@socketsecurity/lib 6.0.3 → 6.0.5

package/dist/secrets/windows.js

@@ -1,318 +1,260 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var windows_exports = {};
-__export(windows_exports, {
-  buildTarget: () => buildTarget,
-  deleteWindows: () => deleteWindows,
-  deleteWindowsSync: () => deleteWindowsSync,
-  getDpapiFilePath: () => getDpapiFilePath,
-  isWindowsBackendAvailable: () => isWindowsBackendAvailable,
-  quotePs: () => quotePs,
-  readDpapi: () => readDpapi,
-  readDpapiSync: () => readDpapiSync,
-  readWindows: () => readWindows,
-  readWindowsSync: () => readWindowsSync,
-  runPsAsync: () => runPsAsync,
-  runPsSync: () => runPsSync,
-  validateKeychainComponent: () => validateKeychainComponent,
-  writeDpapi: () => writeDpapi,
-  writeDpapiSync: () => writeDpapiSync,
-  writeWindows: () => writeWindows,
-  writeWindowsSync: () => writeWindowsSync
-});
-module.exports = __toCommonJS(windows_exports);
-var import_node_child_process = require("node:child_process");
-var import_node_fs = require("node:fs");
-var import_node_os = require("node:os");
-var import_node_path = __toESM(require("node:path"));
-var import_node_process = __toESM(require("node:process"));
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+let node_os = require("node:os");
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+let node_child_process = require("node:child_process");
+
+//#region src/secrets/windows.ts
+/**
+* @file Windows backend via PowerShell CredentialManager module, with a
+*   DPAPI-encrypted file fallback. Two paths, tried in order:
+*
+*   1. CredentialManager PowerShell module (`New-StoredCredential` /
+*      `Get-StoredCredential` / `Remove-StoredCredential`). The cleanest path —
+*      stored credentials live in the Windows Credential Manager, the same
+*      place `cmdkey` writes to. Requires the module to be installed
+*      (`Install-Module CredentialManager -Scope CurrentUser`).
+*   2. DPAPI-encrypted file under `%APPDATA%\<service>\<account>.enc`. Used when
+*      the CredentialManager module isn't available.
+*      `System.Security.Cryptography.ProtectedData` encrypts under the
+*      current-user machine key — readable only by this user on this machine,
+*      never plaintext. The target name composed for CredentialManager is
+*      `service:account` (matching `cmdkey /generic:<target>` convention).
+*/
 const POWERSHELL_BIN = "powershell";
 function buildTarget(service, account) {
-  return `${service}:${account}`;
+	return `${service}:${account}`;
 }
 async function deleteWindows(service, account) {
-  const target = buildTarget(service, account);
-  let removedAny = false;
-  const psScript = `
+	const target = buildTarget(service, account);
+	let removedAny = false;
+	if ((await runPsAsync(`
     try { Remove-StoredCredential -Target ${quotePs(target)}; exit 0 }
     catch { exit 1 }
-  `;
-  const ps = await runPsAsync(psScript);
-  if (ps.status === 0) {
-    removedAny = true;
-  }
-  const filePath = getDpapiFilePath(service, account);
-  if ((0, import_node_fs.existsSync)(filePath)) {
-    try {
-      const { rmSync } = await import("node:fs");
-      rmSync(filePath, { force: true });
-      removedAny = true;
-    } catch {
-    }
-  }
-  return removedAny ? "removed" : "absent";
+  `)).status === 0) removedAny = true;
+	const filePath = getDpapiFilePath(service, account);
+	if ((0, node_fs.existsSync)(filePath)) try {
+		const { rmSync } = await import("node:fs");
+		rmSync(filePath, { force: true });
+		removedAny = true;
+	} catch {}
+	return removedAny ? "removed" : "absent";
 }
 function deleteWindowsSync(service, account) {
-  const target = buildTarget(service, account);
-  let removedAny = false;
-  const psScript = `
+	const target = buildTarget(service, account);
+	let removedAny = false;
+	if (runPsSync(`
     try { Remove-StoredCredential -Target ${quotePs(target)}; exit 0 }
     catch { exit 1 }
-  `;
-  const ps = runPsSync(psScript);
-  if (ps.status === 0) {
-    removedAny = true;
-  }
-  const filePath = getDpapiFilePath(service, account);
-  if ((0, import_node_fs.existsSync)(filePath)) {
-    try {
