@socketsecurity/cli-with-sentry 1.14.0 → 1.15.0

package/dist/utils.js

@@ -26,7 +26,7 @@ var require$$11 = require('node:zlib');
 var fs = require('../external/@socketsecurity/registry/lib/fs');
 var url = require('../external/@socketsecurity/registry/lib/url');
 var require$$1 = require('node:module');
-var agent = require('../external/@socketsecurity/registry/lib/agent');
+var agent$1 = require('../external/@socketsecurity/registry/lib/agent');
 var bin = require('../external/@socketsecurity/registry/lib/bin');
 var packages = require('../external/@socketsecurity/registry/lib/packages');
 var os = require('node:os');
@@ -674,7 +674,7 @@ function normalizeConfigKey(key) {
   //       property apiKey, we'll copy that to apiToken and delete the old property.
   // We added `org` as a convenience alias for `defaultOrg`
   const normalizedKey = key === 'apiKey' ? constants.CONFIG_KEY_API_TOKEN : key === constants.CONFIG_KEY_ORG ? constants.CONFIG_KEY_DEFAULT_ORG : key;
-  if (!isSupportedConfigKey(normalizedKey)) {
+  if (normalizedKey !== constants.CONFIG_KEY_AUTH_TYPE && !isSupportedConfigKey(normalizedKey)) {
     return {
       ok: false,
       message: `Invalid config key: ${normalizedKey}`,
@@ -969,6 +969,610 @@ function getRequirementsKey(cmdPath) {
   return cmdPath.replace(/^socket[: ]/, '').replace(/ +/g, ':');
 }
 
+// Cached extra CA certificates for SSL_CERT_FILE support.
+let extraCaCerts;
+let extraCaCertsResolved = false;
+
+// Node reads NODE_EXTRA_CA_CERTS only at process start. If only SSL_CERT_FILE
+// is set, pass the extra certificates to each outbound TLS agent explicitly.
+function getExtraCaCerts() {
+  if (extraCaCertsResolved) {
+    return extraCaCerts;
+  }
+  extraCaCertsResolved = true;
+  if (process.env['NODE_EXTRA_CA_CERTS']) {
+    return undefined;
+  }
+  const certPath = constants.default.ENV.NODE_EXTRA_CA_CERTS;
+  if (!certPath) {
+    return undefined;
+  }
+  try {
+    const extraCerts = u.readFileSync(certPath, 'utf-8');
+    extraCaCerts = [...node_tls.rootCertificates, extraCerts];
+    return extraCaCerts;
+  } catch (error) {
+    debug$2.debugFn('warn', `Failed to read certificate file: ${certPath}`, error);
+    return undefined;
+  }
+}
+
+const OAUTH_ISSUER = 'https://api.socket.dev';
+const OAUTH_RESOURCE = 'https://mcp.socket.dev/';
+const RESOURCE_METADATA = `${OAUTH_RESOURCE}.well-known/oauth-protected-resource`;
+const ISSUER_METADATA = `${OAUTH_ISSUER}/.well-known/oauth-authorization-server`;
+const REQUIRED_SCOPES = ['packages:list', 'alerts:list', 'threat-feed:list'];
+const FLOW_TIMEOUT = 5 * 60_000;
+const REQUEST_TIMEOUT = 20_000;
+const MAX_RESPONSE = 256 * 1024;
+const LOCK_TIMEOUT = 60_000;
+const FILE = 'oauth.json';
+const error = message => new Error(`Socket browser sign-in: ${message}`);
+const random = (n = 32) => require$$0.randomBytes(n).toString('base64url');
+const form = data => new URLSearchParams(data).toString();
+function trustedEndpoint(value) {
+  if (typeof value !== 'string') {
+    throw error('OAuth metadata is invalid.');
+  }
+  let u;
+  try {
+    u = new URL(value);
+  } catch {
+    throw error('OAuth metadata is invalid.');
+  }
+  if (u.protocol !== 'https:' || u.origin !== OAUTH_ISSUER || u.username || u.password || u.search || u.hash) {
+    throw error('OAuth metadata contains an untrusted endpoint.');
+  }
+  return u.href;
+}
+function agent(proxy, timeoutMs = REQUEST_TIMEOUT) {
+  const ca = getExtraCaCerts();
+  return proxy ? new vendor.HttpsProxyAgent({
+    proxy,
+    timeout: timeoutMs,
+    ...(ca ? {
+      ca,
+      proxyRequestOptions: {
+        ca
+      }
+    } : {})
+  }) : ca ? new require$$13.Agent({
+    ca
+  }) : undefined;
+}
+function oauthCancellationError(signal) {
+  return signal?.reason instanceof Error ? signal.reason : error('Sign-in was cancelled.');
+}
+function http(url, opts = {}) {
+  const target = new URL(url);
+  if (target.protocol !== 'https:' || target.origin !== OAUTH_ISSUER && target.origin !== new URL(OAUTH_RESOURCE).origin) {
+    throw error('Refusing to contact an untrusted OAuth endpoint.');
+  }
+  return new Promise((resolve, reject) => {
+    if (opts.signal?.aborted) {
+      reject(opts.signal.reason ?? error('Sign-in was cancelled.'));
+      return;
+    }
+    let done = false;
+    const finish = fn => {
+      if (!done) {
+        done = true;
+        clearTimeout(deadline);
+        opts.signal?.removeEventListener('abort', abort);
+        requestAgent?.destroy();
+        fn();
+      }
+    };
+    const timeoutMs = Math.min(opts.timeoutMs ?? REQUEST_TIMEOUT, REQUEST_TIMEOUT);
+    const requestAgent = agent(opts.proxy, timeoutMs);
+    const req = require$$13.request(target, {
+      method: opts.method ?? 'GET',
+      timeout: timeoutMs,
+      ...(requestAgent ? {
+        agent: requestAgent
+      } : {}),
+      headers: {
+        accept: 'application/json',
+        ...opts.headers,
+        ...(opts.body ? {
+          'content-length': String(Buffer.byteLength(opts.body))
+        } : {})
+      }
+    }, res => {
+      const chunks = [];
+      let size = 0;
+      res.on('data', chunk => {
+        size += chunk.length;
+        if (size > MAX_RESPONSE) {
+          req.destroy(error('OAuth response was too large.'));
+          return;
+        }
+        chunks.push(Buffer.from(chunk));
+      });
+      res.on('error', () => finish(() => reject(error('OAuth response could not be read.'))));
+      res.on('aborted', () => finish(() => reject(error('OAuth response ended unexpectedly.'))));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        if (!text && opts.allowEmpty) {
