api.md

API Reference

Every subpath exported by @socketsecurity/lib, grouped by namespace. Each entry links to the exported source module. Where the module has an @file description, it appears in the table. Open the linked module for exported symbols, signatures, behavior, and type definitions.

Common tasks

• Start with installation and import examples. The package exposes each utility through a subpath import.
• Make HTTP requests and downloads, including JSON parsing, retries, redirects, and progress callbacks.
• Read and write files safely, with path, glob, and deletion helpers.
• Spawn and manage processes, including platform-aware commands and locks.
• Read environment and platform state, including CI and Node.js environment values.
• Combine utilities in complete examples, such as downloads with progress and cleanup.

Regenerate with pnpm run docs after adding or removing exports. Do not edit this file by hand.

Jump to: Top-level · ai/ · archives/ · arrays/ · attestations/ · cacache/ · cache/ · cli/ · compression/ · config/ · constants/ · cover/ · crypto/ · debug/ · dlx/ · eco/ · env/ · errors/ · events/ · exe/ · external-tools/ · fs/ · git/ · github/ · globs/ · hooks/ · http-request/ · ipc/ · json/ · links/ · logger/ · memo/ · native-messaging/ · node/ · objects/ · oci/ · packages/ · paths/ · perf/ · polyfills/ · power/ · primordials/ · process/ · promises/ · regexps/ · releases/ · schema/ · secrets/ · shell/ · sorts/ · spinner/ · state/ · stdio/ · streams/ · strings/ · temporal/ · term/ · url/ · versions/ · words/ · yaml/

Top-level

Subpath	Description
@socketsecurity/lib/http-request	Node-side HTTP request layer - the public surface (httpJson, httpText, httpRequest, HttpResponseError) for consumers on Node.
@socketsecurity/lib/logger	Node-side Logger class - owns per-instance state (parent, bound stream, indent buffers, theme) and exposes the public surface as thin delegators over sibling free-function leaves.
@socketsecurity/lib/power	Open the module for exported symbols and declarations.

ai/

All 31 ai/ subpaths, alphabetical and linked to source: agent, advisor, assist, backends, billing-context, builtin, cli-flags, cost, credentials, discover, enforce, exec, and 17 more

Subpath	Description
@socketsecurity/lib/ai/advisor	Spawn advisor - composes tier + route + billing + profile into ONE call so callers stop hand-wiring the AI stack layer by layer.
@socketsecurity/lib/ai/agent/context	The running-agent context contract: the shape detectAgent() returns, and the mapping from the cross-agent AI_AGENT env value to an agent family.
@socketsecurity/lib/ai/agent/detect	Which AI agent is invoking this process, read from the environment the running agent injects.
@socketsecurity/lib/ai/agent/paths	Where an agent keeps its config and memory on the current platform.
@socketsecurity/lib/ai/assist	Opt-in "AI assist when stuck" helper - a thin, dependency-light layer over the ai-agent runner (pickAgent + spawnAiAgent).
@socketsecurity/lib/ai/backends	Multi-agent CLI backend registry + role routing.
@socketsecurity/lib/ai/billing-context	Build a BillingContext for the route-heuristic WITHOUT privileged lookups.
@socketsecurity/lib/ai/builtin	Lazy cross-runtime resolver for the built-in LanguageModel factory.
@socketsecurity/lib/ai/cli-flags	Agent-CLI flag compatibility: recognize a flag the installed CLI does not know, and strip it so the spawn can be retried without it.
@socketsecurity/lib/ai/cost	Pure parsers for per-agent token/cost usage embedded in a spawn's output.
@socketsecurity/lib/ai/credentials	Layered provider-credential resolver for AI backends.
@socketsecurity/lib/ai/discover	Detect which AI agent CLIs are installed on PATH.
@socketsecurity/lib/ai/enforce	Runtime enforcers that keep a spawn honest against the advice advisor.mts produced.
@socketsecurity/lib/ai/exec	Exec-backend injection point: WHERE a shell command runs, a separate axis from WHICH model produced it (ai/backends).
@socketsecurity/lib/ai/failures	Classify an agent CLI's failure output into the three conditions that call for different recovery: the model is unavailable, so fall over to another agent; the service is overloaded, so retry the same agent after back...
@socketsecurity/lib/ai/http	OpenAI-compatible HTTP backends for AI providers that expose a chat-completions endpoint rather than a CLI - Fireworks (api.fireworks.ai) and Synthetic (api.synthetic.new).
@socketsecurity/lib/ai/json	Zero-dependency JSON hardening for noisy model text.
@socketsecurity/lib/ai/majority	Best-of-N self-consistency for decision tasks.
@socketsecurity/lib/ai/profiles	Pre-built lockdown profiles for spawnAiAgent.
@socketsecurity/lib/ai/reliability	Generate-and-verify reliability loop for code-generation tasks.
@socketsecurity/lib/ai/role	Declarative ROLE → tier + profile orchestration for AI call-outs.
@socketsecurity/lib/ai/route	Availability-gated tier routing.
@socketsecurity/lib/ai/route-heuristic	Billing-aware routing heuristic - a PURE policy layer over route.mts.
@socketsecurity/lib/ai/routing	Task-to-backend routing.
@socketsecurity/lib/ai/simulator	Node/browser-agnostic simulator of the stable LanguageModel Prompt API.
@socketsecurity/lib/ai/spawn	Locked-down spawn for AI agent CLIs (Claude / Codex / Gemini / OpenCode).
@socketsecurity/lib/ai/spawn-local	Keyless on-device execution path for a local TierCandidate, the non-CLI complement to spawn.mts.
@socketsecurity/lib/ai/subagent-status	The terminal-status contract a delegated subagent returns to its orchestrator.
@socketsecurity/lib/ai/tier	Canonical model + reasoning-effort ladder for AI orchestrators.
@socketsecurity/lib/ai/types	Shared types for the locked-down AI agent surface.
@socketsecurity/lib/ai/worktree	Run AI agents in parallel, each in its own git worktree, and merge results back to the base branch.

archives/

Subpath	Description
@socketsecurity/lib/archives/detect	Format detection by file extension.
@socketsecurity/lib/archives/extract	extractArchive - format-detecting dispatcher that routes to extractTar / extractTarGz / extractZip.
@socketsecurity/lib/archives/tar	Tar / tar.gz extraction with security limits and symlink rejection.
@socketsecurity/lib/archives/types	Public type surface for archives/* modules - the ArchiveFormat union, the ExtractOptions security-limit record, and the three default limits that record documents.
@socketsecurity/lib/archives/zip	Bounded ZIP extraction with path and symlink containment.

arrays/

Subpath	Description
@socketsecurity/lib/arrays/chunk	Split an array into fixed-size chunks.
@socketsecurity/lib/arrays/join	Grammatical list joiners via Intl.ListFormat - Oxford-comma aware and locale-correct.
@socketsecurity/lib/arrays/predicates	Array type-guard predicates.
@socketsecurity/lib/arrays/unique	Deduplicate an array via Set.

attestations/

Subpath	Description
@socketsecurity/lib/attestations/types	Open the module for exported symbols and declarations.
@socketsecurity/lib/attestations/verify	Open the module for exported symbols and declarations.

cacache/

Subpath	Description
@socketsecurity/lib/cacache/clear	Bulk-clear entries from the Socket shared cacache - clear() plus its wildcard helper createPatternMatcher.
@socketsecurity/lib/cacache/read	Cache read entrypoints: get throws on miss and safeGet returns undefined on miss.
@socketsecurity/lib/cacache/tmp	withTmp - run a callback with a freshly-created temp directory under the cacache root.
@socketsecurity/lib/cacache/types	Public type surface for cacache/* modules - the CacheEntry row shape returned by reads and the option bags consumed by clear / get / put.
@socketsecurity/lib/cacache/write	Cache write entrypoints - put inserts or replaces by key and remove deletes a single key.

cache/

Subpath	Description
@socketsecurity/lib/cache/ttl/browser	createBrowserTtlCache - browser-safe sibling of createTtlCache (./store).
@socketsecurity/lib/cache/ttl/store	createTtlCache - generic TTL-based cache built on top of cacache (persistent) plus an in-memory LRU memo layer.
@socketsecurity/lib/cache/ttl/types	Public type surface for cache/ttl/* modules - the seven-method TtlCache interface returned by createTtlCache and createBrowserTtlCache, plus the TtlCacheEntry storage shape, the TtlCacheStorage adapter con...

cli/

Subpath	Description
@socketsecurity/lib/cli/check	socket-lib check <name> subcommand group.
@socketsecurity/lib/cli/check-primordials	socket-lib check primordials handler.
@socketsecurity/lib/cli/is-main-module	Entrypoint detection for CLI scripts.
@socketsecurity/lib/cli/main	Fail-soft entrypoint runner for CLI scripts.
@socketsecurity/lib/cli/socket-lib	socket-lib CLI entry point - top-level dispatcher.

compression/

Subpath	Description
@socketsecurity/lib/compression/brotli	Brotli compression / decompression - in-memory, file-to-file, and raw-stream variants.
@socketsecurity/lib/compression/gzip	Gzip compression / decompression - same calling shapes as brotli: in-memory, file-to-file, and raw-stream variants.
@socketsecurity/lib/compression/types	Public type surface for compression/* modules - the CompressOptions accepted by every compression entrypoint and CompressFileOptions which extends it with inPlace.

config/

Subpath	Description
@socketsecurity/lib/config/layers	Read a layered config - a base config that higher layers may override or extend.
@socketsecurity/lib/config/repo	Fleet-convention config reader: a per-repo override (.config/repo) layered over the cascaded fleet default (.config/fleet).

constants/

Subpath	Description
@socketsecurity/lib/constants/encoding	Character encoding and character code constants.
@socketsecurity/lib/constants/github	GitHub API and cache constants.
@socketsecurity/lib/constants/licenses	License identifier constants.
@socketsecurity/lib/constants/maintained-node-versions	Maintained Node.js versions without external dependencies.
@socketsecurity/lib/constants/node	Node.js runtime version and capability helpers.
@socketsecurity/lib/constants/package-default-socket-categories	Default Socket security categories for packages.
@socketsecurity/lib/constants/packages	Package metadata, defaults, extensions, and lifecycle helpers.
@socketsecurity/lib/constants/platform	Platform detection and OS-specific constants.
@socketsecurity/lib/constants/runtime	Runtime environment detection constants.
@socketsecurity/lib/constants/sentinels	Core primitives and fundamental constants.
@socketsecurity/lib/constants/socket	Socket.dev branding and identifier constants.
@socketsecurity/lib/constants/testing	Testing framework and CI-related string constants.
@socketsecurity/lib/constants/time	Time-related numeric constants.
@socketsecurity/lib/constants/typescript	TypeScript availability detection.
@socketsecurity/lib/constants/units	Self-describing multipliers for durations and byte sizes.

