@socketsecurity/lib 6.0.6 → 6.0.8

package/dist/logger/symbols.js

@@ -22,74 +22,15 @@ src_external__socketregistry_is_unicode_supported = require_runtime.__toESM(src_
 *   are configured) and re-renders whenever `setTheme()` fires
 *   `onThemeChange`.
 */
-let _consoleSymbols;
-let _kGroupIndentationWidthSymbol;
-/**
-* Lazily get console symbols on first access.
-*
-* Deferred to avoid accessing global console during early Node.js bootstrap
-* before stdout is ready.
-*/
-function getConsoleSymbols() {
-	/* c8 ignore start */
-	if (_consoleSymbols === void 0) _consoleSymbols = require_primordials_object.ObjectGetOwnPropertySymbols(require_logger__internal.globalConsole);
-	/* c8 ignore stop */
-	return _consoleSymbols;
-}
-/**
-* Lazily get kGroupIndentationWidth symbol on first access.
-*/
-function getKGroupIndentationWidthSymbol() {
-	/* c8 ignore next - Lazy-init second-call branch; module-singleton. */
-	if (_kGroupIndentationWidthSymbol === void 0) _kGroupIndentationWidthSymbol = getConsoleSymbols().find((s) => s.label === "kGroupIndentWidth") ?? Symbol("kGroupIndentWidth");
-	return _kGroupIndentationWidthSymbol;
-}
-/**
-* Symbol for incrementing the internal log call counter.
-*
-* This is an internal symbol used to track the number of times logging methods
-* have been called on a logger instance.
-*/
-const incLogCallCountSymbol = Symbol.for("logger.logCallCount++");
-/**
-* Symbol for tracking whether the last logged line was blank.
-*
-* This is used internally to prevent multiple consecutive blank lines and to
-* determine whether to add spacing before certain messages.
-*/
-const lastWasBlankSymbol = Symbol.for("logger.lastWasBlank");
-/**
-* Log symbols for terminal output with colored indicators.
-*
-* Provides colored Unicode symbols (✖, ℹ, ∴, →, ✔, ⚠) with ASCII fallbacks (×,
-* i, :., >, √, ‼) for terminals that don't support Unicode. Symbols are colored
-* according to the active theme's color palette (error, info, reason, step,
-* success, warning).
-*
-* The symbols are lazily initialized on first access and automatically update
-* when the fallback theme changes (via setTheme()). Note that LOG_SYMBOLS
-* reflect the global fallback theme, not async-local theme contexts from
-* withTheme().
-*
-* @example
-*   ```typescript
-*   import { LOG_SYMBOLS } from '@socketsecurity/lib/logger/symbols'
-*
-*   console.log(`${LOG_SYMBOLS.fail} Build failed`) // Theme error color ✖
-*   console.log(`${LOG_SYMBOLS.info} Starting process`) // Theme info color ℹ
-*   console.log(`${LOG_SYMBOLS.progress} Working on task`) // Theme step color ∴
-*   console.log(`${LOG_SYMBOLS.step} Processing files`) // Theme step color →
-*   console.log(`${LOG_SYMBOLS.success} Build completed`) // Theme success color ✔
-*   console.log(`${LOG_SYMBOLS.warn} Deprecated API used`) // Theme warning color ⚠
-*   ```
-*/
-const LOG_SYMBOLS = /*@__PURE__*/ (() => {
+let consoleSymbols;
+let kGroupIndentationWidthSymbol;
+function createLogSymbols() {
 	const target = { __proto__: null };
 	let initialized = false;
 	const handler = { __proto__: null };
 	const updateSymbols = () => {
 		const supported = (0, src_external__socketregistry_is_unicode_supported.default)();
-		const colors = /* @__PURE__ */ require_logger_colors.getYoctocolors();
+		const colors = require_logger_colors.getYoctocolors();
 		const theme = require_themes_context.getTheme();
 		const successColor = theme.colors.success;
 		const errorColor = theme.colors.error;
@@ -98,18 +39,18 @@ const LOG_SYMBOLS = /*@__PURE__*/ (() => {
 		const stepColor = theme.colors.step;
 		/* c8 ignore start - ASCII-fallback symbol arms only fire on
 		terminals without unicode support; tests run on unicode TTYs. */
-		target["fail"] = /* @__PURE__ */ require_logger_colors.applyColor(supported ? "✖" : "×", errorColor, colors);
-		target["info"] = /* @__PURE__ */ require_logger_colors.applyColor(supported ? "ℹ" : "i", infoColor, colors);