+          finish(() => resolve({
+            status: res.statusCode ?? 0,
+            body: {}
+          }));
+          return;
+        }
+        try {
+          const body = JSON.parse(text);
+          finish(() => resolve({
+            status: res.statusCode ?? 0,
+            body
+          }));
+        } catch {
+          finish(() => reject(error('OAuth server returned an invalid response.')));
+        }
+      });
+    });
+    const abort = () => {
+      finish(() => reject(error('Sign-in was cancelled.')));
+      req.destroy();
+    };
+    const deadline = setTimeout(() => {
+      finish(() => reject(error('OAuth request timed out.')));
+      req.destroy();
+    }, timeoutMs);
+    opts.signal?.addEventListener('abort', abort, {
+      once: true
+    });
+    req.on('error', () => finish(() => reject(error('OAuth request failed.'))));
+    if (opts.body) {
+      req.write(opts.body);
+    }
+    req.end();
+  });
+}
+async function discover(opts) {
+  const r = await http(RESOURCE_METADATA, {
+    signal: opts.signal,
+    proxy: opts.apiProxy
+  });
+  const rb = r.body;
+  if (r.status !== 200 || !objects.isObjectObject(rb) || rb['resource'] !== OAUTH_RESOURCE || !Array.isArray(rb['authorization_servers']) || !rb['authorization_servers'].some(server => server === OAUTH_ISSUER) || !Array.isArray(rb['scopes_supported']) || rb['scopes_supported'].length !== REQUIRED_SCOPES.length || REQUIRED_SCOPES.some(s => !rb['scopes_supported'].includes(s))) {
+    throw error('Socket OAuth resource metadata could not be verified.');
+  }
+  const ir = await http(ISSUER_METADATA, {
+    signal: opts.signal,
+    proxy: opts.apiProxy
+  });
+  const m = ir.body;
+  if (ir.status !== 200 || !objects.isObjectObject(m) || m['issuer'] !== OAUTH_ISSUER || !Array.isArray(m['grant_types_supported']) || !m['grant_types_supported'].includes('authorization_code') || !m['grant_types_supported'].includes('refresh_token') || !Array.isArray(m['code_challenge_methods_supported']) || !m['code_challenge_methods_supported'].includes('S256') || !Array.isArray(m['token_endpoint_auth_methods_supported']) || !m['token_endpoint_auth_methods_supported'].includes('none')) {
+    throw error('Socket OAuth issuer metadata is invalid.');
+  }
+  return {
+    authorize: trustedEndpoint(m['authorization_endpoint']),
+    register: trustedEndpoint(m['registration_endpoint']),
+    token: trustedEndpoint(m['token_endpoint']),
+    ...(m['revocation_endpoint'] ? {
+      revoke: trustedEndpoint(m['revocation_endpoint'])
+    } : {})
+  };
+}
+function parseToken(r, fallback, meta) {
+  const b = r.body;
+  if (r.status < 200 || r.status >= 300 || !objects.isObjectObject(b) || typeof b['access_token'] !== 'string' || !b['access_token'].trim() || typeof b['token_type'] !== 'string' || b['token_type'].toLowerCase() !== 'bearer' || typeof b['expires_in'] !== 'number' || !Number.isFinite(b['expires_in']) || b['expires_in'] <= 0 || !Number.isSafeInteger(Date.now() + b['expires_in'] * 1000) || b['refresh_token'] !== undefined && (typeof b['refresh_token'] !== 'string' || !b['refresh_token'])) {
+    const code = objects.isObjectObject(b) && b['error'] === 'invalid_grant';
+    throw error(code ? 'The saved session expired or was revoked. Run `socket login` again.' : 'Token exchange failed. Run `socket login` again if the problem continues.');
+  }
+  if (b['scope'] !== undefined && typeof b['scope'] !== 'string') {
+    throw error('The authorization server returned invalid permissions.');
+  }
+  const scopes = typeof b['scope'] === 'string' ? b['scope'].split(/\s+/).filter(Boolean) : fallback;
+  if (scopes.some(s => !REQUIRED_SCOPES.includes(s))) {
+    throw error('The authorization server returned unsupported permissions.');
+  }
+  if (REQUIRED_SCOPES.some(scope => !scopes.includes(scope))) {
+    throw error('The authorization server did not grant the required read-only permissions.');
+  }
+  return {
+    version: 1,
+    issuer: OAUTH_ISSUER,
+    resource: OAUTH_RESOURCE,
+    apiOrigin: OAUTH_ISSUER,
+    clientId: meta.clientId,
+    accessToken: b['access_token'],
+    ...(typeof b['refresh_token'] === 'string' ? {
+      refreshToken: b['refresh_token']
+    } : {}),
+    expiresAt: Date.now() + b['expires_in'] * 1000,
+    scopes,
+    tokenEndpoint: meta.tokenEndpoint,
+    ...(meta.revocationEndpoint ? {
+      revocationEndpoint: meta.revocationEndpoint
+    } : {})
+  };
+}
+function same(a, b) {
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && require$$0.timingSafeEqual(x, y);
+}
+async function beginOAuthLogin(options) {
+  const controller = new AbortController();
+  const abort = () => controller.abort(options.signal?.reason);
+  if (options.signal?.aborted) {
+    abort();
+  }
+  options.signal?.addEventListener('abort', abort, {
+    once: true
+  });
+  const timeout = setTimeout(() => controller.abort(error('Sign-in timed out. Run `socket login` to try again.')), FLOW_TIMEOUT);
+  const signal = controller.signal;
+  let server;
+  try {
+    const meta = await discover({
+      signal,
+      apiProxy: options.apiProxy
+    });
+    const state = random();
+    const verifier = random(48);
+    const challenge = require$$0.createHash('sha256').update(verifier).digest('base64url');
+    let resolveCode;
+    let rejectCode;
+    let settled = false;
+    const codePromise = new Promise((resolve, reject) => {
+      resolveCode = resolve;
+      rejectCode = reject;
+    });
+    // Attach a rejection observer immediately: an OAuth error callback can arrive while DCR is pending.
