@socketsecurity/lib 6.0.5 → 6.0.7

package/dist/dlx/detect.d.ts

@@ -11,36 +11,13 @@
  *   - DLX cache: Check for node_modules/ directory
  *   - Local paths: Check for package.json with bin field, then file extension
  */
-export declare function packageJsonPathCacheSet(key: string, value: string | undefined): void;
 export type ExecutableType = 'package' | 'binary' | 'unknown';
 export interface ExecutableDetectionResult {
     type: ExecutableType;
     method: 'dlx-cache' | 'package-json' | 'file-extension';
-    packageJsonPath?: string;
-    inDlxCache?: boolean;
+    packageJsonPath?: string | undefined;
+    inDlxCache?: boolean | undefined;
 }
-/**
- * Find package.json in the directory containing the file or parent directories.
- * Results are cached to avoid repeated directory traversal.
- *
- * @private
- *
- * @param filePath - Path to search from.
- *
- * @returns Path to package.json if found, undefined otherwise
- */
-export declare function findPackageJson(filePath: string): string | undefined;
-/**
- * Read and parse package.json with caching. Results are cached to avoid
- * repeated file reads.
- *
- * @private
- *
- * @param packageJsonPath - Path to package.json.
- *
- * @returns Parsed package.json or null if invalid
- */
-export declare function readPackageJson(packageJsonPath: string): object | undefined;
 /**
  * Detect executable type for paths in DLX cache. Uses filesystem structure
  * (node_modules/ presence).
@@ -95,6 +72,17 @@ export declare function detectExecutableType(filePath: string): ExecutableDetect
  * @returns Detection result
  */
 export declare function detectLocalExecutableType(filePath: string): ExecutableDetectionResult;
+/**
+ * Find package.json in the directory containing the file or parent directories.
+ * Results are cached to avoid repeated directory traversal.
+ *
+ * @private
+ *
+ * @param filePath - Path to search from.
+ *
+ * @returns Path to package.json if found, undefined otherwise
+ */
+export declare function findPackageJson(filePath: string): string | undefined;
 /**
  * Check if a file path indicates a Node.js script.
  *
@@ -138,3 +126,24 @@ export declare function isNativeBinary(filePath: string): boolean;
  * @returns True if detected as Node.js package
  */
 export declare function isNodePackage(filePath: string): boolean;
+/**
+ * Set a package.json path cache entry, evicting the oldest when the LRU is
+ * full.
+ *
+ * @private
+ *
+ * @param key - Start directory used as the cache key.
+ * @param value - Resolved package.json path, or undefined for a negative entry.
+ */
+export declare function packageJsonPathCacheSet(key: string, value: string | undefined): void;
+/**
+ * Read and parse package.json with caching. Results are cached to avoid
+ * repeated file reads.
+ *
+ * @private
+ *
+ * @param packageJsonPath - Path to package.json.
+ *
+ * @returns Parsed package.json or null if invalid
+ */
+export declare function readPackageJson(packageJsonPath: string): object | undefined;

package/dist/dlx/detect.js

@@ -8,7 +8,7 @@ const require_primordials_date = require('../primordials/date.js');
 const require_primordials_json = require('../primordials/json.js');
 const require_paths_socket = require('../paths/socket.js');
 const require_dlx_paths = require('./paths.js');
-const require_fs_find_up = require('../fs/find-up.js');
+const require_fs_find = require('../fs/find.js');
 
