@socketsecurity/lib 6.0.7 → 6.0.9

package/dist/bin/resolve.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_constants_platform = require('../constants/platform.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_constants_platform = require('../constants/platform.js');
 const require_paths_normalize = require('../paths/normalize.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
@@ -102,7 +102,7 @@ function resolveRealBinSync(binPath) {
 		}
 	}
 	/* c8 ignore start - Windows-only wrapper-script resolution; tested
-	on Windows runners. The whole `if (WIN32)` block parses npm/npx/ // socket-hook: allow npx
+	on Windows runners. The whole `if (WIN32)` block parses npm/npx/ // socket-lint: allow npx
 	pnpm/yarn .cmd/.bat/.ps1 shims to extract the underlying CLI JS
 	path. Unreachable on macOS/Linux. */
 	if (require_constants_platform.WIN32) {

package/dist/cache/ttl/store.js

@@ -2,10 +2,10 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_error = require('../../primordials/error.js');
-const require_primordials_math = require('../../primordials/math.js');
 const require_primordials_string = require('../../primordials/string.js');
-const require_primordials_regexp = require('../../primordials/regexp.js');
+const require_primordials_math = require('../../primordials/math.js');
 const require_primordials_map_set = require('../../primordials/map-set.js');
+const require_primordials_regexp = require('../../primordials/regexp.js');
 const require_primordials_date = require('../../primordials/date.js');
 const require_primordials_json = require('../../primordials/json.js');
 const require_cacache_clear = require('../../cacache/clear.js');

package/dist/cli/check-primordials.d.ts

@@ -10,14 +10,20 @@
  *   error)
  */
 import type { PrimordialsCheckConfig, PrimordialsCheckResult, PrimordialsFinding } from '../checks/primordials';
-interface ParsedArgs {
+export interface ParsedArgs {
     readonly config: string | undefined;
     readonly json: boolean;
     readonly explain: boolean;
     readonly silent: boolean;
     readonly help: boolean;
 }
-interface SerializedFinding {
+export interface RawConfig {
+    scanDirs?: unknown | undefined;
+    aliasMap?: unknown | undefined;
+    nodeInternalOnly?: unknown | undefined;
+    socketLibPrimordialsPath?: unknown | undefined;
+}
+export interface SerializedFinding {
     kind: PrimordialsFinding['kind'];
     name: string;
     files: readonly string[];
@@ -41,4 +47,3 @@ export declare function serialize(result: PrimordialsCheckResult): {
     used: number;
     findings: SerializedFinding[];
 };
-export {};

package/dist/cli/check-primordials.js

@@ -3,20 +3,20 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_error = require('../primordials/error.js');
-const require_primordials_array = require('../primordials/array.js');
+const require_primordials_object = require('../primordials/object.js');
 const require_primordials_map_set = require('../primordials/map-set.js');
+const require_primordials_array = require('../primordials/array.js');
 const require_primordials_json = require('../primordials/json.js');
-const require_primordials_object = require('../primordials/object.js');
 const require_errors_message = require('../errors/message.js');
 const require_logger_default = require('../logger/default.js');
 const require_argv_parse = require('../argv/parse.js');
 const require_checks_primordials_defaults = require('../checks/primordials-defaults.js');
 const require_checks_primordials = require('../checks/primordials.js');
 let node_fs = require("node:fs");
-let node_path = require("node:path");
-node_path = require_runtime.__toESM(node_path);
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
 
 //#region src/cli/check-primordials.ts
 /**

package/dist/compression/_internal.js

@@ -3,8 +3,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_error = require('../primordials/error.js');
-const require_primordials_string = require('../primordials/string.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_primordials_string = require('../primordials/string.js');
 let node_path = require("node:path");
 node_path = require_runtime.__toESM(node_path);
 

package/dist/compression/brotli.d.ts

@@ -10,7 +10,7 @@ import type { Buffer } from 'node:buffer';
 import type { BrotliOptions } from 'node:zlib';
 import type { CompressFileOptions, CompressOptions } from './types';
 export declare const BROTLI_EXTS: ReadonlySet<string>;
-interface ResolvedBrotliOptions extends BrotliOptions {
+export interface ResolvedBrotliOptions extends BrotliOptions {
     params: NonNullable<BrotliOptions['params']>;
 }
 /**
@@ -79,4 +79,3 @@ export declare function isBrotliCompressed(input: Buffer): boolean;
  * coverage.
  */
 export declare function resolveBrotliOptions(options: CompressOptions | undefined): ResolvedBrotliOptions;
-export {};