+    void codePromise.catch(() => {});
+    server = require$$12.createServer((req, res) => {
+      let u;
+      try {
+        u = new URL(req.url ?? '/', 'http://127.0.0.1');
+      } catch {
+        res.writeHead(400).end('Invalid callback request.');
+        return;
+      }
+      if (req.method !== 'GET' || u.pathname !== '/oauth/callback') {
+        res.writeHead(404).end();
+        return;
+      }
+      if (settled) {
+        res.writeHead(410).end();
+        return;
+      }
+      if (!same(u.searchParams.get('state') ?? '', state)) {
+        res.writeHead(400).end('Sign-in state did not match.');
+        return;
+      }
+      if (u.searchParams.has('error') || !u.searchParams.get('code')) {
+        settled = true;
+        res.writeHead(400).end('Sign-in was not completed.');
+        rejectCode(error('Authorization was declined.'));
+        return;
+      }
+      settled = true;
+      res.writeHead(200, {
+        'content-type': 'text/html; charset=utf-8',
+        'cache-control': 'no-store'
+      }).end('<!doctype html><title>Socket CLI</title><p>Sign-in complete. Return to your terminal.</p>');
+      resolveCode(u.searchParams.get('code'));
+    });
+    signal.addEventListener('abort', () => {
+      if (!settled) {
+        settled = true;
+        rejectCode(oauthCancellationError(signal));
+      }
+    }, {
+      once: true
+    });
+    if (signal.aborted && !settled) {
+      settled = true;
+      rejectCode(oauthCancellationError(signal));
+    }
+    const redirectUri = await new Promise((resolve, reject) => {
+      server.once('error', () => reject(error('Could not start the local callback listener.')));
+      server.listen(0, '127.0.0.1', () => {
+        const a = server.address();
+        if (!a || typeof a === 'string') {
+          reject(error('Could not start the local callback listener.'));
+        } else {
+          resolve(`http://127.0.0.1:${a.port}/oauth/callback`);
+        }
+      });
+    });
+    const registration = await http(meta.register, {
+      method: 'POST',
+      signal,
+      proxy: options.apiProxy,
+      headers: {
+        'content-type': 'application/json'
+      },
+      body: JSON.stringify({
+        client_name: 'Socket CLI',
+        redirect_uris: [redirectUri],
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: 'none'
+      })
+    });
+    const reg = registration.body;
+    if (registration.status < 200 || registration.status >= 300 || !objects.isObjectObject(reg) || typeof reg['client_id'] !== 'string' || !reg['client_id'].trim() || reg['token_endpoint_auth_method'] !== undefined && reg['token_endpoint_auth_method'] !== 'none' || reg['redirect_uris'] !== undefined && (!Array.isArray(reg['redirect_uris']) || !reg['redirect_uris'].some(value => value === redirectUri)) || reg['grant_types'] !== undefined && (!Array.isArray(reg['grant_types']) || !['authorization_code', 'refresh_token'].every(grant => reg['grant_types'].some(value => value === grant))) || reg['response_types'] !== undefined && (!Array.isArray(reg['response_types']) || !reg['response_types'].some(value => value === 'code'))) {
+      throw error('The OAuth client could not be registered.');
+    }
+    const clientId = reg['client_id'];
+    const url = new URL(meta.authorize);
+    url.search = form({
+      response_type: 'code',
+      client_id: clientId,
+      redirect_uri: redirectUri,
+      scope: REQUIRED_SCOPES.join(' '),
+      state,
+      code_challenge: challenge,
+      code_challenge_method: 'S256',
+      resource: OAUTH_RESOURCE
+    });
+    options.onAuthorizationUrl(url.href);
+    if (options.openBrowser !== false) {
+      try {
+        await vendor.open(url.href);
+      } catch {
+        /* URL was printed; manual browser completion remains available. */
+      }
+    }
+    const code = await codePromise;
+    const token = await http(meta.token, {
+      method: 'POST',
+      signal,
+      proxy: options.apiProxy,
+      headers: {
+        'content-type': 'application/x-www-form-urlencoded'
+      },
+      body: form({
+        grant_type: 'authorization_code',
+        code,
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        code_verifier: verifier,
+        resource: OAUTH_RESOURCE
+      })
+    });
+    return parseToken(token, REQUIRED_SCOPES, {
+      clientId,
+      tokenEndpoint: meta.token,
+      ...(meta.revoke ? {
+        revocationEndpoint: meta.revoke
+      } : {})
+    });
+  } finally {
+    clearTimeout(timeout);
+    options.signal?.removeEventListener('abort', abort);
+    server?.close();
+    server?.closeAllConnections();
+  }
+}
+const filePath = dir => path.join(dir, FILE);
+function validCredentials(value) {
+  if (!objects.isObjectObject(value) || value['version'] !== 1 || value['issuer'] !== OAUTH_ISSUER || value['resource'] !== OAUTH_RESOURCE || value['apiOrigin'] !== OAUTH_ISSUER || typeof value['clientId'] !== 'string' || !value['clientId'] || typeof value['accessToken'] !== 'string' || !value['accessToken'] || typeof value['expiresAt'] !== 'number' || !Number.isFinite(value['expiresAt']) || value['expiresAt'] <= 0 || !Array.isArray(value['scopes']) || value['scopes'].some(s => typeof s !== 'string' || !REQUIRED_SCOPES.includes(s)) || value['refreshToken'] !== undefined && (typeof value['refreshToken'] !== 'string' || !value['refreshToken'])) {
+    return false;
+  }
+  try {
+    trustedEndpoint(value['tokenEndpoint']);
+    if (value['revocationEndpoint'] !== undefined) {
+      trustedEndpoint(value['revocationEndpoint']);
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readOAuthCredentials(directory) {
+  try {
+    const x = JSON.parse(u.readFileSync(filePath(directory), 'utf8'));
+    if (!validCredentials(x)) {
+      throw error('Saved OAuth credentials are invalid. Run `socket login` again.');
+    }
+    return x;
+  } catch (e) {
+    if (e.code === 'ENOENT') {
+      return undefined;
+    }
+    if (e instanceof SyntaxError) {
+      throw error('Saved OAuth credentials are corrupt. Run `socket login` again.');
+    }
+    throw e;
+  }
+}
+async function locked(directory, action, signal) {
+  if (signal?.aborted) {
+    throw oauthCancellationError(signal);
+  }
+  await u.promises.mkdir(directory, {
+    recursive: true,
+    mode: 0o700
+  });
+  const lock = `${filePath(directory)}.lock`;
+  const until = Date.now() + LOCK_TIMEOUT;
+  while (true) {
+    try {
+      // This await performs the inter-process mutex acquisition.
