@neotales/is-elevated 0.0.0 → 0.1.0-alpha.0

package/README.md

@@ -5,17 +5,17 @@
 `@neotales/is-elevated` detects whether the current process is running with elevated privileges.
 On Unix-like systems this typically means root. On Windows it checks whether the current token is elevated.
 
-![logo](https://raw.githubusercontent.com/neotales/js-std/refs/heads/dev/eng/assets/logo.png)
+![logo](https://raw.githubusercontent.com/neotales/js-lib/refs/heads/dev/eng/assets/logo.png)
 
 [![JSR](https://jsr.io/badges/@neotales/is-elevated)](https://jsr.io/@neotales/is-elevated)
 [![npm version](https://badge.fury.io/js/@neotales%2Fis-elevated.svg)](https://badge.fury.io/js/@neotales%2Fis-elevated)
-[![GitHub version](https://badge.fury.io/gh/neotales%2Fjs-os.svg)](https://badge.fury.io/gh/neotales%2Fjs-os)
+[![GitHub version](https://badge.fury.io/gh/neotales%2Fjs-lib.svg)](https://badge.fury.io/gh/neotales%2Fjs-lib)
 
 ## Documentation
 
 Documentation is available on [jsr.io](https://jsr.io/@neotales/is-elevated/doc).
 
-A list of other modules can be found at [github.com/neotales/js-os](https://github.com/neotales/js-os).
+[Module list](https://github.com/neotales/js-lib)..
 
 ## Installation
 
@@ -25,6 +25,25 @@ npx jsr add @neotales/is-elevated
 npm install @neotales/is-elevated
 ```
 
+### Runtime support
+
+The module README table is the support claim. A browser can still load `is-elevated`. That is not support: `isElevatedAvailable()` is false there, and `isElevated()` throws.
+
+| Runtime | Supported | Generated from the TypeScript |
+| --- | --- | --- |
+| Deno | ✅ | source; requires --allow-sys and --allow-ffi |
+| Node.js | ✅ | published npm ESM twin (node >= 22) |
+| Bun | ✅ | source; Bun rewrites @neotales/ imports to relative paths |
+| Ende | ✅ | source; requires --allow-sys |
+| QuickJS-ng | ❌ | one ESM bundle |
+| workerd | ✅ | one ESM bundle, imported from the worker |
+| txiki.js | ✅ | one ESM bundle, run with `tjs run`; Windows backend is `tjs:ffi` |
+| ClearScript | ❌ | TypeScript graph transpiled to .js, then loaded by the host |
+| browsers | ❌ | one ESM bundle, no syntax rewrite; leaves ffi_*.ts out; node:module and bun:ffi are not loaded |
+| JerryScript | ❌ | no bundle; FFI files import host modules the IIFE cannot include |
+
+Load instructions: [runtime documentation](../../../docs/README.md).
+
 ## Usage
 
 ```typescript
@@ -37,9 +56,10 @@ if (!isElevated()) {
 
 ## Exports
 
-| Export       | Subpath                 | Description                                      |
-| ------------ | ----------------------- | ------------------------------------------------ |
-| `isElevated` | `@neotales/is-elevated` | Detects whether the current process is elevated. |
+| Export                | Subpath                 | Description                                                  |
+| --------------------- | ----------------------- | ------------------------------------------------------------ |
+| `isElevated`          | `@neotales/is-elevated` | Detects whether the current process is elevated.             |
+| `isElevatedAvailable` | `@neotales/is-elevated` | Reports whether elevation detection can run in this runtime. |
 
 ```typescript
 import { isElevated } from "@neotales/is-elevated";
@@ -53,29 +73,15 @@ if (elevated) {
 
 ## Elevation Detection
 
-On Unix-like systems, elevation means an effective user ID of `0`. Node and Bun check `process.geteuid()` when available, then fall back to `process.getuid()`. The result is cached so repeated checks do not need to query the runtime again.
-
-On Windows, the package opens the current process token and calls `GetTokenInformation` with `TokenElevation`. Node uses native `node:ffi` when available and otherwise the optional `koffi` dependency; Bun and Deno use their native FFI implementations. The FFI implementations are loaded only on Windows.
-
-This intentionally does not use `Shell32.IsUserAnAdmin`. That API checks administrator-group membership rather than the current process token, so it can disagree under User Account Control when an administrator account is running with a filtered, non-elevated token. `TokenElevation` reports the process state directly.
-
-## Runtime Support
+On Unix-like systems, elevation means an effective user ID of `0`. The module uses an effective ID when the runtime exposes one and otherwise falls back to `Deno.uid()`. This keeps the result tied to the identity under which the process is actually executing.
 
-This npm package supports Node, Bun, and Deno. Deno users can import it with
-`npm:@neotales/is-elevated`. Call `isElevatedAvailable()` before relying on
-Windows elevation detection when the runtime's FFI configuration may be unknown.
+On Windows, the module opens the current process token and calls `GetTokenInformation` with `TokenElevation`. The returned `TokenIsElevated` value describes the current process token, which is the relevant answer for an operation that needs administrator privileges.
 
-- **Deno**: run with `--allow-ffi`.
-- **Bun**: the native `bun:ffi` backend is selected automatically.
-- **Node.js**: see [Node.js FFI](#nodejs-ffi).
+This intentionally does not use `Shell32.IsUserAnAdmin`. That API is a convenience membership check and can disagree with the current token under User Account Control: an administrator account may be running with a filtered, non-elevated token. Token elevation inspection reports the process state directly.
 
 ## Node.js FFI
 
-On Windows, Node.js requires a native FFI backend. Run Node >= 26 with
-`--experimental-ffi` to enable `node:ffi`, or install koffi with
-`npm install koffi` when optional dependencies were omitted or unavailable.
-When neither is available, `isElevatedAvailable()` returns `false` and
-`isElevated()` throws an error that links to this section.
