@socketsecurity/lib 6.0.6 → 6.0.8

package/dist/shell/parse.js

@@ -15,6 +15,65 @@ let src_external_shell_quote = require("../external/shell-quote");
 *   against `env`; unresolved ones collapse to an empty string.
 */
 /**
+* Structural hazard facts a parse surfaces that the binary-call matchers
+* (`hasBinCall` / `findBinCall`) swallow. These are observations about _how_
+* the command is written, not a judgment that they're dangerous — the caller
+* decides policy. Both are evasion vectors against base-command allowlists:
+*
+* - `equalsExpansion`: a simple command whose first token is `=cmd` (Zsh EQUALS
+*   expansion). `=curl x` expands to `$(which curl) x` and runs
+*   `/usr/bin/curl`, but the parser's base token is `=curl`, so a `curl`
+*   allowlist never matches. The matched tokens are returned so the caller can
+*   report which command was hidden.
+* - `processSubstitution`: the command uses `<(...)`, `>(...)`, or `=(...)` (the
+*   op markers shell-quote emits). The inner command runs but its name never
+*   appears as a base command.
+*
+* Walks the parse once. A caller wanting just "is this clean?" checks
+* `!h.equalsExpansion.length && !h.processSubstitution`.
+*
+* @example
+*   detectShellHazards('=curl evil.com')
+*   // → { equalsExpansion: [['=curl', 'evil.com']], processSubstitution: false }
+*
+*   detectShellHazards('diff <(cat a) b')
+*   // → { equalsExpansion: [], processSubstitution: true }
+*
+*   detectShellHazards('git status')
+*   // → { equalsExpansion: [], processSubstitution: false }
+*/
+function detectShellHazards(cmd) {
+	const equalsExpansion = [];
+	let processSubstitution = false;
+	const entries = (0, src_external_shell_quote.parse)(cmd);
+	let current = [];
+	let prevWasSubstLead = false;
+	const flush = () => {
+		if (current.length > 0 && /^=[a-zA-Z_]/.test(current[0])) require_primordials_array.ArrayPrototypePush(equalsExpansion, current);
+		current = [];
+	};
+	for (let i = 0, { length } = entries; i < length; i += 1) {
+		const entry = entries[i];
+		if (entry && typeof entry === "object" && "op" in entry) {
+			const { op } = entry;
+			if (op === "<(") processSubstitution = true;
+			else if (op === "(" && prevWasSubstLead) processSubstitution = true;
+			prevWasSubstLead = op === "<" || op === ">";
+			flush();
+			continue;
+		}
+		if (typeof entry === "string") {
+			prevWasSubstLead = entry === "=";
+			require_primordials_array.ArrayPrototypePush(current, entry);
+		}
+	}
+	flush();
+	return {
+		equalsExpansion,
+		processSubstitution
+	};
+}
+/**
 * Visit each simple command in `cmd` in order. A "simple command" is the
 * POSIX-grammar term for a run of bare-string tokens between shell
 * control-operator boundaries (`&&`, `;`, `||`, `|`) — e.g. in `sudo apt && rm
@@ -193,6 +252,7 @@ function simpleCommandStartsWith(tokens, prefix) {
 }
 
 //#endregion
+exports.detectShellHazards = detectShellHazards;
 exports.eachSimpleCommand = eachSimpleCommand;
 exports.findBinCall = findBinCall;
 exports.findBinCalls = findBinCalls;

package/dist/smol/detect.js

@@ -27,26 +27,25 @@ const require_node_module = require('../node/module.js');
 /**
 * Cached smol-binary detection result.
 */
-let _isSmol;
+let isSmolCache;
 /**
 * Cached `node:smol-util` binding. `null` = probed and unavailable; `undefined`
 * = not yet probed. JS truthiness collapses both to "no binding" at the call
 * site.
 */
-let _smolUtil;
-let _smolUtilProbed = false;
+let smolUtilCache;
+let smolUtilProbed = false;
 /**
 * Returns `node:smol-util` when running on the smol Node binary, otherwise
 * `undefined`. Result is cached across calls.
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSmolUtil() {
-	if (!_smolUtilProbed) {
-		_smolUtilProbed = true;
+	if (!smolUtilProbed) {
+		smolUtilProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-util")) _smolUtil = require("node:smol-util");
+		if (require_node_module.isNodeBuiltin("node:smol-util")) smolUtilCache = require("node:smol-util");
 	}
-	return _smolUtil;
+	return smolUtilCache;
 }
 /**
 * Detect if the current process is running on socket-btm's smol Node binary.
