@socketsecurity/cli-with-sentry 1.1.25 → 2.0.0

package/dist/instrument-with-sentry.js

@@ -1,44 +0,0 @@
-'use strict';
-
-var require$$5 = require('node:module');
-var logger = require('../external/@socketsecurity/registry/lib/logger');
-var constants = require('./constants.js');
-
-var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
-// This should ONLY be included in the special Sentry build!
-// Otherwise the Sentry dependency won't even be present in the manifest.
-
-if (constants.default.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD) {
-  const require$1 = require$$5.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('instrument-with-sentry.js', document.baseURI).href)));
-  const Sentry = /*@__PURE__*/require$1('@sentry/node');
-  Sentry.init({
-    onFatalError(error) {
-      // Defer module loads until after Sentry.init is called.
-      if (constants.default.ENV.SOCKET_CLI_DEBUG) {
-        logger.logger.fail('[DEBUG] [Sentry onFatalError]:', error);
-      }
-    },
-    dsn: 'https://66736701db8e4ffac046bd09fa6aaced@o555220.ingest.us.sentry.io/4508846967619585',
-    enabled: true,
-    integrations: []
-  });
-  Sentry.setTag('environment', constants.default.ENV.INLINED_SOCKET_CLI_PUBLISHED_BUILD ? 'pub' : constants.default.ENV.NODE_ENV);
-  Sentry.setTag('version', constants.default.ENV.INLINED_SOCKET_CLI_VERSION_HASH);
-  if (constants.default.ENV.SOCKET_CLI_DEBUG) {
-    Sentry.setTag('debugging', true);
-    logger.logger.info('[DEBUG] Set up Sentry.');
-  } else {
-    Sentry.setTag('debugging', false);
-  }
-  const {
-    kInternalsSymbol,
-    [kInternalsSymbol]: {
-      setSentry
-    }
-  } = constants.default;
-  setSentry(Sentry);
-} else if (constants.default.ENV.SOCKET_CLI_DEBUG) {
-  logger.logger.info('[DEBUG] Sentry disabled explicitly.');
-}
-//# debugId=8db796aa-e819-4fc9-a6ac-9ca028014859
-//# sourceMappingURL=instrument-with-sentry.js.map

package/dist/instrument-with-sentry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"instrument-with-sentry.js","sources":["../src/instrument-with-sentry.mts"],"sourcesContent":["// This should ONLY be included in the special Sentry build!\n// Otherwise the Sentry dependency won't even be present in the manifest.\n\nimport { createRequire } from 'node:module'\n\nimport { logger } from '@socketsecurity/registry/lib/logger'\n\nimport constants from './constants.mts'\n\nif (constants.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD) {\n  const require = createRequire(import.meta.url)\n  const Sentry = /*@__PURE__*/ require('@sentry/node')\n  Sentry.init({\n    onFatalError(error: Error) {\n      // Defer module loads until after Sentry.init is called.\n      if (constants.ENV.SOCKET_CLI_DEBUG) {\n        logger.fail('[DEBUG] [Sentry onFatalError]:', error)\n      }\n    },\n    dsn: 'https://66736701db8e4ffac046bd09fa6aaced@o555220.ingest.us.sentry.io/4508846967619585',\n    enabled: true,\n    integrations: [],\n  })\n  Sentry.setTag(\n    'environment',\n    constants.ENV.INLINED_SOCKET_CLI_PUBLISHED_BUILD\n      ? 'pub'\n      : constants.ENV.NODE_ENV,\n  )\n  Sentry.setTag('version', constants.ENV.INLINED_SOCKET_CLI_VERSION_HASH)\n  if (constants.ENV.SOCKET_CLI_DEBUG) {\n    Sentry.setTag('debugging', true)\n    logger.info('[DEBUG] Set up Sentry.')\n  } else {\n    Sentry.setTag('debugging', false)\n  }\n  const {\n    kInternalsSymbol,\n    [kInternalsSymbol as unknown as 'Symbol(kInternalsSymbol)']: { setSentry },\n  } = constants\n  setSentry(Sentry)\n} else if (constants.ENV.SOCKET_CLI_DEBUG) {\n  logger.info('[DEBUG] Sentry disabled explicitly.')\n}\n"],"names":["logger","dsn","enabled","integrations","Sentry","setSentry"],"mappings":";;;;;;;AAAA;AACA;;AAQA;;AAEE;;;AAGI;AACA;AACEA;AACF;;AAEFC;AACAC;AACAC;AACF;AACAC;;AAOA;AACEA;AACAJ;AACF;AACEI;AACF;;;AAGE;AAA+DC;AAAU;AAC3E;;AAEF;AACEL;AACF","debugId":"8db796aa-e819-4fc9-a6ac-9ca028014859"}

package/dist/npm-cli.js

@@ -1,30 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-var shadowNpmBin = require('./shadow-npm-bin2.js');
-
-void (async () => {
-  process.exitCode = 1;
-  const {
-    spawnPromise
-  } = await shadowNpmBin.shadowNpmBin(process.argv.slice(2), {
-    stdio: 'inherit',
-    cwd: process.cwd(),
-    env: {
-      ...process.env
-    }
-  });
-
-  // See https://nodejs.org/api/child_process.html#event-exit.
-  spawnPromise.process.on('exit', (code, signalName) => {
-    if (signalName) {
-      process.kill(process.pid, signalName);
-    } else if (typeof code === 'number') {
-      // eslint-disable-next-line n/no-process-exit
-      process.exit(code);
-    }
-  });
-  await spawnPromise;
-})();
-//# debugId=262aa1f5-464f-4c2c-ab0c-27dea2404ca7
-//# sourceMappingURL=npm-cli.js.map

package/dist/npm-cli.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"npm-cli.js","sources":["../src/npm-cli.mts"],"sourcesContent":["#!/usr/bin/env node\n\nimport shadowNpmBin from './shadow/npm/bin.mts'\n\nvoid (async () => {\n  process.exitCode = 1\n\n  const { spawnPromise } = await shadowNpmBin(process.argv.slice(2), {\n    stdio: 'inherit',\n    cwd: process.cwd(),\n    env: { ...process.env },\n  })\n\n  // See https://nodejs.org/api/child_process.html#event-exit.\n  spawnPromise.process.on('exit', (code, signalName) => {\n    if (signalName) {\n      process.kill(process.pid, signalName)\n    } else if (typeof code === 'number') {\n      // eslint-disable-next-line n/no-process-exit\n      process.exit(code)\n    }\n  })\n\n  await spawnPromise\n})()\n"],"names":["spawnPromise","stdio","cwd","env","process"],"mappings":";;;;;AAIA;;;AAGUA;AAAa;AACnBC;AACAC;AACAC;AAAO;AAAe;AACxB;;AAEA;;AAEE;;AAEA;AACE;AACAC;AACF;AACF;AAEA;AACF","debugId":"262aa1f5-464f-4c2c-ab0c-27dea2404ca7"}

package/dist/npx-cli.js

@@ -1,26 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-var shadowNpxBin = require('./shadow-npx-bin.js');
-
-void (async () => {
-  process.exitCode = 1;
-  const {
-    spawnPromise
-  } = await shadowNpxBin(process.argv.slice(2), {
-    stdio: 'inherit'
-  });
-
-  // See https://nodejs.org/api/child_process.html#event-exit.
-  spawnPromise.process.on('exit', (code, signalName) => {
-    if (signalName) {
-      process.kill(process.pid, signalName);
-    } else if (typeof code === 'number') {
-      // eslint-disable-next-line n/no-process-exit
-      process.exit(code);
-    }
-  });
-  await spawnPromise;
-})();
-//# debugId=5cd12cb6-eaab-445b-ac32-8aa57a64b454
-//# sourceMappingURL=npx-cli.js.map