cover/

Subpath	Description
@socketsecurity/lib/cover/code	Code coverage utilities for parsing v8 coverage data.
@socketsecurity/lib/cover/formatters	Coverage output formatters.
@socketsecurity/lib/cover/type	TypeScript type coverage utilities.
@socketsecurity/lib/cover/types	Type definitions for coverage utilities.

crypto/

Subpath	Description
@socketsecurity/lib/crypto/hash	Crypto hash helpers that prefer Node builtins where available.
@socketsecurity/lib/crypto/integrity	Integrity + checksum helpers.

debug/

Subpath	Description
@socketsecurity/lib/debug/caller-info	getCallerInfo - extract the caller's function name from the V8 stack trace at a given offset.
@socketsecurity/lib/debug/namespace	Namespace-handling helpers - extractOptions normalises the polymorphic first argument that every *Ns function takes, getDebugJsInstance per-namespace caches the underlying debug-js instance with customLog pa...
@socketsecurity/lib/debug/output	Output entrypoints - debug / debugCache / debugDir / debugLog and their *Ns namespace variants, plus debuglog (node-util-compatible) and debugtime (start/end timers).
@socketsecurity/lib/debug/types	Public type surface for debug/* modules - the options bag accepted by every debug*Ns entrypoint and the InspectOptions mirror of node:util's shape (the public subset we accept; not the full thing).

dlx/

Subpath	Description
@socketsecurity/lib/dlx/arborist	Safe Arborist wrapper for dlx installs and lockfile-only resolution.
@socketsecurity/lib/dlx/binary	DLX binary execution utilities for Socket ecosystem.
@socketsecurity/lib/dlx/binary-cache	On-disk cache metadata helpers for dlx binaries.
@socketsecurity/lib/dlx/binary-download	Download helpers for dlx binaries - fetch tarballs from URLs, verify integrity, cache to disk with concurrency locking.
@socketsecurity/lib/dlx/binary-resolution	Binary resolution for installed dlx packages.
@socketsecurity/lib/dlx/binary-types	Public option / result interfaces for dlx binary operations.
@socketsecurity/lib/dlx/cache	Cache key generation utilities for DLX package installations.
@socketsecurity/lib/dlx/detect	Executable type detection for DLX and local filesystem paths.
@socketsecurity/lib/dlx/dir	Directory management utilities for DLX installations.
@socketsecurity/lib/dlx/firewall	Socket Firewall integration for dlx installs.
@socketsecurity/lib/dlx/lockfile	Package pin generation for dlx installs.
@socketsecurity/lib/dlx/manifest	DLX manifest storage utilities.
@socketsecurity/lib/dlx/package	DLX package execution - install and execute npm packages.
@socketsecurity/lib/dlx/packages	Package management utilities for DLX installations.
@socketsecurity/lib/dlx/paths	Path utilities for DLX package installations.
@socketsecurity/lib/dlx/spec	Parse package@version specs into {name, version}.
@socketsecurity/lib/dlx/types	Public option / result interfaces for dlx package operations.

eco/

All 73 eco/ subpaths, alphabetical and linked to source: cargo, manifest, npm, purl, types

Subpath	Description
@socketsecurity/lib/eco/cargo/lockfile-format	Format descriptor for Cargo.lock - Rust's Cargo-managed lockfile.
@socketsecurity/lib/eco/cargo/manifest-format	Format descriptor for Cargo.toml - Rust's package manifest.
@socketsecurity/lib/eco/cargo/parse-lockfile	parseCargoLock(content) - parses a Rust Cargo.lock (v1/v2/v3/v4) into a ParsedLockfile.
@socketsecurity/lib/eco/manifest/analyze-lockfile	analyzeLockfile(lockfile) - returns a LockfileStats summary (counts by dep type, total packages, per-ecosystem breakdown).
@socketsecurity/lib/eco/manifest/detect-format	detectFormat(filename) - maps a filename or path to its FormatDescriptor (ecosystem + manifest/lockfile + lockfile format), or returns undefined if nothing matched.
@socketsecurity/lib/eco/manifest/find-packages	findPackages(lockfile, pattern) - returns all PackageRefs whose name matches the regex/string pattern.
@socketsecurity/lib/eco/manifest/get-package	getPackage(lockfile, name) - O(1) lookup of the first matching PackageRef by name in a ParsedLockfile.
@socketsecurity/lib/eco/manifest/get-package-versions	getPackageVersions(lockfile, name) - returns all PackageRefs that match the given name in a ParsedLockfile.
@socketsecurity/lib/eco/manifest/manifest-error	ManifestError - the error class every parser in src/eco/<pm>/parse-* and every dispatcher in src/eco/manifest/* throws on invalid / unsupported input.
@socketsecurity/lib/eco/manifest/parse	parse(filename, content) - auto-detects format from filename then dispatches to parseManifest or parseLockfile.
@socketsecurity/lib/eco/manifest/parse-lockfile	parseLockfile(content, ecosystem, format?) - dispatches to the right per-PM lockfile parser.
@socketsecurity/lib/eco/manifest/parse-manifest	parseManifest(content, ecosystem) - dispatches to the right per-ecosystem manifest parser.
@socketsecurity/lib/eco/manifest/types	Shared types for manifest + lockfile parsing.
@socketsecurity/lib/eco/npm/bun/exec	Bun tool surface.
@socketsecurity/lib/eco/npm/bun/lockfile/parse	jsParseBunLock(content) - parse the text bun.lock (bun v1.2+).
@socketsecurity/lib/eco/npm/constants/lifecycle-script-names	NPM lifecycle script names.
@socketsecurity/lib/eco/npm/constants/package-default-node-range	Default Node.js version range for packages.
@socketsecurity/lib/eco/npm/constants/package-managers	Package manager constants.
@socketsecurity/lib/eco/npm/manifest-format	Format descriptor for package.json - the manifest shape shared across the entire npm-family ecosystem: npm, pnpm, yarn, bun, and vlt.
@socketsecurity/lib/eco/npm/meta	Node twin of the cached, batch-capable npm registry metadata client - the Socket-wide replacement for ad-hoc packument fetchers.
@socketsecurity/lib/eco/npm/meta-cache	Node twin of the cached packument fetch - binds the platform-free policy core (./shared) to the two capabilities it refuses to import for itself: httpJson from ../../http-request/node and the cacache-backed `cre...
@socketsecurity/lib/eco/npm/meta-cache/browser	Browser twin of the cached packument fetch - same policy core (./shared), same exports as ./node, bound instead to httpJson from ../../http-request/browser (a fetch wrapper) and to createBrowserTtlCache (`...
@socketsecurity/lib/eco/npm/meta-cache/node	Node twin of the cached packument fetch - binds the platform-free policy core (./shared) to the two capabilities it refuses to import for itself: httpJson from ../../http-request/node and the cacache-backed `cre...
@socketsecurity/lib/eco/npm/meta-slice	Pure slicing of a raw npm packument into the client's slim shapes - no network, no cache.
@socketsecurity/lib/eco/npm/meta/browser	Browser twin of the cached, batch-capable npm registry metadata client.
@socketsecurity/lib/eco/npm/meta/node	Node twin of the cached, batch-capable npm registry metadata client - the Socket-wide replacement for ad-hoc packument fetchers.
@socketsecurity/lib/eco/npm/meta/types	Type surface for the npm metadata client (./meta, ./meta-cache, ./meta-slice) - the raw packument shapes accepted from the registry, the slimmed shapes the client returns, and the options/result records for the ...
@socketsecurity/lib/eco/npm/npm-cli/exec	Execute npm commands with optimized flags and security defaults.
@socketsecurity/lib/eco/npm/npm-cli/extract-package-name-from-path	extractPackageNameFromPath(pkgPath) - given an npm v2/v3 lockfile entry key like node_modules/a/node_modules/b, returns the final package name (b), preserving scoped-package boundaries (@scope/name stays joined).
@socketsecurity/lib/eco/npm/npm-cli/flags	Npm CLI flag predicates.
@socketsecurity/lib/eco/npm/npm-cli/lockfile/format	Format descriptor for npm lockfiles - covers both package-lock.json and npm-shrinkwrap.json (npm v1/v2/v3 lock formats share the parser).
@socketsecurity/lib/eco/npm/npm-cli/lockfile/parse	parsePackageLock(content) - parses an npm package-lock.json / npm-shrinkwrap.json (v1/v2/v3) into a ParsedLockfile.
@socketsecurity/lib/eco/npm/npm-cli/parse-git-url	parseGitUrl(resolved) - extracts { url, commit } from a resolved field on an npm lockfile entry when it points to a git source (git+… or git://…).
@socketsecurity/lib/eco/npm/package-extensions/data	Per-package package.json overrides, keyed by package name and version range.
@socketsecurity/lib/eco/npm/package-extensions/types	Public type surface for eco/npm/package-extensions/* modules - the PackageExtension tuple shape used by the merged Yarn / Socket-curated extensions list.
@socketsecurity/lib/eco/npm/parse-git-dep	parseGitDep(spec) - recognize a git dependency in any npm-ecosystem spelling: npm, yarn classic, yarn berry, bun, vlt (strings) and pnpm (a { type: 'git', repo, commit } resolution object).
@socketsecurity/lib/eco/npm/parse-package-json	parsePackageJson(content) - parses a package.json string into a ParsedManifest.
@socketsecurity/lib/eco/npm/pnpm/exec	Execute pnpm commands with optimized flags and security defaults.
@socketsecurity/lib/eco/npm/pnpm/flags	Pnpm CLI flag predicates.
@socketsecurity/lib/eco/npm/pnpm/lockfile/detect-version	detectPnpmVersion(content) - scans a pnpm-lock.yaml for its lockfileVersion: line and returns 5, 6, or 9.
@socketsecurity/lib/eco/npm/pnpm/lockfile/format	Format descriptor for pnpm-lock.yaml - pnpm's YAML-formatted lockfile (v5/v6/v9).
@socketsecurity/lib/eco/npm/pnpm/lockfile/package-id-v5	parsePnpmPackageIdV5(pkgId) - extracts { name, version } from a pnpm v5 package key.
@socketsecurity/lib/eco/npm/pnpm/lockfile/package-id-v6-v9	parsePnpmPackageIdV6V9(pkgId) - extracts { name, version } from a pnpm v6/v9 package key.
@socketsecurity/lib/eco/npm/pnpm/lockfile/parse	parsePnpmLock(content) - parses a pnpm-lock.yaml (v5, v6, or v9) into a ParsedLockfile.
@socketsecurity/lib/eco/npm/registry	Browser-safe npm registry client - pure parsers + injectable-fetch shell.
@socketsecurity/lib/eco/npm/registry/access	The npm registry Access endpoints: who can reach a package, at what level, and whether it is public at all.
@socketsecurity/lib/eco/npm/registry/audit	The npm registry bulk audit endpoint: advisories for a set of packages and versions in one round trip.
@socketsecurity/lib/eco/npm/registry/auth	The 2FA/OTP extension point for the authenticated npm registry API.
@socketsecurity/lib/eco/npm/registry/cache	TTL caching for the npm registry API reads, mirroring the approach in socket-sdk-js src/socket-sdk-class.mts: a TtlCache whose getOrFetch both caches and deduplicates concurrent callers, plus a per-endpoint-clas...
@socketsecurity/lib/eco/npm/registry/client	Shared request primitives for the authenticated npm registry API.
@socketsecurity/lib/eco/npm/registry/live	Live (CDN-cache-defeating) npm registry reads - the cache-busted packument fetch, the checked latest-version read, and the maintainer-list read.
@socketsecurity/lib/eco/npm/registry/oidc	The npm registry OIDC token exchange: trade a CI provider's id_token for a short-lived, package-scoped npm registry token.
@socketsecurity/lib/eco/npm/registry/org	The npm registry Org endpoints: who belongs to an org, at what role, and which teams exist inside it.
@socketsecurity/lib/eco/npm/registry/publish	The npm registry publish endpoint: PUT /{escapedPackageName} with a packument-shaped payload.
@socketsecurity/lib/eco/npm/registry/search	The npm registry search endpoint.
@socketsecurity/lib/eco/npm/registry/stage	Npm staging and package-version lifecycle reads.
@socketsecurity/lib/eco/npm/registry/stage-actions	The npm registry staging MUTATIONS: put a version into staging, throw it away, or approve it into a real publish.
@socketsecurity/lib/eco/npm/registry/stage-tarball	The staged-tarball read: GET /-/stage/{stage-id}/tarball.
@socketsecurity/lib/eco/npm/registry/tarball	Turning npm tarball BYTES back into files, on Node.
@socketsecurity/lib/eco/npm/registry/tarball/browser	Browser-safe npm tarball reading.
@socketsecurity/lib/eco/npm/registry/tarball/node	Turning npm tarball BYTES back into files, on Node.
@socketsecurity/lib/eco/npm/registry/team	The npm registry Team endpoints: creating and deleting teams inside an org, and moving users in and out of them.
@socketsecurity/lib/eco/npm/registry/tokens	The npm registry Tokens endpoints: create, list, and delete npm access tokens.
@socketsecurity/lib/eco/npm/registry/trust	The npm registry Trust endpoints: the trusted publisher configurations that let a CI provider publish a package through OIDC instead of a long-lived token.
@socketsecurity/lib/eco/npm/script	Cross-tool script runner - picks the right package manager by detecting the nearest lockfile and dispatches to its exec function.
@socketsecurity/lib/eco/npm/vlt/exec	Vlt tool surface.
@socketsecurity/lib/eco/npm/vlt/lockfile/parse	jsParseVltLock(content) - parse vlt-lock.json.
@socketsecurity/lib/eco/npm/yarn/exec	Execute Yarn Classic (v1.x) commands with optimized flags and security defaults.
@socketsecurity/lib/eco/npm/yarn/lockfile/descriptor	parseYarnDescriptor(descriptor) - extracts the package name from a yarn lockfile spec key.
@socketsecurity/lib/eco/npm/yarn/lockfile/format	Format descriptor for yarn.lock - yarn's lockfile (Classic v1 + Berry v6 share the filename; the parser auto-discriminates on __metadata: presence).
@socketsecurity/lib/eco/npm/yarn/lockfile/parse	parseYarnLock(content) - parses a yarn.lock (Classic v1 or Berry v6) into a ParsedLockfile.
@socketsecurity/lib/eco/purl	PURL (Package URL) ecosystem identifiers shared across every package manager Socket understands.
@socketsecurity/lib/eco/types	Socket Registry ecosystem schema types - tags for packages and the manifest entries the registry build pipeline emits.