@@ -66,8 +65,8 @@ function getSmolUtil() {
 *   ```
 */
 function isSmol() {
-	if (_isSmol === void 0) _isSmol = /* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-util");
-	return _isSmol;
+	if (isSmolCache === void 0) isSmolCache = require_node_module.isNodeBuiltin("node:smol-util");
+	return isSmolCache;
 }
 
 //#endregion

package/dist/smol/http.js

@@ -18,20 +18,19 @@ const require_node_module = require('../node/module.js');
 *   `httpText` exports, which already route through this when smol
 *   is present.
 */
-let _smolHttp;
-let _smolHttpProbed = false;
+let smolHttpBinding;
+let smolHttpProbed = false;
 /**
 * Returns `node:smol-http` when running on the smol Node binary, otherwise
 * `undefined`. Result is cached across calls.
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSmolHttp() {
-	if (!_smolHttpProbed) {
-		_smolHttpProbed = true;
+	if (!smolHttpProbed) {
+		smolHttpProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-http")) _smolHttp = require("node:smol-http");
+		if (require_node_module.isNodeBuiltin("node:smol-http")) smolHttpBinding = require("node:smol-http");
 	}
-	return _smolHttp;
+	return smolHttpBinding;
 }
 
 //#endregion

package/dist/smol/https.js

@@ -16,20 +16,19 @@ const require_node_module = require('../node/module.js');
 *   callers should use the standard server-side helpers, which
 *   route through this when smol is present.
 */
-let _smolHttps;
-let _smolHttpsProbed = false;
+let smolHttps;
+let smolHttpsProbed = false;
 /**
 * Returns `node:smol-https` when running on the smol Node binary, otherwise
 * `undefined`. Result is cached across calls.
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSmolHttps() {
-	if (!_smolHttpsProbed) {
-		_smolHttpsProbed = true;
+	if (!smolHttpsProbed) {
+		smolHttpsProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-https")) _smolHttps = require("node:smol-https");
+		if (require_node_module.isNodeBuiltin("node:smol-https")) smolHttps = require("node:smol-https");
 	}
-	return _smolHttps;
+	return smolHttps;
 }
 
 //#endregion

package/dist/smol/manifest.d.ts

@@ -83,7 +83,7 @@ export interface ParsedLockfile {
 export interface FormatDescriptor {
     readonly ecosystem: EcosystemString;
     readonly type: 'manifest' | 'lockfile';
-    readonly format?: 'npm' | 'yarn' | 'pnpm' | 'composer' | 'cargo';
+    readonly format?: 'npm' | 'yarn' | 'pnpm' | 'composer' | 'cargo' | undefined;
 }
 /**
  * Supported-files index returned by `supportedFiles`.

package/dist/smol/manifest.js

@@ -18,20 +18,19 @@ const require_node_module = require('../node/module.js');
 *   (`@socketsecurity/lib/eco/manifest/parse`), which already routes
 *   through this when smol is present.
 */
-let _smolManifest;
-let _smolManifestProbed = false;
+let cachedSmolManifest;
+let smolManifestProbed = false;
 /**
 * Returns `node:smol-manifest` when running on the smol Node binary, otherwise
 * `undefined`. Result is cached across calls.
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSmolManifest() {
-	if (!_smolManifestProbed) {
-		_smolManifestProbed = true;
+	if (!smolManifestProbed) {
+		smolManifestProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-manifest")) _smolManifest = require("node:smol-manifest");
+		if (require_node_module.isNodeBuiltin("node:smol-manifest")) cachedSmolManifest = require("node:smol-manifest");
 	}
-	return _smolManifest;
+	return cachedSmolManifest;
 }
 
 //#endregion

package/dist/smol/path.d.ts

@@ -6,7 +6,7 @@
  *   and on socket-btm binaries that haven't shipped the binding yet; callers
  *   fall back to the JS implementation. Result is cached. The binding does not
  *   exist yet (the plan is unbuilt) — this accessor is the seam so that when it
- *   lands, only this file changes and `paths/walk`, `fs/access`, `fs/find-up`
+ *   lands, only this file changes and `paths/walk`, `fs/access`, `fs/find`
  *   light up natively. Today `getSmolPath()` is always `undefined` and the JS
  *   paths run.