package/dist/compression/brotli.js

@@ -11,8 +11,8 @@ const require_compression__internal = require('./_internal.js');
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 node_path = require_runtime.__toESM(node_path);
-let node_util = require("node:util");
 let node_stream_promises = require("node:stream/promises");
+let node_util = require("node:util");
 let node_zlib = require("node:zlib");
 
 //#region src/compression/brotli.ts
@@ -88,6 +88,10 @@ function isBrotliCompressed(input) {
 * coverage.
 */
 function resolveBrotliOptions(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const level = options?.level ?? 11;
 	const params = { [node_zlib.constants.BROTLI_PARAM_QUALITY]: level };
 	if (options?.size !== void 0 && options.size > 0) params[node_zlib.constants.BROTLI_PARAM_SIZE_HINT] = options.size;

package/dist/compression/gzip.js

@@ -11,8 +11,8 @@ const require_compression__internal = require('./_internal.js');
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 node_path = require_runtime.__toESM(node_path);
-let node_util = require("node:util");
 let node_stream_promises = require("node:stream/promises");
+let node_util = require("node:util");
 let node_zlib = require("node:zlib");
 
 //#region src/compression/gzip.ts
@@ -87,6 +87,10 @@ function isGzipCompressed(input) {
 * coverage.
 */
 function resolveGzipOptions(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const level = options?.level;
 	if (level === void 0) return { __proto__: null };
 	return {

package/dist/config/layers.d.ts

@@ -0,0 +1,53 @@
+/**
+ * @file Read a layered config — a base config that higher layers may override
+ *   or extend. Generic over the layer directories, the base name, and the file
+ *   extension: `readConfigLayers('vitest', { dirs: ['.config/base',
+ *   '.config/local'] })` reads each `<dir>/vitest.json` in precedence order and
+ *   returns the layers that exist. Callers apply their own merge, because merge
+ *   policy varies (a denylist unions all layers; an allowlist takes the highest
+ *   layer that declares one; an array key concatenates). `mergeConfigArray`
+ *   covers the concat case across any number of layers. No fleet knowledge
+ *   lives here — the fleet-convention `.config/fleet` + `.config/repo` wrapper
+ *   is `fleet/repo-config`'s `resolveRepoConfig`, a thin layer over this
+ *   reader.
+ */
+export interface ReadConfigLayersOptions {
+    dirs: readonly string[];
+    rootDir?: string | undefined;
+    cwd?: string | undefined;
+    ext?: string | undefined;
+}
+/**
+ * Concatenate one array-valued key across all layers — the common merge for a
+ * list that higher layers EXTEND rather than replace (e.g. extra exclude
+ * globs). Layers contribute in precedence order; a non-array value for the key
+ * (or a missing key, or an `undefined` layer) contributes nothing.
+ *
+ * @param layers - The layers from `readConfigLayers` (or any object array).
+ * @param key - The array-valued property to concatenate.
+ *
+ * @returns Each layer's entries in order; `[]` when no layer has the array.
+ */
+export declare function mergeConfigArray<T extends Record<string, unknown>, K extends keyof T>(layers: ReadonlyArray<T | undefined>, key: K): Array<T[K] extends Array<infer E> ? E : never>;
+/**
+ * Read a named config from an ordered list of layer directories.
+ *
+ * For each dir in `dirs`, reads `<rootDir>/<dir>/<name><ext>`; layers that are
+ * absent or unparseable are skipped (never throws — config reads are
+ * best-effort). The returned array preserves `dirs` order (lowest precedence
+ * first), so the last element is the highest-precedence layer present.
+ *
+ * @example
+ *   ;```typescript
+ *   const layers = readConfigLayers<VitestConfig>('vitest', {
+ *     dirs: ['.config/base', '.config/team', '.config/local'],
+ *   })
+ *   // layers === every one of those that existed, in that order
+ *   ```
+ *
+ * @param name - Base name of the config file (no directory, no extension).
+ * @param options - Layer dirs + resolution options.
+ *
+ * @returns Parsed layers in precedence order; empty when none exist.
+ */
+export declare function readConfigLayers<T = unknown>(name: string, options: ReadConfigLayersOptions): T[];

