@socketsecurity/lib 6.0.2 → 6.0.4

package/dist/dlx/firewall.js

@@ -1,107 +1,69 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var firewall_exports = {};
-__export(firewall_exports, {
-  checkFirewallPurls: () => checkFirewallPurls,
-  npmPurl: () => npmPurl
-});
-module.exports = __toCommonJS(firewall_exports);
-var import_node = require("../http-request/node");
-var import_user_agent = require("../http-request/user-agent");
-var import_error = require("../primordials/error");
-var import_map_set = require("../primordials/map-set");
-var import_promise = require("../primordials/promise");
-var import_string = require("../primordials/string");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_error = require('../primordials/error.js');
+const require_primordials_string = require('../primordials/string.js');
+const require_primordials_map_set = require('../primordials/map-set.js');
+const require_primordials_promise = require('../primordials/promise.js');
+const require_http_request_user_agent = require('../http-request/user-agent.js');
+const require_http_request_node = require('../http-request/node.js');
+
+//#region src/dlx/firewall.ts
 const FIREWALL_API_URL = "https://firewall-api.socket.dev/purl";
 const FIREWALL_TIMEOUT = 1e4;
-const FIREWALL_BLOCK_SEVERITIES = new import_map_set.SetCtor([
-  "critical",
-  "high"
-]);
+const FIREWALL_BLOCK_SEVERITIES = new require_primordials_map_set.SetCtor(["critical", "high"]);
+/**
+* Check all resolved packages in an Arborist ideal tree against the Socket
+* Firewall API (public, no auth required). Throws if any dependency has
+* critical or high severity alerts.
+*
+* @private
+*
+* @param arb - Arborist instance with populated idealTree.
+* @param requestedPackage - Top-level package name (for error messages)
+*/
 async function checkFirewallPurls(arb, requestedPackage) {
-  const idealTree = arb.idealTree;
-  if (!idealTree) {
-    return;
-  }
-  const purls = [];
-  for (const node of idealTree.inventory.values()) {
-    if (node.isProjectRoot) {
-      continue;
-    }
-    const { name, version } = node.package;
-    if (!name || !version) {
-      continue;
-    }
-    purls.push({ purl: npmPurl(name, version), name, version });
-  }
-  if (purls.length === 0) {
-    return;
-  }
-  const blocked = [];
-  await (0, import_promise.PromiseAllSettled)(
-    purls.map(async ({ name, purl, version }) => {
-      try {
-        const data = await (0, import_node.httpJson)(
-          `${FIREWALL_API_URL}/${encodeURIComponent(purl)}`,
-          {
-            headers: { "User-Agent": (0, import_user_agent.getSocketCallerUserAgent)() },
-            timeout: FIREWALL_TIMEOUT,
-            retries: 1,
-            retryDelay: 500
-          }
-        );
-        const blocking = (data.alerts ?? []).filter(
-          (a) => a.severity && FIREWALL_BLOCK_SEVERITIES.has(a.severity)
-        );
-        if (blocking.length > 0) {
-          blocked.push({
-            name,
-            version,
-            alerts: blocking.map(
-              (a) => `${a.severity}: ${a.type ?? a.key ?? "unknown"}`
-            )
-          });
-        }
-      } catch {
-      }
-    })
-  );
-  if (blocked.length > 0) {
-    const details = blocked.map((b) => `  ${b.name}@${b.version}: ${b.alerts.join(", ")}`).join("\n");
-    throw new import_error.ErrorCtor(
-      `Socket Firewall blocked installation of "${requestedPackage}".