env/

All 33 env/ subpaths, alphabetical and linked to source: agents, boolean, case-insensitive, ci, debug, flags, github, github-status, home, locale, node-auth-token, node-env, and 21 more

Subpath	Description
@socketsecurity/lib/env/agents	AI coding-agent detection.
@socketsecurity/lib/env/boolean	envAsBoolean - coerce an env-var-shaped value into a boolean via an options bag (defaultValue, trim).
@socketsecurity/lib/env/case-insensitive	Case-insensitive environment-variable key lookup - findCaseInsensitiveEnvKey walks Object.keys(env) with an O(1) length-prefilter before the (expensive) toUpperCase comparison.
@socketsecurity/lib/env/ci	CI environment predicate.
@socketsecurity/lib/env/debug	DEBUG environment variable getter.
@socketsecurity/lib/env/flags	Environment flag booleans, re-exported from std-env - not reimplemented.
@socketsecurity/lib/env/github	GitHub Actions environment variable getters.
@socketsecurity/lib/env/github-status	Probe githubstatus.com to detect platform degradation before making GitHub API calls.
@socketsecurity/lib/env/home	HOME environment variable getter with Windows fallback.
@socketsecurity/lib/env/locale	Locale and language environment variable getters.
@socketsecurity/lib/env/node-auth-token	NODE_AUTH_TOKEN environment variable getter.
@socketsecurity/lib/env/node-env	NODE_ENV environment variable getter.
@socketsecurity/lib/env/node-version-managers	Detect which Node version manager is active on this machine and emit a targeted upgrade hint.
@socketsecurity/lib/env/npm	NPM environment variable getters.
@socketsecurity/lib/env/number	envAsNumber - coerce an env-var-shaped value into a number.
@socketsecurity/lib/env/package-manager	Package manager environment detection.
@socketsecurity/lib/env/path	PATH environment variable helpers.
@socketsecurity/lib/env/pre-commit	PRE_COMMIT environment variable getter.
@socketsecurity/lib/env/providers	CI/host provider detection, re-exported from std-env - not reimplemented.
@socketsecurity/lib/env/proxy	createEnvProxy - wrap process.env, or any env-like record, in a Proxy that adds case-insensitive lookups for known-Windows-sensitive keys (PATH, APPDATA, etc.) and an overrides layer.
@socketsecurity/lib/env/rewire	Environment variable rewiring utilities for testing.
@socketsecurity/lib/env/runtimes	JS runtime detection, re-exported from std-env - not reimplemented.
@socketsecurity/lib/env/shell	SHELL environment variable getter.
@socketsecurity/lib/env/socket	Socket Security environment variable getters.
@socketsecurity/lib/env/socket-cli	Socket CLI environment variables.
@socketsecurity/lib/env/socket-mcp	Socket MCP HTTP server environment variable getters.
@socketsecurity/lib/env/string	envAsString - coerce an env-var-shaped value into a string via an options bag (defaultValue, trim).
@socketsecurity/lib/env/temp-dir	Temporary directory environment variable getters.
@socketsecurity/lib/env/term	TERM environment variable getter.
@socketsecurity/lib/env/test	Test environment variable getters and detection.
@socketsecurity/lib/env/types	Public type surface for the cross-cutting env/* leaves - option bags consumed by envAsBoolean / envAsNumber / envAsString.
@socketsecurity/lib/env/windows	Windows environment variable getters.
@socketsecurity/lib/env/xdg	XDG Base Directory Specification environment variable getters.

errors/

Subpath	Description
@socketsecurity/lib/errors/message	Human-readable error-message extractor.
@socketsecurity/lib/errors/predicates	Error type-guard predicates - isError (with the isErrorBuiltin / isErrorShim building blocks) and the libuv errno-code narrower isErrnoException.
@socketsecurity/lib/errors/stack	Stack-trace extractor with cause-chain support.

events/

Subpath	Description
@socketsecurity/lib/events/exit/handler	onExit - register a callback for process exit / signal.
@socketsecurity/lib/events/exit/intercept	Process-method interceptors - processEmit replaces process.emit and processReallyExit replaces process.reallyExit while load() is active.
@socketsecurity/lib/events/exit/lifecycle	load and unload - install and remove the signal-exit listeners.
@socketsecurity/lib/events/exit/signals	signals() - list the signals this process is watching.
@socketsecurity/lib/events/exit/types	Public type surface for events/exit/* modules - the OnExitOptions consumed by onExit, plus the shared internal types for the signal emitter, emitted-signal map, and listener map.
@socketsecurity/lib/events/warning/handler	Bump the max-listener cap on an EventTarget (or AbortSignal).
@socketsecurity/lib/events/warning/suppress	process.emitWarning suppression.

exe/

Subpath	Description
@socketsecurity/lib/exe/argv/flag-predicates	Flag predicates - is* checks across parsed FlagValues, raw process.argv, or no input.
@socketsecurity/lib/exe/argv/flag-types	Types + COMMON_FLAGS table for argv flag parsing.
@socketsecurity/lib/exe/argv/meta	The CLI self-description contract: every Socket product CLI answers --describe with a one-line purpose and --describe --json with a machine-readable manifest of its commands and flags, before any side effect.
@socketsecurity/lib/exe/argv/parse	Argument parsing utilities for CLI applications.
@socketsecurity/lib/exe/argv/parse-args-string	Tokenize a shell-style command string into an argv array.
@socketsecurity/lib/exe/exec	execBin - spawn a binary with PATH resolution, wrapper-script unwrapping, and Windows shell handling.
@socketsecurity/lib/exe/path/bin-kinds	Which wrapper format a binary's shim uses, and the extension/name predicates the resolvers share.
@socketsecurity/lib/exe/path/find	Find specific package-manager binaries with platform- aware fallbacks.
@socketsecurity/lib/exe/path/resolve	Resolve a binary path to the underlying script file.
@socketsecurity/lib/exe/path/resolve-shims	Wrapper-script parsers: given a shim's source text, extract the relative path to the real script it executes.
@socketsecurity/lib/exe/path/resolve-volta	Volta-managed binary resolution.
@socketsecurity/lib/exe/path/sanitize	Sanitize the executable search path, then resolve against it.
@socketsecurity/lib/exe/path/which	Look up binaries on PATH.
@socketsecurity/lib/exe/sea/detect	Single Executable Application binary detection + path accessor.
@socketsecurity/lib/exe/shadow/detect	Shadow-bin detection.
@socketsecurity/lib/exe/shadow/skip	Shadow binary installation utilities for Socket ecosystem.
@socketsecurity/lib/exe/shadow/types	Public type surface for exe/shadow/* modules - the ShadowInstallationOptions record.
@socketsecurity/lib/exe/smol/detect	Smol detection + lazy-loader for node:smol-util.
@socketsecurity/lib/exe/smol/http	Lazy-loader for socket-btm's node:smol-http.
@socketsecurity/lib/exe/smol/https	Lazy-loader for socket-btm's node:smol-https.
@socketsecurity/lib/exe/smol/manifest	Lazy-loader for socket-btm's node:smol-manifest.
@socketsecurity/lib/exe/smol/path	Lazy-loader for socket-btm's node:smol-path - native fast paths for the hot path-string primitives (dirname, normalize, …) and, per the socket-btm node-smol-path Phase 4 plan, batched filesystem ops (access,...
@socketsecurity/lib/exe/smol/primordial	Lazy-loader for socket-btm's node:smol-primordial binding.
@socketsecurity/lib/exe/smol/purl	Lazy-loader for socket-btm's node:smol-purl binding.
@socketsecurity/lib/exe/smol/versions	Lazy-loader for socket-btm's node:smol-versions.
@socketsecurity/lib/exe/smol/vfs	Lazy-loader for socket-btm's node:smol-vfs.
@socketsecurity/lib/exe/types	Public type surface for exe/* modules - the WhichOptions interface that callers pass to which, whichSync, whichReal, and whichRealSync, plus the whichLocalBin variant.

