@socketsecurity/lib 6.0.2 → 6.0.4

package/dist/bin/socket-lib.js

@@ -1,79 +1,57 @@
 #!/usr/bin/env node
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var socket_lib_exports = {};
-__export(socket_lib_exports, {
-  main: () => main,
-  printHelp: () => printHelp
-});
-module.exports = __toCommonJS(socket_lib_exports);
-var import_node_process = __toESM(require("node:process"));
-var import_default = require("../logger/default");
-var import_check = require("./check");
-const logger = (0, import_default.getDefaultLogger)();
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_logger_default = require('../logger/default.js');
+const require_bin_check = require('./check.js');
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+
+//#region src/bin/socket-lib.ts
+/**
+* @file `socket-lib` CLI entry point — top-level dispatcher. socket-lib — print
+*   help, list commands socket-lib check <name> [opts...] — run a fleet-wide
+*   check Subcommands live as siblings under `src/bin/`; each is its own file
+*   so a misbehaving check can't crash other commands at parse time. The
+*   dispatcher just routes; subcommands own their own arg parsing. The CLI is
+*   shipped via the `bin` field in package.json and intended to be invoked as
+*   `pnpm exec socket-lib <command>` from any consumer that has
+*   `@socketsecurity/lib` as a (dev)dependency.
+*/
+const logger = require_logger_default.getDefaultLogger();
 function printHelp() {
-  logger.log("socket-lib \u2014 fleet-wide static-analysis CLI");
-  logger.log("");
-  logger.log("Usage:");
-  logger.log("  socket-lib <command> [...args]");
-  logger.log("");
-  logger.log("Commands:");
-  logger.log("  check <name>   Run a fleet-wide check (primordials, ...).");
-  logger.log("");
-  logger.log("Run `socket-lib check --help` for the list of checks.");
-}
-async function main(args = import_node_process.default.argv.slice(2)) {
-  const command = args[0];
-  if (!command || command === "--help" || command === "-h") {
-    printHelp();
-    return 0;
-  }
-  switch (command) {
-    case "check": {
-      return await (0, import_check.runCheck)(args.slice(1));
-    }
-    default: {
-      logger.error(`socket-lib: unknown command '${command}'`);
-      logger.error("Run `socket-lib --help` for the list of commands.");
-      return 1;
-    }
-  }
+	logger.log("socket-lib — fleet-wide static-analysis CLI");
+	logger.log("");
+	logger.log("Usage:");
+	logger.log("  socket-lib <command> [...args]");
+	logger.log("");
+	logger.log("Commands:");
+	logger.log("  check <name>   Run a fleet-wide check (primordials, ...).");
+	logger.log("");
+	logger.log("Run `socket-lib check --help` for the list of checks.");
 }
-if (typeof require !== "undefined" && require.main === module) {
-  void main().then((code) => {
-    import_node_process.default.exit(code);
-  });
+async function main(args = node_process.default.argv.slice(2)) {
+	const command = args[0];
+	if (!command || command === "--help" || command === "-h") {
+		printHelp();
+		return 0;
+	}
+	switch (command) {
+		case "check": return await require_bin_check.runCheck(args.slice(1));
+		default:
+			logger.error(`socket-lib: unknown command '${command}'`);
+			logger.error("Run `socket-lib --help` for the list of commands.");
+			return 1;
+	}
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  main,
-  printHelp
+/* c8 ignore start - CJS CLI entry guard; only fires when this
+module is invoked as the bin (`socket-lib`), not when imported. */
+if (typeof require !== "undefined" && require.main === module) main().then((code) => {
+	node_process.default.exit(code);
 });
+/* c8 ignore stop */
+
+//#endregion
+exports.main = main;
+exports.printHelp = printHelp;

package/dist/bin/types.js

@@ -1,18 +1,2 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var types_exports = {};
-module.exports = __toCommonJS(types_exports);
+/* Socket Lib - Built with rolldown */