package/dist/npx-cli.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"npx-cli.js","sources":["../src/npx-cli.mts"],"sourcesContent":["#!/usr/bin/env node\n\nimport shadowNpxBin from './shadow/npx/bin.mts'\n\nvoid (async () => {\n  process.exitCode = 1\n\n  const { spawnPromise } = await shadowNpxBin(process.argv.slice(2), {\n    stdio: 'inherit',\n  })\n\n  // See https://nodejs.org/api/child_process.html#event-exit.\n  spawnPromise.process.on('exit', (code, signalName) => {\n    if (signalName) {\n      process.kill(process.pid, signalName)\n    } else if (typeof code === 'number') {\n      // eslint-disable-next-line n/no-process-exit\n      process.exit(code)\n    }\n  })\n\n  await spawnPromise\n})()\n"],"names":["spawnPromise","stdio","process"],"mappings":";;;;;AAIA;;;AAGUA;AAAa;AACnBC;AACF;;AAEA;;AAEE;;AAEA;AACE;AACAC;AACF;AACF;AAEA;AACF","debugId":"5cd12cb6-eaab-445b-ac32-8aa57a64b454"}

package/dist/pnpm-cli.js

@@ -1,30 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-var shadowPnpmBin = require('./shadow-pnpm-bin2.js');
-
-void (async () => {
-  process.exitCode = 1;
-  const {
-    spawnPromise
-  } = await shadowPnpmBin.shadowPnpmBin(process.argv.slice(2), {
-    stdio: 'inherit',
-    cwd: process.cwd(),
-    env: {
-      ...process.env
-    }
-  });
-
-  // See https://nodejs.org/api/child_process.html#event-exit.
-  spawnPromise.process.on('exit', (code, signalName) => {
-    if (signalName) {
-      process.kill(process.pid, signalName);
-    } else if (typeof code === 'number') {
-      // eslint-disable-next-line n/no-process-exit
-      process.exit(code);
-    }
-  });
-  await spawnPromise;
-})();
-//# debugId=93ceb884-0229-46ec-a929-0b0700025836
-//# sourceMappingURL=pnpm-cli.js.map

package/dist/pnpm-cli.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pnpm-cli.js","sources":["../src/pnpm-cli.mts"],"sourcesContent":["#!/usr/bin/env node\n\nimport shadowPnpmBin from './shadow/pnpm/bin.mts'\n\nvoid (async () => {\n  process.exitCode = 1\n\n  const { spawnPromise } = await shadowPnpmBin(process.argv.slice(2), {\n    stdio: 'inherit',\n    cwd: process.cwd(),\n    env: { ...process.env },\n  })\n\n  // See https://nodejs.org/api/child_process.html#event-exit.\n  spawnPromise.process.on('exit', (code, signalName) => {\n    if (signalName) {\n      process.kill(process.pid, signalName)\n    } else if (typeof code === 'number') {\n      // eslint-disable-next-line n/no-process-exit\n      process.exit(code)\n    }\n  })\n\n  await spawnPromise\n})()\n"],"names":["spawnPromise","stdio","cwd","env","process"],"mappings":";;;;;AAIA;;;AAGUA;AAAa;AACnBC;AACAC;AACAC;AAAO;AAAe;AACxB;;AAEA;;AAEE;;AAEA;AACE;AACAC;AACF;AACF;AAEA;AACF","debugId":"93ceb884-0229-46ec-a929-0b0700025836"}

package/dist/shadow-npm-bin.js

@@ -1,8 +0,0 @@
-'use strict';
-var shadowNpmBin = require('./shadow-npm-bin2.js');
-
-
-
-module.exports = shadowNpmBin.shadowNpmBin;
-//# debugId=b6ee2805-0bfe-4b8d-a2df-609b517340be
-//# sourceMappingURL=shadow-npm-bin.js.map

package/dist/shadow-npm-bin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"shadow-npm-bin.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;","debugId":"b6ee2805-0bfe-4b8d-a2df-609b517340be"}

package/dist/shadow-npm-bin2.js

@@ -1,102 +0,0 @@
-'use strict';
-
-var constants = require('./constants.js');
-var require$$0 = require('node:url');
-var agent = require('../external/@socketsecurity/registry/lib/agent');
-var require$$9 = require('../external/@socketsecurity/registry/lib/debug');
-var require$$11 = require('../external/@socketsecurity/registry/lib/objects');
-var spawn = require('../external/@socketsecurity/registry/lib/spawn');
-var utils = require('./utils.js');
-
-/**
- * Ensures stdio configuration includes IPC channel for process communication.
- * Converts various stdio formats to include 'ipc' as the fourth element.
- */
-function ensureIpcInStdio(stdio) {
-  if (typeof stdio === 'string') {
-    return [stdio, stdio, stdio, 'ipc'];
-  } else if (Array.isArray(stdio)) {
-    if (!stdio.includes('ipc')) {
-      return stdio.concat('ipc');
-    }
-    return stdio;
-  } else {
-    return ['pipe', 'pipe', 'pipe', 'ipc'];
-  }
-}
-
-async function shadowNpmBase(binName, args = process.argv.slice(2), options, extra) {
-  const {
-    env: spawnEnv,
-    ipc,
-    ...spawnOpts
-  } = {
-    __proto__: null,
-    ...options
-  };
-  let cwd = require$$11.getOwn(spawnOpts, 'cwd') ?? process.cwd();
-  if (cwd instanceof URL) {
-    cwd = require$$0.fileURLToPath(cwd);
-  }
-  const isShadowNpm = binName === constants.NPM;
-  const terminatorPos = args.indexOf('--');
-  const rawBinArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos);
-  const nodeOptionsArg = rawBinArgs.findLast(agent.isNpmNodeOptionsFlag);
-  const progressArg = rawBinArgs.findLast(agent.isNpmProgressFlag) !== '--no-progress';
-  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos);
-  const permArgs = isShadowNpm && constants.default.SUPPORTS_NODE_PERMISSION_FLAG ? ['--permission', '--allow-child-process',
-  // '--allow-addons',
-  // '--allow-wasi',
-  // Allow all reads because npm walks up directories looking for config
-  // and package.json files.
-  '--allow-fs-read=*', `--allow-fs-write=${cwd}/*`, `--allow-fs-write=${constants.default.npmGlobalPrefix}/*`, `--allow-fs-write=${constants.default.npmCachePath}/*`] : [];
-  const useAudit = rawBinArgs.includes('--audit');
-  const useDebug = require$$9.isDebug('stdio');
-  const useNodeOptions = nodeOptionsArg || permArgs.length;
-  const binArgs = rawBinArgs.filter(a => !agent.isNpmAuditFlag(a) && !agent.isNpmProgressFlag(a));
-  const isSilent = !useDebug && !binArgs.some(agent.isNpmLoglevelFlag);
-  // The default value of loglevel is "notice". We default to "error" which is
-  // two levels quieter.
-  const logLevelArgs = isSilent ? [constants.FLAG_LOGLEVEL, 'error'] : [];
-  const noAuditArgs = useAudit || !(await utils.findUp(constants.NODE_MODULES, {
-    cwd,
-    onlyDirectories: true
-  })) ? [] : ['--no-audit'];
-  const stdio = ensureIpcInStdio(require$$11.getOwn(spawnOpts, 'stdio'));
-  const realBinPath = isShadowNpm ? await utils.installNpmLinks(constants.default.shadowBinPath) : await utils.installNpxLinks(constants.default.shadowBinPath);
-  const spawnPromise = spawn.spawn(constants.default.execPath, [...constants.default.nodeNoWarningsFlags, ...constants.default.nodeDebugFlags, ...constants.default.nodeHardenFlags, ...constants.default.nodeMemoryFlags, ...(constants.default.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD ? ['--require', constants.default.instrumentWithSentryPath] : []), '--require', constants.default.shadowNpmInjectPath, realBinPath, ...noAuditArgs, ...(useNodeOptions ? [`--node-options='${nodeOptionsArg ? nodeOptionsArg.slice(15) : ''}${utils.cmdFlagsToString(permArgs)}'`] : []), '--no-fund',
-  // Add '--no-progress' to fix input being swallowed by the npm spinner.
-  '--no-progress',
-  // Add '--loglevel=error' if a loglevel flag is not provided and the
-  // SOCKET_CLI_DEBUG environment variable is not truthy.
-  ...logLevelArgs, ...binArgs, ...otherArgs], {
-    ...spawnOpts,
-    env: {
-      ...process.env,
-      ...constants.default.processEnv,
-      ...spawnEnv
-    },
-    stdio
-  }, extra);
-  spawnPromise.process.send({
-    [constants.default.SOCKET_IPC_HANDSHAKE]: {
-      [constants.default.SOCKET_CLI_SHADOW_API_TOKEN]: utils.getPublicApiToken(),
-      [constants.default.SOCKET_CLI_SHADOW_BIN]: binName,
-      [constants.default.SOCKET_CLI_SHADOW_PROGRESS]: progressArg,
-      ...ipc
-    }
-  });
-  return {
-    spawnPromise
-  };
-}
-
-async function shadowNpmBin(args = process.argv.slice(2), options, extra) {
-  return await shadowNpmBase(constants.NPM, args, options, extra);
-}
-
-exports.ensureIpcInStdio = ensureIpcInStdio;
-exports.shadowNpmBase = shadowNpmBase;
-exports.shadowNpmBin = shadowNpmBin;
-//# debugId=6d18cbc8-e145-4f23-9c89-eb5694f263dd
-//# sourceMappingURL=shadow-npm-bin2.js.map