 //#region src/dlx/detect.ts
 /**
@@ -35,81 +35,8 @@ const NODE_JS_EXTENSIONS = new require_primordials_map_set.SetCtor([
 const PACKAGE_JSON_PATH_CACHE_MAX_SIZE = 200;
 const PACKAGE_JSON_NEGATIVE_TTL_MS = 1e4;
 const packageJsonPathCache = new require_primordials_map_set.MapCtor();
-function packageJsonPathCacheSet(key, value) {
-	if (packageJsonPathCache.has(key)) packageJsonPathCache.delete(key);
-	else if (packageJsonPathCache.size >= PACKAGE_JSON_PATH_CACHE_MAX_SIZE) {
-		const oldest = packageJsonPathCache.keys().next().value;
-		if (oldest !== void 0) packageJsonPathCache.delete(oldest);
-	}
-	packageJsonPathCache.set(key, {
-		path: value,
-		at: Date.now()
-	});
-}
 const packageJsonContentCache = new require_primordials_map_set.MapCtor();
 /**
-* Find package.json in the directory containing the file or parent directories.
-* Results are cached to avoid repeated directory traversal.
-*
-* @private
-*
-* @param filePath - Path to search from.
-*
-* @returns Path to package.json if found, undefined otherwise
-*/
-function findPackageJson(filePath) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const nodePath = /* @__PURE__ */ require_node_path.getNodePath();
-	const startDir = nodePath.dirname(nodePath.resolve(filePath));
-	const cached = packageJsonPathCache.get(startDir);
-	if (cached !== void 0) if (cached.path === void 0) {
-		if (require_primordials_date.DateNow() - cached.at < PACKAGE_JSON_NEGATIVE_TTL_MS) return;
-		packageJsonPathCache.delete(startDir);
-	} else if (fs.existsSync(cached.path)) {
-		packageJsonPathCacheSet(startDir, cached.path);
-		return cached.path;
-	} else packageJsonPathCache.delete(startDir);
-	const packageJsonPath = /* @__PURE__ */ require_fs_find_up.findUpSync("package.json", { cwd: startDir });
-	packageJsonPathCacheSet(startDir, packageJsonPath);
-	return packageJsonPath;
-}
-/**
-* Read and parse package.json with caching. Results are cached to avoid
-* repeated file reads.
-*
-* @private
-*
-* @param packageJsonPath - Path to package.json.
-*
-* @returns Parsed package.json or null if invalid
-*/
-function readPackageJson(packageJsonPath) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	let mtimeMs = 0;
-	try {
-		mtimeMs = fs.statSync(packageJsonPath).mtimeMs;
-	} catch {
-		packageJsonContentCache.delete(packageJsonPath);
-		return;
-	}
-	const cached = packageJsonContentCache.get(packageJsonPath);
-	if (cached !== void 0 && cached.mtimeMs === mtimeMs) return cached.content;
-	try {
-		const content = require_primordials_json.JSONParse(fs.readFileSync(packageJsonPath, "utf8"));
-		packageJsonContentCache.set(packageJsonPath, {
-			mtimeMs,
-			content
-		});
-		return content;
-	} catch {
-		packageJsonContentCache.set(packageJsonPath, {
-			mtimeMs,
-			content: void 0
-		});
-		return;
-	}
-}
-/**
 * Detect executable type for paths in DLX cache. Uses filesystem structure
 * (node_modules/ presence).
 *
@@ -124,8 +51,8 @@ function readPackageJson(packageJsonPath) {
 * @returns Detection result
 */
 function detectDlxExecutableType(filePath) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const fs = require_node_fs.getNodeFs();
+	const path = require_node_path.getNodePath();
 	const dlxDir = require_paths_socket.getSocketDlxDir();
 	const absolutePath = path.resolve(filePath);
 	const cacheKey = path.relative(dlxDir, absolutePath).split(path.sep)[0] ?? "";