+      // eslint-disable-next-line no-await-in-loop
+      await u.promises.mkdir(lock, {
+        mode: 0o700
+      });
+      break;
+    } catch (e) {
+      if (e.code !== 'EEXIST') {
+        throw e;
+      }
+      if (Date.now() >= until) {
+        throw error(`Could not acquire sign-in lock ${lock}. After confirming no other Socket CLI process is running, remove this lock directory and retry.`);
+      }
+      if (signal?.aborted) {
+        throw oauthCancellationError(signal);
+      }
+      // eslint-disable-next-line no-await-in-loop
+      await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+          signal?.removeEventListener('abort', onAbort);
+          resolve();
+        }, 100);
+        const onAbort = () => {
+          clearTimeout(timer);
+          reject(oauthCancellationError(signal));
+        };
+        signal?.addEventListener('abort', onAbort, {
+          once: true
+        });
+        if (signal?.aborted) {
+          onAbort();
+        }
+      });
+    }
+  }
+  try {
+    return await action();
+  } finally {
+    await u.promises.rm(lock, {
+      recursive: true,
+      force: true
+    });
+  }
+}
+async function writeAtomic(directory, credentials) {
+  await u.promises.chmod(directory, 0o700).catch(() => {});
+  const target = filePath(directory);
+  const tmp = `${target}.${process.pid}.${random(6)}.tmp`;
+  try {
+    await u.promises.writeFile(tmp, `${JSON.stringify(credentials, null, 2)}\n`, {
+      mode: 0o600,
+      flag: 'wx'
+    });
+    await u.promises.chmod(tmp, 0o600);
+    await u.promises.rename(tmp, target);
+  } finally {
+    await u.promises.rm(tmp, {
+      force: true
+    }).catch(() => {});
+  }
+}
+async function saveOAuthCredentials(directory, credentials) {
+  if (!validCredentials(credentials)) {
+    throw error('Refusing to save invalid OAuth credentials.');
+  }
+  await locked(directory, () => writeAtomic(directory, credentials));
+}
+async function resolveOAuthAccessToken(directory, options = {}) {
+  if (options.signal?.aborted) {
+    throw oauthCancellationError(options.signal);
+  }
+  const current = readOAuthCredentials(directory);
+  if (!current) {
+    return undefined;
+  }
+  if (current.expiresAt > Date.now() + 30_000) {
+    return current.accessToken;
+  }
+  return await locked(directory, async () => {
+    if (options.signal?.aborted) {
+      throw oauthCancellationError(options.signal);
+    }
+    const latest = readOAuthCredentials(directory);
+    if (!latest) {
+      throw error('The saved session was removed. Run `socket login` again.');
+    }
+    if (latest.expiresAt > Date.now() + 30_000) {
+      return latest.accessToken;
+    }
+    if (!latest.refreshToken) {
+      throw error('The saved session expired. Run `socket login` again.');
+    }
+    if (options.signal?.aborted) {
+      throw oauthCancellationError(options.signal);
+    }
+    // Durably discard the rotating token before sending it. A timeout/crash can
+    // never cause another process to replay a token the server may have used.
+    const refreshToken = latest.refreshToken;
+    await writeAtomic(directory, {
+      ...latest,
+      refreshToken: undefined
+    });
+    const result = await http(latest.tokenEndpoint, {
+      method: 'POST',
+      signal: options.signal,
+      proxy: options.apiProxy,
+      timeoutMs: options.requestTimeoutMs,
+      headers: {
+        'content-type': 'application/x-www-form-urlencoded'
+      },
+      body: form({
+        grant_type: 'refresh_token',
+        client_id: latest.clientId,
+        refresh_token: refreshToken,
+        resource: OAUTH_RESOURCE
+      })
+    });
+    const fresh = parseToken(result, latest.scopes, {
+      clientId: latest.clientId,
+      tokenEndpoint: latest.tokenEndpoint,
+      ...(latest.revocationEndpoint ? {
+        revocationEndpoint: latest.revocationEndpoint
+      } : {})
+    });
+    await writeAtomic(directory, fresh);
+    return fresh.accessToken;
+  }, options.signal);
+}
+async function logoutOAuth(directory, options = {}) {
+  return await locked(directory, async () => {
+    let creds;
+    let warning;
+    try {
+      creds = readOAuthCredentials(directory);
+    } catch {
+      warning = 'Saved credentials were invalid; local sign-in data was removed.';
+    }
+    let revoked = false;
+    if (creds) {
+      if (!creds.revocationEndpoint) {
+        warning = 'Remote session revocation was not confirmed.';
+      } else {
+        try {
+          const token = creds.refreshToken ?? creds.accessToken;
+          const hint = creds.refreshToken ? 'refresh_token' : 'access_token';
+          const r = await http(creds.revocationEndpoint, {
+            method: 'POST',
+            signal: options.signal,
+            proxy: options.apiProxy,
+            allowEmpty: true,
+            headers: {
+              'content-type': 'application/x-www-form-urlencoded'
+            },
+            body: form({
+              client_id: creds.clientId,
+              token,
+              token_type_hint: hint
+            })
+          });
+          revoked = r.status >= 200 && r.status < 300;
+          if (!revoked) {
+            warning = 'Remote session revocation was not confirmed.';
+          }
+        } catch {
+          warning = 'Remote session revocation was not confirmed.';
+        }
+      }
+    }
+    await u.promises.rm(filePath(directory), {
+      force: true
+    });
+    return {
+      revoked,
+      ...(warning ? {
+        warning
+      } : {})
+    };
+  });
+}
+
 /**
  * Telemetry service for Socket CLI.
  * Manages event collection, batching, and submission to Socket API.
@@ -1879,76 +2483,117 @@ function getDefaultProxyUrl() {
   const apiProxy = constants.default.ENV.SOCKET_CLI_API_PROXY || getConfigValueOrUndef(constants.CONFIG_KEY_API_PROXY);
   return url.isUrl(apiProxy) ? apiProxy : undefined;
 }
-
-// Cached extra CA certificates for SSL_CERT_FILE support.
-let _extraCaCerts;
-let _extraCaCertsResolved = false;
-
-// Returns combined root and extra CA certificates when SSL_CERT_FILE is set
-// but NODE_EXTRA_CA_CERTS is not. Node.js loads NODE_EXTRA_CA_CERTS at process
-// startup, so setting SSL_CERT_FILE alone does not affect the current process.
-// This function reads the certificate file manually and combines it with the
-// default root certificates for use in HTTPS agents.
-function getExtraCaCerts() {
-  if (_extraCaCertsResolved) {
-    return _extraCaCerts;
-  }
-  _extraCaCertsResolved = true;
-  // Node.js already loaded extra CA certs at startup.
-  if (process.env['NODE_EXTRA_CA_CERTS']) {
+function getDefaultApiToken() {
+  if (constants.default.ENV.SOCKET_CLI_NO_API_TOKEN) {
     return undefined;
   }
-  // Check for SSL_CERT_FILE fallback via constants.
-  const certPath = constants.default.ENV.NODE_EXTRA_CA_CERTS;
-  if (!certPath) {
-    return undefined;
+  const environmentToken = constants.default.ENV.SOCKET_CLI_API_TOKEN;
+  if (strings.isNonEmptyString(environmentToken)) {
+    return environmentToken;
   }
-  try {
-    const extraCerts = u.readFileSync(certPath, 'utf-8');
-    // Combine default root certificates with extra certificates. Specifying ca
-    // in an agent replaces the default trust store, so both must be included.