package/dist/bin/which.js

@@ -1,155 +1,220 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var which_exports = {};
-__export(which_exports, {
-  which: () => which,
-  whichReal: () => whichReal,
-  whichRealSync: () => whichRealSync,
-  whichSync: () => whichSync
-});
-module.exports = __toCommonJS(which_exports);
-var import_which = __toESM(require("../external/which"));
-var import_normalize = require("../paths/normalize");
-var import_array = require("../primordials/array");
-var import_internal = require("./_internal");
-var import_resolve = require("./resolve");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_paths_predicates = require('../paths/predicates.js');
+const require_primordials_array = require('../primordials/array.js');
+const require_node_fs = require('../node/fs.js');
+const require_bin__internal = require('./_internal.js');
+const require_bin_resolve = require('./resolve.js');
+let src_external_which = require("../external/which");
+src_external_which = require_runtime.__toESM(src_external_which);
+
+//#region src/bin/which.ts
+/**
+* @file Look up binaries on PATH. Two pairs of public functions: `which` /
+*   `whichSync` — wrap the upstream `which` package, returning the first
+*   matching path (or array with `{ all: true }`). Path-like inputs (absolute
+*   paths, `./relative`, `../relative`) bypass PATH resolution and pass through
+*   unchanged. Both are tolerant — they return `null` for not-found instead of
+*   throwing. `whichReal` / `whichRealSync` — same but resolve the result
+*   through `resolveRealBinSync` so the caller gets the underlying script path
+*   (e.g., `npm-cli.js`) rather than the wrapper. Default `nothrow: true` so a
+*   missing binary returns `undefined` instead of bubbling a `which` package
+*   error. Caching matches `_internal.binPathCache` and `binPathAllCache`. Both
+*   caches validate hits with `existsSync` so a tool reinstall mid-session
+*   doesn't return a stale path.
+*/
+/**
+* Find an executable in the system PATH asynchronously.
+*
+* This function resolves binary names to their full paths by searching the
+* system PATH. It should only be used for binary names (not paths). If the
+* input is already a path (absolute or relative), it will be returned as-is
+* without PATH resolution.
+*
+* Binary name vs. path detection:
+*
+* - Binary names: 'npm', 'git', 'node' - will be resolved via PATH
+* - Absolute paths: '/usr/bin/node', 'C:\Program Files\nodejs\node.exe' -
+*   returned as-is
+* - Relative paths: './node', '../bin/npm' - returned as-is
+*
+* @example
+*   ;```typescript
+*   // Resolve binary names
+*   await which('node') // '/usr/local/bin/node'
+*   await which('npm') // '/usr/local/bin/npm'
+*   await which('nonexistent') // null
+*
+*   // Paths are returned as-is
+*   await which('/usr/bin/node') // '/usr/bin/node'
+*   await which('./local-script') // './local-script'
+*   ```
+*
+* @param {string} binName - The binary name to resolve (e.g., 'npm', 'git')
+* @param {WhichOptions | undefined} options - Options for resolution.
+*
+* @returns {Promise<string | string[] | null>} Promise resolving to the full
+*   path, the original path, or null if not found.
+*/
 async function which(binName, options) {
-  if ((0, import_normalize.isPath)(binName)) {
-    return binName;
-  }
-  try {
-    const result = await (0, import_which.default)(
-      binName,
-      options
-    );
-    return result;
-  } catch {
-    return null;
-  }
+	if (/* @__PURE__ */ require_paths_predicates.isPath(binName)) return binName;
+	try {
+		return await (0, src_external_which.default)(binName, options);
+	} catch {
+		return null;
+	}
 }
+/**
+* Find a binary in the system PATH and resolve to the real underlying script
+* asynchronously. Resolves wrapper scripts (.cmd, .ps1, shell scripts) to the
+* actual .js files they execute.
+*
+* @example
+*   ;```typescript
+*   const npmPath = await whichReal('npm')
+*   // e.g. '/usr/local/lib/node_modules/npm/bin/npm-cli.js'
+*   ```
+*
+* @throws {Error} If the binary is not found and nothrow is false.
+*/
 async function whichReal(binName, options) {
-  const fs = (0, import_internal.getFs)();
-  const opts = { __proto__: null, nothrow: true, ...options };
-  if (opts.all) {
-    const cachedAll = import_internal.binPathAllCache.get(binName);
