@socketsecurity/lib 6.0.6 → 6.0.8

package/dist/dlx/binary-resolution.js

@@ -4,10 +4,10 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_error = require('../primordials/error.js');
 const require_constants_platform = require('../constants/platform.js');
+const require_primordials_object = require('../primordials/object.js');
 const require_paths_normalize = require('../paths/normalize.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
-const require_primordials_object = require('../primordials/object.js');
 const require_fs_read_json = require('../fs/read-json.js');
 const require_dlx__internal = require('./_internal.js');
 let src_external_libnpmexec = require("../external/libnpmexec");
@@ -41,9 +41,9 @@ src_external_libnpmexec = require_runtime.__toESM(src_external_libnpmexec);
 *   ```
 */
 function findBinaryPath(packageDir, packageName, binaryName) {
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
-	const installedDir = /* @__PURE__ */ require_paths_normalize.normalizePath(path.join(packageDir, "node_modules", packageName));
-	const pkgJson = /* @__PURE__ */ require_fs_read_json.readJsonSync(path.join(installedDir, "package.json"));
+	const path = require_node_path.getNodePath();
+	const installedDir = require_paths_normalize.normalizePath(path.join(packageDir, "node_modules", packageName));
+	const pkgJson = require_fs_read_json.readJsonSync(path.join(installedDir, "package.json"));
 	const bin = pkgJson["bin"];
 	let binName;
 	let binPath;
@@ -82,7 +82,7 @@ function findBinaryPath(packageDir, packageName, binaryName) {
 		}
 	}
 	if (!binPath) throw new require_primordials_error.ErrorCtor(`No binary found for package "${packageName}"`);
-	return resolveBinaryPath(/* @__PURE__ */ require_paths_normalize.normalizePath(path.join(installedDir, binPath)));
+	return resolveBinaryPath(require_paths_normalize.normalizePath(path.join(installedDir, binPath)));
 }
 /**
 * Make all binaries in an installed package executable. Reads the package.json
@@ -105,12 +105,12 @@ function findBinaryPath(packageDir, packageName, binaryName) {
 */
 function makePackageBinsExecutable(packageDir, packageName) {
 	if (require_constants_platform.WIN32) return;
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
-	const installedDir = /* @__PURE__ */ require_paths_normalize.normalizePath(path.join(packageDir, "node_modules", packageName));
+	const fs = require_node_fs.getNodeFs();
+	const path = require_node_path.getNodePath();
+	const installedDir = require_paths_normalize.normalizePath(path.join(packageDir, "node_modules", packageName));
 	const pkgJsonPath = path.join(installedDir, "package.json");
 	try {
-		const bin = (/* @__PURE__ */ require_fs_read_json.readJsonSync(pkgJsonPath))["bin"];
+		const bin = require_fs_read_json.readJsonSync(pkgJsonPath)["bin"];
 		if (!bin) return;
 		const binPaths = [];
 		if (typeof bin === "string") binPaths.push(bin);
@@ -118,8 +118,9 @@ function makePackageBinsExecutable(packageDir, packageName) {
 			const binObj = bin;
 			binPaths.push(...require_primordials_object.ObjectValues(binObj));
 		}
-		for (const binPath of binPaths) {
-			const fullPath = /* @__PURE__ */ require_paths_normalize.normalizePath(path.join(installedDir, binPath));
+		for (let i = 0, { length } = binPaths; i < length; i += 1) {
+			const binPath = binPaths[i];
+			const fullPath = require_paths_normalize.normalizePath(path.join(installedDir, binPath));
 			if (fs.existsSync(fullPath)) try {
 				fs.chmodSync(fullPath, 493);
 			} catch {}
@@ -141,7 +142,7 @@ function makePackageBinsExecutable(packageDir, packageName) {
 */
 function resolveBinaryPath(basePath) {