-    _extraCaCerts = [...node_tls.rootCertificates, extraCerts];
-    return _extraCaCerts;
-  } catch (e) {
-    debug$2.debugFn('warn', `Failed to read certificate file: ${certPath}`, e);
+  if (getConfigValueOrUndef(constants.CONFIG_KEY_AUTH_TYPE) === 'oauth') {
     return undefined;
   }
+  const key = getConfigValueOrUndef(constants.CONFIG_KEY_API_TOKEN);
+  return strings.isNonEmptyString(key) ? key : undefined;
 }
 
-// This Socket API token should be stored globally for the duration of the CLI execution.
-let _defaultToken;
-function getDefaultApiToken() {
-  if (constants.default.ENV.SOCKET_CLI_NO_API_TOKEN) {
-    _defaultToken = undefined;
-    return _defaultToken;
-  }
-  const key = constants.default.ENV.SOCKET_CLI_API_TOKEN || getConfigValueOrUndef(constants.CONFIG_KEY_API_TOKEN) || _defaultToken;
-  _defaultToken = strings.isNonEmptyString(key) ? key : undefined;
-  return _defaultToken;
+/** Whether saved OAuth auth is active instead of a flag or explicit token. */
+function isOAuthLoginActive() {
+  return !isConfigFromFlag() && !constants.default.ENV.SOCKET_CLI_NO_API_TOKEN && !constants.default.ENV.SOCKET_CLI_API_TOKEN && getConfigValueOrUndef(constants.CONFIG_KEY_AUTH_TYPE) === 'oauth';
 }
-function getPublicApiToken() {
-  return getDefaultApiToken() || constants.default.ENV.SOCKET_CLI_API_TOKEN || constants.default.SOCKET_PUBLIC_API_TOKEN;
+async function resolvePublicApiToken(options) {
+  const token = await resolveDefaultApiToken(options);
+  if (token) {
+    return token;
+  }
+  if (!constants.default.ENV.SOCKET_CLI_NO_API_TOKEN && getConfigValueOrUndef(constants.CONFIG_KEY_AUTH_TYPE) === 'oauth') {
+    throw new Error('Browser sign-in has no usable access token. Run `socket login` to sign in again.');
+  }
+  return constants.default.SOCKET_PUBLIC_API_TOKEN;
 }
 function getVisibleTokenPrefix() {
+  if (!constants.default.ENV.SOCKET_CLI_NO_API_TOKEN && getConfigValueOrUndef(constants.CONFIG_KEY_AUTH_TYPE) === 'oauth' && !constants.default.ENV.SOCKET_CLI_API_TOKEN) {
+    return 'oauth';
+  }
   const apiToken = getDefaultApiToken();
   return apiToken ? apiToken.slice(TOKEN_PREFIX_LENGTH, TOKEN_PREFIX_LENGTH + TOKEN_VISIBLE_LENGTH) : '';
 }
 function hasDefaultApiToken() {
-  return !!getDefaultApiToken();
+  if (getDefaultApiToken()) {
+    return true;
+  }
+  const directory = constants.default.socketAppDataPath;
+  return Boolean(isOAuthLoginActive() && directory && hasOAuthCredentialFile(directory));
+}
+function hasOAuthCredentialFile(directory) {
+  try {
+    return Boolean(readOAuthCredentials(directory));
+  } catch {
+    // Keep preflight from crashing; async token resolution reports a useful
+    // error and must not fall back to another credential.
+    return true;
+  }
+}
+async function resolveDefaultApiToken(options) {
+  if (constants.default.ENV.SOCKET_CLI_NO_API_TOKEN) {
+    return undefined;
+  }
+  const environmentToken = constants.default.ENV.SOCKET_CLI_API_TOKEN;
+  if (strings.isNonEmptyString(environmentToken)) {
+    return environmentToken;
+  }
+  if (getConfigValueOrUndef(constants.CONFIG_KEY_AUTH_TYPE) !== 'oauth') {
+    const configured = getConfigValueOrUndef(constants.CONFIG_KEY_API_TOKEN);
+    return strings.isNonEmptyString(configured) ? configured : undefined;
+  }
+
+  // Explicit config is read-only and must never consult persisted OAuth state.
+  if (isConfigFromFlag()) {
+    return undefined;
+  }
+  const directory = constants.default.socketAppDataPath;
+  if (!directory) {
+    throw new Error('OAuth credentials are unavailable in this environment. Run `socket login` in a supported user session.');
+  }
+  const credentials = readOAuthCredentials(directory);
+  if (!credentials) {
+    throw new Error('Browser sign-in is selected but its credentials are missing or invalid. Run `socket login` to sign in again.');
+  }
+  const apiBaseUrl = options?.apiBaseUrl ?? getDefaultApiBaseUrl$1();
+  if (apiBaseUrl) {
+    let origin;
+    try {
+      origin = new URL(apiBaseUrl).origin;
+    } catch {
+      throw new Error('The configured Socket API URL is invalid for OAuth.');
+    }
+    if (origin !== credentials.apiOrigin) {
+      throw new Error('Browser sign-in can only be used with Socket’s trusted API origin. Use `socket login --api-token` for a custom API URL.');
+    }
+  }
+  return await resolveOAuthAccessToken(directory, {
+    apiProxy: options?.apiProxy ?? getDefaultProxyUrl(),
+    signal: options?.signal
+  });
 }
 async function setupSdk(options) {
   const opts = {
     __proto__: null,
     ...options
   };
-  let {
-    apiToken = getDefaultApiToken()
-  } = opts;
-  if (typeof apiToken !== 'string' && vendor.isInteractiveExports()) {
-    apiToken = await prompts.password({
-      message: 'Enter your Socket.dev API token (not saved, use socket login to persist)'
-    });
-    _defaultToken = apiToken;
+  let apiToken;
+  try {
+    apiToken = opts.apiToken ?? (await resolveDefaultApiToken({
+      apiBaseUrl: opts.apiBaseUrl,
+      apiProxy: opts.apiProxy
+    }));
+  } catch (error) {
+    return {
+      ok: false,
+      message: 'Auth Error',
+      cause: getErrorCause(error)
+    };
   }
   if (!apiToken) {
     return {
@@ -2095,6 +2740,18 @@ async function setupSdk(options) {
 
 const MAX_REDIRECTS = 20;
 const NO_ERROR_MESSAGE = 'No error message returned';
+function getApiErrorText(value) {
+  if (typeof value === 'string') {
+    return value;
+  }
+  if (!value || typeof value !== 'object') {
+    return '';
+  }
+  const record = value;
+  const details = record['details'];
+  const nestedCode = details && typeof details === 'object' ? details['code'] : undefined;
+  return [record['code'], nestedCode, record['message'], record['error']].filter(part => typeof part === 'string').join(' ');
+}
 
 // Cached HTTPS agent for direct API calls. Undefined only until the first
 // getHttpsAgent() call lazily creates it.
