = {\n      cwd: process.cwd(),\n      // On Windows, npm is often a .cmd file that requires shell execution.\n      // The spawn function from @socketsecurity/registry will handle this properly\n      // when shell is true.\n      shell: constants.WIN32,\n    }\n  }\n  return _npmStdioPipeOptions\n}\n\nconst LAZY_ENV = () => {\n  const { env } = process\n  const envHelpers = /*@__PURE__*/ require('@socketsecurity/registry/lib/env')\n  const utils = /*@__PURE__*/ require(\n    path.join(constants.rootPath, 'dist/utils.js'),\n  )\n  const envAsBoolean = envHelpers.envAsBoolean\n  const envAsNumber = envHelpers.envAsNumber\n  const envAsString = envHelpers.envAsString\n  const getConfigValueOrUndef = utils.getConfigValueOrUndef\n  const readOrDefaultSocketJson = utils.readOrDefaultSocketJson\n  const GITHUB_TOKEN = envAsString(env['GITHUB_TOKEN'])\n  const INLINED_SOCKET_CLI_PUBLISHED_BUILD = envAsBoolean(\n    process.env['INLINED_SOCKET_CLI_PUBLISHED_BUILD'],\n  )\n  // We inline some environment values so that they CANNOT be influenced by user\n  // provided environment variables.\n  return Object.freeze({\n    __proto__: null,\n    // Lazily access registryConstants.ENV.\n    ...registryConstants.ENV,\n    // Disable using GitHub's workflow actions/cache.\n    // https://github.com/actions/cache\n    DISABLE_GITHUB_CACHE: envAsBoolean(env['DISABLE_GITHUB_CACHE']),\n    // The API URL. For example, https://api.github.com.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_API_URL:\n      envAsString(env['GITHUB_API_URL']) || 'https://api.github.com',\n    // The name of the base ref or target branch of the pull request in a workflow\n    // run. This is only set when the event that triggers a workflow run is either\n    // pull_request or pull_request_target. For example, main.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_BASE_REF: envAsString(env['GITHUB_BASE_REF']),\n    // The short ref name of the branch or tag that triggered the GitHub workflow\n    // run. This value matches the branch or tag name shown on GitHub. For example,\n    // feature-branch-1. For pull requests, the format is <pr_number>/merge.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_REF_NAME: envAsString(env['GITHUB_REF_NAME']),\n    // The type of ref that triggered the workflow run. Valid values are branch or tag.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_REF_TYPE: envAsString(env['GITHUB_REF_TYPE']),\n    // The owner and repository name. For example, octocat/Hello-World.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_REPOSITORY: envAsString(env['GITHUB_REPOSITORY']),\n    // The URL of the GitHub server. For example, https://github.com.\n    // https://docs.github.com/en/codespaces/developing-in-a-codespace/default-environment-variables-for-your-codespace#list-of-default-environment-variables\n    GITHUB_SERVER_URL:\n      envAsString(env['GITHUB_SERVER_URL']) || 'https://github.com',\n    // The GITHUB_TOKEN secret is a GitHub App installation access token.\n    // The token's permissions are limited to the repository that contains the\n    // workflow.\n    // https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#about-the-github_token-secret\n    GITHUB_TOKEN,\n    // Comp-time inlined @coana-tech/cli package version.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION']\".\n    INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION: envAsString(\n      process.env['INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION'],\n    ),\n    // Comp-time inlined @cyclonedx/cdxgen package version.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION']\".\n    INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION: envAsString(\n      process.env['INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION'],\n    ),\n    // Comp-time inlined Socket package homepage.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_HOMEPAGE']\".\n    INLINED_SOCKET_CLI_HOMEPAGE: envAsString(\n      process.env['INLINED_SOCKET_CLI_HOMEPAGE'],\n    ),\n    // Comp-time inlined flag to determine if this is the Legacy build.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_LEGACY_BUILD']\".\n    INLINED_SOCKET_CLI_LEGACY_BUILD: envAsBoolean(\n      process.env['INLINED_SOCKET_CLI_LEGACY_BUILD'],\n    ),\n    // Comp-time inlined Socket package name.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_NAME']\".\n    INLINED_SOCKET_CLI_NAME: envAsString(\n      process.env['INLINED_SOCKET_CLI_NAME'],\n    ),\n    // Comp-time inlined flag to determine if this is a published build.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_PUBLISHED_BUILD']\".\n    INLINED_SOCKET_CLI_PUBLISHED_BUILD,\n    // Comp-time inlined flag to determine if this is the Sentry build.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_SENTRY_BUILD']\".\n    INLINED_SOCKET_CLI_SENTRY_BUILD: envAsBoolean(\n      process.env['INLINED_SOCKET_CLI_SENTRY_BUILD'],\n    ),\n    // Comp-time inlined synp package version.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_SYNP_VERSION']\".\n    INLINED_SOCKET_CLI_SYNP_VERSION: envAsString(\n      process.env['INLINED_SOCKET_CLI_SYNP_VERSION'],\n    ),\n    // Comp-time inlined Socket package version.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_VERSION']\".\n    INLINED_SOCKET_CLI_VERSION: envAsString(\n      process.env['INLINED_SOCKET_CLI_VERSION'],\n    ),\n    // Comp-time inlined Socket package version hash.\n    // The '@rollup/plugin-replace' will replace \"process.env['INLINED_SOCKET_CLI_VERSION_HASH']\".\n    INLINED_SOCKET_CLI_VERSION_HASH: envAsString(\n      process.env['INLINED_SOCKET_CLI_VERSION_HASH'],\n    ),\n    // Enable the module compile cache for the Node.js instance.\n    // https://nodejs.org/api/cli.html#node_compile_cachedir\n    NODE_COMPILE_CACHE: constants.SUPPORTS_NODE_COMPILE_CACHE_ENV_VAR\n      ? constants.socketCachePath\n      : '',\n    // Redefine registryConstants.ENV.NODE_ENV to account for the\n    // INLINED_SOCKET_CLI_PUBLISHED_BUILD environment variable.\n    NODE_ENV:\n      envAsString(env['NODE_ENV']).toLowerCase() === 'production'\n        ? 'production'\n        : INLINED_SOCKET_CLI_PUBLISHED_BUILD\n          ? ''\n          : 'development',\n    // Well known \"root\" CAs (like VeriSign) will be extended with the extra\n    // certificates in file. The file should consist of one or more trusted\n    // certificates in PEM format.\n    // https://nodejs.org/api/cli.html#node_extra_ca_certsfile\n    NODE_EXTRA_CA_CERTS:\n      envAsString(env['NODE_EXTRA_CA_CERTS']) ||\n      // Commonly used environment variable to specify the path to a single\n      // PEM-encoded certificate file.\n      envAsString(env['SSL_CERT_FILE']),\n    // PATH is an environment variable that lists directories where executable\n    // programs are located. When a command is run, the system searches these\n    // directories to find the executable.\n    PATH: envAsString(env['PATH']),\n    // Accept risks of a Socket wrapped npm/npx run.\n    SOCKET_CLI_ACCEPT_RISKS: envAsBoolean(env[SOCKET_CLI_ACCEPT_RISKS]),\n    // Change the base URL for Socket API calls.\n    // https://github.com/SocketDev/socket-cli?tab=readme-ov-file#environment-variables-for-development\n    SOCKET_CLI_API_BASE_URL:\n      envAsString(env['SOCKET_CLI_API_BASE_URL']) ||\n      // TODO: Remove legacy environment variable name.\n      envAsString(env['SOCKET_SECURITY_API_BASE_URL']) ||\n      getConfigValueOrUndef('apiBaseUrl') ||\n      API_V0_URL,\n    // Set the proxy that all requests are routed through.