@@ -204,6 +131,32 @@ function detectLocalExecutableType(filePath) {
 	};
 }
 /**
+* Find package.json in the directory containing the file or parent directories.
+* Results are cached to avoid repeated directory traversal.
+*
+* @private
+*
+* @param filePath - Path to search from.
+*
+* @returns Path to package.json if found, undefined otherwise
+*/
+function findPackageJson(filePath) {
+	const fs = require_node_fs.getNodeFs();
+	const nodePath = require_node_path.getNodePath();
+	const startDir = nodePath.dirname(nodePath.resolve(filePath));
+	const cached = packageJsonPathCache.get(startDir);
+	if (cached !== void 0) if (cached.path === void 0) {
+		if (require_primordials_date.DateNow() - cached.at < PACKAGE_JSON_NEGATIVE_TTL_MS) return;
+		packageJsonPathCache.delete(startDir);
+	} else if (fs.existsSync(cached.path)) {
+		packageJsonPathCacheSet(startDir, cached.path);
+		return cached.path;
+	} else packageJsonPathCache.delete(startDir);
+	const packageJsonPath = require_fs_find.findUpSync("package.json", { cwd: startDir });
+	packageJsonPathCacheSet(startDir, packageJsonPath);
+	return packageJsonPath;
+}
+/**
 * Check if a file path indicates a Node.js script.
 *
 * @example
@@ -218,7 +171,7 @@ function detectLocalExecutableType(filePath) {
 * @returns True if file has .js, .mjs, or .cjs extension
 */
 function isJsFilePath(filePath) {
-	const ext = (/* @__PURE__ */ require_node_path.getNodePath()).extname(filePath).toLowerCase();
+	const ext = require_node_path.getNodePath().extname(filePath).toLowerCase();
 	return NODE_JS_EXTENSIONS.has(ext);
 }
 /**
@@ -253,6 +206,62 @@ function isNativeBinary(filePath) {
 function isNodePackage(filePath) {
 	return detectExecutableType(filePath).type === "package";
 }
+/**
+* Set a package.json path cache entry, evicting the oldest when the LRU is
+* full.
+*
+* @private
+*
+* @param key - Start directory used as the cache key.
+* @param value - Resolved package.json path, or undefined for a negative entry.
+*/
+function packageJsonPathCacheSet(key, value) {
+	if (packageJsonPathCache.has(key)) packageJsonPathCache.delete(key);
+	else if (packageJsonPathCache.size >= PACKAGE_JSON_PATH_CACHE_MAX_SIZE) {
+		const oldest = packageJsonPathCache.keys().next().value;
+		if (oldest !== void 0) packageJsonPathCache.delete(oldest);
+	}
+	packageJsonPathCache.set(key, {
+		path: value,
+		at: Date.now()
+	});
+}
+/**
+* Read and parse package.json with caching. Results are cached to avoid
+* repeated file reads.
+*
+* @private
+*
+* @param packageJsonPath - Path to package.json.
+*
+* @returns Parsed package.json or null if invalid
+*/
+function readPackageJson(packageJsonPath) {
+	const fs = require_node_fs.getNodeFs();
+	let mtimeMs = 0;
+	try {
+		mtimeMs = fs.statSync(packageJsonPath).mtimeMs;
+	} catch {
+		packageJsonContentCache.delete(packageJsonPath);
+		return;
+	}
+	const cached = packageJsonContentCache.get(packageJsonPath);
+	if (cached !== void 0 && cached.mtimeMs === mtimeMs) return cached.content;
+	try {
+		const content = require_primordials_json.JSONParse(fs.readFileSync(packageJsonPath, "utf8"));
+		packageJsonContentCache.set(packageJsonPath, {
+			mtimeMs,
+			content
+		});
+		return content;
+	} catch {
+		packageJsonContentCache.set(packageJsonPath, {
+			mtimeMs,
+			content: void 0
+		});
+		return;
+	}
+}
 