package/dist/shadow-npm-bin2.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"shadow-npm-bin2.js","sources":["../src/shadow/stdio-ipc.mts","../src/shadow/npm-base.mts","../src/shadow/npm/bin.mts"],"sourcesContent":["import type { StdioOptions } from 'node:child_process'\n\n/**\n * Ensures stdio configuration includes IPC channel for process communication.\n * Converts various stdio formats to include 'ipc' as the fourth element.\n */\nexport function ensureIpcInStdio(\n  stdio: StdioOptions | undefined,\n): StdioOptions {\n  if (typeof stdio === 'string') {\n    return [stdio, stdio, stdio, 'ipc']\n  } else if (Array.isArray(stdio)) {\n    if (!stdio.includes('ipc')) {\n      return stdio.concat('ipc')\n    }\n    return stdio\n  } else {\n    return ['pipe', 'pipe', 'pipe', 'ipc']\n  }\n}\n","import { fileURLToPath } from 'node:url'\n\nimport {\n  isNpmAuditFlag,\n  isNpmLoglevelFlag,\n  isNpmNodeOptionsFlag,\n  isNpmProgressFlag,\n} from '@socketsecurity/registry/lib/agent'\nimport { isDebug } from '@socketsecurity/registry/lib/debug'\nimport { getOwn } from '@socketsecurity/registry/lib/objects'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport { ensureIpcInStdio } from './stdio-ipc.mts'\nimport constants, {\n  FLAG_LOGLEVEL,\n  NODE_MODULES,\n  NPM,\n  NPX,\n} from '../constants.mts'\nimport { cmdFlagsToString } from '../utils/cmd.mts'\nimport { findUp } from '../utils/fs.mts'\nimport { getPublicApiToken } from '../utils/sdk.mts'\nimport { installNpmLinks, installNpxLinks } from '../utils/shadow-links.mts'\n\nimport type { IpcObject } from '../constants.mts'\nimport type {\n  SpawnExtra,\n  SpawnOptions,\n  SpawnResult,\n} from '@socketsecurity/registry/lib/spawn'\n\nexport type ShadowBinOptions = SpawnOptions & {\n  ipc?: IpcObject | undefined\n}\n\nexport type ShadowBinResult = {\n  spawnPromise: SpawnResult<string, SpawnExtra | undefined>\n}\n\nexport default async function shadowNpmBase(\n  binName: typeof NPM | typeof NPX,\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowBinOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowBinResult> {\n  const {\n    env: spawnEnv,\n    ipc,\n    ...spawnOpts\n  } = { __proto__: null, ...options } as ShadowBinOptions\n\n  let cwd = getOwn(spawnOpts, 'cwd') ?? process.cwd()\n  if (cwd instanceof URL) {\n    cwd = fileURLToPath(cwd)\n  }\n\n  const isShadowNpm = binName === NPM\n  const terminatorPos = args.indexOf('--')\n  const rawBinArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n  const nodeOptionsArg = rawBinArgs.findLast(isNpmNodeOptionsFlag)\n  const progressArg = rawBinArgs.findLast(isNpmProgressFlag) !== '--no-progress'\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n  const permArgs =\n    isShadowNpm && constants.SUPPORTS_NODE_PERMISSION_FLAG\n      ? [\n          '--permission',\n          '--allow-child-process',\n          // '--allow-addons',\n          // '--allow-wasi',\n          // Allow all reads because npm walks up directories looking for config\n          // and package.json files.\n          '--allow-fs-read=*',\n          `--allow-fs-write=${cwd}/*`,\n          `--allow-fs-write=${constants.npmGlobalPrefix}/*`,\n          `--allow-fs-write=${constants.npmCachePath}/*`,\n        ]\n      : []\n\n  const useAudit = rawBinArgs.includes('--audit')\n  const useDebug = isDebug('stdio')\n  const useNodeOptions = nodeOptionsArg || permArgs.length\n  const binArgs = rawBinArgs.filter(\n    a => !isNpmAuditFlag(a) && !isNpmProgressFlag(a),\n  )\n  const isSilent = !useDebug && !binArgs.some(isNpmLoglevelFlag)\n  // The default value of loglevel is \"notice\". We default to \"error\" which is\n  // two levels quieter.\n  const logLevelArgs = isSilent ? [FLAG_LOGLEVEL, 'error'] : []\n  const noAuditArgs =\n    useAudit || !(await findUp(NODE_MODULES, { cwd, onlyDirectories: true }))\n      ? []\n      : ['--no-audit']\n\n  const stdio = ensureIpcInStdio(getOwn(spawnOpts, 'stdio'))\n\n  const realBinPath = isShadowNpm\n    ? await installNpmLinks(constants.shadowBinPath)\n    : await installNpxLinks(constants.shadowBinPath)\n\n  const spawnPromise = spawn(\n    constants.execPath,\n    [\n      ...constants.nodeNoWarningsFlags,\n      ...constants.nodeDebugFlags,\n      ...constants.nodeHardenFlags,\n      ...constants.nodeMemoryFlags,\n      ...(constants.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD\n        ? ['--require', constants.instrumentWithSentryPath]\n        : []),\n      '--require',\n      constants.shadowNpmInjectPath,\n      realBinPath,\n      ...noAuditArgs,\n      ...(useNodeOptions\n        ? [\n            `--node-options='${nodeOptionsArg ? nodeOptionsArg.slice(15) : ''}${cmdFlagsToString(permArgs)}'`,\n          ]\n        : []),\n      '--no-fund',\n      // Add '--no-progress' to fix input being swallowed by the npm spinner.\n      '--no-progress',\n      // Add '--loglevel=error' if a loglevel flag is not provided and the\n      // SOCKET_CLI_DEBUG environment variable is not truthy.\n      ...logLevelArgs,\n      ...binArgs,\n      ...otherArgs,\n    ],\n    {\n      ...spawnOpts,\n      env: {\n        ...process.env,\n        ...constants.processEnv,\n        ...spawnEnv,\n      },\n      stdio,\n    },\n    extra,\n  )\n\n  spawnPromise.process.send({\n    [constants.SOCKET_IPC_HANDSHAKE]: {\n      [constants.SOCKET_CLI_SHADOW_API_TOKEN]: getPublicApiToken(),\n      [constants.SOCKET_CLI_SHADOW_BIN]: binName,\n      [constants.SOCKET_CLI_SHADOW_PROGRESS]: progressArg,\n      ...ipc,\n    },\n  })\n\n  return { spawnPromise }\n}\n","import { NPM } from '../../constants.mts'\nimport shadowNpmBase from '../npm-base.mts'\n\nimport type { ShadowBinOptions, ShadowBinResult } from '../npm-base.mts'\nimport type { SpawnExtra } from '@socketsecurity/registry/lib/spawn'\n\nexport type { ShadowBinOptions, ShadowBinResult }\n\nexport default async function shadowNpmBin(\n  args: string[] | readonly string[] = process.argv.slice(2),\n  options?: ShadowBinOptions | undefined,\n  extra?: SpawnExtra | undefined,\n): Promise<ShadowBinResult> {\n  return await shadowNpmBase(NPM, args, options, extra)\n}\n"],"names":["env","__proto__","cwd","onlyDirectories","stdio","spawnPromise"],"mappings":";;;;;;;;;;AAEA;AACA;AACA;AACA;AACO;AAGL;;;AAGE;AACE;AACF;AACA;AACF;;AAEA;AACF;;ACoBe;;AAOXA;;;AAGF;AAAMC;;;AAEN;;AAEEC;AACF;AAEA;AACA;AACA;AACA;;AAEA;;AAMQ;AACA;AACA;AACA;AACA;AAOR;AACA;AACA;AACA;;AAIA;AACA;;;;AAGkDC;AAAsB;;AAMxE;AAIA;AAoBI;;AAEA;AACA;;AAMA;AACAH;;;;;AAKAI;;AAKJC;;AAEI;AACA;AACA;;AAEF;AACF;;AAESA;;AACX;;AC7Ie;;AAMf;;;;","debugId":"6d18cbc8-e145-4f23-9c89-eb5694f263dd"}