\n    // https://github.com/SocketDev/socket-cli?tab=readme-ov-file#environment-variables-for-development\n    SOCKET_CLI_API_PROXY:\n      envAsString(env['SOCKET_CLI_API_PROXY']) ||\n      // TODO: Remove legacy environment variable name.\n      envAsString(env['SOCKET_SECURITY_API_PROXY']) ||\n      // Commonly used environment variables to specify routing requests through\n      // a proxy server.\n      envAsString(env['HTTPS_PROXY']) ||\n      envAsString(env['https_proxy']) ||\n      envAsString(env['HTTP_PROXY']) ||\n      envAsString(env['http_proxy']),\n    // Set the timeout in milliseconds for Socket API requests.\n    // https://nodejs.org/api/http.html#httprequesturl-options-callback\n    SOCKET_CLI_API_TIMEOUT: envAsNumber(env['SOCKET_CLI_API_TIMEOUT']),\n    // Set the Socket API token.\n    // https://github.com/SocketDev/socket-cli?tab=readme-ov-file#environment-variables\n    SOCKET_CLI_API_TOKEN:\n      envAsString(env['SOCKET_CLI_API_TOKEN']) ||\n      // TODO: Remove legacy environment variable names.\n      envAsString(env['SOCKET_CLI_API_KEY']) ||\n      envAsString(env['SOCKET_SECURITY_API_TOKEN']) ||\n      envAsString(env['SOCKET_SECURITY_API_KEY']),\n    // A JSON stringified Socket configuration object.\n    SOCKET_CLI_CONFIG: envAsString(env['SOCKET_CLI_CONFIG']),\n    // The git config user.email used by Socket CLI.\n    SOCKET_CLI_GIT_USER_EMAIL:\n      envAsString(env['SOCKET_CLI_GIT_USER_EMAIL']) ||\n      'github-actions[bot]@users.noreply.github.com',\n    // The git config user.name used by Socket CLI.\n    SOCKET_CLI_GIT_USER_NAME:\n      envAsString(env['SOCKET_CLI_GIT_USER_NAME']) ||\n      envAsString(env['SOCKET_CLI_GIT_USERNAME']) ||\n      'github-actions[bot]',\n    // Change the base URL for GitHub REST API calls.\n    // https://docs.github.com/en/rest\n    SOCKET_CLI_GITHUB_API_URL:\n      envAsString(env['SOCKET_CLI_GITHUB_API_URL']) ||\n      readOrDefaultSocketJson(process.cwd())?.defaults?.scan?.github\n        ?.githubApiUrl ||\n      'https://api.github.com',\n    // A classic GitHub personal access token with the \"repo\" scope or a\n    // fine-grained access token with at least read/write permissions set for\n    // \"Contents\" and \"Pull Request\".\n    // https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens\n    SOCKET_CLI_GITHUB_TOKEN:\n      envAsString(env['SOCKET_CLI_GITHUB_TOKEN']) ||\n      // TODO: Remove undocumented legacy environment variable name.\n      envAsString(env['SOCKET_SECURITY_GITHUB_PAT']) ||\n      GITHUB_TOKEN,\n    // Make the default API token `undefined`.\n    SOCKET_CLI_NO_API_TOKEN: envAsBoolean(env['SOCKET_CLI_NO_API_TOKEN']),\n    // The absolute location of the npm directory.\n    SOCKET_CLI_NPM_PATH: envAsString(env['SOCKET_CLI_NPM_PATH']),\n    // Specify the Socket organization slug.\n    SOCKET_CLI_ORG_SLUG:\n      envAsString(env['SOCKET_CLI_ORG_SLUG']) ||\n      // Coana CLI accepts the SOCKET_ORG_SLUG environment variable.\n      envAsString(env['SOCKET_ORG_SLUG']),\n    // View all risks of a Socket wrapped npm/npx run.\n    SOCKET_CLI_VIEW_ALL_RISKS: envAsBoolean(env[SOCKET_CLI_VIEW_ALL_RISKS]),\n    // Specifies the type of terminal or terminal emulator being used by the process.\n    TERM: envAsString(env['TERM']),\n  })\n}\n\nconst lazyBashRcPath = () => path.join(constants.homePath, '.bashrc')\n\nconst lazyBinPath = () => path.join(constants.rootPath, 'bin')\n\nconst lazyBinCliPath = () => path.join(constants.binPath, 'cli.js')\n\nconst lazyBlessedContribPath = () =>\n  path.join(constants.externalPath, 'blessed-contrib')\n\nconst lazyBlessedOptions = () =>\n  Object.freeze({\n    smartCSR: true,\n    term: constants.WIN32 ? 'windows-ansi' : 'xterm',\n    useBCE: true,\n  })\n\nconst lazyBlessedPath = () => path.join(constants.externalPath, 'blessed')\n\nconst lazyDistCliPath = () => path.join(constants.distPath, 'cli.js')\n\nconst lazyDistPath = () => path.join(constants.rootPath, 'dist')\n\nconst lazyExternalPath = () => path.join(constants.rootPath, 'external')\n\nconst lazyGithubCachePath = () => path.join(constants.socketCachePath, 'github')\n\nconst lazyHomePath = () => os.homedir()\n\nconst lazyInstrumentWithSentryPath = () =>\n  path.join(constants.distPath, 'instrument-with-sentry.js')\n\nconst lazyMinimumVersionByAgent = () =>\n  new Map([\n    // Bun >=1.1.39 supports the text-based lockfile.\n    // https://bun.sh/blog/bun-lock-text-lockfile\n    [BUN, '1.1.39'],\n    // The npm version bundled with Node 18.\n    // https://nodejs.org/en/about/previous-releases#looking-for-the-latest-release-of-a-version-branch\n    [NPM, '10.8.2'],\n    // 8.x is the earliest version to support Node 18.\n    // https://pnpm.io/installation#compatibility\n    // https://www.npmjs.com/package/pnpm?activeTab=versions\n    [PNPM, '8.15.7'],\n    // 4.x supports >= Node 18.12.0\n    // https://github.com/yarnpkg/berry/blob/%40yarnpkg/core/4.1.0/CHANGELOG.md#400\n    [YARN_BERRY, '4.0.0'],\n    // Latest 1.x.\n    // https://www.npmjs.com/package/yarn?activeTab=versions\n    [YARN_CLASSIC, '1.22.22'],\n    // vlt does not support overrides so we don't gate on it.\n    [VLT, '*'],\n  ])\n\nconst lazyNmBinPath = () => path.join(constants.rootPath, 'node_modules/.bin')\n\nconst lazyNodeDebugFlags = () =>\n  constants.ENV.SOCKET_CLI_DEBUG ? ['--trace-uncaught', '--trace-warnings'] : []\n\n// Redefine registryConstants.nodeHardenFlags to account for the\n// INLINED_SOCKET_CLI_SENTRY_BUILD environment variable.\nconst lazyNodeHardenFlags = () =>\n  Object.freeze(\n    // Harden Node security.\n    // https://nodejs.org/en/learn/getting-started/security-best-practices\n    constants.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD || constants.WIN32\n      ? [\n          // https://nodejs.org/api/cli.html#--disallow-code-generation-from-strings\n          // '--disallow-code-generation-from-strings'\n        ]\n      : [\n          // '--disallow-code-generation-from-strings',\n          // https://nodejs.org/api/cli.html#--disable-protomode\n          // '--disable-proto',\n          // 'throw',\n          // https://nodejs.org/api/cli.html#--frozen-intrinsics\n          // We have contributed the following patches to our dependencies to make\n          // Node's --frozen-intrinsics workable.\n          // √ https://github.com/SBoudrias/Inquirer.js/pull/1683\n          // √ https://github.com/pnpm/components/pull/23\n          // '--frozen-intrinsics',\n          // https://nodejs.org/api/cli.html#--no-deprecation\n          // '--no-deprecation',\n        ],\n  )\n\nconst lazyNodeMemoryFlags = () => {\n  const flags = /*@__PURE__*/ require(\n    path.join(constants.rootPath, 'dist/flags.js'),\n  )\n  const getMaxOldSpaceSizeFlag = flags.getMaxOldSpaceSizeFlag\n  const getMaxSemiSpaceSizeFlag = flags.getMaxSemiSpaceSizeFlag\n  return Object.freeze([\n    `--max-old-space-size=${getMaxOldSpaceSizeFlag()}`,\n    `--max-semi-space-size=${getMaxSemiSpaceSizeFlag()}`,\n  ])\n}\n\nconst lazyNpmCachePath = () => {\n  const spawnHelpers = /*@__PURE__*/ require('@socketsecurity/registry/lib/spawn')\n  const spawnSync = spawnHelpers.spawnSync\n  return spawnSync(\n    constants.npmExecPath,\n    ['config', 'get', 'cache'],\n    getNpmStdioPipeOptions(),\n  ).stdout\n}\n\nconst lazyNpmGlobalPrefix = () => {\n  const spawnHelpers = /*@__PURE__*/ require('@socketsecurity/registry/lib/spawn')\n  const spawnSync = spawnHelpers.spawnSync\n  return spawnSync(\n    constants.npmExecPath,\n    ['prefix', '-g'],\n    getNpmStdioPipeOptions(),\n  ).stdout\n}\n\nconst lazyNpmNmNodeGypPath = () =>\n  path.join(\n    constants.npmRealExecPath,\n    '../../node_modules/node-gyp/bin/node-gyp.js',\n  )\n\nconst lazyProcessEnv = () =>\n  Object.setPrototypeOf(\n    Object.fromEntries(\n      Object.entries(constants.ENV).reduce(\n        (entries, entry) => {\n          const { 0: key, 1: value } = entry\n          if (key.startsWith('INLINED_SOCKET_CLI_')) {\n            return entries\n          }\n          if (typeof value === 'string') {\n            if (value) {\n              entries.push(entry as [string, string])\n            }\n          } else if (typeof value === 'boolean' && value) {\n            entries.push([key, '1'])\n          }\n          return entries\n        },\n        [] as Array<[string, string]>,\n      ),\n    ),\n    null,\n  )\n\nconst lazyRootPath = () => path.join(realpathSync.native(__dirname), '..')