package/dist/config/layers.js

@@ -0,0 +1,83 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_node_path = require('../node/path.js');
+const require_fs_read_json = require('../fs/read-json.js');
+const require_primordials_process = require('../primordials/process.js');
+const require_git_repo = require('../git/repo.js');
+
+//#region src/config/layers.ts
+/**
+* @file Read a layered config — a base config that higher layers may override
+*   or extend. Generic over the layer directories, the base name, and the file
+*   extension: `readConfigLayers('vitest', { dirs: ['.config/base',
+*   '.config/local'] })` reads each `<dir>/vitest.json` in precedence order and
+*   returns the layers that exist. Callers apply their own merge, because merge
+*   policy varies (a denylist unions all layers; an allowlist takes the highest
+*   layer that declares one; an array key concatenates). `mergeConfigArray`
+*   covers the concat case across any number of layers. No fleet knowledge
+*   lives here — the fleet-convention `.config/fleet` + `.config/repo` wrapper
+*   is `fleet/repo-config`'s `resolveRepoConfig`, a thin layer over this
+*   reader.
+*/
+/**
+* Concatenate one array-valued key across all layers — the common merge for a
+* list that higher layers EXTEND rather than replace (e.g. extra exclude
+* globs). Layers contribute in precedence order; a non-array value for the key
+* (or a missing key, or an `undefined` layer) contributes nothing.
+*
+* @param layers - The layers from `readConfigLayers` (or any object array).
+* @param key - The array-valued property to concatenate.
+*
+* @returns Each layer's entries in order; `[]` when no layer has the array.
+*/
+function mergeConfigArray(layers, key) {
+	const out = [];
+	for (let i = 0, { length } = layers; i < length; i += 1) {
+		const value = layers[i]?.[key];
+		if (Array.isArray(value)) out.push(...value);
+	}
+	return out;
+}
+/**
+* Read a named config from an ordered list of layer directories.
+*
+* For each dir in `dirs`, reads `<rootDir>/<dir>/<name><ext>`; layers that are
+* absent or unparseable are skipped (never throws — config reads are
+* best-effort). The returned array preserves `dirs` order (lowest precedence
+* first), so the last element is the highest-precedence layer present.
+*
+* @example
+*   ;```typescript
+*   const layers = readConfigLayers<VitestConfig>('vitest', {
+*     dirs: ['.config/base', '.config/team', '.config/local'],
+*   })
+*   // layers === every one of those that existed, in that order
+*   ```
+*
+* @param name - Base name of the config file (no directory, no extension).
+* @param options - Layer dirs + resolution options.
+*
+* @returns Parsed layers in precedence order; empty when none exist.
+*/
+function readConfigLayers(name, options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const path = require_node_path.getNodePath();
+	const cwd = opts.cwd ?? require_primordials_process.processCwd();
+	const rootDir = opts.rootDir ?? require_git_repo.findGitRoot(cwd);
+	const file = `${name}${opts.ext ?? ".json"}`;
+	const layers = [];
+	const { dirs } = opts;
+	for (let i = 0, { length } = dirs; i < length; i += 1) {
+		const value = require_fs_read_json.readJsonSync(path.join(rootDir, dirs[i], file), { throws: false });
+		if (value !== void 0) layers.push(value);
+	}
+	return layers;
+}
+
+//#endregion
+exports.mergeConfigArray = mergeConfigArray;
+exports.readConfigLayers = readConfigLayers;

package/dist/constants/packages.d.ts

@@ -17,5 +17,8 @@ export declare function getLifecycleScriptNames(): string[];
 export declare function getPackageDefaultNodeRange(): string | undefined;
 export declare function getPackageDefaultSocketCategories(): readonly string[];
 export declare function getPackageExtensions(): Iterable<[string, unknown]>;
+export declare class BoundedPackumentCache extends Map<string, unknown> {
+    set(key: string, value: unknown): this;
+}
 export declare function getPackumentCache(): Map<string, unknown>;
 export declare function getPacoteCachePath(): string;

package/dist/constants/packages.js

@@ -2,9 +2,9 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_primordials_object = require('../primordials/object.js');
 const require_paths_normalize = require('../paths/normalize.js');
 const require_primordials_array = require('../primordials/array.js');
-const require_primordials_object = require('../primordials/object.js');
 const require_primordials_reflect = require('../primordials/reflect.js');
 const require_constants_lifecycle_script_names = require('./lifecycle-script-names.js');
 const require_constants_package_default_node_range = require('./package-default-node-range.js');
@@ -85,6 +85,7 @@ function getPacoteCachePath() {
 
