@socketsecurity/lib 5.27.0 → 6.0.0

package/dist/{debug.d.ts → debug/output.d.ts}

@@ -1,23 +1,12 @@
 /**
- * @fileoverview Debug logging utilities with lazy loading and environment-based control.
- * Provides Socket CLI specific debug functionality and logging formatters.
+ * @file Output entrypoints — `debug` / `debugCache` / `debugDir` / `debugLog`
+ *   and their `*Ns` namespace variants, plus `debuglog` (node-util-compatible)
+ *   and `debugtime` (start/end timers). Each output function gates through
+ *   `isEnabled`, prefixes the caller name from `getCallerInfo`, pauses any
+ *   active spinner across the write, and uses the lazy `pointingTriangle` glyph
+ *   for the divider.
  */
-interface DebugOptions {
-    namespaces?: string;
-    spinner?: {
-        isSpinning: boolean;
-        stop(): void;
-        start(): void;
-    };
-    [key: string]: unknown;
-}
-type NamespacesOrOptions = string | DebugOptions;
-interface InspectOptions {
-    depth?: number | null;
-    colors?: boolean;
-    [key: string]: unknown;
-}
-export type { DebugOptions, NamespacesOrOptions, InspectOptions };
+import type { InspectOptions, NamespacesOrOptions } from './types';
 /**
  * Debug output with caller info (wrapper for debugNs with default namespace).
  */
@@ -26,21 +15,21 @@ export declare function debug(...args: unknown[]): void;
  * Cache debug function with caller info.
  *
  * @example
- * ```typescript
- * debugCache('hit', 'socket-sdk:scans:abc123')
- * debugCache('miss', 'socket-sdk:scans:xyz', { ttl: 60000 })
- * ```
+ *   ;```typescript
+ *   debugCache('hit', 'socket-sdk:scans:abc123')
+ *   debugCache('miss', 'socket-sdk:scans:xyz', { ttl: 60000 })
+ *   ```
  */
 export declare function debugCache(operation: string, key: string, meta?: unknown | undefined): void;
 /**
- * Debug output for cache operations with caller info.
- * First argument is the operation type (hit/miss/set/clear).
- * Second argument is the cache key or message.
- * Optional third argument is metadata object.
+ * Debug output for cache operations with caller info. First argument is the
+ * operation type (hit/miss/set/clear). Second argument is the cache key or
+ * message. Optional third argument is metadata object.
  */
 export declare function debugCacheNs(namespacesOrOpts: NamespacesOrOptions, operation: string, key: string, meta?: unknown | undefined): void;
 /**
- * Debug output for object inspection (wrapper for debugDirNs with default namespace).
+ * Debug output for object inspection (wrapper for debugDirNs with default
+ * namespace).
  */
 export declare function debugDir(obj: unknown, inspectOpts?: InspectOptions | undefined): void;
 /**
@@ -55,29 +44,21 @@ export declare function debugLog(...args: unknown[]): void;
  * Debug logging function with caller info.
  */
 export declare function debugLogNs(namespacesOrOpts: NamespacesOrOptions, ...args: unknown[]): void;
-/**
- * Create a Node.js util.debuglog compatible function.
- * Returns a function that conditionally writes debug messages to stderr.
- */
-export declare function debuglog(section: string): import("util").DebugLogger;
 /**
  * Debug output with caller info.
  */
 export declare function debugNs(namespacesOrOpts: NamespacesOrOptions, ...args: unknown[]): void;
 /**
- * Create timing functions for measuring code execution time.
- * Returns an object with start() and end() methods, plus a callable function.
+ * Create a Node.js util.debuglog compatible function. Returns a function that
+ * conditionally writes debug messages to stderr.
+ */
+export declare function debuglog(section: string): import("util").DebugLogger;
+/**
+ * Create timing functions for measuring code execution time. Returns an object
+ * with start() and end() methods, plus a callable function.
  */
 export declare function debugtime(label: string): {
     (): void;
     start: () => void;
     end: () => void;
 };
-/**
- * Check if debug mode is enabled.
- */
-export declare function isDebug(): boolean;
-/**
- * Check if debug mode is enabled.
- */
-export declare function isDebugNs(namespaces: string | undefined): boolean;