 //#endregion
 exports.detectDlxExecutableType = detectDlxExecutableType;

package/dist/dlx/dir.js

@@ -20,7 +20,7 @@ const require_dlx_packages = require('./packages.js');
 *   ```
 */
 async function clearDlx() {
-	await /* @__PURE__ */ require_promises_iterate.pEach(await require_dlx_packages.listDlxPackagesAsync(), (pkg) => require_dlx_packages.removeDlxPackage(pkg));
+	await require_promises_iterate.pEach(await require_dlx_packages.listDlxPackagesAsync(), (pkg) => require_dlx_packages.removeDlxPackage(pkg));
 }
 /**
 * Clear all DLX package installations synchronously.
@@ -45,7 +45,7 @@ function clearDlxSync() {
 *   ```
 */
 function dlxDirExists() {
-	return (/* @__PURE__ */ require_node_fs.getNodeFs()).existsSync(require_paths_socket.getSocketDlxDir());
+	return require_node_fs.getNodeFs().existsSync(require_paths_socket.getSocketDlxDir());
 }
 /**
 * Ensure the DLX directory exists, creating it if necessary.

package/dist/dlx/firewall.d.ts

@@ -7,7 +7,7 @@
  *     `dlx/package.ts` so the firewall logic + PURL helper can be reused by
  *     other dlx flows without dragging in the install orchestrator.
  */
-import Arborist from '../external/@npmcli/arborist';
+import type Arborist from '../external/@npmcli/arborist';
 /**
  * Check all resolved packages in an Arborist ideal tree against the Socket
  * Firewall API (public, no auth required). Throws if any dependency has

