@socketsecurity/lib 3.0.2 → 3.0.3

package/dist/git.js.map

@@ -2,6 +2,6 @@
   "version": 3,
   "sources": ["../src/git.ts"],
   "sourcesContent": ["import path from 'path'\n\nimport { WIN32 } from '#constants/platform'\nimport { debugNs } from './debug'\nimport { getGlobMatcher } from './globs'\nimport { normalizePath } from './path'\nimport { spawn, spawnSync } from './spawn'\nimport { stripAnsi } from './strings'\n\n/**\n * Options for git diff operations.\n *\n * Controls how git diff results are processed and returned.\n *\n * @example\n * ```typescript\n * // Get absolute file paths\n * const files = await getChangedFiles({ absolute: true })\n * // => ['/path/to/repo/src/file.ts']\n *\n * // Get relative paths with caching disabled\n * const files = await getChangedFiles({ cache: false })\n * // => ['src/file.ts']\n *\n * // Get files from specific directory\n * const files = await getChangedFiles({ cwd: '/path/to/repo/src' })\n * ```\n */\nexport interface GitDiffOptions {\n  /**\n   * Return absolute file paths instead of relative paths.\n   *\n   * @default false\n   */\n  absolute?: boolean | undefined\n  /**\n   * Cache git diff results to avoid repeated git subprocess calls.\n   *\n   * Caching is keyed by the git command and options used, so different\n   * option combinations maintain separate cache entries.\n   *\n   * @default true\n   */\n  cache?: boolean | undefined\n  /**\n   * Working directory for git operations.\n   *\n   * Git operations will be run from this directory, and returned paths\n   * will be relative to the git repository root. Symlinks are resolved\n   * using `fs.realpathSync()`.\n   *\n   * @default process.cwd()\n   */\n  cwd?: string | undefined\n  /**\n   * Parse git porcelain format output (status codes like `M`, `A`, `??`).\n   *\n   * When `true`, strips the two-character status code and space from the\n   * beginning of each line. Automatically enabled for `getChangedFiles()`.\n   *\n   * @default false\n   */\n  porcelain?: boolean | undefined\n  /**\n   * Return results as a `Set` instead of an array.\n   *\n   * @default false\n   */\n  asSet?: boolean | undefined\n  /**\n   * Additional options passed to glob matcher.\n   *\n   * Supports options like `dot`, `ignore`, `nocase` for filtering results.\n   */\n  [key: string]: unknown\n}\n\n/**\n * Options for filtering packages by git changes.\n *\n * Used to determine which packages in a monorepo have changed files.\n *\n * @example\n * ```typescript\n * // Filter packages with changes\n * const changed = filterPackagesByChanges(packages)\n *\n * // Force include all packages\n * const all = filterPackagesByChanges(packages, { force: true })\n *\n * // Use custom package key\n * const changed = filterPackagesByChanges(\n *   packages,\n *   { packageKey: 'directory' }\n * )\n * ```\n */\nexport interface FilterPackagesByChangesOptions {\n  /**\n   * Force include all packages regardless of changes.\n   *\n   * @default false\n   */\n  force?: boolean | undefined\n  /**\n   * Key to access package path in package objects.\n   *\n   * @default 'path'\n   */\n  packageKey?: string | undefined\n  /**\n   * Additional options for filtering.\n   */\n  [key: string]: unknown\n}\n\ntype SpawnArgs = [string, string[], Record<string, unknown>]\n\ninterface GitDiffSpawnArgs {\n  all: SpawnArgs\n  unstaged: SpawnArgs\n  staged: SpawnArgs\n}\n\nconst gitDiffCache = new Map<string, string[]>()\n\nlet _fs: typeof import('fs') | undefined\n/**\n * Lazily load the `fs` module to avoid Webpack errors.\n *\n * Uses non-`node:` prefixed require internally to prevent Webpack from\n * attempting to bundle Node.js built-in modules.\n *\n * @returns The Node.js `fs` module.\n *\n * @example\n * ```typescript\n * const fs = getFs()\n * const exists = fs.existsSync('/path/to/file')\n * ```\n */\n/*@__NO_SIDE_EFFECTS__*/\nfunction getFs() {\n  if (_fs === undefined) {\n    // Use non-'node:' prefixed require to avoid Webpack errors.\n\n    _fs = /*@__PURE__*/ require('node:fs')\n  }\n  return _fs as typeof import('fs')\n}\n\nlet _path: typeof import('path') | undefined\n/**\n * Lazily load the `path` module to avoid Webpack errors.\n *\n * Uses non-`node:` prefixed require internally to prevent Webpack from\n * attempting to bundle Node.js built-in modules.\n *\n * @returns The Node.js `path` module.\n *\n * @example\n * ```typescript\n * const path = getPath()\n * const joined = path.join('/foo', 'bar')\n * ```\n */\n/*@__NO_SIDE_EFFECTS__*/\nfunction getPath() {\n  if (_path === undefined) {\n    _path = /*@__PURE__*/ require('node:path')\n  }\n  return _path as typeof import('path')\n}\n\n/**\n * Get the git executable path.\n *\n * Currently always returns `'git'`, relying on the system PATH to resolve\n * the git binary location. This may be extended in the future to support\n * custom git paths.\n *\n * @returns The git executable name or path.\n *\n * @example\n * ```typescript\n * const git = getGitPath()\n * // => 'git'\n * ```\n */\nfunction getGitPath(): string {\n  return 'git'\n}\n\n/**\n * Get the current working directory for git operations.\n *\n * Returns the real path to handle symlinks correctly. This is important\n * because symlinked directories like `/tmp -> /private/tmp` can cause\n * path mismatches when comparing git output.\n *\n * @returns The resolved real path of `process.cwd()`.\n *\n * @example\n * ```typescript\n * const cwd = getCwd()\n * // In /tmp (symlink to /private/tmp):\n * // => '/private/tmp'\n * ```\n */\nfunction getCwd(): string {\n  return getFs().realpathSync(process.cwd())\n}\n\n/**\n * Get spawn arguments for different git diff operations.\n *\n * Prepares argument arrays for `spawn()`/`spawnSync()` calls that retrieve:\n * - `all`: All changed files (staged, unstaged, untracked) via `git status --porcelain`\n * - `unstaged`: Unstaged modifications via `git diff --name-only`\n * - `staged`: Staged changes via `git diff --cached --name-only`\n *\n * Automatically resolves symlinks in the provided `cwd` and enables shell\n * mode on Windows for proper command execution.\n *\n * @param cwd - Working directory for git operations, defaults to `process.cwd()`.\n * @returns Object containing spawn arguments for all, unstaged, and staged operations.\n */\nfunction getGitDiffSpawnArgs(cwd?: string | undefined): GitDiffSpawnArgs {\n  const resolvedCwd = cwd ? getFs().realpathSync(cwd) : getCwd()\n  return {\n    all: [\n      getGitPath(),\n      ['status', '--porcelain'],\n      {\n        cwd: resolvedCwd,\n        shell: WIN32,\n      },\n    ],\n    unstaged: [\n      getGitPath(),\n      ['diff', '--name-only'],\n      {\n        cwd: resolvedCwd,\n      },\n    ],\n    staged: [\n      getGitPath(),\n      ['diff', '--cached', '--name-only'],\n      {\n        cwd: resolvedCwd,\n        shell: WIN32,\n      },\n    ],\n  }\n}\n\n/**\n * Execute git diff command asynchronously and parse results.\n *\n * Internal helper for async git operations. Handles caching, command execution,\n * and result parsing. Returns empty array on git command failure.\n *\n * @param args - Spawn arguments tuple `[command, args, options]`.\n * @param options - Git diff options for caching and parsing.\n * @returns Promise resolving to array of file paths.\n */\nasync function innerDiff(\n  args: SpawnArgs,\n  options?: GitDiffOptions | undefined,\n): Promise<string[]> {\n  const { cache = true, ...parseOptions } = { __proto__: null, ...options }\n  const cacheKey = cache ? JSON.stringify({ args, parseOptions }) : undefined\n  if (cache && cacheKey) {\n    const result = gitDiffCache.get(cacheKey)\n    if (result) {\n      return result\n    }\n  }\n  let result: string[]\n  try {\n    // Use stdioString: false to get raw Buffer, then convert ourselves to preserve exact output.\n    const spawnResult = await spawn(args[0], args[1], {\n      ...args[2],\n      stdioString: false,\n    })\n    const stdout = Buffer.isBuffer(spawnResult.stdout)\n      ? spawnResult.stdout.toString('utf8')\n      : String(spawnResult.stdout)\n    // Extract spawn cwd from args to pass to parser\n    const spawnCwd =\n      typeof args[2]['cwd'] === 'string' ? args[2]['cwd'] : undefined\n    result = parseGitDiffStdout(stdout, parseOptions, spawnCwd)\n  } catch (e) {\n    // Git command failed. This is expected if:\n    // - Not in a git repository\n    // - Git is not installed\n    // - Permission issues accessing .git directory\n    // Log warning in debug mode for troubleshooting.\n    debugNs(\n      'git',\n      `Git command failed (${args[0]} ${args[1].join(' ')}): ${(e as Error).message}`,\n    )\n    return []\n  }\n  if (cache && cacheKey) {\n    gitDiffCache.set(cacheKey, result)\n  }\n  return result\n}\n\n/**\n * Execute git diff command synchronously and parse results.\n *\n * Internal helper for sync git operations. Handles caching, command execution,\n * and result parsing. Returns empty array on git command failure.\n *\n * @param args - Spawn arguments tuple `[command, args, options]`.\n * @param options - Git diff options for caching and parsing.\n * @returns Array of file paths.\n */\nfunction innerDiffSync(\n  args: SpawnArgs,\n  options?: GitDiffOptions | undefined,\n): string[] {\n  const { cache = true, ...parseOptions } = { __proto__: null, ...options }\n  const cacheKey = cache ? JSON.stringify({ args, parseOptions }) : undefined\n  if (cache && cacheKey) {\n    const result = gitDiffCache.get(cacheKey)\n    if (result) {\n      return result\n    }\n  }\n  let result: string[]\n  try {\n    // Use stdioString: false to get raw Buffer, then convert ourselves to preserve exact output.\n    const spawnResult = spawnSync(args[0], args[1], {\n      ...args[2],\n      stdioString: false,\n    })\n    const stdout = Buffer.isBuffer(spawnResult.stdout)\n      ? spawnResult.stdout.toString('utf8')\n      : String(spawnResult.stdout)\n    // Extract spawn cwd from args to pass to parser\n    const spawnCwd =\n      typeof args[2]['cwd'] === 'string' ? args[2]['cwd'] : undefined\n    result = parseGitDiffStdout(stdout, parseOptions, spawnCwd)\n  } catch (e) {\n    // Git command failed. This is expected if:\n    // - Not in a git repository\n    // - Git is not installed\n    // - Permission issues accessing .git directory\n    // Log warning in debug mode for troubleshooting.\n    debugNs(\n      'git',\n      `Git command failed (${args[0]} ${args[1].join(' ')}): ${(e as Error).message}`,\n    )\n    return []\n  }\n  if (cache && cacheKey) {\n    gitDiffCache.set(cacheKey, result)\n  }\n  return result\n}\n\n/**\n * Find git repository root by walking up from the given directory.\n *\n * Searches for a `.git` directory or file by traversing parent directories\n * upward until found or filesystem root is reached. Returns the original path\n * if no git repository is found.\n *\n * This function is exported primarily for testing purposes.\n *\n * @param startPath - Directory path to start searching from.\n * @returns Git repository root path, or `startPath` if not found.\n *\n * @example\n * ```typescript\n * const root = findGitRoot('/path/to/repo/src/subdir')\n * // => '/path/to/repo'\n *\n * const notFound = findGitRoot('/not/a/repo')\n * // => '/not/a/repo'\n * ```\n */\nexport function findGitRoot(startPath: string): string {\n  const fs = getFs()\n  const path = getPath()\n  let currentPath = startPath\n  // Walk up the directory tree looking for .git\n  while (true) {\n    try {\n      const gitPath = path.join(currentPath, '.git')\n      if (fs.existsSync(gitPath)) {\n        return currentPath\n      }\n    } catch {\n      // Ignore errors and continue walking up\n    }\n    const parentPath = path.dirname(currentPath)\n    // Stop if we've reached the root or can't go up anymore\n    if (parentPath === currentPath) {\n      // Return original path if no .git found\n      return startPath\n    }\n    currentPath = parentPath\n  }\n}\n\n/**\n * Parse git diff stdout output into file path array.