\n\nconst lazyShadowBinPath = () => path.join(constants.rootPath, 'shadow-npm-bin')\n\nconst lazyShadowNpmBinPath = () =>\n  path.join(constants.distPath, 'shadow-npm-bin.js')\n\nconst lazyShadowNpmInjectPath = () =>\n  path.join(constants.distPath, 'shadow-npm-inject.js')\n\nconst lazyShadowNpxBinPath = () =>\n  path.join(constants.distPath, 'shadow-npx-bin.js')\n\nconst lazyShadowPnpmBinPath = () =>\n  path.join(constants.distPath, 'shadow-pnpm-bin.js')\n\nconst lazyShadowYarnBinPath = () =>\n  path.join(constants.distPath, 'shadow-yarn-bin.js')\n\nconst lazySocketAppDataPath = (): string | undefined => {\n  // Get the OS app data directory:\n  // - Win: %LOCALAPPDATA% or fail?\n  // - Mac: %XDG_DATA_HOME% or fallback to \"~/Library/Application Support/\"\n  // - Linux: %XDG_DATA_HOME% or fallback to \"~/.local/share/\"\n  // Note: LOCALAPPDATA is typically: C:\\Users\\USERNAME\\AppData\n  // Note: XDG stands for \"X Desktop Group\", nowadays \"freedesktop.org\"\n  //       On most systems that path is: $HOME/.local/share\n  // Then append `socket/settings`, so:\n  // - Win: %LOCALAPPDATA%\\socket\\settings or return undefined\n  // - Mac: %XDG_DATA_HOME%/socket/settings or \"~/Library/Application Support/socket/settings\"\n  // - Linux: %XDG_DATA_HOME%/socket/settings or \"~/.local/share/socket/settings\"\n  const { WIN32 } = constants\n  let dataHome: string | undefined = WIN32\n    ? constants.ENV.LOCALAPPDATA\n    : constants.ENV.XDG_DATA_HOME\n  if (!dataHome) {\n    if (WIN32) {\n      const logger = /*@__PURE__*/ require('@socketsecurity/registry/lib/logger')\n      logger.warn(`Missing %LOCALAPPDATA%.`)\n    } else {\n      dataHome = path.join(\n        constants.homePath,\n        constants.DARWIN ? 'Library/Application Support' : '.local/share',\n      )\n    }\n  }\n  return dataHome ? path.join(dataHome, 'socket/settings') : undefined\n}\n\nconst lazySocketCachePath = () => path.join(constants.rootPath, '.cache')\n\nconst lazySocketRegistryPath = () =>\n  path.join(constants.externalPath, '@socketsecurity/registry')\n\nconst lazyZshRcPath = () => path.join(constants.homePath, '.zshrc')\n\nconst constants: Constants = createConstantsObject(\n  {\n    ...registryConstantsAttribs.props,\n    ALERT_TYPE_CRITICAL_CVE,\n    ALERT_TYPE_CVE,\n    ALERT_TYPE_MEDIUM_CVE,\n    ALERT_TYPE_MILD_CVE,\n    API_V0_URL,\n    BUN,\n    CONFIG_KEY_API_BASE_URL,\n    CONFIG_KEY_API_PROXY,\n    CONFIG_KEY_API_TOKEN,\n    CONFIG_KEY_DEFAULT_ORG,\n    CONFIG_KEY_ENFORCED_ORGS,\n    CONFIG_KEY_ORG,\n    DOT_GIT_DIR,\n    DOT_SOCKET_DIR,\n    DOT_SOCKET_DOT_FACTS_JSON,\n    DRY_RUN_BAILING_NOW,\n    DRY_RUN_LABEL,\n    DRY_RUN_NOT_SAVING,\n    ENV: undefined,\n    ENVIRONMENT_YAML,\n    ENVIRONMENT_YML,\n    ERROR_NO_MANIFEST_FILES,\n    ERROR_NO_PACKAGE_JSON,\n    ERROR_NO_REPO_FOUND,\n    ERROR_NO_SOCKET_DIR,\n    ERROR_UNABLE_RESOLVE_ORG,\n    EXT_YAML,\n    EXT_YML,\n    FLAG_CONFIG,\n    FLAG_DRY_RUN,\n    FLAG_HELP,\n    FLAG_ID,\n    FLAG_JSON,\n    FLAG_MARKDOWN,\n    FLAG_ORG,\n    FLAG_PIN,\n    FLAG_PROD,\n    FLAG_QUIET,\n    FLAG_SILENT,\n    FLAG_TEXT,\n    FLAG_VERBOSE,\n    FLAG_VERSION,\n    FOLD_SETTING_FILE,\n    FOLD_SETTING_NONE,\n    FOLD_SETTING_PKG,\n    FOLD_SETTING_VERSION,\n    GQL_PAGE_SENTINEL,\n    GQL_PR_STATE_CLOSED,\n    GQL_PR_STATE_MERGED,\n    GQL_PR_STATE_OPEN,\n    HTTP_STATUS_BAD_REQUEST,\n    HTTP_STATUS_FORBIDDEN,\n    HTTP_STATUS_INTERNAL_SERVER_ERROR,\n    HTTP_STATUS_NOT_FOUND,\n    HTTP_STATUS_UNAUTHORIZED,\n    NODE_MODULES,\n    NPM_BUGGY_OVERRIDES_PATCHED_VERSION,\n    NPM_REGISTRY_URL,\n    NPX,\n    OUTPUT_JSON,\n    OUTPUT_MARKDOWN,\n    OUTPUT_TEXT,\n    PACKAGE_JSON,\n    PACKAGE_LOCK_JSON,\n    PNPM,\n    PNPM_LOCK_YAML,\n    PNPM_WORKSPACE_YAML,\n    REDACTED,\n    REPORT_LEVEL_DEFER,\n    REPORT_LEVEL_ERROR,\n    REPORT_LEVEL_IGNORE,\n    REPORT_LEVEL_MONITOR,\n    REPORT_LEVEL_WARN,\n    REQUIREMENTS_TXT,\n    SOCKET_CLI_ACCEPT_RISKS,\n    SOCKET_CLI_BIN_NAME,\n    SOCKET_CLI_ISSUES_URL,\n    SOCKET_CLI_SHADOW_ACCEPT_RISKS,\n    SOCKET_CLI_SHADOW_API_TOKEN,\n    SOCKET_CLI_SHADOW_BIN,\n    SOCKET_CLI_SHADOW_PROGRESS,\n    SOCKET_CLI_SHADOW_SILENT,\n    SOCKET_CLI_VIEW_ALL_RISKS,\n    SOCKET_DEFAULT_BRANCH,\n    SOCKET_DEFAULT_REPOSITORY,\n    SOCKET_JSON,\n    SOCKET_WEBSITE_URL,\n    SOCKET_YAML,\n    SOCKET_YML,\n    TSCONFIG_JSON,\n    UNKNOWN_ERROR,\n    UNKNOWN_VALUE,\n    V1_MIGRATION_GUIDE_URL,\n    VLT,\n    YARN,\n    YARN_BERRY,\n    YARN_CLASSIC,\n    bashRcPath: undefined,\n    binPath: undefined,\n    binCliPath: undefined,\n    blessedContribPath: undefined,\n    blessedOptions: undefined,\n    blessedPath: undefined,\n    distCliPath: undefined,\n    distPath: undefined,\n    externalPath: undefined,\n    githubCachePath: undefined,\n    homePath: undefined,\n    instrumentWithSentryPath: undefined,\n    minimumVersionByAgent: undefined,\n    nmBinPath: undefined,\n    nodeHardenFlags: undefined,\n    nodeDebugFlags: undefined,\n    nodeMemoryFlags: undefined,\n    npmCachePath: undefined,\n    npmGlobalPrefix: undefined,\n    npmNmNodeGypPath: undefined,\n    processEnv: undefined,\n    rootPath: undefined,\n    shadowBinPath: undefined,\n    shadowNpmInjectPath: undefined,\n    shadowNpmBinPath: undefined,\n    shadowPnpmBinPath: undefined,\n    shadowYarnBinPath: undefined,\n    socketAppDataPath: undefined,\n    socketCachePath: undefined,\n    socketRegistryPath: undefined,\n    zshRcPath: undefined,\n  },\n  {\n    getters: {\n      ...registryConstantsAttribs.getters,\n      ENV: LAZY_ENV,\n      bashRcPath: lazyBashRcPath,\n      binCliPath: lazyBinCliPath,\n      binPath: lazyBinPath,\n      blessedContribPath: lazyBlessedContribPath,\n      blessedOptions: lazyBlessedOptions,\n      blessedPath: lazyBlessedPath,\n      distCliPath: lazyDistCliPath,\n      distPath: lazyDistPath,\n      externalPath: lazyExternalPath,\n      githubCachePath: lazyGithubCachePath,\n      homePath: lazyHomePath,\n      instrumentWithSentryPath: lazyInstrumentWithSentryPath,\n      minimumVersionByAgent: lazyMinimumVersionByAgent,\n      nmBinPath: lazyNmBinPath,\n      nodeDebugFlags: lazyNodeDebugFlags,\n      nodeHardenFlags: lazyNodeHardenFlags,\n      nodeMemoryFlags: lazyNodeMemoryFlags,\n      npmCachePath: lazyNpmCachePath,\n      npmGlobalPrefix: lazyNpmGlobalPrefix,\n      npmNmNodeGypPath: lazyNpmNmNodeGypPath,\n      processEnv: lazyProcessEnv,\n      rootPath: lazyRootPath,\n      shadowBinPath: lazyShadowBinPath,\n      shadowNpmBinPath: lazyShadowNpmBinPath,\n      shadowNpmInjectPath: lazyShadowNpmInjectPath,\n      shadowNpxBinPath: lazyShadowNpxBinPath,\n      shadowPnpmBinPath: lazyShadowPnpmBinPath,\n      shadowYarnBinPath: lazyShadowYarnBinPath,\n      socketAppDataPath: lazySocketAppDataPath,\n      socketCachePath: lazySocketCachePath,\n      socketRegistryPath: lazySocketRegistryPath,\n      zshRcPath: lazyZshRcPath,\n    },\n    internals: {\n      ...registryConstantsAttribs.internals,\n      getIpc,\n      getSentry() {\n        return _Sentry\n      },\n      setSentry(Sentry: Sentry): boolean {\n        if (_Sentry === undefined) {\n          _Sentry = Sentry\n          return true\n        }\n        return false\n      },\n    },\n  },\n) as Constants\n\nexport {\n  // Re-exported from socket-registry.