external-tools/

All 86 external-tools/ subpaths, alphabetical and linked to source: bazel, cdxgen, janus, jre, opengrep, python, sbt, skillspector, socket-keychain, synp, trivy, trufflehog, and 4 more

Subpath	Description
@socketsecurity/lib/external-tools/bazel/asset-names	Upstream Bazel release asset-name mapping per platform-arch.
@socketsecurity/lib/external-tools/bazel/from-download	bazelFromDownload() - fetches the upstream Bazel binary and returns a ResolvedBazel pointing at the cached executable.
@socketsecurity/lib/external-tools/bazel/from-path	bazelFromPath() - looks for bazelisk first, then bazel, on the system PATH.
@socketsecurity/lib/external-tools/bazel/read-bazel-version-file	readBazelVersionFile(workspaceDir) - walks up from workspaceDir looking for a .bazelversion file, the Bazel/Bazelisk convention for pinning the project's Bazel version.
@socketsecurity/lib/external-tools/bazel/resolve	resolveBazel() - Bazel resolution entry point.
@socketsecurity/lib/external-tools/bazel/resolve-asset-url	resolveBazelAssetUrl(version, platformArch) - builds the upstream GitHub Releases download URL for a Bazel binary.
@socketsecurity/lib/external-tools/bazel/resolve-bazel-version	resolveBazelVersion({ cwd }) - picks the Bazel version to run for a project, matching the bazelisk precedence: 1.
@socketsecurity/lib/external-tools/bazel/types	Shared types for Bazel resolution.
@socketsecurity/lib/external-tools/cdxgen/asset-names	Upstream cdxgen release asset-name mapping per platform-arch.
@socketsecurity/lib/external-tools/cdxgen/from-download	cdxgenFromDownload() - fetches the upstream cdxgen SEA binary (slim by default) and returns a ResolvedCdxgen pointing at the cached executable.
@socketsecurity/lib/external-tools/cdxgen/from-path	cdxgenFromPath() - looks for cdxgen on the system PATH.
@socketsecurity/lib/external-tools/cdxgen/from-vfs	cdxgenFromVfs() - extracts cdxgen from the smol binary's VFS.
@socketsecurity/lib/external-tools/cdxgen/resolve	resolveCdxgen() - cdxgen resolution entry point.
@socketsecurity/lib/external-tools/cdxgen/types	Shared types for cdxgen resolution.
@socketsecurity/lib/external-tools/from-download	Generic "download tier" for external-tools resolvers.
@socketsecurity/lib/external-tools/from-pip-venv	Generic "venv-install tier" for external-tools resolvers.
@socketsecurity/lib/external-tools/janus/asset-names	Upstream janus release asset-name mapping per platform-arch.
@socketsecurity/lib/external-tools/janus/from-download	janusFromDownload() - fetches upstream janus and returns a ResolvedJanus pointing at the extracted binary.
@socketsecurity/lib/external-tools/janus/from-path	janusFromPath() - looks for janus on the system PATH.
@socketsecurity/lib/external-tools/janus/from-vfs	janusFromVfs() - extracts the janus binary from the smol binary's VFS.
@socketsecurity/lib/external-tools/janus/resolve	resolveJanus() - janus resolution entry point.
@socketsecurity/lib/external-tools/janus/types	Shared types for janus resolution.
@socketsecurity/lib/external-tools/jre/asset-names	Adoptium API platform-arch → asset-query mappings.
@socketsecurity/lib/external-tools/jre/detect-platform-arch	getJreArch() - resolves the current machine to a platform-arch string suitable for the Adoptium ADOPTIUM_QUERY_MAP keys (e.g.
@socketsecurity/lib/external-tools/jre/from-download	jreFromDownload() - fetches Adoptium JRE and returns a ResolvedJre pointing at the extracted java binary.
@socketsecurity/lib/external-tools/jre/from-java-home	jreFromJavaHome() - checks $JAVA_HOME for an existing JRE/JDK.
@socketsecurity/lib/external-tools/jre/from-path	jreFromPath() - looks for java (or java.exe) on the system PATH via socket-lib's which.
@socketsecurity/lib/external-tools/jre/from-vfs	jreFromVfs() - extracts the JRE directory tree from the smol binary's VFS and returns the resolved-shape pointing into the extracted directory.
@socketsecurity/lib/external-tools/jre/resolve	resolveJre() - the JRE resolution entry point.
@socketsecurity/lib/external-tools/jre/types	Shared types for JRE resolution.
@socketsecurity/lib/external-tools/manifest	Reader for external-tools.json - the Socket manifest describing downloadable external binaries (sfw, zizmor, etc.) with pinned versions, per-platform asset names, and integrity hashes.
@socketsecurity/lib/external-tools/opengrep/asset-names	Upstream OpenGrep release asset-name mapping per platform-arch.
@socketsecurity/lib/external-tools/opengrep/from-download	opengrepFromDownload() - fetches upstream OpenGrep and returns a ResolvedOpengrep pointing at the cached binary.
@socketsecurity/lib/external-tools/opengrep/from-path	opengrepFromPath() - looks for opengrep on the system PATH.
@socketsecurity/lib/external-tools/opengrep/from-vfs	opengrepFromVfs() - extracts the OpenGrep binary from the smol binary's VFS.
@socketsecurity/lib/external-tools/opengrep/resolve	resolveOpengrep() - OpenGrep resolution entry point.
@socketsecurity/lib/external-tools/opengrep/types	Shared types for OpenGrep resolution.
@socketsecurity/lib/external-tools/python/asset-names	Python-build-standalone release asset mapping.
@socketsecurity/lib/external-tools/python/dlx	One-call dlx convenience wrappers for python: resolve or download a CPython into the known dlx location, then run a pip primitive against it - so callers don't thread pythonBin by hand.
@socketsecurity/lib/external-tools/python/from-download	pythonFromDownload() - fetches a python-build-standalone CPython into the DLX cache and returns a ResolvedPython pointing at the interpreter.
@socketsecurity/lib/external-tools/python/from-path	pythonFromPath() - looks for a CPython interpreter on the system PATH.
@socketsecurity/lib/external-tools/python/pin	resolvePipPackagePin() - the Python mirror of resolveNpmPackagePin() (dlx/lockfile).
@socketsecurity/lib/external-tools/python/pip-install	downloadPipPackage() - the Python mirror of dlx/package.ts's downloadNpmPackage().
@socketsecurity/lib/external-tools/python/resolve	resolvePython() - CPython resolution entry point.
@socketsecurity/lib/external-tools/python/types	Types for the python-build-standalone DLX resolver.
@socketsecurity/lib/external-tools/python/uv-install	Uv project install helpers - the locked-source-of-truth half of the "uv project + dlx materialize" model.
@socketsecurity/lib/external-tools/sbt/asset-names	SBT distribution download-URL builder.
@socketsecurity/lib/external-tools/sbt/from-download	sbtFromDownload() - fetches the SBT launcher tarball, extracts it, and returns a ResolvedSbt pointing at the bin/sbt script.
@socketsecurity/lib/external-tools/sbt/from-path	sbtFromPath() - looks for the sbt shell script on the system PATH.
@socketsecurity/lib/external-tools/sbt/from-vfs	sbtFromVfs() - extracts the SBT launcher jar from the smol binary's VFS.
@socketsecurity/lib/external-tools/sbt/resolve	resolveSbt() - SBT resolution entry point.
@socketsecurity/lib/external-tools/sbt/types	Shared types for SBT resolution.
@socketsecurity/lib/external-tools/skillspector/from-dlx	skillspectorFromDlx() - DLX-venv tier of SkillSpector resolution.
@socketsecurity/lib/external-tools/skillspector/from-path	skillspectorFromPath() - which skillspector lookup.
@socketsecurity/lib/external-tools/skillspector/from-uv	skillspectorFromUv() - locked-uv-project tier of SkillSpector resolution.
@socketsecurity/lib/external-tools/skillspector/from-vfs	skillspectorFromVfs() - extracts SkillSpector from the smol Node VFS if it's bundled.
@socketsecurity/lib/external-tools/skillspector/resolve	resolveSkillSpector() - SkillSpector resolution entry point.
@socketsecurity/lib/external-tools/skillspector/types	Shared types for SkillSpector resolution.
@socketsecurity/lib/external-tools/socket-keychain/asset-names	GitHub Release names for the standalone socket-keychain executable.
@socketsecurity/lib/external-tools/socket-keychain/from-download	Download one exact socket-keychain release asset, verify its pinned integrity, and copy it into the shared Wheelhouse rack.
@socketsecurity/lib/external-tools/socket-keychain/resolve	Security-sensitive resolver for socket-keychain.
@socketsecurity/lib/external-tools/socket-keychain/types	Result type for a checksum-pinned socket-keychain installation.
@socketsecurity/lib/external-tools/synp/asset-names	Upstream synp package coordinates.
@socketsecurity/lib/external-tools/synp/from-download	synpFromDownload() - installs the pinned synp npm package via dlx/package and returns a ResolvedSynp pointing at the resolved bin shim.
@socketsecurity/lib/external-tools/synp/from-path	synpFromPath() - looks for synp on the system PATH.
@socketsecurity/lib/external-tools/synp/from-vfs	synpFromVfs() - extracts synp from the smol binary's VFS.
@socketsecurity/lib/external-tools/synp/resolve	resolveSynp() - synp resolution entry point.
@socketsecurity/lib/external-tools/synp/types	Shared types for synp resolution.
@socketsecurity/lib/external-tools/trivy/asset-names	Upstream Trivy release asset-name mapping per platform-arch.
@socketsecurity/lib/external-tools/trivy/from-download	trivyFromDownload() - fetches upstream Trivy and returns a ResolvedTrivy pointing at the extracted binary.
@socketsecurity/lib/external-tools/trivy/from-path	trivyFromPath() - looks for trivy on the system PATH.
@socketsecurity/lib/external-tools/trivy/from-vfs	trivyFromVfs() - extracts the Trivy binary from the smol binary's VFS.
@socketsecurity/lib/external-tools/trivy/resolve	resolveTrivy() - Trivy resolution entry point.
@socketsecurity/lib/external-tools/trivy/types	Shared types for Trivy resolution.
@socketsecurity/lib/external-tools/trufflehog/asset-names	Upstream TruffleHog release asset-name mapping per platform-arch.
@socketsecurity/lib/external-tools/trufflehog/from-download	trufflehogFromDownload() - fetches upstream TruffleHog and returns a ResolvedTrufflehog pointing at the extracted binary.
@socketsecurity/lib/external-tools/trufflehog/from-path	trufflehogFromPath() - looks for trufflehog on the system PATH via socket-lib's which.
@socketsecurity/lib/external-tools/trufflehog/from-vfs	trufflehogFromVfs() - extracts the TruffleHog binary from the smol binary's VFS.
@socketsecurity/lib/external-tools/trufflehog/resolve	resolveTrufflehog() - TruffleHog resolution entry point.
@socketsecurity/lib/external-tools/trufflehog/types	Shared types for TruffleHog resolution.
@socketsecurity/lib/external-tools/uv/asset-names	Upstream uv release asset-name mapping per platform-arch.
@socketsecurity/lib/external-tools/uv/from-download	uvFromDownload() - fetches upstream uv and returns a ResolvedUv pointing at the extracted binary.
@socketsecurity/lib/external-tools/uv/from-path	uvFromPath() - looks for uv on the system PATH.
@socketsecurity/lib/external-tools/uv/from-vfs	uvFromVfs() - extracts the uv binary from the smol binary's VFS.
@socketsecurity/lib/external-tools/uv/resolve	resolveUv() - uv resolution entry point.
@socketsecurity/lib/external-tools/uv/types	Shared types for uv resolution.