-		target["progress"] = /* @__PURE__ */ require_logger_colors.applyColor(supported ? "∴" : ":.", stepColor, colors);
-		target["reason"] = colors.dim(/* @__PURE__ */ require_logger_colors.applyColor(supported ? "∴" : ":.", warningColor, colors));
-		target["skip"] = /* @__PURE__ */ require_logger_colors.applyColor(supported ? "↻" : "@", stepColor, colors);
-		target["step"] = /* @__PURE__ */ require_logger_colors.applyColor(supported ? "→" : ">", stepColor, colors);
-		target["success"] = /* @__PURE__ */ require_logger_colors.applyColor(supported ? "✔" : "√", successColor, colors);
-		target["warn"] = /* @__PURE__ */ require_logger_colors.applyColor(supported ? "⚠" : "‼", warningColor, colors);
+		target["fail"] = require_logger_colors.applyColor(supported ? "✖" : "×", errorColor, colors);
+		target["info"] = require_logger_colors.applyColor(supported ? "ℹ" : "i", infoColor, colors);
+		target["progress"] = require_logger_colors.applyColor(supported ? "∴" : ":.", stepColor, colors);
+		target["reason"] = colors.dim(require_logger_colors.applyColor(supported ? "∴" : ":.", warningColor, colors));
+		target["skip"] = require_logger_colors.applyColor(supported ? "↻" : "@", stepColor, colors);
+		target["step"] = require_logger_colors.applyColor(supported ? "→" : ">", stepColor, colors);
+		target["success"] = require_logger_colors.applyColor(supported ? "✔" : "√", successColor, colors);
+		target["warn"] = require_logger_colors.applyColor(supported ? "⚠" : "‼", warningColor, colors);
 		/* c8 ignore stop */
 	};
 	const init = () => {
-		/* c8 ignore start */
+		/* c8 ignore start - Idempotent guard; init runs once, second-call branch never re-enters. */
 		if (initialized) return;
 		/* c8 ignore stop */
 		updateSymbols();
@@ -117,7 +58,7 @@ const LOG_SYMBOLS = /*@__PURE__*/ (() => {
 		for (const trapName in handler) delete handler[trapName];
 	};
 	const reset = () => {
-		/* c8 ignore start */
+		/* c8 ignore start - Defensive guard; reset only runs after init, so the un-init branch is unreachable in tests. */
 		if (!initialized) return;
 		/* c8 ignore stop */
 		updateSymbols();
@@ -136,10 +77,48 @@ const LOG_SYMBOLS = /*@__PURE__*/ (() => {
 		reset();
 	});
 	return new require_primordials_globals.ProxyCtor(target, handler);
-})();
+}
+function createLogSymbolsProxyPlaceholder() {}
+/**
+* Lazily get console symbols on first access.
+*
+* Deferred to avoid accessing global console during early Node.js bootstrap
+* before stdout is ready.
+*/
+function getConsoleSymbols() {
+	/* c8 ignore start - Lazy-init second-call branch; module-singleton, the re-init guard never re-enters in tests. */
+	if (consoleSymbols === void 0) consoleSymbols = require_primordials_object.ObjectGetOwnPropertySymbols(require_logger__internal.globalConsole);
+	/* c8 ignore stop */
+	return consoleSymbols;
+}
+/**
+* Lazily get kGroupIndentationWidth symbol on first access.
+*/
+function getKGroupIndentationWidthSymbol() {
+	/* c8 ignore next - Lazy-init second-call branch; module-singleton. */
+	if (kGroupIndentationWidthSymbol === void 0) kGroupIndentationWidthSymbol = getConsoleSymbols().find((s) => s.label === "kGroupIndentWidth") ?? Symbol("kGroupIndentWidth");
+	return kGroupIndentationWidthSymbol;
+}
+/**
+* Symbol for incrementing the internal log call counter.
+*
+* This is an internal symbol used to track the number of times logging methods
+* have been called on a logger instance.
+*/
+const incLogCallCountSymbol = Symbol.for("logger.logCallCount++");
+/**
+* Symbol for tracking whether the last logged line was blank.
+*
+* This is used internally to prevent multiple consecutive blank lines and to
+* determine whether to add spacing before certain messages.
+*/
+const lastWasBlankSymbol = Symbol.for("logger.lastWasBlank");
+const LOG_SYMBOLS = /*@__PURE__*/ createLogSymbols();
 
