@socketsecurity/lib 5.11.1 → 5.11.3

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.11.3](https://github.com/SocketDev/socket-lib/releases/tag/v5.11.3) - 2026-03-26
+
+### Fixed
+
+- **build**: Deduplicate shared deps across external bundles (#110)
+- **quality**: Comprehensive quality scan fixes across codebase (#111)
+- **releases**: Add in-memory TTL cache for GitHub API responses
+- **releases**: Guard against missing assets in GitHub release response (#112)
+- **process-lock**: Fix Windows path separator handling for lock directory creation (#112)
+
+## [5.11.2](https://github.com/SocketDev/socket-lib/releases/tag/v5.11.2) - 2026-03-24
+
+### Added
+
+- **http-request**: Custom CA certificate support for TLS connections
+  - `httpRequest`, `httpJson`, `httpText` accept `ca` option for custom certificate authorities
+  - `httpDownload` accepts `ca` option, threaded through redirects and retries
+  - `fetchChecksums` accepts `ca` option, passed through to underlying request
+  - Enables SSL_CERT_FILE support when NODE_EXTRA_CA_CERTS is unavailable at process startup
+
 ## [5.11.1](https://github.com/SocketDev/socket-lib/releases/tag/v5.11.1) - 2026-03-24
 
 ### Added

package/dist/abort.js

@@ -51,9 +51,7 @@ function createTimeoutSignal(ms) {
   if (ms <= 0) {
     throw new TypeError("timeout must be a positive number");
   }
-  const controller = new AbortController();
-  setTimeout(() => controller.abort(), ms);
-  return controller.signal;
+  return AbortSignal.timeout(Math.ceil(ms));
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/agent.js

@@ -1,8 +1,10 @@
 "use strict";
 /* Socket Lib - Built with esbuild */
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -16,6 +18,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var agent_exports = {};
 __export(agent_exports, {
@@ -34,6 +44,7 @@ __export(agent_exports, {
   isPnpmLoglevelFlag: () => isPnpmLoglevelFlag
 });
 module.exports = __toCommonJS(agent_exports);
+var import_node_process = __toESM(require("node:process"));
 var import_agents = require("./constants/agents");
 var import_node = require("./constants/node");
 var import_platform = require("./constants/platform");
@@ -230,7 +241,7 @@ function execScript(scriptName, args, options) {
     return (0, import_spawn.spawn)(scriptName, resolvedArgs, spawnOptions);
   }
   const useNodeRun = !prepost && (0, import_node.supportsNodeRun)();
-  const cwd = (0, import_objects.getOwn)(spawnOptions, "cwd") ?? process.cwd();
+  const cwd = (0, import_objects.getOwn)(spawnOptions, "cwd") ?? import_node_process.default.cwd();
   const pnpmLockPath = (0, import_fs.findUpSync)(import_agents.PNPM_LOCK_YAML, { cwd });
   if (pnpmLockPath) {
     return execPnpm(["run", scriptName, ...resolvedArgs], spawnOptions);

package/dist/ansi.js

@@ -39,7 +39,7 @@ const ANSI_REGEX = /\x1b\[[0-9;]*m/g;
 // @__NO_SIDE_EFFECTS__
 function ansiRegex(options) {
   const { onlyFirst } = options ?? {};
-  const ST = "(?:\\u0007\\u001B\\u005C|\\u009C)";
+  const ST = "(?:\\u0007|\\u001B\\u005C|\\u009C)";
   const osc = `(?:\\u001B\\][\\s\\S]*?${ST})`;
   const csi = "[\\u001B\\u009B][[\\]()#;?]*(?:\\d{1,4}(?:[;:]\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]";
   const pattern = `${osc}|${csi}`;