 	if (!require_constants_platform.WIN32) return basePath;
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const fs = require_node_fs.getNodeFs();
 	const cached = require_dlx__internal.binaryPathCache.get(basePath);
 	if (cached) {
 		if (fs.existsSync(cached)) {
@@ -150,14 +151,15 @@ function resolveBinaryPath(basePath) {
 		}
 		require_dlx__internal.binaryPathCache.delete(basePath);
 	}
-	for (const ext of [
+	const extensions = [
 		".cmd",
 		".bat",
 		".ps1",
 		".exe",
 		""
-	]) {
-		const testPath = basePath + ext;
+	];
+	for (let i = 0, { length } = extensions; i < length; i += 1) {
+		const testPath = basePath + extensions[i];
 		if (fs.existsSync(testPath)) {
 			require_dlx__internal.binaryPathCacheSet(basePath, testPath);
 			return testPath;

package/dist/dlx/binary-types.d.ts

@@ -132,13 +132,13 @@ export interface DlxMetadata {
     size: number;
     source?: {
         type: 'download' | 'extract' | 'package';
-        url?: string;
-        path?: string;
-        spec?: string;
-    };
+        url?: string | undefined;
+        path?: string | undefined;
+        spec?: string | undefined;
+    } | undefined;
     update_check?: {
         last_check: number;
         last_notification: number;
         latest_known: string;
-    };
+    } | undefined;
 }

package/dist/dlx/binary.js

@@ -59,18 +59,18 @@ async function dlxBinary(args, options, spawnExtra) {
 		if (normalized.type === "integrity") integrity = normalized.value;
 		else sha256 = normalized.value;
 	}
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const fs = require_node_fs.getNodeFs();
+	const path = require_node_path.getNodePath();
 	const force = yes === true ? true : userForce;
 	const cacheDir = require_dlx_binary_cache.getDlxCachePath();
 	const binaryName = name || `binary-${node_process.default.platform}-${require_constants_platform.getArch()}`;
 	const cacheKey = require_dlx_cache.generateCacheKey(`${url}:${binaryName}`);
 	const cacheEntryDir = path.join(cacheDir, cacheKey);
-	const binaryPath = /* @__PURE__ */ require_paths_normalize.normalizePath(path.join(cacheEntryDir, binaryName));
+	const binaryPath = require_paths_normalize.normalizePath(path.join(cacheEntryDir, binaryName));
 	let downloaded = false;
 	let computedIntegrity = integrity;
 	if (!force && fs.existsSync(cacheEntryDir) && await require_dlx_binary_cache.isBinaryCacheValid(cacheEntryDir, cacheTtl)) try {
-		const metadata = await /* @__PURE__ */ require_fs_read_json.readJson(require_dlx_binary_cache.getBinaryCacheMetadataPath(cacheEntryDir), { throws: false });
+		const metadata = await require_fs_read_json.readJson(require_dlx_binary_cache.getBinaryCacheMetadataPath(cacheEntryDir), { throws: false });
 		if (metadata && typeof metadata === "object" && !require_primordials_array.ArrayIsArray(metadata) && typeof metadata["integrity"] === "string") {
 			computedIntegrity = metadata["integrity"];
 			if (!fs.existsSync(binaryPath)) downloaded = true;
@@ -129,7 +129,7 @@ async function dlxBinary(args, options, spawnExtra) {
 */
 function executeBinary(binaryPath, args, spawnOptions, spawnExtra) {
 	const needsShell = require_constants_platform.WIN32 && /\.(?:bat|cmd|ps1)$/i.test(binaryPath);
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const path = require_node_path.getNodePath();
 	const cacheEntryDir = path.dirname(binaryPath);
 	return require_process_spawn_child.spawn(binaryPath, args, needsShell ? {
 		...spawnOptions,

package/dist/dlx/cache.js

@@ -41,7 +41,7 @@ const require_crypto_hash = require('../crypto/hash.js');
 * hashes the package spec (name@version), not just name.