-      const fsMod = require("node:fs");
-      fsMod.rmSync(filePath, { force: true });
-      removedAny = true;
-    } catch {
-    }
-  }
-  return removedAny ? "removed" : "absent";
+  `).status === 0) removedAny = true;
+	const filePath = getDpapiFilePath(service, account);
+	if ((0, node_fs.existsSync)(filePath)) try {
+		require("node:fs").rmSync(filePath, { force: true });
+		removedAny = true;
+	} catch {}
+	return removedAny ? "removed" : "absent";
 }
 function getDpapiFilePath(service, account) {
-  validateKeychainComponent(service, "service");
-  validateKeychainComponent(account, "account");
-  const appData = import_node_process.default.env["APPDATA"] ?? import_node_path.default.join((0, import_node_os.homedir)(), "AppData", "Roaming");
-  return import_node_path.default.join(appData, service, `${account}.enc`);
+	validateKeychainComponent(service, "service");
+	validateKeychainComponent(account, "account");
+	const appData = node_process.default.env["APPDATA"] ?? node_path.default.join((0, node_os.homedir)(), "AppData", "Roaming");
+	return node_path.default.join(appData, service, `${account}.enc`);
 }
 function isWindowsBackendAvailable() {
-  const r = (0, import_node_child_process.spawnSync)(POWERSHELL_BIN, ["-NoProfile", "-Command", "exit 0"], {
-    stdio: "ignore"
-  });
-  return r.status === 0;
+	return (0, node_child_process.spawnSync)(POWERSHELL_BIN, [
+		"-NoProfile",
+		"-Command",
+		"exit 0"
+	], { stdio: "ignore" }).status === 0;
 }
 function quotePs(value) {
-  return `'${value.replace(/'/g, "''")}'`;
+	return `'${value.replace(/'/g, "''")}'`;
 }
 async function readDpapi(filePath) {
-  if (!(0, import_node_fs.existsSync)(filePath)) {
-    return void 0;
-  }
-  const script = `
+	if (!(0, node_fs.existsSync)(filePath)) return;
+	const r = await runPsAsync(`
     Add-Type -AssemblyName System.Security
     $bytes = [Convert]::FromBase64String((Get-Content -Raw ${quotePs(filePath)}))
     $plain = [System.Security.Cryptography.ProtectedData]::Unprotect($bytes, $null, 'CurrentUser')
     [System.Text.Encoding]::UTF8.GetString($plain)
-  `;
-  const r = await runPsAsync(script);
-  if (r.status !== 0) {
-    return void 0;
-  }
-  const out = r.stdout.trim();
-  return out || void 0;
+  `);
+	if (r.status !== 0) return;
+	return r.stdout.trim() || void 0;
 }
 function readDpapiSync(filePath) {
-  if (!(0, import_node_fs.existsSync)(filePath)) {
-    return void 0;
-  }
-  const script = `
+	if (!(0, node_fs.existsSync)(filePath)) return;
+	const r = runPsSync(`
     Add-Type -AssemblyName System.Security
     $bytes = [Convert]::FromBase64String((Get-Content -Raw ${quotePs(filePath)}))
     $plain = [System.Security.Cryptography.ProtectedData]::Unprotect($bytes, $null, 'CurrentUser')
     [System.Text.Encoding]::UTF8.GetString($plain)
-  `;
-  const r = runPsSync(script);
-  if (r.status !== 0) {
-    return void 0;
-  }
-  const out = r.stdout.trim();
-  return out || void 0;
+  `);
+	if (r.status !== 0) return;
+	return r.stdout.trim() || void 0;
 }
 async function readWindows(service, account) {
-  const target = buildTarget(service, account);
-  const script = `
+	const ps = await runPsAsync(`
     try {
-      (Get-StoredCredential -Target ${quotePs(target)}).Password |
+      (Get-StoredCredential -Target ${quotePs(buildTarget(service, account))}).Password |
         ConvertFrom-SecureString -AsPlainText
     } catch { exit 1 }
-  `;
-  const ps = await runPsAsync(script);
-  if (ps.status === 0) {
-    const out = ps.stdout.trim();
-    if (out) {
-      return out;
-    }
-  }
-  return readDpapi(getDpapiFilePath(service, account));
+  `);
+	if (ps.status === 0) {
+		const out = ps.stdout.trim();
+		if (out) return out;
+	}
+	return readDpapi(getDpapiFilePath(service, account));
 }
 function readWindowsSync(service, account) {
-  const target = buildTarget(service, account);
-  const script = `
+	const ps = runPsSync(`
     try {
-      (Get-StoredCredential -Target ${quotePs(target)}).Password |
+      (Get-StoredCredential -Target ${quotePs(buildTarget(service, account))}).Password |
         ConvertFrom-SecureString -AsPlainText
