@socketsecurity/lib 6.0.6 → 6.0.8

package/dist/env/socket-cli.js

@@ -24,9 +24,8 @@ const require_env_number = require('./number.js');
 *
 * @returns Whether to accept all risks
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSocketCliAcceptRisks() {
-	return /* @__PURE__ */ require_env_boolean.envAsBoolean(require_env_rewire.getEnvValue("SOCKET_CLI_ACCEPT_RISKS"));
+	return require_env_boolean.envAsBoolean(require_env_rewire.getEnvValue("SOCKET_CLI_ACCEPT_RISKS"));
 }
 /**
 * Socket CLI API base URL (alternative name). Checks SOCKET_CLI_API_BASE_URL
@@ -42,7 +41,6 @@ function getSocketCliAcceptRisks() {
 *
 * @returns API base URL or undefined
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSocketCliApiBaseUrl() {
 	return require_env_rewire.getEnvValue("SOCKET_CLI_API_BASE_URL") || require_env_rewire.getEnvValue("SOCKET_SECURITY_API_BASE_URL");
 }
@@ -62,7 +60,6 @@ function getSocketCliApiBaseUrl() {
 *
 * @returns API proxy URL or undefined
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSocketCliApiProxy() {
 	return require_env_rewire.getEnvValue("SOCKET_CLI_API_PROXY") || require_env_rewire.getEnvValue("SOCKET_SECURITY_API_PROXY") || require_env_rewire.getEnvValue("HTTPS_PROXY") || require_env_rewire.getEnvValue("https_proxy") || require_env_rewire.getEnvValue("HTTP_PROXY") || require_env_rewire.getEnvValue("http_proxy");
 }
@@ -79,9 +76,8 @@ function getSocketCliApiProxy() {
 *
 * @returns API timeout in milliseconds
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSocketCliApiTimeout() {
-	return /* @__PURE__ */ require_env_number.envAsNumber(require_env_rewire.getEnvValue("SOCKET_CLI_API_TIMEOUT"));
+	return require_env_number.envAsNumber(require_env_rewire.getEnvValue("SOCKET_CLI_API_TIMEOUT"));
 }
 /**
 * Bootstrap cache directory path. Set by bootstrap wrappers to pass dlx cache
@@ -97,7 +93,6 @@ function getSocketCliApiTimeout() {
 *
 * @returns Bootstrap cache directory or undefined
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSocketCliBootstrapCacheDir() {
 	return require_env_rewire.getEnvValue("SOCKET_CLI_BOOTSTRAP_CACHE_DIR");
 }
@@ -115,7 +110,6 @@ function getSocketCliBootstrapCacheDir() {
 *
 * @returns Bootstrap package spec or undefined
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSocketCliBootstrapSpec() {
 	return require_env_rewire.getEnvValue("SOCKET_CLI_BOOTSTRAP_SPEC");
 }
@@ -132,7 +126,6 @@ function getSocketCliBootstrapSpec() {
 *
 * @returns Config file path or undefined
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSocketCliConfig() {
 	return require_env_rewire.getEnvValue("SOCKET_CLI_CONFIG");
 }
@@ -149,7 +142,6 @@ function getSocketCliConfig() {
 *
 * @returns Fix mode value or undefined
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSocketCliFix() {
 	return require_env_rewire.getEnvValue("SOCKET_CLI_FIX");
 }
@@ -167,7 +159,6 @@ function getSocketCliFix() {
 *
 * @returns GitHub token or undefined
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSocketCliGithubToken() {
 	return require_env_rewire.getEnvValue("SOCKET_CLI_GITHUB_TOKEN") || require_env_rewire.getEnvValue("SOCKET_SECURITY_GITHUB_PAT") || require_env_rewire.getEnvValue("GITHUB_TOKEN");
 }
@@ -185,9 +176,8 @@ function getSocketCliGithubToken() {
 *
 * @returns Whether to skip API token requirement
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSocketCliNoApiToken() {
-	return /* @__PURE__ */ require_env_boolean.envAsBoolean(require_env_rewire.getEnvValue("SOCKET_CLI_NO_API_TOKEN"));
+	return require_env_boolean.envAsBoolean(require_env_rewire.getEnvValue("SOCKET_CLI_NO_API_TOKEN"));
 }
 /**
 * Controls Socket CLI optimization mode.
@@ -203,9 +193,8 @@ function getSocketCliNoApiToken() {
 *
 * @returns Whether optimization mode is enabled
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSocketCliOptimize() {
-	return /* @__PURE__ */ require_env_boolean.envAsBoolean(require_env_rewire.getEnvValue("SOCKET_CLI_OPTIMIZE"));
+	return require_env_boolean.envAsBoolean(require_env_rewire.getEnvValue("SOCKET_CLI_OPTIMIZE"));
 }
 /**
 * Socket CLI organization slug identifier (alternative name). Checks
@@ -221,7 +210,6 @@ function getSocketCliOptimize() {
 *
 * @returns Organization slug or undefined
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSocketCliOrgSlug() {
 	return require_env_rewire.getEnvValue("SOCKET_CLI_ORG_SLUG") || require_env_rewire.getEnvValue("SOCKET_ORG_SLUG");
 }
@@ -239,9 +227,8 @@ function getSocketCliOrgSlug() {
 *
 * @returns Whether to view all risks
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSocketCliViewAllRisks() {
-	return /* @__PURE__ */ require_env_boolean.envAsBoolean(require_env_rewire.getEnvValue("SOCKET_CLI_VIEW_ALL_RISKS"));
+	return require_env_boolean.envAsBoolean(require_env_rewire.getEnvValue("SOCKET_CLI_VIEW_ALL_RISKS"));
 }
 