fs/

Subpath	Description
@socketsecurity/lib/fs/access	Synchronous file-access predicates - boolean "can this process do X to this path?" checks over fs.accessSync.
@socketsecurity/lib/fs/allowed-dirs-cache	Cache-invalidation entry point for the allowed-directories list used by safeDelete / safeDeleteSync.
@socketsecurity/lib/fs/atomic	Single-file writes a concurrent reader can never catch half-finished.
@socketsecurity/lib/fs/copy	Recursive copy for a file or directory tree, with three destination modes (see {@link CopyMode}).
@socketsecurity/lib/fs/encoding	Encoding-name normalization.
@socketsecurity/lib/fs/find	Walk parent directories to locate a file or directory by name.
@socketsecurity/lib/fs/force	THE escape hatch.
@socketsecurity/lib/fs/inspect	Filesystem inspection helpers - stat / lstat wrappers that return undefined instead of throwing, and the directory / symlink / emptiness predicates layered on top.
@socketsecurity/lib/fs/read-dir	Async/sync directory listing - returns directory names only (filtering out files), with optional emptiness suppression and natural-order sorting.
@socketsecurity/lib/fs/read-file	File-content readers - UTF-8 / binary / safe variants (sync + async).
@socketsecurity/lib/fs/read-json	Read-and-parse helpers for JSON files.
@socketsecurity/lib/fs/read-json-cache	Process-scoped LRU cache for readJson / readJsonSync results, keyed by absolute path + stat (ino + size + mtimeMs).
@socketsecurity/lib/fs/resolve-module	require.resolve-from-an-arbitrary-base.
@socketsecurity/lib/fs/safe	Safe deletion + idempotent directory creation.
@socketsecurity/lib/fs/scratch	One scratch-directory fixture, with a delete that refuses any target outside the OS temp dir.
@socketsecurity/lib/fs/strict	The strictest of the three deletes.
@socketsecurity/lib/fs/types	Public type surface for fs/* modules - option shapes, encoding union, and result records.
@socketsecurity/lib/fs/unique	Generate a unique filepath by appending -1, -2, … before the extension until the path is free.
@socketsecurity/lib/fs/validate	Pre-flight readability check for file lists.
@socketsecurity/lib/fs/write-json	JSON writers that match the wire-format conventions a tool ecosystem expects: configurable indentation, configurable EOL, trailing newline by default.

git/

Subpath	Description
@socketsecurity/lib/git/changed	"Anything different from HEAD" helpers - the broad-strokes git status --porcelain view that lumps staged, unstaged, and untracked paths together.
@socketsecurity/lib/git/exec	Centralized git command runner.
@socketsecurity/lib/git/ignored	getTrackedIgnoredFiles - the paths git TRACKS that the repo's own .gitignore also IGNORES.
@socketsecurity/lib/git/isolated-index	Isolated git index helper.
@socketsecurity/lib/git/remote	Parse a git remote URL into owner/repo, and read a checkout's origin.
@socketsecurity/lib/git/repo	Git repository discovery + foundational lazy fs/path/cwd helpers shared across git/* leaves.
@socketsecurity/lib/git/staged	"Ready for the next commit" helpers - git diff --cached over only the index.
@socketsecurity/lib/git/status	Pure parser for git status --porcelain output.
@socketsecurity/lib/git/tracked	Tracked-status + submodule-membership probes for a working-tree path.
@socketsecurity/lib/git/tree	getTreeManifest - the git ls-tree -r <ref> manifest of a commit.
@socketsecurity/lib/git/types	Public type surface for git/* modules - the FilterPackagesByChangesOptions and GitDiffOptions configuration records.
@socketsecurity/lib/git/unstaged	"Edited but not yet staged" helpers - git diff over the working tree only.
@socketsecurity/lib/git/worktree	Worktree enumeration over git worktree list --porcelain -z.

github/

Subpath	Description
@socketsecurity/lib/github/cli	The gh CLI runner, and gh api on top of it.
@socketsecurity/lib/github/commit	Create a SIGNED commit on a branch via the GitHub git-objects API (blob -> tree -> commit -> ref PATCH).
@socketsecurity/lib/github/constants	GitHub API URL + cache-TTL constants.
@socketsecurity/lib/github/error-classification	Classify a GitHub API error response from its status, headers, and body.
@socketsecurity/lib/github/errors	Named errors thrown by github/* helpers.
@socketsecurity/lib/github/ghsa	GitHub Security Advisory (GHSA) lookups.
@socketsecurity/lib/github/packages	Build GitHub Packages REST paths for container packages.
@socketsecurity/lib/github/pull/merge	GitHub pull request merge-async REST helpers.
@socketsecurity/lib/github/pull/reviews	Update a SUBMITTED pull request review's body via GraphQL.
@socketsecurity/lib/github/rate-limit	GitHub rate-limit budget tracking, preflight, and reset-aware waiting.
@socketsecurity/lib/github/rate-limit-wait	Reset-aware waiting for a throttled GitHub request.
@socketsecurity/lib/github/refs	Resolve GitHub git refs (tag / branch / commit) to full commit SHAs.
@socketsecurity/lib/github/refs-cache	TtlCache singleton for github/refs.
@socketsecurity/lib/github/refs-graphql	Resolve a GitHub git ref via GraphQL.
@socketsecurity/lib/github/refs-rest	Resolve a GitHub git ref via REST tier-cascade.
@socketsecurity/lib/github/refs-write	GitHub git-refs REST write helpers - create, fast-forward, and delete a branch ref, plus tag creation.
@socketsecurity/lib/github/request	Authenticated GitHub REST fetch.
@socketsecurity/lib/github/token	GitHub token resolution.
@socketsecurity/lib/github/types	Public type surface for github/* modules - pure interfaces.
@socketsecurity/lib/github/workflow-runs	Look up a GitHub Actions workflow run for a commit and classify its verdict - the "is CI green on this SHA?" primitive behind gated releases (bump/tag/publish only after the pre-release commit's CI passes).

globs/

Subpath	Description
@socketsecurity/lib/globs/defaults	The npm-packlist-derived defaultIgnore list.
@socketsecurity/lib/globs/match	glob (async) and globSync - fast-glob wrappers with a node:fs.glob fast-path when the option surface lines up.
@socketsecurity/lib/globs/matcher	getGlobMatcher - picomatch-backed sync predicate with an LRU-memoized matcher cache.
@socketsecurity/lib/globs/stream	globStreamLicenses - license-file discovery as an async stream.
@socketsecurity/lib/globs/types	Public type surface for globs/* modules - the Pattern alias, the FastGlobOptions mirror of fast-glob's option surface, and the GlobOptions extension that adds Socket-specific recursive / ignoreOriginals fl...

hooks/

Subpath	Description
@socketsecurity/lib/hooks/dispatch-failure	The failure policy a machine-global agent hook dispatcher applies when a hook's own runtime cannot load, as distinct from a hook that loaded and returned a verdict.

http-request/

Subpath	Description
@socketsecurity/lib/http-request/browser	Browser-safe HTTP request layer - mirrors the public surface of @socketsecurity/lib/http-request (httpJson, httpText, httpRequest, HttpResponseError) but uses the browser's fetch API instead of Node's `nod...
@socketsecurity/lib/http-request/checksum-file	Checksum file fetching + parsing for download verification.
@socketsecurity/lib/http-request/download	Streaming file downloads with retries, progress callbacks, and SHA-256 verification.
@socketsecurity/lib/http-request/download-types	Types for HTTP download + checksum-fetch operations.
@socketsecurity/lib/http-request/errors	Error-message enrichment for HTTP/HTTPS requests.
@socketsecurity/lib/http-request/fetch/browser	Thin wrapper over the global fetch() so tests can mock the network layer via vi.mock('@socketsecurity/lib/http-request/fetch/browser') without monkey-patching globalThis.fetch (which conflicts with the project's...
@socketsecurity/lib/http-request/headers	Header utilities for HTTP/HTTPS requests.
@socketsecurity/lib/http-request/http-request	Node-side HTTP request layer - the public surface (httpJson, httpText, httpRequest, HttpResponseError) for consumers on Node.
@socketsecurity/lib/http-request/node	Node-side HTTP request layer - the public surface (httpJson, httpText, httpRequest, HttpResponseError) for consumers on Node.
@socketsecurity/lib/http-request/request	Core HTTP/HTTPS request loop - the retry orchestrator.
@socketsecurity/lib/http-request/request-attempt	Single HTTP request attempt - the workhorse beneath the retrying httpRequest orchestrator.
@socketsecurity/lib/http-request/request-types	Types for HTTP request configuration - options, hooks, and Node IncomingMessage aliases.
@socketsecurity/lib/http-request/response-reader	Read a raw Node IncomingMessage into our HttpResponse shape.
@socketsecurity/lib/http-request/response-types	Types for HTTP response surface - HttpResponse with its fetch-like body accessors, and HttpResponseError for throwOnError.
@socketsecurity/lib/http-request/user-agent	User-Agent header generation for socket-lib's outbound HTTP requests.

ipc/

Subpath	Description
@socketsecurity/lib/ipc/cli/get	Socket CLI child-process IPC object getter.
@socketsecurity/lib/ipc/cli/types	Public type surface for ipc/cli/* modules - the IpcObject record describing the SOCKET_CLI_* env-var shape forwarded from a parent Socket CLI to a child process.
@socketsecurity/lib/ipc/directory	Stub-directory creation + permission audit.
@socketsecurity/lib/ipc/paths	IPC stub path resolution.
@socketsecurity/lib/ipc/types	Public type surface for ipc/* modules - the IpcStub shape that backs the file-based handoff.
@socketsecurity/lib/ipc/write	Atomic stub write - O_CREAT|O_WRONLY|O_EXCL| O_NOFOLLOW so we refuse to overwrite a pre-existing stub (collision with attacker-planted file or PID reuse) and refuse to follow symlinks at the final path component.