 */
 function generateCacheKey(spec) {
-	return (/* @__PURE__ */ require_crypto_hash.hash("sha512", spec, "hex")).substring(0, 16);
+	return require_crypto_hash.hash("sha512", spec, "hex").substring(0, 16);
 }
 
 //#endregion

package/dist/dlx/detect.d.ts

@@ -11,36 +11,21 @@
  *   - DLX cache: Check for node_modules/ directory
  *   - Local paths: Check for package.json with bin field, then file extension
  */
-export declare function packageJsonPathCacheSet(key: string, value: string | undefined): void;
+export type PackageJsonPathEntry = {
+    path: string | undefined;
+    at: number;
+};
+export type PackageJsonCacheEntry = {
+    mtimeMs: number;
+    content: object | undefined;
+};
 export type ExecutableType = 'package' | 'binary' | 'unknown';
 export interface ExecutableDetectionResult {
     type: ExecutableType;
     method: 'dlx-cache' | 'package-json' | 'file-extension';
-    packageJsonPath?: string;
-    inDlxCache?: boolean;
+    packageJsonPath?: string | undefined;
+    inDlxCache?: boolean | undefined;
 }
-/**
- * Find package.json in the directory containing the file or parent directories.
- * Results are cached to avoid repeated directory traversal.
- *
- * @private
- *
- * @param filePath - Path to search from.
- *
- * @returns Path to package.json if found, undefined otherwise
- */
-export declare function findPackageJson(filePath: string): string | undefined;
-/**
- * Read and parse package.json with caching. Results are cached to avoid
- * repeated file reads.
- *
- * @private
- *
- * @param packageJsonPath - Path to package.json.
- *
- * @returns Parsed package.json or null if invalid
- */
-export declare function readPackageJson(packageJsonPath: string): object | undefined;
 /**
  * Detect executable type for paths in DLX cache. Uses filesystem structure
  * (node_modules/ presence).
@@ -95,6 +80,17 @@ export declare function detectExecutableType(filePath: string): ExecutableDetect
  * @returns Detection result
  */
 export declare function detectLocalExecutableType(filePath: string): ExecutableDetectionResult;
+/**
+ * Find package.json in the directory containing the file or parent directories.
+ * Results are cached to avoid repeated directory traversal.
+ *
+ * @private
+ *
+ * @param filePath - Path to search from.
+ *
+ * @returns Path to package.json if found, undefined otherwise
+ */
+export declare function findPackageJson(filePath: string): string | undefined;
 /**
  * Check if a file path indicates a Node.js script.
  *
@@ -138,3 +134,24 @@ export declare function isNativeBinary(filePath: string): boolean;
  * @returns True if detected as Node.js package
  */
 export declare function isNodePackage(filePath: string): boolean;
+/**
+ * Set a package.json path cache entry, evicting the oldest when the LRU is
+ * full.
+ *
+ * @private
+ *
+ * @param key - Start directory used as the cache key.
+ * @param value - Resolved package.json path, or undefined for a negative entry.
+ */
+export declare function packageJsonPathCacheSet(key: string, value: string | undefined): void;
+/**
+ * Read and parse package.json with caching. Results are cached to avoid
+ * repeated file reads.
+ *
+ * @private
+ *
+ * @param packageJsonPath - Path to package.json.
+ *
+ * @returns Parsed package.json or null if invalid
+ */
+export declare function readPackageJson(packageJsonPath: string): object | undefined;

package/dist/dlx/detect.js

@@ -8,7 +8,7 @@ const require_primordials_date = require('../primordials/date.js');
 const require_primordials_json = require('../primordials/json.js');
 const require_paths_socket = require('../paths/socket.js');
 const require_dlx_paths = require('./paths.js');
-const require_fs_find_up = require('../fs/find-up.js');
+const require_fs_find = require('../fs/find.js');
 
 //#region src/dlx/detect.ts
 /**
@@ -35,81 +35,8 @@ const NODE_JS_EXTENSIONS = new require_primordials_map_set.SetCtor([
 const PACKAGE_JSON_PATH_CACHE_MAX_SIZE = 200;
 const PACKAGE_JSON_NEGATIVE_TTL_MS = 1e4;
 const packageJsonPathCache = new require_primordials_map_set.MapCtor();
-function packageJsonPathCacheSet(key, value) {
-	if (packageJsonPathCache.has(key)) packageJsonPathCache.delete(key);
-	else if (packageJsonPathCache.size >= PACKAGE_JSON_PATH_CACHE_MAX_SIZE) {
-		const oldest = packageJsonPathCache.keys().next().value;
-		if (oldest !== void 0) packageJsonPathCache.delete(oldest);
-	}
-	packageJsonPathCache.set(key, {
-		path: value,
-		at: Date.now()
-	});
-}
 const packageJsonContentCache = new require_primordials_map_set.MapCtor();
 /**
-* Find package.json in the directory containing the file or parent directories.