     } catch { exit 1 }
-  `;
-  const ps = runPsSync(script);
-  if (ps.status === 0) {
-    const out = ps.stdout.trim();
-    if (out) {
-      return out;
-    }
-  }
-  return readDpapiSync(getDpapiFilePath(service, account));
+  `);
+	if (ps.status === 0) {
+		const out = ps.stdout.trim();
+		if (out) return out;
+	}
+	return readDpapiSync(getDpapiFilePath(service, account));
 }
 function runPsAsync(script, input) {
-  return new Promise((resolve) => {
-    const child = (0, import_node_child_process.spawn)(POWERSHELL_BIN, ["-NoProfile", "-Command", script], {
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.setEncoding("utf8");
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk;
-    });
-    child.stderr.setEncoding("utf8");
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk;
-    });
-    child.on("error", () => resolve({ status: -1, stdout, stderr }));
-    child.on("close", (status) => resolve({ status, stdout, stderr }));
-    if (input !== void 0) {
-      child.stdin.end(input);
-    } else {
-      child.stdin.end();
-    }
-  });
+	return new Promise((resolve) => {
+		const child = (0, node_child_process.spawn)(POWERSHELL_BIN, [
+			"-NoProfile",
+			"-Command",
+			script
+		], { stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		] });
+		let stdout = "";
+		let stderr = "";
+		child.stdout.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk;
+		});
+		child.stderr.setEncoding("utf8");
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk;
+		});
+		child.on("error", () => resolve({
+			status: -1,
+			stdout,
+			stderr
+		}));
+		child.on("close", (status) => resolve({
+			status,
+			stdout,
+			stderr
+		}));
+		if (input !== void 0) child.stdin.end(input);
+		else child.stdin.end();
+	});
 }
 function runPsSync(script, input) {
-  const r = (0, import_node_child_process.spawnSync)(POWERSHELL_BIN, ["-NoProfile", "-Command", script], {
-    encoding: "utf8",
-    input,
-    stdio: ["pipe", "pipe", "pipe"]
-  });
-  return { status: r.status, stdout: r.stdout, stderr: r.stderr };
+	const r = (0, node_child_process.spawnSync)(POWERSHELL_BIN, [
+		"-NoProfile",
+		"-Command",
+		script
+	], {
+		encoding: "utf8",
+		input,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		]
+	});
+	return {
+		status: r.status,
+		stdout: r.stdout,
+		stderr: r.stderr
+	};
 }
+/**
+* Reject identifier components (service / account names) that contain path
+* separators, `..` segments, or NUL bytes. These would escape the intended
+* `%APPDATA%\<service>\<account>.enc` layout and let a caller read or overwrite
+* arbitrary files under the user's profile.
+*
+* Throws on bad input rather than sanitizing — callers should pass logical
+* identifiers (e.g. `socket-cli`, `SOCKET_API_KEY`), not paths.
+*/
 function validateKeychainComponent(value, name) {
-  if (/[\\/]/.test(value) || value.includes("..") || value.includes("\0") || value === "" || value === ".") {
-    throw new Error(
-      `secrets/windows: ${name} contains path-traversal characters: ${JSON.stringify(value)}. Use a plain identifier (no \\\\, /, .., or NUL).`
-    );
-  }
+	if (/[\\/]/.test(value) || value.includes("..") || value.includes("\0") || value === "" || value === ".") throw new Error(`secrets/windows: ${name} contains path-traversal characters: ${JSON.stringify(value)}. Use a plain identifier (no \\\\, /, .., or NUL).`);
 }
 async function writeDpapi(filePath, value) {
-  const dir = import_node_path.default.dirname(filePath);
-  if (!(0, import_node_fs.existsSync)(dir)) {
-    (0, import_node_fs.mkdirSync)(dir, { recursive: true });
-  }
-  const script = `
+	const dir = node_path.default.dirname(filePath);
+	if (!(0, node_fs.existsSync)(dir)) (0, node_fs.mkdirSync)(dir, { recursive: true });
+	const r = await runPsAsync(`
     Add-Type -AssemblyName System.Security
     $token = [Console]::In.ReadToEnd().Trim()
     $bytes = [System.Text.Encoding]::UTF8.GetBytes($token)
     $protected = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, 'CurrentUser')
     [Convert]::ToBase64String($protected) | Set-Content -Path ${quotePs(filePath)} -NoNewline
-  `;