-The following dependencies have security alerts:
-${details}
-
-Visit https://socket.dev for more information.`
-    );
-  }
+	const idealTree = arb.idealTree;
+	if (!idealTree) return;
+	const purls = [];
+	for (const node of idealTree.inventory.values()) {
+		if (node.isProjectRoot) continue;
+		const { name, version } = node.package;
+		if (!name || !version) continue;
+		purls.push({
+			purl: npmPurl(name, version),
+			name,
+			version
+		});
+	}
+	if (purls.length === 0) return;
+	const blocked = [];
+	await require_primordials_promise.PromiseAllSettled(purls.map(async ({ name, purl, version }) => {
+		try {
+			const blocking = ((await require_http_request_node.httpJson(`${FIREWALL_API_URL}/${encodeURIComponent(purl)}`, {
+				headers: { "User-Agent": require_http_request_user_agent.getSocketCallerUserAgent() },
+				timeout: FIREWALL_TIMEOUT,
+				retries: 1,
+				retryDelay: 500
+			})).alerts ?? []).filter((a) => a.severity && FIREWALL_BLOCK_SEVERITIES.has(a.severity));
+			if (blocking.length > 0) blocked.push({
+				name,
+				version,
+				alerts: blocking.map((a) => `${a.severity}: ${a.type ?? a.key ?? "unknown"}`)
+			});
+		} catch {}
+	}));
+	if (blocked.length > 0) throw new require_primordials_error.ErrorCtor(`Socket Firewall blocked installation of "${requestedPackage}".\nThe following dependencies have security alerts:\n${blocked.map((b) => `  ${b.name}@${b.version}: ${b.alerts.join(", ")}`).join("\n")}\n\nVisit https://socket.dev for more information.`);
 }
+/**
+* Build a PURL string for an npm package. Follows the PURL spec for the npm
+* type: - Scoped: `@scope/pkg` → `pkg:npm/%40scope/pkg@version` - Unscoped:
+* `pkg` → `pkg:npm/pkg@version`
+*/
 function npmPurl(name, version) {
-  const encoded = (0, import_string.StringPrototypeStartsWith)(name, "@") ? `%40${(0, import_string.StringPrototypeSlice)(name, 1)}` : name;
-  const encodedVersion = (0, import_string.StringPrototypeReplace)(version, /\+/g, "%2B");
-  return `pkg:npm/${encoded}@${encodedVersion}`;
+	return `pkg:npm/${require_primordials_string.StringPrototypeStartsWith(name, "@") ? `%40${require_primordials_string.StringPrototypeSlice(name, 1)}` : name}@${require_primordials_string.StringPrototypeReplace(version, /\+/g, "%2B")}`;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  checkFirewallPurls,
-  npmPurl
-});
+
+//#endregion
+exports.checkFirewallPurls = checkFirewallPurls;
+exports.npmPurl = npmPurl;

package/dist/dlx/lockfile.js

@@ -1,135 +1,130 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var lockfile_exports = {};
-__export(lockfile_exports, {
-  DEFAULT_MIN_RELEASE_DAYS: () => DEFAULT_MIN_RELEASE_DAYS,
-  DlxLockfileError: () => DlxLockfileError,
-  generatePackagePin: () => generatePackagePin,
-  specName: () => specName,
-  specRange: () => specRange
-});
-module.exports = __toCommonJS(lockfile_exports);
-var import_node_os = __toESM(require("node:os"));
-var import_pacote = __toESM(require("../external/pacote"));
-var import_safe = require("../fs/safe");
-var import_arborist = require("./arborist");
-var import_integrity = require("../integrity");
-var import_date = require("../primordials/date");
-var import_json = require("../primordials/json");
-var import_string = require("../primordials/string");
-var import_fs = require("../node/fs");
-var import_path = require("../node/path");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_primordials_string = require('../primordials/string.js');
+const require_integrity = require('../integrity.js');
+const require_node_fs = require('../node/fs.js');
+const require_node_path = require('../node/path.js');
+const require_primordials_date = require('../primordials/date.js');
+const require_primordials_json = require('../primordials/json.js');
+const require_fs_safe = require('../fs/safe.js');
+const require_dlx_arborist = require('./arborist.js');
+let node_os = require("node:os");
+node_os = require_runtime.__toESM(node_os);
+let src_external_pacote = require("../external/pacote");
+src_external_pacote = require_runtime.__toESM(src_external_pacote);
+
+//#region src/dlx/lockfile.ts
+/**
+* @file Package pin generation for dlx installs. `generatePackagePin` resolves
+*   an npm package against the registry using Arborist's lockfile-only mode and
+*   fetches its top-level tarball to return both hash formats plus the lockfile
+*   content — everything needed to vendor a reproducible install. The
+*   `LockfileSpec` type is also exported here for use as the `lockfile` option
+*   on `downloadPackage`. Sniff/write handling lives inline in `./package.ts` —
+*   no helper.