 //#endregion
 exports.LOG_SYMBOLS = LOG_SYMBOLS;
+exports.createLogSymbols = createLogSymbols;
+exports.createLogSymbolsProxyPlaceholder = createLogSymbolsProxyPlaceholder;
 exports.getConsoleSymbols = getConsoleSymbols;
 exports.getKGroupIndentationWidthSymbol = getKGroupIndentationWidthSymbol;
 exports.incLogCallCountSymbol = incLogCallCountSymbol;

package/dist/logger/types.d.ts

@@ -59,7 +59,7 @@ export type LogSymbols = {
  * All methods return the logger instance for method chaining.
  */
 export type LoggerMethods = {
-    [K in keyof typeof console]: (typeof console)[K] extends (...args: infer A) => any ? (...args: A) => Logger : (typeof console)[K];
+    [K in keyof typeof console]: (typeof console)[K] extends (...args: infer A) => unknown ? (...args: A) => Logger : (typeof console)[K];
 };
 /**
  * A task that can be executed with automatic start/complete logging.

package/dist/memo/types.d.ts

@@ -11,27 +11,27 @@ export type MemoizeOptions<Args extends unknown[]> = {
     /**
      * Custom cache key generator (defaults to JSON.stringify)
      */
-    keyGen?: (...args: Args) => string;
+    keyGen?: ((...args: Args) => string) | undefined;
     /**
      * Maximum cache size (LRU eviction when exceeded)
      */
-    maxSize?: number;
+    maxSize?: number | undefined;
     /**
      * TTL in milliseconds (cache entries expire after this time)
      */
-    ttl?: number;
+    ttl?: number | undefined;
     /**
      * Cache name for debugging.
      */
-    name?: string;
+    name?: string | undefined;
     /**
      * Weak cache for object keys (enables GC)
      */
-    weak?: boolean;
+    weak?: boolean | undefined;
     /**
      * Custom equality check for cache hits.
      */
-    equals?: (a: Args, b: Args) => boolean;
+    equals?: ((a: Args, b: Args) => boolean) | undefined;
 };
 /**
  * Cache entry with metadata.

package/dist/native-messaging/host.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @file Chrome native messaging host entry point. Chrome launches this script
+ *   as a subprocess when the extension calls
+ *   `chrome.runtime.connectNative('dev.socket.trusted-publisher-host')`. The
+ *   protocol is length-prefixed binary over stdin/stdout: incoming: [4-byte LE
+ *   uint32 length][UTF-8 JSON message] outgoing: [4-byte LE uint32
+ *   length][UTF-8 JSON response] The host handles one request type: { type:
+ *   'get-api-token' } → { token: string } | { error: string } The host NEVER
+ *   logs to stdout (Chrome treats any stdout byte outside the length-prefixed
+ *   protocol as a message boundary error). All diagnostics go to stderr only.
+ *   Detection: Chrome passes the extension origin as `process.argv[2]`
+ *   (`chrome-extension://<id>/`). The `NATIVE_MESSAGING_HOST` constant in
+ *   `src/constants/platform.ts` captures this check so other modules can skip
+ *   TTY-only paths when running in this context.
+ */
+import type { Readable, Writable } from 'node:stream';
+export declare function handleOne(stdin?: Readable, stdout?: Writable): Promise<void>;
+export declare function readExact(length: number, stream?: Readable): Promise<Buffer>;
+export declare function runHost(): Promise<void>;
+export declare function writeMessage(obj: unknown, stream?: Writable): void;