-* Results are cached to avoid repeated directory traversal.
-*
-* @private
-*
-* @param filePath - Path to search from.
-*
-* @returns Path to package.json if found, undefined otherwise
-*/
-function findPackageJson(filePath) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const nodePath = /* @__PURE__ */ require_node_path.getNodePath();
-	const startDir = nodePath.dirname(nodePath.resolve(filePath));
-	const cached = packageJsonPathCache.get(startDir);
-	if (cached !== void 0) if (cached.path === void 0) {
-		if (require_primordials_date.DateNow() - cached.at < PACKAGE_JSON_NEGATIVE_TTL_MS) return;
-		packageJsonPathCache.delete(startDir);
-	} else if (fs.existsSync(cached.path)) {
-		packageJsonPathCacheSet(startDir, cached.path);
-		return cached.path;
-	} else packageJsonPathCache.delete(startDir);
-	const packageJsonPath = /* @__PURE__ */ require_fs_find_up.findUpSync("package.json", { cwd: startDir });
-	packageJsonPathCacheSet(startDir, packageJsonPath);
-	return packageJsonPath;
-}
-/**
-* Read and parse package.json with caching. Results are cached to avoid
-* repeated file reads.
-*
-* @private
-*
-* @param packageJsonPath - Path to package.json.
-*
-* @returns Parsed package.json or null if invalid
-*/
-function readPackageJson(packageJsonPath) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	let mtimeMs = 0;
-	try {
-		mtimeMs = fs.statSync(packageJsonPath).mtimeMs;
-	} catch {
-		packageJsonContentCache.delete(packageJsonPath);
-		return;
-	}
-	const cached = packageJsonContentCache.get(packageJsonPath);
-	if (cached !== void 0 && cached.mtimeMs === mtimeMs) return cached.content;
-	try {
-		const content = require_primordials_json.JSONParse(fs.readFileSync(packageJsonPath, "utf8"));
-		packageJsonContentCache.set(packageJsonPath, {
-			mtimeMs,
-			content
-		});
-		return content;
-	} catch {
-		packageJsonContentCache.set(packageJsonPath, {
-			mtimeMs,
-			content: void 0
-		});
-		return;
-	}
-}
-/**
 * Detect executable type for paths in DLX cache. Uses filesystem structure
 * (node_modules/ presence).
 *
@@ -124,8 +51,8 @@ function readPackageJson(packageJsonPath) {
 * @returns Detection result
 */
 function detectDlxExecutableType(filePath) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const fs = require_node_fs.getNodeFs();
+	const path = require_node_path.getNodePath();
 	const dlxDir = require_paths_socket.getSocketDlxDir();
 	const absolutePath = path.resolve(filePath);
 	const cacheKey = path.relative(dlxDir, absolutePath).split(path.sep)[0] ?? "";
@@ -204,6 +131,32 @@ function detectLocalExecutableType(filePath) {
 	};
 }
 /**
+* Find package.json in the directory containing the file or parent directories.
+* Results are cached to avoid repeated directory traversal.
+*
+* @private
+*
+* @param filePath - Path to search from.
+*
+* @returns Path to package.json if found, undefined otherwise
+*/
+function findPackageJson(filePath) {
+	const fs = require_node_fs.getNodeFs();
+	const nodePath = require_node_path.getNodePath();
+	const startDir = nodePath.dirname(nodePath.resolve(filePath));
+	const cached = packageJsonPathCache.get(startDir);
+	if (cached !== void 0) if (cached.path === void 0) {
+		if (require_primordials_date.DateNow() - cached.at < PACKAGE_JSON_NEGATIVE_TTL_MS) return;
+		packageJsonPathCache.delete(startDir);
+	} else if (fs.existsSync(cached.path)) {
+		packageJsonPathCacheSet(startDir, cached.path);
+		return cached.path;
+	} else packageJsonPathCache.delete(startDir);
+	const packageJsonPath = require_fs_find.findUpSync("package.json", { cwd: startDir });
+	packageJsonPathCacheSet(startDir, packageJsonPath);
+	return packageJsonPath;
+}
+/**
 * Check if a file path indicates a Node.js script.