 //#endregion

package/dist/env/socket-mcp.d.ts

@@ -0,0 +1,114 @@
+/**
+ * @file Socket MCP HTTP server environment variable getters. Covers the MCP
+ *   transport (HTTP mode, port) and the OAuth credentials / proxy-trust
+ *   settings the MCP HTTP server reads at startup.
+ */
+/**
+ * Whether the MCP server should run in HTTP mode. MCP_HTTP_MODE — when set to
+ * the literal string `'true'`, the MCP server serves over HTTP instead of
+ * stdio. Returns `false` for any other value (including unset).
+ *
+ * @example
+ *   ;```typescript
+ *   import { getMcpHttpMode } from '@socketsecurity/lib/env/socket-mcp'
+ *
+ *   if (getMcpHttpMode()) {
+ *     startHttpServer()
+ *   }
+ *   ```
+ *
+ * @returns `true` if HTTP mode is enabled, `false` otherwise
+ */
+export declare function getMcpHttpMode(): boolean;
+/**
+ * MCP HTTP server listen port. MCP_PORT — port the MCP HTTP server binds to.
+ * Defaults to `3000` (matches socket-mcp's documented default). Invalid /
+ * non-numeric values also fall back to `3000`.
+ *
+ * @example
+ *   ;```typescript
+ *   import { getMcpPort } from '@socketsecurity/lib/env/socket-mcp'
+ *
+ *   const port = getMcpPort()
+ *   ```
+ *
+ * @returns The MCP server port (default `3000`)
+ */
+export declare function getMcpPort(): number;
+/**
+ * OAuth introspection client ID for the MCP HTTP server.
+ * SOCKET_OAUTH_INTROSPECTION_CLIENT_ID — client credential used to call the
+ * issuer's introspection endpoint. Empty string when unset.
+ *
+ * @example
+ *   ;```typescript
+ *   import { getSocketOauthIntrospectionClientId } from '@socketsecurity/lib/env/socket-mcp'
+ *
+ *   const clientId = getSocketOauthIntrospectionClientId()
+ *   ```
+ *
+ * @returns The OAuth client ID, or `''` if not set
+ */
+export declare function getSocketOauthIntrospectionClientId(): string;
+/**
+ * OAuth introspection client secret for the MCP HTTP server.
+ * SOCKET_OAUTH_INTROSPECTION_CLIENT_SECRET — paired with the client ID for
+ * authenticated introspection requests. Empty string when unset.
+ *
+ * @example
+ *   ;```typescript
+ *   import { getSocketOauthIntrospectionClientSecret } from '@socketsecurity/lib/env/socket-mcp'
+ *
+ *   const clientSecret = getSocketOauthIntrospectionClientSecret()
+ *   ```
+ *
+ * @returns The OAuth client secret, or `''` if not set
+ */
+export declare function getSocketOauthIntrospectionClientSecret(): string;
+/**
+ * OAuth issuer URL for the MCP HTTP server. SOCKET_OAUTH_ISSUER — issuer to
+ * validate inbound OAuth tokens against. Returns the empty string when unset;
+ * callers treat empty as "no issuer configured".
+ *
+ * @example
+ *   ;```typescript
+ *   import { getSocketOauthIssuer } from '@socketsecurity/lib/env/socket-mcp'
+ *
+ *   const issuer = getSocketOauthIssuer()
+ *   if (issuer) { ... }
+ *   ```
+ *
+ * @returns The OAuth issuer URL, or `''` if not set
+ */
+export declare function getSocketOauthIssuer(): string;
+/**
+ * Required OAuth scopes for the MCP HTTP server. SOCKET_OAUTH_REQUIRED_SCOPES —
+ * whitespace-separated list of scopes inbound tokens must carry. Defaults to
+ * `'packages:list'` (the minimum scope socket-mcp's depscore tool needs).
+ *
+ * @example
+ *   ;```typescript
+ *   import { getSocketOauthRequiredScopes } from '@socketsecurity/lib/env/socket-mcp'
+ *
+ *   const scopes = getSocketOauthRequiredScopes().split(/\s+/u)
+ *   ```
+ *
+ * @returns The required-scopes string, defaulting to `'packages:list'`
+ */
+export declare function getSocketOauthRequiredScopes(): string;
+/**
+ * Whether the MCP HTTP server should trust upstream proxy headers. TRUST_PROXY
+ * — when set to the literal string `'true'`, the server honors
+ * `X-Forwarded-Host` / `X-Forwarded-Proto` when composing OAuth metadata URLs.
+ * Off by default to prevent header spoofing when no upstream proxy is present.
+ *
+ * @example
+ *   ;```typescript
+ *   import { getTrustProxy } from '@socketsecurity/lib/env/socket-mcp'
+ *
+ *   if (getTrustProxy()) { ... }
+ *   ```
+ *
+ * @returns `true` if proxy headers are trusted, `false` otherwise
+ */
+export declare function getTrustProxy(): boolean;