+On Windows, Node uses `node:ffi` when the module loads. It was added in 26.1.0, is still experimental, and requires `--experimental-ffi`. If it does not load, the same call goes through koffi. The generated npm package declares koffi `^2.9.0` as an optional dependency. When neither is available, `isElevatedAvailable()` returns `false` and `isElevated()` throws.
 
 ## License
 

package/esm/_dnt.polyfills.js

@@ -0,0 +1,130 @@
+/**
+ * Based on [import-meta-ponyfill](https://github.com/gaubee/import-meta-ponyfill),
+ * but instead of using npm to install additional dependencies,
+ * this approach manually consolidates cjs/mjs/d.ts into a single file.
+ *
+ * Note that this code might be imported multiple times
+ * (for example, both dnt.test.polyfills.ts and dnt.polyfills.ts contain this code;
+ *  or Node.js might dynamically clear the cache and then force a require).
+ * Therefore, it's important to avoid redundant writes to global objects.
+ * Additionally, consider that commonjs is used alongside esm,
+ * so the two ponyfill functions are stored independently in two separate global objects.
+ */
+//@ts-ignore
+import { createRequire } from "node:module";
+//@ts-ignore
+import { fileURLToPath, pathToFileURL } from "node:url";
+//@ts-ignore
+import { dirname } from "node:path";
+const defineGlobalPonyfill = (symbolFor, fn) => {
+    if (!Reflect.has(globalThis, Symbol.for(symbolFor))) {
+        Object.defineProperty(globalThis, Symbol.for(symbolFor), {
+            configurable: true,
+            get() {
+                return fn;
+            },
+        });
+    }
+};
+export let import_meta_ponyfill_commonjs = (Reflect.get(globalThis, Symbol.for("import-meta-ponyfill-commonjs")) ??
+    (() => {
+        const moduleImportMetaWM = new WeakMap();
+        return (require, module) => {
+            let importMetaCache = moduleImportMetaWM.get(module);
+            if (importMetaCache == null) {
+                const importMeta = Object.assign(Object.create(null), {
+                    url: pathToFileURL(module.filename).href,
+                    main: require.main == module,
+                    resolve: (specifier, parentURL = importMeta.url) => {
+                        return pathToFileURL((importMeta.url === parentURL
+                            ? require
+                            : createRequire(parentURL))
+                            .resolve(specifier)).href;
+                    },
+                    filename: module.filename,
+                    dirname: module.path,
+                });
+                moduleImportMetaWM.set(module, importMeta);
+                importMetaCache = importMeta;
+            }
+            return importMetaCache;
+        };
+    })());
+defineGlobalPonyfill("import-meta-ponyfill-commonjs", import_meta_ponyfill_commonjs);
+export let import_meta_ponyfill_esmodule = (Reflect.get(globalThis, Symbol.for("import-meta-ponyfill-esmodule")) ??
+    ((importMeta) => {
+        const resolveFunStr = String(importMeta.resolve);
+        const shimWs = new WeakSet();
+        //@ts-ignore
+        const mainUrl = ("file:///" + process.argv[1].replace(/\\/g, "/"))
+            .replace(/\/{3,}/, "///");
+        const commonShim = (importMeta) => {
+            if (typeof importMeta.main !== "boolean") {
+                importMeta.main = importMeta.url === mainUrl;
+            }
+            if (typeof importMeta.filename !== "string") {
+                importMeta.filename = fileURLToPath(importMeta.url);
+                importMeta.dirname = dirname(importMeta.filename);
+            }
+        };
+        if (
+        // v16.2.0+, v14.18.0+: Add support for WHATWG URL object to parentURL parameter.
+        resolveFunStr === "undefined" ||
+            // v20.0.0+, v18.19.0+"" This API now returns a string synchronously instead of a Promise.
+            resolveFunStr.startsWith("async")
+        // enable by --experimental-import-meta-resolve flag
+        ) {
+            import_meta_ponyfill_esmodule = (importMeta) => {
+                if (!shimWs.has(importMeta)) {
+                    shimWs.add(importMeta);
+                    const importMetaUrlRequire = {
+                        url: importMeta.url,
+                        require: createRequire(importMeta.url),
+                    };
+                    // note: the parameter types must be explicitly annotated because
+                    // `@types/node` also declares `ImportMeta.resolve`, which makes
+                    // the contextual type an overload set that provides no inference
+                    importMeta.resolve = function resolve(specifier, parentURL = importMeta.url) {
+                        return pathToFileURL((importMetaUrlRequire.url === parentURL
+                            ? importMetaUrlRequire.require
+                            : createRequire(parentURL)).resolve(specifier)).href;
+                    };
+                    commonShim(importMeta);
+                }
+                return importMeta;
+            };
+        }
+        else {
+            /// native support
+            import_meta_ponyfill_esmodule = (importMeta) => {
+                if (!shimWs.has(importMeta)) {
+                    shimWs.add(importMeta);
+                    commonShim(importMeta);
+                }
+                return importMeta;
+            };
+        }
+        return import_meta_ponyfill_esmodule(importMeta);
+    }));
+defineGlobalPonyfill("import-meta-ponyfill-esmodule", import_meta_ponyfill_esmodule);
+export let import_meta_ponyfill = ((...args) => {
+    const _MODULE = (() => {
+        if (typeof require === "function" && typeof module === "object") {
+            return "commonjs";
+        }
+        else {
+            // eval("typeof import.meta");
+            return "esmodule";
+        }
+    })();
+    if (_MODULE === "commonjs") {
+        //@ts-ignore
+        import_meta_ponyfill = (r, m) => import_meta_ponyfill_commonjs(r, m);
+    }
+    else {
+        //@ts-ignore
+        import_meta_ponyfill = (im) => import_meta_ponyfill_esmodule(im);
+    }
+    //@ts-ignore
+    return import_meta_ponyfill(...args);
+});

package/esm/ffi_bun.js

@@ -1,22 +1,28 @@
-/// <reference types="@types/bun" />
-import { dlopen, FFIType, ptr } from "bun:ffi";
+/**
+ * Implements native Windows elevation detection through Bun FFI.