\n  AT_LATEST,\n  BIOME_JSON,\n  BUN,\n  CI,\n  COLUMN_LIMIT,\n  DOT_GIT_DIR,\n  DOT_PACKAGE_LOCK_JSON,\n  DOT_SOCKET_DIR,\n  EMPTY_FILE,\n  EMPTY_VALUE,\n  ESLINT_CONFIG_JS,\n  ESNEXT,\n  EXTENSIONS,\n  EXTENSIONS_JSON,\n  EXT_CJS,\n  EXT_CMD,\n  EXT_CTS,\n  EXT_DTS,\n  EXT_JS,\n  EXT_JSON,\n  EXT_LOCK,\n  EXT_LOCKB,\n  EXT_MD,\n  EXT_MJS,\n  EXT_MTS,\n  EXT_PS1,\n  EXT_YAML,\n  EXT_YML,\n  GITIGNORE,\n  LATEST,\n  LICENSE,\n  LICENSE_GLOB,\n  LICENSE_GLOB_RECURSIVE,\n  LICENSE_ORIGINAL,\n  LICENSE_ORIGINAL_GLOB,\n  LICENSE_ORIGINAL_GLOB_RECURSIVE,\n  LOOP_SENTINEL,\n  MANIFEST_JSON,\n  MIT,\n  NODE_AUTH_TOKEN,\n  NODE_ENV,\n  NODE_MODULES,\n  NODE_MODULES_GLOB_RECURSIVE,\n  NPM,\n  NPX,\n  OVERRIDES,\n  PACKAGE_DEFAULT_VERSION,\n  PACKAGE_JSON,\n  PACKAGE_LOCK_JSON,\n  PNPM,\n  PNPM_LOCK_YAML,\n  PRE_COMMIT,\n  README_GLOB,\n  README_GLOB_RECURSIVE,\n  README_MD,\n  REGISTRY,\n  REGISTRY_SCOPE_DELIMITER,\n  RESOLUTIONS,\n  SOCKET_GITHUB_ORG,\n  SOCKET_IPC_HANDSHAKE,\n  SOCKET_OVERRIDE_SCOPE,\n  SOCKET_PUBLIC_API_TOKEN,\n  SOCKET_REGISTRY_NPM_ORG,\n  SOCKET_REGISTRY_PACKAGE_NAME,\n  SOCKET_REGISTRY_REPO_NAME,\n  SOCKET_REGISTRY_SCOPE,\n  SOCKET_SECURITY_SCOPE,\n  TSCONFIG_JSON,\n  UNKNOWN_ERROR,\n  UNKNOWN_VALUE,\n  UNLICENCED,\n  UNLICENSED,\n  UTF8,\n  VITEST,\n  VLT,\n  YARN,\n  YARN_BERRY,\n  YARN_CLASSIC,\n  YARN_LOCK,\n  // Socket CLI specific constants.\n  ALERT_TYPE_CRITICAL_CVE,\n  ALERT_TYPE_CVE,\n  ALERT_TYPE_MEDIUM_CVE,\n  ALERT_TYPE_MILD_CVE,\n  API_V0_URL,\n  CONFIG_KEY_API_BASE_URL,\n  CONFIG_KEY_API_PROXY,\n  CONFIG_KEY_API_TOKEN,\n  CONFIG_KEY_DEFAULT_ORG,\n  CONFIG_KEY_ENFORCED_ORGS,\n  CONFIG_KEY_ORG,\n  DOT_SOCKET_DOT_FACTS_JSON,\n  DRY_RUN_BAILING_NOW,\n  DRY_RUN_LABEL,\n  DRY_RUN_NOT_SAVING,\n  ENVIRONMENT_YAML,\n  ENVIRONMENT_YML,\n  ERROR_NO_MANIFEST_FILES,\n  ERROR_NO_PACKAGE_JSON,\n  ERROR_NO_REPO_FOUND,\n  ERROR_NO_SOCKET_DIR,\n  ERROR_UNABLE_RESOLVE_ORG,\n  FLAG_CONFIG,\n  FLAG_DRY_RUN,\n  FLAG_HELP,\n  FLAG_ID,\n  FLAG_JSON,\n  FLAG_MARKDOWN,\n  FLAG_ORG,\n  FLAG_PIN,\n  FLAG_PROD,\n  FLAG_QUIET,\n  FLAG_SILENT,\n  FLAG_TEXT,\n  FLAG_VERBOSE,\n  FLAG_VERSION,\n  FOLD_SETTING_FILE,\n  FOLD_SETTING_NONE,\n  FOLD_SETTING_PKG,\n  FOLD_SETTING_VERSION,\n  GQL_PAGE_SENTINEL,\n  GQL_PR_STATE_CLOSED,\n  GQL_PR_STATE_MERGED,\n  GQL_PR_STATE_OPEN,\n  HTTP_STATUS_BAD_REQUEST,\n  HTTP_STATUS_FORBIDDEN,\n  HTTP_STATUS_INTERNAL_SERVER_ERROR,\n  HTTP_STATUS_NOT_FOUND,\n  HTTP_STATUS_UNAUTHORIZED,\n  NPM_BUGGY_OVERRIDES_PATCHED_VERSION,\n  NPM_REGISTRY_URL,\n  OUTPUT_JSON,\n  OUTPUT_MARKDOWN,\n  OUTPUT_TEXT,\n  PNPM_WORKSPACE_YAML,\n  REDACTED,\n  REPORT_LEVEL_DEFER,\n  REPORT_LEVEL_ERROR,\n  REPORT_LEVEL_IGNORE,\n  REPORT_LEVEL_MONITOR,\n  REPORT_LEVEL_WARN,\n  REQUIREMENTS_TXT,\n  SOCKET_CLI_ACCEPT_RISKS,\n  SOCKET_CLI_BIN_NAME,\n  SOCKET_CLI_ISSUES_URL,\n  SOCKET_CLI_SHADOW_ACCEPT_RISKS,\n  SOCKET_CLI_SHADOW_API_TOKEN,\n  SOCKET_CLI_SHADOW_BIN,\n  SOCKET_CLI_SHADOW_PROGRESS,\n  SOCKET_CLI_SHADOW_SILENT,\n  SOCKET_CLI_VIEW_ALL_RISKS,\n  SOCKET_DEFAULT_BRANCH,\n  SOCKET_DEFAULT_REPOSITORY,\n  SOCKET_JSON,\n  SOCKET_WEBSITE_URL,\n  SOCKET_YAML,\n  SOCKET_YML,\n  V1_MIGRATION_GUIDE_URL,\n}\n\nexport default constants\n"],"names":["attributes","getIpc","_npmStdioPipeOptions","cwd","env","__proto__","DISABLE_GITHUB_CACHE","GITHUB_BASE_REF","GITHUB_REF_NAME","GITHUB_REF_TYPE","GITHUB_REPOSITORY","NODE_EXTRA_CA_CERTS","envAsString","PATH","SOCKET_CLI_ACCEPT_RISKS","SOCKET_CLI_API_BASE_URL","SOCKET_CLI_API_PROXY","SOCKET_CLI_API_TIMEOUT","SOCKET_CLI_API_TOKEN","SOCKET_CLI_CONFIG","SOCKET_CLI_GIT_USER_NAME","SOCKET_CLI_GITHUB_TOKEN","SOCKET_CLI_NO_API_TOKEN","SOCKET_CLI_NPM_PATH","SOCKET_CLI_ORG_SLUG","SOCKET_CLI_VIEW_ALL_RISKS","TERM","smartCSR","term","useBCE","constants","entries","WIN32","logger","dataHome","ENV","bashRcPath","binPath","binCliPath","blessedContribPath","blessedOptions","blessedPath","distCliPath","distPath","externalPath","githubCachePath","homePath","instrumentWithSentryPath","minimumVersionByAgent","nmBinPath","nodeHardenFlags","nodeDebugFlags","nodeMemoryFlags","npmCachePath","npmGlobalPrefix","npmNmNodeGypPath","processEnv","rootPath","shadowBinPath","shadowNpmInjectPath","shadowNpmBinPath","shadowPnpmBinPath","shadowYarnBinPath","socketAppDataPath","socketCachePath","socketRegistryPath","zshRcPath","getters","shadowNpxBinPath","internals","getSentry","_Sentry"],"mappings":";;;;;;;;;;;;AAYA;AACA;AACA;AACA;AACA;AACA;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiFE;AACEA;;AAEAC;AACF;AACF;AAgFA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAmJA;AAEA;AACA;;AAEIC;AACEC;AACA;AACA;AACA;;;AAGJ;AACA;AACF;AAEA;;AACUC;AAAI;AACZ;AACA;AAGA;AACA;AACA;AACA;AACA;;;AAKA;AACA;;AAEEC;AACA;;AAEA;AACA;AACAC;AACA;AACA;;AAGA;AACA;AACA;AACA;AACAC;AACA;AACA;AACA;AACA;AACAC;AACA;AACA;AACAC;AACA;AACA;AACAC;AACA;AACA;;AAGA;AACA;AACA;AACA;;AAEA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAEA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAIA;AACA;;AAOA;AACA;AACA;AACA;AACAC;AAEE;AACA;AACAC;AACF;AACA;AACA;AACAC;AACA;AACAC;AACA;AACA;AACAC;AAEE;AACAH;AAGF;AACA;AACAI;AAEE;AACAJ;AACA;AACA;AACAA;AAIF;AACA;AACAK;AACA;AACA;AACAC;AAEE;;AAIF;AACAC;AACA;;AAIA;AACAC;AAIA;AACA;;AAMA;AACA;AACA;AACA;AACAC;AAEE;AACAT;AAEF;AACAU;AACA;AACAC;AACA;AACAC;AAEE;AACAZ;AACF;AACAa;AACA;AACAC;AACF;AACF;AAEA;AAEA;AAEA;AAEA;AAGA;AAEIC;AACAC;AACAC;AACF;AAEF;AAEA;AAEA;AAEA;AAEA;AAEA;AAEA;AAGA;AAEI;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGJ;AAEA;;AAGA;AACA;AACA;AAEI;AACA;AACAC;AAEM;AACA;AAAA;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAAA;AAIV;AACE;AAGA;AACA;AACA;AAIF;AAEA;AACE;AACA;AACA;AAKF;AAEA;AACE;AACA;AACA;AAKF;AAEA;AAMA;;AAKkB;AAAQ;AAAS;AACzB;AACE;AACF;AACA;AACE;AACEC;AACF;;;AAGF;AACA;AACF;AAOR;AAEA;AAEA;AAGA;AAGA;AAGA;AAGA;AAGA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACQC;AAAM;AACd;;AAIE;AACE;AACAC;AACF;AACEC;AAIF;AACF;;AAEF;AAEA;AAEA;AAGA;AAEA;;;;;;;;;;;;;;;;;;;;AAqBIC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+EAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACF;AAEEC;;AAEEhC;AACAC;AACAE;AACAD;AACAE;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAE;AACAD;AACAE;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAE;AACAD;AACAS;AACAP;AACAC;AACAC;AACAC;AACAC;AACAC;;AAEFG;;;AAGEC;AACE;;;;AAIEC;AACA;AACF;AACA;AACF;AACF;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;","debugId":"c1920328-8086-4fc1-a542-3b0b654e3cc8"}

package/dist/shadow-pnpm-bin2.js

@@ -296,7 +296,11 @@ async function shadowPnpmBin(args = process.argv.slice(2), options, extra) {
       ...process.env,
       ...spawnEnv
     },
-    stdio
+    stdio,
+    // On Windows, pnpm is often a .cmd file that requires shell execution.
+    // The spawn function from @socketsecurity/registry will handle this properly
+    // when shell is true.
+    shell: constants.default.WIN32
   }, extra);
 
   // Send IPC handshake.