json/

Subpath	Description
@socketsecurity/lib/json/edit	Editable JSON file manipulation with formatting preservation.
@socketsecurity/lib/json/format	Shared utilities for JSON formatting preservation and manipulation.
@socketsecurity/lib/json/parse	JSON parsing utilities with Buffer detection and BOM stripping.
@socketsecurity/lib/json/types	JSON type definitions and interfaces.

links/

Subpath	Description
@socketsecurity/lib/links/create	Themed hyperlink utilities for terminal output.
@socketsecurity/lib/links/github	Markdown GitHub reference links.
@socketsecurity/lib/links/types	Public type surface for links/* modules - the LinkOptions record.

logger/

Subpath	Description
@socketsecurity/lib/logger/browser	Browser-safe Logger implementation - mirrors the public success / fail / warn / error / info / log surface of the Node Logger (see ./node) but backed by the global console so it works in Chrome MV3...
@socketsecurity/lib/logger/colors	Color application helpers for logger/* modules.
@socketsecurity/lib/logger/console	Lazy Console construction + dynamic prototype mirroring for Logger.
@socketsecurity/lib/logger/console-methods	Free-function bodies for the Logger methods that are thin, chainable mirrors of the underlying node:console API (assert, count, dir, dirxml, table, time, timeEnd, timeLog, trace).
@socketsecurity/lib/logger/default	Shared-default Logger singleton.
@socketsecurity/lib/logger/indentation-methods	Free-function bodies for the Logger indentation-domain methods (indent, dedent, resetIndent, group, groupCollapsed, groupEnd).
@socketsecurity/lib/logger/logger	Node-side Logger class - owns per-instance state (parent, bound stream, indent buffers, theme) and exposes the public surface as thin delegators over sibling free-function leaves.
@socketsecurity/lib/logger/node	Node-side Logger class - owns per-instance state (parent, bound stream, indent buffers, theme) and exposes the public surface as thin delegators over sibling free-function leaves.
@socketsecurity/lib/logger/options	Constructor-options parsing for the Logger class.
@socketsecurity/lib/logger/semantic-methods	Free-function bodies for the symbol-prefixed semantic Logger methods (done, fail, info, skip, step, success, warn).
@socketsecurity/lib/logger/stream	Terminal stream resolution + line-clearing helpers shared by the Node-side Logger methods that write directly to a stream (clearLine, clearVisible, progress).
@socketsecurity/lib/logger/stream-methods	Free-function bodies for the Logger methods that write to or clear a raw stream rather than going through the indented #apply path (clearLine, clearVisible, progress, write).
@socketsecurity/lib/logger/symbols	Symbol exports + the LOG_SYMBOLS proxy.
@socketsecurity/lib/logger/symbols-builder	Free-function helpers for per-instance log-symbol construction + symbol stripping.
@socketsecurity/lib/logger/types	Public type surface for logger/* modules - the LogSymbols shape, the LoggerMethods mapped type that mirrors console, and the Task interface returned by Logger.createTask.

memo/

Subpath	Description
@socketsecurity/lib/memo/async	memoizeAsync - async-aware memoizer with the same LRU+TTL contract as memoize, plus thundering-herd dedup.
@socketsecurity/lib/memo/clear	clearAllMemoizationCaches - fan out to every per-cache clear function registered in shared.cacheRegistry.
@socketsecurity/lib/memo/decorator	Memoize - class-method decorator that wraps the decorated method via memoize.
@socketsecurity/lib/memo/memoize	memoize - synchronous function memoizer with LRU eviction (Map insertion-order based), optional TTL, and optional custom key generator.
@socketsecurity/lib/memo/once	once - zero-argument memoizer.
@socketsecurity/lib/memo/types	Public type surface for memo/* modules - MemoizeOptions is the user-facing options bag accepted by every memoize entrypoint, CacheEntry<T> is the internal row stored in each per-function cache.
@socketsecurity/lib/memo/weak	memoizeWeak - memoizer keyed by an object reference via WeakMap.
@socketsecurity/lib/memo/weak-async	memoizeWeakAsync - async memoizer keyed by an object reference via WeakMap.

native-messaging/

Subpath	Description
@socketsecurity/lib/native-messaging/host	Chrome native messaging host entry point.
@socketsecurity/lib/native-messaging/install	Install the Socket native messaging host manifest so Chrome can find and launch the host when the extension calls connectNative().
@socketsecurity/lib/native-messaging/rate-limit	Token-bucket rate limit for the Chrome native-messaging host.
@socketsecurity/lib/native-messaging/run	Native messaging host entry point.

node/

Subpath	Description
@socketsecurity/lib/node/async-hooks	Lazy-loader for node:async_hooks.
@socketsecurity/lib/node/child-process	Lazy-loader for node:child_process.
@socketsecurity/lib/node/crypto	Lazy-loader for node:crypto.
@socketsecurity/lib/node/events	Lazy-loader for node:events.
@socketsecurity/lib/node/fs	Early-snapshot accessor for node:fs.
@socketsecurity/lib/node/fs/promises	Lazy-loader for node:fs/promises.
@socketsecurity/lib/node/http	Lazy-loader for node:http.
@socketsecurity/lib/node/https	Lazy-loader for node:https.
@socketsecurity/lib/node/module	Accessors for node:module that work across runtimes.
@socketsecurity/lib/node/os	Early-snapshot accessor for node:os.
@socketsecurity/lib/node/path	Early-snapshot accessor for node:path.
@socketsecurity/lib/node/process	Early-snapshot accessor for node:process.
@socketsecurity/lib/node/timers/promises	Lazy-loader for node:timers/promises.
@socketsecurity/lib/node/url	Lazy-loader for node:url.
@socketsecurity/lib/node/util	Lazy-loader for node:util.

objects/

Subpath	Description
@socketsecurity/lib/objects/getters	Lazy-getter primitives + createConstantsObject.
@socketsecurity/lib/objects/inspect	Object inspection helpers - getKeys, getOwn, getOwnPropertyValues.
@socketsecurity/lib/objects/mutate	Object mutation helpers: a deep recursive merge, plus objectAssign and objectFreeze aliasing their natives.
@socketsecurity/lib/objects/options	Open the module for exported symbols and declarations.
@socketsecurity/lib/objects/predicates	Object type guards: hasKeys, hasOwn, isObject, isPlainObject.
@socketsecurity/lib/objects/sort	Sorted-object helpers: entryKeyComparator, objectEntries, toSortedObject, toSortedObjectFromEntries.
@socketsecurity/lib/objects/types	Public type surface for objects/* modules - getter definition shapes and the Remap type helper.

oci/

Subpath	Description
@socketsecurity/lib/oci/blob	Fetch a blob, either a layer or the config, by digest.
@socketsecurity/lib/oci/manifest	Fetch and parse an OCI/Docker image manifest.
@socketsecurity/lib/oci/registry	The tie-together layer for an anonymous OCI pull: token → manifest → blob, in the order the distribution spec requires.
@socketsecurity/lib/oci/registry-token	Anonymous bearer-token acquisition for an OCI distribution-spec pull.
@socketsecurity/lib/oci/types	Shared types for the browser-safe OCI distribution-spec pull client.

packages/

Subpath	Description
@socketsecurity/lib/packages/advisory	Pure helpers over the standard OSV advisory schema.
@socketsecurity/lib/packages/edit	Editable package.json manipulation utilities.
@socketsecurity/lib/packages/edit-class	The EditablePackageJson class factory.
@socketsecurity/lib/packages/exports	Package exports field utilities.
@socketsecurity/lib/packages/fetch	Network-facing package helpers: the lazily-initialized make-fetch-happen fetcher with its shared cache, and GitHub tarball-URL resolution for a package spec.
@socketsecurity/lib/packages/find	Find the nearest package.json, or other marker, walking up from an import.meta - the package-domain wrapper over the generic findUpSync lookup in fs/find.
@socketsecurity/lib/packages/isolation	Package isolation utilities for testing.
@socketsecurity/lib/packages/licenses	SPDX license parsing and analysis utilities.
@socketsecurity/lib/packages/lockfile-redundancy	Deterministic lockfile redundancy detection.
@socketsecurity/lib/packages/manifest	Package manifest and packument fetching utilities.
@socketsecurity/lib/packages/metadata-extensions	Package-extension lookup: match a package name + version against the packageExtensions overrides table and merge the matching entries.
@socketsecurity/lib/packages/normalize	Package.json normalization utilities.
@socketsecurity/lib/packages/provenance	Package provenance and attestation verification utilities.
@socketsecurity/lib/packages/read	Read + parse a package.json.
@socketsecurity/lib/packages/sbom-anomalies	Deterministic SBOM anomaly detection.
@socketsecurity/lib/packages/specs	Package spec parsing, name resolution, and GitHub URL utilities.
@socketsecurity/lib/packages/tarball	Package tarball operations: extract a package to a directory and pack a spec into a tarball, both via pacote/libnpmpack with the shared packument cache.
@socketsecurity/lib/packages/types	Public type surface for packages/* modules - the PackageJson shape (npm-extended with a socket field) plus option bags consumed across edit / manifest / normalize / operations / provenance / licenses.
@socketsecurity/lib/packages/validation	Package name validation utilities.

paths/

Subpath	Description
@socketsecurity/lib/paths/conversion	Path conversion utilities - MSYS↔native bridging and string-shape helpers.
@socketsecurity/lib/paths/dirnames	Directory name and path pattern constants.
@socketsecurity/lib/paths/exts	File extension constants.
@socketsecurity/lib/paths/filenames	File name constants.
@socketsecurity/lib/paths/globs	Glob pattern constants.
@socketsecurity/lib/paths/normalize	The public paths/normalize surface.
@socketsecurity/lib/paths/packages	Package.json path resolution utilities.
@socketsecurity/lib/paths/predicates	Path predicates - is* checks for path shape and kind.
@socketsecurity/lib/paths/resolve	Path resolution utilities - resolve, relative, relativeResolve.
@socketsecurity/lib/paths/rewire	Path rewiring utilities for testing.
@socketsecurity/lib/paths/socket	Path utilities for Socket ecosystem directories.
@socketsecurity/lib/paths/walk	Walk parent directories.

perf/

Subpath	Description
@socketsecurity/lib/perf/enabled	Feature-flag check - isPerfEnabled() returns true when DEBUG=perf is set in the environment.
@socketsecurity/lib/perf/metrics	Read-side helpers - getPerformanceMetrics returns a shallow copy of the recorded rows, getPerformanceSummary rolls them up per operation (count / total / avg / min / max), and clearPerformanceMetrics empties the...
@socketsecurity/lib/perf/report	Report-side helpers - generatePerformanceReport returns a multi-line ASCII-bordered report string; printPerformanceSummary writes a one-line-per-op summary through debugLog.
@socketsecurity/lib/perf/timer	Recording-side helpers.
@socketsecurity/lib/perf/types	Public type surface for perf/* modules - the PerformanceMetrics row shape pushed onto the shared metrics array by perfTimer / measure / measureSync / perfCheckpoint / trackMemory.