+ *
+ * @module @neotales/is-elevated/ffi_bun
+ * @internal
+ */
+const specifier = "bun:ffi";
+let ffi;
+try {
+    ffi = await import(/* @vite-ignore */ specifier);
+}
+catch (cause) {
+    throw new Error("Unable to load bun:ffi. See https://github.com/neotales/js-lib/blob/dev/os/jsr/is-elevated/README.md#runtime-support", { cause });
+}
 let elevated;
 /**
  * Reports whether the current process is running with elevated privileges.
  *
  * @param cache - Whether to reuse the result from the first evaluation.
  * @returns Whether the process has elevated privileges.
- * @example
- * ```ts
- * import { evalIsProcessElevated } from "./ffi_bun.js";
- *
- * const elevated = evalIsProcessElevated();
- * ```
  */
 export function evalIsProcessElevated(cache = true) {
-    if (cache && elevated !== undefined) {
+    if (cache && elevated !== undefined)
         return elevated;
-    }
+    const { FFIType, dlopen, ptr } = ffi;
     const advapi32 = dlopen("Advapi32.dll", {
         OpenProcessToken: { args: [FFIType.ptr, FFIType.u32, FFIType.ptr], returns: FFIType.bool },
         GetTokenInformation: {
@@ -33,15 +39,15 @@ export function evalIsProcessElevated(cache = true) {
         const TOKEN_QUERY = 0x0008;
         const TOKEN_ELEVATION = 20;
         const tokenHandle = new BigUint64Array(1);
-        const success = advapi32.symbols.OpenProcessToken(kernel32.symbols.GetCurrentProcess(), TOKEN_QUERY, ptr(tokenHandle));
-        if (!success)
+        const opened = advapi32.symbols.OpenProcessToken(kernel32.symbols.GetCurrentProcess(), TOKEN_QUERY, ptr(tokenHandle));
+        if (!opened)
             throw new Error("Failed to open process token");
         try {
             const tokenInfo = new Uint8Array(4);
             const returnLength = new Uint32Array(1);
             const result = advapi32.symbols.GetTokenInformation(tokenHandle[0], TOKEN_ELEVATION, ptr(tokenInfo), 4, ptr(returnLength));
             if (!result)
-                throw new Error(`Failed to get token information ${kernel32.symbols.GetLastError()}`);
+                throw new Error(`Failed to get token information (${kernel32.symbols.GetLastError()})`);
             elevated = tokenInfo[0] !== 0;
             return elevated;
         }

package/esm/ffi_deno.js

@@ -4,7 +4,6 @@
  * @module @neotales/is-elevated/ffi_deno
  */
 let elevated;
-const deno = globalThis.Deno;
 /**
  * Reports whether the current process is running with elevated privileges.
  *
@@ -12,22 +11,27 @@ const deno = globalThis.Deno;
  * @returns Whether the process has elevated privileges.
  * @example
  * ```ts
- * import { evalIsProcessElevated } from "./ffi_deno.js";
+ * import { evalIsProcessElevated } from "./ffi_deno.ts";
  *
  * const elevated = evalIsProcessElevated();
  * ```
  */
 export function evalIsProcessElevated(cache = true) {
+    if (Deno.build.os !== "windows") {
+        if (!cache || elevated === undefined)
+            elevated = Deno.uid() === 0;
+        return elevated;
+    }
     if (cache && elevated !== undefined)
         return elevated;
-    const advapi32 = deno.dlopen("Advapi32.dll", {
+    const advapi32 = Deno.dlopen("Advapi32.dll", {
         OpenProcessToken: { parameters: ["pointer", "u32", "pointer"], result: "bool" },
         GetTokenInformation: {
             parameters: ["u64", "u32", "pointer", "u32", "pointer"],
             result: "bool",
         },
     });
-    const kernel32 = deno.dlopen("Kernel32.dll", {
+    const kernel32 = Deno.dlopen("Kernel32.dll", {
         GetCurrentProcess: { parameters: [], result: "pointer" },
         CloseHandle: { parameters: ["pointer"], result: "bool" },
         GetLastError: { parameters: [], result: "i32" },
@@ -37,21 +41,22 @@ export function evalIsProcessElevated(cache = true) {
         const TOKEN_ELEVATION = 20;
         const processHandle = kernel32.symbols.GetCurrentProcess();
         const tokenHandle = new BigUint64Array(1);
-        const tokenHandlePtr = deno.UnsafePointer.of(tokenHandle);
+        const tokenHandlePtr = Deno.UnsafePointer.of(tokenHandle);
         const success = advapi32.symbols.OpenProcessToken(processHandle, TOKEN_QUERY, tokenHandlePtr);
-        if (!success)
+        if (!success) {
             throw new Error("Failed to open process token");
+        }
         try {
             const tokenInfo = new Uint8Array(4);
             const returnLength = new Uint32Array(1);
-            const result = advapi32.symbols.GetTokenInformation(tokenHandle[0], TOKEN_ELEVATION, deno.UnsafePointer.of(tokenInfo), 4, deno.UnsafePointer.of(returnLength));
+            const result = advapi32.symbols.GetTokenInformation(tokenHandle[0], TOKEN_ELEVATION, Deno.UnsafePointer.of(tokenInfo), 4, Deno.UnsafePointer.of(returnLength));
             if (!result)
                 throw new Error("Failed to get token information " + kernel32.symbols.GetLastError());
             elevated = tokenInfo[0] !== 0;
             return elevated;
         }
         finally {
-            kernel32.symbols.CloseHandle(deno.UnsafePointer.create(tokenHandle[0]));
+            kernel32.symbols.CloseHandle(Deno.UnsafePointer.create(tokenHandle[0]));
         }
     }
     finally {

package/esm/ffi_koffi.js

@@ -1,7 +1,13 @@
-import process from "node:process";
-const { createRequire } = process.getBuiltinModule("node:module");
-const require = createRequire(import.meta.url);
-const koffi = require("koffi");
+/**
+ * Windows elevation through koffi, used when node:ffi is not available.