package/dist/shadow-npm-inject.js

@@ -1,307 +0,0 @@
-'use strict';
-
-var require$$5 = require('node:module');
-var vendor = require('./vendor.js');
-var path = require('node:path');
-var path$1 = require('../external/@socketsecurity/registry/lib/path');
-var constants = require('./constants.js');
-var utils = require('./utils.js');
-var logger = require('../external/@socketsecurity/registry/lib/logger');
-var require$$9 = require('../external/@socketsecurity/registry/lib/debug');
-var require$$11 = require('../external/@socketsecurity/registry/lib/objects');
-var require$$13 = require('../external/@socketsecurity/registry/lib/url');
-
-var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
-let _arboristPkgPath;
-function getArboristPackagePath() {
-  if (_arboristPkgPath === undefined) {
-    const pkgName = '@npmcli/arborist';
-    const mainPathWithForwardSlashes = path$1.normalizePath(utils.getNpmRequire().resolve(pkgName));
-    const arboristPkgPathWithForwardSlashes = mainPathWithForwardSlashes.slice(0, mainPathWithForwardSlashes.lastIndexOf(pkgName) + pkgName.length);
-    _arboristPkgPath = constants.default.WIN32 ? path.normalize(arboristPkgPathWithForwardSlashes) : arboristPkgPathWithForwardSlashes;
-  }
-  return _arboristPkgPath;
-}
-let _arboristClassPath;
-function getArboristClassPath() {
-  if (_arboristClassPath === undefined) {
-    _arboristClassPath = path.join(getArboristPackagePath(), 'lib/arborist/index.js');
-  }
-  return _arboristClassPath;
-}
-let _arboristEdgeClassPath;
-function getArboristEdgeClassPath() {
-  if (_arboristEdgeClassPath === undefined) {
-    _arboristEdgeClassPath = path.join(getArboristPackagePath(), 'lib/edge.js');
-  }
-  return _arboristEdgeClassPath;
-}
-let _arboristNodeClassPath;
-function getArboristNodeClassPath() {
-  if (_arboristNodeClassPath === undefined) {
-    _arboristNodeClassPath = path.join(getArboristPackagePath(), 'lib/node.js');
-  }
-  return _arboristNodeClassPath;
-}
-let _arboristOverrideSetClassPath;
-function getArboristOverrideSetClassPath() {
-  if (_arboristOverrideSetClassPath === undefined) {
-    _arboristOverrideSetClassPath = path.join(getArboristPackagePath(), 'lib/override-set.js');
-  }
-  return _arboristOverrideSetClassPath;
-}
-
-const DiffAction = utils.createEnum({
-  add: 'ADD',
-  change: 'CHANGE',
-  remove: 'REMOVE'
-});
-
-function getUrlOrigin(input) {
-  // TODO: URL.parse is available in Node 22.1.0. We can use it when we drop Node 18.
-  // https://nodejs.org/docs/latest-v22.x/api/url.html#urlparseinput-base
-  // return URL.parse(input)?.origin ?? ''
-  return require$$13.parseUrl(input)?.origin ?? '';
-}
-async function getAlertsMapFromArborist(arb, needInfoOn, options) {
-  const opts = {
-    __proto__: null,
-    consolidate: false,
-    nothrow: false,
-    ...options,
-    filter: utils.toFilterConfig(require$$11.getOwn(options, 'filter'))
-  };
-  const purls = needInfoOn.map(d => utils.idToNpmPurl(d.node.pkgid));
-  let overrides;
-  const overridesMap = (arb.actualTree ?? arb.idealTree ?? (await arb.loadActual()))?.overrides?.children;
-  if (overridesMap) {
-    overrides = Object.fromEntries(Array.from(overridesMap.entries()).map(([key, overrideSet]) => {
-      return [key, overrideSet.value];
-    }));
-  }
-  return await utils.getAlertsMapFromPurls(purls, {
-    overrides,
-    ...opts
-  });
-}
-function getDetailsFromDiff(diff, options) {
-  const details = [];
-  // `diff` is `null` when `npm install --package-lock-only` is passed.
-  if (!diff) {
-    require$$9.debugFn('notice', `miss: diff is ${diff}`);
-    return details;
-  }
-  const {
-    NPM_REGISTRY_URL
-  } = constants.default;
-  const filterConfig = utils.toFilterConfig({
-    existing: false,
-    unknownOrigin: true,
-    ...require$$11.getOwn(options, 'filter')
-  });
-  const queue = [...diff.children];
-  let pos = 0;
-  let {
-    length: queueLength
-  } = queue;
-  while (pos < queueLength) {
-    if (pos === constants.default.LOOP_SENTINEL) {
-      throw new Error('Detected infinite loop while walking Arborist diff.');
-    }
-    const currDiff = queue[pos++];
-    const {
-      action
-    } = currDiff;
-    if (action) {
-      // The `pkgNode`, i.e. the `ideal` node, will be `undefined` if the diff
-      // action is 'REMOVE'
-      // The `oldNode`, i.e. the `actual` node, will be `undefined` if the diff
-      // action is 'ADD'.
-      const {
-        actual: oldNode,
-        ideal: pkgNode
-      } = currDiff;
-      let existing;
-      let keep = false;
-      if (action === DiffAction.change) {
-        if (pkgNode?.package.version !== oldNode?.package.version) {
-          keep = true;
-          if (oldNode?.package.name && oldNode.package.name === pkgNode?.package.name) {
-            existing = oldNode;
-          }
-        }
-      } else {
-        keep = action !== DiffAction.remove;
-      }
-      if (keep && pkgNode?.resolved && (!oldNode || oldNode.resolved)) {
-        if (filterConfig.unknownOrigin || getUrlOrigin(pkgNode.resolved) === NPM_REGISTRY_URL) {
-          details.push({
-            node: pkgNode,
-            existing
-          });
-        }
-      }
-    }
-    for (const child of currDiff.children) {
-      queue[queueLength++] = child;
-    }
-  }
-  if (filterConfig.existing) {
-    const {
-      unchanged
-    } = diff;
-    for (let i = 0, {