package/dist/dlx/lockfile.d.ts

@@ -1,15 +1,15 @@
 /**
- * @file Package pin generation for dlx installs. `generatePackagePin` resolves
- *   an npm package against the registry using Arborist's lockfile-only mode and
- *   fetches its top-level tarball to return both hash formats plus the lockfile
- *   content — everything needed to vendor a reproducible install. The
+ * @file Package pin generation for dlx installs. `resolveNpmPackagePin`
+ *   resolves an npm package against the registry using Arborist's lockfile-only
+ *   mode and fetches its top-level tarball to return both hash formats plus the
+ *   lockfile content — everything needed to vendor a reproducible install. The
  *   `LockfileSpec` type is also exported here for use as the `lockfile` option
- *   on `downloadPackage`. Sniff/write handling lives inline in `./package.ts` —
- *   no helper.
+ *   on `downloadNpmPackage`. Sniff/write handling lives inline in
+ *   `./package.ts` — no helper.
  */
 import type { ComputedHashes } from '../integrity';
 /**
- * Lockfile source for the `lockfile` option on `downloadPackage`.
+ * Lockfile source for the `lockfile` option on `downloadNpmPackage`.
  *
  * Bare strings are sniffed: a leading `{` (after whitespace) means JSON
  * content, anything else is treated as a filesystem path. Pass the explicit `{
@@ -40,11 +40,7 @@ export declare const DEFAULT_MIN_RELEASE_DAYS = 7;
 /**
  * Options for generating a vendorable pin for an npm package.
  */
-export interface GeneratePackagePinOptions {
-    /**
-     * Package spec, e.g. `'@anthropic-ai/claude-code@2.1.92'`.
-     */
-    package: string;
+export interface ResolveNpmPackagePinOptions {
     /**
      * Minimum release age in days. Refuses to resolve any version (direct or
      * transitive) published more recently than `Date.now() - N days`.
@@ -62,12 +58,17 @@ export interface GeneratePackagePinOptions {
      * exclusive with {@link minReleaseDays}.
      */
     minReleaseMins?: number | undefined;
+    /**
+     * Package spec, e.g. `'@anthropic-ai/claude-code@2.1.92'`. Named `spec` to
+     * match `downloadNpmPackage`/`downloadPipPackage`.
+     */
+    spec: string;
 }
 /**
- * Result of {@link generatePackagePin}. All file data is returned as content —
+ * Result of {@link resolveNpmPackagePin}. All file data is returned as content —
  * the caller decides whether/where to write it.
  */
-export interface PinDetails {
+export interface NpmPackagePin {
     /**
      * Resolved package name.
      */
@@ -95,7 +96,7 @@ export interface PinDetails {
  */
 export declare class DlxLockfileError extends Error {
     constructor(message: string, options?: {
-        cause?: unknown;
+        cause?: unknown | undefined;
     } | undefined);
 }
 /**
@@ -112,15 +113,15 @@ export declare class DlxLockfileError extends Error {
  *
  * @example
  *   ;```ts
- *   const pin = await generatePackagePin({
- *     package: '@anthropic-ai/claude-code@2.1.92',
+ *   const pin = await resolveNpmPackagePin({
+ *     spec: '@anthropic-ai/claude-code@2.1.92',
  *   })
  *   await fs.writeFile('./claude.lock.json', pin.lockfile, 'utf8')
  *   // pin.hash.integrity → 'sha512-…'
  *   // pin.hash.checksum  → hex
  *   ```
  */
-export declare function generatePackagePin(options: GeneratePackagePinOptions): Promise<PinDetails>;
+export declare function resolveNpmPackagePin(options: ResolveNpmPackagePinOptions): Promise<NpmPackagePin>;
 /**
  * Extract the package name from a spec like `'name@range'` or
  * `'@scope/name@range'` or a bare `'name'`.

package/dist/dlx/lockfile.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
-const require_primordials_string = require('../primordials/string.js');
 const require_integrity = require('../integrity.js');
+const require_primordials_string = require('../primordials/string.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
 const require_primordials_date = require('../primordials/date.js');
@@ -17,13 +17,13 @@ src_external_pacote = require_runtime.__toESM(src_external_pacote);
 
 //#region src/dlx/lockfile.ts
 /**
-* @file Package pin generation for dlx installs. `generatePackagePin` resolves
-*   an npm package against the registry using Arborist's lockfile-only mode and
-*   fetches its top-level tarball to return both hash formats plus the lockfile
-*   content — everything needed to vendor a reproducible install. The
+* @file Package pin generation for dlx installs. `resolveNpmPackagePin`
+*   resolves an npm package against the registry using Arborist's lockfile-only
+*   mode and fetches its top-level tarball to return both hash formats plus the
+*   lockfile content — everything needed to vendor a reproducible install. The
 *   `LockfileSpec` type is also exported here for use as the `lockfile` option
-*   on `downloadPackage`. Sniff/write handling lives inline in `./package.ts` —
-*   no helper.
+*   on `downloadNpmPackage`. Sniff/write handling lives inline in
+*   `./package.ts` — no helper.
 */
 /**
 * Default minimum release age in days applied when a caller passes neither
@@ -55,20 +55,20 @@ var DlxLockfileError = class extends Error {
 *
 * @example
 *   ;```ts
-*   const pin = await generatePackagePin({
-*     package: '@anthropic-ai/claude-code@2.1.92',
+*   const pin = await resolveNpmPackagePin({
+*     spec: '@anthropic-ai/claude-code@2.1.92',
 *   })
 *   await fs.writeFile('./claude.lock.json', pin.lockfile, 'utf8')
 *   // pin.hash.integrity → 'sha512-…'
 *   // pin.hash.checksum  → hex
 *   ```
 */
-async function generatePackagePin(options) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
-	const { minReleaseDays, minReleaseMins, package: spec } = options;
-	if (typeof spec !== "string" || spec.length === 0) throw new DlxLockfileError("generatePackagePin requires a package spec");
-	if (minReleaseDays !== void 0 && minReleaseMins !== void 0) throw new DlxLockfileError("generatePackagePin: minReleaseDays and minReleaseMins are mutually exclusive");
+async function resolveNpmPackagePin(options) {
+	const fs = require_node_fs.getNodeFs();
+	const path = require_node_path.getNodePath();
+	const { minReleaseDays, minReleaseMins, spec } = options;
+	if (typeof spec !== "string" || spec.length === 0) throw new DlxLockfileError("resolveNpmPackagePin requires a package spec");
+	if (minReleaseDays !== void 0 && minReleaseMins !== void 0) throw new DlxLockfileError("resolveNpmPackagePin: minReleaseDays and minReleaseMins are mutually exclusive");
 	const effectiveDays = minReleaseDays !== void 0 ? minReleaseDays : minReleaseMins !== void 0 ? void 0 : 7;
 	const ageMs = effectiveDays !== void 0 ? effectiveDays * 864e5 : minReleaseMins !== void 0 ? minReleaseMins * 6e4 : 0;
 	const before = ageMs > 0 ? new require_primordials_date.DateCtor(require_primordials_date.DateNow() - ageMs) : void 0;
@@ -125,6 +125,6 @@ function specRange(spec) {
 //#endregion
 exports.DEFAULT_MIN_RELEASE_DAYS = DEFAULT_MIN_RELEASE_DAYS;
 exports.DlxLockfileError = DlxLockfileError;
-exports.generatePackagePin = generatePackagePin;
+exports.resolveNpmPackagePin = resolveNpmPackagePin;
 exports.specName = specName;
 exports.specRange = specRange;