\n *\n * Internal helper that processes raw git command output by:\n * 1. Finding git repository root from spawn cwd\n * 2. Stripping ANSI codes and splitting into lines\n * 3. Parsing porcelain format status codes if requested\n * 4. Normalizing and optionally making paths absolute\n * 5. Filtering paths based on cwd and glob options\n *\n * Git always returns paths relative to the repository root, regardless of\n * where the command was executed. This function handles the path resolution\n * correctly by finding the repo root and adjusting paths accordingly.\n *\n * @param stdout - Raw stdout from git command.\n * @param options - Git diff options for path processing.\n * @param spawnCwd - Working directory where git command was executed.\n * @returns Array of processed file paths.\n */\nfunction parseGitDiffStdout(\n  stdout: string,\n  options?: GitDiffOptions | undefined,\n  spawnCwd?: string | undefined,\n): string[] {\n  // Find git repo root from spawnCwd. Git always returns paths relative to the repo root,\n  // not the cwd where it was run. So we need to find the repo root to correctly parse paths.\n  const defaultRoot = spawnCwd ? findGitRoot(spawnCwd) : getCwd()\n  const {\n    absolute = false,\n    cwd: cwdOption = defaultRoot,\n    porcelain = false,\n    ...matcherOptions\n  } = { __proto__: null, ...options }\n  // Resolve cwd to handle symlinks.\n  const cwd =\n    cwdOption === defaultRoot ? defaultRoot : getFs().realpathSync(cwdOption)\n  const rootPath = defaultRoot\n  // Split into lines without trimming to preserve leading spaces in porcelain format.\n  let rawFiles = stdout\n    ? stripAnsi(stdout)\n        .split('\\n')\n        .map(line => line.trimEnd())\n        .filter(line => line)\n    : []\n  // Parse porcelain format: strip status codes.\n  // Git status --porcelain format is: XY filename\n  // where X and Y are single characters and there's a space before the filename.\n  if (porcelain) {\n    rawFiles = rawFiles.map(line => {\n      // Status is first 2 chars, then space, then filename.\n      return line.length > 3 ? line.substring(3) : line\n    })\n  }\n  const files = absolute\n    ? rawFiles.map(relPath => normalizePath(path.join(rootPath, relPath)))\n    : rawFiles.map(relPath => normalizePath(relPath))\n  if (cwd === rootPath) {\n    return files\n  }\n  const relPath = normalizePath(path.relative(rootPath, cwd))\n  const matcher = getGlobMatcher([`${relPath}/**`], {\n    ...(matcherOptions as {\n      dot?: boolean\n      ignore?: string[]\n      nocase?: boolean\n    }),\n    absolute,\n    cwd: rootPath,\n  } as {\n    absolute?: boolean\n    cwd?: string\n    dot?: boolean\n    ignore?: string[]\n    nocase?: boolean\n  })\n  const filtered: string[] = []\n  for (const filepath of files) {\n    if (matcher(filepath)) {\n      filtered.push(filepath)\n    }\n  }\n  return filtered\n}\n\n/**\n * Get all changed files including staged, unstaged, and untracked files.\n *\n * Uses `git status --porcelain` which returns the full working tree status\n * with status codes:\n * - `M` - Modified\n * - `A` - Added\n * - `D` - Deleted\n * - `??` - Untracked\n * - `R` - Renamed\n * - `C` - Copied\n *\n * This is the most comprehensive check - captures everything that differs\n * from the last commit, including:\n * - Files modified and staged with `git add`\n * - Files modified but not staged\n * - New files not yet tracked by git\n *\n * Status codes are automatically stripped from the output.\n *\n * @param options - Options controlling path format and filtering.\n * @returns Promise resolving to array of changed file paths.\n *\n * @example\n * ```typescript\n * // Get all changed files as relative paths\n * const files = await getChangedFiles()\n * // => ['src/foo.ts', 'src/bar.ts', 'newfile.ts']\n *\n * // Get absolute paths\n * const files = await getChangedFiles({ absolute: true })\n * // => ['/path/to/repo/src/foo.ts', ...]\n *\n * // Get changed files in specific directory\n * const files = await getChangedFiles({ cwd: '/path/to/repo/src' })\n * // => ['foo.ts', 'bar.ts']\n * ```\n */\nexport async function getChangedFiles(\n  options?: GitDiffOptions | undefined,\n): Promise<string[]> {\n  const args = getGitDiffSpawnArgs(options?.cwd).all\n  return await innerDiff(args, {\n    __proto__: null,\n    ...options,\n    porcelain: true,\n  })\n}\n\n/**\n * Get all changed files including staged, unstaged, and untracked files.\n *\n * Synchronous version of `getChangedFiles()`. Uses `git status --porcelain`\n * which returns the full working tree status with status codes:\n * - `M` - Modified\n * - `A` - Added\n * - `D` - Deleted\n * - `??` - Untracked\n * - `R` - Renamed\n * - `C` - Copied\n *\n * This is the most comprehensive check - captures everything that differs\n * from the last commit, including:\n * - Files modified and staged with `git add`\n * - Files modified but not staged\n * - New files not yet tracked by git\n *\n * Status codes are automatically stripped from the output.\n *\n * @param options - Options controlling path format and filtering.\n * @returns Array of changed file paths.\n *\n * @example\n * ```typescript\n * // Get all changed files as relative paths\n * const files = getChangedFilesSync()\n * // => ['src/foo.ts', 'src/bar.ts', 'newfile.ts']\n *\n * // Get absolute paths\n * const files = getChangedFilesSync({ absolute: true })\n * // => ['/path/to/repo/src/foo.ts', ...]\n *\n * // Get changed files in specific directory\n * const files = getChangedFilesSync({ cwd: '/path/to/repo/src' })\n * // => ['foo.ts', 'bar.ts']\n * ```\n */\nexport function getChangedFilesSync(\n  options?: GitDiffOptions | undefined,\n): string[] {\n  const args = getGitDiffSpawnArgs(options?.cwd).all\n  return innerDiffSync(args, {\n    __proto__: null,\n    ...options,\n    porcelain: true,\n  })\n}\n\n/**\n * Get unstaged modified files (changes not yet staged for commit).\n *\n * Uses `git diff --name-only` which returns only unstaged modifications\n * to tracked files. Does NOT include:\n * - Untracked files (new files not added to git)\n * - Staged changes (files added with `git add`)\n *\n * This is a focused check for uncommitted changes to existing tracked files.\n * Useful for detecting work-in-progress modifications before staging.\n *\n * @param options - Options controlling path format and filtering.\n * @returns Promise resolving to array of unstaged file paths.\n *\n * @example\n * ```typescript\n * // Get unstaged files\n * const files = await getUnstagedFiles()\n * // => ['src/foo.ts', 'src/bar.ts']\n *\n * // After staging some files\n * await spawn('git', ['add', 'src/foo.ts'])\n * const files = await getUnstagedFiles()\n * // => ['src/bar.ts'] (foo.ts no longer included)\n *\n * // Get absolute paths\n * const files = await getUnstagedFiles({ absolute: true })\n * // => ['/path/to/repo/src/bar.ts']\n * ```\n */\nexport async function getUnstagedFiles(\n  options?: GitDiffOptions | undefined,\n): Promise<string[]> {\n  const args = getGitDiffSpawnArgs(options?.cwd).unstaged\n  return await innerDiff(args, options)\n}\n\n/**\n * Get unstaged modified files (changes not yet staged for commit).\n *\n * Synchronous version of `getUnstagedFiles()`. Uses `git diff --name-only`\n * which returns only unstaged modifications to tracked files. Does NOT include:\n * - Untracked files (new files not added to git)\n * - Staged changes (files added with `git add`)\n *\n * This is a focused check for uncommitted changes to existing tracked files.\n * Useful for detecting work-in-progress modifications before staging.\n *\n * @param options - Options controlling path format and filtering.\n * @returns Array of unstaged file paths.\n *\n * @example\n * ```typescript\n * // Get unstaged files\n * const files = getUnstagedFilesSync()\n * // => ['src/foo.ts', 'src/bar.ts']\n *\n * // After staging some files\n * spawnSync('git', ['add', 'src/foo.ts'])\n * const files = getUnstagedFilesSync()\n * // => ['src/bar.ts'] (foo.ts no longer included)\n *\n * // Get absolute paths\n * const files = getUnstagedFilesSync({ absolute: true })\n * // => ['/path/to/repo/src/bar.ts']\n * ```\n */\nexport function getUnstagedFilesSync(\n  options?: GitDiffOptions | undefined,\n): string[] {\n  const args = getGitDiffSpawnArgs(options?.cwd).unstaged\n  return innerDiffSync(args, options)\n}\n\n/**\n * Get staged files ready for commit (changes added with `git add`).\n *\n * Uses `git diff --cached --name-only` which returns only staged changes.\n * Does NOT include:\n * - Unstaged modifications (changes not added with `git add`)\n * - Untracked files (new files not added to git)\n *\n * This is a focused check for what will be included in the next commit.\n * Useful for validating changes before committing or running pre-commit hooks.\n *\n * @param options - Options controlling path format and filtering.\n * @returns Promise resolving to array of staged file paths.\n *\n * @example\n * ```typescript\n * // Get currently staged files\n * const files = await getStagedFiles()\n * // => ['src/foo.ts']\n *\n * // Stage more files\n * await spawn('git', ['add', 'src/bar.ts'])\n * const files = await getStagedFiles()\n * // => ['src/foo.ts', 'src/bar.ts']\n *\n * // Get absolute paths\n * const files = await getStagedFiles({ absolute: true })\n * // => ['/path/to/repo/src/foo.ts', ...]\n * ```\n */\nexport async function getStagedFiles(\n  options?: GitDiffOptions | undefined,\n): Promise<string[]> {\n  const args = getGitDiffSpawnArgs(options?.cwd).staged\n  return await innerDiff(args, options)\n}\n\n/**\n * Get staged files ready for commit (changes added with `git add`).\n *\n * Synchronous version of `getStagedFiles()`. Uses `git diff --cached --name-only`\n * which returns only staged changes. Does NOT include:\n * - Unstaged modifications (changes not added with `git add`)\n * - Untracked files (new files not added to git)\n *\n * This is a focused check for what will be included in the next commit.\n * Useful for validating changes before committing or running pre-commit hooks.\n *\n * @param options - Options controlling path format and filtering.\n * @returns Array of staged file paths.\n *\n * @example\n * ```typescript\n * // Get currently staged files\n * const files = getStagedFilesSync()\n * // => ['src/foo.ts']\n *\n * // Stage more files\n * spawnSync('git', ['add', 'src/bar.ts'])\n * const files = getStagedFilesSync()\n * // => ['src/foo.ts', 'src/bar.ts']\n *\n * // Get absolute paths\n * const files = getStagedFilesSync({ absolute: true })\n * // => ['/path/to/repo/src/foo.ts', ...]\n * ```\n */\nexport function getStagedFilesSync(\n  options?: GitDiffOptions | undefined,\n): string[] {\n  const args = getGitDiffSpawnArgs(options?.cwd).staged\n  return innerDiffSync(args, options)\n}\n\n/**\n * Check if a file or directory has any git changes.\n *\n * Checks if the given pathname has any changes including:\n * - Staged modifications (added with `git add`)\n * - Unstaged modifications (not yet staged)\n * - Untracked status (new file/directory not in git)\n *\n * For directories, returns `true` if ANY file within the directory has changes.\n *\n * Symlinks in the pathname and cwd are automatically resolved using\n * `fs.realpathSync()` before comparison.\n *\n * @param pathname - File or directory path to check.