  */

package/dist/smol/path.js

@@ -12,26 +12,25 @@ const require_node_module = require('../node/module.js');
 *   and on socket-btm binaries that haven't shipped the binding yet; callers
 *   fall back to the JS implementation. Result is cached. The binding does not
 *   exist yet (the plan is unbuilt) — this accessor is the seam so that when it
-*   lands, only this file changes and `paths/walk`, `fs/access`, `fs/find-up`
+*   lands, only this file changes and `paths/walk`, `fs/access`, `fs/find`
 *   light up natively. Today `getSmolPath()` is always `undefined` and the JS
 *   paths run.
 */
-let _smolPath;
-let _smolPathProbed = false;
+let smolPathCache;
+let smolPathProbed = false;
 /**
 * Returns the `node:smol-path` binding when running on a smol Node binary that
 * ships it; otherwise `undefined`. Cached across calls.
 *
 * @returns The native binding, or `undefined` to signal "use the JS fallback".
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSmolPath() {
-	if (!_smolPathProbed) {
-		_smolPathProbed = true;
+	if (!smolPathProbed) {
+		smolPathProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-path")) _smolPath = require("node:smol-path");
+		if (require_node_module.isNodeBuiltin("node:smol-path")) smolPathCache = require("node:smol-path");
 	}
-	return _smolPath;
+	return smolPathCache;
 }
 
 //#endregion

package/dist/smol/primordial.d.ts

@@ -67,6 +67,10 @@ export interface SmolPrimordialBinding {
     numberParseInt10(s: string): number;
     stringCharCodeAt(s: string, i: number): number;
     stringIsWellFormed(s: string): boolean;
+    IntlCollator: typeof Intl.Collator;
+    IntlListFormat: typeof Intl.ListFormat;
+    IntlPluralRules: typeof Intl.PluralRules;
+    IntlSegmenter: typeof Intl.Segmenter;
 }
 /**
  * Returns `node:smol-primordial` when running on the smol Node binary,

package/dist/smol/primordial.js

@@ -20,20 +20,19 @@ const require_node_module = require('../node/module.js');
 *
 * @see https://v8.dev/blog/v8-release-99 — V8 Fast API Calls overview
 */
-let _smolPrimordial;
-let _smolPrimordialProbed = false;
+let smolPrimordial;
+let smolPrimordialProbed = false;
 /**
 * Returns `node:smol-primordial` when running on the smol Node binary,
 * otherwise `undefined`. Result is cached across calls.
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSmolPrimordial() {
-	if (!_smolPrimordialProbed) {
-		_smolPrimordialProbed = true;
+	if (!smolPrimordialProbed) {
+		smolPrimordialProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-primordial")) _smolPrimordial = require("node:smol-primordial");
+		if (require_node_module.isNodeBuiltin("node:smol-primordial")) smolPrimordial = require("node:smol-primordial");
 	}
-	return _smolPrimordial;
+	return smolPrimordial;
 }
 
 //#endregion

package/dist/smol/purl.d.ts

@@ -7,7 +7,7 @@
  *   calls. Callers fall back to the JS `@socketregistry/packageurl-js` import
  *   on the undefined path.
  *
- * @internal — used by `src/packages/operations.ts` to resolve the
+ * @internal — used by `src/packages/specs.ts` to resolve the
  *   `pkg:npm/<name>` parse on `resolveRegistryPackageName`. Most
  *   callers should keep using `PackageURL` from
  *   `external/@socketregistry/packageurl-js` directly; this loader

package/dist/smol/purl.js

@@ -13,26 +13,25 @@ const require_node_module = require('../node/module.js');
 *   calls. Callers fall back to the JS `@socketregistry/packageurl-js` import
 *   on the undefined path.
 *
-* @internal — used by `src/packages/operations.ts` to resolve the
+* @internal — used by `src/packages/specs.ts` to resolve the
 *   `pkg:npm/<name>` parse on `resolveRegistryPackageName`. Most
 *   callers should keep using `PackageURL` from
 *   `external/@socketregistry/packageurl-js` directly; this loader
 *   only matters where the hot path warrants the native acceleration.
 */
-let _smolPurl;
-let _smolPurlProbed = false;
+let smolPurl;
+let smolPurlProbed = false;
 /**
 * Returns `node:smol-purl` when running on the smol Node binary, otherwise
 * `undefined`. Result is cached across calls.