package/dist/archives.js

@@ -39,6 +39,7 @@ module.exports = __toCommonJS(archives_exports);
 var import_node_fs = require("node:fs");
 var import_promises = require("node:stream/promises");
 var import_node_zlib = require("node:zlib");
+var import_node_process = __toESM(require("node:process"));
 var import_adm_zip = __toESM(require("./external/adm-zip.js"));
 var import_tar_fs = __toESM(require("./external/tar-fs.js"));
 var import_fs = require("./fs.js");
@@ -96,7 +97,7 @@ async function extractTar(archivePath, outputDir, options = {}) {
       }
       if (header.type === "symlink" || header.type === "link") {
         destroyScheduled = true;
-        process.nextTick(() => {
+        import_node_process.default.nextTick(() => {
           extractStream.destroy(
             new Error(
               `Symlink detected in archive: ${header.name}. Symlinks are not supported for security reasons.`
@@ -107,7 +108,7 @@ async function extractTar(archivePath, outputDir, options = {}) {
       }
       if (header.size && header.size > maxFileSize) {
         destroyScheduled = true;
-        process.nextTick(() => {
+        import_node_process.default.nextTick(() => {
           extractStream.destroy(
             new Error(
               `File size exceeds limit: ${header.name} (${header.size} bytes > ${maxFileSize} bytes)`
@@ -120,7 +121,7 @@ async function extractTar(archivePath, outputDir, options = {}) {
         totalExtractedSize += header.size;
         if (totalExtractedSize > maxTotalSize) {
           destroyScheduled = true;
-          process.nextTick(() => {
+          import_node_process.default.nextTick(() => {
             extractStream.destroy(
               new Error(
                 `Total extracted size exceeds limit: ${totalExtractedSize} bytes > ${maxTotalSize} bytes`
@@ -161,7 +162,7 @@ async function extractTarGz(archivePath, outputDir, options = {}) {
       }
       if (header.type === "symlink" || header.type === "link") {
         destroyScheduled = true;
-        process.nextTick(() => {
+        import_node_process.default.nextTick(() => {
           extractStream.destroy(
             new Error(
               `Symlink detected in archive: ${header.name}. Symlinks are not supported for security reasons.`
@@ -172,7 +173,7 @@ async function extractTarGz(archivePath, outputDir, options = {}) {
       }
       if (header.size && header.size > maxFileSize) {
         destroyScheduled = true;
-        process.nextTick(() => {
+        import_node_process.default.nextTick(() => {
           extractStream.destroy(
             new Error(
               `File size exceeds limit: ${header.name} (${header.size} bytes > ${maxFileSize} bytes)`
@@ -185,7 +186,7 @@ async function extractTarGz(archivePath, outputDir, options = {}) {
         totalExtractedSize += header.size;
         if (totalExtractedSize > maxTotalSize) {
           destroyScheduled = true;
-          process.nextTick(() => {
+          import_node_process.default.nextTick(() => {
             extractStream.destroy(
               new Error(
                 `Total extracted size exceeds limit: ${totalExtractedSize} bytes > ${maxTotalSize} bytes`

package/dist/argv/flags.d.ts

@@ -1,10 +1,3 @@
-/**
- * Common flag utilities for Socket CLI applications.
- * Provides consistent flag checking across all Socket projects.
- */
-/**
- * Flag values object from parsed arguments.
- */
 export interface FlagValues {
     [key: string]: unknown;
     quiet?: boolean;

package/dist/argv/flags.js

@@ -1,8 +1,10 @@
 "use strict";
 /* Socket Lib - Built with esbuild */
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -16,6 +18,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var flags_exports = {};
 __export(flags_exports, {
@@ -37,7 +47,8 @@ __export(flags_exports, {
   isWatch: () => isWatch
 });
 module.exports = __toCommonJS(flags_exports);
-const processArg = [...process.argv];
+var import_node_process = __toESM(require("node:process"));
+const processArg = [...import_node_process.default.argv];
 function getLogLevel(input) {
   if (isQuiet(input)) {
     return "silent";