-    if (cachedAll && cachedAll.length > 0) {
-      if (fs.existsSync(cachedAll[0])) {
-        return cachedAll;
-      }
-      import_internal.binPathAllCache.delete(binName);
-    }
-  } else {
-    const cached = import_internal.binPathCache.get(binName);
-    if (cached) {
-      if (fs.existsSync(cached)) {
-        return cached;
-      }
-      import_internal.binPathCache.delete(binName);
-    }
-  }
-  const result = await (0, import_which.default)(
-    binName,
-    opts
-  );
-  if (opts?.all) {
-    const paths = (0, import_array.ArrayIsArray)(result) ? result : typeof result === "string" ? [result] : void 0;
-    if (paths?.length) {
-      const resolved2 = (0, import_array.ArrayPrototypeMap)(paths, (p) => (0, import_resolve.resolveRealBinSync)(p));
-      import_internal.binPathAllCache.set(binName, resolved2);
-      return resolved2;
-    }
-    return paths;
-  }
-  if (!result) {
-    return void 0;
-  }
-  const resolved = (0, import_resolve.resolveRealBinSync)(result);
-  import_internal.binPathCache.set(binName, resolved);
-  return resolved;
+	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const opts = {
+		__proto__: null,
+		nothrow: true,
+		...options
+	};
+	/* c8 ignore start */
+	if (opts.all) {
+		const cachedAll = require_bin__internal.binPathAllCache.get(binName);
+		if (cachedAll && cachedAll.length > 0) {
+			if (fs.existsSync(cachedAll[0])) return cachedAll;
+			require_bin__internal.binPathAllCache.delete(binName);
+		}
+	} else {
+		const cached = require_bin__internal.binPathCache.get(binName);
+		if (cached) {
+			if (fs.existsSync(cached)) return cached;
+			require_bin__internal.binPathCache.delete(binName);
+		}
+	}
+	/* c8 ignore stop */
+	/* c8 ignore next - External which call */
+	const result = await (0, src_external_which.default)(binName, opts);
+	/* c8 ignore start */
+	if (opts?.all) {
+		const paths = require_primordials_array.ArrayIsArray(result) ? result : typeof result === "string" ? [result] : void 0;
+		if (paths?.length) {
+			const resolved = require_primordials_array.ArrayPrototypeMap(paths, (p) => /* @__PURE__ */ require_bin_resolve.resolveRealBinSync(p));
+			require_bin__internal.binPathAllCache.set(binName, resolved);
+			return resolved;
+		}
+		return paths;
+	}
+	if (!result) return;
+	/* c8 ignore stop */
+	const resolved = /* @__PURE__ */ require_bin_resolve.resolveRealBinSync(result);
+	require_bin__internal.binPathCache.set(binName, resolved);
+	return resolved;
 }
+/**
+* Find a binary in the system PATH and resolve to the real underlying script
+* synchronously. Resolves wrapper scripts (.cmd, .ps1, shell scripts) to the
+* actual .js files they execute.
+*
+* @example
+*   ;```typescript
+*   const npmPath = whichRealSync('npm')
+*   // e.g. '/usr/local/lib/node_modules/npm/bin/npm-cli.js'
+*   ```
+*
+* @throws {Error} If the binary is not found and nothrow is false.
+*/
 function whichRealSync(binName, options) {
-  const fs = (0, import_internal.getFs)();
-  const opts = { __proto__: null, nothrow: true, ...options };
-  if (opts.all) {
-    const cachedAll = import_internal.binPathAllCache.get(binName);
-    if (cachedAll && cachedAll.length > 0) {
-      if (fs.existsSync(cachedAll[0])) {
-        return cachedAll;
-      }
-      import_internal.binPathAllCache.delete(binName);
-    }
-  } else {
-    const cached = import_internal.binPathCache.get(binName);
-    if (cached) {
-      if (fs.existsSync(cached)) {
-        return cached;
-      }
-      import_internal.binPathCache.delete(binName);
-    }
-  }
-  const result = whichSync(binName, opts);
-  if (opts.all) {
-    const paths = (0, import_array.ArrayIsArray)(result) ? result : typeof result === "string" ? [result] : void 0;
-    if (paths?.length) {
-      const resolved2 = (0, import_array.ArrayPrototypeMap)(paths, (p) => (0, import_resolve.resolveRealBinSync)(p));
-      import_internal.binPathAllCache.set(binName, resolved2);
-      return resolved2;
-    }
-    return paths;
-  }
-  if (!result) {
-    return void 0;
-  }
-  const resolved = (0, import_resolve.resolveRealBinSync)(result);
-  import_internal.binPathCache.set(binName, resolved);
-  return resolved;
+	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const opts = {
+		__proto__: null,