package/dist/env/socket-mcp.js

@@ -0,0 +1,146 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_number = require('../primordials/number.js');
+const require_env_rewire = require('./rewire.js');
+const require_env_number = require('./number.js');
+
+//#region src/env/socket-mcp.ts
+/**
+* @file Socket MCP HTTP server environment variable getters. Covers the MCP
+*   transport (HTTP mode, port) and the OAuth credentials / proxy-trust
+*   settings the MCP HTTP server reads at startup.
+*/
+/**
+* Whether the MCP server should run in HTTP mode. MCP_HTTP_MODE — when set to
+* the literal string `'true'`, the MCP server serves over HTTP instead of
+* stdio. Returns `false` for any other value (including unset).
+*
+* @example
+*   ;```typescript
+*   import { getMcpHttpMode } from '@socketsecurity/lib/env/socket-mcp'
+*
+*   if (getMcpHttpMode()) {
+*     startHttpServer()
+*   }
+*   ```
+*
+* @returns `true` if HTTP mode is enabled, `false` otherwise
+*/
+function getMcpHttpMode() {
+	return require_env_rewire.getEnvValue("MCP_HTTP_MODE") === "true";
+}
+/**
+* MCP HTTP server listen port. MCP_PORT — port the MCP HTTP server binds to.
+* Defaults to `3000` (matches socket-mcp's documented default). Invalid /
+* non-numeric values also fall back to `3000`.
+*
+* @example
+*   ;```typescript
+*   import { getMcpPort } from '@socketsecurity/lib/env/socket-mcp'
+*
+*   const port = getMcpPort()
+*   ```
+*
+* @returns The MCP server port (default `3000`)
+*/
+function getMcpPort() {
+	const parsed = require_env_number.envAsNumber(require_env_rewire.getEnvValue("MCP_PORT"));
+	return require_primordials_number.NumberIsFinite(parsed) && parsed > 0 ? parsed : 3e3;
+}
+/**
+* OAuth introspection client ID for the MCP HTTP server.
+* SOCKET_OAUTH_INTROSPECTION_CLIENT_ID — client credential used to call the
+* issuer's introspection endpoint. Empty string when unset.
+*
+* @example
+*   ;```typescript
+*   import { getSocketOauthIntrospectionClientId } from '@socketsecurity/lib/env/socket-mcp'
+*
+*   const clientId = getSocketOauthIntrospectionClientId()
+*   ```
+*
+* @returns The OAuth client ID, or `''` if not set
+*/
+function getSocketOauthIntrospectionClientId() {
+	return require_env_rewire.getEnvValue("SOCKET_OAUTH_INTROSPECTION_CLIENT_ID") ?? "";
+}
+/**
+* OAuth introspection client secret for the MCP HTTP server.
+* SOCKET_OAUTH_INTROSPECTION_CLIENT_SECRET — paired with the client ID for
+* authenticated introspection requests. Empty string when unset.
+*
+* @example
+*   ;```typescript
+*   import { getSocketOauthIntrospectionClientSecret } from '@socketsecurity/lib/env/socket-mcp'