package/dist/argv/parse.js

@@ -36,12 +36,13 @@ __export(parse_exports, {
   parseArgsWithDefaults: () => parseArgsWithDefaults
 });
 module.exports = __toCommonJS(parse_exports);
+var import_node_process = __toESM(require("node:process"));
 var import_yargs_parser = __toESM(require("../external/yargs-parser"));
 function parseArgs(config = {}) {
   const {
     allowNegative = false,
     allowPositionals = true,
-    args = process.argv.slice(2),
+    args = import_node_process.default.argv.slice(2),
     configuration,
     options = {},
     strict = true
@@ -142,7 +143,7 @@ const commonParseArgsConfig = {
   strict: false
 };
 function getPositionalArgs(startIndex = 2) {
-  const args = process.argv.slice(startIndex);
+  const args = import_node_process.default.argv.slice(startIndex);
   const positionals = [];
   let i = 0;
   while (i < args.length) {
@@ -155,13 +156,8 @@ function getPositionalArgs(startIndex = 2) {
   }
   return positionals;
 }
-function hasFlag(flag, argv = process.argv) {
-  const flagVariants = [
-    `--${flag}`,
-    // Short flag.
-    `-${flag.charAt(0)}`
-  ];
-  return flagVariants.some((variant) => argv.includes(variant));
+function hasFlag(flag, argv = import_node_process.default.argv) {
+  return argv.includes(`--${flag}`);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/bin.js

@@ -42,6 +42,7 @@ __export(bin_exports, {
   whichSync: () => whichSync
 });
 module.exports = __toCommonJS(bin_exports);
+var import_node_process = __toESM(require("node:process"));
 var import_home = require("./env/home");
 var import_windows = require("./env/windows");
 var import_xdg = require("./env/xdg");
@@ -135,7 +136,7 @@ function findRealBin(binName, commonPaths = []) {
 function findRealNpm() {
   const fs = /* @__PURE__ */ getFs();
   const path = /* @__PURE__ */ getPath();
-  const nodeDir = path.dirname(process.execPath);
+  const nodeDir = path.dirname(import_node_process.default.execPath);
   const npmInNodeDir = path.join(nodeDir, "npm");
   if (fs.existsSync(npmInNodeDir)) {
     return npmInNodeDir;

package/dist/cache-with-ttl.js

@@ -90,9 +90,16 @@ function createTtlCache(options) {
     }
     const cacheEntry = await cacache.safeGet(fullKey);
     if (cacheEntry) {
-      const entry = JSON.parse(
-        cacheEntry.data.toString("utf8")
-      );
+      let entry;
+      try {
+        entry = JSON.parse(cacheEntry.data.toString("utf8"));
+      } catch {
+        try {
+          await cacache.remove(fullKey);
+        } catch {
+        }
+        return void 0;
+      }
       if (!isExpired(entry)) {
         if (opts.memoize) {
           memoCache.set(fullKey, entry);

package/dist/constants/node.js

@@ -1,8 +1,10 @@
 "use strict";
 /* Socket Lib - Built with esbuild */
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -16,6 +18,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var node_exports = {};
 __export(node_exports, {
@@ -41,8 +51,9 @@ __export(node_exports, {
   supportsProcessSend: () => supportsProcessSend
 });
 module.exports = __toCommonJS(node_exports);
+var import_node_process = __toESM(require("node:process"));
 var import_maintained_node_versions = require("./maintained-node-versions");
-const NODE_VERSION = process.version;
+const NODE_VERSION = import_node_process.default.version;
 function getNodeVersion() {
   return NODE_VERSION;
 }
@@ -105,7 +116,7 @@ function getNodeDisableSigusr1Flags() {
   return _nodeDisableSigusr1Flags;
 }
 function supportsProcessSend() {
-  return typeof process.send === "function";
+  return typeof import_node_process.default.send === "function";
 }
 let _nodeHardenFlags;
 let _nodePermissionFlags;
@@ -152,7 +163,7 @@ function getNodeNoWarningsFlags() {
   return _nodeNoWarningsFlags;
 }
 function getExecPath() {
-  return process.execPath;
+  return import_node_process.default.execPath;
 }
 const NODE_SEA_FUSE = "NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2";
 const ESNEXT = "esnext";