 //#endregion
 exports.AT_LATEST = AT_LATEST;
+exports.BoundedPackumentCache = BoundedPackumentCache;
 exports.LATEST = LATEST;
 exports.PACKAGE = PACKAGE;
 exports.PACKAGE_DEFAULT_VERSION = PACKAGE_DEFAULT_VERSION;

package/dist/constants/socket.d.ts

@@ -21,12 +21,8 @@ export declare const SOCKET_GITHUB_ORG = "SocketDev";
 export declare const SOCKET_REGISTRY_REPO_NAME = "socket-registry";
 export declare const SOCKET_REGISTRY_PACKAGE_NAME = "@socketsecurity/registry";
 export declare const SOCKET_REGISTRY_NPM_ORG = "socketregistry";
-export declare const SOCKET_CLI_APP_NAME = "socket";
-export declare const SOCKET_DLX_APP_NAME = "dlx";
-export declare const SOCKET_FIREWALL_APP_NAME = "sfw";
-export declare const SOCKET_REGISTRY_APP_NAME = "registry";
-export declare const SOCKET_WHEELHOUSE_APP_NAME = "wheelhouse";
-export declare const SOCKET_APP_PREFIX = "_";
+export declare const SOCKET_DIR_PREFIX = "_";
+export declare const SOCKET_DIR: Readonly<Record<'cacache' | 'dlx' | 'state' | 'wheelhouse', string>>;
 export declare const SOCKET_LIB_NAME = "@socketsecurity/lib";
 export declare const SOCKET_LIB_VERSION: string;
 export declare const SOCKET_IPC_HANDSHAKE = "SOCKET_IPC_HANDSHAKE";