package/dist/dlx/manifest.d.ts

@@ -27,12 +27,12 @@
  */
 export interface PackageDetails {
     installed_version: string;
-    size?: number;
+    size?: number | undefined;
     update_check?: {
         last_check: number;
         last_notification: number;
         latest_known: string;
-    };
+    } | undefined;
 }
 /**
  * Details for binary download entries.
@@ -47,8 +47,8 @@ export interface BinaryDetails {
     size: number;
     source: {
         type: 'download' | 'extract';
-        url?: string;
-        path?: string;
+        url?: string | undefined;
+        path?: string | undefined;
     };
     /**
      * Update check metadata (same structure as packages).
@@ -57,7 +57,7 @@ export interface BinaryDetails {
         last_check: number;
         last_notification: number;
         latest_known: string;
-    };
+    } | undefined;
 }
 /**
  * Unified manifest entry for all cached items (packages and binaries). Shared
@@ -81,7 +81,7 @@ export interface DlxManifestOptions {
     /**
      * Custom manifest file path (defaults to ~/.socket/_dlx/.dlx-manifest.json).
      */
-    manifestPath?: string;
+    manifestPath?: string | undefined;
 }
 /**
  * Type guard for binary entries.

package/dist/dlx/manifest.js

@@ -4,8 +4,8 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
 const require_primordials_date = require('../primordials/date.js');
-const require_primordials_object = require('../primordials/object.js');
 const require_primordials_json = require('../primordials/json.js');
+const require_primordials_object = require('../primordials/object.js');
 const require_errors_message = require('../errors/message.js');
 const require_logger_default = require('../logger/default.js');
 const require_paths_socket = require('../paths/socket.js');
@@ -38,8 +38,8 @@ const require_fs_read_file = require('../fs/read-file.js');
 *   - Binary metadata tracking
 *   - Rate limiting registry requests
 */
-const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-const path = /* @__PURE__ */ require_node_path.getNodePath();
+const fs = require_node_fs.getNodeFs();
+const path = require_node_path.getNodePath();
 const logger = require_logger_default.getDefaultLogger();
 /**
 * Manifest file name.
@@ -92,7 +92,7 @@ var DlxManifest = class {
 	readManifest() {
 		try {
 			if (!fs.existsSync(this.manifestPath)) return { __proto__: null };
-			const rawContent = /* @__PURE__ */ require_fs_read_file.readFileUtf8Sync(this.manifestPath);
+			const rawContent = require_fs_read_file.readFileUtf8Sync(this.manifestPath);
 			const content = (typeof rawContent === "string" ? rawContent : rawContent.toString("utf8")).trim();
 			if (!content) return { __proto__: null };
 			return require_primordials_json.JSONParse(content);
@@ -172,7 +172,7 @@ var DlxManifest = class {
 	getAllPackages() {
 		try {
 			if (!fs.existsSync(this.manifestPath)) return [];
-			const rawContent = /* @__PURE__ */ require_fs_read_file.readFileUtf8Sync(this.manifestPath);
+			const rawContent = require_fs_read_file.readFileUtf8Sync(this.manifestPath);
 			const content = (typeof rawContent === "string" ? rawContent : rawContent.toString("utf8")).trim();
 			if (!content) return [];
 			return require_primordials_object.ObjectKeys(require_primordials_json.JSONParse(content));