\n * @param options - Options for the git status check.\n * @returns Promise resolving to `true` if path has any changes, `false` otherwise.\n *\n * @example\n * ```typescript\n * // Check if file is changed\n * const changed = await isChanged('src/foo.ts')\n * // => true\n *\n * // Check if directory has any changes\n * const changed = await isChanged('src/')\n * // => true (if any file in src/ is changed)\n *\n * // Check from different cwd\n * const changed = await isChanged(\n *   '/path/to/repo/src/foo.ts',\n *   { cwd: '/path/to/repo' }\n * )\n * ```\n */\nexport async function isChanged(\n  pathname: string,\n  options?: GitDiffOptions | undefined,\n): Promise<boolean> {\n  const files = await getChangedFiles({\n    __proto__: null,\n    ...options,\n    absolute: false,\n  })\n  // Resolve pathname to handle symlinks before computing relative path.\n  const resolvedPathname = getFs().realpathSync(pathname)\n  const baseCwd = options?.cwd ? getFs().realpathSync(options['cwd']) : getCwd()\n  const relativePath = normalizePath(path.relative(baseCwd, resolvedPathname))\n  return files.includes(relativePath)\n}\n\n/**\n * Check if a file or directory has any git changes.\n *\n * Synchronous version of `isChanged()`. Checks if the given pathname has\n * any changes including:\n * - Staged modifications (added with `git add`)\n * - Unstaged modifications (not yet staged)\n * - Untracked status (new file/directory not in git)\n *\n * For directories, returns `true` if ANY file within the directory has changes.\n *\n * Symlinks in the pathname and cwd are automatically resolved using\n * `fs.realpathSync()` before comparison.\n *\n * @param pathname - File or directory path to check.\n * @param options - Options for the git status check.\n * @returns `true` if path has any changes, `false` otherwise.\n *\n * @example\n * ```typescript\n * // Check if file is changed\n * const changed = isChangedSync('src/foo.ts')\n * // => true\n *\n * // Check if directory has any changes\n * const changed = isChangedSync('src/')\n * // => true (if any file in src/ is changed)\n *\n * // Check from different cwd\n * const changed = isChangedSync(\n *   '/path/to/repo/src/foo.ts',\n *   { cwd: '/path/to/repo' }\n * )\n * ```\n */\nexport function isChangedSync(\n  pathname: string,\n  options?: GitDiffOptions | undefined,\n): boolean {\n  const files = getChangedFilesSync({\n    __proto__: null,\n    ...options,\n    absolute: false,\n  })\n  // Resolve pathname to handle symlinks before computing relative path.\n  const resolvedPathname = getFs().realpathSync(pathname)\n  const baseCwd = options?.cwd ? getFs().realpathSync(options['cwd']) : getCwd()\n  const relativePath = normalizePath(path.relative(baseCwd, resolvedPathname))\n  return files.includes(relativePath)\n}\n\n/**\n * Check if a file or directory has unstaged changes.\n *\n * Checks if the given pathname has modifications that are not yet staged\n * for commit (changes not added with `git add`). Does NOT include:\n * - Staged changes (already added with `git add`)\n * - Untracked files (new files not in git)\n *\n * For directories, returns `true` if ANY file within the directory has\n * unstaged changes.\n *\n * Symlinks in the pathname and cwd are automatically resolved using\n * `fs.realpathSync()` before comparison.\n *\n * @param pathname - File or directory path to check.\n * @param options - Options for the git diff check.\n * @returns Promise resolving to `true` if path has unstaged changes, `false` otherwise.\n *\n * @example\n * ```typescript\n * // Check if file has unstaged changes\n * const unstaged = await isUnstaged('src/foo.ts')\n * // => true\n *\n * // After staging the file\n * await spawn('git', ['add', 'src/foo.ts'])\n * const unstaged = await isUnstaged('src/foo.ts')\n * // => false\n *\n * // Check directory\n * const unstaged = await isUnstaged('src/')\n * // => true (if any file in src/ has unstaged changes)\n * ```\n */\nexport async function isUnstaged(\n  pathname: string,\n  options?: GitDiffOptions | undefined,\n): Promise<boolean> {\n  const files = await getUnstagedFiles({\n    __proto__: null,\n    ...options,\n    absolute: false,\n  })\n  // Resolve pathname to handle symlinks before computing relative path.\n  const resolvedPathname = getFs().realpathSync(pathname)\n  const baseCwd = options?.cwd ? getFs().realpathSync(options['cwd']) : getCwd()\n  const relativePath = normalizePath(path.relative(baseCwd, resolvedPathname))\n  return files.includes(relativePath)\n}\n\n/**\n * Check if a file or directory has unstaged changes.\n *\n * Synchronous version of `isUnstaged()`. Checks if the given pathname has\n * modifications that are not yet staged for commit (changes not added with\n * `git add`). Does NOT include:\n * - Staged changes (already added with `git add`)\n * - Untracked files (new files not in git)\n *\n * For directories, returns `true` if ANY file within the directory has\n * unstaged changes.\n *\n * Symlinks in the pathname and cwd are automatically resolved using\n * `fs.realpathSync()` before comparison.\n *\n * @param pathname - File or directory path to check.\n * @param options - Options for the git diff check.\n * @returns `true` if path has unstaged changes, `false` otherwise.\n *\n * @example\n * ```typescript\n * // Check if file has unstaged changes\n * const unstaged = isUnstagedSync('src/foo.ts')\n * // => true\n *\n * // After staging the file\n * spawnSync('git', ['add', 'src/foo.ts'])\n * const unstaged = isUnstagedSync('src/foo.ts')\n * // => false\n *\n * // Check directory\n * const unstaged = isUnstagedSync('src/')\n * // => true (if any file in src/ has unstaged changes)\n * ```\n */\nexport function isUnstagedSync(\n  pathname: string,\n  options?: GitDiffOptions | undefined,\n): boolean {\n  const files = getUnstagedFilesSync({\n    __proto__: null,\n    ...options,\n    absolute: false,\n  })\n  // Resolve pathname to handle symlinks before computing relative path.\n  const resolvedPathname = getFs().realpathSync(pathname)\n  const baseCwd = options?.cwd ? getFs().realpathSync(options['cwd']) : getCwd()\n  const relativePath = normalizePath(path.relative(baseCwd, resolvedPathname))\n  return files.includes(relativePath)\n}\n\n/**\n * Check if a file or directory is staged for commit.\n *\n * Checks if the given pathname has changes staged with `git add` that will\n * be included in the next commit. Does NOT include:\n * - Unstaged modifications (changes not added with `git add`)\n * - Untracked files (new files not in git)\n *\n * For directories, returns `true` if ANY file within the directory is staged.\n *\n * Symlinks in the pathname and cwd are automatically resolved using\n * `fs.realpathSync()` before comparison.\n *\n * @param pathname - File or directory path to check.\n * @param options - Options for the git diff check.\n * @returns Promise resolving to `true` if path is staged, `false` otherwise.\n *\n * @example\n * ```typescript\n * // Check if file is staged\n * const staged = await isStaged('src/foo.ts')\n * // => false\n *\n * // Stage the file\n * await spawn('git', ['add', 'src/foo.ts'])\n * const staged = await isStaged('src/foo.ts')\n * // => true\n *\n * // Check directory\n * const staged = await isStaged('src/')\n * // => true (if any file in src/ is staged)\n * ```\n */\nexport async function isStaged(\n  pathname: string,\n  options?: GitDiffOptions | undefined,\n): Promise<boolean> {\n  const files = await getStagedFiles({\n    __proto__: null,\n    ...options,\n    absolute: false,\n  })\n  // Resolve pathname to handle symlinks before computing relative path.\n  const resolvedPathname = getFs().realpathSync(pathname)\n  const baseCwd = options?.cwd ? getFs().realpathSync(options['cwd']) : getCwd()\n  const relativePath = normalizePath(path.relative(baseCwd, resolvedPathname))\n  return files.includes(relativePath)\n}\n\n/**\n * Check if a file or directory is staged for commit.\n *\n * Synchronous version of `isStaged()`. Checks if the given pathname has\n * changes staged with `git add` that will be included in the next commit.\n * Does NOT include:\n * - Unstaged modifications (changes not added with `git add`)\n * - Untracked files (new files not in git)\n *\n * For directories, returns `true` if ANY file within the directory is staged.\n *\n * Symlinks in the pathname and cwd are automatically resolved using\n * `fs.realpathSync()` before comparison.\n *\n * @param pathname - File or directory path to check.\n * @param options - Options for the git diff check.\n * @returns `true` if path is staged, `false` otherwise.\n *\n * @example\n * ```typescript\n * // Check if file is staged\n * const staged = isStagedSync('src/foo.ts')\n * // => false\n *\n * // Stage the file\n * spawnSync('git', ['add', 'src/foo.ts'])\n * const staged = isStagedSync('src/foo.ts')\n * // => true\n *\n * // Check directory\n * const staged = isStagedSync('src/')\n * // => true (if any file in src/ is staged)\n * ```\n */\nexport function isStagedSync(\n  pathname: string,\n  options?: GitDiffOptions | undefined,\n): boolean {\n  const files = getStagedFilesSync({\n    __proto__: null,\n    ...options,\n    absolute: false,\n  })\n  // Resolve pathname to handle symlinks before computing relative path.\n  const resolvedPathname = getFs().realpathSync(pathname)\n  const baseCwd = options?.cwd ? getFs().realpathSync(options['cwd']) : getCwd()\n  const relativePath = normalizePath(path.relative(baseCwd, resolvedPathname))\n  return files.includes(relativePath)\n}\n"],
-  "mappings": ";6iBAAA,IAAAA,GAAA,GAAAC,EAAAD,GAAA,iBAAAE,EAAA,oBAAAC,EAAA,wBAAAC,EAAA,mBAAAC,EAAA,uBAAAC,EAAA,qBAAAC,EAAA,yBAAAC,EAAA,cAAAC,EAAA,kBAAAC,EAAA,aAAAC,GAAA,iBAAAC,GAAA,eAAAC,EAAA,mBAAAC,KAAA,eAAAC,EAAAf,IAAA,IAAAgB,EAAiB,mBAEjBC,EAAsB,+BACtBC,EAAwB,mBACxBC,EAA+B,mBAC/BH,EAA8B,kBAC9BI,EAAiC,mBACjCC,EAA0B,qBAqH1B,MAAMC,EAAe,IAAI,IAEzB,IAAIC,EAgBJ,SAASC,GAAQ,CACf,OAAID,IAAQ,SAGVA,EAAoB,QAAQ,SAAS,GAEhCA,CACT,CAEA,IAAIE,EAgBJ,SAASC,GAAU,CACjB,OAAID,IAAU,SACZA,EAAsB,QAAQ,WAAW,GAEpCA,CACT,CAiBA,SAASE,GAAqB,CAC5B,MAAO,KACT,CAkBA,SAASC,GAAiB,CACxB,OAAOJ,EAAM,EAAE,aAAa,QAAQ,IAAI,CAAC,CAC3C,CAgBA,SAASK,EAAoBC,EAA4C,CACvE,MAAMC,EAAcD,EAAMN,EAAM,EAAE,aAAaM,CAAG,EAAIF,EAAO,EAC7D,MAAO,CACL,IAAK,CACHD,EAAW,EACX,CAAC,SAAU,aAAa,EACxB,CACE,IAAKI,EACL,MAAO,OACT,CACF,EACA,SAAU,CACRJ,EAAW,EACX,CAAC,OAAQ,aAAa,EACtB,CACE,IAAKI,CACP,CACF,EACA,OAAQ,CACNJ,EAAW,EACX,CAAC,OAAQ,WAAY,aAAa,EAClC,CACE,IAAKI,EACL,MAAO,OACT,CACF,CACF,CACF,CAYA,eAAeC,EACbC,EACAC,EACmB,CACnB,KAAM,CAAE,MAAAC,EAAQ,GAAM,GAAGC,CAAa,EAAI,CAAE,UAAW,KAAM,GAAGF,CAAQ,EAClEG,EAAWF,EAAQ,KAAK,UAAU,CAAE,KAAAF,EAAM,aAAAG,CAAa,CAAC,EAAI,OAClE,GAAID,GAASE,EAAU,CACrB,MAAMC,EAAShB,EAAa,IAAIe,CAAQ,EACxC,GAAIC,EACF,OAAOA,CAEX,CACA,IAAIA,EACJ,GAAI,CAEF,MAAMC,EAAc,QAAM,SAAMN,EAAK,CAAC,EAAGA,EAAK,CAAC,EAAG,CAChD,GAAGA,EAAK,CAAC,EACT,YAAa,EACf,CAAC,EACKO,EAAS,OAAO,SAASD,EAAY,MAAM,EAC7CA,EAAY,OAAO,SAAS,MAAM,EAClC,OAAOA,EAAY,MAAM,EAEvBE,EACJ,OAAOR,EAAK,CAAC,EAAE,KAAW,SAAWA,EAAK,CAAC,EAAE,IAAS,OACxDK,EAASI,EAAmBF,EAAQJ,EAAcK,CAAQ,CAC5D,OAASE,EAAG,CAMV,oBACE,MACA,uBAAuBV,EAAK,CAAC,CAAC,IAAIA,EAAK,CAAC,EAAE,KAAK,GAAG,CAAC,MAAOU,EAAY,OAAO,EAC/E,EACO,CAAC,CACV,CACA,OAAIR,GAASE,GACXf,EAAa,IAAIe,EAAUC,CAAM,EAE5BA,CACT,CAYA,SAASM,EACPX,EACAC,EACU,CACV,KAAM,CAAE,MAAAC,EAAQ,GAAM,GAAGC,CAAa,EAAI,CAAE,UAAW,KAAM,GAAGF,CAAQ,EAClEG,EAAWF,EAAQ,KAAK,UAAU,CAAE,KAAAF,EAAM,aAAAG,CAAa,CAAC,EAAI,OAClE,GAAID,GAASE,EAAU,CACrB,MAAMC,EAAShB,EAAa,IAAIe,CAAQ,EACxC,GAAIC,EACF,OAAOA,CAEX,CACA,IAAIA,EACJ,GAAI,CAEF,MAAMC,KAAc,aAAUN,EAAK,CAAC,EAAGA,EAAK,CAAC,EAAG,CAC9C,GAAGA,EAAK,CAAC,EACT,YAAa,EACf,CAAC,EACKO,EAAS,OAAO,SAASD,EAAY,MAAM,EAC7CA