+ *
+ * @module @neotales/is-elevated/ffi_koffi
+ * @internal
+ */
+import { createRequire } from "node:module";
+const require = createRequire(globalThis[Symbol.for("import-meta-ponyfill-esmodule")](import.meta).url);
+const specifier = "koffi";
+const koffi = require(specifier);
 const advapi32 = koffi.load("Advapi32.dll");
 const kernel32 = koffi.load("Kernel32.dll");
 const OpenProcessToken = advapi32.func("int __stdcall OpenProcessToken(void *ProcessHandle, uint32 DesiredAccess, _Out_ void **TokenHandle)");
@@ -15,17 +21,10 @@ let elevated;
  *
  * @param cache - Whether to reuse the result from the first evaluation.
  * @returns Whether the process has elevated privileges.
- * @example
- * ```ts
- * import { evalIsProcessElevated } from "./ffi_koffi.js";
- *
- * const elevated = evalIsProcessElevated();
- * ```
  */
 export function evalIsProcessElevated(cache = true) {
-    if (cache && elevated !== undefined) {
+    if (cache && elevated !== undefined)
         return elevated;
-    }
     const TOKEN_QUERY = 0x0008;
     const TOKEN_ELEVATION = 20;
     const processHandle = GetCurrentProcess();

package/esm/ffi_node.js

@@ -1,63 +1,61 @@
-import process from "node:process";
-const { createRequire } = process.getBuiltinModule("node:module");
-const require = createRequire(import.meta.url);
-const ffi = require("node:ffi");
-if (!ffi) {
-    throw new Error();
+/**
+ * Implements native Windows elevation detection through Node.js FFI.
+ *
+ * @module @neotales/is-elevated/ffi_node
+ * @internal
+ */
+import { createRequire } from "node:module";
+const require = createRequire(globalThis[Symbol.for("import-meta-ponyfill-esmodule")](import.meta).url);
+const specifier = "node:ffi";
+let ffi;
+try {
+    ffi = require(specifier);
+}
+catch (cause) {
+    throw new Error(`Unable to load ${specifier}. See https://github.com/neotales/js-lib/blob/dev/os/jsr/is-elevated/README.md#nodejs-ffi`, { cause });
 }
+const advapi32 = ffi.dlopen("Advapi32.dll", {
+    OpenProcessToken: { arguments: ["pointer", "u32", "pointer"], return: "u8" },
+    GetTokenInformation: {
+        arguments: ["pointer", "u32", "pointer", "u32", "pointer"],
+        return: "u8",
+    },
+});
+const kernel32 = ffi.dlopen("Kernel32.dll", {
+    GetCurrentProcess: { arguments: [], return: "pointer" },
+    CloseHandle: { arguments: ["pointer"], return: "u8" },
+    GetLastError: { arguments: [], return: "u32" },
+});
 let elevated;
 /**
  * Reports whether the current process is running with elevated privileges.
  *
  * @param cache - Whether to reuse the result from the first evaluation.
  * @returns Whether the process has elevated privileges.
- * @example
- * ```ts
- * import { evalIsProcessElevated } from "./ffi_node.js";
- *
- * const elevated = evalIsProcessElevated();
- * ```
  */
 export function evalIsProcessElevated(cache = true) {
-    if (cache && elevated !== undefined) {
+    if (cache && elevated !== undefined)
         return elevated;
+    const TOKEN_QUERY = 0x0008;
+    const TOKEN_ELEVATION = 20;
+    const processHandle = kernel32.functions.GetCurrentProcess();
+    const tokenHandleBuffer = new Uint8Array(8);
+    const opened = advapi32.functions.OpenProcessToken(processHandle, TOKEN_QUERY, tokenHandleBuffer);
+    if (!opened) {
+        throw new Error(`Failed to open process token (${kernel32.functions.GetLastError()})`);
     }
-    const advapi32 = ffi.dlopen("Advapi32.dll", {
-        OpenProcessToken: { arguments: ["pointer", "u32", "pointer"], return: "u8" },
-        GetTokenInformation: {
-            arguments: ["pointer", "u32", "pointer", "u32", "pointer"],
-            return: "u8",
-        },
-    });
-    const kernel32 = ffi.dlopen("Kernel32.dll", {
-        GetCurrentProcess: { arguments: [], return: "pointer" },
-        CloseHandle: { arguments: ["pointer"], return: "u8" },
-        GetLastError: { arguments: [], return: "u32" },
-    });
+    const tokenHandle = new DataView(tokenHandleBuffer.buffer).getBigUint64(0, true);
     try {
-        const TOKEN_QUERY = 0x0008;
-        const TOKEN_ELEVATION = 20;
-        const processHandle = kernel32.functions.GetCurrentProcess();
-        const tokenHandleBuf = new Uint8Array(8);
-        const success = advapi32.functions.OpenProcessToken(processHandle, TOKEN_QUERY, tokenHandleBuf);
-        if (!success)
-            throw new Error(`Failed to open process token (${kernel32.functions.GetLastError()})`);
-        const tokenHandle = new DataView(tokenHandleBuf.buffer).getBigUint64(0, true);
-        try {
-            const tokenInfo = new Uint8Array(4);
-            const returnLength = new Uint8Array(4);
-            const result = advapi32.functions.GetTokenInformation(tokenHandle, TOKEN_ELEVATION, tokenInfo, 4, returnLength);
-            if (!result)
-                throw new Error(`Failed to get token information (${kernel32.functions.GetLastError()})`);
-            elevated = tokenInfo[0] !== 0;
-            return elevated;
-        }
-        finally {
-            kernel32.functions.CloseHandle(tokenHandle);
+        const tokenInfo = new Uint8Array(4);
+        const returnLength = new Uint8Array(4);
+        const result = advapi32.functions.GetTokenInformation(tokenHandle, TOKEN_ELEVATION, tokenInfo, 4, returnLength);
+        if (!result) {
+            throw new Error(`Failed to get token information (${kernel32.functions.GetLastError()})`);
         }
+        elevated = tokenInfo[0] !== 0;
+        return elevated;
     }
     finally {
-        advapi32.lib.close();
-        kernel32.lib.close();
+        kernel32.functions.CloseHandle(tokenHandle);
     }
 }

package/esm/ffi_txiki.js

@@ -0,0 +1,58 @@
+/**
+ * Windows elevation through txiki.js `tjs:ffi`.