package/dist/debug/output.js

@@ -0,0 +1,209 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var output_exports = {};
+__export(output_exports, {
+  debug: () => debug,
+  debugCache: () => debugCache,
+  debugCacheNs: () => debugCacheNs,
+  debugDir: () => debugDir,
+  debugDirNs: () => debugDirNs,
+  debugLog: () => debugLog,
+  debugLogNs: () => debugLogNs,
+  debugNs: () => debugNs,
+  debuglog: () => debuglog,
+  debugtime: () => debugtime
+});
+module.exports = __toCommonJS(output_exports);
+var import_debug = __toESM(require("../external/debug"));
+var import_array = require("../primordials/array");
+var import_date = require("../primordials/date");
+var import_reflect = require("../primordials/reflect");
+var import_registry = require("../spinner/registry");
+var import_format = require("../strings/format");
+var import_internal = require("./_internal");
+var import_caller_info = require("./caller-info");
+var import_namespace = require("./namespace");
+var import_socket = require("../env/socket");
+function debug(...args) {
+  debugNs("*", ...args);
+}
+// @__NO_SIDE_EFFECTS__
+function debugCache(operation, key, meta) {
+  if (!(0, import_socket.getSocketDebug)()) {
+    return;
+  }
+  const callerName = (0, import_caller_info.getCallerInfo)(3) || "cache";
+  const pointingTriangle = (0, import_internal.getPointingTriangle)();
+  const prefix = `[CACHE] ${callerName} ${pointingTriangle} ${operation}: ${key}`;
+  const args = meta !== void 0 ? [prefix, meta] : [prefix];
+  (0, import_reflect.ReflectApply)(import_internal.logger.info, import_internal.logger, args);
+}
+function debugCacheNs(namespacesOrOpts, operation, key, meta) {
+  const options = (0, import_namespace.extractOptions)(namespacesOrOpts);
+  const { namespaces } = options;
+  if (!(0, import_namespace.isEnabled)(namespaces)) {
+    return;
+  }
+  const callerName = (0, import_caller_info.getCallerInfo)(4) || "cache";
+  const pointingTriangle = (0, import_internal.getPointingTriangle)();
+  const prefix = `[CACHE] ${callerName} ${pointingTriangle} ${operation}: ${key}`;
+  const logArgs = meta !== void 0 ? [prefix, meta] : [prefix];
+  const spinnerInstance = options.spinner || (0, import_registry.getDefaultSpinner)();
+  const wasSpinning = spinnerInstance?.isSpinning;
+  spinnerInstance?.stop();
+  (0, import_reflect.ReflectApply)(import_internal.logger.info, import_internal.logger, logArgs);
+  if (wasSpinning) {
+    spinnerInstance?.start();
+  }
+}
+function debugDir(obj, inspectOpts) {
+  debugDirNs("*", obj, inspectOpts);
+}
+function debugDirNs(namespacesOrOpts, obj, inspectOpts) {
+  const options = (0, import_namespace.extractOptions)(namespacesOrOpts);
+  const { namespaces } = options;
+  if (!(0, import_namespace.isEnabled)(namespaces)) {
+    return;
+  }
+  const callerName = (0, import_caller_info.getCallerInfo)(4) || "anonymous";
+  const pointingTriangle = (0, import_internal.getPointingTriangle)();
+  let opts = inspectOpts;
+  if (opts === void 0) {
+    const debugOpts = import_debug.default.inspectOpts;
+    if (debugOpts) {
+      opts = {
+        ...debugOpts,
+        showHidden: debugOpts.showHidden === null ? void 0 : debugOpts.showHidden,
+        depth: debugOpts.depth === null || typeof debugOpts.depth === "boolean" ? void 0 : debugOpts.depth
+      };
+    }
+  }
+  const spinnerInstance = options.spinner || (0, import_registry.getDefaultSpinner)();