package/dist/native-messaging/host.js

@@ -0,0 +1,120 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_primordials_error = require('../primordials/error.js');
+const require_errors_message = require('../errors/message.js');
+const require_logger_default = require('../logger/default.js');
+const require_secrets_socket_api_token = require('../secrets/socket-api-token.js');
+const require_native_messaging_install = require('./install.js');
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+
+//#region src/native-messaging/host.ts
+/**
+* @file Chrome native messaging host entry point. Chrome launches this script
+*   as a subprocess when the extension calls
+*   `chrome.runtime.connectNative('dev.socket.trusted-publisher-host')`. The
+*   protocol is length-prefixed binary over stdin/stdout: incoming: [4-byte LE
+*   uint32 length][UTF-8 JSON message] outgoing: [4-byte LE uint32
+*   length][UTF-8 JSON response] The host handles one request type: { type:
+*   'get-api-token' } → { token: string } | { error: string } The host NEVER
+*   logs to stdout (Chrome treats any stdout byte outside the length-prefixed
+*   protocol as a message boundary error). All diagnostics go to stderr only.
+*   Detection: Chrome passes the extension origin as `process.argv[2]`
+*   (`chrome-extension://<id>/`). The `NATIVE_MESSAGING_HOST` constant in
+*   `src/constants/platform.ts` captures this check so other modules can skip
+*   TTY-only paths when running in this context.
+*/
+const logger = require_logger_default.getDefaultLogger();
+async function handleOne(stdin, stdout) {
+	const inStream = stdin ?? node_process.default.stdin;
+	const outStream = stdout ?? node_process.default.stdout;
+	const length = (await readExact(4, inStream)).readUInt32LE(0);
+	if (length === 0 || length > 1048576) {
+		writeMessage({ error: `invalid message length: ${length}` }, outStream);
+		return;
+	}
+	const body = await readExact(length, inStream);
+	let msg;
+	try {
+		msg = JSON.parse(body.toString("utf8"));
+	} catch {
+		writeMessage({ error: "message is not valid JSON" }, outStream);
+		return;
+	}
+	const type = msg["type"];
+	if (type === "get-api-token") {
+		const token = await require_secrets_socket_api_token.readSocketApiToken();
+		if (token) writeMessage({ token }, outStream);
+		else writeMessage({ error: "Socket API token not found. Set SOCKET_API_TOKEN in your environment." }, outStream);
+		return;
+	}
+	writeMessage({ error: `unknown message type: ${String(type)}` }, outStream);
+}
+function readExact(length, stream) {
+	const src = stream ?? node_process.default.stdin;
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		let received = 0;
+		function cleanup() {
+			src.off("readable", onReadable);
+			src.off("error", onError);
+			src.off("end", onEnd);
+		}
+		function tryRead() {
+			let needed = length - received;
+			while (needed > 0) {
+				const chunk = src.read(needed) ?? src.read();
+				if (chunk === null) return;
+				chunks.push(chunk);
+				received += chunk.length;
+				needed = length - received;
+			}
+			cleanup();
+			const full = Buffer.concat(chunks);
+			if (received > length) src.unshift(full.subarray(length));
+			resolve(full.subarray(0, length));
+		}
+		function onReadable() {
+			tryRead();
+		}
+		function onError(err) {
+			cleanup();
+			reject(err);
+		}
+		function onEnd() {
+			cleanup();
+			reject(new require_primordials_error.ErrorCtor("stdin closed before message was complete"));
+		}
+		src.on("readable", onReadable);
+		src.on("error", onError);
+		src.once("end", onEnd);
+		tryRead();
+	});
+}
+async function runHost() {
+	try {
+		require_native_messaging_install.assertNodeStripTypesSupported();
+	} catch (e) {
+		logger.error(require_errors_message.errorMessage(e));
+		node_process.default.exit(1);
+	}
+	while (true) try {
+		await handleOne();
+	} catch {
+		node_process.default.exit(0);
+	}
+}
+function writeMessage(obj, stream) {
+	const payload = Buffer.from(JSON.stringify(obj), "utf8");
+	const header = Buffer.allocUnsafe(4);
+	header.writeUInt32LE(payload.length, 0);
+	(stream ?? node_process.default.stdout).write(Buffer.concat([header, payload]));
+}
+
+//#endregion
+exports.handleOne = handleOne;
+exports.readExact = readExact;
+exports.runHost = runHost;
+exports.writeMessage = writeMessage;