+*/
+/**
+* Default minimum release age in days applied when a caller passes neither
+* `minReleaseDays` nor `minReleaseMins`. Pass `minReleaseDays: 0` to disable
+* the cutoff explicitly.
+*/
 const DEFAULT_MIN_RELEASE_DAYS = 7;
-class DlxLockfileError extends Error {
-  constructor(message, options) {
-    super(message, options);
-    this.name = "DlxLockfileError";
-  }
-}
+/**
+* Thrown when a lockfile spec is malformed (unrecognized string, missing file,
+* invalid JSON) or drifts from its package.json.
+*/
+var DlxLockfileError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "DlxLockfileError";
+	}
+};
+/**
+* Generate a vendorable pin for an npm package without installing it.
+*
+* Runs Arborist in lockfile-only mode (`packageLockOnly: true`) against a
+* temporary directory, fetches the top-level tarball once to compute sha256 hex
+* (since Arborist only exposes SRI from the registry), then tears the tmp
+* directory down before returning.
+*
+* The result contains everything a caller needs to pin the package for future
+* installs: the exact resolved name/version, both hash formats, and the
+* lockfile content (ready to commit).
+*
+* @example
+*   ;```ts
+*   const pin = await generatePackagePin({
+*     package: '@anthropic-ai/claude-code@2.1.92',
+*   })
+*   await fs.writeFile('./claude.lock.json', pin.lockfile, 'utf8')
+*   // pin.hash.integrity → 'sha512-…'
+*   // pin.hash.checksum  → hex
+*   ```
+*/
 async function generatePackagePin(options) {
-  const fs = (0, import_fs.getNodeFs)();
-  const path = (0, import_path.getNodePath)();
-  const { minReleaseDays, minReleaseMins, package: spec } = options;
-  if (typeof spec !== "string" || spec.length === 0) {
-    throw new DlxLockfileError("generatePackagePin requires a package spec");
-  }
-  if (minReleaseDays !== void 0 && minReleaseMins !== void 0) {
-    throw new DlxLockfileError(
-      "generatePackagePin: minReleaseDays and minReleaseMins are mutually exclusive"
-    );
-  }
-  const effectiveDays = minReleaseDays !== void 0 ? minReleaseDays : minReleaseMins !== void 0 ? void 0 : DEFAULT_MIN_RELEASE_DAYS;
-  const ageMs = effectiveDays !== void 0 ? effectiveDays * 864e5 : minReleaseMins !== void 0 ? minReleaseMins * 6e4 : 0;
-  const before = ageMs > 0 ? new import_date.DateCtor((0, import_date.DateNow)() - ageMs) : void 0;
-  const scratch = path.join(
-    import_node_os.default.tmpdir(),
-    `socket-lib-pin-${process.pid}-${Date.now()}`
-  );
-  await (0, import_safe.safeMkdir)(scratch, { recursive: true });
-  try {
-    const packageJson = (0, import_json.JSONStringify)(
-      {
-        name: "socket-lib-pin",
-        version: "0.0.0",
-        private: true,
-        dependencies: { [specName(spec)]: specRange(spec) }
-      },
-      void 0,
-      2
-    );
-    await fs.promises.writeFile(
-      path.join(scratch, "package.json"),
-      packageJson + "\n",
-      "utf8"
-    );
-    await (0, import_arborist.writeSafeNpmrc)(scratch, {
-      minReleaseDays: effectiveDays,
-      minReleaseMins
-    });
-    const ideal = await (0, import_arborist.safeIdealTree)({ path: scratch, before });
-    const tarball = await import_pacote.default.tarball(`${ideal.name}@${ideal.version}`);
-    const hash = (0, import_integrity.computeHashes)(tarball);
-    return {
-      name: ideal.name,
-      version: ideal.version,
-      hash,
-      packageJson,