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSmolPurl() {
-	if (!_smolPurlProbed) {
-		_smolPurlProbed = true;
+	if (!smolPurlProbed) {
+		smolPurlProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-purl")) _smolPurl = require("node:smol-purl");
+		if (require_node_module.isNodeBuiltin("node:smol-purl")) smolPurl = require("node:smol-purl");
 	}
-	return _smolPurl;
+	return smolPurl;
 }
 
 //#endregion

package/dist/smol/versions.js

@@ -16,20 +16,19 @@ const require_node_module = require('../node/module.js');
 *   ops. Most callers should use the standard `versions` exports,
 *   which already route through this when smol is present.
 */
-let _smolVersions;
-let _smolVersionsProbed = false;
+let smolVersions;
+let smolVersionsProbed = false;
 /**
 * Returns `node:smol-versions` when running on the smol Node binary, otherwise
 * `undefined`. Result is cached across calls.
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSmolVersions() {
-	if (!_smolVersionsProbed) {
-		_smolVersionsProbed = true;
+	if (!smolVersionsProbed) {
+		smolVersionsProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-versions")) _smolVersions = require("node:smol-versions");
+		if (require_node_module.isNodeBuiltin("node:smol-versions")) smolVersions = require("node:smol-versions");
 	}
-	return _smolVersions;
+	return smolVersions;
 }
 
 //#endregion

package/dist/smol/vfs.js

@@ -26,8 +26,8 @@ const require_node_module = require('../node/module.js');
 *     binding. Result is cached across calls. Callers fall back to PATH lookup
 *     (or out-of-band downloads in socket-cli's case) when this is missing.
 */
-let _smolVfs;
-let _smolVfsProbed = false;
+let cachedSmolVfs;
+let smolVfsProbed = false;
 /**
 * Returns the pre-mounted SEA `SmolVirtualFileSystem` instance when running on
 * a smol Node binary with an embedded SEA payload; otherwise `undefined`.
@@ -37,14 +37,13 @@ let _smolVfsProbed = false;
 * binding-module loader is collapsed into this function so callers don't deal
 * with two indirection levels.
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getSmolVfs() {
-	if (!_smolVfsProbed) {
-		_smolVfsProbed = true;
+	if (!smolVfsProbed) {
+		smolVfsProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-vfs")) _smolVfs = require("node:smol-vfs").getSmolVfs();
+		if (require_node_module.isNodeBuiltin("node:smol-vfs")) cachedSmolVfs = require("node:smol-vfs").getSmolVfs();
 	}
-	return _smolVfs;
+	return cachedSmolVfs;
 }
 
 //#endregion

package/dist/sorts/_internal.js

@@ -3,17 +3,15 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
 //#region src/sorts/_internal.ts
-let _fastSort;
-let _semver;
-/*@__NO_SIDE_EFFECTS__*/
+let fastSort;
+let semver;
 function getFastSort() {
-	if (_fastSort === void 0) _fastSort = /*@__PURE__*/ require("../external/fast-sort.js");
-	return _fastSort;
+	if (fastSort === void 0) fastSort = /*@__PURE__*/ require("../external/fast-sort.js");
+	return fastSort;
 }
-/*@__NO_SIDE_EFFECTS__*/
 function getSemver() {
-	if (_semver === void 0) _semver = /*@__PURE__*/ require("../external/semver.js");
-	return _semver;
+	if (semver === void 0) semver = /*@__PURE__*/ require("../external/semver.js");
+	return semver;
 }
 
 //#endregion

package/dist/sorts/natural.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_intl = require('../primordials/intl.js');
 const require_sorts__internal = require('./_internal.js');
 
 //#region src/sorts/natural.ts
@@ -11,9 +12,9 @@ const require_sorts__internal = require('./_internal.js');
 *   Intl.Collator()` is 10-14ms in Node — too expensive to call
 *   per-comparison.
 */
-let _localeCompare;
-let _naturalCompare;
-let _naturalSorter;
+let cachedLocaleCompare;
+let cachedNaturalCompare;
+let cachedNaturalSorter;
 /**
 * Compare two strings using locale-aware comparison.
 *
@@ -24,10 +25,9 @@ let _naturalSorter;
 *   localeCompare('a', 'a') // 0
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function localeCompare(x, y) {
-	if (_localeCompare === void 0) _localeCompare = new Intl.Collator().compare;
-	return _localeCompare(x, y);
+	if (cachedLocaleCompare === void 0) cachedLocaleCompare = new require_primordials_intl.IntlCollator().compare;
+	return cachedLocaleCompare(x, y);
 }
 /**
 * Compare two strings using natural sorting (numeric-aware, case-insensitive).