-        length
-      } = unchanged; i < length; i += 1) {
-      const pkgNode = unchanged[i];
-      if (filterConfig.unknownOrigin || getUrlOrigin(pkgNode.resolved) === NPM_REGISTRY_URL) {
-        details.push({
-          node: pkgNode,
-          existing: pkgNode
-        });
-      }
-    }
-  }
-  return details;
-}
-
-// @ts-ignore
-const {
-  kInternalsSymbol,
-  [kInternalsSymbol]: {
-    getIpc
-  }
-} = constants.default;
-const SAFE_NO_SAVE_ARBORIST_REIFY_OPTIONS_OVERRIDES = {
-  __proto__: null,
-  audit: false,
-  dryRun: true,
-  fund: false,
-  ignoreScripts: true,
-  progress: false,
-  save: false,
-  saveBundle: false,
-  silent: true
-};
-const kCtorArgs = Symbol('ctorArgs');
-const kRiskyReify = Symbol('riskyReify');
-const Arborist = vendor.arboristExports;
-
-// Implementation code not related to our custom behavior is based on
-// https://github.com/npm/cli/blob/v11.0.0/workspaces/arborist/lib/arborist/index.js:
-class SafeArborist extends Arborist {
-  constructor(...ctorArgs) {
-    super({
-      path: (ctorArgs.length ? ctorArgs[0]?.path : undefined) ?? process.cwd(),
-      ...(ctorArgs.length ? ctorArgs[0] : undefined),
-      ...SAFE_NO_SAVE_ARBORIST_REIFY_OPTIONS_OVERRIDES
-    }, ...ctorArgs.slice(1));
-    this[kCtorArgs] = ctorArgs;
-  }
-  async [kRiskyReify](...args) {
-    const ctorArgs = this[kCtorArgs];
-    const arb = new Arborist({
-      ...(ctorArgs.length ? ctorArgs[0] : undefined),
-      progress: false
-    }, ...ctorArgs.slice(1));
-    const ret = await arb.reify({
-      ...(args.length ? args[0] : undefined),
-      progress: false
-    }, ...args.slice(1));
-    Object.assign(this, arb);
-    return ret;
-  }
-
-  // @ts-ignore Incorrectly typed.
-  async reify(...args) {
-    const options = {
-      __proto__: null,
-      ...(args.length ? args[0] : undefined)
-    };
-    const ipc = await getIpc();
-    const binName = ipc[constants.default.SOCKET_CLI_SHADOW_BIN];
-    if (!binName) {
-      return await this[kRiskyReify](...args);
-    }
-    await super.reify({
-      ...options,
-      ...SAFE_NO_SAVE_ARBORIST_REIFY_OPTIONS_OVERRIDES,
-      progress: false
-    },
-    // @ts-ignore: TypeScript gets grumpy about rest parameters.
-    ...args.slice(1));
-    const shadowAcceptRisks = !!ipc[constants.default.SOCKET_CLI_SHADOW_ACCEPT_RISKS];
-    const shadowProgress = !!ipc[constants.default.SOCKET_CLI_SHADOW_PROGRESS];
-    const shadowSilent = !!ipc[constants.default.SOCKET_CLI_SHADOW_SILENT];
-    const acceptRisks = shadowAcceptRisks || constants.default.ENV.SOCKET_CLI_ACCEPT_RISKS;
-    const reportOnlyBlocking = acceptRisks || options.dryRun || options['yes'];
-    const silent = !!options['silent'];
-    const spinner = silent || !shadowProgress ? undefined : constants.default.spinner;
-    const isShadowNpx = binName === constants.NPX;
-    const hasExisting = await utils.findUp(constants.NODE_MODULES, {
-      cwd: process.cwd(),
-      onlyDirectories: true
-    });
-    const shouldCheckExisting = reportOnlyBlocking ? true : isShadowNpx;
-    const needInfoOn = getDetailsFromDiff(this.diff, {
-      filter: {
-        existing: shouldCheckExisting
-      }
-    });
-    const alertsMap = await getAlertsMapFromArborist(this, needInfoOn, {
-      apiToken: ipc[constants.default.SOCKET_CLI_SHADOW_API_TOKEN],
-      spinner,
-      filter: reportOnlyBlocking ? {
-        actions: ['error'],
-        blocked: true,
-        existing: shouldCheckExisting
-      } : {
-        actions: ['error', 'monitor', 'warn'],
-        existing: shouldCheckExisting
-      }
-    });
-    if (alertsMap.size) {
-      process.exitCode = 1;
-      const viewAllRisks = constants.default.ENV.SOCKET_CLI_VIEW_ALL_RISKS;
-      utils.logAlertsMap(alertsMap, {
-        hideAt: viewAllRisks ? 'none' : 'middle',
-        output: process.stderr
-      });
-      throw new Error(`
-          Socket ${binName} exiting due to risks.${viewAllRisks ? '' : `\nView all risks - Rerun with environment variable ${constants.default.SOCKET_CLI_VIEW_ALL_RISKS}=1.`}${acceptRisks ? '' : `\nAccept risks - Rerun with environment variable ${constants.default.SOCKET_CLI_ACCEPT_RISKS}=1.`}
-        `.trim());
-    } else if (!silent && !shadowSilent) {
-      logger.logger.success(`Socket ${binName} ${acceptRisks ? 'accepted' : 'found no'}${hasExisting ? ' new' : ''} risks`);
-      if (isShadowNpx) {
-        logger.logger.log(`Running ${options.add[0]}`);
-      }
-    }
-    return await this[kRiskyReify](...args);
-  }
-}
-
-const require$1 = require$$5.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('shadow-npm-inject.js', document.baseURI).href)));
-const Edge = vendor.edgeExports;
-const Node = vendor.nodeExports;
-const OverrideSet = vendor.overrideSetExports;
-function installSafeArborist() {
-  // Override '@npmcli/arborist' module exports with patched variants based on
-  // https://github.com/npm/cli/pull/8089.
-  const cache = require$1.cache;
-  cache[getArboristClassPath()] = {
-    exports: SafeArborist
-  };
-  cache[getArboristEdgeClassPath()] = {
-    exports: Edge
-  };
-  cache[getArboristNodeClassPath()] = {
-    exports: Node
-  };
-  cache[getArboristOverrideSetClassPath()] = {
-    exports: OverrideSet
-  };
-}
-
-installSafeArborist();
-//# debugId=fa30e366-2602-48d0-939f-fcec4c526adc
-//# sourceMappingURL=shadow-npm-inject.js.map