package/dist/native-messaging/index.d.ts

@@ -0,0 +1,5 @@
+export { handleOne, readExact, runHost, writeMessage } from './host';
+export { HOST_NAME, MIN_NODE_VERSION_FOR_STRIP_TYPES, assertNodeStripTypesSupported, buildManifest, chromeManifestDirs, installNativeHost, registerWindows, stripTypesFlag, writeWrapperPosix, writeWrapperWindows, } from './install';
+export type { InstallOptions, InstallResult } from './install';
+export { TokenBucketLimiter } from './rate-limit';
+export type { TokenBucketOptions } from './rate-limit';

package/dist/native-messaging/index.js

@@ -0,0 +1,22 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_native_messaging_install = require('./install.js');
+const require_native_messaging_host = require('./host.js');
+const require_native_messaging_rate_limit = require('./rate-limit.js');
+
+exports.HOST_NAME = require_native_messaging_install.HOST_NAME;
+exports.MIN_NODE_VERSION_FOR_STRIP_TYPES = require_native_messaging_install.MIN_NODE_VERSION_FOR_STRIP_TYPES;
+exports.TokenBucketLimiter = require_native_messaging_rate_limit.TokenBucketLimiter;
+exports.assertNodeStripTypesSupported = require_native_messaging_install.assertNodeStripTypesSupported;
+exports.buildManifest = require_native_messaging_install.buildManifest;
+exports.chromeManifestDirs = require_native_messaging_install.chromeManifestDirs;
+exports.handleOne = require_native_messaging_host.handleOne;
+exports.installNativeHost = require_native_messaging_install.installNativeHost;
+exports.readExact = require_native_messaging_host.readExact;
+exports.registerWindows = require_native_messaging_install.registerWindows;
+exports.runHost = require_native_messaging_host.runHost;
+exports.stripTypesFlag = require_native_messaging_install.stripTypesFlag;
+exports.writeMessage = require_native_messaging_host.writeMessage;
+exports.writeWrapperPosix = require_native_messaging_install.writeWrapperPosix;
+exports.writeWrapperWindows = require_native_messaging_install.writeWrapperWindows;

package/dist/native-messaging/install.d.ts

@@ -0,0 +1,60 @@
+/**
+ * @file Install the Socket native messaging host manifest so Chrome can find
+ *   and launch the host when the extension calls connectNative(). Native host
+ *   manifest paths (Chrome): macOS ~/Library/Application
+ *   Support/Google/Chrome/NativeMessagingHosts/<name>.json
+ *   ~/Library/Application Support/Chromium/NativeMessagingHosts/<name>.json
+ *   Linux ~/.config/google-chrome/NativeMessagingHosts/<name>.json
+ *   ~/.config/chromium/NativeMessagingHosts/<name>.json Windows
+ *   HKCU\Software\Google\Chrome\NativeMessagingHosts<name> → path to .json The
+ *   manifest points to a small wrapper shell script (POSIX) or .cmd (Windows)
+ *   that invokes `node /path/to/socket-lib/src/native-messaging/run.ts` with
+ *   the `--native-messaging` flag so the host can detect its context even when
+ *   the extension origin arg is absent (e.g. during local testing). Strip-types
+ *   flag policy: Node 24+ no flag needed (default-on). Node 22.6–23 pass
+ *   `--strip-types` (stable since 22.6). Node < 22.6 refuse to install;
+ *   assertNodeStripTypesSupported throws. The flag decision is baked into the
+ *   wrapper at install time. If the user later switches Node versions (e.g. via
+ *   nvm) the host enforces the same floor at runtime via
+ *   assertNodeStripTypesSupported.
+ */
+export declare const HOST_NAME = "dev.socket.trusted_publisher_host";
+export declare const MIN_NODE_VERSION_FOR_STRIP_TYPES = "22.6.0";
+export interface InstallOptions {
+    /**
+     * List of Chrome extension origin URLs that are allowed to connect to this
+     * host. Each entry is `chrome-extension://<extension-id>/`. Pass `['*']`
+     * during development to allow any extension (not for production).
+     */
+    allowedOrigins: string[];
+    /**
+     * When `true`, reject wildcard origins (`['*']`) — production installs must
+     * pin to specific extension IDs.
+     */
+    production?: boolean | undefined;
+    /**
+     * Directory to write the wrapper script. Defaults to the same directory as
+     * this file (`src/native-messaging/`).
+     */
+    wrapperDir?: string | undefined;
+}
+export interface InstallResult {
+    manifestPaths: string[];
+    wrapperPath: string;
+}
+/**
+ * Throw a clear, actionable error if the current Node runtime is too old to
+ * strip TypeScript types (i.e. < 22.6). Use at install time + host startup.
+ *
+ * The error message names the active Node version manager (nvm / fnm / volta /
+ * asdf / n / corepack / system) and gives the exact one-liner to upgrade — so
+ * the user can copy-paste the fix rather than searching docs.
+ */
+export declare function assertNodeStripTypesSupported(): void;
+export declare function buildManifest(wrapperPath: string, allowedOrigins: string[]): object;
+export declare function chromeManifestDirs(): string[];
+export declare function installNativeHost(options: InstallOptions): InstallResult;
+export declare function registerWindows(manifestPath: string): void;
+export declare function stripTypesFlag(): string;
+export declare function writeWrapperPosix(wrapperPath: string): void;
+export declare function writeWrapperWindows(wrapperPath: string): void;