package/dist/constants/socket.js

@@ -26,14 +26,16 @@ const SOCKET_GITHUB_ORG = "SocketDev";
 const SOCKET_REGISTRY_REPO_NAME = "socket-registry";
 const SOCKET_REGISTRY_PACKAGE_NAME = "@socketsecurity/registry";
 const SOCKET_REGISTRY_NPM_ORG = "socketregistry";
-const SOCKET_CLI_APP_NAME = "socket";
-const SOCKET_DLX_APP_NAME = "dlx";
-const SOCKET_FIREWALL_APP_NAME = "sfw";
-const SOCKET_REGISTRY_APP_NAME = "registry";
-const SOCKET_WHEELHOUSE_APP_NAME = "wheelhouse";
-const SOCKET_APP_PREFIX = "_";
+const SOCKET_DIR_PREFIX = "_";
+const SOCKET_DIR = {
+	__proto__: null,
+	cacache: `${"_"}cacache`,
+	dlx: `${"_"}dlx`,
+	state: `${"_"}state`,
+	wheelhouse: `${"_"}wheelhouse`
+};
 const SOCKET_LIB_NAME = "@socketsecurity/lib";
-const SOCKET_LIB_VERSION = "6.0.7";
+const SOCKET_LIB_VERSION = "6.0.9";
 const SOCKET_IPC_HANDSHAKE = "SOCKET_IPC_HANDSHAKE";
 const CACHE_SOCKET_API_DIR = "socket-api";
 const REGISTRY = "registry";
@@ -45,14 +47,12 @@ exports.REGISTRY = REGISTRY;
 exports.REGISTRY_SCOPE_DELIMITER = REGISTRY_SCOPE_DELIMITER;
 exports.SOCKET_API_BASE_URL = SOCKET_API_BASE_URL;
 exports.SOCKET_API_TOKENS_URL = SOCKET_API_TOKENS_URL;
-exports.SOCKET_APP_PREFIX = SOCKET_APP_PREFIX;
-exports.SOCKET_CLI_APP_NAME = SOCKET_CLI_APP_NAME;
 exports.SOCKET_CONTACT_URL = SOCKET_CONTACT_URL;
 exports.SOCKET_DASHBOARD_URL = SOCKET_DASHBOARD_URL;
-exports.SOCKET_DLX_APP_NAME = SOCKET_DLX_APP_NAME;
+exports.SOCKET_DIR = SOCKET_DIR;
+exports.SOCKET_DIR_PREFIX = SOCKET_DIR_PREFIX;
 exports.SOCKET_DOCS_CONTACT_URL = SOCKET_DOCS_CONTACT_URL;
 exports.SOCKET_DOCS_URL = SOCKET_DOCS_URL;
-exports.SOCKET_FIREWALL_APP_NAME = SOCKET_FIREWALL_APP_NAME;
 exports.SOCKET_GITHUB_ORG = SOCKET_GITHUB_ORG;
 exports.SOCKET_IPC_HANDSHAKE = SOCKET_IPC_HANDSHAKE;
 exports.SOCKET_LIB_NAME = SOCKET_LIB_NAME;
@@ -61,12 +61,10 @@ exports.SOCKET_OVERRIDE_SCOPE = SOCKET_OVERRIDE_SCOPE;
 exports.SOCKET_PRICING_URL = SOCKET_PRICING_URL;
 exports.SOCKET_PUBLIC_API_KEY = SOCKET_PUBLIC_API_KEY;
 exports.SOCKET_PUBLIC_API_TOKEN = SOCKET_PUBLIC_API_TOKEN;
-exports.SOCKET_REGISTRY_APP_NAME = SOCKET_REGISTRY_APP_NAME;
 exports.SOCKET_REGISTRY_NPM_ORG = SOCKET_REGISTRY_NPM_ORG;
 exports.SOCKET_REGISTRY_PACKAGE_NAME = SOCKET_REGISTRY_PACKAGE_NAME;
 exports.SOCKET_REGISTRY_REPO_NAME = SOCKET_REGISTRY_REPO_NAME;
 exports.SOCKET_REGISTRY_SCOPE = SOCKET_REGISTRY_SCOPE;
 exports.SOCKET_SECURITY_SCOPE = SOCKET_SECURITY_SCOPE;
 exports.SOCKET_STATUS_URL = SOCKET_STATUS_URL;
-exports.SOCKET_WEBSITE_URL = SOCKET_WEBSITE_URL;
-exports.SOCKET_WHEELHOUSE_APP_NAME = SOCKET_WHEELHOUSE_APP_NAME;
+exports.SOCKET_WEBSITE_URL = SOCKET_WEBSITE_URL;

package/dist/cover/code.js

@@ -3,12 +3,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_error = require('../primordials/error.js');
+const require_primordials_object = require('../primordials/object.js');
+const require_objects_predicates = require('../objects/predicates.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
-const require_primordials_object = require('../primordials/object.js');
 const require_fs_read_json = require('../fs/read-json.js');
-const require_objects_predicates = require('../objects/predicates.js');
 const require_process_spawn_child = require('../process/spawn/child.js');
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);

package/dist/crypto/hash.d.ts

@@ -1,7 +1,10 @@
 /**
  * @file Crypto hash helpers that prefer Node builtins where available. Probes
  *   `node:crypto.hash()` (added v21.7.0 / v20.12.0) and falls back to the
- *   streaming `createHash().update().digest()` chain on older runtimes.
+ *   streaming `createHash().update().digest()` chain on older runtimes. Which
+ *   digest goes where (integrity = sha512 trust boundary; checksum = sha256
+ *   interop shape; cache keys = truncated, never trust): see
+ *   `docs/hash-algorithms.md`.
  */
 import type { hash as NodeHash } from 'node:crypto';
 /**

package/dist/crypto/hash.js

@@ -7,7 +7,10 @@ const require_node_crypto = require('../node/crypto.js');
 /**
 * @file Crypto hash helpers that prefer Node builtins where available. Probes
 *   `node:crypto.hash()` (added v21.7.0 / v20.12.0) and falls back to the
-*   streaming `createHash().update().digest()` chain on older runtimes.
+*   streaming `createHash().update().digest()` chain on older runtimes. Which
+*   digest goes where (integrity = sha512 trust boundary; checksum = sha256
+*   interop shape; cache keys = truncated, never trust): see
+*   `docs/hash-algorithms.md`.
 */
 let cachedNativeHash;
 let nativeHashProbed = false;