,EAAY,OAAO,SAAS,MAAM,EAClC,OAAOA,EAAY,MAAM,EAEvBE,EACJ,OAAOR,EAAK,CAAC,EAAE,KAAW,SAAWA,EAAK,CAAC,EAAE,IAAS,OACxDK,EAASI,EAAmBF,EAAQJ,EAAcK,CAAQ,CAC5D,OAASE,EAAG,CAMV,oBACE,MACA,uBAAuBV,EAAK,CAAC,CAAC,IAAIA,EAAK,CAAC,EAAE,KAAK,GAAG,CAAC,MAAOU,EAAY,OAAO,EAC/E,EACO,CAAC,CACV,CACA,OAAIR,GAASE,GACXf,EAAa,IAAIe,EAAUC,CAAM,EAE5BA,CACT,CAuBO,SAASpC,EAAY2C,EAA2B,CACrD,MAAMC,EAAKtB,EAAM,EACXuB,EAAOrB,EAAQ,EACrB,IAAIsB,EAAcH,EAElB,OAAa,CACX,GAAI,CACF,MAAMI,EAAUF,EAAK,KAAKC,EAAa,MAAM,EAC7C,GAAIF,EAAG,WAAWG,CAAO,EACvB,OAAOD,CAEX,MAAQ,CAER,CACA,MAAME,EAAaH,EAAK,QAAQC,CAAW,EAE3C,GAAIE,IAAeF,EAEjB,OAAOH,EAETG,EAAcE,CAChB,CACF,CAqBA,SAASR,EACPF,EACAN,EACAO,EACU,CAGV,MAAMU,EAAcV,EAAWvC,EAAYuC,CAAQ,EAAIb,EAAO,EACxD,CACJ,SAAAwB,EAAW,GACX,IAAKC,EAAYF,EACjB,UAAAG,EAAY,GACZ,GAAGC,CACL,EAAI,CAAE,UAAW,KAAM,GAAGrB,CAAQ,EAE5BJ,EACJuB,IAAcF,EAAcA,EAAc3B,EAAM,EAAE,aAAa6B,CAAS,EACpEG,EAAWL,EAEjB,IAAIM,EAAWjB,KACX,aAAUA,CAAM,EACb,MAAM;AAAA,CAAI,EACV,IAAIkB,GAAQA,EAAK,QAAQ,CAAC,EAC1B,OAAOA,GAAQA,CAAI,EACtB,CAAC,EAIDJ,IACFG,EAAWA,EAAS,IAAIC,GAEfA,EAAK,OAAS,EAAIA,EAAK,UAAU,CAAC,EAAIA,CAC9C,GAEH,MAAMC,EAAQP,EACVK,EAAS,IAAIG,MAAW,iBAAc,EAAAb,QAAK,KAAKS,EAAUI,CAAO,CAAC,CAAC,EACnEH,EAAS,IAAIG,MAAW,iBAAcA,CAAO,CAAC,EAClD,GAAI9B,IAAQ0B,EACV,OAAOG,EAET,MAAMC,KAAU,iBAAc,EAAAb,QAAK,SAASS,EAAU1B,CAAG,CAAC,EACpD+B,KAAU,kBAAe,CAAC,GAAGD,CAAO,KAAK,EAAG,CAChD,GAAIL,EAKJ,SAAAH,EACA,IAAKI,CACP,CAMC,EACKM,EAAqB,CAAC,EAC5B,UAAWC,KAAYJ,EACjBE,EAAQE,CAAQ,GAClBD,EAAS,KAAKC,CAAQ,EAG1B,OAAOD,CACT,CAwCA,eAAsB3D,EACpB+B,EACmB,CACnB,MAAMD,EAAOJ,EAAoBK,GAAS,GAAG,EAAE,IAC/C,OAAO,MAAMF,EAAUC,EAAM,CAC3B,UAAW,KACX,GAAGC,EACH,UAAW,EACb,CAAC,CACH,CAwCO,SAAS9B,EACd8B,EACU,CACV,MAAMD,EAAOJ,EAAoBK,GAAS,GAAG,EAAE,IAC/C,OAAOU,EAAcX,EAAM,CACzB,UAAW,KACX,GAAGC,EACH,UAAW,EACb,CAAC,CACH,CAgCA,eAAsB3B,EACpB2B,EACmB,CACnB,MAAMD,EAAOJ,EAAoBK,GAAS,GAAG,EAAE,SAC/C,OAAO,MAAMF,EAAUC,EAAMC,CAAO,CACtC,CAgCO,SAAS1B,EACd0B,EACU,CACV,MAAMD,EAAOJ,EAAoBK,GAAS,GAAG,EAAE,SAC/C,OAAOU,EAAcX,EAAMC,CAAO,CACpC,CAgCA,eAAsB7B,EACpB6B,EACmB,CACnB,MAAMD,EAAOJ,EAAoBK,GAAS,GAAG,EAAE,OAC/C,OAAO,MAAMF,EAAUC,EAAMC,CAAO,CACtC,CAgCO,SAAS5B,EACd4B,EACU,CACV,MAAMD,EAAOJ,EAAoBK,GAAS,GAAG,EAAE,OAC/C,OAAOU,EAAcX,EAAMC,CAAO,CACpC,CAoCA,eAAsBzB,EACpBuD,EACA9B,EACkB,CAClB,MAAMyB,EAAQ,MAAMxD,EAAgB,CAClC,UAAW,KACX,GAAG+B,EACH,SAAU,EACZ,CAAC,EAEK+B,EAAmBzC,EAAM,EAAE,aAAawC,CAAQ,EAChDE,EAAUhC,GAAS,IAAMV,EAAM,EAAE,aAAaU,EAAQ,GAAM,EAAIN,EAAO,EACvEuC,KAAe,iBAAc,EAAApB,QAAK,SAASmB,EAASD,CAAgB,CAAC,EAC3E,OAAON,EAAM,SAASQ,CAAY,CACpC,CAqCO,SAASzD,EACdsD,EACA9B,EACS,CACT,MAAMyB,EAAQvD,EAAoB,CAChC,UAAW,KACX,GAAG8B,EACH,SAAU,EACZ,CAAC,EAEK+B,EAAmBzC,EAAM,EAAE,aAAawC,CAAQ,EAChDE,EAAUhC,GAAS,IAAMV,EAAM,EAAE,aAAaU,EAAQ,GAAM,EAAIN,EAAO,EACvEuC,KAAe,iBAAc,EAAApB,QAAK,SAASmB,EAASD,CAAgB,CAAC,EAC3E,OAAON,EAAM,SAASQ,CAAY,CACpC,CAoCA,eAAsBtD,EACpBmD,EACA9B,EACkB,CAClB,MAAMyB,EAAQ,MAAMpD,EAAiB,CACnC,UAAW,KACX,GAAG2B,EACH,SAAU,EACZ,CAAC,EAEK+B,EAAmBzC,EAAM,EAAE,aAAawC,CAAQ,EAChDE,EAAUhC,GAAS,IAAMV,EAAM,EAAE,aAAaU,EAAQ,GAAM,EAAIN,EAAO,EACvEuC,KAAe,iBAAc,EAAApB,QAAK,SAASmB,EAASD,CAAgB,CAAC,EAC3E,OAAON,EAAM,SAASQ,CAAY,CACpC,CAqCO,SAASrD,GACdkD,EACA9B,EACS,CACT,MAAMyB,EAAQnD,EAAqB,CACjC,UAAW,KACX,GAAG0B,EACH,SAAU,EACZ,CAAC,EAEK+B,EAAmBzC,EAAM,EAAE,aAAawC,CAAQ,EAChDE,EAAUhC,GAAS,IAAMV,EAAM,EAAE,aAAaU,EAAQ,GAAM,EAAIN,EAAO,EACvEuC,KAAe,iBAAc,EAAApB,QAAK,SAASmB,EAASD,CAAgB,CAAC,EAC3E,OAAON,EAAM,SAASQ,CAAY,CACpC,CAmCA,eAAsBxD,GACpBqD,EACA9B,EACkB,CAClB,MAAMyB,EAAQ,MAAMtD,EAAe,CACjC,UAAW,KACX,GAAG6B,EACH,SAAU,EACZ,CAAC,EAEK+B,EAAmBzC,EAAM,EAAE,aAAawC,CAAQ,EAChDE,EAAUhC,GAAS,IAAMV,EAAM,EAAE,aAAaU,EAAQ,GAAM,EAAIN,EAAO,EACvEuC,KAAe,iBAAc,EAAApB,QAAK,SAASmB,EAASD,CAAgB,CAAC,EAC3E,OAAON,EAAM,SAASQ,CAAY,CACpC,CAoCO,SAASvD,GACdoD,EACA9B,EACS,CACT,MAAMyB,EAAQrD,EAAmB,CAC/B,UAAW,KACX,GAAG4B,EACH,SAAU,EACZ,CAAC,EAEK+B,EAAmBzC,EAAM,EAAE,aAAawC,CAAQ,EAChDE,EAAUhC,GAAS,IAAMV,EAAM,EAAE,aAAaU,EAAQ,GAAM,EAAIN,EAAO,EACvEuC,KAAe,iBAAc,EAAApB,QAAK,SAASmB,EAASD,CAAgB,CAAC,EAC3E,OAAON,EAAM,SAASQ,CAAY,CACpC",
-  "names": ["git_exports", "__export", "findGitRoot", "getChangedFiles", "getChangedFilesSync", "getStagedFiles", "getStagedFilesSync", "getUnstagedFiles", "getUnstagedFilesSync", "isChanged", "isChangedSync", "isStaged", "isStagedSync", "isUnstaged", "isUnstagedSync", "__toCommonJS", "import_path", "import_platform", "import_debug", "import_globs", "import_spawn", "import_strings", "gitDiffCache", "_fs", "getFs", "_path", "getPath", "getGitPath", "getCwd", "getGitDiffSpawnArgs", "cwd", "resolvedCwd", "innerDiff", "args", "options", "cache", "parseOptions", "cacheKey", "result", "spawnResult", "stdout", "spawnCwd", "parseGitDiffStdout", "e", "innerDiffSync", "startPath", "fs", "path", "currentPath", "gitPath", "parentPath", "defaultRoot", "absolute", "cwdOption", "porcelain", "matcherOptions", "rootPath", "rawFiles", "line", "files", "relPath", "matcher", "filtered", "filepath", "pathname", "resolvedPathname", "baseCwd", "relativePath"]
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAiB;AAEjB,sBAAsB;AACtB,mBAAwB;AACxB,mBAA+B;AAC/B,IAAAA,eAA8B;AAC9B,mBAAiC;AACjC,qBAA0B;AAqH1B,MAAM,eAAe,oBAAI,IAAsB;AAE/C,IAAI;AAAA;AAgBJ,SAAS,QAAQ;AACf,MAAI,QAAQ,QAAW;AAGrB,UAAoB,QAAQ,SAAS;AAAA,EACvC;AACA,SAAO;AACT;AAEA,IAAI;AAAA;AAgBJ,SAAS,UAAU;AACjB,MAAI,UAAU,QAAW;AACvB,YAAsB,QAAQ,WAAW;AAAA,EAC3C;AACA,SAAO;AACT;AAiBA,SAAS,aAAqB;AAC5B,SAAO;AACT;AAkBA,SAAS,SAAiB;AACxB,UAAO,sBAAM,GAAE,aAAa,QAAQ,IAAI,CAAC;AAC3C;AAgBA,SAAS,oBAAoB,KAA4C;AACvE,QAAM,cAAc,OAAM,sBAAM,GAAE,aAAa,GAAG,IAAI,OAAO;AAC7D,SAAO;AAAA,IACL,KAAK;AAAA,MACH,WAAW;AAAA,MACX,CAAC,UAAU,aAAa;AAAA,MACxB;AAAA,QACE,KAAK;AAAA,QACL,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR,WAAW;AAAA,MACX,CAAC,QAAQ,aAAa;AAAA,MACtB;AAAA,QACE,KAAK;AAAA,MACP;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,CAAC,QAAQ,YAAY,aAAa;AAAA,MAClC;AAAA,QACE,KAAK;AAAA,QACL,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAYA,eAAe,UACb,MACA,SACmB;AACnB,QAAM,EAAE,QAAQ,MAAM,GAAG,aAAa,IAAI,EAAE,WAAW,MAAM,GAAG,QAAQ;AACxE,QAAM,WAAW,QAAQ,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC,IAAI;AAClE,MAAI,SAAS,UAAU;AACrB,UAAMC,UAAS,aAAa,IAAI,QAAQ;AACxC,QAAIA,SAAQ;AACV,aAAOA;AAAA,IACT;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AAEF,UAAM,cAAc,UAAM,oBAAM,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG;AAAA,MAChD,GAAG,KAAK,CAAC;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AACD,UAAM,SAAS,OAAO,SAAS,YAAY,MAAM,IAC7C,YAAY,OAAO,SAAS,MAAM,IAClC,OAAO,YAAY,MAAM;AAE7B,UAAM,WACJ,OAAO,KAAK,CAAC,EAAE,KAAK,MAAM,WAAW,KAAK,CAAC,EAAE,KAAK,IAAI;AACxD,aAAS,mBAAmB,QAAQ,cAAc,QAAQ;AAAA,EAC5D,SAAS,GAAG;AAMV;AAAA,MACE;AAAA,MACA,uBAAuB,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC,MAAO,EAAY,OAAO;AAAA,IAC/E;AACA,WAAO,CAAC;AAAA,EACV;AACA,MAAI,SAAS,UAAU;AACrB,iBAAa,IAAI,UAAU,MAAM;AAAA,EACnC;AACA,SAAO;AACT;AAYA,SAAS,cACP,MACA,SACU;AACV,QAAM,EAAE,QAAQ,MAAM,GAAG,aAAa,IAAI,EAAE,WAAW,MAAM,GAAG,QAAQ;AACxE,QAAM,WAAW,QAAQ,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC,IAAI;AAClE,MAAI,SAAS,UAAU;AACrB,UAAMA,UAAS,aAAa,IAAI,QAAQ;AACxC,QAAIA,SAAQ;AACV,aAAOA;AAAA,IACT;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AAEF,UAAM,kBAAc,wBAAU,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG;AAAA,MAC9C,GAAG,KAAK,CAAC;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AACD,UAAM,SAAS,OAAO,SAAS,YAAY,MAAM,IAC7C,YAAY,OAAO,SAAS,MAAM,IAClC,OAAO,YAAY,MAAM;AAE7B,UAAM,WACJ,OAAO,KAAK,CAAC,EAAE,KAAK,MAAM,WAAW,KAAK,CAAC,EAAE,KAAK,IAAI;AACxD,aAAS,mBAAmB,QAAQ,cAAc,QAAQ;AAAA,EAC5D,SAAS,GAAG;AAMV;AAAA,MACE;AAAA,MACA,uBAAuB,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC,MAAO,EAAY,OAAO;AAAA,IAC/E;AACA,WAAO,CAAC;AAAA,EACV;AACA,MAAI,SAAS,UAAU;AACrB,iBAAa,IAAI,UAAU,MAAM;AAAA,EACnC;AACA,SAAO;AACT;AAuBO,SAAS,YAAY,WAA2B;AACrD,QAAM,KAAK,sBAAM;AACjB,QAAMC,QAAO,wBAAQ;AACrB,MAAI,cAAc;AAElB,SAAO,MAAM;AACX,QAAI;AACF,YAAM,UAAUA,MAAK,KAAK,aAAa,MAAM;AAC7C,UAAI,GAAG,WAAW,OAAO,GAAG;AAC1B,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AAAA,IAER;AACA,UAAM,aAAaA,MAAK,QAAQ,WAAW;AAE3C,QAAI,eAAe,aAAa;AAE9B,aAAO;AAAA,IACT;AACA,kBAAc;AAAA,EAChB;AACF;AAqBA,SAAS,mBACP,QACA,SACA,UACU;AAGV,QAAM,cAAc,WAAW,YAAY,QAAQ,IAAI,OAAO;AAC9D,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,KAAK,YAAY;AAAA,IACjB,YAAY;AAAA,IACZ,GAAG;AAAA,EACL,IAAI,EAAE,WAAW,MAAM,GAAG,QAAQ;AAElC,QAAM,MACJ,cAAc,cAAc,eAAc,sBAAM,GAAE,aAAa,SAAS;AAC1E,QAAM,WAAW;AAEjB,MAAI,WAAW,aACX,0BAAU,MAAM,EACb,MAAM,IAAI,EACV,IAAI,UAAQ,KAAK,QAAQ,CAAC,EAC1B,OAAO,UAAQ,IAAI,IACtB,CAAC;AAIL,MAAI,WAAW;AACb,eAAW,SAAS,IAAI,UAAQ;AAE9B,aAAO,KAAK,SAAS,IAAI,KAAK,UAAU,CAAC,IAAI;AAAA,IAC/C,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,WACV,SAAS,IAAI,CAAAC,iBAAW,4BAAc,YAAAD,QAAK,KAAK,UAAUC,QAAO,CAAC,CAAC,IACnE,SAAS,IAAI,CAAAA,iBAAW,4BAAcA,QAAO,CAAC;AAClD,MAAI,QAAQ,UAAU;AACpB,WAAO;AAAA,EACT;AACA,QAAM,cAAU,4BAAc,YAAAD,QAAK,SAAS,UAAU,GAAG,CAAC;AAC1D,QAAM,cAAU,6BAAe,CAAC,GAAG,OAAO,KAAK,GAAG;AAAA,IAChD,GAAI;AAAA,IAKJ;AAAA,IACA,KAAK;AAAA,EACP,CAMC;AACD,QAAM,WAAqB,CAAC;AAC5B,aAAW,YAAY,OAAO;AAC5B,QAAI,QAAQ,QAAQ,GAAG;AACrB,eAAS,KAAK,QAAQ;AAAA,IACxB;AAAA,EACF;AACA,SAAO;AACT;AAwCA,eAAsB,gBACpB,SACmB;AACnB,QAAM,OAAO,oBAAoB,SAAS,GAAG,EAAE;AAC/C,SAAO,MAAM,UAAU,MAAM;AAAA,IAC3B,WAAW;AAAA,IACX,GAAG;AAAA,IACH,WAAW;AAAA,EACb,CAAC;AACH;AAwCO,SAAS,oBACd,SACU;AACV,QAAM,OAAO,oBAAoB,SAAS,GAAG,EAAE;AAC/C,SAAO,cAAc,MAAM;AAAA,IACzB,WAAW;AAAA,IACX,GAAG;AAAA,IACH,WAAW;AAAA,EACb,CAAC;AACH;AAgCA,eAAsB,iBACpB,SACmB;AACnB,QAAM,OAAO,oBAAoB,SAAS,GAAG,EAAE;AAC/C,SAAO,MAAM,UAAU,MAAM,OAAO;AACtC;AAgCO,SAAS,qBACd,SACU;AACV,QAAM,OAAO,oBAAoB,SAAS,GAAG,EAAE;AAC/C,SAAO,cAAc,MAAM,OAAO;AACpC;AAgCA,eAAsB,eACpB,SACmB;AACnB,QAAM,OAAO,oBAAoB,SAAS,GAAG,EAAE;AAC/C,SAAO,MAAM,UAAU,MAAM,OAAO;AACtC;AAgCO,SAAS,mBACd,SACU;AACV,QAAM,OAAO,oBAAoB,SAAS,GAAG,EAAE;AAC/C,SAAO,cAAc,MAAM,OAAO;AACpC;AAoCA,eAAsB,UACpB,UACA,SACkB;AAClB,QAAM,QAAQ,MAAM,gBAAgB;AAAA,IAClC,WAAW;AAAA,IACX,GAAG;AAAA,IACH,UAAU;AAAA,EACZ,CAAC;AAED,QAAM,oBAAmB,sBAAM,GAAE,aAAa,QAAQ;AACtD,QAAM,UAAU,SAAS,OAAM,sBAAM,GAAE,aAAa,QAAQ,KAAK,CAAC,IAAI,OAAO;AAC7E,QAAM,mBAAe,4BAAc,YAAAA,QAAK,SAAS,SAAS,gBAAgB,CAAC;AAC3E,SAAO,MAAM,SAAS,YAAY;AACpC;AAqCO,SAAS,cACd,UACA,SACS;AACT,QAAM,QAAQ,oBAAoB;AAAA,IAChC,WAAW;AAAA,IACX,GAAG;AAAA,IACH,UAAU;AAAA,EACZ,CAAC;AAED,QAAM,oBAAmB,sBAAM,GAAE,aAAa,QAAQ;AACtD,QAAM,UAAU,SAAS,OAAM,sBAAM,GAAE,aAAa,QAAQ,KAAK,CAAC,IAAI,OAAO;AAC7E,QAAM,mBAAe,4BAAc,YAAAA,QAAK,SAAS,SAAS,gBAAgB,CAAC;AAC3E,SAAO,MAAM,SAAS,YAAY;AACpC;AAoCA,eAAsB,WACpB,UACA,SACkB;AAClB,QAAM,QAAQ,MAAM,iBAAiB;AAAA,IACnC,WAAW;AAAA,IACX,GAAG;AAAA,IACH,UAAU;AAAA,EACZ,CAAC;AAED,QAAM,oBAAmB,sBAAM,GAAE,aAAa,QAAQ;AACtD,QAAM,UAAU,SAAS,OAAM,sBAAM,GAAE,aAAa,QAAQ,KAAK,CAAC,IAAI,OAAO;AAC7E,QAAM,mBAAe,4BAAc,YAAAA,QAAK,SAAS,SAAS,gBAAgB,CAAC;AAC3E,SAAO,MAAM,SAAS,YAAY;AACpC;AAqCO,SAAS,eACd,UACA,SACS;AACT,QAAM,QAAQ,qBAAqB;AAAA,IACjC,WAAW;AAAA,IACX,GAAG;AAAA,IACH,UAAU;AAAA,EACZ,CAAC;AAED,QAAM,oBAAmB,sBAAM,GAAE,aAAa,QAAQ;AACtD,QAAM,UAAU,SAAS,OAAM,sBAAM,GAAE,aAAa,QAAQ,KAAK,CAAC,IAAI,OAAO;AAC7E,QAAM,mBAAe,4BAAc,YAAAA,QAAK,SAAS,SAAS,gBAAgB,CAAC;AAC3E,SAAO,MAAM,SAAS,YAAY;AACpC;AAmCA,eAAsB,SACpB,UACA,SACkB;AAClB,QAAM,QAAQ,MAAM,eAAe;AAAA,IACjC,WAAW;AAAA,IACX,GAAG;AAAA,IACH,UAAU;AAAA,EACZ,CAAC;AAED,QAAM,oBAAmB,sBAAM,GAAE,aAAa,QAAQ;AACtD,QAAM,UAAU,SAAS,OAAM,sBAAM,GAAE,aAAa,QAAQ,KAAK,CAAC,IAAI,OAAO;AAC7E,QAAM,mBAAe,4BAAc,YAAAA,QAAK,SAAS,SAAS,gBAAgB,CAAC;AAC3E,SAAO,MAAM,SAAS,YAAY;AACpC;AAoCO,SAAS,aACd,UACA,SACS;AACT,QAAM,QAAQ,mBAAmB;AAAA,IAC/B,WAAW;AAAA,IACX,GAAG;AAAA,IACH,UAAU;AAAA,EACZ,CAAC;AAED,QAAM,oBAAmB,sBAAM,GAAE,aAAa,QAAQ;AACtD,QAAM,UAAU,SAAS,OAAM,sBAAM,GAAE,aAAa,QAAQ,KAAK,CAAC,IAAI,OAAO;AAC7E,QAAM,mBAAe,4BAAc,YAAAA,QAAK,SAAS,SAAS,gBAAgB,CAAC;AAC3E,SAAO,MAAM,SAAS,YAAY;AACpC;",
+  "names": ["import_path", "result", "path", "relPath"]
 }

package/dist/github.js

@@ -1,3 +1,204 @@
 /* Socket Lib - Built with esbuild */
