"use strict";
/* Socket Lib - Built with rolldown */
Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
const require_runtime = require('../_virtual/_rolldown/runtime.js');
const require_primordials_string = require('../primordials/string.js');
const require_integrity = require('../integrity.js');
const require_node_fs = require('../node/fs.js');
const require_node_path = require('../node/path.js');
const require_primordials_date = require('../primordials/date.js');
const require_primordials_json = require('../primordials/json.js');
const require_fs_safe = require('../fs/safe.js');
const require_dlx_arborist = require('./arborist.js');
let node_os = require("node:os");
node_os = require_runtime.__toESM(node_os);
let src_external_pacote = require("../external/pacote");
src_external_pacote = require_runtime.__toESM(src_external_pacote);

//#region src/dlx/lockfile.ts
/**
* @file Package pin generation for dlx installs. `generatePackagePin` resolves
*   an npm package against the registry using Arborist's lockfile-only mode and
*   fetches its top-level tarball to return both hash formats plus the lockfile
*   content — everything needed to vendor a reproducible install. The
*   `LockfileSpec` type is also exported here for use as the `lockfile` option
*   on `downloadPackage`. Sniff/write handling lives inline in `./package.ts` —
*   no helper.
*/
/**
* Default minimum release age in days applied when a caller passes neither
* `minReleaseDays` nor `minReleaseMins`. Pass `minReleaseDays: 0` to disable
* the cutoff explicitly.
*/
const DEFAULT_MIN_RELEASE_DAYS = 7;
/**
* Thrown when a lockfile spec is malformed (unrecognized string, missing file,
* invalid JSON) or drifts from its package.json.
*/
var DlxLockfileError = class extends Error {
	constructor(message, options) {
		super(message, options);
		this.name = "DlxLockfileError";
	}
};
/**
* Generate a vendorable pin for an npm package without installing it.
*
* Runs Arborist in lockfile-only mode (`packageLockOnly: true`) against a
* temporary directory, fetches the top-level tarball once to compute sha256 hex
* (since Arborist only exposes SRI from the registry), then tears the tmp
* directory down before returning.
*
* The result contains everything a caller needs to pin the package for future
* installs: the exact resolved name/version, both hash formats, and the
* lockfile content (ready to commit).
*
* @example
*   ;```ts
*   const pin = await generatePackagePin({
*     package: '@anthropic-ai/claude-code@2.1.92',
*   })
*   await fs.writeFile('./claude.lock.json', pin.lockfile, 'utf8')
*   // pin.hash.integrity → 'sha512-…'
*   // pin.hash.checksum  → hex
*   ```
*/
async function generatePackagePin(options) {
	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
	const path = /* @__PURE__ */ require_node_path.getNodePath();
	const { minReleaseDays, minReleaseMins, package: spec } = options;
	if (typeof spec !== "string" || spec.length === 0) throw new DlxLockfileError("generatePackagePin requires a package spec");
	if (minReleaseDays !== void 0 && minReleaseMins !== void 0) throw new DlxLockfileError("generatePackagePin: minReleaseDays and minReleaseMins are mutually exclusive");
	const effectiveDays = minReleaseDays !== void 0 ? minReleaseDays : minReleaseMins !== void 0 ? void 0 : 7;
	const ageMs = effectiveDays !== void 0 ? effectiveDays * 864e5 : minReleaseMins !== void 0 ? minReleaseMins * 6e4 : 0;
	const before = ageMs > 0 ? new require_primordials_date.DateCtor(require_primordials_date.DateNow() - ageMs) : void 0;
	const scratch = path.join(node_os.default.tmpdir(), `socket-lib-pin-${process.pid}-${Date.now()}`);
	await require_fs_safe.safeMkdir(scratch, { recursive: true });
	try {
		const packageJson = require_primordials_json.JSONStringify({
			name: "socket-lib-pin",
			version: "0.0.0",
			private: true,
			dependencies: { [specName(spec)]: specRange(spec) }
		}, void 0, 2);
		await fs.promises.writeFile(path.join(scratch, "package.json"), packageJson + "\n", "utf8");
		await require_dlx_arborist.writeSafeNpmrc(scratch, {
			minReleaseDays: effectiveDays,
			minReleaseMins
		});
		const ideal = await require_dlx_arborist.safeIdealTree({
			path: scratch,
			before
		});
		const hash = require_integrity.computeHashes(await src_external_pacote.default.tarball(`${ideal.name}@${ideal.version}`));
		return {
			name: ideal.name,
			version: ideal.version,
			hash,
			packageJson,
			lockfile: ideal.lockfile
		};
	} finally {
		try {
			await require_fs_safe.safeDelete(scratch, { force: true });
		} catch {}
	}
}
/**
* Extract the package name from a spec like `'name@range'` or
* `'@scope/name@range'` or a bare `'name'`.
*/
function specName(spec) {
	const atIdx = require_primordials_string.StringPrototypeLastIndexOf(spec, "@");
	if (atIdx <= 0) return spec;
	return require_primordials_string.StringPrototypeSlice(spec, 0, atIdx);
}
/**
* Extract the version range (or `'latest'`) from a spec.
*/
function specRange(spec) {
	const atIdx = require_primordials_string.StringPrototypeLastIndexOf(spec, "@");
	if (atIdx <= 0) return "latest";
	return require_primordials_string.StringPrototypeSlice(spec, atIdx + 1) || "latest";
}

//#endregion
exports.DEFAULT_MIN_RELEASE_DAYS = DEFAULT_MIN_RELEASE_DAYS;
exports.DlxLockfileError = DlxLockfileError;
exports.generatePackagePin = generatePackagePin;
exports.specName = specName;
exports.specRange = specRange;