package/dist/dlx/arborist.js

@@ -3,11 +3,11 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_error = require('../primordials/error.js');
+const require_primordials_object = require('../primordials/object.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
 const require_primordials_json = require('../primordials/json.js');
-const require_primordials_object = require('../primordials/object.js');
 const require_paths_socket = require('../paths/socket.js');
 let src_external__npmcli_arborist = require("../external/@npmcli/arborist");
 src_external__npmcli_arborist = require_runtime.__toESM(src_external__npmcli_arborist);
@@ -37,6 +37,10 @@ src_external__npmcli_arborist = require_runtime.__toESM(src_external__npmcli_arb
 * false.
 */
 function getBaseArboristOptions(installPath, options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	return {
 		__proto__: null,
 		path: installPath,
@@ -97,7 +101,10 @@ function readTopLevelFromIdealTree(tree, targetName) {
 async function safeIdealTree(options) {
 	const fs = require_node_fs.getNodeFs();
 	const path = require_node_path.getNodePath();
-	const { before, path: installPath, quiet = true } = options;
+	const { before, path: installPath, quiet = true } = {
+		__proto__: null,
+		...options
+	};
 	const targetName = readSingleDependency(path.join(installPath, "package.json"));
 	const arb = new src_external__npmcli_arborist.default({
 		...getBaseArboristOptions(installPath, { quiet }),
@@ -125,7 +132,10 @@ async function safeIdealTree(options) {
 * This is the strongest form of pinning pnpm/npm offer.
 */
 async function safeReify(options) {
-	const { packageLock = true, path: installPath, quiet = true } = options;
+	const { packageLock = true, path: installPath, quiet = true } = {
+		__proto__: null,
+		...options
+	};
 	/* c8 ignore next - External Arborist call */
 	await new src_external__npmcli_arborist.default({
 		...getBaseArboristOptions(installPath, { quiet }),

package/dist/dlx/binary-cache.js

@@ -3,13 +3,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_objects_predicates = require('../objects/predicates.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
 const require_primordials_date = require('../primordials/date.js');
 const require_primordials_json = require('../primordials/json.js');
 const require_fs_read_json = require('../fs/read-json.js');
-const require_objects_predicates = require('../objects/predicates.js');
 const require_paths_socket = require('../paths/socket.js');
 const require_fs_safe = require('../fs/safe.js');
 const require_constants_time = require('../constants/time.js');

package/dist/dlx/binary-resolution.js

@@ -3,11 +3,11 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_error = require('../primordials/error.js');
+const require_primordials_object = require('../primordials/object.js');
 const require_constants_platform = require('../constants/platform.js');
 const require_paths_normalize = require('../paths/normalize.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
-const require_primordials_object = require('../primordials/object.js');
 const require_fs_read_json = require('../fs/read-json.js');
 const require_dlx__internal = require('./_internal.js');
 let src_external_libnpmexec = require("../external/libnpmexec");

package/dist/dlx/detect.d.ts

@@ -11,6 +11,14 @@
  *   - DLX cache: Check for node_modules/ directory
  *   - Local paths: Check for package.json with bin field, then file extension
  */
+export type PackageJsonPathEntry = {
+    path: string | undefined;
+    at: number;
+};
+export type PackageJsonCacheEntry = {
+    mtimeMs: number;
+    content: object | undefined;
+};
 export type ExecutableType = 'package' | 'binary' | 'unknown';
 export interface ExecutableDetectionResult {
     type: ExecutableType;

package/dist/dlx/firewall.d.ts

@@ -8,6 +8,14 @@
  *     other dlx flows without dragging in the install orchestrator.
  */
 import type Arborist from '../external/@npmcli/arborist';
+export interface FirewallAlert {
+    severity?: string | undefined;
+    type?: string | undefined;
+    key?: string | undefined;
+}
+export interface FirewallResponse {
+    alerts?: FirewallAlert[] | undefined;
+}
 /**
  * Check all resolved packages in an Arborist ideal tree against the Socket
  * Firewall API (public, no auth required). Throws if any dependency has