+  const wasSpinning = spinnerInstance?.isSpinning;
+  spinnerInstance?.stop();
+  import_internal.logger.info(`[DEBUG] ${callerName} ${pointingTriangle} object inspection:`);
+  import_internal.logger.dir(obj, inspectOpts);
+  if (wasSpinning) {
+    spinnerInstance?.start();
+  }
+}
+function debugLog(...args) {
+  debugLogNs("*", ...args);
+}
+function debugLogNs(namespacesOrOpts, ...args) {
+  const options = (0, import_namespace.extractOptions)(namespacesOrOpts);
+  const { namespaces } = options;
+  if (!(0, import_namespace.isEnabled)(namespaces)) {
+    return;
+  }
+  const callerName = (0, import_caller_info.getCallerInfo)(4) || "anonymous";
+  const pointingTriangle = (0, import_internal.getPointingTriangle)();
+  const text = (0, import_array.ArrayPrototypeAt)(args, 0);
+  const logArgs = typeof text === "string" ? [
+    (0, import_format.applyLinePrefix)(`${callerName} ${pointingTriangle} ${text}`, {
+      prefix: "[DEBUG] "
+    }),
+    ...(0, import_array.ArrayPrototypeSlice)(args, 1)
+  ] : [`[DEBUG] ${callerName} ${pointingTriangle}`, ...args];
+  const spinnerInstance = options.spinner || (0, import_registry.getDefaultSpinner)();
+  const wasSpinning = spinnerInstance?.isSpinning;
+  spinnerInstance?.stop();
+  (0, import_reflect.ReflectApply)(import_internal.logger.info, import_internal.logger, logArgs);
+  if (wasSpinning) {
+    spinnerInstance?.start();
+  }
+}
+function debugNs(namespacesOrOpts, ...args) {
+  const options = (0, import_namespace.extractOptions)(namespacesOrOpts);
+  const { namespaces } = options;
+  if (!(0, import_namespace.isEnabled)(namespaces)) {
+    return;
+  }
+  const name = (0, import_caller_info.getCallerInfo)(4) || "anonymous";
+  const pointingTriangle = (0, import_internal.getPointingTriangle)();
+  const text = (0, import_array.ArrayPrototypeAt)(args, 0);
+  const logArgs = typeof text === "string" ? [
+    (0, import_format.applyLinePrefix)(`${name} ${pointingTriangle} ${text}`, {
+      prefix: "[DEBUG] "
+    }),
+    ...(0, import_array.ArrayPrototypeSlice)(args, 1)
+  ] : args;
+  const spinnerInstance = options.spinner || (0, import_registry.getDefaultSpinner)();
+  const wasSpinning = spinnerInstance?.isSpinning;
+  spinnerInstance?.stop();
+  (0, import_reflect.ReflectApply)(import_internal.logger.info, import_internal.logger, logArgs);
+  if (wasSpinning) {
+    spinnerInstance?.start();
+  }
+}
+// @__NO_SIDE_EFFECTS__
+function debuglog(section) {
+  const util = (0, import_internal.getUtil)();
+  return util.debuglog(section);
+}
+// @__NO_SIDE_EFFECTS__
+function debugtime(label) {
+  const util = (0, import_internal.getUtil)();
+  let startTime;
+  const impl = () => {
+    if (startTime === void 0) {
+      startTime = (0, import_date.DateNow)();
+    } else {
+      const duration = (0, import_date.DateNow)() - startTime;
+      util.debuglog("time")(`${label}: ${duration}ms`);
+      startTime = void 0;
+    }
+  };
+  impl.start = () => {
+    startTime = (0, import_date.DateNow)();
+  };
+  impl.end = () => {
+    if (startTime !== void 0) {
+      const duration = (0, import_date.DateNow)() - startTime;
+      util.debuglog("time")(`${label}: ${duration}ms`);
+      startTime = void 0;
+    }
+  };
+  return impl;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  debug,
+  debugCache,
+  debugCacheNs,
+  debugDir,
+  debugDirNs,
+  debugLog,
+  debugLogNs,
+  debugNs,
+  debuglog,
+  debugtime
+});