-var l=Object.defineProperty;var A=Object.getOwnPropertyDescriptor;var R=Object.getOwnPropertyNames;var k=Object.prototype.hasOwnProperty;var x=(e,t)=>{for(var s in t)l(e,s,{get:t[s],enumerable:!0})},O=(e,t,s,i)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of R(t))!k.call(e,n)&&n!==s&&l(e,n,{get:()=>t[n],enumerable:!(i=A(t,n))||i.enumerable});return e};var S=e=>O(l({},"__esModule",{value:!0}),e);var F={};x(F,{cacheFetchGhsa:()=>U,clearRefCache:()=>E,fetchGhsaDetails:()=>_,fetchGitHub:()=>o,getGhsaUrl:()=>I,getGitHubToken:()=>m,getGitHubTokenFromGitConfig:()=>H,getGitHubTokenWithFallback:()=>P,resolveRefToSha:()=>D});module.exports=S(F);var y=require("./cache-with-ttl"),g=require("#env/github"),w=require("#env/socket-cli"),G=require("./http-request"),v=require("./spawn");const f="https://api.github.com",C=300*1e3;let c;function T(){return c===void 0&&(c=(0,y.createTtlCache)({memoize:!0,prefix:"github-refs",ttl:C})),c}function m(){return(0,g.getGithubToken)()||(0,g.getGhToken)()||(0,w.getSocketCliGithubToken)()||void 0}async function o(e,t){const s={__proto__:null,...t},i=s.token||m(),n={Accept:"application/vnd.github.v3+json","User-Agent":"socket-registry-github-client",...s.headers};i&&(n.Authorization=`Bearer ${i}`);const r=await(0,G.httpRequest)(e,{headers:n});if(!r.ok){if(r.status===403){const a=r.headers["x-ratelimit-remaining"];if((typeof a=="string"?a:a?.[0])==="0"){const u=r.headers["x-ratelimit-reset"],p=typeof u=="string"?u:u?.[0],h=p?new Date(Number(p)*1e3):void 0,d=new Error(`GitHub API rate limit exceeded${h?`. Resets at ${h.toLocaleString()}`:""}. Use GITHUB_TOKEN environment variable to increase rate limit.`);throw d.status=403,d.resetTime=h,d}}throw new Error(`GitHub API error ${r.status}: ${r.statusText}`)}return JSON.parse(r.body.toString("utf8"))}async function D(e,t,s,i){const n={__proto__:null,...i},r=`${e}/${t}@${s}`;return process.env.DISABLE_GITHUB_CACHE?await b(e,t,s,n):await T().getOrFetch(r,async()=>await b(e,t,s,n))}async function b(e,t,s,i){const n={token:i.token};try{const r=`${f}/repos/${e}/${t}/git/refs/tags/${s}`,a=await o(r,n);return a.object.type==="tag"?(await o(a.object.url,n)).object.sha:a.object.sha}catch{try{const r=`${f}/repos/${e}/${t}/git/refs/heads/${s}`;return(await o(r,n)).object.sha}catch{try{const r=`${f}/repos/${e}/${t}/commits/${s}`;return(await o(r,n)).sha}catch(r){throw new Error(`failed to resolve ref "${s}" for ${e}/${t}: ${r instanceof Error?r.message:String(r)}`)}}}}async function E(){c&&await c.clear({memoOnly:!0})}async function H(e){try{const t=await(0,v.spawn)("git",["config","github.token"],{...e,stdio:"pipe"});if(t.code===0&&t.stdout)return t.stdout.toString().trim()}catch{}}async function P(){return m()||await H()}function I(e){return`https://github.com/advisories/${e}`}async function _(e,t){const s=`https://api.github.com/advisories/${e}`,i=await o(s,t);return{ghsaId:i.ghsa_id,summary:i.summary,details:i.details,severity:i.severity,aliases:i.aliases||[],publishedAt:i.published_at,updatedAt:i.updated_at,withdrawnAt:i.withdrawn_at,references:i.references||[],vulnerabilities:i.vulnerabilities||[],cvss:i.cvss,cwes:i.cwes||[]}}async function U(e,t){const s=T(),i=`ghsa:${e}`;if(!process.env.DISABLE_GITHUB_CACHE){const r=await s.get(i);if(r)return JSON.parse(r)}const n=await _(e,t);return await s.set(i,JSON.stringify(n)),n}0&&(module.exports={cacheFetchGhsa,clearRefCache,fetchGhsaDetails,fetchGitHub,getGhsaUrl,getGitHubToken,getGitHubTokenFromGitConfig,getGitHubTokenWithFallback,resolveRefToSha});
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var github_exports = {};
+__export(github_exports, {
+  cacheFetchGhsa: () => cacheFetchGhsa,
+  clearRefCache: () => clearRefCache,
+  fetchGhsaDetails: () => fetchGhsaDetails,
+  fetchGitHub: () => fetchGitHub,
+  getGhsaUrl: () => getGhsaUrl,
+  getGitHubToken: () => getGitHubToken,
+  getGitHubTokenFromGitConfig: () => getGitHubTokenFromGitConfig,
+  getGitHubTokenWithFallback: () => getGitHubTokenWithFallback,
+  resolveRefToSha: () => resolveRefToSha
+});
+module.exports = __toCommonJS(github_exports);
+var import_cache_with_ttl = require("./cache-with-ttl");
+var import_github = require("#env/github");
+var import_socket_cli = require("#env/socket-cli");
+var import_http_request = require("./http-request");
+var import_spawn = require("./spawn");
+const GITHUB_API_BASE_URL = "https://api.github.com";
+const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1e3;
+let _githubCache;
+function getGithubCache() {
+  if (_githubCache === void 0) {
+    _githubCache = (0, import_cache_with_ttl.createTtlCache)({
+      memoize: true,
+      prefix: "github-refs",
+      ttl: DEFAULT_CACHE_TTL_MS
+    });
+  }
+  return _githubCache;
+}
+function getGitHubToken() {
+  return (0, import_github.getGithubToken)() || (0, import_github.getGhToken)() || (0, import_socket_cli.getSocketCliGithubToken)() || void 0;
+}
+async function fetchGitHub(url, options) {
+  const opts = { __proto__: null, ...options };
+  const token = opts.token || getGitHubToken();
+  const headers = {
+    Accept: "application/vnd.github.v3+json",
+    "User-Agent": "socket-registry-github-client",
+    ...opts.headers
+  };
+  if (token) {
+    headers["Authorization"] = `Bearer ${token}`;
+  }
+  const response = await (0, import_http_request.httpRequest)(url, { headers });
+  if (!response.ok) {
+    if (response.status === 403) {
+      const rateLimit = response.headers["x-ratelimit-remaining"];
+      const rateLimitStr = typeof rateLimit === "string" ? rateLimit : rateLimit?.[0];
+      if (rateLimitStr === "0") {
+        const resetTime = response.headers["x-ratelimit-reset"];
+        const resetTimeStr = typeof resetTime === "string" ? resetTime : resetTime?.[0];
+        const resetDate = resetTimeStr ? new Date(Number(resetTimeStr) * 1e3) : void 0;
+        const error = new Error(
+          `GitHub API rate limit exceeded${resetDate ? `. Resets at ${resetDate.toLocaleString()}` : ""}. Use GITHUB_TOKEN environment variable to increase rate limit.`
+        );
+        error.status = 403;
+        error.resetTime = resetDate;
+        throw error;
+      }
+    }
+    throw new Error(
+      `GitHub API error ${response.status}: ${response.statusText}`
+    );
+  }
+  return JSON.parse(response.body.toString("utf8"));
+}
+async function resolveRefToSha(owner, repo, ref, options) {
+  const opts = {
+    __proto__: null,
+    ...options
+  };
+  const cacheKey = `${owner}/${repo}@${ref}`;
+  if (process.env["DISABLE_GITHUB_CACHE"]) {
+    return await fetchRefSha(owner, repo, ref, opts);
+  }
+  const cache = getGithubCache();
+  return await cache.getOrFetch(cacheKey, async () => {
+    return await fetchRefSha(owner, repo, ref, opts);
+  });
+}
+async function fetchRefSha(owner, repo, ref, options) {
+  const fetchOptions = {
+    token: options.token
+  };
+  try {
+    const tagUrl = `${GITHUB_API_BASE_URL}/repos/${owner}/${repo}/git/refs/tags/${ref}`;
+    const tagData = await fetchGitHub(tagUrl, fetchOptions);
+    if (tagData.object.type === "tag") {
+      const tagObject = await fetchGitHub(
+        tagData.object.url,
+        fetchOptions
+      );
+      return tagObject.object.sha;
+    }
+    return tagData.object.sha;
+  } catch {
+    try {
+      const branchUrl = `${GITHUB_API_BASE_URL}/repos/${owner}/${repo}/git/refs/heads/${ref}`;
+      const branchData = await fetchGitHub(branchUrl, fetchOptions);
+      return branchData.object.sha;
+    } catch {
+      try {
+        const commitUrl = `${GITHUB_API_BASE_URL}/repos/${owner}/${repo}/commits/${ref}`;
+        const commitData = await fetchGitHub(
+          commitUrl,
+          fetchOptions
+        );
+        return commitData.sha;
+      } catch (e) {
+        throw new Error(
+          `failed to resolve ref "${ref}" for ${owner}/${repo}: ${e instanceof Error ? e.message : String(e)}`
+        );
+      }
+    }
+  }
+}
+async function clearRefCache() {
+  if (_githubCache) {
+    await _githubCache.clear({ memoOnly: true });
+  }
+}
+async function getGitHubTokenFromGitConfig(options) {
+  try {
+    const result = await (0, import_spawn.spawn)("git", ["config", "github.token"], {
+      ...options,
+      stdio: "pipe"
+    });
+    if (result.code === 0 && result.stdout) {
+      return result.stdout.toString().trim();
+    }
+  } catch {
+  }
+  return void 0;
+}
+async function getGitHubTokenWithFallback() {
+  return getGitHubToken() || await getGitHubTokenFromGitConfig();
+}
+function getGhsaUrl(ghsaId) {
+  return `https://github.com/advisories/${ghsaId}`;
+}
+async function fetchGhsaDetails(ghsaId, options) {
+  const url = `https://api.github.com/advisories/${ghsaId}`;
+  const data = await fetchGitHub(url, options);
+  return {
+    ghsaId: data.ghsa_id,
+    summary: data.summary,
+    details: data.details,
+    severity: data.severity,
+    aliases: data.aliases || [],
+    publishedAt: data.published_at,
+    updatedAt: data.updated_at,
+    withdrawnAt: data.withdrawn_at,
+    references: data.references || [],
+    vulnerabilities: data.vulnerabilities || [],
+    cvss: data.cvss,
+    cwes: data.cwes || []
+  };
+}
+async function cacheFetchGhsa(ghsaId, options) {
+  const cache = getGithubCache();
+  const key = `ghsa:${ghsaId}`;
+  if (!process.env["DISABLE_GITHUB_CACHE"]) {
+    const cached = await cache.get(key);
+    if (cached) {
+      return JSON.parse(cached);
+    }
+  }
+  const data = await fetchGhsaDetails(ghsaId, options);
+  await cache.set(key, JSON.stringify(data));
+  return data;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  cacheFetchGhsa,
+  clearRefCache,
+  fetchGhsaDetails,
+  fetchGitHub,
+  getGhsaUrl,
+  getGitHubToken,
+  getGitHubTokenFromGitConfig,
+  getGitHubTokenWithFallback,
+  resolveRefToSha
+});
 //# sourceMappingURL=github.js.map

package/dist/github.js.map

@@ -2,6 +2,6 @@
   "version": 3,
   "sources": ["../src/github.ts"],
   "sourcesContent": ["/**\n * @fileoverview GitHub utilities for Socket projects.\n * Provides GitHub API integration for repository operations.\n *\n * Authentication:\n * - getGitHubToken: Retrieve GitHub token from environment variables\n * - fetchGitHub: Authenticated GitHub API requests with rate limit handling\n *\n * Ref Resolution:\n * - resolveRefToSha: Convert tags/branches to commit SHAs (with memoization and persistent cache)\n * - clearRefCache: Clear the in-memory memoization cache\n *\n * Caching:\n * - Uses cacache for persistent storage with in-memory memoization\n * - Two-tier caching: in-memory (Map) for hot data, persistent (cacache) for durability\n * - Default TTL: 5 minutes\n * - Disable with DISABLE_GITHUB_CACHE env var\n *\n * Rate Limiting:\n * - Automatic rate limit detection and error messages\n * - Cache to minimize API calls\n */\n\nimport type { TtlCache } from './cache-with-ttl'\nimport { createTtlCache } from './cache-with-ttl'\nimport { getGhToken, getGithubToken } from '#env/github'\nimport { getSocketCliGithubToken } from '#env/socket-cli'\nimport { httpRequest } from './http-request'\nimport type { SpawnOptions } from './spawn'\nimport { spawn } from './spawn'\n\n// GitHub API base URL constant (inlined for coverage mode compatibility).\nconst GITHUB_API_BASE_URL = 'https://api.github.com'\n\n// 5 minutes.\nconst DEFAULT_CACHE_TTL_MS = 5 * 60 * 1000\n\n// Create TTL cache instance for GitHub ref resolution.\n// Uses cacache for persistent storage with in-memory memoization.\nlet _githubCache: TtlCache | undefined\n\n/**\n * Get or create the GitHub cache instance.\n * Lazy initializes the cache with default TTL and memoization enabled.\n * Used internally for caching GitHub API responses.