package/dist/cover/code.js

@@ -1,8 +1,10 @@
 "use strict";
 /* Socket Lib - Built with esbuild */
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -16,12 +18,21 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var code_exports = {};
 __export(code_exports, {
   getCodeCoverage: () => getCodeCoverage
 });
 module.exports = __toCommonJS(code_exports);
+var import_node_process = __toESM(require("node:process"));
 var import_fs = require("../fs");
 var import_objects = require("../objects");
 var import_spawn = require("../spawn");
@@ -45,7 +56,7 @@ async function getCodeCoverage(options) {
   const path = /* @__PURE__ */ getPath();
   const opts = {
     __proto__: null,
-    coveragePath: path.join(process.cwd(), "coverage/coverage-final.json"),
+    coveragePath: path.join(import_node_process.default.cwd(), "coverage/coverage-final.json"),
     generateIfMissing: false,
     ...options
   };
@@ -58,7 +69,7 @@ async function getCodeCoverage(options) {
   if (!coverageExists) {
     if (generateIfMissing) {
       await (0, import_spawn.spawn)("vitest", ["run", "--coverage"], {
-        cwd: process.cwd(),
+        cwd: import_node_process.default.cwd(),
         stdio: "inherit"
       });
     } else {

package/dist/cover/type.js

@@ -1,8 +1,10 @@
 "use strict";
 /* Socket Lib - Built with esbuild */
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -16,17 +18,26 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var type_exports = {};
 __export(type_exports, {
   getTypeCoverage: () => getTypeCoverage
 });
 module.exports = __toCommonJS(type_exports);
+var import_node_process = __toESM(require("node:process"));
 var import_spawn = require("../spawn");
 async function getTypeCoverage(options) {
   const opts = {
     __proto__: null,
-    cwd: process.cwd(),
+    cwd: import_node_process.default.cwd(),
     generateIfMissing: false,
     ...options
   };

package/dist/dlx/binary.js

@@ -1,8 +1,10 @@
 "use strict";
 /* Socket Lib - Built with esbuild */
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -16,6 +18,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var binary_exports = {};
 __export(binary_exports, {
@@ -31,6 +41,7 @@ __export(binary_exports, {
   writeBinaryCacheMetadata: () => writeBinaryCacheMetadata
 });
 module.exports = __toCommonJS(binary_exports);
+var import_node_process = __toESM(require("node:process"));
 var import_platform = require("../constants/platform");
 var import_time = require("../constants/time");
 var import_cache = require("./cache");
@@ -120,7 +131,7 @@ async function dlxBinary(args, options, spawnExtra) {
   const path = /* @__PURE__ */ getPath();
   const force = yes === true ? true : userForce;
   const cacheDir = getDlxCachePath();
-  const binaryName = name || `binary-${process.platform}-${(0, import_platform.getArch)()}`;
+  const binaryName = name || `binary-${import_node_process.default.platform}-${(0, import_platform.getArch)()}`;
   const spec = `${url}:${binaryName}`;
   const cacheKey = (0, import_cache.generateCacheKey)(spec);
   const cacheEntryDir = path.join(cacheDir, cacheKey);
@@ -189,7 +200,7 @@ Ensure the filesystem is writable or set SOCKET_DLX_DIR to a writable location.`
     ...spawnOptions,
     env: {
       ...spawnOptions?.env,
-      PATH: `${cacheEntryDir}${(/* @__PURE__ */ getPath()).delimiter}${process.env["PATH"] || ""}`
+      PATH: `${cacheEntryDir}${(/* @__PURE__ */ getPath()).delimiter}${import_node_process.default.env["PATH"] || ""}`
     },
     shell: true
   } : spawnOptions;
@@ -212,7 +223,7 @@ async function downloadBinary(options) {
   const fs = /* @__PURE__ */ getFs();
   const path = /* @__PURE__ */ getPath();
   const cacheDir = getDlxCachePath();
-  const binaryName = name || `binary-${process.platform}-${(0, import_platform.getArch)()}`;
+  const binaryName = name || `binary-${import_node_process.default.platform}-${(0, import_platform.getArch)()}`;
   const spec = `${url}:${binaryName}`;
   const cacheKey = (0, import_cache.generateCacheKey)(spec);
   const cacheEntryDir = path.join(cacheDir, cacheKey);
@@ -321,7 +332,7 @@ function executeBinary(binaryPath, args, spawnOptions, spawnExtra) {
     ...spawnOptions,
     env: {
       ...spawnOptions?.env,
-      PATH: `${cacheEntryDir}${path.delimiter}${process.env["PATH"] || ""}`
+      PATH: `${cacheEntryDir}${path.delimiter}${import_node_process.default.env["PATH"] || ""}`
     },
     shell: true
   } : spawnOptions;
@@ -414,7 +425,7 @@ async function writeBinaryCacheMetadata(cacheEntryPath, cacheKey, url, integrity
     }
   };
   const fs = /* @__PURE__ */ getFs();
-  const tmpPath = `${metaPath}.tmp.${process.pid}`;
+  const tmpPath = `${metaPath}.tmp.${import_node_process.default.pid}`;
   await fs.promises.writeFile(tmpPath, JSON.stringify(metadata, null, 2));
   await fs.promises.rename(tmpPath, metaPath);
 }