-  const r = await runPsAsync(script, value);
-  if (r.status !== 0) {
-    throw new Error(
-      `DPAPI file write failed: ${r.stderr.trim()}. Install the CredentialManager PowerShell module (\`Install-Module CredentialManager -Scope CurrentUser\`) for a cleaner storage path.`
-    );
-  }
+  `, value);
+	if (r.status !== 0) throw new Error(`DPAPI file write failed: ${r.stderr.trim()}. Install the CredentialManager PowerShell module (\`Install-Module CredentialManager -Scope CurrentUser\`) for a cleaner storage path.`);
 }
 function writeDpapiSync(filePath, value) {
-  const dir = import_node_path.default.dirname(filePath);
-  if (!(0, import_node_fs.existsSync)(dir)) {
-    (0, import_node_fs.mkdirSync)(dir, { recursive: true });
-  }
-  const script = `
+	const dir = node_path.default.dirname(filePath);
+	if (!(0, node_fs.existsSync)(dir)) (0, node_fs.mkdirSync)(dir, { recursive: true });
+	const r = runPsSync(`
     Add-Type -AssemblyName System.Security
     $token = [Console]::In.ReadToEnd().Trim()
     $bytes = [System.Text.Encoding]::UTF8.GetBytes($token)
     $protected = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, 'CurrentUser')
     [Convert]::ToBase64String($protected) | Set-Content -Path ${quotePs(filePath)} -NoNewline
-  `;
-  const r = runPsSync(script, value);
-  if (r.status !== 0) {
-    throw new Error(
-      `DPAPI file write failed: ${r.stderr.trim()}. Install the CredentialManager PowerShell module (\`Install-Module CredentialManager -Scope CurrentUser\`) for a cleaner storage path.`
-    );
-  }
+  `, value);
+	if (r.status !== 0) throw new Error(`DPAPI file write failed: ${r.stderr.trim()}. Install the CredentialManager PowerShell module (\`Install-Module CredentialManager -Scope CurrentUser\`) for a cleaner storage path.`);
 }
 async function writeWindows(service, account, value, _label) {
-  const target = buildTarget(service, account);
-  const psScript = `
+	if ((await runPsAsync(`
     $token = $input | Out-String
     $token = $token.Trim()
     $secure = ConvertTo-SecureString $token -AsPlainText -Force
     try {
-      New-StoredCredential -Target ${quotePs(target)} -UserName ${quotePs(account)} -SecurePassword $secure -Persist LocalMachine | Out-Null
+      New-StoredCredential -Target ${quotePs(buildTarget(service, account))} -UserName ${quotePs(account)} -SecurePassword $secure -Persist LocalMachine | Out-Null
       exit 0
     } catch { exit 1 }
-  `;
-  const ps = await runPsAsync(psScript, value);
-  if (ps.status === 0) {
-    return;
-  }
-  await writeDpapi(getDpapiFilePath(service, account), value);
+  `, value)).status === 0) return;
+	await writeDpapi(getDpapiFilePath(service, account), value);
 }
 function writeWindowsSync(service, account, value, _label) {
-  const target = buildTarget(service, account);
-  const psScript = `
+	if (runPsSync(`
     $token = $input | Out-String
     $token = $token.Trim()
     $secure = ConvertTo-SecureString $token -AsPlainText -Force
     try {
-      New-StoredCredential -Target ${quotePs(target)} -UserName ${quotePs(account)} -SecurePassword $secure -Persist LocalMachine | Out-Null
+      New-StoredCredential -Target ${quotePs(buildTarget(service, account))} -UserName ${quotePs(account)} -SecurePassword $secure -Persist LocalMachine | Out-Null
       exit 0
     } catch { exit 1 }
-  `;
-  const ps = runPsSync(psScript, value);
-  if (ps.status === 0) {
-    return;
-  }
-  writeDpapiSync(getDpapiFilePath(service, account), value);
+  `, value).status === 0) return;
+	writeDpapiSync(getDpapiFilePath(service, account), value);
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  buildTarget,
-  deleteWindows,
-  deleteWindowsSync,
-  getDpapiFilePath,
-  isWindowsBackendAvailable,
-  quotePs,
-  readDpapi,
-  readDpapiSync,
-  readWindows,
-  readWindowsSync,
-  runPsAsync,
-  runPsSync,
-  validateKeychainComponent,
-  writeDpapi,
-  writeDpapiSync,
-  writeWindows,
-  writeWindowsSync
-});
+
+//#endregion
+exports.buildTarget = buildTarget;
+exports.deleteWindows = deleteWindows;
+exports.deleteWindowsSync = deleteWindowsSync;
+exports.getDpapiFilePath = getDpapiFilePath;