@@ -315,5 +319,5 @@ async function shadowPnpmBin(args = process.argv.slice(2), options, extra) {
 
 exports.scanPackagesAndLogAlerts = scanPackagesAndLogAlerts;
 exports.shadowPnpmBin = shadowPnpmBin;
-//# debugId=acc15873-04df-4d32-aa27-434eb8c520e1
+//# debugId=cdf92b11-1bc1-407a-8db7-38adcb6998cc
 //# sourceMappingURL=shadow-pnpm-bin2.js.map

package/dist/shadow-pnpm-bin2.js.map

@@ -1 +1 @@
-{"version":3,"file":"shadow-pnpm-bin2.js","sources":["../src/shadow/common.mts","../src/shadow/pnpm/link.mts","../src/shadow/pnpm/bin.mts"],"sourcesContent":["import { promises as fs } from 'node:fs'\nimport { fileURLToPath } from 'node:url'\n\nimport { debugDir, debugFn } from '@socketsecurity/registry/lib/debug'\nimport { logger } from '@socketsecurity/registry/lib/logger'\n\nimport constants, { FLAG_DRY_RUN } from '../constants.mts'\nimport { getAlertsMapFromPurls } from '../utils/alerts-map.mts'\nimport { debugScan } from '../utils/debug.mts'\nimport { safeNpmSpecToPurl } from '../utils/npm-spec.mts'\nimport { logAlertsMap } from '../utils/socket-package-alert.mts'\n\nimport type { AlertsByPurl } from '../utils/socket-package-alert.mts'\nimport type { Spinner } from '@socketsecurity/registry/lib/spinner'\n\n/**\n * Extract package PURLs from add/dlx command arguments.\n */\nexport function extractPackagePurlsFromArgs(\n  command: string,\n  rawArgs: string[] | readonly string[],\n  dlxCommands?: Set<string>,\n): string[] {\n  const packagePurls: string[] = []\n  const isDlxCommand = dlxCommands?.has(command)\n\n  if (command === 'add' || isDlxCommand) {\n    // For 'add package1 package2@version' or 'dlx package', get packages from args.\n    const packageArgs = rawArgs\n      .slice(1)\n      .filter(arg => !arg.startsWith('-') && arg !== '--')\n\n    for (const pkgSpec of packageArgs) {\n      const purl = safeNpmSpecToPurl(pkgSpec)\n      if (purl) {\n        packagePurls.push(purl)\n      }\n    }\n  }\n\n  return packagePurls\n}\n\n/**\n * Extract package PURLs from package.json for install/update commands.\n */\nexport async function extractPackagePurlsFromPackageJson(\n  cwd: string,\n): Promise<string[]> {\n  const packagePurls: string[] = []\n\n  try {\n    const packageJsonContent = await fs.readFile(`${cwd}/package.json`, 'utf8')\n    const packageJson = JSON.parse(packageJsonContent)\n\n    const allDeps = {\n      ...packageJson.dependencies,\n      ...packageJson.devDependencies,\n      ...packageJson.optionalDependencies,\n      ...packageJson.peerDependencies,\n    }\n\n    for (const [name, version] of Object.entries(allDeps)) {\n      const purl = safeNpmSpecToPurl(\n        typeof version === 'string' ? `${name}@${version}` : name,\n      )\n      if (purl) {\n        packagePurls.push(purl)\n      }\n    }\n\n    debugScan('start', packagePurls.length)\n  } catch (e) {\n    debugFn(\n      'warn',\n      'Package.json not found or invalid during dependency scanning',\n    )\n    debugDir('error', e)\n  }\n\n  return packagePurls\n}\n\nexport type PackageScanOptions = {\n  acceptRisks: boolean\n  command: string | undefined\n  cwd?: string | URL\n  dlxCommands?: Set<string>\n  installCommands: Set<string>\n  managerName: string\n  nothrow?: boolean\n  rawArgs: string[] | readonly string[]\n  spinner?: Spinner | undefined\n  viewAllRisks: boolean\n}\n\nexport type PackageScanResult = {\n  alertsMap?: AlertsByPurl\n  shouldExit: boolean\n}\n\n/**\n * Scan packages and log alerts if found.\n */\nexport async function scanPackagesAndLogAlerts(\n  options: PackageScanOptions,\n): Promise<PackageScanResult> {\n  const {\n    acceptRisks,\n    command,\n    dlxCommands,\n    installCommands,\n    managerName,\n    nothrow = true,\n    rawArgs,\n    spinner,\n    viewAllRisks,\n  } = options\n\n  let { cwd = process.cwd() } = options\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  // Check if this is a command that needs security scanning.\n  const isDlxCommand = dlxCommands && command && dlxCommands.has(command)\n  const isInstallCommand = command && installCommands.has(command)\n  const needsScanning = isDlxCommand || isInstallCommand\n\n  if (!needsScanning || rawArgs.includes(FLAG_DRY_RUN)) {\n    return { shouldExit: false }\n  }\n\n  // Extract package names from command arguments before any downloads.\n  let packagePurls: string[] = []\n\n  if (command === 'add' || isDlxCommand) {\n    packagePurls = extractPackagePurlsFromArgs(command, rawArgs, dlxCommands)\n  } else if (isInstallCommand) {\n    // For install/update, scan dependencies from package.json.\n    // Note: This scans direct dependencies only.\n    packagePurls = await extractPackagePurlsFromPackageJson(cwd)\n  }\n\n  if (!packagePurls.length) {\n    return { shouldExit: false }\n  }\n\n  debugScan('start', packagePurls.length)\n  debugDir('inspect', { packagePurls })\n\n  try {\n    const alertsMap = await getAlertsMapFromPurls(packagePurls, {\n      filter: acceptRisks\n        ? { actions: ['error'], blocked: true }\n        : { actions: ['error', 'monitor', 'warn'] },\n      nothrow,\n      spinner,\n    })\n\n    if (alertsMap.size) {\n      process.exitCode = 1\n      spinner?.stop()\n      logAlertsMap(alertsMap, {\n        hideAt: viewAllRisks ? 'none' : 'middle',\n        output: process.stderr,\n      })\n\n      const errorMessage = `Socket ${managerName} exiting due to risks.${\n        viewAllRisks\n          ? ''\n          : `\\nView all risks - Rerun with environment variable ${constants.SOCKET_CLI_VIEW_ALL_RISKS}=1.`\n      }${\n        acceptRisks\n          ? ''\n          : `\\nAccept risks - Rerun with environment variable ${constants.SOCKET_CLI_ACCEPT_RISKS}=1.`\n      }`.trim()\n\n      logger.error(errorMessage)\n      return { alertsMap, shouldExit: true }\n    }\n  } catch (e) {\n    spinner?.stop()\n    // Re-throw process.exit errors from tests.\n    if (e instanceof Error && e.message === 'process.exit called') {\n      throw e\n    }\n    debugScan('error', undefined, e)\n    // Continue with installation if scanning fails.\n  }\n\n  debugScan('complete', packagePurls.length)\n  debugDir('inspect', { args: rawArgs.slice(1) })\n\n  return { shouldExit: false }\n}\n","import path from 'node:path'\n\nimport cmdShim from 'cmd-shim'\n\nimport constants from '../../constants.mts'\nimport {\n  getPnpmBinPath,\n  isPnpmBinPathShadowed,\n} from '../../utils/pnpm-paths.mts'\n\nexport async function installLinks(\n  shadowBinPath: string,\n  _binName: 'pnpm',\n): Promise<string> {\n  // Find pnpm being shadowed by this process.\n  const binPath = getPnpmBinPath()\n  const { WIN32 } = constants\n\n  // TODO: Is this early exit needed?\n  if (WIN32 && binPath) {\n    return binPath\n  }\n\n  const shadowed = isPnpmBinPathShadowed()\n\n  // Move our bin directory to front of PATH so its found first.\n  if (!shadowed) {\n    if (WIN32) {\n      await cmdShim(\n        path.join(constants.distPath, 'pnpm-cli.js'),\n        path.join(shadowBinPath, 'pnpm'),\n      )\n    }\n    const { env } = process\n    env['PATH'] = `${shadowBinPath}${path.delimiter}${env['PATH']}`\n  }\n\n  return binPath\n}\n","import { existsSync } from 'node:fs'\nimport path from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nimport { debugDir, debugFn } from '@socketsecurity/registry/lib/debug'\nimport { logger } from '@socketsecurity/registry/lib/logger'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport { scanPackagesAndLogAlerts } from '../common.mts'\nimport { ensureIpcInStdio } from '../stdio-ipc.mts'\nimport { installLinks } from './link.mts'\nimport constants, {\n  FLAG_DRY_RUN,\n  PNPM,\n  PNPM_LOCK_YAML,\n} from '../../constants.mts'\nimport { getAlertsMapFromPnpmLockfile } from '../../utils/alerts-map.mts'\nimport { cmdFlagsToString } from '../../utils/cmd.mts'\nimport { parsePnpmLockfile, readPnpmLockfile } from '../../utils/pnpm.mts'\nimport { getPublicApiToken } from '../../utils/sdk.mts'\nimport { logAlertsMap } from '../../utils/socket-package-alert.mts'\n\nimport type { IpcObject } from '../../constants.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowPnpmOptions = SpawnOptions & {\n  ipc?: IpcObject | undefined\n}\n\nexport type ShadowPnpmResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nconst DLX_COMMANDS = new Set(['dlx'])\n\nconst INSTALL_COMMANDS = new Set([\n  'add',\n  'i',\n  'install',\n  'install-test',\n  'it',\n  'update',\n  'up',\n])\n\nexport default async function shadowPnpmBin(\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowPnpmOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowPnpmResult> {\n  const opts = { __proto__: null, ...options } as ShadowPnpmOptions\n  const { env: spawnEnv, ipc, ...spawnOpts } = opts\n  const { spinner } = opts\n\n  const wasSpinning = !!spinner?.isSpinning\n\n  spinner?.start()\n\n  let { cwd = process.cwd() } = opts\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  const terminatorPos = args.indexOf('--')\n  const rawPnpmArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n\n  // Check if this is a command that needs security scanning.\n  const command = rawPnpmArgs[0]\n  const isDlxCommand = command && DLX_COMMANDS.has(command)\n  const isInstallCommand = command && INSTALL_COMMANDS.has(command)\n  const needsScanning = isDlxCommand || isInstallCommand\n\n  if (needsScanning && !rawPnpmArgs.includes(FLAG_DRY_RUN)) {\n    const acceptRisks = !!constants.ENV.SOCKET_CLI_ACCEPT_RISKS\n    const viewAllRisks = !!constants.ENV.SOCKET_CLI_VIEW_ALL_RISKS\n\n    // Handle add and dlx commands with shared utility.\n    if (command === 'add' || isDlxCommand) {\n      const scanResult = await scanPackagesAndLogAlerts({\n        acceptRisks,\n        command,\n        cwd,\n        dlxCommands: DLX_COMMANDS,\n        installCommands: INSTALL_COMMANDS,\n        managerName: 'pnpm',\n        rawArgs: rawPnpmArgs,\n        spinner,\n        viewAllRisks,\n      })\n\n      if (scanResult.shouldExit) {\n        // eslint-disable-next-line n/no-process-exit\n        process.exit(1)\n        // This line is never reached in production, but helps tests.