+ *
+ * @module @neotales/is-elevated/ffi_txiki
+ * @internal
+ */
+const specifier = "tjs:ffi";
+let ffi;
+try {
+    ffi = await import(/* @vite-ignore */ specifier);
+}
+catch (cause) {
+    throw new Error("Unable to load tjs:ffi. See https://github.com/neotales/js-lib/blob/dev/os/jsr/is-elevated/README.md#runtime-support", { cause });
+}
+let elevated;
+/**
+ * Reports whether the current process is running with elevated privileges.
+ *
+ * @param cache - Whether to reuse the result from the first evaluation.
+ * @returns Whether the process has elevated privileges.
+ */
+export function evalIsProcessElevated(cache = true) {
+    if (cache && elevated !== undefined)
+        return elevated;
+    const advapi32 = ffi.dlopen("Advapi32.dll", {
+        OpenProcessToken: { args: ["ptr", "u32", "buffer"], returns: "bool_u32" },
+        GetTokenInformation: { args: ["ptr", "u32", "buffer", "u32", "buffer"], returns: "bool_u32" },
+    });
+    const kernel32 = ffi.dlopen("Kernel32.dll", {
+        GetCurrentProcess: { args: [], returns: "ptr" },
+        CloseHandle: { args: ["ptr"], returns: "bool_u32" },
+        GetLastError: { args: [], returns: "u32" },
+    });
+    try {
+        const TOKEN_QUERY = 0x0008;
+        const TOKEN_ELEVATION = 20;
+        const tokenHandle = new Uint8Array(8);
+        const opened = advapi32.symbols.OpenProcessToken(kernel32.symbols.GetCurrentProcess(), TOKEN_QUERY, tokenHandle);
+        if (!opened)
+            throw new Error(`Failed to open process token (${kernel32.symbols.GetLastError()})`);
+        try {
+            const tokenInfo = new Uint8Array(4);
+            const returnLength = new Uint8Array(4);
+            const result = advapi32.symbols.GetTokenInformation(tokenHandle, TOKEN_ELEVATION, tokenInfo, 4, returnLength);
+            if (!result)
+                throw new Error(`Failed to get token information (${kernel32.symbols.GetLastError()})`);
+            elevated = tokenInfo[0] !== 0;
+            return elevated;
+        }
+        finally {
+            kernel32.symbols.CloseHandle(tokenHandle);
+        }
+    }
+    finally {
+        advapi32.close();
+        kernel32.close();
+    }
+}

package/esm/mod.js

@@ -0,0 +1,101 @@
+/**
+ * Detects whether the current process is running with elevated privileges.
+ *
+ * @module @neotales/is-elevated
+ */
+import "./_dnt.polyfills.js";
+let elevated;
+function evalUnixElevation(cache = true) {
+    if (cache && elevated !== undefined)
+        return elevated;
+    let uid = null;
+    if ("process" in globalThis && process.geteuid)
+        uid = process.geteuid();
+    if (uid === null && "process" in globalThis && process.getuid)
+        uid = process.getuid();
+    // Ende has no process. Deno is a permanent alias there, so this is the Ende path too.
+    const globals = globalThis;
+    if (uid === null && globals.Deno?.euid)
+        uid = globals.Deno.euid();
+    if (uid === null && globals.Deno?.uid)
+        uid = globals.Deno.uid();
+    elevated = uid === 0;
+    return elevated;
+}
+function unsupportedNodeFfi() {
+    throw new Error("Unable to determine Windows process elevation because neither node:ffi nor koffi is available. Run Node.js >= 26 with --experimental-ffi, or install koffi. See https://github.com/neotales/js-lib/blob/dev/os/jsr/is-elevated/README.md#nodejs-ffi");
+}
+function unsupportedRuntimeFfi() {
+    throw new Error(`Unable to determine Windows process elevation because the runtime FFI backend is unavailable.${"Deno" in globalThis ? " Run Deno with --allow-ffi." : ""} See https://github.com/neotales/js-lib/blob/dev/os/jsr/is-elevated/README.md#runtime-support`);
+}
+function windows() {
+    if ("process" in globalThis && process.platform === "win32")
+        return true;
+    const nav = globalThis;
+    return nav.navigator?.userAgentData?.platform === "Windows";
+}
+let impl = evalUnixElevation;
+let isSupported = "process" in globalThis || "Deno" in globalThis || "Bun" in globalThis || "tjs" in globalThis;
+if (isSupported && windows()) {
+    let isNode = false;
+    try {
+        if ("Deno" in globalThis) {
+            impl = (await import("./ffi_deno.js")).evalIsProcessElevated;
+        }
+        else if ("Bun" in globalThis) {
+            impl = (await import("./ffi_bun.js")).evalIsProcessElevated;
+        }
+        else if ("tjs" in globalThis) {
+            impl = (await import("./ffi_txiki.js")).evalIsProcessElevated;
+        }
+        else {
+            isNode = true;
+            try {
+                impl = (await import("./ffi_node.js")).evalIsProcessElevated;
+            }
+            catch {
+                impl = (await import("./ffi_koffi.js")).evalIsProcessElevated;
+            }
+        }
+        // Loading a backend alone does not prove FFI permissions and native
+        // libraries are usable, so evaluate once before advertising support.