@@ -2243,14 +2900,18 @@ function _httpsRequestFetch(url, init, agent, redirectCount) {
  * API gives in its `{ error: { message } }` body when there is one.
  */
 async function describeApiFailure(response, path) {
-  let serverMessage;
+  let serverMessage = '';
+  let serverCode = '';
   try {
-    serverMessage = JSON.parse(await response.text())?.error?.message;
+    const payload = JSON.parse(await response.text());
+    const serverError = payload?.error;
+    serverMessage = getApiErrorText(serverError);
+    serverCode = [payload?.code, serverError?.code, serverError?.details?.code].filter(part => typeof part === 'string').join(' ');
   } catch {
     // A body that isn't JSON carries no message.
   }
-  const reason = await getErrorMessageForHttpStatusCode(response.status);
-  return typeof serverMessage === 'string' && serverMessage ? `${response.statusText}: ${serverMessage} (reason: ${reason}) (path: ${path})` : `${response.statusText} (reason: ${reason}) (path: ${path})`;
+  const reason = await getErrorMessageForHttpStatusCode(response.status, [serverCode, serverMessage].filter(Boolean).join(' '));
+  return serverMessage ? `${response.statusText}: ${serverMessage} (reason: ${reason}) (path: ${path})` : `${response.statusText} (reason: ${reason}) (path: ${path})`;
 }
 async function apiFetch(url, init = {}) {
   return await _httpsRequestFetch(url, init, getHttpsAgent(), 0);
@@ -2270,7 +2931,13 @@ function getCommandRequirements(cmdPath) {
 /**
  * Log required permissions for a command when encountering 403 errors.
  */
-function logPermissionsFor403(cmdPath) {
+function logPermissionsFor403(cmdPath, apiError) {
+  if (isOAuthLoginActive()) {
+    const guidance = getOAuth403Guidance(apiError);
+    if (guidance) {
+      logger.logger.error(guidance);
+    }
+  }
   const requirements = getCommandRequirements(cmdPath);
   if (!requirements?.permissions?.length) {
     return;
@@ -2279,7 +2946,9 @@ function logPermissionsFor403(cmdPath) {
   for (const permission of requirements.permissions) {
     logger.logger.error(`  - ${permission}`);
   }
-  logger.logger.error('Please ensure your API token has the required permissions.');
+  if (!isOAuthLoginActive()) {
+    logger.logger.error('Please ensure your API token has the required permissions.');
+  }
 }
 
 // The Socket API server that should be used for operations.
@@ -2295,7 +2964,16 @@ function getDefaultApiBaseUrl() {
 /**
  * Get user-friendly error message for HTTP status codes.
  */
-async function getErrorMessageForHttpStatusCode(code) {
+function getOAuth403Guidance(apiError) {
+  if (/missing[_ -]capability/i.test(apiError ?? '')) {
+    return 'This organization does not grant the capability required for this command. Ask an organization admin to enable it.';
+  }
+  if (/missing[_ -]scope/i.test(apiError ?? '')) {
+    return 'Browser sign-in is read-only. Use `socket login --api-token` or SOCKET_CLI_API_TOKEN for scans and write operations.';
+  }
+  return undefined;
+}
+async function getErrorMessageForHttpStatusCode(code, apiError) {
   if (code === constants.HTTP_STATUS_BAD_REQUEST) {
     return 'One of the options passed might be incorrect';
   }
@@ -2303,6 +2981,13 @@ async function getErrorMessageForHttpStatusCode(code) {
     return 'Your Socket API token appears to be invalid, expired, or revoked. Please verify your token is correct and active';
   }
   if (code === constants.HTTP_STATUS_FORBIDDEN) {
+    if (isOAuthLoginActive()) {
+      const guidance = getOAuth403Guidance(apiError);
+      if (guidance) {
+        return guidance;
+      }
+      return 'Browser sign-in is read-only and does not support this operation. Use `socket login --api-token` or SOCKET_CLI_API_TOKEN';
+    }
     return 'Your Socket API token may not have the required permissions for this command or you might be trying to access (data from) an organization that is not linked to the API token you are logged in with';
   }
   if (code === constants.HTTP_STATUS_NOT_FOUND) {
@@ -2395,15 +3080,16 @@ async function handleApiCall(value, options) {
     debug$2.debugDir('inspect', {
       sdkResult
     });
-    const errStr = sdkResult.error ? String(sdkResult.error).trim() : '';
+    const errStr = getApiErrorText(sdkResult.error);
     const message = errStr || NO_ERROR_MESSAGE;
-    const reason = sdkResult.cause || NO_ERROR_MESSAGE;
+    const reason = getApiErrorText(sdkResult.cause) || NO_ERROR_MESSAGE;
+    const statusReason = sdkResult.status === constants.HTTP_STATUS_FORBIDDEN && isOAuthLoginActive() ? await getErrorMessageForHttpStatusCode(sdkResult.status, `${errStr} ${reason}`) : undefined;
     const baseCause = reason && message !== reason ? `${message} (reason: ${reason})` : message;
     const cause = sdkResult.url ? `${baseCause} (url: ${sdkResult.url})` : baseCause;
     const socketSdkErrorResult = {
       ok: false,
       message: 'Socket API error',
-      cause,
+      cause: statusReason ? `${cause} (reason: ${statusReason})` : cause,
       data: {
         code: sdkResult.status
       }
@@ -2411,7 +3097,7 @@ async function handleApiCall(value, options) {
 
     // Log required permissions for 403 errors when in a command context.
     if (commandPath && sdkResult.status === 403) {
-      logPermissionsFor403(commandPath);
+      logPermissionsFor403(commandPath, `${errStr} ${reason}`);
     }
     return socketSdkErrorResult;
   }
@@ -2424,56 +3110,6 @@ async function handleApiCall(value, options) {
   };
   return socketSdkSuccessResult;
 }
-async function handleApiCallNoSpinner(value, description) {
-  let sdkResult;
-  try {
-    sdkResult = await value;
-  } catch (e) {
-    debug$2.debugFn('error', `API request failed: ${description}`);
-    debug$2.debugDir('error', e);
-    const errStr = e ? String(e).trim() : '';
-    const message = 'Socket API error';
-    const rawCause = errStr || NO_ERROR_MESSAGE;
-    const cause = message !== rawCause ? rawCause : '';
-    return {
-      ok: false,
-      message,
-      ...(cause ? {
-        cause
-      } : {})
-    };
-  }
-
-  // The `success` discriminant is a concrete boolean literal in both branches,
-  // so this narrows the result to its error branch regardless of `R`.