\n        throw new Error('process.exit called')\n      }\n    } else if (['install', 'i', 'update', 'up'].includes(command)) {\n      // For install/update, scan all dependencies from pnpm-lock.yaml\n      const pnpmLockPath = path.join(cwd, PNPM_LOCK_YAML)\n      if (existsSync(pnpmLockPath)) {\n        try {\n          const lockfileContent = await readPnpmLockfile(pnpmLockPath)\n          if (lockfileContent) {\n            const lockfile = parsePnpmLockfile(lockfileContent)\n            if (lockfile) {\n              // Use existing function to scan the entire lockfile\n              debugFn(\n                'notice',\n                `scanning: all dependencies from ${PNPM_LOCK_YAML}`,\n              )\n\n              const alertsMap = await getAlertsMapFromPnpmLockfile(lockfile, {\n                nothrow: true,\n                filter: acceptRisks\n                  ? { actions: ['error'], blocked: true }\n                  : { actions: ['error', 'monitor', 'warn'] },\n              })\n\n              spinner?.stop()\n\n              if (alertsMap.size) {\n                process.exitCode = 1\n                logAlertsMap(alertsMap, {\n                  hideAt: viewAllRisks ? 'none' : 'middle',\n                  output: process.stderr,\n                })\n\n                const errorMessage = `Socket pnpm exiting due to risks.${\n                  viewAllRisks\n                    ? ''\n                    : `\\nView all risks - Rerun with environment variable ${constants.SOCKET_CLI_VIEW_ALL_RISKS}=1.`\n                }${\n                  acceptRisks\n                    ? ''\n                    : `\\nAccept risks - Rerun with environment variable ${constants.SOCKET_CLI_ACCEPT_RISKS}=1.`\n                }`.trim()\n\n                logger.error(errorMessage)\n                // eslint-disable-next-line n/no-process-exit\n                process.exit(1)\n                // This line is never reached in production, but helps tests.\n                throw new Error('process.exit called')\n              }\n\n              // Return early since we've already done the scanning\n              debugFn(\n                'notice',\n                'complete: lockfile scanning, proceeding with install',\n              )\n            }\n          }\n        } catch (e) {\n          debugFn('error', 'PNPM lockfile scanning failed')\n          debugDir('error', e)\n        }\n      } else {\n        debugFn(\n          'notice',\n          'skip: no pnpm-lock.yaml found, skipping bulk install scanning',\n        )\n      }\n    }\n\n    debugFn('notice', 'complete: scanning, proceeding with install')\n  }\n\n  const realPnpmPath = await installLinks(constants.shadowBinPath, PNPM)\n\n  spinner?.stop()\n\n  const suffixArgs = [...rawPnpmArgs, ...otherArgs]\n\n  debugFn(\n    'notice',\n    `spawn: ${PNPM} shadow bin ${realPnpmPath} ${cmdFlagsToString(suffixArgs)}`,\n  )\n\n  if (wasSpinning) {\n    spinner?.start()\n  }\n\n  // Set up stdio with IPC channel.\n  const stdio = ensureIpcInStdio(spawnOpts.stdio)\n\n  const spawnPromise = spawn(\n    realPnpmPath,\n    suffixArgs,\n    {\n      ...spawnOpts,\n      env: {\n        ...process.env,\n        ...spawnEnv,\n      },\n      stdio,\n    },\n    extra,\n  )\n\n  // Send IPC handshake.\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: PNPM,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: true,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n"],"names":["packagePurls","debugScan","debugFn","debugDir","nothrow","viewAllRisks","cwd","shouldExit","blocked","actions","spinner","hideAt","logger","args","WIN32","env","__proto__","dlxCommands","installCommands","managerName","rawArgs","process","stdio","spawnPromise"],"mappings":";;;;;;;;;;;;;AAeA;AACA;AACA;AACO;;AAML;AAEA;AACE;;AAKA;AACE;AACA;AACEA;AACF;AACF;AACF;AAEA;AACF;;AAEA;AACA;AACA;AACO;;;AAMH;AACA;AAEA;;;;AAIE;;AAGF;AACE;AAGA;AACEA;AACF;AACF;AAEAC;;AAEAC;AAIAC;AACF;AAEA;AACF;AAoBA;AACA;AACA;AACO;;;;;;;AASHC;;;AAGAC;AACF;;AAEMC;AAAoB;;AAExBA;AACF;;AAEA;;;AAGA;;;AAGWC;;AACX;;AAEA;;AAGA;;;AAGE;AACA;AACAP;AACF;AAEA;;AACWO;;AACX;AAEAN;;AACsBD;AAAa;;AAGjC;;;AAE4BQ;AAAc;AAClCC;;;AAENC;AACF;;;;;AAMIC;;AAEF;AAEA;AAUAC;;;AACoBL;;AACtB;;;AAGA;;AAEE;AACF;AACAN;AACA;AACF;AAEAA;;AACsBY;AAAuB;;AAEpCN;;AACX;;ACzLO;AAIL;AACA;;AACQO;AAAM;;AAEd;;AAEE;AACF;AAEA;;AAEA;;AAEE;;AAKA;;AACQC;AAAI;AACZA;AACF;AAEA;AACF;;ACDA;AAEA;AAUe;AAKb;AAAeC;;;;AACPD;;;AAAiC;;AACjCL;AAAQ;AAEhB;;;AAIMJ;AAAoB;;AAExBA;AACF;AAEA;AACA;AACA;;AAEA;AACA;;;AAGA;;;;;AAME;AACA;AACE;;;;AAIEW;AACAC;AACAC;AACAC;;AAEAf;AACF;;AAGE;AACAgB;AACA;AACA;AACF;AACF;AACE;;AAEA;;AAEI;AACA;AACE;AACA;AACE;AACAnB;AAKA;AACEE;;;AAE0BI;AAAc;AAClCC;AAAsC;AAC9C;;;;;AAOIE;;AAEF;;AAYAC;AACA;AACAS;AACA;AACA;AACF;;AAEA;AACAnB;AAIF;AACF;;AAEAA;AACAC;AACF;AACF;AACED;AAIF;AACF;AAEAA;AACF;;;;AAQAA;AAKA;;AAEA;;AAEA;AACA;AAEA;AAII;AACAa;;;;AAIAO;;;AAKJ;AACAC;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;;","debugId":"acc15873-04df-4d32-aa27-434eb8c520e1"}
+{"version":3,"file":"shadow-pnpm-bin2.js","sources":["../src/shadow/common.mts","../src/shadow/pnpm/link.mts","../src/shadow/pnpm/bin.mts"],"sourcesContent":["import { promises as fs } from 'node:fs'\nimport { fileURLToPath } from 'node:url'\n\nimport { debugDir, debugFn } from '@socketsecurity/registry/lib/debug'\nimport { logger } from '@socketsecurity/registry/lib/logger'\n\nimport constants, { FLAG_DRY_RUN } from '../constants.mts'\nimport { getAlertsMapFromPurls } from '../utils/alerts-map.mts'\nimport { debugScan } from '../utils/debug.mts'\nimport { safeNpmSpecToPurl } from '../utils/npm-spec.mts'\nimport { logAlertsMap } from '../utils/socket-package-alert.mts'\n\nimport type { AlertsByPurl } from '../utils/socket-package-alert.mts'\nimport type { Spinner } from '@socketsecurity/registry/lib/spinner'\n\n/**\n * Extract package PURLs from add/dlx command arguments.\n */\nexport function extractPackagePurlsFromArgs(\n  command: string,\n  rawArgs: string[] | readonly string[],\n  dlxCommands?: Set<string>,\n): string[] {\n  const packagePurls: string[] = []\n  const isDlxCommand = dlxCommands?.has(command)\n\n  if (command === 'add' || isDlxCommand) {\n    // For 'add package1 package2@version' or 'dlx package', get packages from args.\n    const packageArgs = rawArgs\n      .slice(1)\n      .filter(arg => !arg.startsWith('-') && arg !== '--')\n\n    for (const pkgSpec of packageArgs) {\n      const purl = safeNpmSpecToPurl(pkgSpec)\n      if (purl) {\n        packagePurls.push(purl)\n      }\n    }\n  }\n\n  return packagePurls\n}\n\n/**\n * Extract package PURLs from package.json for install/update commands.\n */\nexport async function extractPackagePurlsFromPackageJson(\n  cwd: string,\n): Promise<string[]> {\n  const packagePurls: string[] = []\n\n  try {\n    const packageJsonContent = await fs.readFile(`${cwd}/package.json`, 'utf8')\n    const packageJson = JSON.parse(packageJsonContent)\n\n    const allDeps = {\n      ...packageJson.dependencies,\n      ...packageJson.devDependencies,\n      ...packageJson.optionalDependencies,\n      ...packageJson.peerDependencies,\n    }\n\n    for (const [name, version] of Object.entries(allDeps)) {\n      const purl = safeNpmSpecToPurl(\n        typeof version === 'string' ? `${name}@${version}` : name,\n      )\n      if (purl) {\n        packagePurls.push(purl)\n      }\n    }\n\n    debugScan('start', packagePurls.length)\n  } catch (e) {\n    debugFn(\n      'warn',\n      'Package.json not found or invalid during dependency scanning',\n    )\n    debugDir('error', e)\n  }\n\n  return packagePurls\n}\n\nexport type PackageScanOptions = {\n  acceptRisks: boolean\n  command: string | undefined\n  cwd?: string | URL\n  dlxCommands?: Set<string>\n  installCommands: Set<string>\n  managerName: string\n  nothrow?: boolean\n  rawArgs: string[] | readonly string[]\n  spinner?: Spinner | undefined\n  viewAllRisks: boolean\n}\n\nexport type PackageScanResult = {\n  alertsMap?: AlertsByPurl\n  shouldExit: boolean\n}\n\n/**\n * Scan packages and log alerts if found.\n */\nexport async function scanPackagesAndLogAlerts(\n  options: PackageScanOptions,\n): Promise<PackageScanResult> {\n  const {\n    acceptRisks,\n    command,\n    dlxCommands,\n    installCommands,\n    managerName,\n    nothrow = true,\n    rawArgs,\n    spinner,\n    viewAllRisks,\n  } = options\n\n  let { cwd = process.cwd() } = options\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  // Check if this is a command that needs security scanning.\n  const isDlxCommand = dlxCommands && command && dlxCommands.has(command)\n  const isInstallCommand = command && installCommands.has(command)\n  const needsScanning = isDlxCommand || isInstallCommand\n\n  if (!needsScanning || rawArgs.includes(FLAG_DRY_RUN)) {\n    return { shouldExit: false }\n  }\n\n  // Extract package names from command arguments before any downloads.\n  let packagePurls: string[] = []\n\n  if (command === 'add' || isDlxCommand) {\n    packagePurls = extractPackagePurlsFromArgs(command, rawArgs, dlxCommands)\n  } else if (isInstallCommand) {\n    // For install/update, scan dependencies from package.json.\n    // Note: This scans direct dependencies only.\n    packagePurls = await extractPackagePurlsFromPackageJson(cwd)\n  }\n\n  if (!packagePurls.length) {\n    return { shouldExit: false }\n  }\n\n  debugScan('start', packagePurls.length)\n  debugDir('inspect', { packagePurls })\n\n  try {\n    const alertsMap = await getAlertsMapFromPurls(packagePurls, {\n      filter: acceptRisks\n        ? { actions: ['error'], blocked: true }\n        : { actions: ['error', 'monitor', 'warn'] },\n      nothrow,\n      spinner,\n    })\n\n    if (alertsMap.size) {\n      process.exitCode = 1\n      spinner?.stop()\n      logAlertsMap(alertsMap, {\n        hideAt: viewAllRisks ? 'none' : 'middle',\n        output: process.stderr,\n      })\n\n      const errorMessage = `Socket ${managerName} exiting due to risks.${\n        viewAllRisks\n          ? ''\n          : `\\nView all risks - Rerun with environment variable ${constants.SOCKET_CLI_VIEW_ALL_RISKS}=1.`\n      }${\n        acceptRisks\n          ? ''\n          : `\\nAccept risks - Rerun with environment variable ${constants.SOCKET_CLI_ACCEPT_RISKS}=1.