package/dist/shadow-npm-inject.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"shadow-npm-inject.js","sources":["../src/shadow/npm/paths.mts","../src/shadow/npm/arborist/types.mts","../src/shadow/npm/arborist-helpers.mts","../src/shadow/npm/arborist/lib/arborist/index.mts","../src/shadow/npm/arborist/index.mts","../src/shadow/npm/inject.mts"],"sourcesContent":["import path from 'node:path'\n\nimport { normalizePath } from '@socketsecurity/registry/lib/path'\n\nimport constants from '../../constants.mts'\nimport { getNpmRequire } from '../../utils/npm-paths.mts'\n\nlet _arboristPkgPath: string | undefined\nexport function getArboristPackagePath() {\n  if (_arboristPkgPath === undefined) {\n    const pkgName = '@npmcli/arborist'\n    const mainPathWithForwardSlashes = normalizePath(\n      getNpmRequire().resolve(pkgName),\n    )\n    const arboristPkgPathWithForwardSlashes = mainPathWithForwardSlashes.slice(\n      0,\n      mainPathWithForwardSlashes.lastIndexOf(pkgName) + pkgName.length,\n    )\n    _arboristPkgPath = constants.WIN32\n      ? path.normalize(arboristPkgPathWithForwardSlashes)\n      : arboristPkgPathWithForwardSlashes\n  }\n  return _arboristPkgPath\n}\n\nlet _arboristClassPath: string | undefined\nexport function getArboristClassPath() {\n  if (_arboristClassPath === undefined) {\n    _arboristClassPath = path.join(\n      getArboristPackagePath(),\n      'lib/arborist/index.js',\n    )\n  }\n  return _arboristClassPath\n}\n\nlet _arboristEdgeClassPath: string | undefined\nexport function getArboristEdgeClassPath() {\n  if (_arboristEdgeClassPath === undefined) {\n    _arboristEdgeClassPath = path.join(getArboristPackagePath(), 'lib/edge.js')\n  }\n  return _arboristEdgeClassPath\n}\n\nlet _arboristNodeClassPath: string | undefined\nexport function getArboristNodeClassPath() {\n  if (_arboristNodeClassPath === undefined) {\n    _arboristNodeClassPath = path.join(getArboristPackagePath(), 'lib/node.js')\n  }\n  return _arboristNodeClassPath\n}\n\nlet _arboristOverrideSetClassPath: string | undefined\nexport function getArboristOverrideSetClassPath() {\n  if (_arboristOverrideSetClassPath === undefined) {\n    _arboristOverrideSetClassPath = path.join(\n      getArboristPackagePath(),\n      'lib/override-set.js',\n    )\n  }\n  return _arboristOverrideSetClassPath\n}\n","import { createEnum } from '../../../utils/objects.mts'\n\nimport type {\n  Advisory as BaseAdvisory,\n  Arborist as BaseArborist,\n  Options as BaseArboristOptions,\n  AuditReport as BaseAuditReport,\n  Diff as BaseDiff,\n  Edge as BaseEdge,\n  Node as BaseNode,\n  BaseOverrideSet,\n  BuildIdealTreeOptions,\n  ReifyOptions,\n} from '@npmcli/arborist'\n\nexport type ArboristOptions = BaseArboristOptions & {\n  npmCommand?: string | undefined\n  npmVersion?: string | undefined\n}\n\nexport type ArboristClass = ArboristInstance & {\n  new (...args: any): ArboristInstance\n}\n\nexport type ArboristInstance = Omit<\n  typeof BaseArborist,\n  | 'actualTree'\n  | 'auditReport'\n  | 'buildIdealTree'\n  | 'diff'\n  | 'idealTree'\n  | 'loadActual'\n  | 'loadVirtual'\n  | 'reify'\n> & {\n  auditReport?: AuditReportInstance | null | undefined\n  actualTree?: NodeClass | null | undefined\n  diff: Diff | null\n  idealTree?: NodeClass | null | undefined\n  buildIdealTree(\n    options?: BuildIdealTreeOptions | undefined,\n  ): Promise<NodeClass>\n  loadActual(options?: ArboristOptions | undefined): Promise<NodeClass>\n  loadVirtual(options?: ArboristOptions | undefined): Promise<NodeClass>\n  reify(options?: ArboristReifyOptions | undefined): Promise<NodeClass>\n}\n\nexport type ArboristReifyOptions = ReifyOptions & ArboristOptions\n\nexport type AuditAdvisory = Omit<BaseAdvisory, 'id'> & {\n  id: number\n  cwe: string[]\n  cvss: {\n    score: number\n    vectorString: string\n  }\n  vulnerable_versions: string\n}\n\nexport type AuditReportInstance = Omit<BaseAuditReport, 'report'> & {\n  report: { [dependency: string]: AuditAdvisory[] }\n}\n\nexport const DiffAction = createEnum({\n  add: 'ADD',\n  change: 'CHANGE',\n  remove: 'REMOVE',\n})\n\nexport type Diff = Omit<\n  BaseDiff,\n  | 'actual'\n  | 'children'\n  | 'filterSet'\n  | 'ideal'\n  | 'leaves'\n  | 'removed'\n  | 'shrinkwrapInflated'\n  | 'unchanged'\n> & {\n  actual: NodeClass\n  children: Diff[]\n  filterSet: Set<NodeClass>\n  ideal: NodeClass\n  leaves: NodeClass[]\n  parent: Diff | null\n  removed: NodeClass[]\n  shrinkwrapInflated: Set<NodeClass>\n  unchanged: NodeClass[]\n}\n\nexport type EdgeClass = Omit<\n  BaseEdge,\n  | 'accept'\n  | 'detach'\n  | 'optional'\n  | 'overrides'\n  | 'peer'\n  | 'peerConflicted'\n  | 'rawSpec'\n  | 'reload'\n  | 'satisfiedBy'\n  | 'spec'\n  | 'to'\n> & {\n  optional: boolean\n  overrides: OverrideSetClass | undefined\n  peer: boolean\n  peerConflicted: boolean\n  rawSpec: string\n  get accept(): string | undefined\n  get spec(): string\n  get to(): NodeClass | null\n  new (...args: any): EdgeClass\n  detach(): void\n  reload(hard?: boolean | undefined): void\n  satisfiedBy(node: NodeClass): boolean\n}\n\nexport type LinkClass = Omit<NodeClass, 'isLink'> & {\n  readonly isLink: true\n}\n\nexport type NodeClass = Omit<\n  BaseNode,\n  | 'addEdgeIn'\n  | 'addEdgeOut'\n  | 'canDedupe'\n  | 'canReplace'\n  | 'canReplaceWith'\n  | 'children'\n  | 'deleteEdgeIn'\n  | 'edgesIn'\n  | 'edgesOut'\n  | 'from'\n  | 'hasShrinkwrap'\n  | 'inDepBundle'\n  | 'inShrinkwrap'\n  | 'integrity'\n  | 'isTop'\n  | 'matches'\n  | 'meta'\n  | 'name'\n  | 'overrides'\n  | 'packageName'\n  | 'parent'\n  | 'recalculateOutEdgesOverrides'\n  | 'resolve'\n  | 'resolveParent'\n  | 'root'\n  | 'target'\n  | 'updateOverridesEdgeInAdded'\n  | 'updateOverridesEdgeInRemoved'\n  | 'version'\n  | 'versions'\n> & {\n  name: string\n  version: string\n  children: Map<string, NodeClass | LinkClass>\n  edgesIn: Set<EdgeClass>\n  edgesOut: Map<string, EdgeClass>\n  from: NodeClass | null\n  hasShrinkwrap: boolean\n  inShrinkwrap: boolean | undefined\n  integrity?: string | null\n  isTop: boolean | undefined\n  meta: BaseNode['meta'] & {\n    addEdge(edge: EdgeClass): void\n  }\n  overrides: OverrideSetClass | undefined\n  target: NodeClass\n  versions: string[]\n  get inDepBundle(): boolean\n  get packageName(): string | null\n  get parent(): NodeClass | null\n  set parent(value: NodeClass | null)\n  get resolveParent(): NodeClass | null\n  get root(): NodeClass | null\n  set root(value: NodeClass | null)\n  new (...args: any): NodeClass\n  addEdgeIn(edge: EdgeClass): void\n  addEdgeOut(edge: EdgeClass): void\n  canDedupe(preferDedupe?: boolean | undefined): boolean\n  canReplace(node: NodeClass, ignorePeers?: string[] | undefined): boolean\n  canReplaceWith(node: NodeClass, ignorePeers?: string[] | undefined): boolean\n  deleteEdgeIn(edge: EdgeClass): void\n  matches(node: NodeClass): boolean\n  recalculateOutEdgesOverrides(): void\n  resolve(name: string): NodeClass\n  updateOverridesEdgeInAdded(\n    otherOverrideSet: OverrideSetClass | undefined,\n  ): boolean\n  updateOverridesEdgeInRemoved(otherOverrideSet: OverrideSetClass): boolean\n}\n\nexport interface OverrideSetClass\n  extends Omit<\n    BaseOverrideSet,\n    | 'ancestry'\n    | 'children'\n    | 'getEdgeRule'\n    | 'getMatchingRule'\n    | 'getNodeRule'\n    | 'parent'\n    | 'ruleset'\n  > {\n  children: Map<string, OverrideSetClass>\n  key: string | undefined\n  keySpec: string | undefined\n  name: string | undefined\n  parent: OverrideSetClass | undefined\n  value: string | undefined\n  version: string | undefined\n  // eslint-disable-next-line @typescript-eslint/no-misused-new\n  new (...args: any[]): OverrideSetClass\n  get isRoot(): boolean\n  get ruleset(): Map<string, OverrideSetClass>\n  ancestry(): Generator<OverrideSetClass>\n  childrenAreEqual(otherOverrideSet: OverrideSetClass | undefined): boolean\n  getEdgeRule(edge: EdgeClass): OverrideSetClass\n  getMatchingRule(node: NodeClass): OverrideSetClass | null\n  getNodeRule(node: NodeClass): OverrideSetClass\n  isEqual(otherOverrideSet: OverrideSetClass | undefined): boolean\n}\n","import { debugFn } from '@socketsecurity/registry/lib/debug'\nimport { getOwn } from '@socketsecurity/registry/lib/objects'\nimport { parseUrl } from '@socketsecurity/registry/lib/url'\n\nimport constants from '../../constants.mts'\nimport { DiffAction } from './arborist/types.mts'\nimport { getAlertsMapFromPurls } from '../../utils/alerts-map.mts'\nimport { toFilterConfig } from '../../utils/filter-config.mts'\nimport { idToNpmPurl } from '../../utils/spec.mts'\n\nimport type { ArboristInstance, Diff, NodeClass } from './arborist/types.mts'\nimport type {\n  AlertFilter,\n  AlertsByPurl,\n} from '../../utils/socket-package-alert.mts'\nimport type { Spinner } from '@socketsecurity/registry/lib/spinner'\n\nfunction getUrlOrigin(input: string): string {\n  // TODO: URL.parse is available in Node 22.1.0. We can use it when we drop Node 18.\n  // https://nodejs.org/docs/latest-v22.x/api/url.html#urlparseinput-base\n  // return URL.parse(input)?.origin ?? ''\n  return parseUrl(input)?.origin ?? ''\n}\n\nexport type GetAlertsMapFromArboristOptions = {\n  apiToken?: string | undefined\n  consolidate?: boolean | undefined\n  filter?: AlertFilter | undefined\n  nothrow?: boolean | undefined\n  spinner?: Spinner | undefined\n}\n\nexport async function getAlertsMapFromArborist(\n  arb: ArboristInstance,\n  needInfoOn: PackageDetail[],\n  options?: GetAlertsMapFromArboristOptions | undefined,\n): Promise<AlertsByPurl> {\n  const opts = {\n    __proto__: null,\n    consolidate: false,\n    nothrow: false,\n    ...options,\n    filter: toFilterConfig(getOwn(options, 'filter')),\n  } as GetAlertsMapFromArboristOptions & { filter: AlertFilter }\n\n  const purls = needInfoOn.map(d => idToNpmPurl(d.node.pkgid))\n\n  let overrides: { [key: string]: string } | undefined\n  const overridesMap = (\n    arb.actualTree ??\n    arb.idealTree ??\n    (await arb.loadActual())\n  )?.overrides?.children\n  if (overridesMap) {\n    overrides = Object.fromEntries(\n      Array.from(overridesMap.entries()).map(([key, overrideSet]) => {\n        return [key, overrideSet.value!]\n      }),\n    )\n  }\n\n  return await getAlertsMapFromPurls(purls, {\n    overrides,\n    ...opts,\n  })\n}\n\nexport type DiffQueryFilter = {\n  existing?: boolean | undefined\n  unknownOrigin?: boolean | undefined\n}\n\nexport type DiffQueryOptions = {\n  filter?: DiffQueryFilter | undefined\n}\n\nexport type PackageDetail = {\n  node: NodeClass\n  existing?: NodeClass | undefined\n}\n\nexport function getDetailsFromDiff(\n  diff: Diff | null,\n  options?: DiffQueryOptions | undefined,\n): PackageDetail[] {\n  const details: PackageDetail[] = []\n  // `diff` is `null` when `npm install --package-lock-only` is passed.\n  if (!diff) {\n    debugFn('notice', `miss: diff is ${diff}`)\n    return details\n  }\n\n  const { NPM_REGISTRY_URL } = constants\n\n  const filterConfig = toFilterConfig({\n    existing: false,\n    unknownOrigin: true,\n    ...getOwn(options, 'filter'),\n  }) as DiffQueryFilter\n\n  const queue: Diff[] = [...diff.children]\n  let pos = 0\n  let { length: queueLength } = queue\n  while (pos < queueLength) {\n    if (pos === constants.LOOP_SENTINEL) {\n      throw new Error('Detected infinite loop while walking Arborist diff.')\n    }\n    const currDiff = queue[pos++]!\n    const { action } = currDiff\n    if (action) {\n      // The `pkgNode`, i.e. the `ideal` node, will be `undefined` if the diff\n      // action is 'REMOVE'\n      // The `oldNode`, i.e. the `actual` node, will be `undefined` if the diff\n      // action is 'ADD'.\n      const { actual: oldNode, ideal: pkgNode } = currDiff\n      let existing: NodeClass | undefined\n      let keep = false\n      if (action === DiffAction.change) {\n        if (pkgNode?.package.version !== oldNode?.package.version) {\n          keep = true\n          if (\n            oldNode?.package.name &&\n            oldNode.package.name === pkgNode?.package.name\n          ) {\n            existing = oldNode\n          }\n        }\n      } else {\n        keep = action !== DiffAction.remove\n      }\n      if (keep && pkgNode?.resolved && (!oldNode || oldNode.resolved)) {\n        if (\n          filterConfig.unknownOrigin ||\n          getUrlOrigin(pkgNode.resolved) === NPM_REGISTRY_URL\n        ) {\n          details.push({\n            node: pkgNode,\n            existing,\n          })\n        }\n      }\n    }\n    for (const child of currDiff.children) {\n      queue[queueLength++] = child\n    }\n  }\n  if (filterConfig.existing) {\n    const { unchanged } = diff\n    for (let i = 0, { length } = unchanged; i < length; i += 1) {\n      const pkgNode = unchanged[i]!\n      if (\n        filterConfig.unknownOrigin ||\n        getUrlOrigin(pkgNode.resolved!) === NPM_REGISTRY_URL\n      ) {\n        details.push({\n          node: pkgNode,\n          existing: pkgNode,\n        })\n      }\n    }\n  }\n  return details\n}\n","// @ts-ignore\nimport UntypedArborist from '@npmcli/arborist/lib/arborist/index.js'\n\nimport { logger } from '@socketsecurity/registry/lib/logger'\n\nimport constants, { NODE_MODULES, NPX } from '../../../../../constants.mts'\nimport { findUp } from '../../../../../utils/fs.mts'\nimport { logAlertsMap } from '../../../../../utils/socket-package-alert.mts'\nimport {\n  getAlertsMapFromArborist,\n  getDetailsFromDiff,\n} from '../../../arborist-helpers.mts'\n\nimport type {\n  ArboristClass,\n  ArboristReifyOptions,\n  NodeClass,\n} from '../../types.mts'\n\nconst {\n  kInternalsSymbol,\n  [kInternalsSymbol as unknown as 'Symbol(kInternalsSymbol)']: { getIpc },\n} = constants\n\nexport const SAFE_NO_SAVE_ARBORIST_REIFY_OPTIONS_OVERRIDES = {\n  __proto__: null,\n  audit: false,\n  dryRun: true,\n  fund: false,\n  ignoreScripts: true,\n  progress: false,\n  save: false,\n  saveBundle: false,\n  silent: true,\n}\n\nexport const SAFE_WITH_SAVE_ARBORIST_REIFY_OPTIONS_OVERRIDES = {\n  // @ts-ignore\n  __proto__: null,\n  ...SAFE_NO_SAVE_ARBORIST_REIFY_OPTIONS_OVERRIDES,\n  dryRun: false,\n  save: true,\n}\n\nexport const kCtorArgs = Symbol('ctorArgs')\n\nexport const kRiskyReify = Symbol('riskyReify')\n\nexport const Arborist: ArboristClass = UntypedArborist\n\n// Implementation code not related to our custom behavior is based on\n// https://github.com/npm/cli/blob/v11.0.0/workspaces/arborist/lib/arborist/index.js:\nexport class SafeArborist extends Arborist {\n  constructor(...ctorArgs: ConstructorParameters<ArboristClass>) {\n    super(\n      {\n        path:\n          (ctorArgs.length ? ctorArgs[0]?.path : undefined) ?? process.cwd(),\n        ...