+*
+*   const clientSecret = getSocketOauthIntrospectionClientSecret()
+*   ```
+*
+* @returns The OAuth client secret, or `''` if not set
+*/
+function getSocketOauthIntrospectionClientSecret() {
+	return require_env_rewire.getEnvValue("SOCKET_OAUTH_INTROSPECTION_CLIENT_SECRET") ?? "";
+}
+/**
+* OAuth issuer URL for the MCP HTTP server. SOCKET_OAUTH_ISSUER — issuer to
+* validate inbound OAuth tokens against. Returns the empty string when unset;
+* callers treat empty as "no issuer configured".
+*
+* @example
+*   ;```typescript
+*   import { getSocketOauthIssuer } from '@socketsecurity/lib/env/socket-mcp'
+*
+*   const issuer = getSocketOauthIssuer()
+*   if (issuer) { ... }
+*   ```
+*
+* @returns The OAuth issuer URL, or `''` if not set
+*/
+function getSocketOauthIssuer() {
+	return require_env_rewire.getEnvValue("SOCKET_OAUTH_ISSUER") ?? "";
+}
+/**
+* Required OAuth scopes for the MCP HTTP server. SOCKET_OAUTH_REQUIRED_SCOPES —
+* whitespace-separated list of scopes inbound tokens must carry. Defaults to
+* `'packages:list'` (the minimum scope socket-mcp's depscore tool needs).
+*
+* @example
+*   ;```typescript
+*   import { getSocketOauthRequiredScopes } from '@socketsecurity/lib/env/socket-mcp'
+*
+*   const scopes = getSocketOauthRequiredScopes().split(/\s+/u)
+*   ```
+*
+* @returns The required-scopes string, defaulting to `'packages:list'`
+*/
+function getSocketOauthRequiredScopes() {
+	return require_env_rewire.getEnvValue("SOCKET_OAUTH_REQUIRED_SCOPES") ?? "packages:list";
+}
+/**
+* Whether the MCP HTTP server should trust upstream proxy headers. TRUST_PROXY
+* — when set to the literal string `'true'`, the server honors
+* `X-Forwarded-Host` / `X-Forwarded-Proto` when composing OAuth metadata URLs.
+* Off by default to prevent header spoofing when no upstream proxy is present.
+*
+* @example
+*   ;```typescript
+*   import { getTrustProxy } from '@socketsecurity/lib/env/socket-mcp'
+*
+*   if (getTrustProxy()) { ... }
+*   ```
+*
+* @returns `true` if proxy headers are trusted, `false` otherwise
+*/
+function getTrustProxy() {
+	return require_env_rewire.getEnvValue("TRUST_PROXY") === "true";
+}
+
+//#endregion
+exports.getMcpHttpMode = getMcpHttpMode;
+exports.getMcpPort = getMcpPort;
+exports.getSocketOauthIntrospectionClientId = getSocketOauthIntrospectionClientId;
+exports.getSocketOauthIntrospectionClientSecret = getSocketOauthIntrospectionClientSecret;
+exports.getSocketOauthIssuer = getSocketOauthIssuer;
+exports.getSocketOauthRequiredScopes = getSocketOauthRequiredScopes;
+exports.getTrustProxy = getTrustProxy;