\n *\n * @returns The singleton cache instance\n */\nfunction getGithubCache(): TtlCache {\n  if (_githubCache === undefined) {\n    _githubCache = createTtlCache({\n      memoize: true,\n      prefix: 'github-refs',\n      ttl: DEFAULT_CACHE_TTL_MS,\n    })\n  }\n  return _githubCache\n}\n\n/**\n * Options for GitHub API fetch requests.\n */\nexport interface GitHubFetchOptions {\n  /**\n   * GitHub authentication token.\n   * If not provided, will attempt to use token from environment variables.\n   */\n  token?: string | undefined\n  /**\n   * Additional HTTP headers to include in the request.\n   * Will be merged with default headers (Accept, User-Agent, Authorization).\n   */\n  headers?: Record<string, string> | undefined\n}\n\n/**\n * Error thrown when GitHub API rate limit is exceeded.\n * Extends the standard Error with additional rate limit information.\n */\nexport interface GitHubRateLimitError extends Error {\n  /** HTTP status code (always 403 for rate limit errors) */\n  status: number\n  /**\n   * Date when the rate limit will reset.\n   * Undefined if reset time is not available in response headers.\n   */\n  resetTime?: Date | undefined\n}\n\n/**\n * Get GitHub authentication token from environment variables.\n * Checks multiple environment variable names in priority order.\n *\n * Environment variables checked (in order):\n * 1. `GITHUB_TOKEN` - Standard GitHub token variable\n * 2. `GH_TOKEN` - Alternative GitHub CLI token variable\n * 3. `SOCKET_CLI_GITHUB_TOKEN` - Socket-specific token variable\n *\n * @returns The first available GitHub token, or `undefined` if none found\n *\n * @example\n * ```ts\n * const token = getGitHubToken()\n * if (!token) {\n *   console.warn('No GitHub token found')\n * }\n * ```\n */\nexport function getGitHubToken(): string | undefined {\n  return (\n    getGithubToken() || getGhToken() || getSocketCliGithubToken() || undefined\n  )\n}\n\n/**\n * Fetch data from GitHub API with automatic authentication and rate limit handling.\n * Makes authenticated requests to the GitHub REST API with proper error handling.\n *\n * Features:\n * - Automatic token injection from environment if not provided\n * - Rate limit detection with helpful error messages\n * - Standard GitHub API headers (Accept, User-Agent)\n * - JSON response parsing\n *\n * @template T - Expected response type (defaults to `unknown`)\n * @param url - Full GitHub API URL (e.g., 'https://api.github.com/repos/owner/repo')\n * @param options - Fetch options including token and custom headers\n * @returns Parsed JSON response of type `T`\n *\n * @throws {GitHubRateLimitError} When API rate limit is exceeded (status 403)\n * @throws {Error} For other API errors with status code and message\n *\n * @example\n * ```ts\n * // Fetch repository information\n * interface Repo {\n *   name: string\n *   full_name: string\n *   default_branch: string\n * }\n * const repo = await fetchGitHub<Repo>(\n *   'https://api.github.com/repos/owner/repo'\n * )\n * console.log(`Default branch: ${repo.default_branch}`)\n * ```\n *\n * @example\n * ```ts\n * // With custom token and headers\n * const data = await fetchGitHub(\n *   'https://api.github.com/user',\n *   {\n *     token: 'ghp_customtoken',\n *     headers: { 'X-Custom-Header': 'value' }\n *   }\n * )\n * ```\n *\n * @example\n * ```ts\n * // Handle rate limit errors\n * try {\n *   await fetchGitHub('https://api.github.com/repos/owner/repo')\n * } catch (error) {\n *   if (error.status === 403 && error.resetTime) {\n *     console.error(`Rate limited until ${error.resetTime}`)\n *   }\n * }\n * ```\n */\nexport async function fetchGitHub<T = unknown>(\n  url: string,\n  options?: GitHubFetchOptions | undefined,\n): Promise<T> {\n  const opts = { __proto__: null, ...options } as GitHubFetchOptions\n  const token = opts.token || getGitHubToken()\n\n  const headers: Record<string, string> = {\n    Accept: 'application/vnd.github.v3+json',\n    'User-Agent': 'socket-registry-github-client',\n    ...opts.headers,\n  }\n\n  if (token) {\n    headers['Authorization'] = `Bearer ${token}`\n  }\n\n  const response = await httpRequest(url, { headers })\n\n  if (!response.ok) {\n    if (response.status === 403) {\n      const rateLimit = response.headers['x-ratelimit-remaining']\n      const rateLimitStr =\n        typeof rateLimit === 'string' ? rateLimit : rateLimit?.[0]\n      if (rateLimitStr === '0') {\n        const resetTime = response.headers['x-ratelimit-reset']\n        const resetTimeStr =\n          typeof resetTime === 'string' ? resetTime : resetTime?.[0]\n        const resetDate = resetTimeStr\n          ? new Date(Number(resetTimeStr) * 1000)\n          : undefined\n        const error = new Error(\n          `GitHub API rate limit exceeded${resetDate ? `. Resets at ${resetDate.toLocaleString()}` : ''}. Use GITHUB_TOKEN environment variable to increase rate limit.`,\n        ) as GitHubRateLimitError\n        error.status = 403\n        error.resetTime = resetDate\n        throw error\n      }\n    }\n    throw new Error(\n      `GitHub API error ${response.status}: ${response.statusText}`,\n    )\n  }\n\n  return JSON.parse(response.body.toString('utf8')) as T\n}\n\n/**\n * GitHub ref object returned by the API.\n * Represents a git reference (tag or branch).\n */\nexport interface GitHubRef {\n  /** The object this ref points to */\n  object: {\n    /** SHA of the commit or tag object */\n    sha: string\n    /** Type of object ('commit' or 'tag') */\n    type: string\n    /** API URL to fetch the full object details */\n    url: string\n  }\n  /** Full ref path (e.g., 'refs/tags/v1.0.0' or 'refs/heads/main') */\n  ref: string\n  /** API URL for this ref */\n  url: string\n}\n\n/**\n * GitHub annotated tag object returned by the API.\n * Represents a git tag with metadata.\n */\nexport interface GitHubTag {\n  /** Tag annotation message */\n  message: string\n  /** The commit this tag points to */\n  object: {\n    /** SHA of the commit */\n    sha: string\n    /** Type of object (usually 'commit') */\n    type: string\n    /** API URL to fetch the commit details */\n    url: string\n  }\n  /** SHA of this tag object itself */\n  sha: string\n  /** Tag name (e.g., 'v1.0.0') */\n  tag: string\n  /**\n   * Information about who created the tag.\n   * Undefined for lightweight tags.\n   */\n  tagger?: {\n    /** Tag creation date in ISO 8601 format */\n    date: string\n    /** Tagger's email address */\n    email: string\n    /** Tagger's name */\n    name: string\n  }\n  /** API URL for this tag object */\n  url: string\n}\n\n/**\n * GitHub commit object returned by the API.\n * Represents a git commit with metadata.\n */\nexport interface GitHubCommit {\n  /** Full commit SHA */\n  sha: string\n  /** API URL for this commit */\n  url: string\n  /** Commit details */\n  commit: {\n    /** Commit message */\n    message: string\n    /** Author information */\n    author: {\n      /** Commit author date in ISO 8601 format */\n      date: string\n      /** Author's email address */\n      email: string\n      /** Author's name */\n      name: string\n    }\n  }\n}\n\n/**\n * Options for resolving git refs to commit SHAs.\n */\nexport interface ResolveRefOptions {\n  /**\n   * GitHub authentication token.\n   * If not provided, will attempt to use token from environment variables.\n   */\n  token?: string | undefined\n}\n\n/**\n * Resolve a git ref (tag, branch, or commit SHA) to its full commit SHA.\n * Handles tags (annotated and lightweight), branches, and commit SHAs.\n * Results are cached in-memory and on disk (with TTL) to minimize API calls.\n *\n * Resolution strategy:\n * 1. Try as a tag (refs/tags/{ref})\n * 2. If tag is annotated, dereference to get the commit SHA\n * 3. If not a tag, try as a branch (refs/heads/{ref})\n * 4. If not a branch, try as a commit SHA directly\n *\n * Caching behavior:\n * - In-memory cache (Map) for immediate lookups\n * - Persistent disk cache (cacache) for durability across runs\n * - Default TTL: 5 minutes\n * - Disable caching with `DISABLE_GITHUB_CACHE` env var\n *\n * @param owner - Repository owner (user or organization name)\n * @param repo - Repository name\n * @param ref - Git reference to resolve (tag name, branch name, or commit SHA)\n * @param options - Resolution options including authentication token\n * @returns The full commit SHA (40-character hex string)\n *\n * @throws {Error} When ref cannot be resolved after trying all strategies\n * @throws {GitHubRateLimitError} When API rate limit is exceeded\n *\n * @example\n * ```ts\n * // Resolve a tag to commit SHA\n * const sha = await resolveRefToSha('owner', 'repo', 'v1.0.0')\n * console.log(sha) // 'a1b2c3d4e5f6...'\n * ```\n *\n * @example\n * ```ts\n * // Resolve a branch to latest commit SHA\n * const sha = await resolveRefToSha('owner', 'repo', 'main')\n * console.log(sha) // Latest commit on main branch\n * ```\n *\n * @example\n * ```ts\n * // Resolve with custom token\n * const sha = await resolveRefToSha(\n *   'owner',\n *   'repo',\n *   'develop',\n *   { token: 'ghp_customtoken' }\n * )\n * ```\n *\n * @example\n * ```ts\n * // Commit SHA passes through unchanged (but validates it exists)\n * const sha = await resolveRefToSha('owner', 'repo', 'a1b2c3d4')\n * console.log(sha) // Full 40-char SHA\n * ```\n */\nexport async function resolveRefToSha(\n  owner: string,\n  repo: string,\n  ref: string,\n  options?: ResolveRefOptions | undefined,\n): Promise<string> {\n  const opts = {\n    __proto__: null,\n    ...options,\n  } as ResolveRefOptions\n\n  const cacheKey = `${owner}/${repo}@${ref}`\n\n  // Optionally disable cache.\n  if (process.env['DISABLE_GITHUB_CACHE']) {\n    return await fetchRefSha(owner, repo, ref, opts)\n  }\n\n  // Use TTL cache for persistent storage and in-memory memoization.\n  const cache = getGithubCache()\n  return await cache.getOrFetch(cacheKey, async () => {\n    return await fetchRefSha(owner, repo, ref, opts)\n  })\n}\n\n/**\n * Fetch the SHA for a git ref from GitHub API.\n * Internal helper that implements the multi-strategy ref resolution logic.\n * Tries tags, branches, and direct commit lookups in sequence.\n *\n * @param owner - Repository owner\n * @param repo - Repository name\n * @param ref - Git reference to resolve\n * @param options - Resolution options with authentication token\n * @returns The full commit SHA\n *\n * @throws {Error} When ref cannot be resolved after all strategies fail\n */\nasync function fetchRefSha(\n  owner: string,\n  repo: string,\n  ref: string,\n  options: ResolveRefOptions,\n): Promise<string> {\n  const fetchOptions: GitHubFetchOptions = {\n    token: options.token,\n  }\n\n  try {\n    // Try as a tag first.\n    const tagUrl = `${GITHUB_API_BASE_URL}/repos/${owner}/${repo}/git/refs/tags/${ref}`\n    const tagData = await fetchGitHub<GitHubRef>(tagUrl, fetchOptions)\n\n    // Tag might point to a tag object or directly to a commit.\n    if (tagData.object.type === 'tag') {\n      // Dereference the tag object to get the commit.\n      const tagObject = await fetchGitHub<GitHubTag>(\n        tagData.object.url,\n        fetchOptions,\n      )\n      return tagObject.object.sha\n    }\n    return tagData.object.sha\n  } catch {\n    // Not a tag, try as a branch.\n    try {\n      const branchUrl = `${GITHUB_API_BASE_URL}/repos/${owner}/${repo}/git/refs/heads/${ref}`\n      const branchData = await fetchGitHub<GitHubRef>(branchUrl, fetchOptions)\n      return branchData.object.sha\n    } catch {\n      // Try without refs/ prefix (for commit SHAs or other refs).