package/dist/debug/types.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @file Public type surface for `debug/*` modules — the options bag accepted by
+ *   every `debug*Ns` entrypoint and the `InspectOptions` mirror of
+ *   `node:util`'s shape (the public subset we accept; not the full thing). Pure
+ *   types, no runtime side effects.
+ */
+export interface DebugOptions {
+    namespaces?: string;
+    spinner?: {
+        isSpinning: boolean;
+        stop(): void;
+        start(): void;
+    };
+    [key: string]: unknown;
+}
+export type NamespacesOrOptions = string | DebugOptions;
+export interface InspectOptions {
+    depth?: number | null;
+    colors?: boolean;
+    [key: string]: unknown;
+}

package/dist/debug/types.js

@@ -0,0 +1,18 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);

package/dist/dlx/_internal.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @file Shared internals for the `dlx/*` module — the bounded LRU cache used by
+ *   `resolveBinaryPath` on Windows. Webpack-safe lazy `node:fs` / `node:path` /
+ *   `node:crypto` loaders live in the canonical
+ *   `@socketsecurity/lib/node/{fs,path,crypto}` helpers — import `getNodeFs` /
+ *   `getNodePath` / `getNodeCrypto` directly from there.
+ */
+export declare const BINARY_PATH_CACHE_MAX_SIZE = 200;
+export declare const binaryPathCache: Map<string, string>;
+export declare function binaryPathCacheSet(key: string, value: string): void;

package/dist/dlx/_internal.js

@@ -0,0 +1,47 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var internal_exports = {};
+__export(internal_exports, {
+  BINARY_PATH_CACHE_MAX_SIZE: () => BINARY_PATH_CACHE_MAX_SIZE,
+  binaryPathCache: () => binaryPathCache,
+  binaryPathCacheSet: () => binaryPathCacheSet
+});
+module.exports = __toCommonJS(internal_exports);
+var import_map_set = require("../primordials/map-set");
+const BINARY_PATH_CACHE_MAX_SIZE = 200;
+const binaryPathCache = new import_map_set.MapCtor();
+function binaryPathCacheSet(key, value) {
+  if (binaryPathCache.has(key)) {
+    binaryPathCache.delete(key);
+  } else if (binaryPathCache.size >= BINARY_PATH_CACHE_MAX_SIZE) {
+    const oldest = binaryPathCache.keys().next().value;
+    if (oldest !== void 0) {
+      binaryPathCache.delete(oldest);
+    }
+  }
+  binaryPathCache.set(key, value);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  BINARY_PATH_CACHE_MAX_SIZE,
+  binaryPathCache,
+  binaryPathCacheSet
+});