package/dist/native-messaging/install.js

@@ -0,0 +1,144 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_primordials_error = require('../primordials/error.js');
+const require_constants_platform = require('../constants/platform.js');
+const require_env_home = require('../env/home.js');
+const require_env_windows = require('../env/windows.js');
+const require_constants_node = require('../constants/node.js');
+const require_env_node_version_managers = require('../env/node-version-managers.js');
+let node_fs = require("node:fs");
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+let node_url = require("node:url");
+let _socketsecurity_lib_stable_process_spawn_child = require("@socketsecurity/lib-stable/process/spawn/child");
+
+//#region src/native-messaging/install.ts
+/**
+* @file Install the Socket native messaging host manifest so Chrome can find
+*   and launch the host when the extension calls connectNative(). Native host
+*   manifest paths (Chrome): macOS ~/Library/Application
+*   Support/Google/Chrome/NativeMessagingHosts/<name>.json
+*   ~/Library/Application Support/Chromium/NativeMessagingHosts/<name>.json
+*   Linux ~/.config/google-chrome/NativeMessagingHosts/<name>.json
+*   ~/.config/chromium/NativeMessagingHosts/<name>.json Windows
+*   HKCU\Software\Google\Chrome\NativeMessagingHosts<name> → path to .json The
+*   manifest points to a small wrapper shell script (POSIX) or .cmd (Windows)
+*   that invokes `node /path/to/socket-lib/src/native-messaging/run.ts` with
+*   the `--native-messaging` flag so the host can detect its context even when
+*   the extension origin arg is absent (e.g. during local testing). Strip-types
+*   flag policy: Node 24+ no flag needed (default-on). Node 22.6–23 pass
+*   `--strip-types` (stable since 22.6). Node < 22.6 refuse to install;
+*   assertNodeStripTypesSupported throws. The flag decision is baked into the
+*   wrapper at install time. If the user later switches Node versions (e.g. via
+*   nvm) the host enforces the same floor at runtime via
+*   assertNodeStripTypesSupported.
+*/
+const HOST_NAME = "dev.socket.trusted_publisher_host";
+const MIN_NODE_VERSION_FOR_STRIP_TYPES = "22.6.0";
+const __dirname$1 = node_path.default.dirname((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href));
+const HOST_SCRIPT = node_path.default.resolve(__dirname$1, "run.ts");
+/**
+* Throw a clear, actionable error if the current Node runtime is too old to
+* strip TypeScript types (i.e. < 22.6). Use at install time + host startup.
+*
+* The error message names the active Node version manager (nvm / fnm / volta /
+* asdf / n / corepack / system) and gives the exact one-liner to upgrade — so
+* the user can copy-paste the fix rather than searching docs.
+*/
+function assertNodeStripTypesSupported() {
+	if (require_constants_node.supportsNodeStripTypes()) return;
+	const manager = require_env_node_version_managers.detectActiveNodeManager();
+	const hint = require_env_node_version_managers.nodeManagerUpgradeHint(manager, MIN_NODE_VERSION_FOR_STRIP_TYPES);
+	throw new require_primordials_error.ErrorCtor(`Node ${require_constants_node.getNodeVersion()} cannot run TypeScript directly. The Socket native-messaging host needs Node ${MIN_NODE_VERSION_FOR_STRIP_TYPES}+ (type-stripping is stable in Node 22.6 and default-on in Node 24).\nDetected Node manager: ${manager}\nTo upgrade: ${hint}`);
+}
+function buildManifest(wrapperPath, allowedOrigins) {
+	return {
+		name: HOST_NAME,
+		description: "Socket Security — API token bridge for the Trusted Publisher extension",
+		path: wrapperPath,
+		type: "stdio",
+		allowed_origins: allowedOrigins
+	};
+}
+function chromeManifestDirs() {
+	const home = require_env_home.getHome();