polyfills/

Subpath	Description
@socketsecurity/lib/polyfills/array	Shims for the ES2023 change-array-by-copy methods, both Node 20.
@socketsecurity/lib/polyfills/group-by	Shims for Object.groupBy and Map.groupBy, both Node 21.
@socketsecurity/lib/polyfills/iterator	The iterator helpers in this package's three-export shape.
@socketsecurity/lib/polyfills/iterator/eager	The six iterator helpers that consume the iterator and return a value.
@socketsecurity/lib/polyfills/iterator/lazy	The five iterator helpers that return another iterator.
@socketsecurity/lib/polyfills/iterator/statics	Iterator.from (Node 22) and Iterator.concat (Node 26).
@socketsecurity/lib/polyfills/promise	Shims for the Promise statics newer than Node >= 18.
@socketsecurity/lib/polyfills/set	Shims for the seven ES2025 Set methods, all Node 22.

power/

Subpath	Description
@socketsecurity/lib/power/browser	Open the module for exported symbols and declarations.
@socketsecurity/lib/power/node	Open the module for exported symbols and declarations.
@socketsecurity/lib/power/probe	Host power-source detection with bounded native and operating-system probes.
@socketsecurity/lib/power/util	Open the module for exported symbols and declarations.

primordials/

Subpath	Description
@socketsecurity/lib/primordials/array	Safe references to Array, typed-array, ArrayBuffer, DataView, Atomics, and shared iterator-prototype primordials.
@socketsecurity/lib/primordials/buffer	Safe references to Node's Buffer global.
@socketsecurity/lib/primordials/checks/primordials	Primordials drift check - generic core.
@socketsecurity/lib/primordials/checks/primordials-defaults	GENERATED - do not edit by hand.
@socketsecurity/lib/primordials/date	Safe references to Date.
@socketsecurity/lib/primordials/error	Safe references to Error and its subclass constructors, plus V8's stack-trace API.
@socketsecurity/lib/primordials/function	Safe references to Function.prototype methods.
@socketsecurity/lib/primordials/globals	Safe references to top-level globals that don't fit a larger primordials leaf - primitive constructors (Boolean, BigInt), Proxy, SharedArrayBuffer, language-level constants (Infinity, NaN, globalThis), a...
@socketsecurity/lib/primordials/headers	Safe references to the Fetch Headers constructor and its Headers.prototype methods.
@socketsecurity/lib/primordials/intl	Safe references to Intl constructors.
@socketsecurity/lib/primordials/json	Safe references to JSON.parse / JSON.stringify.
@socketsecurity/lib/primordials/map-set	Safe references to Map, Set, WeakMap, WeakSet, and WeakRef.
@socketsecurity/lib/primordials/math	Safe references to Math constants and methods.
@socketsecurity/lib/primordials/number	Safe references to Number, its constants, predicates, and parse helpers.
@socketsecurity/lib/primordials/object	Safe references to Object static methods and prototype methods.
@socketsecurity/lib/primordials/process	Safe call-through accessors for the process global's methods and value reads.
@socketsecurity/lib/primordials/promise	Safe references to Promise static methods, prototype methods, and the ES2024 withResolvers factory.
@socketsecurity/lib/primordials/reflect	Safe references to Reflect.*.
@socketsecurity/lib/primordials/regexp	Safe references to RegExp and its prototype methods.
@socketsecurity/lib/primordials/string	Safe references to String static methods and prototype methods.
@socketsecurity/lib/primordials/symbol	Safe references to Symbol, well-known symbols, and Symbol.prototype.
@socketsecurity/lib/primordials/uncurry	uncurryThis and the cluster of helpers built atop it.
@socketsecurity/lib/primordials/url	Safe references to URL, URLSearchParams, and the URLSearchParams.prototype methods.

process/

Subpath	Description
@socketsecurity/lib/process/abort	Process control helpers.
@socketsecurity/lib/process/lock-instance	Singleton processLock instance - the canonical cross-cutting lock manager.
@socketsecurity/lib/process/lock-manager	ProcessLockManager - the class that owns active locks, touch timers, and the exit-handler registration.
@socketsecurity/lib/process/lock-types	Public type surface for process/lock-* modules - the ProcessLockOptions bag accepted by processLock.acquire and processLock.withLock.
@socketsecurity/lib/process/open-url	Open a URL in the platform's default browser.
@socketsecurity/lib/process/spawn/child	Child process spawning utilities with cross-platform support.
@socketsecurity/lib/process/spawn/errors	Spawn error classification and enhancement.
@socketsecurity/lib/process/spawn/kill-tree	Cross-platform process-tree termination.
@socketsecurity/lib/process/spawn/pty	Zero-dependency PTY runner: run a command under a pseudo-terminal using the system script binary, no node-pty and no native addon.
@socketsecurity/lib/process/spawn/retry	The Node retry variant: a real blocking wait between attempts.
@socketsecurity/lib/process/spawn/retry/browser	The browser retry variant: no blocking wait, so no retry.
@socketsecurity/lib/process/spawn/retry/node	The Node retry variant: a real blocking wait between attempts.
@socketsecurity/lib/process/spawn/retry/policy	Retry policy for spawned commands.
@socketsecurity/lib/process/spawn/run	Script-style run lanes over spawn/child: runInherit forwards stdio and resolves the exit code, runCapture collects stdout while stderr stays visible, and runInheritTee forwards the live stream AND keeps a copy -...
@socketsecurity/lib/process/spawn/stdio	Stdio configuration helpers for spawn callers.
@socketsecurity/lib/process/spawn/timeout	Platform-aware spawn-timeout scaling.
@socketsecurity/lib/process/spawn/tree-kill-timer	The killTreeOnTimeout timer for {@link spawn}.
@socketsecurity/lib/process/spawn/types	Public type surface for spawn/* modules.
@socketsecurity/lib/process/spawn/windows-shell	Decide whether a spawn needs shell: true on Windows, in one place.
@socketsecurity/lib/process/spawn/with-retry	Async spawn with retry.
@socketsecurity/lib/process/transient	Temporary package executor detection utilities for Socket ecosystem.
@socketsecurity/lib/process/tree	Reading the process table as labelled rows, and spotting a wrapper that has recursed into itself.

promises/

Subpath	Description
@socketsecurity/lib/promises/abort	Abort signal utilities - composite signal construction from multiple sources and timeout-driven signal creation.
@socketsecurity/lib/promises/all-keyed	Keyed promise combinators: pAllKeyed and pAllSettledKeyed - the tc39 proposal-await-dictionary (Promise.allKeyed / Promise.allSettledKeyed, stage 3) as plain helpers, no global patching.
@socketsecurity/lib/promises/backoff	Escalating-wait pacing for code that polls or retries against rate-limited services: a createBackoff state machine - initial delay, multiply per wait, optional cap, reset on forward progress.
@socketsecurity/lib/promises/debounce	Debounce user-driven requests and carry an AbortController so a newer request cancels the in-flight one.
@socketsecurity/lib/promises/iterate	Concurrency-controlled async iteration helpers: pEach, pEachChunk, pFilter, pFilterChunk.
@socketsecurity/lib/promises/options	Option-shape normalizers for the iteration / retry helpers.
@socketsecurity/lib/promises/queue	Bounded concurrency promise queue.
@socketsecurity/lib/promises/resolvers	ECMA-262 standalone async helpers - withResolvers (Promise.withResolvers) and fromAsync (Array.fromAsync).
@socketsecurity/lib/promises/retry	pRetry - exponential-backoff retry with optional jitter, abort-signal support, and an onRetry hook for customizing delays or canceling retries entirely.
@socketsecurity/lib/promises/timers	Browser-compatible promise-based timer helpers.
@socketsecurity/lib/promises/types	Public type surface for promises/* modules: RetryOptions, IterationOptions, PromiseWithResolvers, and the QueuedTask storage shape used by the bounded-concurrency PromiseQueue.

regexps/

Subpath	Description
@socketsecurity/lib/regexps/escape	Public escapeRegExp entry - binds to native RegExp.escape (TC39 Stage 4, Node 24+ / V8 13.7) when available, otherwise falls back to the spec-compliant implementation in ./spec.
@socketsecurity/lib/regexps/hex	Hex-encoding helpers - fixed-width \xHH (hex2) and \uHHHH (hex4) producers used by the spec-compliant RegExp.escape fallback to emit canonical escape sequences.
@socketsecurity/lib/regexps/spec	Spec-compliant fallback for the TC39 RegExp.escape (https://tc39.es/ecma262/#sec-regexp.escape).

releases/

Subpath	Description
@socketsecurity/lib/releases/github-archives	GitHub release archive download + extraction.
@socketsecurity/lib/releases/github-asset-url	Per-release asset-URL discovery for GitHub releases.
@socketsecurity/lib/releases/github-assets	Asset matching helpers for GitHub releases.
@socketsecurity/lib/releases/github-auth	GitHub API authentication header helpers for the release helpers.
@socketsecurity/lib/releases/github-downloads	GitHub release asset downloads.
@socketsecurity/lib/releases/github-listing	GitHub release listing via REST + GraphQL.
@socketsecurity/lib/releases/github-retry-config	Shared retry configuration for the GitHub release helpers (github-listing, github-asset-url).
@socketsecurity/lib/releases/github-types	Public types for GitHub release download utilities.
@socketsecurity/lib/releases/socket-btm	Socket-btm release download utilities.
@socketsecurity/lib/releases/socket-btm-binary-naming	Socket-btm binary asset/platform-arch naming helpers.

schema/

Subpath	Description
@socketsecurity/lib/schema/parse	Throwing twin of validateSchema.
@socketsecurity/lib/schema/types	Shared types for schema validation.
@socketsecurity/lib/schema/validate	Universal schema validator - non-throwing.

secrets/

Subpath	Description
@socketsecurity/lib/secrets/addon	In-process biometric keychain backend - the sockeye keychain.node N-API addon, loaded lazily and OPTIONALLY.
@socketsecurity/lib/secrets/broker	Sockeye broker client.
@socketsecurity/lib/secrets/compare	Constant-time secret comparison.
@socketsecurity/lib/secrets/find	Resolve a secret from the canonical Socket precedence order: process env → OS keychain.
@socketsecurity/lib/secrets/keychain	Cross-platform secret-storage helper.
@socketsecurity/lib/secrets/linux	Linux Secret Service backend via secret-tool.
@socketsecurity/lib/secrets/login	Interactive socket.dev login - acquire an API token and store it in the canonical socketsecurity keychain slot, biometric-first.
@socketsecurity/lib/secrets/macos	MacOS Keychain backend via security(1).
@socketsecurity/lib/secrets/oauth-pkce	Pure helpers for a client-side OAuth authorization-code flow: PKCE S256 pair generation (RFC 7636 §4), the RFC 8414 issuer-discovery URL, the authorization URL the browser opens, and the loopback callback parser (RFC ...
@socketsecurity/lib/secrets/one-password	Open the module for exported symbols and declarations.
@socketsecurity/lib/secrets/patterns	Shared catalog of secret-bearing env-var key names and literal secret-value shapes.
@socketsecurity/lib/secrets/rc	Write a managed export VAR='<value>' block to the user's shell rc ("run commands") file.
@socketsecurity/lib/secrets/redact	Deep redaction for payloads that carry live credentials beside state worth keeping (audit inventories, captured API responses, transcripts).
@socketsecurity/lib/secrets/socket-api-token	Convenience helper for reading the Socket API token from the canonical env → keychain precedence order.
@socketsecurity/lib/secrets/socket-oauth	Open the module for exported symbols and declarations.
@socketsecurity/lib/secrets/types	Public type surface for secrets/*.
@socketsecurity/lib/secrets/windows	Windows backend via PowerShell CredentialManager module, with a DPAPI-encrypted file fallback.