-  if (sdkResult.success === false) {
-    debug$2.debugFn('error', `fail: ${description} bad response`);
-    debug$2.debugDir('inspect', {
-      sdkResult
-    });
-    const errStr = sdkResult.error ? String(sdkResult.error).trim() : '';
-    const message = errStr || NO_ERROR_MESSAGE;
-    const reason = sdkResult.cause || NO_ERROR_MESSAGE;
-    const baseCause = reason && message !== reason ? `${message} (reason: ${reason})` : message;
-    const cause = sdkResult.url ? `${baseCause} (url: ${sdkResult.url})` : baseCause;
-    return {
-      ok: false,
-      message: 'Socket API error',
-      cause,
-      data: {
-        code: sdkResult.status
-      }
-    };
-  } else {
-    // Narrowing a type parameter by its `success` discriminant resolves `.data`
-    // through the constraint's success branch (`unknown`); re-apply the precise
-    // per-call success type the return contract already guarantees.
-    return {
-      ok: true,
-      data: sdkResult.data
-    };
-  }
-}
 async function queryApi(path, apiToken) {
   const baseUrl = getDefaultApiBaseUrl();
   const url = `${baseUrl}${baseUrl.endsWith('/') ? '' : '/'}${path}`;
@@ -2493,12 +3129,23 @@ async function queryApi(path, apiToken) {
  * status-dependent flows such as the cached-scan 202 poll loop.
  */
 async function queryApiSafeTextWithStatus(path, description, commandPath) {
-  const apiToken = getDefaultApiToken();
+  let apiToken;
+  try {
+    apiToken = await resolveDefaultApiToken({
+      apiBaseUrl: getDefaultApiBaseUrl()
+    });
+  } catch (error) {
+    return {
+      ok: false,
+      message: 'Authentication Error',
+      cause: getErrorCause(error)
+    };
+  }
   if (!apiToken) {
     return {
       ok: false,
       message: 'Authentication Error',
-      cause: 'User must be authenticated to run this command. Run `socket login` and enter your Socket API token.'
+      cause: 'User must be authenticated to run this command. Run `socket login` or set SOCKET_CLI_API_TOKEN.'
     };
   }
   const {
@@ -2605,15 +3252,26 @@ async function queryApiSafeJson(path, description = '') {
  * Send POST/PUT request to Socket API with JSON response handling.
  */
 async function sendApiRequest(path, options) {
-  const apiToken = getDefaultApiToken();
+  const baseUrl = getDefaultApiBaseUrl();
+  let apiToken;
+  try {
+    apiToken = await resolveDefaultApiToken({
+      apiBaseUrl: baseUrl
+    });
+  } catch (error) {
+    return {
+      ok: false,
+      message: 'Authentication Error',
+      cause: getErrorCause(error)
+    };
+  }
   if (!apiToken) {
     return {
       ok: false,
       message: 'Authentication Error',
-      cause: 'User must be authenticated to run this command. To log in, run the command `socket login` and enter your Socket API token.'
+      cause: 'User must be authenticated to run this command. Run `socket login` or set SOCKET_CLI_API_TOKEN.'
     };
   }
-  const baseUrl = getDefaultApiBaseUrl();
   const {
     body,
     commandPath,
@@ -5472,7 +6130,16 @@ async function spawnCoana(args, orgSlug, options) {
     // outbound axios User-Agent header.
     SOCKET_CALLER_USER_AGENT: getCliUserAgent()
   };
-  const defaultApiToken = getDefaultApiToken();
+  let defaultApiToken;
+  try {
+    defaultApiToken = await resolveDefaultApiToken();
+  } catch (error) {
+    return {
+      ok: false,
+      message: 'Socket authentication failed',
+      cause: error instanceof Error ? error.message : String(error)
+    };
+  }
   if (defaultApiToken) {
     mixinsEnv['SOCKET_CLI_API_TOKEN'] = defaultApiToken;
   }
@@ -6653,6 +7320,14 @@ function isHelpFlag(cmdArg) {
   return helpFlags.has(cmdArg);
 }
 
+/**
+ * Check if npm command requires lockfile scanning.
+ * npm uses: install, i, update
+ */
+function isNpmLockfileScanCommand(command) {
+  return command === 'install' || command === 'i' || command === 'ci' || command === 'update';
+}
+
 /**
  * Check if pnpm command requires lockfile scanning.
  * pnpm uses: install, i, update, up
@@ -6726,10 +7401,10 @@ function parseReachEcosystems(raw) {
  * within an ecosystem (e.g. only PNPM artifacts in a mixed pnpm/yarn/npm repo).
  *
  * Mirrors the list returned by Coana's `getFilterablePackageManagers()` in
- * packages/web-compat-utils/src/package-manager-utils.ts.
+ * packages/utils/src/package-manager-utils.ts.