`\n      }`.trim()\n\n      logger.error(errorMessage)\n      return { alertsMap, shouldExit: true }\n    }\n  } catch (e) {\n    spinner?.stop()\n    // Re-throw process.exit errors from tests.\n    if (e instanceof Error && e.message === 'process.exit called') {\n      throw e\n    }\n    debugScan('error', undefined, e)\n    // Continue with installation if scanning fails.\n  }\n\n  debugScan('complete', packagePurls.length)\n  debugDir('inspect', { args: rawArgs.slice(1) })\n\n  return { shouldExit: false }\n}\n","import path from 'node:path'\n\nimport cmdShim from 'cmd-shim'\n\nimport constants from '../../constants.mts'\nimport {\n  getPnpmBinPath,\n  isPnpmBinPathShadowed,\n} from '../../utils/pnpm-paths.mts'\n\nexport async function installLinks(\n  shadowBinPath: string,\n  _binName: 'pnpm',\n): Promise<string> {\n  // Find pnpm being shadowed by this process.\n  const binPath = getPnpmBinPath()\n  const { WIN32 } = constants\n\n  // TODO: Is this early exit needed?\n  if (WIN32 && binPath) {\n    return binPath\n  }\n\n  const shadowed = isPnpmBinPathShadowed()\n\n  // Move our bin directory to front of PATH so its found first.\n  if (!shadowed) {\n    if (WIN32) {\n      await cmdShim(\n        path.join(constants.distPath, 'pnpm-cli.js'),\n        path.join(shadowBinPath, 'pnpm'),\n      )\n    }\n    const { env } = process\n    env['PATH'] = `${shadowBinPath}${path.delimiter}${env['PATH']}`\n  }\n\n  return binPath\n}\n","import { existsSync } from 'node:fs'\nimport path from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nimport { debugDir, debugFn } from '@socketsecurity/registry/lib/debug'\nimport { logger } from '@socketsecurity/registry/lib/logger'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport { scanPackagesAndLogAlerts } from '../common.mts'\nimport { ensureIpcInStdio } from '../stdio-ipc.mts'\nimport { installLinks } from './link.mts'\nimport constants, {\n  FLAG_DRY_RUN,\n  PNPM,\n  PNPM_LOCK_YAML,\n} from '../../constants.mts'\nimport { getAlertsMapFromPnpmLockfile } from '../../utils/alerts-map.mts'\nimport { cmdFlagsToString } from '../../utils/cmd.mts'\nimport { parsePnpmLockfile, readPnpmLockfile } from '../../utils/pnpm.mts'\nimport { getPublicApiToken } from '../../utils/sdk.mts'\nimport { logAlertsMap } from '../../utils/socket-package-alert.mts'\n\nimport type { IpcObject } from '../../constants.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowPnpmOptions = SpawnOptions & {\n  ipc?: IpcObject | undefined\n}\n\nexport type ShadowPnpmResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nconst DLX_COMMANDS = new Set(['dlx'])\n\nconst INSTALL_COMMANDS = new Set([\n  'add',\n  'i',\n  'install',\n  'install-test',\n  'it',\n  'update',\n  'up',\n])\n\nexport default async function shadowPnpmBin(\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowPnpmOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowPnpmResult> {\n  const opts = { __proto__: null, ...options } as ShadowPnpmOptions\n  const { env: spawnEnv, ipc, ...spawnOpts } = opts\n  const { spinner } = opts\n\n  const wasSpinning = !!spinner?.isSpinning\n\n  spinner?.start()\n\n  let { cwd = process.cwd() } = opts\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  const terminatorPos = args.indexOf('--')\n  const rawPnpmArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n\n  // Check if this is a command that needs security scanning.\n  const command = rawPnpmArgs[0]\n  const isDlxCommand = command && DLX_COMMANDS.has(command)\n  const isInstallCommand = command && INSTALL_COMMANDS.has(command)\n  const needsScanning = isDlxCommand || isInstallCommand\n\n  if (needsScanning && !rawPnpmArgs.includes(FLAG_DRY_RUN)) {\n    const acceptRisks = !!constants.ENV.SOCKET_CLI_ACCEPT_RISKS\n    const viewAllRisks = !!constants.ENV.SOCKET_CLI_VIEW_ALL_RISKS\n\n    // Handle add and dlx commands with shared utility.\n    if (command === 'add' || isDlxCommand) {\n      const scanResult = await scanPackagesAndLogAlerts({\n        acceptRisks,\n        command,\n        cwd,\n        dlxCommands: DLX_COMMANDS,\n        installCommands: INSTALL_COMMANDS,\n        managerName: 'pnpm',\n        rawArgs: rawPnpmArgs,\n        spinner,\n        viewAllRisks,\n      })\n\n      if (scanResult.shouldExit) {\n        // eslint-disable-next-line n/no-process-exit\n        process.exit(1)\n        // This line is never reached in production, but helps tests.\n        throw new Error('process.exit called')\n      }\n    } else if (['install', 'i', 'update', 'up'].includes(command)) {\n      // For install/update, scan all dependencies from pnpm-lock.yaml\n      const pnpmLockPath = path.join(cwd, PNPM_LOCK_YAML)\n      if (existsSync(pnpmLockPath)) {\n        try {\n          const lockfileContent = await readPnpmLockfile(pnpmLockPath)\n          if (lockfileContent) {\n            const lockfile = parsePnpmLockfile(lockfileContent)\n            if (lockfile) {\n              // Use existing function to scan the entire lockfile\n              debugFn(\n                'notice',\n                `scanning: all dependencies from ${PNPM_LOCK_YAML}`,\n              )\n\n              const alertsMap = await getAlertsMapFromPnpmLockfile(lockfile, {\n                nothrow: true,\n                filter: acceptRisks\n                  ? { actions: ['error'], blocked: true }\n                  : { actions: ['error', 'monitor', 'warn'] },\n              })\n\n              spinner?.stop()\n\n              if (alertsMap.size) {\n                process.exitCode = 1\n                logAlertsMap(alertsMap, {\n                  hideAt: viewAllRisks ? 'none' : 'middle',\n                  output: process.stderr,\n                })\n\n                const errorMessage = `Socket pnpm exiting due to risks.${\n                  viewAllRisks\n                    ? ''\n                    : `\\nView all risks - Rerun with environment variable ${constants.SOCKET_CLI_VIEW_ALL_RISKS}=1.`\n                }${\n                  acceptRisks\n                    ? ''\n                    : `\\nAccept risks - Rerun with environment variable ${constants.SOCKET_CLI_ACCEPT_RISKS}=1.`\n                }`.trim()\n\n                logger.error(errorMessage)\n                // eslint-disable-next-line n/no-process-exit\n                process.exit(1)\n                // This line is never reached in production, but helps tests.\n                throw new Error('process.exit called')\n              }\n\n              // Return early since we've already done the scanning\n              debugFn(\n                'notice',\n                'complete: lockfile scanning, proceeding with install',\n              )\n            }\n          }\n        } catch (e) {\n          debugFn('error', 'PNPM lockfile scanning failed')\n          debugDir('error', e)\n        }\n      } else {\n        debugFn(\n          'notice',\n          'skip: no pnpm-lock.yaml found, skipping bulk install scanning',\n        )\n      }\n    }\n\n    debugFn('notice', 'complete: scanning, proceeding with install')\n  }\n\n  const realPnpmPath = await installLinks(constants.shadowBinPath, PNPM)\n\n  spinner?.stop()\n\n  const suffixArgs = [...rawPnpmArgs, ...otherArgs]\n\n  debugFn(\n    'notice',\n    `spawn: ${PNPM} shadow bin ${realPnpmPath} ${cmdFlagsToString(suffixArgs)}`,\n  )\n\n  if (wasSpinning) {\n    spinner?.start()\n  }\n\n  // Set up stdio with IPC channel.\n  const stdio = ensureIpcInStdio(spawnOpts.stdio)\n\n  const spawnPromise = spawn(\n    realPnpmPath,\n    suffixArgs,\n    {\n      ...spawnOpts,\n      env: {\n        ...process.env,\n        ...spawnEnv,\n      },\n      stdio,\n      // On Windows, pnpm is often a .cmd file that requires shell execution.\n      // The spawn function from @socketsecurity/registry will handle this properly\n      // when shell is true.\n      shell: constants.WIN32,\n    },\n    extra,\n  )\n\n  // Send IPC handshake.\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: PNPM,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: true,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n"],"names":["packagePurls","debugScan","debugFn","debugDir","nothrow","viewAllRisks","cwd","shouldExit","blocked","actions","spinner","hideAt","logger","args","WIN32","env","__proto__","dlxCommands","installCommands","managerName","rawArgs","process","spawnPromise"],"mappings":";;;;;;;;;;;;;AAeA;AACA;AACA;AACO;;AAML;AAEA;AACE;;AAKA;AACE;AACA;AACEA;AACF;AACF;AACF;AAEA;AACF;;AAEA;AACA;AACA;AACO;;;AAMH;AACA;AAEA;;;;AAIE;;AAGF;AACE;AAGA;AACEA;AACF;AACF;AAEAC;;AAEAC;AAIAC;AACF;AAEA;AACF;AAoBA;AACA;AACA;AACO;;;;;;;AASHC;;;AAGAC;AACF;;AAEMC;AAAoB;;AAExBA;AACF;;AAEA;;;AAGA;;;AAGWC;;AACX;;AAEA;;AAGA;;;AAGE;AACA;AACAP;AACF;AAEA;;AACWO;;AACX;AAEAN;;AACsBD;AAAa;;AAGjC;;;AAE4BQ;AAAc;AAClCC;;;AAENC;AACF;;;;;AAMIC;;AAEF;AAEA;AAUAC;;;AACoBL;;AACtB;;;AAGA;;AAEE;AACF;AACAN;AACA;AACF;AAEAA;;AACsBY;AAAuB;;AAEpCN;;AACX;;ACzLO;AAIL;AACA;;AACQO;AAAM;;AAEd;;AAEE;AACF;AAEA;;AAEA;;AAEE;;AAKA;;AACQC;AAAI;AACZA;AACF;AAEA;AACF;;ACDA;AAEA;AAUe;AAKb;AAAeC;;;;AACPD;;;AAAiC;;AACjCL;AAAQ;AAEhB;;;AAIMJ;AAAoB;;AAExBA;AACF;AAEA;AACA;AACA;;AAEA;AACA;;;AAGA;;;;;AAME;AACA;AACE;;;;AAIEW;AACAC;AACAC;AACAC;;AAEAf;AACF;;AAGE;AACAgB;AACA;AACA;AACF;AACF;AACE;;AAEA;;AAEI;AACA;AACE;AACA;AACE;AACAnB;AAKA;AACEE;;;AAE0BI;AAAc;AAClCC;AAAsC;AAC9C;;;;;AAOIE;;AAEF;;AAYAC;AACA;AACAS;AACA;AACA;AACF;;AAEA;AACAnB;AAIF;AACF;;AAEAA;AACAC;AACF;AACF;AACED;AAIF;AACF;AAEAA;AACF;;;;AAQAA;AAKA;;AAEA;;AAEA;AACA;AAEA;AAII;AACAa;;;;;AAKA;AACA;AACA;;;;AAMJ;AACAO;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;;","debugId":"cdf92b11-1bc1-407a-8db7-38adcb6998cc"}

package/dist/shadow-yarn-bin.js

@@ -86,7 +86,11 @@ async function shadowYarnBin(args = process.argv.slice(2), options, extra) {
       ...process.env,
       ...spawnEnv
     },
-    stdio
+    stdio,
+    // On Windows, yarn is often a .cmd file that requires shell execution.
+    // The spawn function from @socketsecurity/registry will handle this properly
+    // when shell is true.
+    shell: constants.default.WIN32
   }, extra);
 
   // Send IPC handshake.