shell/

Subpath	Description
@socketsecurity/lib/shell/command-args	Positional-argument extraction that survives value-taking flags.
@socketsecurity/lib/shell/parse	Tokenize a shell command line into typed entries (bare strings, operators, comments, globs).
@socketsecurity/lib/shell/quote	Escape an argv array into a single shell-safe command string.

sorts/

Subpath	Description
@socketsecurity/lib/sorts/natural	Locale-aware + numeric-aware comparison via Intl.Collator, plus the naturalSorter helper that wires the fast-sort engine to the natural comparator.
@socketsecurity/lib/sorts/strings	Plain string comparison.
@socketsecurity/lib/sorts/types	Public type surface for sorts/* modules - the FastSortFunction shape returned by naturalSorter.

spinner/

Subpath	Description
@socketsecurity/lib/spinner/create-spinner-class	Builds the lazy-init Socket Spinner class that extends the live yocto-spinner constructor.
@socketsecurity/lib/spinner/default	Spinner-style registry - exposes the union of the standard cli-spinners collection and Socket's custom socket pulse animation, plus a lazy default-spinner singleton.
@socketsecurity/lib/spinner/default-state	The default-spinner singleton's storage, split out from default.mts so a caller that only needs to peek at whether a default spinner already exists never pays for constructing one.
@socketsecurity/lib/spinner/format	Stateless helpers shared by spinner/* modules - the ciSpinner constant for non-interactive output, the COLOR_INHERIT sentinel for shimmer color references, plus pure formatters (desc, formatProgress, `normal...
@socketsecurity/lib/spinner/spinner	Spinner factory - lazily builds the Socket Spinner class that wraps yocto-spinner with Socket-specific behaviors (custom RGB color pipeline, shimmer, progress bar, indented step messages, status methods that don't...
@socketsecurity/lib/spinner/spinner-internals	Pure helpers extracted from the Socket Spinner class body: option parsing (theme/color resolution, shimmer config) and the shimmer rendering pass.
@socketsecurity/lib/spinner/spinner-shimmer-methods	Shimmer-configuration methods for the Socket Spinner class, split out of create-spinner-class.ts to keep that module under the file-size cap.
@socketsecurity/lib/spinner/spinner-status-methods	Status-presentation methods for the Socket Spinner class, split out of create-spinner-class.ts to keep that module under the file-size cap.
@socketsecurity/lib/spinner/types	Public type surface for spinner/* modules - the Spinner instance shape, configuration option records, progress and shimmer state types, plus the withSpinner* option records.
@socketsecurity/lib/spinner/with	Lifecycle wrappers around Spinner - withSpinner (async, push-pop options + auto-stop), withSpinnerRestore (conditionally restart a previously-spinning instance), and withSpinnerSync (sync sibling of `withSpinn...

state/

Subpath	Description
@socketsecurity/lib/state/db	Reusable SQLite helpers for the Socket _state database.

stdio/

Subpath	Description
@socketsecurity/lib/stdio/clear	Terminal clearing and cursor utilities.
@socketsecurity/lib/stdio/divider	Console divider and separator utilities.
@socketsecurity/lib/stdio/footer	Console footer/summary formatting utilities.
@socketsecurity/lib/stdio/header	Console header/banner formatting utilities.
@socketsecurity/lib/stdio/progress	Progress bar utilities for CLI applications.
@socketsecurity/lib/stdio/prompts	User prompt utilities for interactive scripts.
@socketsecurity/lib/stdio/prompts-types	Type definitions for the interactive prompt wrappers in ./prompts.
@socketsecurity/lib/stdio/stderr	Standard error stream utilities.
@socketsecurity/lib/stdio/stdout	Standard output stream utilities.

streams/

Subpath	Description
@socketsecurity/lib/streams/parallel	Parallel iteration helpers - parallelMap() and the fire-and-forget parallelEach().
@socketsecurity/lib/streams/transform	Streaming transform helper - transform() wraps streaming-iterables.transform with the project's pRetry per-item retry policy.

strings/

Subpath	Description
@socketsecurity/lib/strings/format	Line formatting helpers: applyLinePrefix, centerText, indentString, repeatString.
@socketsecurity/lib/strings/lines	Newline-aware line splitting.
@socketsecurity/lib/strings/predicates	String predicates: isBlankString and isNonEmptyString.
@socketsecurity/lib/strings/search	search - like String.prototype.search but with a configurable starting index.
@socketsecurity/lib/strings/transform	String transformations: stripBom, stripPaddedSuffix, stripSurroundingQuotes, toKebabCase, trimCharsFromEnds, trimNewlines.
@socketsecurity/lib/strings/types	Public type surface for strings/* modules - branded string types and option interfaces.
@socketsecurity/lib/strings/width	stringWidth - calculate visual terminal width.

temporal/

Subpath	Description
@socketsecurity/lib/temporal/instant	Spec clause 8 - Temporal.Instant Objects.
@socketsecurity/lib/temporal/now	Spec clause 6 - Temporal.Now.
@socketsecurity/lib/temporal/slots	Internal-slot machinery for Temporal objects.
@socketsecurity/lib/temporal/system	Spec clause 21.x host hook - wallclock reader.
@socketsecurity/lib/temporal/temporal	Public aggregator for the Temporal surface.

term/

Subpath	Description
@socketsecurity/lib/term/ansi/constants	ANSI escape code constants.
@socketsecurity/lib/term/ansi/strip	ANSI escape-code regex factory and stripping helper.
@socketsecurity/lib/term/colors/convert	Color conversion helpers - isRgbTuple() narrows a ColorValue to the RGB-tuple branch, and toRgb() resolves a named color or passes through an existing tuple.
@socketsecurity/lib/term/colors/palette/named	Named-color palette - maps each ColorName to its canonical RGB tuple.
@socketsecurity/lib/term/colors/palette/socket	Socket terminal-color palette - mirrors the CSS design tokens defined in Socket's template/styles/tokens.css (light / dark / synthwave themes).
@socketsecurity/lib/term/colors/support	Color-capability detection for term/colors/* and logger/*.
@socketsecurity/lib/term/colors/types	Public type surface for term/colors/* modules - the ColorInherit literal, the ColorName named-color union, the ColorRgb tuple, and the ColorValue super-union.
@socketsecurity/lib/term/effects/pulse-frames	Socket pulse animation frames generator.
@socketsecurity/lib/term/effects/shimmer	Shimmer animation engine - pure functions, zero deps.
@socketsecurity/lib/term/effects/shimmer-keyframes	SVG keyframe batcher for the shimmer engine.
@socketsecurity/lib/term/effects/shimmer-terminal	Terminal renderer for the shimmer engine.
@socketsecurity/lib/term/tables/bordered	Bordered table renderer using Unicode box-drawing characters (┌, ─, │, ┴, …).
@socketsecurity/lib/term/tables/padding	Cell padding + display-width measurement - shared helpers used by both the simple and bordered table renderers.
@socketsecurity/lib/term/tables/simple	Borderless table renderer - columns separated by two spaces, header underlined with ─.
@socketsecurity/lib/term/tables/types	Public type surface for term/tables/* modules - the ColumnAlignment union + TableColumn config record.
@socketsecurity/lib/term/themes/context	Elegant theme context management.
@socketsecurity/lib/term/themes/resolve	Theme utilities - color resolution and composition.
@socketsecurity/lib/term/themes/themes	Elegant theme definitions for Socket libraries.
@socketsecurity/lib/term/themes/types	Elegant theme type system.

url/

Subpath	Description
@socketsecurity/lib/url/assert-safe	SSRF guard for operator- or issuer-supplied URLs - assertSafeHttpUrl parses a raw URL, rejects non-HTTP(S) schemes, refuses hosts that resolve to loopback / private / link-local ranges (cloud metadata, redis, intern...
@socketsecurity/lib/url/parse	URL parsing helpers - parseUrl (safe new URL(...) wrapper that returns undefined instead of throwing) and createRelativeUrl (compose a relative path against an optional base).
@socketsecurity/lib/url/predicates	URL type-guard predicates - isUrl answers whether a value parses as a valid URL via parseUrl.
@socketsecurity/lib/url/search-params	URL search-param coercion helpers - urlSearchParamsAs* normalise a raw string | null | undefined value into a typed shape (array / boolean / number / string) with a default.
@socketsecurity/lib/url/types	Public type surface for url/* modules - option interfaces consumed by createRelativeUrl, urlSearchParamsAs*, and urlSearchParamsGet*.

versions/

Subpath	Description
@socketsecurity/lib/versions/compare	Version comparison operators aligned with node:smol-versions, the C++-accelerated multi-ecosystem version helper shipped by the smol Node binary.
@socketsecurity/lib/versions/modify	Mutation helpers - incrementVersion bumps a version by release type ('major' | 'minor' | 'patch' | 'pre*'), and versionDiff returns the kind of step between two versions.
@socketsecurity/lib/versions/parse	Parsing helpers - coerceVersion rounds a sloppy input ("1.2") up to a valid semver triple, parseVersion returns {major, minor, patch, prerelease, build}, and the getMajor* / getMinor* / getPatchVersion acc...
@socketsecurity/lib/versions/range	Range / set helpers - satisfiesVersion / filterVersions check membership against a semver range, maxVersion / minVersion pick the bounds of an arbitrary version array.
@socketsecurity/lib/versions/types	Public type surface for versions/* modules - the parsed-version shape returned by parseVersion, a stable subset of semver's SemVer instance exposed as a structural type rather than leaking the upstream class.

words/

Subpath	Description
@socketsecurity/lib/words/article	Indefinite-article picker - determineArticle() returns 'a' or 'an' based on the leading vowel of a word.
@socketsecurity/lib/words/capitalize	Word-case helpers - capitalize() produces an upper-first / lower-rest variant that iterates by code point so surrogate pairs aren't split.
@socketsecurity/lib/words/pluralize	Count-based pluralization.
@socketsecurity/lib/words/types	Public type surface for words/* modules - the PluralizeOptions record and its PluralForms companion.

yaml/

Subpath	Description
@socketsecurity/lib/yaml/edit	Surface-preserving YAML editor, the sibling of json/edit.
@socketsecurity/lib/yaml/types	Types for the editable-YAML surface.