+        impl();
+        isSupported = true;
+    }
+    catch (error) {
+        const debug = "process" in globalThis && process.env.DEBUG === "true";
+        if (debug)
+            console.debug(error);
+        isSupported = false;
+        impl = isNode ? unsupportedNodeFfi : unsupportedRuntimeFfi;
+    }
+}
+/**
+ * Returns whether elevation detection is available in the current runtime.
+ *
+ * @returns `true` when {@linkcode isElevated} can evaluate the current process.
+ */
+export function isElevatedAvailable() {
+    return isSupported;
+}
+/**
+ * Reports whether the current process is running with elevated privileges.
+ *
+ * @param cache - Whether to reuse the result from the first evaluation.
+ * @returns Whether the process has elevated privileges.
+ * @throws {Error} On Windows when the runtime has no usable FFI backend.
+ * @example
+ * import { isElevated } from "jsr:@neotales/is-elevated";
+ *
+ * if (isElevated()) {
+ *   console.log("The process is elevated.");
+ * }
+ */
+export function isElevated(cache = true) {
+    if (!isSupported) {
+        if (impl !== evalUnixElevation)
+            impl();
+        unsupportedRuntimeFfi();
+    }
+    return impl(cache);
+}

package/esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/package.json

@@ -1,58 +1,42 @@
 {
   "name": "@neotales/is-elevated",
-  "version": "0.0.0",
-  "description": "isElevated function determines if the current process is running elevated (admin/root) across windows, linux, and darwin platforms.",
+  "version": "0.1.0-alpha.0",
   "keywords": [
-    "admin",
-    "elevated",
-    "root",
-    "std",
-    "sudo",
-    "windows",
-    "linux",
-    "darwin",
-    "is-elevated"
+    "is-elevated",
+    "deno",
+    "node",
+    "bun",
+    "ende",
+    "workerd",
+    "txiki"
   ],
-  "homepage": "https://github.com/neotales/js-os",
-  "bugs": {
-    "url": "https://github.com/neotales/js-os/issues"
-  },
-  "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/neotales/js-os.git",
-    "directory": "npm/is-elevated"
+    "url": "git+https://github.com/neotales/js-lib.git",
+    "directory": "os/npm/is-elevated"
   },
-  "files": [
-    "esm",
-    "types"
-  ],
-  "type": "module",
+  "license": "MIT",
+  "module": "./esm/mod.js",
+  "types": "./types/mod.d.ts",
   "exports": {
     ".": {
-      "types": "./types/index.d.ts",
-      "import": "./esm/index.js"
+      "import": {
+        "types": "./types/mod.d.ts",
+        "default": "./esm/mod.js"
+      },
+      "default": {
+        "types": "./types/mod.d.ts",
+        "default": "./esm/mod.js"
+      }
     }
   },
-  "publishConfig": {
-    "access": "public"
-  },
-  "devDependencies": {
-    "@types/bun": "^1.3.14",
-    "@types/node": "^25.9.3",
-    "typescript": "^6.0.3"
+  "type": "module",
+  "engines": {
+    "node": ">=22"
   },
   "optionalDependencies": {
     "koffi": "^2.9.0"
   },
-  "engines": {
-    "node": ">=22"
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "test": "node --test esm/*.test.js",
-    "test:ffi": "node --experimental-ffi --test esm/*.test.js",
-    "test:bun": "bun test ./esm",
-    "test:deno": "deno test -A esm/*.test.js"
-  }
+  "_generatedBy": "dnt@0.44.0",
+  "scripts": {}
 }

package/types/_dnt.polyfills.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Based on [import-meta-ponyfill](https://github.com/gaubee/import-meta-ponyfill),
+ * but instead of using npm to install additional dependencies,
+ * this approach manually consolidates cjs/mjs/d.ts into a single file.
+ *
+ * Note that this code might be imported multiple times
+ * (for example, both dnt.test.polyfills.ts and dnt.polyfills.ts contain this code;
+ *  or Node.js might dynamically clear the cache and then force a require).
+ * Therefore, it's important to avoid redundant writes to global objects.
+ * Additionally, consider that commonjs is used alongside esm,
+ * so the two ponyfill functions are stored independently in two separate global objects.
+ */
+import { createRequire } from "node:module";
+import { type URL } from "node:url";
+declare global {
+    interface ImportMeta {
+        /** A string representation of the fully qualified module URL. When the
+         * module is loaded locally, the value will be a file URL (e.g.
+         * `file:///path/module.ts`).
+         *
+         * You can also parse the string as a URL to determine more information about
+         * how the current module was loaded. For example to determine if a module was
+         * local or not:
+         *
+         * ```ts
+         * const url = new URL(import.meta.url);
+         * if (url.protocol === "file:") {
+         *   console.log("this module was loaded locally");
+         * }
+         * ```
+         */
+        url: string;
+        /**
+         * A function that returns resolved specifier as if it would be imported
+         * using `import(specifier)`.
+         *
+         * ```ts
+         * console.log(import.meta.resolve("./foo.js"));
+         * // file:///dev/foo.js
+         * ```
+         *
+         * @param specifier The module specifier to resolve relative to `parent`.
+         * @param parent The absolute parent module URL to resolve from.
+         * @returns The absolute (`file:`) URL string for the resolved module.