\n      try {\n        const commitUrl = `${GITHUB_API_BASE_URL}/repos/${owner}/${repo}/commits/${ref}`\n        const commitData = await fetchGitHub<GitHubCommit>(\n          commitUrl,\n          fetchOptions,\n        )\n        return commitData.sha\n      } catch (e) {\n        throw new Error(\n          `failed to resolve ref \"${ref}\" for ${owner}/${repo}: ${e instanceof Error ? e.message : String(e)}`,\n        )\n      }\n    }\n  }\n}\n\n/**\n * Clear the ref resolution cache (in-memory only).\n * Clears the in-memory memoization cache without affecting the persistent disk cache.\n * Useful for testing or when you need fresh data from the API.\n *\n * Note: This only clears the in-memory cache. The persistent cacache storage\n * remains intact and will be used to rebuild the in-memory cache on next access.\n *\n * @returns Promise that resolves when cache is cleared\n *\n * @example\n * ```ts\n * // Clear cache to force fresh API calls\n * await clearRefCache()\n * const sha = await resolveRefToSha('owner', 'repo', 'main')\n * // This will hit the persistent cache or API, not in-memory cache\n * ```\n */\nexport async function clearRefCache(): Promise<void> {\n  if (_githubCache) {\n    await _githubCache.clear({ memoOnly: true })\n  }\n}\n\n/**\n * Get GitHub authentication token from git config.\n * Reads the `github.token` configuration value from git config.\n * This is a fallback method when environment variables don't contain a token.\n *\n * @param options - Spawn options for git command execution\n * @returns GitHub token from git config, or `undefined` if not configured\n *\n * @example\n * ```ts\n * const token = await getGitHubTokenFromGitConfig()\n * if (token) {\n *   console.log('Found token in git config')\n * }\n * ```\n *\n * @example\n * ```ts\n * // With custom working directory\n * const token = await getGitHubTokenFromGitConfig({\n *   cwd: '/path/to/repo'\n * })\n * ```\n */\nexport async function getGitHubTokenFromGitConfig(\n  options?: SpawnOptions | undefined,\n): Promise<string | undefined> {\n  try {\n    const result = await spawn('git', ['config', 'github.token'], {\n      ...options,\n      stdio: 'pipe',\n    })\n    if (result.code === 0 && result.stdout) {\n      return result.stdout.toString().trim()\n    }\n  } catch {\n    // Ignore errors - git config may not have token.\n  }\n  return undefined\n}\n\n/**\n * Get GitHub authentication token from all available sources.\n * Checks environment variables first, then falls back to git config.\n * This is the recommended way to get a GitHub token with maximum compatibility.\n *\n * Priority order:\n * 1. Environment variables (GITHUB_TOKEN, GH_TOKEN, SOCKET_CLI_GITHUB_TOKEN)\n * 2. Git config (github.token)\n *\n * @returns GitHub token from first available source, or `undefined` if none found\n *\n * @example\n * ```ts\n * const token = await getGitHubTokenWithFallback()\n * if (!token) {\n *   throw new Error('GitHub token required')\n * }\n * ```\n */\nexport async function getGitHubTokenWithFallback(): Promise<\n  string | undefined\n> {\n  return getGitHubToken() || (await getGitHubTokenFromGitConfig())\n}\n\n/**\n * GitHub Security Advisory (GHSA) details.\n * Represents a complete security advisory from GitHub's database.\n */\nexport interface GhsaDetails {\n  /** GHSA identifier (e.g., 'GHSA-xxxx-yyyy-zzzz') */\n  ghsaId: string\n  /** Short summary of the vulnerability */\n  summary: string\n  /** Detailed description of the vulnerability */\n  details: string\n  /** Severity level ('low', 'moderate', 'high', 'critical') */\n  severity: string\n  /** Alternative identifiers (CVE IDs, etc.) */\n  aliases: string[]\n  /** ISO 8601 timestamp when advisory was published */\n  publishedAt: string\n  /** ISO 8601 timestamp when advisory was last updated */\n  updatedAt: string\n  /**\n   * ISO 8601 timestamp when advisory was withdrawn.\n   * `null` if advisory is still active.\n   */\n  withdrawnAt: string | null\n  /** External reference URLs for more information */\n  references: Array<{ url: string }>\n  /** Affected packages and version ranges */\n  vulnerabilities: Array<{\n    /** Package information */\n    package: {\n      /** Ecosystem (e.g., 'npm', 'pip', 'maven') */\n      ecosystem: string\n      /** Package name */\n      name: string\n    }\n    /** Version range expression for vulnerable versions */\n    vulnerableVersionRange: string\n    /**\n     * First patched version that fixes the vulnerability.\n     * `null` if no patched version exists yet.\n     */\n    firstPatchedVersion: { identifier: string } | null\n  }>\n  /**\n   * CVSS (Common Vulnerability Scoring System) information.\n   * `null` if CVSS score is not available.\n   */\n  cvss: {\n    /** CVSS score (0.0-10.0) */\n    score: number\n    /** CVSS vector string describing the vulnerability characteristics */\n    vectorString: string\n  } | null\n  /** CWE (Common Weakness Enumeration) categories */\n  cwes: Array<{\n    /** CWE identifier (e.g., 'CWE-79') */\n    cweId: string\n    /** Human-readable CWE name */\n    name: string\n    /** Description of the weakness category */\n    description: string\n  }>\n}\n\n/**\n * Generate GitHub Security Advisory URL from GHSA ID.\n * Constructs the public advisory URL for a given GHSA identifier.\n *\n * @param ghsaId - GHSA identifier (e.g., 'GHSA-xxxx-yyyy-zzzz')\n * @returns Full URL to the advisory page\n *\n * @example\n * ```ts\n * const url = getGhsaUrl('GHSA-1234-5678-90ab')\n * console.log(url) // 'https://github.com/advisories/GHSA-1234-5678-90ab'\n * ```\n */\nexport function getGhsaUrl(ghsaId: string): string {\n  return `https://github.com/advisories/${ghsaId}`\n}\n\n/**\n * Fetch GitHub Security Advisory details from the API.\n * Retrieves complete advisory information including severity, affected packages,\n * CVSS scores, and CWE classifications.\n *\n * @param ghsaId - GHSA identifier to fetch (e.g., 'GHSA-xxxx-yyyy-zzzz')\n * @param options - Fetch options including authentication token\n * @returns Complete advisory details with normalized field names\n *\n * @throws {Error} If advisory cannot be found or API request fails\n * @throws {GitHubRateLimitError} When API rate limit is exceeded\n *\n * @example\n * ```ts\n * const advisory = await fetchGhsaDetails('GHSA-1234-5678-90ab')\n * console.log(`Severity: ${advisory.severity}`)\n * console.log(`Affects: ${advisory.vulnerabilities.length} packages`)\n * if (advisory.cvss) {\n *   console.log(`CVSS Score: ${advisory.cvss.score}`)\n * }\n * ```\n *\n * @example\n * ```ts\n * // Check if vulnerability is patched\n * const advisory = await fetchGhsaDetails('GHSA-xxxx-yyyy-zzzz')\n * for (const vuln of advisory.vulnerabilities) {\n *   if (vuln.firstPatchedVersion) {\n *     console.log(\n *       `Patched in ${vuln.package.name}@${vuln.firstPatchedVersion.identifier}`\n *     )\n *   }\n * }\n * ```\n */\nexport async function fetchGhsaDetails(\n  ghsaId: string,\n  options?: GitHubFetchOptions | undefined,\n): Promise<GhsaDetails> {\n  const url = `https://api.github.com/advisories/${ghsaId}`\n  const data = await fetchGitHub<{\n    aliases?: string[]\n    cvss: unknown\n    cwes?: Array<{ cweId: string; name: string; description: string }>\n    details: string\n    ghsa_id: string\n    published_at: string\n    references?: Array<{ url: string }>\n    severity: string\n    summary: string\n    updated_at: string\n    vulnerabilities?: Array<{\n      package: { ecosystem: string; name: string }\n      vulnerableVersionRange: string\n      firstPatchedVersion: { identifier: string } | null\n    }>\n    withdrawn_at: string\n  }>(url, options)\n\n  return {\n    ghsaId: data.ghsa_id,\n    summary: data.summary,\n    details: data.details,\n    severity: data.severity,\n    aliases: data.aliases || [],\n    publishedAt: data.published_at,\n    updatedAt: data.updated_at,\n    withdrawnAt: data.withdrawn_at,\n    references: data.references || [],\n    vulnerabilities: data.vulnerabilities || [],\n    cvss: data.cvss as { score: number; vectorString: string } | null,\n    cwes: data.cwes || [],\n  }\n}\n\n/**\n * Fetch GitHub Security Advisory details with caching.\n * Retrieves advisory information with two-tier caching (in-memory + persistent).\n * Cached results are stored with the default TTL (5 minutes).\n *\n * Caching behavior:\n * - Checks in-memory cache first for immediate response\n * - Falls back to persistent disk cache if not in memory\n * - Fetches from API only if not cached\n * - Stores result in both cache tiers\n * - Respects `DISABLE_GITHUB_CACHE` env var\n *\n * @param ghsaId - GHSA identifier to fetch\n * @param options - Fetch options including authentication token\n * @returns Complete advisory details\n *\n * @throws {Error} If advisory cannot be found or API request fails\n * @throws {GitHubRateLimitError} When API rate limit is exceeded\n *\n * @example\n * ```ts\n * // First call hits API\n * const advisory = await cacheFetchGhsa('GHSA-1234-5678-90ab')\n *\n * // Second call within 5 minutes returns cached data\n * const cached = await cacheFetchGhsa('GHSA-1234-5678-90ab')\n * ```\n *\n * @example\n * ```ts\n * // Disable caching for fresh data\n * process.env.DISABLE_GITHUB_CACHE = '1'\n * const advisory = await cacheFetchGhsa('GHSA-xxxx-yyyy-zzzz')\n * ```\n */\nexport async function cacheFetchGhsa(\n  ghsaId: string,\n  options?: GitHubFetchOptions | undefined,\n): Promise<GhsaDetails> {\n  const cache = getGithubCache()\n  const key = `ghsa:${ghsaId}`\n\n  // Check cache first.\n  if (!process.env['DISABLE_GITHUB_CACHE']) {\n    const cached = await cache.get(key)\n    if (cached) {\n      return JSON.parse(cached as string) as GhsaDetails\n    }\n  }\n\n  // Fetch and cache.\n  const data = await fetchGhsaDetails(ghsaId, options)\n  await cache.set(key, JSON.stringify(data))\n  return data\n}\n"],
-  "mappings": ";4ZAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,oBAAAE,EAAA,kBAAAC,EAAA,qBAAAC,EAAA,gBAAAC,EAAA,eAAAC,EAAA,mBAAAC,EAAA,gCAAAC,EAAA,+BAAAC,EAAA,oBAAAC,IAAA,eAAAC,EAAAX,GAwBA,IAAAY,EAA+B,4BAC/BC,EAA2C,uBAC3CC,EAAwC,2BACxCC,EAA4B,0BAE5BC,EAAsB,mBAGtB,MAAMC,EAAsB,yBAGtBC,EAAuB,IAAS,IAItC,IAAIC,EASJ,SAASC,GAA2B,CAClC,OAAID,IAAiB,SACnBA,KAAe,kBAAe,CAC5B,QAAS,GACT,OAAQ,cACR,IAAKD,CACP,CAAC,GAEIC,CACT,CAmDO,SAASZ,GAAqC,CACnD,SACE,kBAAe,MAAK,cAAW,MAAK,2BAAwB,GAAK,MAErE,CA0DA,eAAsBF,EACpBgB,EACAC,EACY,CACZ,MAAMC,EAAO,CAAE,UAAW,KAAM,GAAGD,CAAQ,EACrCE,EAAQD,EAAK,OAAShB,EAAe,EAErCkB,EAAkC,CACtC,OAAQ,iCACR,aAAc,gCACd,GAAGF,EAAK,OACV,EAEIC,IACFC,EAAQ,cAAmB,UAAUD,CAAK,IAG5C,MAAME,EAAW,QAAM,eAAYL,EAAK,CAAE,QAAAI,CAAQ,CAAC,EAEnD,GAAI,CAACC,EAAS,GAAI,CAChB,GAAIA,EAAS,SAAW,IAAK,CAC3B,MAAMC,EAAYD,EAAS,QAAQ,uBAAuB,EAG1D,IADE,OAAOC,GAAc,SAAWA,EAAYA,IAAY,CAAC,KACtC,IAAK,CACxB,MAAMC,EAAYF,EAAS,QAAQ,mBAAmB,EAChDG,EACJ,OAAOD,GAAc,SAAWA,EAAYA,IAAY,CAAC,EACrDE,EAAYD,EACd,IAAI,KAAK,OAAOA,CAAY,EAAI,GAAI,EACpC,OACEE,EAAQ,IAAI,MAChB,iCAAiCD,EAAY,eAAeA,EAAU,eAAe,CAAC,GAAK,EAAE,iEAC/F,EACA,MAAAC,EAAM,OAAS,IACfA,EAAM,UAAYD,EACZC,CACR,CACF,CACA,MAAM,IAAI,MACR,oBAAoBL,EAAS,MAAM,KAAKA,EAAS,UAAU,EAC7D,CACF,CAEA,OAAO,KAAK,MAAMA,EAAS,KAAK,SAAS,MAAM,CAAC,CAClD,CAwJA,eAAsBhB,EACpBsB,EACAC,EACAC,EACAZ,EACiB,CACjB,MAAMC,EAAO,CACX,UAAW,KACX,GAAGD,CACL,EAEMa,EAAW,GAAGH,CAAK,IAAIC,CAAI,IAAIC,CAAG,GAGxC,OAAI,QAAQ,IAAI,qBACP,MAAME,EAAYJ,EAAOC,EAAMC,EAAKX,CAAI,EAK1C,MADOH,EAAe,EACV,WAAWe,EAAU,SAC/B,MAAMC,EAAYJ,EAAOC,EAAMC,EAAKX,CAAI,CAChD,CACH,CAeA,eAAea,EACbJ,EACAC,EACAC,EACAZ,EACiB,CACjB,MAAMe,EAAmC,CACvC,MAAOf,EAAQ,KACjB,EAEA,GAAI,CAEF,MAAMgB,EAAS,GAAGrB,CAAmB,UAAUe,CAAK,IAAIC,CAAI,kBAAkBC,CAAG,GAC3EK,EAAU,MAAMlC,EAAuBiC,EAAQD,CAAY,EAGjE,OAAIE,EAAQ,OAAO,OAAS,OAER,MAAMlC,EACtBkC,EAAQ,OAAO,IACfF,CACF,GACiB,OAAO,IAEnBE,EAAQ,OAAO,GACxB,MAAQ,CAEN,GAAI,CACF,MAAMC,EAAY,GAAGvB,CAAmB,UAAUe,CAAK,IAAIC,CAAI,mBAAmBC,CAAG,GAErF,OADmB,MAAM7B,EAAuBmC,EAAWH,CAAY,GACrD,OAAO,GAC3B,MAAQ,CAEN,GAAI,CACF,MAAMI,EAAY,GAAGxB,CAAmB,UAAUe,CAAK,IAAIC,CAAI,YAAYC,CAAG,GAK9E,OAJmB,MAAM7B,EACvBoC,EACAJ,CACF,GACkB,GACpB,OAASK,EAAG,CACV,MAAM,IAAI,MACR,0BAA0BR,CAAG,SAASF,CAAK,IAAIC,CAAI,KAAKS,aAAa,MAAQA,EAAE,QAAU,OAAOA,CAAC,CAAC,EACpG,CACF,CACF,CACF,CACF,CAoBA,eAAsBvC,GAA+B,CAC/CgB,GACF,MAAMA,EAAa,MAAM,CAAE,SAAU,EAAK,CAAC,CAE/C,CA0BA,eAAsBX,EACpBc,EAC6B,CAC7B,GAAI,CACF,MAAMqB,EAAS,QAAM,SAAM,MAAO,CAAC,SAAU,cAAc,EAAG,CAC5D,GAAGrB,EACH,MAAO,MACT,CAAC,EACD,GAAIqB,EAAO,OAAS,GAAKA,EAAO,OAC9B,OAAOA,EAAO,OAAO,SAAS,EAAE,KAAK,CAEzC,MAAQ,CAER,CAEF,CAqBA,eAAsBlC,GAEpB,CACA,OAAOF,EAAe,GAAM,MAAMC,EAA4B,CAChE,CA+EO,SAASF,EAAWsC,EAAwB,CACjD,MAAO,iCAAiCA,CAAM,EAChD,CAqCA,eAAsBxC,EACpBwC,EACAtB,EACsB,CACtB,MAAMD,EAAM,qCAAqCuB,CAAM,GACjDC,EAAO,MAAMxC,EAiBhBgB,EAAKC,CAAO,EAEf,MAAO,CACL,OAAQuB,EAAK,QACb,QAASA,EAAK,QACd,QAASA,EAAK,QACd,SAAUA,EAAK,SACf,QAASA,EAAK,SAAW,CAAC,EAC1B,YAAaA,EAAK,aAClB,UAAWA,EAAK,WAChB,YAAaA,EAAK,aAClB,WAAYA,EAAK,YAAc,CAAC,EAChC,gBAAiBA,EAAK,iBAAmB,CAAC,EAC1C,KAAMA,EAAK,KACX,KAAMA,EAAK,MAAQ,CAAC,CACtB,CACF,CAqCA,eAAsB3C,EACpB0C,EACAtB,EACsB,CACtB,MAAMwB,EAAQ1B,EAAe,EACvB2B,EAAM,QAAQH,CAAM,GAG1B,GAAI,CAAC,QAAQ,IAAI,qBAAyB,CACxC,MAAMI,EAAS,MAAMF,EAAM,IAAIC,CAAG,EAClC,GAAIC,EACF,OAAO,KAAK,MAAMA,CAAgB,CAEtC,CAGA,MAAMH,EAAO,MAAMzC,EAAiBwC,EAAQtB,CAAO,EACnD,aAAMwB,EAAM,IAAIC,EAAK,KAAK,UAAUF,CAAI,CAAC,EAClCA,CACT",