+	if (!home) throw new require_primordials_error.ErrorCtor("Cannot determine home directory.");
+	if (require_constants_platform.DARWIN) {
+		const lib = node_path.default.join(home, "Library", "Application Support");
+		return [node_path.default.join(lib, "Google", "Chrome", "NativeMessagingHosts"), node_path.default.join(lib, "Chromium", "NativeMessagingHosts")];
+	}
+	if (require_constants_platform.WIN32) {
+		const appData = require_env_windows.getAppdata() ?? node_path.default.join(home, "AppData", "Roaming");
+		return [node_path.default.join(appData, "Google", "Chrome", "User Data", "NativeMessagingHosts")];
+	}
+	const config = node_process.default.env["XDG_CONFIG_HOME"] ?? node_path.default.join(home, ".config");
+	return [node_path.default.join(config, "google-chrome", "NativeMessagingHosts"), node_path.default.join(config, "chromium", "NativeMessagingHosts")];
+}
+function installNativeHost(options) {
+	assertNodeStripTypesSupported();
+	const { allowedOrigins, production = false, wrapperDir = __dirname$1 } = {
+		__proto__: null,
+		...options
+	};
+	if (production && allowedOrigins.includes("*")) throw new require_primordials_error.ErrorCtor("production mode rejects allowedOrigins '*' — pin to specific chrome-extension://<id>/ origins");
+	if (allowedOrigins.length === 0) throw new require_primordials_error.ErrorCtor("allowedOrigins must contain at least one origin; pass ['*'] for development");
+	const wrapperName = require_constants_platform.WIN32 ? `${HOST_NAME}.cmd` : `${HOST_NAME}.sh`;
+	const wrapperPath = node_path.default.join(wrapperDir, wrapperName);
+	if (require_constants_platform.WIN32) writeWrapperWindows(wrapperPath);
+	else writeWrapperPosix(wrapperPath);
+	const manifest = buildManifest(wrapperPath, allowedOrigins);
+	const dirs = chromeManifestDirs();
+	const written = [];
+	for (const dir of dirs) {
+		(0, node_fs.mkdirSync)(dir, { recursive: true });
+		const manifestPath = node_path.default.join(dir, `${HOST_NAME}.json`);
+		(0, node_fs.writeFileSync)(manifestPath, JSON.stringify(manifest, null, 2) + "\n", "utf8");
+		written.push(manifestPath);
+	}
+	if (require_constants_platform.WIN32 && written[0]) registerWindows(written[0]);
+	return {
+		manifestPaths: written,
+		wrapperPath
+	};
+}
+function registerWindows(manifestPath) {
+	(0, _socketsecurity_lib_stable_process_spawn_child.spawnSync)("reg", [
+		"add",
+		`HKCU\\Software\\Google\\Chrome\\NativeMessagingHosts\\${HOST_NAME}`,
+		"/ve",
+		"/t",
+		"REG_SZ",
+		"/d",
+		manifestPath,
+		"/f"
+	], {
+		stdio: "ignore",
+		shell: require_constants_platform.WIN32
+	});
+}
+function stripTypesFlag() {
+	return require_constants_node.supportsNodeStripTypesDefault() ? "" : "--strip-types ";
+}
+function writeWrapperPosix(wrapperPath) {
+	(0, node_fs.writeFileSync)(wrapperPath, ["#!/bin/sh", `exec "${node_process.default.execPath}" ${stripTypesFlag()}"${HOST_SCRIPT}" "$@"`].join("\n") + "\n", { encoding: "utf8" });
+	(0, node_fs.chmodSync)(wrapperPath, 493);
+}
+function writeWrapperWindows(wrapperPath) {
+	(0, node_fs.writeFileSync)(wrapperPath, `@echo off\r\n"${node_process.default.execPath}" ${stripTypesFlag()}"${HOST_SCRIPT}" %*\r\n`, { encoding: "utf8" });
+}
+
+//#endregion
+exports.HOST_NAME = HOST_NAME;
+exports.MIN_NODE_VERSION_FOR_STRIP_TYPES = MIN_NODE_VERSION_FOR_STRIP_TYPES;
+exports.assertNodeStripTypesSupported = assertNodeStripTypesSupported;
+exports.buildManifest = buildManifest;
+exports.chromeManifestDirs = chromeManifestDirs;
+exports.installNativeHost = installNativeHost;
+exports.registerWindows = registerWindows;
+exports.stripTypesFlag = stripTypesFlag;
+exports.writeWrapperPosix = writeWrapperPosix;
+exports.writeWrapperWindows = writeWrapperWindows;