+         */
+        resolve(specifier: string, parent?: string | URL | undefined): string;
+        /** A flag that indicates if the current module is the main module that was
+         * called when starting the program under Deno.
+         *
+         * ```ts
+         * if (import.meta.main) {
+         *   // this was loaded as the main module, maybe do some bootstrapping
+         * }
+         * ```
+         */
+        main: boolean;
+        /** The absolute path of the current module.
+         *
+         * This property is only provided for local modules (ie. using `file://` URLs).
+         *
+         * Example:
+         * ```
+         * // Unix
+         * console.log(import.meta.filename); // /home/alice/my_module.ts
+         *
+         * // Windows
+         * console.log(import.meta.filename); // C:\alice\my_module.ts
+         * ```
+         */
+        filename: string;
+        /** The absolute path of the directory containing the current module.
+         *
+         * This property is only provided for local modules (ie. using `file://` URLs).
+         *
+         * * Example:
+         * ```
+         * // Unix
+         * console.log(import.meta.dirname); // /home/alice
+         *
+         * // Windows
+         * console.log(import.meta.dirname); // C:\alice
+         * ```
+         */
+        dirname: string;
+    }
+}
+type NodeRequest = ReturnType<typeof createRequire>;
+type NodeModule = NonNullable<NodeRequest["main"]>;
+interface ImportMetaPonyfillCommonjs {
+    (require: NodeRequest, module: NodeModule): ImportMeta;
+}
+interface ImportMetaPonyfillEsmodule {
+    (importMeta: ImportMeta): ImportMeta;
+}
+interface ImportMetaPonyfill extends ImportMetaPonyfillCommonjs, ImportMetaPonyfillEsmodule {
+}
+export declare let import_meta_ponyfill_commonjs: ImportMetaPonyfillCommonjs;
+export declare let import_meta_ponyfill_esmodule: ImportMetaPonyfillEsmodule;
+export declare let import_meta_ponyfill: ImportMetaPonyfill;
+export {};

package/types/ffi_bun.d.ts

@@ -1,13 +1,13 @@
+/**
+ * Implements native Windows elevation detection through Bun FFI.
+ *
+ * @module @neotales/is-elevated/ffi_bun
+ * @internal
+ */
 /**
  * Reports whether the current process is running with elevated privileges.
  *
  * @param cache - Whether to reuse the result from the first evaluation.
  * @returns Whether the process has elevated privileges.
- * @example
- * ```ts
- * import { evalIsProcessElevated } from "./ffi_bun.js";
- *
- * const elevated = evalIsProcessElevated();
- * ```
  */
 export declare function evalIsProcessElevated(cache?: boolean): boolean;

package/types/ffi_deno.d.ts

@@ -10,7 +10,7 @@
  * @returns Whether the process has elevated privileges.
  * @example
  * ```ts
- * import { evalIsProcessElevated } from "./ffi_deno.js";
+ * import { evalIsProcessElevated } from "./ffi_deno.ts";
  *
  * const elevated = evalIsProcessElevated();
  * ```

package/types/ffi_koffi.d.ts

@@ -1,13 +1,13 @@
+/**
+ * Windows elevation through koffi, used when node:ffi is not available.
+ *
+ * @module @neotales/is-elevated/ffi_koffi
+ * @internal
+ */
 /**
  * Reports whether the current process is running with elevated privileges.
  *
  * @param cache - Whether to reuse the result from the first evaluation.
  * @returns Whether the process has elevated privileges.
- * @example
- * ```ts
- * import { evalIsProcessElevated } from "./ffi_koffi.js";
- *
- * const elevated = evalIsProcessElevated();
- * ```
  */
 export declare function evalIsProcessElevated(cache?: boolean): boolean;

package/types/ffi_node.d.ts

@@ -1,13 +1,13 @@
+/**
+ * Implements native Windows elevation detection through Node.js FFI.
+ *
+ * @module @neotales/is-elevated/ffi_node
+ * @internal
+ */
 /**
  * Reports whether the current process is running with elevated privileges.
  *
  * @param cache - Whether to reuse the result from the first evaluation.
  * @returns Whether the process has elevated privileges.
- * @example
- * ```ts
- * import { evalIsProcessElevated } from "./ffi_node.js";
- *
- * const elevated = evalIsProcessElevated();
- * ```
  */
 export declare function evalIsProcessElevated(cache?: boolean): boolean;

package/types/ffi_txiki.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Windows elevation through txiki.js `tjs:ffi`.
+ *
+ * @module @neotales/is-elevated/ffi_txiki
+ * @internal
+ */
+/**
+ * Reports whether the current process is running with elevated privileges.
+ *
+ * @param cache - Whether to reuse the result from the first evaluation.
+ * @returns Whether the process has elevated privileges.
+ */
+export declare function evalIsProcessElevated(cache?: boolean): boolean;

package/types/{index.d.ts → mod.d.ts}

@@ -1,3 +1,9 @@
+/**
+ * Detects whether the current process is running with elevated privileges.
+ *
+ * @module @neotales/is-elevated
+ */
+import "./_dnt.polyfills.js";
 /**
  * Returns whether elevation detection is available in the current runtime.
  *
@@ -11,7 +17,7 @@ export declare function isElevatedAvailable(): boolean;
  * @returns Whether the process has elevated privileges.
  * @throws {Error} On Windows when the runtime has no usable FFI backend.