package/dist/dlx/manifest.js

@@ -45,6 +45,8 @@ function getPath() {
   }
   return _path;
 }
+const fs = /* @__PURE__ */ getFs();
+const path = /* @__PURE__ */ getPath();
 const logger = (0, import_logger.getDefaultLogger)();
 const MANIFEST_FILE_NAME = ".dlx-manifest.json";
 function isBinaryEntry(entry) {
@@ -57,7 +59,7 @@ class DlxManifest {
   manifestPath;
   lockPath;
   constructor(options = {}) {
-    this.manifestPath = options.manifestPath ?? (/* @__PURE__ */ getPath()).join((0, import_socket.getSocketDlxDir)(), MANIFEST_FILE_NAME);
+    this.manifestPath = options.manifestPath ?? path.join((0, import_socket.getSocketDlxDir)(), MANIFEST_FILE_NAME);
     this.lockPath = `${this.manifestPath}.lock`;
   }
   /**
@@ -66,7 +68,7 @@ class DlxManifest {
    */
   readManifest() {
     try {
-      if (!(/* @__PURE__ */ getFs()).existsSync(this.manifestPath)) {
+      if (!fs.existsSync(this.manifestPath)) {
         return /* @__PURE__ */ Object.create(null);
       }
       const rawContent = (0, import_fs.readFileUtf8Sync)(this.manifestPath);
@@ -87,7 +89,7 @@ class DlxManifest {
    * @private
    */
   async writeManifest(data) {
-    const manifestDir = (/* @__PURE__ */ getPath()).dirname(this.manifestPath);
+    const manifestDir = path.dirname(this.manifestPath);
     try {
       (0, import_fs.safeMkdirSync)(manifestDir, { recursive: true });
     } catch (error) {
@@ -98,18 +100,12 @@ class DlxManifest {
     const content = JSON.stringify(data, null, 2);
     const tempPath = `${this.manifestPath}.tmp`;
     try {
-      (/* @__PURE__ */ getFs()).writeFileSync(tempPath, content, "utf8");
-      (/* @__PURE__ */ getFs()).writeFileSync(this.manifestPath, content, "utf8");
-      try {
-        if ((/* @__PURE__ */ getFs()).existsSync(tempPath)) {
-          (/* @__PURE__ */ getFs()).unlinkSync(tempPath);
-        }
-      } catch {
-      }
+      fs.writeFileSync(tempPath, content, "utf8");
+      fs.renameSync(tempPath, this.manifestPath);
     } catch (error) {
       try {
-        if ((/* @__PURE__ */ getFs()).existsSync(tempPath)) {
-          (/* @__PURE__ */ getFs()).unlinkSync(tempPath);
+        if (fs.existsSync(tempPath)) {
+          fs.unlinkSync(tempPath);
         }
       } catch {
       }
@@ -122,17 +118,16 @@ class DlxManifest {
   async clear(name) {
     await import_process_lock.processLock.withLock(this.lockPath, async () => {
       try {
-        if (!(/* @__PURE__ */ getFs()).existsSync(this.manifestPath)) {
+        if (!fs.existsSync(this.manifestPath)) {
           return;
         }
-        const content = (/* @__PURE__ */ getFs()).readFileSync(this.manifestPath, "utf8");
+        const content = fs.readFileSync(this.manifestPath, "utf8");
         if (!content.trim()) {
           return;
         }
         const data = JSON.parse(content);
         delete data[name];