@@ -38,13 +38,12 @@ function localeCompare(x, y) {
 *   naturalCompare('img10', 'img2') // positive (img10 after img2)
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function naturalCompare(x, y) {
-	if (_naturalCompare === void 0) _naturalCompare = new Intl.Collator(void 0, {
+	if (cachedNaturalCompare === void 0) cachedNaturalCompare = new require_primordials_intl.IntlCollator(void 0, {
 		numeric: true,
 		sensitivity: "base"
 	}).compare;
-	return _naturalCompare(x, y);
+	return cachedNaturalCompare(x, y);
 }
 /**
 * Sort an array using natural comparison.
@@ -55,10 +54,9 @@ function naturalCompare(x, y) {
 *   // ['file1', 'file2', 'file10']
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function naturalSorter(arrayToSort) {
-	if (_naturalSorter === void 0) _naturalSorter = (/* @__PURE__ */ require_sorts__internal.getFastSort()).createNewSortInstance({ comparer: naturalCompare });
-	return _naturalSorter(arrayToSort);
+	if (cachedNaturalSorter === void 0) cachedNaturalSorter = require_sorts__internal.getFastSort().createNewSortInstance({ comparer: naturalCompare });
+	return cachedNaturalSorter(arrayToSort);
 }
 
 //#endregion

package/dist/sorts/semver.js

@@ -18,10 +18,9 @@ const require_sorts__internal = require('./_internal.js');
 *   compareSemver('1.0.0', '1.0.0') // 0
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function compareSemver(a, b) {
 	/* c8 ignore start */
-	const semver = /* @__PURE__ */ require_sorts__internal.getSemver();
+	const semver = require_sorts__internal.getSemver();
 	const validA = semver.valid(a);
 	/* c8 ignore stop */
 	const validB = semver.valid(b);

package/dist/sorts/strings.js

@@ -18,7 +18,6 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 *   compareStr('a', 'a') // 0
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function compareStr(a, b) {
 	return a < b ? -1 : a > b ? 1 : 0;
 }

package/dist/sorts/types.d.ts

@@ -3,5 +3,5 @@
  *   shape returned by `naturalSorter`. Pure types, no runtime side effects.
  */
 import type * as fastSortType from '../external/fast-sort';
-export type FastSortFunction = ReturnType<typeof import('fast-sort').createNewSortInstance>;
+export type FastSortFunction = ReturnType<typeof fastSortType.createNewSortInstance>;
 export type { fastSortType };

package/dist/spinner/create-spinner-class.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @file Builds the lazy-init Socket `Spinner` class that extends the live
+ *   `yocto-spinner` constructor. The class graph is constructed inside
+ *   `createSpinnerClass()` so the `super()` call binds against the runtime
+ *   `YoctoSpinner` constructor passed in by the factory; keeping it here
+ *   (rather than at module scope) preserves the spinner's lazy-init guarantee
+ *   while splitting the bulk of the class body out of the factory module.
+ */
+import type { ColorRgb, ColorValue } from '../colors/types';
+import { incLogCallCountSymbol, lastWasBlankSymbol } from '../logger/symbols';
+import type { SpinnerInstance, SpinnerOptions } from './types';
+export type SpinnerCtorType = {
+    new (options?: SpinnerOptions | undefined): SpinnerInstance;
+};
+export type YoctoSpinnerConstructor = new (...args: unknown[]) => {
+    get color(): ColorRgb | ColorValue;
+    set color(value: ColorRgb | ColorValue);
+    isSpinning: boolean;
+    [key: string]: unknown;
+};
+export type SpinnerLogger = {
+    error: (...args: unknown[]) => unknown;
+    log: (...args: unknown[]) => unknown;
+    [lastWasBlankSymbol]: (value: boolean) => unknown;
+    [incLogCallCountSymbol]: () => unknown;
+};
+/**
+ * Build the Socket `Spinner` class as a subclass of the live `yocto-spinner`
+ * constructor. Passing the parent class in keeps the `super()` binding against
+ * the runtime constructor while letting the bulk of the class body live outside
+ * the factory module.
+ *
+ * @param YoctoSpinnerClass - Runtime `yocto-spinner` constructor to extend.
+ * @param logger - Default logger used for status output.
+ *
+ * @returns The constructed Socket spinner constructor.
+ */
+export declare function createSpinnerClass(YoctoSpinnerClass: YoctoSpinnerConstructor, logger: SpinnerLogger): SpinnerCtorType;