-  "names": ["github_exports", "__export", "cacheFetchGhsa", "clearRefCache", "fetchGhsaDetails", "fetchGitHub", "getGhsaUrl", "getGitHubToken", "getGitHubTokenFromGitConfig", "getGitHubTokenWithFallback", "resolveRefToSha", "__toCommonJS", "import_cache_with_ttl", "import_github", "import_socket_cli", "import_http_request", "import_spawn", "GITHUB_API_BASE_URL", "DEFAULT_CACHE_TTL_MS", "_githubCache", "getGithubCache", "url", "options", "opts", "token", "headers", "response", "rateLimit", "resetTime", "resetTimeStr", "resetDate", "error", "owner", "repo", "ref", "cacheKey", "fetchRefSha", "fetchOptions", "tagUrl", "tagData", "branchUrl", "commitUrl", "e", "result", "ghsaId", "data", "cache", "key", "cached"]
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAwBA,4BAA+B;AAC/B,oBAA2C;AAC3C,wBAAwC;AACxC,0BAA4B;AAE5B,mBAAsB;AAGtB,MAAM,sBAAsB;AAG5B,MAAM,uBAAuB,IAAI,KAAK;AAItC,IAAI;AASJ,SAAS,iBAA2B;AAClC,MAAI,iBAAiB,QAAW;AAC9B,uBAAe,sCAAe;AAAA,MAC5B,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,KAAK;AAAA,IACP,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAmDO,SAAS,iBAAqC;AACnD,aACE,8BAAe,SAAK,0BAAW,SAAK,2CAAwB,KAAK;AAErE;AA0DA,eAAsB,YACpB,KACA,SACY;AACZ,QAAM,OAAO,EAAE,WAAW,MAAM,GAAG,QAAQ;AAC3C,QAAM,QAAQ,KAAK,SAAS,eAAe;AAE3C,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,GAAG,KAAK;AAAA,EACV;AAEA,MAAI,OAAO;AACT,YAAQ,eAAe,IAAI,UAAU,KAAK;AAAA,EAC5C;AAEA,QAAM,WAAW,UAAM,iCAAY,KAAK,EAAE,QAAQ,CAAC;AAEnD,MAAI,CAAC,SAAS,IAAI;AAChB,QAAI,SAAS,WAAW,KAAK;AAC3B,YAAM,YAAY,SAAS,QAAQ,uBAAuB;AAC1D,YAAM,eACJ,OAAO,cAAc,WAAW,YAAY,YAAY,CAAC;AAC3D,UAAI,iBAAiB,KAAK;AACxB,cAAM,YAAY,SAAS,QAAQ,mBAAmB;AACtD,cAAM,eACJ,OAAO,cAAc,WAAW,YAAY,YAAY,CAAC;AAC3D,cAAM,YAAY,eACd,IAAI,KAAK,OAAO,YAAY,IAAI,GAAI,IACpC;AACJ,cAAM,QAAQ,IAAI;AAAA,UAChB,iCAAiC,YAAY,eAAe,UAAU,eAAe,CAAC,KAAK,EAAE;AAAA,QAC/F;AACA,cAAM,SAAS;AACf,cAAM,YAAY;AAClB,cAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,oBAAoB,SAAS,MAAM,KAAK,SAAS,UAAU;AAAA,IAC7D;AAAA,EACF;AAEA,SAAO,KAAK,MAAM,SAAS,KAAK,SAAS,MAAM,CAAC;AAClD;AAwJA,eAAsB,gBACpB,OACA,MACA,KACA,SACiB;AACjB,QAAM,OAAO;AAAA,IACX,WAAW;AAAA,IACX,GAAG;AAAA,EACL;AAEA,QAAM,WAAW,GAAG,KAAK,IAAI,IAAI,IAAI,GAAG;AAGxC,MAAI,QAAQ,IAAI,sBAAsB,GAAG;AACvC,WAAO,MAAM,YAAY,OAAO,MAAM,KAAK,IAAI;AAAA,EACjD;AAGA,QAAM,QAAQ,eAAe;AAC7B,SAAO,MAAM,MAAM,WAAW,UAAU,YAAY;AAClD,WAAO,MAAM,YAAY,OAAO,MAAM,KAAK,IAAI;AAAA,EACjD,CAAC;AACH;AAeA,eAAe,YACb,OACA,MACA,KACA,SACiB;AACjB,QAAM,eAAmC;AAAA,IACvC,OAAO,QAAQ;AAAA,EACjB;AAEA,MAAI;AAEF,UAAM,SAAS,GAAG,mBAAmB,UAAU,KAAK,IAAI,IAAI,kBAAkB,GAAG;AACjF,UAAM,UAAU,MAAM,YAAuB,QAAQ,YAAY;AAGjE,QAAI,QAAQ,OAAO,SAAS,OAAO;AAEjC,YAAM,YAAY,MAAM;AAAA,QACtB,QAAQ,OAAO;AAAA,QACf;AAAA,MACF;AACA,aAAO,UAAU,OAAO;AAAA,IAC1B;AACA,WAAO,QAAQ,OAAO;AAAA,EACxB,QAAQ;AAEN,QAAI;AACF,YAAM,YAAY,GAAG,mBAAmB,UAAU,KAAK,IAAI,IAAI,mBAAmB,GAAG;AACrF,YAAM,aAAa,MAAM,YAAuB,WAAW,YAAY;AACvE,aAAO,WAAW,OAAO;AAAA,IAC3B,QAAQ;AAEN,UAAI;AACF,cAAM,YAAY,GAAG,mBAAmB,UAAU,KAAK,IAAI,IAAI,YAAY,GAAG;AAC9E,cAAM,aAAa,MAAM;AAAA,UACvB;AAAA,UACA;AAAA,QACF;AACA,eAAO,WAAW;AAAA,MACpB,SAAS,GAAG;AACV,cAAM,IAAI;AAAA,UACR,0BAA0B,GAAG,SAAS,KAAK,IAAI,IAAI,KAAK,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,QACpG;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAoBA,eAAsB,gBAA+B;AACnD,MAAI,cAAc;AAChB,UAAM,aAAa,MAAM,EAAE,UAAU,KAAK,CAAC;AAAA,EAC7C;AACF;AA0BA,eAAsB,4BACpB,SAC6B;AAC7B,MAAI;AACF,UAAM,SAAS,UAAM,oBAAM,OAAO,CAAC,UAAU,cAAc,GAAG;AAAA,MAC5D,GAAG;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AACD,QAAI,OAAO,SAAS,KAAK,OAAO,QAAQ;AACtC,aAAO,OAAO,OAAO,SAAS,EAAE,KAAK;AAAA,IACvC;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAqBA,eAAsB,6BAEpB;AACA,SAAO,eAAe,KAAM,MAAM,4BAA4B;AAChE;AA+EO,SAAS,WAAW,QAAwB;AACjD,SAAO,iCAAiC,MAAM;AAChD;AAqCA,eAAsB,iBACpB,QACA,SACsB;AACtB,QAAM,MAAM,qCAAqC,MAAM;AACvD,QAAM,OAAO,MAAM,YAiBhB,KAAK,OAAO;AAEf,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf,SAAS,KAAK,WAAW,CAAC;AAAA,IAC1B,aAAa,KAAK;AAAA,IAClB,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,YAAY,KAAK,cAAc,CAAC;AAAA,IAChC,iBAAiB,KAAK,mBAAmB,CAAC;AAAA,IAC1C,MAAM,KAAK;AAAA,IACX,MAAM,KAAK,QAAQ,CAAC;AAAA,EACtB;AACF;AAqCA,eAAsB,eACpB,QACA,SACsB;AACtB,QAAM,QAAQ,eAAe;AAC7B,QAAM,MAAM,QAAQ,MAAM;AAG1B,MAAI,CAAC,QAAQ,IAAI,sBAAsB,GAAG;AACxC,UAAM,SAAS,MAAM,MAAM,IAAI,GAAG;AAClC,QAAI,QAAQ;AACV,aAAO,KAAK,MAAM,MAAgB;AAAA,IACpC;AAAA,EACF;AAGA,QAAM,OAAO,MAAM,iBAAiB,QAAQ,OAAO;AACnD,QAAM,MAAM,IAAI,KAAK,KAAK,UAAU,IAAI,CAAC;AACzC,SAAO;AACT;",
+  "names": []
 }

package/dist/globs.js

@@ -1,3 +1,151 @@
 /* Socket Lib - Built with esbuild */
-var p=Object.defineProperty;var d=Object.getOwnPropertyDescriptor;var h=Object.getOwnPropertyNames;var y=Object.prototype.hasOwnProperty;var _=(t,o)=>{for(var n in o)p(t,n,{get:o[n],enumerable:!0})},O=(t,o,n,r)=>{if(o&&typeof o=="object"||typeof o=="function")for(let e of h(o))!y.call(t,e)&&e!==n&&p(t,e,{get:()=>o[e],enumerable:!(r=d(o,e))||r.enumerable});return t};var S=t=>O(p({},"__esModule",{value:!0}),t);var L={};_(L,{defaultIgnore:()=>m,getGlobMatcher:()=>w,globStreamLicenses:()=>v});module.exports=S(L);var u=require("./objects");const m=(0,u.objectFreeze)(["**/.git","**/.npmrc","**/node_modules","**/.DS_Store","**/.gitignore","**/.hg","**/.lock-wscript","**/.npmignore","**/.svn","**/.wafpickle-*","**/.*.swp","**/._*/**","**/archived-packages/**","**/build/config.gypi","**/CVS","**/npm-debug.log","**/*.orig","**/.env","**/.eslintcache","**/.nvm","**/.tap","**/.vscode","**/*.tsbuildinfo","**/Thumbs.db","**/bower_components"]);let b;function E(){return b===void 0&&(b=require("./external/picomatch")),b}let g;function G(){if(g===void 0){const t=require("./external/fast-glob");g="default"in t?t.default:t}return g}function v(t,o){const{ignore:n,ignoreOriginals:r,recursive:e,...i}={__proto__:null,...o},a=[...Array.isArray(n)?n:m,"**/*.{cjs,cts,js,json,mjs,mts,ts}"];if(r){const{LICENSE_ORIGINAL_GLOB_RECURSIVE:s}=require("#constants/paths");a.push(s)}const c=G(),l=require("#constants/paths");return c.globStream([e?l.LICENSE_GLOB_RECURSIVE:l.LICENSE_GLOB],{__proto__:null,absolute:!0,caseSensitiveMatch:!1,cwd:t,...i,...a?{ignore:a}:{}})}const f=new Map;function w(t,o){const n=Array.isArray(t)?t:[t],r=JSON.stringify({patterns:n,options:o});let e=f.get(r);if(e)return e;const i=n.filter(s=>!s.startsWith("!")),a=n.filter(s=>s.startsWith("!")).map(s=>s.slice(1)),c=E(),l={dot:!0,nocase:!0,...o,...a.length>0?{ignore:a}:{}};return e=c(i.length>0?i:n,l),f.set(r,e),e}0&&(module.exports={defaultIgnore,getGlobMatcher,globStreamLicenses});
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var globs_exports = {};
+__export(globs_exports, {
+  defaultIgnore: () => defaultIgnore,
+  getGlobMatcher: () => getGlobMatcher,
+  globStreamLicenses: () => globStreamLicenses
+});
+module.exports = __toCommonJS(globs_exports);
+var import_objects = require("./objects");
+const defaultIgnore = (0, import_objects.objectFreeze)([
+  // Most of these ignored files can be included specifically if included in the
+  // files globs. Exceptions to this are:
+  // https://docs.npmjs.com/cli/v10/configuring-npm/package-json#files
+  // These can NOT be included.
+  // https://github.com/npm/npm-packlist/blob/v10.0.0/lib/index.js#L280
+  "**/.git",
+  "**/.npmrc",
+  // '**/bun.lockb?',
+  "**/node_modules",
+  // '**/package-lock.json',
+  // '**/pnpm-lock.ya?ml',
+  // '**/yarn.lock',
+  // Include npm-packlist defaults:
+  // https://github.com/npm/npm-packlist/blob/v10.0.0/lib/index.js#L15-L38
+  "**/.DS_Store",
+  "**/.gitignore",
+  "**/.hg",
+  "**/.lock-wscript",
+  "**/.npmignore",
+  "**/.svn",
+  "**/.wafpickle-*",
+  "**/.*.swp",
+  "**/._*/**",
+  "**/archived-packages/**",
+  "**/build/config.gypi",
+  "**/CVS",
+  "**/npm-debug.log",
+  "**/*.orig",
+  // Inline generic socket-registry .gitignore entries.
+  "**/.env",
+  "**/.eslintcache",
+  "**/.nvm",
+  "**/.tap",
+  "**/.vscode",
+  "**/*.tsbuildinfo",
+  "**/Thumbs.db",
+  // Inline additional ignores.
+  "**/bower_components"
+]);
+let _picomatch;
+// @__NO_SIDE_EFFECTS__
+function getPicomatch() {
+  if (_picomatch === void 0) {
+    _picomatch = require("./external/picomatch");
+  }
+  return _picomatch;
+}
+let _fastGlob;
+// @__NO_SIDE_EFFECTS__
+function getFastGlob() {
+  if (_fastGlob === void 0) {
+    const globExport = require("./external/fast-glob");
+    _fastGlob = "default" in globExport ? globExport.default : globExport;
+  }
+  return _fastGlob;
+}
+// @__NO_SIDE_EFFECTS__
+function globStreamLicenses(dirname, options) {
+  const {
+    ignore: ignoreOpt,
+    ignoreOriginals,
+    recursive,
+    ...globOptions
+  } = { __proto__: null, ...options };
+  const ignore = [
+    ...Array.isArray(ignoreOpt) ? ignoreOpt : defaultIgnore,
+    "**/*.{cjs,cts,js,json,mjs,mts,ts}"
+  ];
+  if (ignoreOriginals) {
+    const { LICENSE_ORIGINAL_GLOB_RECURSIVE } = (
+      /*@__INLINE__*/
+      require("#constants/paths")
+    );
+    ignore.push(LICENSE_ORIGINAL_GLOB_RECURSIVE);
+  }
+  const fastGlob = /* @__PURE__ */ getFastGlob();
+  const paths = (
+    /*@__INLINE__*/
+    require("#constants/paths")
+  );
+  return fastGlob.globStream(
+    [recursive ? paths.LICENSE_GLOB_RECURSIVE : paths.LICENSE_GLOB],
+    {
+      __proto__: null,
+      absolute: true,
+      caseSensitiveMatch: false,
+      cwd: dirname,
+      ...globOptions,
+      ...ignore ? { ignore } : {}
+    }
+  );
+}
+const matcherCache = /* @__PURE__ */ new Map();
+// @__NO_SIDE_EFFECTS__
+function getGlobMatcher(glob, options) {
+  const patterns = Array.isArray(glob) ? glob : [glob];
+  const key = JSON.stringify({ patterns, options });
+  let matcher = matcherCache.get(key);
+  if (matcher) {
+    return matcher;
+  }
+  const positivePatterns = patterns.filter((p) => !p.startsWith("!"));
+  const negativePatterns = patterns.filter((p) => p.startsWith("!")).map((p) => p.slice(1));
+  const picomatch = /* @__PURE__ */ getPicomatch();
+  const matchOptions = {
+    dot: true,
+    nocase: true,
+    ...options,
+    ...negativePatterns.length > 0 ? { ignore: negativePatterns } : {}
+  };
+  matcher = picomatch(
+    positivePatterns.length > 0 ? positivePatterns : patterns,
+    matchOptions
+  );
+  matcherCache.set(key, matcher);
+  return matcher;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  defaultIgnore,
+  getGlobMatcher,
+  globStreamLicenses
+});
 //# sourceMappingURL=globs.js.map