@@ -104,5 +108,5 @@ async function shadowYarnBin(args = process.argv.slice(2), options, extra) {
 }
 
 module.exports = shadowYarnBin;
-//# debugId=13fbcedb-c0f8-4da1-b471-4a7bc1ea6bd
+//# debugId=1cf735f7-d72e-4a95-9a5f-bc6822d5a468
 //# sourceMappingURL=shadow-yarn-bin.js.map

package/dist/shadow-yarn-bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"shadow-yarn-bin.js","sources":["../src/shadow/yarn/link.mts","../src/shadow/yarn/bin.mts"],"sourcesContent":["import path from 'node:path'\n\nimport cmdShim from 'cmd-shim'\n\nimport constants from '../../constants.mts'\nimport {\n  getYarnBinPath,\n  isYarnBinPathShadowed,\n} from '../../utils/yarn-paths.mts'\n\nexport async function installLinks(\n  shadowBinPath: string,\n  binName: 'yarn',\n): Promise<string> {\n  const binPath = getYarnBinPath()\n  const { WIN32 } = constants\n\n  if (WIN32 && binPath) {\n    return binPath\n  }\n\n  const shadowed = isYarnBinPathShadowed()\n\n  if (!shadowed) {\n    if (WIN32) {\n      await cmdShim(\n        path.join(constants.distPath, `${binName}-cli.js`),\n        path.join(shadowBinPath, binName),\n      )\n    }\n    const { env } = process\n    env['PATH'] = `${shadowBinPath}${path.delimiter}${env['PATH']}`\n  }\n\n  return binPath\n}\n","import { debugFn } from '@socketsecurity/registry/lib/debug'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport { scanPackagesAndLogAlerts } from '../common.mts'\nimport { ensureIpcInStdio } from '../stdio-ipc.mts'\nimport { installLinks } from './link.mts'\nimport constants, { YARN } from '../../constants.mts'\nimport { cmdFlagsToString } from '../../utils/cmd.mts'\nimport { getPublicApiToken } from '../../utils/sdk.mts'\n\nimport type { IpcObject } from '../../constants.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowYarnOptions = SpawnOptions & {\n  ipc?: IpcObject | undefined\n}\n\nexport type ShadowYarnResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nconst DLX_COMMANDS = new Set(['dlx'])\n\nconst INSTALL_COMMANDS = new Set([\n  'add',\n  'install',\n  'up',\n  'upgrade',\n  'upgrade-interactive',\n])\n\nexport default async function shadowYarnBin(\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowYarnOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowYarnResult> {\n  const opts = { __proto__: null, ...options } as ShadowYarnOptions\n  const { env: spawnEnv, ipc, ...spawnOpts } = opts\n  const { spinner } = opts\n\n  const wasSpinning = !!spinner?.isSpinning\n\n  spinner?.start()\n\n  const terminatorPos = args.indexOf('--')\n  const rawYarnArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n\n  // Check for package scanning.\n  const command = rawYarnArgs[0]\n  const scanResult = await scanPackagesAndLogAlerts({\n    acceptRisks: !!constants.ENV.SOCKET_CLI_ACCEPT_RISKS,\n    command,\n    cwd: process.cwd(),\n    dlxCommands: DLX_COMMANDS,\n    installCommands: INSTALL_COMMANDS,\n    managerName: 'yarn',\n    rawArgs: rawYarnArgs,\n    spinner,\n    viewAllRisks: !!constants.ENV.SOCKET_CLI_VIEW_ALL_RISKS,\n  })\n\n  if (scanResult.shouldExit) {\n    // eslint-disable-next-line n/no-process-exit\n    process.exit(1)\n    // This line is never reached in production, but helps tests.\n    throw new Error('process.exit called')\n  }\n\n  const realYarnPath = await installLinks(constants.shadowBinPath, YARN)\n\n  spinner?.stop()\n\n  const suffixArgs = [...rawYarnArgs, ...otherArgs]\n\n  debugFn(\n    'notice',\n    `spawn: ${YARN} shadow bin ${realYarnPath} ${cmdFlagsToString(suffixArgs)}`,\n  )\n\n  if (wasSpinning) {\n    spinner?.start()\n  }\n\n  // Set up stdio with IPC channel.\n  const stdio = ensureIpcInStdio(spawnOpts.stdio)\n\n  const spawnPromise = spawn(\n    realYarnPath,\n    suffixArgs,\n    {\n      ...spawnOpts,\n      env: {\n        ...process.env,\n        ...spawnEnv,\n      },\n      stdio,\n    },\n    extra,\n  )\n\n  // Send IPC handshake.\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: YARN,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: true,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n"],"names":["WIN32","env","__proto__","spinner","acceptRisks","cwd","dlxCommands","installCommands","managerName","rawArgs","viewAllRisks","process","debugFn","stdio","spawnPromise"],"mappings":";;;;;;;;;;;AAUO;AAIL;;AACQA;AAAM;;AAGZ;AACF;AAEA;;AAGE;;AAKA;;AACQC;AAAI;AACZA;AACF;AAEA;AACF;;ACVA;AAEA;AAQe;AAKb;AAAeC;;;;AACPD;;;AAAiC;;AACjCE;AAAQ;AAEhB;;AAIA;AACA;AACA;;AAEA;AACA;AACA;AACEC;;AAEAC;AACAC;AACAC;AACAC;AACAC;;AAEAC;AACF;;AAGE;AACAC;AACA;AACA;AACF;;;;AAQAC;AAKA;;AAEA;;AAEA;AACA;AAEA;AAII;AACAX;;;;AAIAY;;;AAKJ;AACAC;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;","debugId":"13fbcedb-c0f8-4da1-b471-4a7bc1ea6bd"}
+{"version":3,"file":"shadow-yarn-bin.js","sources":["../src/shadow/yarn/link.mts","../src/shadow/yarn/bin.mts"],"sourcesContent":["import path from 'node:path'\n\nimport cmdShim from 'cmd-shim'\n\nimport constants from '../../constants.mts'\nimport {\n  getYarnBinPath,\n  isYarnBinPathShadowed,\n} from '../../utils/yarn-paths.mts'\n\nexport async function installLinks(\n  shadowBinPath: string,\n  binName: 'yarn',\n): Promise<string> {\n  const binPath = getYarnBinPath()\n  const { WIN32 } = constants\n\n  if (WIN32 && binPath) {\n    return binPath\n  }\n\n  const shadowed = isYarnBinPathShadowed()\n\n  if (!shadowed) {\n    if (WIN32) {\n      await cmdShim(\n        path.join(constants.distPath, `${binName}-cli.js`),\n        path.join(shadowBinPath, binName),\n      )\n    }\n    const { env } = process\n    env['PATH'] = `${shadowBinPath}${path.delimiter}${env['PATH']}`\n  }\n\n  return binPath\n}\n","import { debugFn } from '@socketsecurity/registry/lib/debug'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport { scanPackagesAndLogAlerts } from '../common.mts'\nimport { ensureIpcInStdio } from '../stdio-ipc.mts'\nimport { installLinks } from './link.mts'\nimport constants, { YARN } from '../../constants.mts'\nimport { cmdFlagsToString } from '../../utils/cmd.mts'\nimport { getPublicApiToken } from '../../utils/sdk.mts'\n\nimport type { IpcObject } from '../../constants.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowYarnOptions = SpawnOptions & {\n  ipc?: IpcObject | undefined\n}\n\nexport type ShadowYarnResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nconst DLX_COMMANDS = new Set(['dlx'])\n\nconst INSTALL_COMMANDS = new Set([\n  'add',\n  'install',\n  'up',\n  'upgrade',\n  'upgrade-interactive',\n])\n\nexport default async function shadowYarnBin(\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowYarnOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowYarnResult> {\n  const opts = { __proto__: null, ...options } as ShadowYarnOptions\n  const { env: spawnEnv, ipc, ...spawnOpts } = opts\n  const { spinner } = opts\n\n  const wasSpinning = !!spinner?.isSpinning\n\n  spinner?.start()\n\n  const terminatorPos = args.indexOf('--')\n  const rawYarnArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n\n  // Check for package scanning.\n  const command = rawYarnArgs[0]\n  const scanResult = await scanPackagesAndLogAlerts({\n    acceptRisks: !!constants.ENV.SOCKET_CLI_ACCEPT_RISKS,\n    command,\n    cwd: process.cwd(),\n    dlxCommands: DLX_COMMANDS,\n    installCommands: INSTALL_COMMANDS,\n    managerName: 'yarn',\n    rawArgs: rawYarnArgs,\n    spinner,\n    viewAllRisks: !!constants.ENV.SOCKET_CLI_VIEW_ALL_RISKS,\n  })\n\n  if (scanResult.shouldExit) {\n    // eslint-disable-next-line n/no-process-exit\n    process.exit(1)\n    // This line is never reached in production, but helps tests.\n    throw new Error('process.exit called')\n  }\n\n  const realYarnPath = await installLinks(constants.shadowBinPath, YARN)\n\n  spinner?.stop()\n\n  const suffixArgs = [...rawYarnArgs, ...otherArgs]\n\n  debugFn(\n    'notice',\n    `spawn: ${YARN} shadow bin ${realYarnPath} ${cmdFlagsToString(suffixArgs)}`,\n  )\n\n  if (wasSpinning) {\n    spinner?.start()\n  }\n\n  // Set up stdio with IPC channel.\n  const stdio = ensureIpcInStdio(spawnOpts.stdio)\n\n  const spawnPromise = spawn(\n    realYarnPath,\n    suffixArgs,\n    {\n      ...spawnOpts,\n      env: {\n        ...process.env,\n        ...spawnEnv,\n      },\n      stdio,\n      // On Windows, yarn is often a .cmd file that requires shell execution.\n      // The spawn function from @socketsecurity/registry will handle this properly\n      // when shell is true.\n      shell: constants.WIN32,\n    },\n    extra,\n  )\n\n  // Send IPC handshake.\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: YARN,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: true,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n"],"names":["WIN32","env","__proto__","spinner","acceptRisks","cwd","dlxCommands","installCommands","managerName","rawArgs","viewAllRisks","process","debugFn","spawnPromise"],"mappings":";;;;;;;;;;;AAUO;AAIL;;AACQA;AAAM;;AAGZ;AACF;AAEA;;AAGE;;AAKA;;AACQC;AAAI;AACZA;AACF;AAEA;AACF;;ACVA;AAEA;AAQe;AAKb;AAAeC;;;;AACPD;;;AAAiC;;AACjCE;AAAQ;AAEhB;;AAIA;AACA;AACA;;AAEA;AACA;AACA;AACEC;;AAEAC;AACAC;AACAC;AACAC;AACAC;;AAEAC;AACF;;AAGE;AACAC;AACA;AACA;AACF;;;;AAQAC;AAKA;;AAEA;;AAEA;AACA;AAEA;AAII;AACAX;;;;;AAKA;AACA;AACA;;;;AAMJ;AACAY;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;","debugId":"1cf735f7-d72e-4a95-9a5f-bc6822d5a468"}