package/dist/dlx/package.d.ts

@@ -20,9 +20,9 @@
  *   - dlx/binary.ts: Downloads standalone binaries from URLs
  *   - dlx/package.ts: Installs npm packages from registries Implementation:
  *   - Uses Arborist for package installation (like npx, no npm CLI required)
- *   - Split into downloadPackage() and executePackage() for flexibility
+ *   - Split into downloadNpmPackage() and executePackage() for flexibility
  *   - dlxPackage() combines both for convenience Module shape: this file holds
- *     the three async orchestrators (`dlxPackage`, `downloadPackage`,
+ *     the three async orchestrators (`dlxPackage`, `downloadNpmPackage`,
  *     `ensurePackageInstalled`) and the synchronous `executePackage`. The
  *     supporting surface lives in sibling leaves and is re-exported here so
  *     existing `dlx/package` importers keep working unchanged:
@@ -33,7 +33,7 @@
  *   - lazy `node:fs` / `node:path` + LRU cache — `./_internal`
  */
 import { spawn } from '../process/spawn/child';
-import type { DlxPackageOptions, DlxPackageResult, DownloadPackageResult, EnsurePackageInstallOptions } from './types';
+import type { DlxPackageOptions, DlxPackageResult, DownloadNpmPackageResult, EnsurePackageInstallOptions } from './types';
 import type { SpawnExtra, SpawnOptions } from '../process/spawn/types';
 /**
  * Execute a package via DLX - install if needed and run its binary.
@@ -47,7 +47,7 @@ import type { SpawnExtra, SpawnOptions } from '../process/spawn/types';
  *   ;```typescript
  *   // Download and execute cdxgen
  *   const result = await dlxPackage(['--version'], {
- *     package: '@cyclonedx/cdxgen@10.0.0',
+ *     spec: '@cyclonedx/cdxgen@10.0.0',
  *   })
  *   await result.spawnPromise
  *   ```
@@ -61,15 +61,15 @@ export declare function dlxPackage(args: readonly string[] | string[], options:
  * @example
  *   ;```typescript
  *   // Install @socketsecurity/cli without running it
- *   const result = await downloadPackage({
- *     package: '@socketsecurity/cli@1.2.0',
+ *   const result = await downloadNpmPackage({
+ *     spec: '@socketsecurity/cli@1.2.0',
  *     force: true,
  *   })
  *   console.log('Installed to:', result.packageDir)
  *   console.log('Binary at:', result.binaryPath)
  *   ```
  */
-export declare function downloadPackage(options: DlxPackageOptions): Promise<DownloadPackageResult>;
+export declare function downloadNpmPackage(options: DlxPackageOptions): Promise<DownloadNpmPackageResult>;
 /**
  * Install package to ~/.socket/_dlx/<hash>/ if not already installed. Uses
  * pacote for installation (no npm CLI required). Protected by process lock to
@@ -91,7 +91,7 @@ export declare function ensurePackageInstalled(packageName: string, packageSpec:
 }>;
 /**
  * Execute a package's binary with cross-platform shell handling. The package
- * must already be installed (use downloadPackage first).
+ * must already be installed (use downloadNpmPackage first).
  *
  * On Windows, script files (.bat, .cmd, .ps1) require shell: true. Matches
  * npm/npx execution behavior.
@@ -99,7 +99,7 @@ export declare function ensurePackageInstalled(packageName: string, packageSpec:
  * @example
  *   ;```typescript
  *   // Execute an already-installed package
- *   const downloaded = await downloadPackage({ package: 'cowsay@1.5.0' })
+ *   const downloaded = await downloadNpmPackage({ spec: 'cowsay@1.5.0' })
  *   const result = await executePackage(
  *     downloaded.binaryPath,
  *     ['Hello World'],
@@ -112,4 +112,4 @@ export { binaryPathCacheSet } from './_internal';
 export { findBinaryPath, makePackageBinsExecutable, resolveBinaryPath, } from './binary-resolution';
 export { checkFirewallPurls, npmPurl } from './firewall';
 export { parsePackageSpec } from './spec';
-export type { DlxPackageOptions, DlxPackageResult, DownloadPackageResult, EnsurePackageInstallOptions, } from './types';
+export type { DlxPackageOptions, DlxPackageResult, DownloadNpmPackageResult, EnsurePackageInstallOptions, } from './types';