package/dist/dlx/arborist.d.ts

@@ -1,46 +1,43 @@
 /**
- * @fileoverview Safe Arborist wrapper for dlx installs and lockfile-only
- * resolution.
+ * @file Safe Arborist wrapper for dlx installs and lockfile-only resolution.
+ *   Every Arborist invocation in this module is configured with a fixed set of
+ *   security-hardening options mirroring socket-cli v1.1.79 SafeArborist:
  *
- * Every Arborist invocation in this module is configured with a fixed set
- * of security-hardening options mirroring socket-cli v1.1.79 SafeArborist:
- *
- *   - audit:         false   — no network call to the npm audit endpoint
- *   - fund:          false   — no collection/display of funding URLs
- *   - ignoreScripts: true    — no preinstall/install/postinstall scripts
- *   - progress:      false   — no progress bar on stdout
- *   - saveBundle:    false   — never update bundledDependencies
- *   - silent:        true    — suppress Arborist's default log output
- *
- * `save` varies by operation: {@link safeIdealTree} uses `save: true` so
- * Arborist writes `package-lock.json`; {@link safeReify} uses `save: false`
- * so the caller's `package.json` is never rewritten.
- *
- * A `.npmrc` with the equivalent settings is also written into the
- * install directory as a belt-and-suspenders defense for any downstream
- * tool that reads it.
+ *   - audit: false — no network call to the npm audit endpoint
+ *   - fund: false — no collection/display of funding URLs
+ *   - ignoreScripts: true — no preinstall/install/postinstall scripts
+ *   - progress: false — no progress bar on stdout
+ *   - saveBundle: false — never update bundledDependencies
+ *   - silent: true — suppress Arborist's default log output `save` varies by
+ *     operation: {@link safeIdealTree} uses `save: true` so Arborist writes
+ *     `package-lock.json`; {@link safeReify} uses `save: false` so the caller's
+ *     `package.json` is never rewritten. A `.npmrc` with the equivalent
+ *     settings is also written into the install directory as a
+ *     belt-and-suspenders defense for any downstream tool that reads it.
  */
+import Arborist from '../external/@npmcli/arborist';
 /**
  * Shared options for the safe-arborist operations below.
  */
 export interface SafeArboristOptions {
     /**
      * Install directory. Arborist reads `package.json` (and, for reify,
-     * `package-lock.json`) from this directory and creates `node_modules`
-     * here when installing.
+     * `package-lock.json`) from this directory and creates `node_modules` here
+     * when installing.
      *
      * Must already exist before calling. The caller is responsible for its
      * lifecycle (including cleanup of tmp directories).
      */
     path: string;
     /**
-     * Refuse to resolve any version published after this date. Passed to
-     * Arborist (and pacote) as the `before` option. Matches npm's
-     * `min-release-age` semantics once a caller converts days → Date.
+     * Refuse to resolve any version published after this date. Passed to Arborist
+     * (and pacote) as the `before` option. Matches npm's `min-release-age`
+     * semantics once a caller converts days → Date.
      */
     before?: Date | undefined;
     /**
      * Suppress Arborist's default log output.
+     *
      * @default true
      */
     quiet?: boolean | undefined;
@@ -54,11 +51,17 @@ export interface SafeIdealTreeResult {
      * registry (sourced from Arborist's idealTree, not from a tarball).
      */
     integrity: string;
-    /** Resolved package name. */
+    /**
+     * Resolved package name.
+     */
     name: string;
-    /** Resolved package version. */
+    /**
+     * Resolved package version.
+     */
     version: string;
-    /** `package-lock.json` JSON content written by Arborist. */
+    /**
+     * `package-lock.json` JSON content written by Arborist.
+     */
     lockfile: string;
 }
 /**
@@ -66,9 +69,9 @@ export interface SafeIdealTreeResult {
  */
 export interface SafeReifyOptions extends SafeArboristOptions {
     /**
-     * When true, Arborist reifies against the existing `package-lock.json`
-     * in `path` without rewriting it. When false, Arborist may update the
-     * lockfile to match resolved dependencies.
+     * When true, Arborist reifies against the existing `package-lock.json` in
+     * `path` without rewriting it. When false, Arborist may update the lockfile
+     * to match resolved dependencies.
      *
      * Pin-mode callers set this to true so committed lockfiles are the
      * authoritative resolution.
@@ -77,58 +80,80 @@ export interface SafeReifyOptions extends SafeArboristOptions {
      */
     packageLock?: boolean | undefined;
 }
+/**
+ * Fixed Arborist options that must not be overridden by callers. Mirrors
+ * socket-cli v1.1.79's SafeArborist overrides: audit: false, fund: false,