-      lockfile: ideal.lockfile
-    };
-  } finally {
-    try {
-      await (0, import_safe.safeDelete)(scratch, { force: true });
-    } catch {
-    }
-  }
+	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const { minReleaseDays, minReleaseMins, package: spec } = options;
+	if (typeof spec !== "string" || spec.length === 0) throw new DlxLockfileError("generatePackagePin requires a package spec");
+	if (minReleaseDays !== void 0 && minReleaseMins !== void 0) throw new DlxLockfileError("generatePackagePin: minReleaseDays and minReleaseMins are mutually exclusive");
+	const effectiveDays = minReleaseDays !== void 0 ? minReleaseDays : minReleaseMins !== void 0 ? void 0 : 7;
+	const ageMs = effectiveDays !== void 0 ? effectiveDays * 864e5 : minReleaseMins !== void 0 ? minReleaseMins * 6e4 : 0;
+	const before = ageMs > 0 ? new require_primordials_date.DateCtor(require_primordials_date.DateNow() - ageMs) : void 0;
+	const scratch = path.join(node_os.default.tmpdir(), `socket-lib-pin-${process.pid}-${Date.now()}`);
+	await require_fs_safe.safeMkdir(scratch, { recursive: true });
+	try {
+		const packageJson = require_primordials_json.JSONStringify({
+			name: "socket-lib-pin",
+			version: "0.0.0",
+			private: true,
+			dependencies: { [specName(spec)]: specRange(spec) }
+		}, void 0, 2);
+		await fs.promises.writeFile(path.join(scratch, "package.json"), packageJson + "\n", "utf8");
+		await require_dlx_arborist.writeSafeNpmrc(scratch, {
+			minReleaseDays: effectiveDays,
+			minReleaseMins
+		});
+		const ideal = await require_dlx_arborist.safeIdealTree({
+			path: scratch,
+			before
+		});
+		const hash = require_integrity.computeHashes(await src_external_pacote.default.tarball(`${ideal.name}@${ideal.version}`));
+		return {
+			name: ideal.name,
+			version: ideal.version,
+			hash,
+			packageJson,
+			lockfile: ideal.lockfile
+		};
+	} finally {
+		try {
+			await require_fs_safe.safeDelete(scratch, { force: true });
+		} catch {}
+	}
 }
+/**
+* Extract the package name from a spec like `'name@range'` or
+* `'@scope/name@range'` or a bare `'name'`.
+*/
 function specName(spec) {
-  const atIdx = (0, import_string.StringPrototypeLastIndexOf)(spec, "@");
-  if (atIdx <= 0) {
-    return spec;
-  }
-  return (0, import_string.StringPrototypeSlice)(spec, 0, atIdx);
+	const atIdx = require_primordials_string.StringPrototypeLastIndexOf(spec, "@");
+	if (atIdx <= 0) return spec;
+	return require_primordials_string.StringPrototypeSlice(spec, 0, atIdx);
 }
+/**
+* Extract the version range (or `'latest'`) from a spec.
+*/
 function specRange(spec) {
-  const atIdx = (0, import_string.StringPrototypeLastIndexOf)(spec, "@");
-  if (atIdx <= 0) {
-    return "latest";
-  }
-  return (0, import_string.StringPrototypeSlice)(spec, atIdx + 1) || "latest";
+	const atIdx = require_primordials_string.StringPrototypeLastIndexOf(spec, "@");
+	if (atIdx <= 0) return "latest";
+	return require_primordials_string.StringPrototypeSlice(spec, atIdx + 1) || "latest";
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  DEFAULT_MIN_RELEASE_DAYS,
-  DlxLockfileError,
-  generatePackagePin,
-  specName,
-  specRange
-});
+
+//#endregion
+exports.DEFAULT_MIN_RELEASE_DAYS = DEFAULT_MIN_RELEASE_DAYS;
+exports.DlxLockfileError = DlxLockfileError;
+exports.generatePackagePin = generatePackagePin;
+exports.specName = specName;
+exports.specRange = specRange;