-        const updatedContent = JSON.stringify(data, null, 2);
-        (/* @__PURE__ */ getFs()).writeFileSync(this.manifestPath, updatedContent, "utf8");
+        await this.writeManifest(data);
       } catch (error) {
         logger.warn(
           `Failed to clear cache for ${name}: ${error instanceof Error ? error.message : String(error)}`
@@ -146,8 +141,8 @@ class DlxManifest {
   async clearAll() {
     await import_process_lock.processLock.withLock(this.lockPath, async () => {
       try {
-        if ((/* @__PURE__ */ getFs()).existsSync(this.manifestPath)) {
-          (/* @__PURE__ */ getFs()).unlinkSync(this.manifestPath);
+        if (fs.existsSync(this.manifestPath)) {
+          fs.unlinkSync(this.manifestPath);
         }
       } catch (error) {
         logger.warn(
@@ -173,7 +168,7 @@ class DlxManifest {
    */
   getAllPackages() {
     try {
-      if (!(/* @__PURE__ */ getFs()).existsSync(this.manifestPath)) {
+      if (!fs.existsSync(this.manifestPath)) {
         return [];
       }
       const rawContent = (0, import_fs.readFileUtf8Sync)(this.manifestPath);
@@ -219,8 +214,8 @@ class DlxManifest {
     await import_process_lock.processLock.withLock(this.lockPath, async () => {
       let data = /* @__PURE__ */ Object.create(null);
       try {
-        if ((/* @__PURE__ */ getFs()).existsSync(this.manifestPath)) {
-          const content2 = (/* @__PURE__ */ getFs()).readFileSync(this.manifestPath, "utf8");
+        if (fs.existsSync(this.manifestPath)) {
+          const content2 = fs.readFileSync(this.manifestPath, "utf8");
           if (content2.trim()) {
             data = JSON.parse(content2);
           }
@@ -231,7 +226,7 @@ class DlxManifest {
         );
       }
       data[name] = record;
-      const manifestDir = (/* @__PURE__ */ getPath()).dirname(this.manifestPath);
+      const manifestDir = path.dirname(this.manifestPath);
       try {
         (0, import_fs.safeMkdirSync)(manifestDir, { recursive: true });
       } catch (error) {
@@ -242,18 +237,12 @@ class DlxManifest {
       const content = JSON.stringify(data, null, 2);
       const tempPath = `${this.manifestPath}.tmp`;
       try {
-        (/* @__PURE__ */ getFs()).writeFileSync(tempPath, content, "utf8");
-        (/* @__PURE__ */ getFs()).writeFileSync(this.manifestPath, content, "utf8");
-        try {
-          if ((/* @__PURE__ */ getFs()).existsSync(tempPath)) {
-            (/* @__PURE__ */ getFs()).unlinkSync(tempPath);
-          }
-        } catch {
-        }
+        fs.writeFileSync(tempPath, content, "utf8");
+        fs.renameSync(tempPath, this.manifestPath);
       } catch (error) {
         try {
-          if ((/* @__PURE__ */ getFs()).existsSync(tempPath)) {
-            (/* @__PURE__ */ getFs()).unlinkSync(tempPath);
+          if (fs.existsSync(tempPath)) {
+            fs.unlinkSync(tempPath);
           }
         } catch {
         }