+exports.isWindowsBackendAvailable = isWindowsBackendAvailable;
+exports.quotePs = quotePs;
+exports.readDpapi = readDpapi;
+exports.readDpapiSync = readDpapiSync;
+exports.readWindows = readWindows;
+exports.readWindowsSync = readWindowsSync;
+exports.runPsAsync = runPsAsync;
+exports.runPsSync = runPsSync;
+exports.validateKeychainComponent = validateKeychainComponent;
+exports.writeDpapi = writeDpapi;
+exports.writeDpapiSync = writeDpapiSync;
+exports.writeWindows = writeWindows;
+exports.writeWindowsSync = writeWindowsSync;

package/dist/shadow/skip.js

@@ -1,73 +1,54 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var skip_exports = {};
-__export(skip_exports, {
-  shouldSkipShadow: () => shouldSkipShadow
-});
-module.exports = __toCommonJS(skip_exports);
-var import_node_process = __toESM(require("node:process"));
-var import_normalize = require("../paths/normalize");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_paths_normalize = require('../paths/normalize.js');
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+
+//#region src/shadow/skip.ts
+/**
+* @file Shadow binary installation utilities for Socket ecosystem. Provides
+*   logic to determine when shadow binary installation should be skipped.
+*/
+/**
+* Determines if shadow binaries should be installed. Shadows should NOT be
+* installed when: - Running in a temporary execution context (exec/npx/dlx) -
+* On Windows with an existing binary path (required for Windows to function)
+*
+* @example
+*   ;```typescript
+*   if (shouldSkipShadow(binPath, { cwd: process.cwd() })) {
+*     console.log('Skipping shadow binary installation')
+*   }
+*   ```
+*
+* @param binPath - Path to the binary being shadowed.
+* @param options - Configuration options.
+* @param options.cwd - Current working directory path to check.
+* @param options.win32 - Whether running on Windows.
+*
+* @returns True if shadow installation should be skipped
+*/
 function shouldSkipShadow(binPath, options) {
-  const { cwd = import_node_process.default.cwd(), win32 = false } = {
-    __proto__: null,
-    ...options
-  };
-  if (win32 && binPath) {
-    return true;
-  }
-  const userAgent = import_node_process.default.env["npm_config_user_agent"];
-  if (userAgent?.includes("exec") || userAgent?.includes("npx") || // # socket-hook: allow npx
-  userAgent?.includes("dlx")) {
-    return true;
-  }
-  const normalizedCwd = (0, import_normalize.normalizePath)(cwd);
-  const npmCache = import_node_process.default.env["npm_config_cache"];
-  if (npmCache && normalizedCwd.includes((0, import_normalize.normalizePath)(npmCache))) {
-    return true;
-  }
-  const tempPatterns = [
-    // npm's npx cache directory
-    "_npx",
-    // pnpm dlx temporary store
-    ".pnpm-store",
-    // Common dlx directory prefix
-    "dlx-",
-    // Yarn Berry PnP virtual packages.
-    ".yarn/$$",
-    // Yarn on Windows uses normalized forward slash paths.
-    "AppData/Local/Temp/xfs-"
-  ];
-  return tempPatterns.some((pattern) => normalizedCwd.includes(pattern));
+	const { cwd = node_process.default.cwd(), win32 = false } = {
+		__proto__: null,
+		...options
+	};
+	if (win32 && binPath) return true;
+	const userAgent = node_process.default.env["npm_config_user_agent"];
+	if (userAgent?.includes("exec") || userAgent?.includes("npx") || userAgent?.includes("dlx")) return true;
+	const normalizedCwd = /* @__PURE__ */ require_paths_normalize.normalizePath(cwd);
+	const npmCache = node_process.default.env["npm_config_cache"];
+	if (npmCache && normalizedCwd.includes(/* @__PURE__ */ require_paths_normalize.normalizePath(npmCache))) return true;
+	return [
+		"_npx",
+		".pnpm-store",
+		"dlx-",
+		".yarn/$$",
+		"AppData/Local/Temp/xfs-"
+	].some((pattern) => normalizedCwd.includes(pattern));
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  shouldSkipShadow
-});
+
+//#endregion
+exports.shouldSkipShadow = shouldSkipShadow;

package/dist/shadow/types.js

@@ -1,18 +1,2 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var types_exports = {};
-module.exports = __toCommonJS(types_exports);
+/* Socket Lib - Built with rolldown */