(ctorArgs.length ? ctorArgs[0] : undefined),\n        ...SAFE_NO_SAVE_ARBORIST_REIFY_OPTIONS_OVERRIDES,\n      },\n      ...ctorArgs.slice(1),\n    )\n    ;(this as any)[kCtorArgs] = ctorArgs\n  }\n\n  async [kRiskyReify](\n    ...args: Parameters<InstanceType<ArboristClass>['reify']>\n  ): Promise<NodeClass> {\n    const ctorArgs = (this as any)[kCtorArgs]\n    const arb = new Arborist(\n      {\n        ...(ctorArgs.length ? ctorArgs[0] : undefined),\n        progress: false,\n      },\n      ...ctorArgs.slice(1),\n    )\n    const ret = await (arb.reify as (...args: any[]) => Promise<NodeClass>)(\n      {\n        ...(args.length ? args[0] : undefined),\n        progress: false,\n      },\n      ...args.slice(1),\n    )\n    Object.assign(this, arb)\n    return ret\n  }\n\n  // @ts-ignore Incorrectly typed.\n  override async reify(\n    this: SafeArborist,\n    ...args: Parameters<InstanceType<ArboristClass>['reify']>\n  ): Promise<NodeClass> {\n    const options = {\n      __proto__: null,\n      ...(args.length ? args[0] : undefined),\n    } as ArboristReifyOptions\n\n    const ipc = await getIpc()\n\n    const binName = ipc[constants.SOCKET_CLI_SHADOW_BIN]\n    if (!binName) {\n      return await this[kRiskyReify](...args)\n    }\n\n    await super.reify(\n      {\n        ...options,\n        ...SAFE_NO_SAVE_ARBORIST_REIFY_OPTIONS_OVERRIDES,\n        progress: false,\n      },\n      // @ts-ignore: TypeScript gets grumpy about rest parameters.\n      ...args.slice(1),\n    )\n\n    const shadowAcceptRisks = !!ipc[constants.SOCKET_CLI_SHADOW_ACCEPT_RISKS]\n    const shadowProgress = !!ipc[constants.SOCKET_CLI_SHADOW_PROGRESS]\n    const shadowSilent = !!ipc[constants.SOCKET_CLI_SHADOW_SILENT]\n\n    const acceptRisks =\n      shadowAcceptRisks || constants.ENV.SOCKET_CLI_ACCEPT_RISKS\n    const reportOnlyBlocking = acceptRisks || options.dryRun || options['yes']\n    const silent = !!options['silent']\n    const spinner = silent || !shadowProgress ? undefined : constants.spinner\n\n    const isShadowNpx = binName === NPX\n    const hasExisting = await findUp(NODE_MODULES, {\n      cwd: process.cwd(),\n      onlyDirectories: true,\n    })\n    const shouldCheckExisting = reportOnlyBlocking ? true : isShadowNpx\n\n    const needInfoOn = getDetailsFromDiff(this.diff, {\n      filter: {\n        existing: shouldCheckExisting,\n      },\n    })\n\n    const alertsMap = await getAlertsMapFromArborist(this, needInfoOn, {\n      apiToken: ipc[constants.SOCKET_CLI_SHADOW_API_TOKEN],\n      spinner,\n      filter: reportOnlyBlocking\n        ? {\n            actions: ['error'],\n            blocked: true,\n            existing: shouldCheckExisting,\n          }\n        : {\n            actions: ['error', 'monitor', 'warn'],\n            existing: shouldCheckExisting,\n          },\n    })\n\n    if (alertsMap.size) {\n      process.exitCode = 1\n      const viewAllRisks = constants.ENV.SOCKET_CLI_VIEW_ALL_RISKS\n      logAlertsMap(alertsMap, {\n        hideAt: viewAllRisks ? 'none' : 'middle',\n        output: process.stderr,\n      })\n      throw new Error(\n        `\n          Socket ${binName} exiting due to risks.${\n            viewAllRisks\n              ? ''\n              : `\\nView all risks - Rerun with environment variable ${constants.SOCKET_CLI_VIEW_ALL_RISKS}=1.`\n          }${\n            acceptRisks\n              ? ''\n              : `\\nAccept risks - Rerun with environment variable ${constants.SOCKET_CLI_ACCEPT_RISKS}=1.`\n          }\n        `.trim(),\n      )\n    } else if (!silent && !shadowSilent) {\n      logger.success(\n        `Socket ${binName} ${acceptRisks ? 'accepted' : 'found no'}${hasExisting ? ' new' : ''} risks`,\n      )\n      if (isShadowNpx) {\n        logger.log(`Running ${options.add![0]}`)\n      }\n    }\n\n    return await this[kRiskyReify](...args)\n  }\n}\n","import { createRequire } from 'node:module'\n\n// @ts-ignore\nimport UntypedEdge from '@npmcli/arborist/lib/edge.js'\n// @ts-ignore\nimport UntypedNode from '@npmcli/arborist/lib/node.js'\n// @ts-ignore\nimport UntypedOverrideSet from '@npmcli/arborist/lib/override-set.js'\n\nimport {\n  getArboristClassPath,\n  getArboristEdgeClassPath,\n  getArboristNodeClassPath,\n  getArboristOverrideSetClassPath,\n} from '../paths.mts'\nimport { Arborist, SafeArborist } from './lib/arborist/index.mts'\n\nimport type { EdgeClass, NodeClass, OverrideSetClass } from './types.mts'\n\nconst require = createRequire(import.meta.url)\n\nexport { Arborist, SafeArborist }\n\nexport const Edge: EdgeClass = UntypedEdge\n\nexport const Node: NodeClass = UntypedNode\n\nexport const OverrideSet: OverrideSetClass = UntypedOverrideSet\n\nexport function installSafeArborist() {\n  // Override '@npmcli/arborist' module exports with patched variants based on\n  // https://github.com/npm/cli/pull/8089.\n  const cache: { [key: string]: any } = require.cache\n  cache[getArboristClassPath()] = { exports: SafeArborist }\n  cache[getArboristEdgeClassPath()] = { exports: Edge }\n  cache[getArboristNodeClassPath()] = { exports: Node }\n  cache[getArboristOverrideSetClassPath()] = { exports: OverrideSet }\n}\n","import { installSafeArborist } from './arborist/index.mts'\n\ninstallSafeArborist()\n"],"names":["_arboristPkgPath","add","change","remove","__proto__","consolidate","nothrow","debugFn","NPM_REGISTRY_URL","existing","unknownOrigin","length","action","actual","ideal","keep","node","queue","unchanged","getIpc","audit","dryRun","fund","ignoreScripts","progress","save","saveBundle","silent","path","Object","cwd","onlyDirectories","filter","apiToken","blocked","actions","hideAt","logger","cache","exports","installSafeArborist"],"mappings":";;;;;;;;;;;;;;AAOA;AACO;;;AAGH;AAGA;AAIAA;AAGF;AACA;AACF;AAEA;AACO;;;AAML;AACA;AACF;AAEA;AACO;;;AAGL;AACA;AACF;AAEA;AACO;;;AAGL;AACA;AACF;AAEA;AACO;;;AAML;AACA;AACF;;ACEO;AACLC;AACAC;AACAC;AACF;;AClDA;AACE;AACA;AACA;AACA;AACF;AAUO;AAKL;AACEC;AACAC;AACAC;AACA;;;AAIF;AAEA;;AAMA;;AAGM;AACF;AAEJ;AAEA;;;AAGA;AACF;AAgBO;;AAKL;;AAEEC;AACA;AACF;;AAEQC;AAAiB;;AAGvBC;AACAC;AACA;AACF;AAEA;;;AAEMC;AAAoB;;AAExB;AACE;AACF;AACA;;AACQC;AAAO;AACf;AACE;AACA;AACA;AACA;;AACQC;AAAiBC;AAAe;AACxC;;AAEA;;AAEIC;AACA;AAIEN;AACF;AACF;AACF;AACEM;AACF;AACA;AACE;;AAKIC;AACAP;AACF;AACF;AACF;AACF;AACA;AACEQ;AACF;AACF;;;AAEUC;AAAU;AAClB;AAAkBP;;AAChB;AACA;;AAKIK;AACAP;AACF;AACF;AACF;AACF;AACA;AACF;;AClKA;AAmBA;;AAEE;AAA+DU;AAAO;AACxE;AAEO;AACLf;AACAgB;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACAC;AACF;AAUO;AAEA;AAEA;;AAEP;AACA;AACO;;AAEH;AAEIC;;;;AAOF;AACJ;AAEA;AAGE;AACA;;AAGIJ;;AAIJ;;AAGIA;;AAIJK;AACA;AACF;;AAEA;AACA;AAIE;AACEzB;;;AAIF;AAEA;;;AAGA;;AAII;AACA;AACAoB;;AAEF;AACA;;;;;;AAUF;;AAGA;AACA;AACEM;AACAC;AACF;AACA;AAEA;AACEC;AACEvB;AACF;AACF;;AAGEwB;;;;AAKMC;AACAzB;AACF;AAEE0B;AACA1B;AACF;AACN;;;AAIE;;AAEE2B;;AAEF;;AAGN;AAQA;AAGI;AACEC;AAGA;;AAEA;AACF;;AAGF;AACF;;ACrKA;AAIO;AAEA;AAEA;AAEA;AACL;AACA;AACA;AACAC;AAAkCC;;AAClCD;AAAsCC;;AACtCD;AAAsCC;;AACtCD;AAA6CC;;AAC/C;;ACnCAC","debugId":"fa30e366-2602-48d0-939f-fcec4c526adc"}