package/dist/dlx/lockfile.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
-const require_integrity = require('../integrity.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_integrity = require('../integrity.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
 const require_primordials_date = require('../primordials/date.js');
@@ -66,7 +66,10 @@ var DlxLockfileError = class extends Error {
 async function resolveNpmPackagePin(options) {
 	const fs = require_node_fs.getNodeFs();
 	const path = require_node_path.getNodePath();
-	const { minReleaseDays, minReleaseMins, spec } = options;
+	const { minReleaseDays, minReleaseMins, spec } = {
+		__proto__: null,
+		...options
+	};
 	if (typeof spec !== "string" || spec.length === 0) throw new DlxLockfileError("resolveNpmPackagePin requires a package spec");
 	if (minReleaseDays !== void 0 && minReleaseMins !== void 0) throw new DlxLockfileError("resolveNpmPackagePin: minReleaseDays and minReleaseMins are mutually exclusive");
 	const effectiveDays = minReleaseDays !== void 0 ? minReleaseDays : minReleaseMins !== void 0 ? void 0 : 7;

package/dist/dlx/manifest.js

@@ -1,11 +1,11 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_object = require('../primordials/object.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
 const require_primordials_date = require('../primordials/date.js');
 const require_primordials_json = require('../primordials/json.js');
-const require_primordials_object = require('../primordials/object.js');
 const require_errors_message = require('../errors/message.js');
 const require_logger_default = require('../logger/default.js');
 const require_paths_socket = require('../paths/socket.js');

package/dist/dlx/package.js

@@ -79,6 +79,10 @@ const rangeOperatorsRegExp = /[~^><=xX* ]|\|\|/;
 *   ```
 */
 async function dlxPackage(args, options, spawnExtra) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const downloadResult = await downloadNpmPackage(options);
 	const spawnPromise = executePackage(downloadResult.binaryPath, args, options.spawnOptions, spawnExtra);
 	return {

package/dist/eco/cargo/parse-lockfile.d.ts

@@ -40,7 +40,7 @@
  *     test/fixtures/sdxgen-bug-regressions/ cargo-patch-unused-no-leak/.
  */
 import type { PackageRef, ParsedLockfile } from '../manifest/types';
-type PackageIndex = Record<string, number | number[]>;
+export type PackageIndex = Record<string, number | number[]>;
 export interface CargoEntryState {
     name: string;
     version: string;
@@ -81,4 +81,3 @@ export declare function stripTomlString(value: string): string;
  */
 export declare function valueAfterEquals(line: string): string;
 export declare const parseCargoLock: (content: string) => ParsedLockfile;
-export {};

package/dist/eco/cargo/parse-lockfile.js

@@ -1,9 +1,9 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_object = require('../../primordials/object.js');
 const require_primordials_string = require('../../primordials/string.js');
 const require_primordials_array = require('../../primordials/array.js');
-const require_primordials_object = require('../../primordials/object.js');
 
 //#region src/eco/cargo/parse-lockfile.ts
 /**
@@ -100,7 +100,7 @@ function jsParseCargoLock(content) {
 		const trimmed = require_primordials_string.StringPrototypeTrim(line);
 		if (trimmed.length === 0 || trimmed[0] === "#") continue;
 		if (trimmed[0] === "[") {
-			if (currentEntry && currentEntry.name) {
+			if (currentEntry?.name) {
 				require_primordials_array.ArrayPrototypePush(packages, freezeCargoEntry(currentEntry));
 				addToCargoIndex(packageIndex, currentEntry.name, packages.length - 1);
 			}
@@ -131,7 +131,7 @@ function jsParseCargoLock(content) {
 			}
 		} else if (require_primordials_string.StringPrototypeIndexOf(trimmed, "version") === 0) lockVersion = stripTomlString(valueAfterEquals(trimmed));
 	}
-	if (currentEntry && currentEntry.name) {
+	if (currentEntry?.name) {
 		require_primordials_array.ArrayPrototypePush(packages, freezeCargoEntry(currentEntry));
 		addToCargoIndex(packageIndex, currentEntry.name, packages.length - 1);
 	}