 *
 * @example
@@ -218,7 +171,7 @@ function detectLocalExecutableType(filePath) {
 * @returns True if file has .js, .mjs, or .cjs extension
 */
 function isJsFilePath(filePath) {
-	const ext = (/* @__PURE__ */ require_node_path.getNodePath()).extname(filePath).toLowerCase();
+	const ext = require_node_path.getNodePath().extname(filePath).toLowerCase();
 	return NODE_JS_EXTENSIONS.has(ext);
 }
 /**
@@ -253,6 +206,62 @@ function isNativeBinary(filePath) {
 function isNodePackage(filePath) {
 	return detectExecutableType(filePath).type === "package";
 }
+/**
+* Set a package.json path cache entry, evicting the oldest when the LRU is
+* full.
+*
+* @private
+*
+* @param key - Start directory used as the cache key.
+* @param value - Resolved package.json path, or undefined for a negative entry.
+*/
+function packageJsonPathCacheSet(key, value) {
+	if (packageJsonPathCache.has(key)) packageJsonPathCache.delete(key);
+	else if (packageJsonPathCache.size >= PACKAGE_JSON_PATH_CACHE_MAX_SIZE) {
+		const oldest = packageJsonPathCache.keys().next().value;
+		if (oldest !== void 0) packageJsonPathCache.delete(oldest);
+	}
+	packageJsonPathCache.set(key, {
+		path: value,
+		at: Date.now()
+	});
+}
+/**
+* Read and parse package.json with caching. Results are cached to avoid
+* repeated file reads.
+*
+* @private
+*
+* @param packageJsonPath - Path to package.json.
+*
+* @returns Parsed package.json or null if invalid
+*/
+function readPackageJson(packageJsonPath) {
+	const fs = require_node_fs.getNodeFs();
+	let mtimeMs = 0;
+	try {
+		mtimeMs = fs.statSync(packageJsonPath).mtimeMs;
+	} catch {
+		packageJsonContentCache.delete(packageJsonPath);
+		return;
+	}
+	const cached = packageJsonContentCache.get(packageJsonPath);
+	if (cached !== void 0 && cached.mtimeMs === mtimeMs) return cached.content;
+	try {
+		const content = require_primordials_json.JSONParse(fs.readFileSync(packageJsonPath, "utf8"));
+		packageJsonContentCache.set(packageJsonPath, {
+			mtimeMs,
+			content
+		});
+		return content;
+	} catch {
+		packageJsonContentCache.set(packageJsonPath, {
+			mtimeMs,
+			content: void 0
+		});
+		return;
+	}
+}
 
 //#endregion
 exports.detectDlxExecutableType = detectDlxExecutableType;

package/dist/dlx/dir.js

@@ -20,7 +20,7 @@ const require_dlx_packages = require('./packages.js');
 *   ```
 */
 async function clearDlx() {
-	await /* @__PURE__ */ require_promises_iterate.pEach(await require_dlx_packages.listDlxPackagesAsync(), (pkg) => require_dlx_packages.removeDlxPackage(pkg));
+	await require_promises_iterate.pEach(await require_dlx_packages.listDlxPackagesAsync(), (pkg) => require_dlx_packages.removeDlxPackage(pkg));
 }
 /**
 * Clear all DLX package installations synchronously.
@@ -45,7 +45,7 @@ function clearDlxSync() {
 *   ```
 */
 function dlxDirExists() {
-	return (/* @__PURE__ */ require_node_fs.getNodeFs()).existsSync(require_paths_socket.getSocketDlxDir());
+	return require_node_fs.getNodeFs().existsSync(require_paths_socket.getSocketDlxDir());
 }
 /**
 * Ensure the DLX directory exists, creating it if necessary.

package/dist/dlx/firewall.d.ts

@@ -7,7 +7,15 @@
  *     `dlx/package.ts` so the firewall logic + PURL helper can be reused by
  *     other dlx flows without dragging in the install orchestrator.