  */
 
-const ALL_PACKAGE_MANAGERS = ['CARGO', 'COMPOSER', 'GO', 'GRADLE', 'MAVEN', 'NPM', 'NUGET', 'PIPENV', 'PIP_REQUIREMENTS', 'PNPM', 'POETRY', 'RUBYGEMS', 'RUSH', 'SBT', 'YARN'];
+const ALL_PACKAGE_MANAGERS = ['CARGO', 'COMPOSER', 'GO', 'GRADLE', 'MAVEN', 'NPM', 'NUGET', 'PIPENV', 'PIP_REQUIREMENTS', 'PNPM', 'POETRY', 'RUBYGEMS', 'RUSH', 'SBT', 'UV', 'YARN'];
 const ALL_PACKAGE_MANAGERS_SET = new Set(ALL_PACKAGE_MANAGERS);
 function isValidPackageManager(value) {
   return ALL_PACKAGE_MANAGERS_SET.has(value);
@@ -7185,10 +7860,10 @@ function shadowNpmInstall(options) {
   const useDebug = debug$2.isDebug('stdio');
   const terminatorPos = args.indexOf('--');
   const rawBinArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos);
-  const binArgs = rawBinArgs.filter(a => !agent.isNpmAuditFlag(a) && !agent.isNpmFundFlag(a) && !agent.isNpmProgressFlag(a));
+  const binArgs = rawBinArgs.filter(a => !agent$1.isNpmAuditFlag(a) && !agent$1.isNpmFundFlag(a) && !agent$1.isNpmProgressFlag(a));
   const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos);
-  const progressArg = rawBinArgs.findLast(agent.isNpmProgressFlag) !== '--no-progress';
-  const isSilent = !useDebug && !binArgs.some(agent.isNpmLoglevelFlag);
+  const progressArg = rawBinArgs.findLast(agent$1.isNpmProgressFlag) !== '--no-progress';
+  const isSilent = !useDebug && !binArgs.some(agent$1.isNpmLoglevelFlag);
   const logLevelArgs = isSilent ? [constants.FLAG_LOGLEVEL, 'silent'] : [];
   const useIpc = objects.isObject(ipc);
 
@@ -7205,7 +7880,7 @@ function shadowNpmInstall(options) {
   } else {
     stdio = useIpc ? ['pipe', 'pipe', 'pipe', 'ipc'] : 'pipe';
   }
-  const spawnPromise = spawn.spawn(constants.default.execPath, [...constants.default.nodeNoWarningsFlags, ...constants.default.nodeDebugFlags, ...constants.default.nodeHardenFlags, ...constants.default.nodeMemoryFlags, ...(constants.default.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD ? ['--require', constants.default.instrumentWithSentryPath] : []), '--require', constants.default.shadowNpmInjectPath, agent.resolveBinPathSync(agentExecPath), 'install',
+  const spawnPromise = spawn.spawn(constants.default.execPath, [...constants.default.nodeNoWarningsFlags, ...constants.default.nodeDebugFlags, ...constants.default.nodeHardenFlags, ...constants.default.nodeMemoryFlags, ...(constants.default.ENV.INLINED_SOCKET_CLI_SENTRY_BUILD ? ['--require', constants.default.instrumentWithSentryPath] : []), '--require', constants.default.shadowNpmInjectPath, agent$1.resolveBinPathSync(agentExecPath), 'install',
   // Avoid code paths for 'audit' and 'fund'.
   '--no-audit', '--no-fund',
   // Add '--no-progress' to fix input being swallowed by the npm spinner.
@@ -9104,8 +9779,10 @@ exports.CVE_FORMAT_REGEXP = CVE_FORMAT_REGEXP;
 exports.GHSA_FORMAT_REGEXP = GHSA_FORMAT_REGEXP;
 exports.IGNORED_DIRS = IGNORED_DIRS;
 exports.InputError = InputError;
+exports.OAUTH_ISSUER = OAUTH_ISSUER;
 exports.RangeStyles = RangeStyles;
 exports.apiFetch = apiFetch;
+exports.beginOAuthLogin = beginOAuthLogin;
 exports.cacheFetch = cacheFetch;
 exports.camelToKebab = camelToKebab;
 exports.captureException = captureException;
@@ -9141,7 +9818,9 @@ exports.getBaseBranch = getBaseBranch;
 exports.getBashrcDetails = getBashrcDetails;
 exports.getConfigValue = getConfigValue;
 exports.getConfigValueOrUndef = getConfigValueOrUndef;
+exports.getDefaultApiBaseUrl = getDefaultApiBaseUrl$1;
 exports.getDefaultOrgSlug = getDefaultOrgSlug;
+exports.getDefaultProxyUrl = getDefaultProxyUrl;
 exports.getEcosystemChoicesForMeow = getEcosystemChoicesForMeow;
 exports.getEnterpriseOrgs = getEnterpriseOrgs;
 exports.getErrorCause = getErrorCause;
@@ -9160,7 +9839,6 @@ exports.getOrInsert = getOrInsert;
 exports.getOrgSlugs = getOrgSlugs;
 exports.getOutputKind = getOutputKind;
 exports.getPackageFilesForScan = getPackageFilesForScan;
-exports.getPublicApiToken = getPublicApiToken;
 exports.getReachabilityEcosystemChoices = getReachabilityEcosystemChoices;
 exports.getRepoInfo = getRepoInfo;
 exports.getRepoName = getRepoName;
@@ -9184,7 +9862,6 @@ exports.githubApiRequest = githubApiRequest;
 exports.globWithGitIgnore = globWithGitIgnore;
 exports.globWorkspace = globWorkspace;
 exports.handleApiCall = handleApiCall;
-exports.handleApiCallNoSpinner = handleApiCallNoSpinner;
 exports.hasDefaultApiToken = hasDefaultApiToken;
 exports.hasEnterpriseOrgPlan = hasEnterpriseOrgPlan;
 exports.idToNpmPurl = idToNpmPurl;
@@ -9198,6 +9875,7 @@ exports.isErrnoException = isErrnoException;
 exports.isFactsOnlyTypes = isFactsOnlyTypes;
 exports.isGitHubBlockingError = isGitHubBlockingError;
 exports.isHelpFlag = isHelpFlag;
+exports.isNpmLockfileScanCommand = isNpmLockfileScanCommand;
 exports.isPnpmLockfileScanCommand = isPnpmLockfileScanCommand;
 exports.isReachabilityReportPath = isReachabilityReportPath;
 exports.isReportSupportedFile = isReportSupportedFile;
@@ -9208,6 +9886,7 @@ exports.isValidPackageManager = isValidPackageManager;
 exports.isYarnBerry = isYarnBerry;
 exports.loadSocketConfig = loadSocketConfig;
 exports.logAlertsMap = logAlertsMap;
+exports.logoutOAuth = logoutOAuth;
 exports.mailtoLink = mailtoLink;
 exports.mapToObject = mapToObject;
 exports.mdTable = mdTable;
@@ -9229,10 +9908,12 @@ exports.readSocketJsonCascade = readSocketJsonCascade;
 exports.readSocketJsonSync = readSocketJsonSync;
 exports.realpathOrResolved = realpathOrResolved;
 exports.resolveAdvisoryIds = resolveAdvisoryIds;
+exports.resolvePublicApiToken = resolvePublicApiToken;
 exports.runAgentInstall = runAgentInstall;
 exports.runSelfUpdateCheck = runSelfUpdateCheck;
 exports.safeNpa = safeNpa$1;
 exports.safeNpmSpecToPurl = safeNpmSpecToPurl;
+exports.saveOAuthCredentials = saveOAuthCredentials;
 exports.sendApiRequest = sendApiRequest;
 exports.serializeResultJson = serializeResultJson;
 exports.setGitRemoteGithubRepoUrl = setGitRemoteGithubRepoUrl;
@@ -9260,5 +9941,5 @@ exports.walkNestedMap = walkNestedMap;
 exports.webLink = webLink;
 exports.withTmpDir = withTmpDir;
 exports.writeSocketJson = writeSocketJson;
-//# debugId=871c30cb-bdbb-449e-8766-245047cb9b4d
+//# debugId=ead18e45-7f35-4138-8864-de9f0791c0e
 //# sourceMappingURL=utils.js.map