+ * ignoreScripts: true, save: false, saveBundle: false, silent: true, progress:
+ * false.
+ */
+export declare function getBaseArboristOptions(installPath: string, options: {
+    quiet: boolean;
+}): ConstructorParameters<typeof Arborist>[0];
+/**
+ * Read the single declared dependency from a package.json. We only support one
+ * top-level dep per snapshot, which keeps the result unambiguous (no "which of
+ * N deps did we pin?").
+ */
+export declare function readSingleDependency(packageJsonPath: string): string;
+/**
+ * Read the top-level package from an Arborist idealTree's inventory. Arborist's
+ * `Inventory` extends `Map`, so iteration yields `[key, node]` pairs — use
+ * `.values()` to get nodes directly.
+ */
+export declare function readTopLevelFromIdealTree(tree: unknown, targetName: string): {
+    name: string;
+    version: string;
+    integrity: string;
+};
 /**
  * Run Arborist in `packageLockOnly` mode against a directory that already
  * contains a `package.json` with a single dependency. Resolves the graph
- * against the registry and writes `package-lock.json` into `path`, but
- * does NOT install into `node_modules`.
+ * against the registry and writes `package-lock.json` into `path`, but does NOT
+ * install into `node_modules`.
  *
- * Used by snapshot/bootstrap flows to obtain a lockfile + top-level
- * integrity without paying for a full install.
+ * Used by snapshot/bootstrap flows to obtain a lockfile + top-level integrity
+ * without paying for a full install.
  *
- * Uses `save: true` (rather than our usual `save: false`) so Arborist
- * actually writes the lockfile — without that flag, `reify()` in
- * `packageLockOnly` mode with no `add` list skips the write.
+ * Uses `save: true` (rather than our usual `save: false`) so Arborist actually
+ * writes the lockfile — without that flag, `reify()` in `packageLockOnly` mode
+ * with no `add` list skips the write.
  */
 export declare function safeIdealTree(options: SafeArboristOptions): Promise<SafeIdealTreeResult>;
 /**
- * Install into `node_modules` using Arborist's reify operation. Honors
- * the committed `package-lock.json` in `path` when `packageLock: true`.
+ * Install into `node_modules` using Arborist's reify operation. Honors the
+ * committed `package-lock.json` in `path` when `packageLock: true`.
  *
- * Does not fetch registry metadata for versions already pinned by the
- * lockfile — arborist uses the lockfile's `integrity` strings to fetch
- * tarballs by ssri. This is the strongest form of pinning pnpm/npm
- * offer.
+ * Does not fetch registry metadata for versions already pinned by the lockfile
+ * — arborist uses the lockfile's `integrity` strings to fetch tarballs by ssri.
+ * This is the strongest form of pinning pnpm/npm offer.
  */
 export declare function safeReify(options: SafeReifyOptions): Promise<void>;
 /**
- * Options for {@link writeSafeNpmrc}. Optional release-age hints are
- * echoed into the generated `.npmrc` as defense-in-depth for any
- * downstream tool that shells out to npm/pnpm in the directory.
+ * Options for {@link writeSafeNpmrc}. Optional release-age hints are echoed into
+ * the generated `.npmrc` as defense-in-depth for any downstream tool that
+ * shells out to npm/pnpm in the directory.
  */
 export interface WriteSafeNpmrcOptions {
-    /** npm `min-release-age` (days). Mutually exclusive with minReleaseMins. */
+    /**
+     * Npm `min-release-age` (days). Mutually exclusive with minReleaseMins.
+     */
     minReleaseDays?: number | undefined;
-    /** pnpm `minimumReleaseAge` (minutes). Mutually exclusive with minReleaseDays. */
+    /**
+     * Pnpm `minimumReleaseAge` (minutes). Mutually exclusive with minReleaseDays.
+     */
     minReleaseMins?: number | undefined;
 }
 /**
- * Write a hardened `.npmrc` into `path`. Used by both preview and pin
- * flows as a second layer of protection alongside the Arborist options.
+ * Write a hardened `.npmrc` into `path`. Used by both preview and pin flows as
+ * a second layer of protection alongside the Arborist options.
  *
- * Content written (always):
- *   ignore-scripts=true
- *   audit=false
- *   fund=false
- *   save=false
- *   save-bundle=false
- *   progress=false
+ * Content written (always): ignore-scripts=true audit=false fund=false
+ * save=false save-bundle=false progress=false.
  *
  * When {@link WriteSafeNpmrcOptions.minReleaseDays} is set, also writes:
- *   min-release-age=<days>
+ * min-release-age=<days>
  *
- * When {@link WriteSafeNpmrcOptions.minReleaseMins} is set, also writes
- * the pnpm-style equivalent:
- *   minimum-release-age=<minutes>
+ * When {@link WriteSafeNpmrcOptions.minReleaseMins} is set, also writes the
+ * pnpm-style equivalent: minimum-release-age=<minutes>
  */
 export declare function writeSafeNpmrc(installPath: string, options?: WriteSafeNpmrcOptions | undefined): Promise<void>;