  */
-import Arborist from '../external/@npmcli/arborist';
+import type Arborist from '../external/@npmcli/arborist';
+export interface FirewallAlert {
+    severity?: string | undefined;
+    type?: string | undefined;
+    key?: string | undefined;
+}
+export interface FirewallResponse {
+    alerts?: FirewallAlert[] | undefined;
+}
 /**
  * Check all resolved packages in an Arborist ideal tree against the Socket
  * Firewall API (public, no auth required). Throws if any dependency has

package/dist/dlx/firewall.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_error = require('../primordials/error.js');
-const require_primordials_string = require('../primordials/string.js');
 const require_primordials_map_set = require('../primordials/map-set.js');
+const require_primordials_string = require('../primordials/string.js');
 const require_primordials_promise = require('../primordials/promise.js');
 const require_http_request_user_agent = require('../http-request/user-agent.js');
 const require_http_request_node = require('../http-request/node.js');

package/dist/dlx/lockfile.d.ts

@@ -1,15 +1,15 @@
 /**
- * @file Package pin generation for dlx installs. `generatePackagePin` resolves
- *   an npm package against the registry using Arborist's lockfile-only mode and
- *   fetches its top-level tarball to return both hash formats plus the lockfile
- *   content — everything needed to vendor a reproducible install. The
+ * @file Package pin generation for dlx installs. `resolveNpmPackagePin`
+ *   resolves an npm package against the registry using Arborist's lockfile-only
+ *   mode and fetches its top-level tarball to return both hash formats plus the
+ *   lockfile content — everything needed to vendor a reproducible install. The
  *   `LockfileSpec` type is also exported here for use as the `lockfile` option
- *   on `downloadPackage`. Sniff/write handling lives inline in `./package.ts` —
- *   no helper.
+ *   on `downloadNpmPackage`. Sniff/write handling lives inline in
+ *   `./package.ts` — no helper.
  */
 import type { ComputedHashes } from '../integrity';
 /**
- * Lockfile source for the `lockfile` option on `downloadPackage`.
+ * Lockfile source for the `lockfile` option on `downloadNpmPackage`.
  *
  * Bare strings are sniffed: a leading `{` (after whitespace) means JSON
  * content, anything else is treated as a filesystem path. Pass the explicit `{
@@ -40,11 +40,7 @@ export declare const DEFAULT_MIN_RELEASE_DAYS = 7;
 /**
  * Options for generating a vendorable pin for an npm package.
  */
-export interface GeneratePackagePinOptions {
-    /**
-     * Package spec, e.g. `'@anthropic-ai/claude-code@2.1.92'`.
-     */
-    package: string;
+export interface ResolveNpmPackagePinOptions {
     /**
      * Minimum release age in days. Refuses to resolve any version (direct or
      * transitive) published more recently than `Date.now() - N days`.
@@ -62,12 +58,17 @@ export interface GeneratePackagePinOptions {
      * exclusive with {@link minReleaseDays}.
      */
     minReleaseMins?: number | undefined;
+    /**
+     * Package spec, e.g. `'@anthropic-ai/claude-code@2.1.92'`. Named `spec` to
+     * match `downloadNpmPackage`/`downloadPipPackage`.
+     */
+    spec: string;
 }
 /**
- * Result of {@link generatePackagePin}. All file data is returned as content —
+ * Result of {@link resolveNpmPackagePin}. All file data is returned as content —
  * the caller decides whether/where to write it.
  */
-export interface PinDetails {
+export interface NpmPackagePin {
     /**
      * Resolved package name.
      */
@@ -95,7 +96,7 @@ export interface PinDetails {
  */
 export declare class DlxLockfileError extends Error {
     constructor(message: string, options?: {
-        cause?: unknown;
+        cause?: unknown | undefined;
     } | undefined);
 }
 /**
@@ -112,15 +113,15 @@ export declare class DlxLockfileError extends Error {
  *
  * @example
  *   ;```ts
- *   const pin = await generatePackagePin({
- *     package: '@anthropic-ai/claude-code@2.1.92',
+ *   const pin = await resolveNpmPackagePin({
+ *     spec: '@anthropic-ai/claude-code@2.1.92',
  *   })
  *   await fs.writeFile('./claude.lock.json', pin.lockfile, 'utf8')
  *   // pin.hash.integrity → 'sha512-…'
  *   // pin.hash.checksum  → hex
  *   ```
  */
-export declare function generatePackagePin(options: GeneratePackagePinOptions): Promise<PinDetails>;
+export declare function resolveNpmPackagePin(options: ResolveNpmPackagePinOptions): Promise<NpmPackagePin>;
 /**
  * Extract the package name from a spec like `'name@range'` or
  * `'@scope/name@range'` or a bare `'name'`.