package/dist/native-messaging/rate-limit.d.ts

@@ -0,0 +1,69 @@
+/**
+ * @file Token-bucket rate limit for the Chrome native-messaging host. Why this
+ *   exists: A Chrome extension that has been hijacked (XSS in a content script,
+ *   a compromised CDN dependency) can call `chrome.runtime.connectNative()` in
+ *   a tight loop. Without a rate limit, the attacker can request our
+ *   `get-api-token` message thousands of times a second — useful for scraping
+ *   tokens from a multi-account user, or for keeping the bearer "fresh" in the
+ *   page's memory after the user navigates away. The bucket gives each origin
+ *   (`chrome-extension://<id>/`, passed by Chrome as `process.argv[2]`) a
+ *   budget. Burst is allowed; sustained hammering is denied with `{ error:
+ *   'rate limited' }`. A typing-fast human never sees the limit; a botted
+ *   extension hits it on its second line of attack. Why in-memory: The NM host
+ *   is a per-Chrome-launch subprocess — restarting Chrome restarts the bucket.
+ *   That's exactly what we want: an attacker who can force Chrome to relaunch
+ *   has bigger problems than rate-limiting. Shape patterned after pilcrow's
+ *   `ratelimit/limit.go` — minimal, in-memory, LRU-evicts at `maxKeys`. The
+ *   fleet's `socket-lib` already has a TTL-cache module but it's overkill for
+ *   this one use case; a 50-line bucket is easier to audit.
+ */
+export interface TokenBucketOptions {
+    /**
+     * How many tokens fit in a single bucket. The first `capacity` requests from
+     * an origin pass without blocking; the (capacity + 1)th request only passes
+     * if at least one refill interval has elapsed since the last refill
+     * checkpoint.
+     */
+    capacity: number;
+    /**
+     * How many milliseconds it takes for one token to refill. With `capacity: 60`
+     * and `refillIntervalMs: 1000`, an origin gets up to 60 requests of burst
+     * plus a steady-state 1 req/s.
+     */
+    refillIntervalMs: number;
+    /**
+     * Maximum number of distinct keys (origins) to track at once. When the map
+     * fills, the least-recently-touched key is evicted. Caps memory against an
+     * attacker that varies the key on every request.
+     */
+    maxKeys: number;
+}
+export interface BucketEntry {
+    tokens: number;
+    lastRefillAt: number;
+    newer: BucketEntry | undefined;
+    older: BucketEntry | undefined;
+    key: string;
+}
+export declare class TokenBucketLimiter {
+    #private;
+    constructor(options: TokenBucketOptions);
+    /**
+     * Try to consume one token for `key`. Returns `true` when the request is
+     * allowed; `false` when the bucket is empty and not enough time has elapsed
+     * to refill.
+     *
+     * `now` is injectable so tests can advance the virtual clock without
+     * sleeping. In production callers pass `Date.now()` (the default).
+     */
+    consume(key: string, now?: number): boolean;
+    /**
+     * Test-only inspector. Returns the current token count for `key`, or
+     * `undefined` if `key` has never been seen.
+     */
+    peek(key: string): number | undefined;
+    /**
+     * Test-only inspector. Returns the current number of tracked keys.
+     */
+    size(): number;
+}