+		nothrow: true,
+		...options
+	};
+	/* c8 ignore start */
+	if (opts.all) {
+		const cachedAll = require_bin__internal.binPathAllCache.get(binName);
+		if (cachedAll && cachedAll.length > 0) {
+			if (fs.existsSync(cachedAll[0])) return cachedAll;
+			require_bin__internal.binPathAllCache.delete(binName);
+		}
+	} else {
+		const cached = require_bin__internal.binPathCache.get(binName);
+		if (cached) {
+			if (fs.existsSync(cached)) return cached;
+			require_bin__internal.binPathCache.delete(binName);
+		}
+	}
+	/* c8 ignore stop */
+	const result = whichSync(binName, opts);
+	/* c8 ignore start */
+	if (opts.all) {
+		const paths = require_primordials_array.ArrayIsArray(result) ? result : typeof result === "string" ? [result] : void 0;
+		if (paths?.length) {
+			const resolved = require_primordials_array.ArrayPrototypeMap(paths, (p) => /* @__PURE__ */ require_bin_resolve.resolveRealBinSync(p));
+			require_bin__internal.binPathAllCache.set(binName, resolved);
+			return resolved;
+		}
+		return paths;
+	}
+	if (!result) return;
+	/* c8 ignore stop */
+	const resolved = /* @__PURE__ */ require_bin_resolve.resolveRealBinSync(result);
+	require_bin__internal.binPathCache.set(binName, resolved);
+	return resolved;
 }
+/**
+* Find an executable in the system PATH synchronously.
+*
+* This function resolves binary names to their full paths by searching the
+* system PATH. It should only be used for binary names (not paths). If the
+* input is already a path (absolute or relative), it will be returned as-is
+* without PATH resolution.
+*
+* Binary name vs. path detection:
+*
+* - Binary names: 'npm', 'git', 'node' - will be resolved via PATH
+* - Absolute paths: '/usr/bin/node', 'C:\Program Files\nodejs\node.exe' -
+*   returned as-is
+* - Relative paths: './node', '../bin/npm' - returned as-is
+*
+* @example
+*   ;```typescript
+*   // Resolve binary names
+*   whichSync('node') // '/usr/local/bin/node'
+*   whichSync('npm') // '/usr/local/bin/npm'
+*   whichSync('nonexistent') // null
+*
+*   // Paths are returned as-is
+*   whichSync('/usr/bin/node') // '/usr/bin/node'
+*   whichSync('./local-script') // './local-script'
+*   ```
+*
+* @param {string} binName - The binary name to resolve (e.g., 'npm', 'git')
+* @param {WhichOptions | undefined} options - Options for resolution.
+*
+* @returns {string | string[] | null} The full path to the binary, the original
+*   path if input is a path, or null if not found.
+*/
 function whichSync(binName, options) {
-  if ((0, import_normalize.isPath)(binName)) {
-    return binName;
-  }
-  try {
-    const result = import_which.default.sync(
-      binName,
-      options
-    );
-    return result;
-  } catch {
-    return null;
-  }
+	if (/* @__PURE__ */ require_paths_predicates.isPath(binName)) return binName;
+	try {
+		return src_external_which.default.sync(binName, options);
+	} catch {
+		return null;
+	}
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  which,
-  whichReal,
-  whichRealSync,
-  whichSync
-});
+
+//#endregion
+exports.which = which;
+exports.whichReal = whichReal;
+exports.whichRealSync = whichRealSync;
+exports.whichSync = whichSync;

package/dist/cacache/_internal.js

@@ -1,43 +1,28 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var internal_exports = {};
-__export(internal_exports, {
-  getCacache: () => getCacache
-});
-module.exports = __toCommonJS(internal_exports);
-var import_cacache = __toESM(require("../external/cacache"));
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+let src_external_cacache = require("../external/cacache");
+src_external_cacache = require_runtime.__toESM(src_external_cacache);
+
+//#region src/cacache/_internal.ts
+/**
+* @file Accessor for the vendored `cacache` module. Centralised so other
+*   `cacache/*` leaves stay decoupled from the import path — if the vendoring
+*   moves, only this leaf updates.
+*/
+/**
+* Get the cacache module for cache operations.
+*
+* @example
+*   ;```typescript
+*   const cacache = getCacache()
+*   const entries = await cacache.ls(cacheDir)
+*   ```
+*/
 function getCacache() {
-  return import_cacache.default;
+	return src_external_cacache.default;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  getCacache
-});
+
+//#endregion
+exports.getCacache = getCacache;