  * @example
- * import { isElevated } from "@neotales/is-elevated";
+ * import { isElevated } from "jsr:@neotales/is-elevated";
  *
  * if (isElevated()) {
  *   console.log("The process is elevated.");

package/esm/index.js

@@ -1,71 +0,0 @@
-import process from "node:process";
-let elevated;
-function evalUnixElevation(cache = true) {
-    if (cache && elevated !== undefined) {
-        return elevated;
-    }
-    const uid = process.geteuid?.() ?? process.getuid?.();
-    elevated = uid === 0;
-    return elevated;
-}
-const runtime = globalThis;
-const isWindows = process.platform === "win32";
-function unsupportedNodeFfi() {
-    throw new Error("Unable to determine Windows process elevation because neither node:ffi nor koffi is available. Run Node.js >= 26 with --experimental-ffi, or install koffi with npm install koffi. See https://github.com/neotales/js-os/blob/dev/npm/is-elevated/README.md#nodejs-ffi");
-}
-function unsupportedRuntimeFfi() {
-    throw new Error("Unable to determine Windows process elevation because the runtime FFI backend is unavailable. Run Deno with --allow-ffi. See https://github.com/neotales/js-os/blob/dev/npm/is-elevated/README.md#runtime-support");
-}
-let impl = evalUnixElevation;
-let isSupported = !isWindows;
-if (isWindows) {
-    try {
-        if (runtime.Deno) {
-            impl = (await import("./ffi_deno.js")).evalIsProcessElevated;
-        }
-        else if (runtime.Bun) {
-            impl = (await import("./ffi_bun.js")).evalIsProcessElevated;
-        }
-        else {
-            try {
-                impl = (await import("./ffi_node.js")).evalIsProcessElevated;
-            }
-            catch {
-                impl = (await import("./ffi_koffi.js")).evalIsProcessElevated;
-            }
-        }
-        // A backend import can succeed while FFI permissions or DLL loading fail.
-        // Probe it once before exposing a supported evaluator.
-        impl();
-        isSupported = true;
-    }
-    catch (error) {
-        if (process.env.DEBUG === "true")
-            console.debug(error);
-        impl = runtime.Deno || runtime.Bun ? unsupportedRuntimeFfi : unsupportedNodeFfi;
-    }
-}
-/**
- * Returns whether elevation detection is available in the current runtime.
- *
- * @returns `true` when {@linkcode isElevated} can evaluate the current process.
- */
-export function isElevatedAvailable() {
-    return isSupported;
-}
-/**
- * Reports whether the current process is running with elevated privileges.
- *
- * @param cache - Whether to reuse the result from the first evaluation.
- * @returns Whether the process has elevated privileges.
- * @throws {Error} On Windows when the runtime has no usable FFI backend.
- * @example
- * import { isElevated } from "@neotales/is-elevated";
- *
- * if (isElevated()) {
- *   console.log("The process is elevated.");
- * }
- */
-export function isElevated(cache = true) {
-    return impl(cache);
-}

package/esm/index.test.js

@@ -1,39 +0,0 @@
-import { strictEqual, throws } from "node:assert/strict";
-import process from "node:process";
-import { test } from "node:test";
-import { isElevated, isElevatedAvailable } from "./index.js";
-import { evalIsProcessElevated as evalNodeIsProcessElevated } from "./node.js";
-test("isElevated returns a boolean", () => {
-    if (process.platform === "win32" && !isElevatedAvailable())
-        return;
-    strictEqual(typeof isElevated(), "boolean");
-    strictEqual(typeof isElevated(false), "boolean");
-});
-test("isElevatedAvailable returns a boolean", () => {
-    strictEqual(typeof isElevatedAvailable(), "boolean");
-});
-test("isElevated caches by default", () => {
-    if (process.platform === "win32" && !isElevatedAvailable())
-        return;
-    strictEqual(isElevated(), isElevated());
-});
-test("node evaluator returns a boolean", () => {
-    strictEqual(typeof evalNodeIsProcessElevated(), "boolean");
-    strictEqual(typeof evalNodeIsProcessElevated(false), "boolean");
-});
-test("node evaluator matches effective uid semantics on unix-like runtimes", { skip: process.platform === "win32" || (!process.geteuid && !process.getuid) }, () => {
-    strictEqual(evalNodeIsProcessElevated(false), (process.geteuid?.() ?? process.getuid?.()) === 0);
-});
-test("isElevated matches effective uid semantics on unix-like runtimes", { skip: process.platform === "win32" || (!process.geteuid && !process.getuid) }, () => {
-    strictEqual(isElevated(false), (process.geteuid?.() ?? process.getuid?.()) === 0);
-});
-test("node evaluator falls back to false when uid is unavailable", { skip: process.platform !== "win32" }, () => {
-    strictEqual(evalNodeIsProcessElevated(false), false);
-});
-test("root helper returns a boolean on Windows-specific runtimes", { skip: process.platform !== "win32" }, () => {
-    if (!isElevatedAvailable()) {
-        throws(() => isElevated(), /node:ffi nor koffi.*#nodejs-ffi/);
-        return;
-    }
-    strictEqual(typeof isElevated(false), "boolean");
-});

package/esm/node.js

@@ -1,20 +0,0 @@
-import process from "node:process";
-let elevated;
-/**
- * Reports whether the current process has an effective user ID of zero.
- *
- * @param cache - Whether to reuse the result from the first evaluation.
- * @returns Whether the process has an effective user ID of zero.
- * @example
- * import { evalIsProcessElevated } from "./node.js";
- *
- * const elevated = evalIsProcessElevated();
- */
-export function evalIsProcessElevated(cache = true) {
-    if (cache && elevated !== undefined) {
-        return elevated;
-    }
-    const uid = process.geteuid?.() ?? process.getuid?.();
-    elevated = uid === 0;
-    return elevated;
-}

package/types/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/types/node.d.ts

@@ -1,11 +0,0 @@
-/**
- * Reports whether the current process has an effective user ID of zero.
- *
- * @param cache - Whether to reuse the result from the first evaluation.
- * @returns Whether the process has an effective user ID of zero.
- * @example
- * import { evalIsProcessElevated } from "./node.js";
- *
- * const elevated = evalIsProcessElevated();
- */
-export declare function evalIsProcessElevated(cache?: boolean): boolean;