package/dist/dlx/lockfile.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
-const require_primordials_string = require('../primordials/string.js');
 const require_integrity = require('../integrity.js');
+const require_primordials_string = require('../primordials/string.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
 const require_primordials_date = require('../primordials/date.js');
@@ -17,13 +17,13 @@ src_external_pacote = require_runtime.__toESM(src_external_pacote);
 
 //#region src/dlx/lockfile.ts
 /**
-* @file Package pin generation for dlx installs. `generatePackagePin` resolves
-*   an npm package against the registry using Arborist's lockfile-only mode and
-*   fetches its top-level tarball to return both hash formats plus the lockfile
-*   content — everything needed to vendor a reproducible install. The
+* @file Package pin generation for dlx installs. `resolveNpmPackagePin`
+*   resolves an npm package against the registry using Arborist's lockfile-only
+*   mode and fetches its top-level tarball to return both hash formats plus the
+*   lockfile content — everything needed to vendor a reproducible install. The
 *   `LockfileSpec` type is also exported here for use as the `lockfile` option
-*   on `downloadPackage`. Sniff/write handling lives inline in `./package.ts` —
-*   no helper.
+*   on `downloadNpmPackage`. Sniff/write handling lives inline in
+*   `./package.ts` — no helper.
 */
 /**
 * Default minimum release age in days applied when a caller passes neither
@@ -55,20 +55,23 @@ var DlxLockfileError = class extends Error {
 *
 * @example
 *   ;```ts
-*   const pin = await generatePackagePin({
-*     package: '@anthropic-ai/claude-code@2.1.92',
+*   const pin = await resolveNpmPackagePin({
+*     spec: '@anthropic-ai/claude-code@2.1.92',
 *   })
 *   await fs.writeFile('./claude.lock.json', pin.lockfile, 'utf8')
 *   // pin.hash.integrity → 'sha512-…'
 *   // pin.hash.checksum  → hex
 *   ```
 */
-async function generatePackagePin(options) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
-	const { minReleaseDays, minReleaseMins, package: spec } = options;
-	if (typeof spec !== "string" || spec.length === 0) throw new DlxLockfileError("generatePackagePin requires a package spec");
-	if (minReleaseDays !== void 0 && minReleaseMins !== void 0) throw new DlxLockfileError("generatePackagePin: minReleaseDays and minReleaseMins are mutually exclusive");
+async function resolveNpmPackagePin(options) {
+	const fs = require_node_fs.getNodeFs();
+	const path = require_node_path.getNodePath();
+	const { minReleaseDays, minReleaseMins, spec } = {
+		__proto__: null,
+		...options
+	};
+	if (typeof spec !== "string" || spec.length === 0) throw new DlxLockfileError("resolveNpmPackagePin requires a package spec");
+	if (minReleaseDays !== void 0 && minReleaseMins !== void 0) throw new DlxLockfileError("resolveNpmPackagePin: minReleaseDays and minReleaseMins are mutually exclusive");
 	const effectiveDays = minReleaseDays !== void 0 ? minReleaseDays : minReleaseMins !== void 0 ? void 0 : 7;
 	const ageMs = effectiveDays !== void 0 ? effectiveDays * 864e5 : minReleaseMins !== void 0 ? minReleaseMins * 6e4 : 0;
 	const before = ageMs > 0 ? new require_primordials_date.DateCtor(require_primordials_date.DateNow() - ageMs) : void 0;
@@ -125,6 +128,6 @@ function specRange(spec) {
 //#endregion
 exports.DEFAULT_MIN_RELEASE_DAYS = DEFAULT_MIN_RELEASE_DAYS;
 exports.DlxLockfileError = DlxLockfileError;
-exports.generatePackagePin = generatePackagePin;
+exports.resolveNpmPackagePin = resolveNpmPackagePin;
 exports.specName = specName;
 exports.specRange = specRange;