package/dist/env/socket.d.ts

@@ -1,38 +1,6 @@
 /**
  * @file Socket Security environment variable getters.
  */
-/**
- * Whether the MCP server should run in HTTP mode. MCP_HTTP_MODE — when set to
- * the literal string `'true'`, the MCP server serves over HTTP instead of
- * stdio. Returns `false` for any other value (including unset).
- *
- * @example
- *   ;```typescript
- *   import { getMcpHttpMode } from '@socketsecurity/lib/env/socket'
- *
- *   if (getMcpHttpMode()) {
- *     startHttpServer()
- *   }
- *   ```
- *
- * @returns `true` if HTTP mode is enabled, `false` otherwise
- */
-export declare function getMcpHttpMode(): boolean;
-/**
- * MCP HTTP server listen port. MCP_PORT — port the MCP HTTP server binds to.
- * Defaults to `3000` (matches socket-mcp's documented default). Invalid /
- * non-numeric values also fall back to `3000`.
- *
- * @example
- *   ;```typescript
- *   import { getMcpPort } from '@socketsecurity/lib/env/socket'
- *
- *   const port = getMcpPort()
- *   ```
- *
- * @returns The MCP server port (default `3000`)
- */
-export declare function getMcpPort(): number;
 /**
  * SOCKET_ACCEPT_RISKS environment variable getter. Whether to accept all Socket
  * Security risks.
@@ -308,67 +276,6 @@ export declare function getSocketNoApiToken(): boolean;
  * @returns The Socket NPM registry URL, or `undefined` if not set
  */
 export declare function getSocketNpmRegistry(): string | undefined;
-/**
- * OAuth introspection client ID for the MCP HTTP server.
- * SOCKET_OAUTH_INTROSPECTION_CLIENT_ID — client credential used to call the
- * issuer's introspection endpoint. Empty string when unset.
- *
- * @example
- *   ;```typescript
- *   import { getSocketOauthIntrospectionClientId } from '@socketsecurity/lib/env/socket'
- *
- *   const clientId = getSocketOauthIntrospectionClientId()
- *   ```
- *
- * @returns The OAuth client ID, or `''` if not set
- */
-export declare function getSocketOauthIntrospectionClientId(): string;
-/**
- * OAuth introspection client secret for the MCP HTTP server.
- * SOCKET_OAUTH_INTROSPECTION_CLIENT_SECRET — paired with the client ID for
- * authenticated introspection requests. Empty string when unset.
- *
- * @example
- *   ;```typescript
- *   import { getSocketOauthIntrospectionClientSecret } from '@socketsecurity/lib/env/socket'
- *
- *   const clientSecret = getSocketOauthIntrospectionClientSecret()
- *   ```
- *
- * @returns The OAuth client secret, or `''` if not set
- */
-export declare function getSocketOauthIntrospectionClientSecret(): string;
-/**
- * OAuth issuer URL for the MCP HTTP server. SOCKET_OAUTH_ISSUER — issuer to
- * validate inbound OAuth tokens against. Returns the empty string when unset;
- * callers treat empty as "no issuer configured".
- *
- * @example
- *   ;```typescript
- *   import { getSocketOauthIssuer } from '@socketsecurity/lib/env/socket'
- *
- *   const issuer = getSocketOauthIssuer()
- *   if (issuer) { ... }
- *   ```
- *
- * @returns The OAuth issuer URL, or `''` if not set
- */
-export declare function getSocketOauthIssuer(): string;
-/**
- * Required OAuth scopes for the MCP HTTP server. SOCKET_OAUTH_REQUIRED_SCOPES —
- * whitespace-separated list of scopes inbound tokens must carry. Defaults to
- * `'packages:list'` (the minimum scope socket-mcp's depscore tool needs).
- *
- * @example
- *   ;```typescript
- *   import { getSocketOauthRequiredScopes } from '@socketsecurity/lib/env/socket'
- *
- *   const scopes = getSocketOauthRequiredScopes().split(/\s+/u)
- *   ```
- *
- * @returns The required-scopes string, defaulting to `'packages:list'`
- */
-export declare function getSocketOauthRequiredScopes(): string;
 /**
  * SOCKET_ORG_SLUG environment variable getter. Socket Security organization
  * slug identifier.
@@ -414,6 +321,13 @@ export declare function getSocketRegistryUrl(): string | undefined;
  * @returns The repository name, or `undefined` if neither is set
  */
 export declare function getSocketRepositoryName(): string | undefined;
+/**
+ * SOCKET_STATE_DIR environment variable getter. Overrides the default Socket
+ * state directory (~/.socket/_state) location.
+ *
+ * @returns The state directory path, or `undefined` if not set
+ */
+export declare function getSocketStateDirEnv(): string | undefined;
 /**
  * SOCKET_VIEW_ALL_RISKS environment variable getter. Whether to view all Socket
  * Security risks.
@@ -430,19 +344,4 @@ export declare function getSocketRepositoryName(): string | undefined;
  * @returns `true` if viewing all risks, `false` otherwise
  */
 export declare function getSocketViewAllRisks(): boolean;
-/**
- * Whether the MCP HTTP server should trust upstream proxy headers. TRUST_PROXY
- * — when set to the literal string `'true'`, the server honors
- * `X-Forwarded-Host` / `X-Forwarded-Proto` when composing OAuth metadata URLs.
- * Off by default to prevent header spoofing when no upstream proxy is present.
- *
- * @example
- *   ;```typescript
- *   import { getTrustProxy } from '@socketsecurity/lib/env/socket'
- *
- *   if (getTrustProxy()) { ... }
- *   ```
- *
- * @returns `true` if proxy headers are trusted, `false` otherwise
- */
-export declare function getTrustProxy(): boolean;
+export { getMcpHttpMode, getMcpPort, getSocketOauthIntrospectionClientId, getSocketOauthIntrospectionClientSecret, getSocketOauthIssuer, getSocketOauthRequiredScopes, getTrustProxy, } from './socket-mcp';