@socketsecurity/lib 5.28.0 → 6.0.0

package/dist/dlx/binary.js

@@ -30,101 +30,40 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var binary_exports = {};
 __export(binary_exports, {
-  cleanDlxCache: () => cleanDlxCache,
+  cleanDlxCache: () => import_binary_cache2.cleanDlxCache,
   dlxBinary: () => dlxBinary,
-  downloadBinary: () => downloadBinary,
-  downloadBinaryFile: () => downloadBinaryFile,
+  downloadBinary: () => import_binary_download2.downloadBinary,
+  downloadBinaryFile: () => import_binary_download2.downloadBinaryFile,
   executeBinary: () => executeBinary,
-  getBinaryCacheMetadataPath: () => getBinaryCacheMetadataPath,
-  getDlxCachePath: () => getDlxCachePath,
-  isBinaryCacheValid: () => isBinaryCacheValid,
-  listDlxCache: () => listDlxCache,
-  writeBinaryCacheMetadata: () => writeBinaryCacheMetadata
+  getBinaryCacheMetadataPath: () => import_binary_cache2.getBinaryCacheMetadataPath,
+  getDlxCachePath: () => import_binary_cache2.getDlxCachePath,
+  isBinaryCacheValid: () => import_binary_cache2.isBinaryCacheValid,
+  listDlxCache: () => import_binary_cache2.listDlxCache,
+  writeBinaryCacheMetadata: () => import_binary_cache2.writeBinaryCacheMetadata
 });
 module.exports = __toCommonJS(binary_exports);
 var import_node_process = __toESM(require("node:process"));
 var import_platform = require("../constants/platform");
 var import_time = require("../constants/time");
-var import_fs = require("../fs");
-var import_http_request = require("../http-request");
-var import_objects = require("../objects");
+var import_read_json = require("../fs/read-json");
+var import_safe = require("../fs/safe");
 var import_normalize = require("../paths/normalize");
-var import_socket = require("../paths/socket");
-var import_process_lock = require("../process-lock");
-var import_spawn = require("../spawn");
-var import_crypto = require("../crypto");
+var import_spawn = require("../spawn/spawn");
 var import_cache = require("./cache");
-var import_integrity = require("./integrity");
-var import_primordials = require("../primordials");
-let _crypto;
-// @__NO_SIDE_EFFECTS__
-function getCrypto() {
-  if (_crypto === void 0) {
-    _crypto = require("node:crypto");
-  }
-  return _crypto;
-}
-let _fs;
-// @__NO_SIDE_EFFECTS__
-function getFs() {
-  if (_fs === void 0) {
-    _fs = require("node:fs");
-  }
-  return _fs;
-}
-let _path;
-// @__NO_SIDE_EFFECTS__
-function getPath() {
-  if (_path === void 0) {
-    _path = require("node:path");
-  }
-  return _path;
-}
-async function cleanDlxCache(maxAge = import_time.DLX_BINARY_CACHE_TTL) {
-  const cacheDir = getDlxCachePath();
-  const fs = /* @__PURE__ */ getFs();
-  if (!fs.existsSync(cacheDir)) {
-    return 0;
-  }
-  let cleaned = 0;
-  const now = (0, import_primordials.DateNow)();
-  const path = /* @__PURE__ */ getPath();
-  const entries = await fs.promises.readdir(cacheDir);
-  for (const entry of entries) {
-    const entryPath = path.join(cacheDir, entry);
-    const metaPath = getBinaryCacheMetadataPath(entryPath);
-    try {
-      if (!await (0, import_fs.isDir)(entryPath)) {
-        continue;
-      }
-      const metadata = await (0, import_fs.readJson)(metaPath, { throws: false });
-      if (!metadata || typeof metadata !== "object" || (0, import_primordials.ArrayIsArray)(metadata)) {
-        continue;
-      }
-      const timestamp = metadata["timestamp"];
-      const age = typeof timestamp === "number" && timestamp > 0 ? now - timestamp : Number.POSITIVE_INFINITY;
-      if (age < 0 || age > maxAge) {
-        await (0, import_fs.safeDelete)(entryPath, { force: true, recursive: true });
-        cleaned += 1;
-      }
-    } catch {
-      try {
-        const contents = await fs.promises.readdir(entryPath);
-        if (!contents.length) {
-          await (0, import_fs.safeDelete)(entryPath);
-          cleaned += 1;
-        }
-      } catch {
-      }
-    }
-  }
-  return cleaned;
-}
+var import_integrity = require("../integrity");
+var import_array = require("../primordials/array");
+var import_error = require("../primordials/error");
+var import_fs = require("../node/fs");
+var import_path = require("../node/path");
+var import_binary_cache = require("./binary-cache");
+var import_binary_download = require("./binary-download");
+var import_binary_cache2 = require("./binary-cache");
+var import_binary_download2 = require("./binary-download");
 async function dlxBinary(args, options, spawnExtra) {
   const {
     cacheTtl = import_time.DLX_BINARY_CACHE_TTL,
     force: userForce = false,
-    hash: hash2,
+    hash,
     integrity: rawIntegrity,
     name,
     sha256: rawSha256,
@@ -134,18 +73,18 @@ async function dlxBinary(args, options, spawnExtra) {
   } = { __proto__: null, ...options };
   let integrity = rawIntegrity;
   let sha256 = rawSha256;
-  if (hash2 !== void 0) {
-    const normalized = (0, import_integrity.normalizeHash)(hash2);
+  if (hash !== void 0) {
+    const normalized = (0, import_integrity.normalizeHash)(hash);
     if (normalized.type === "integrity") {
       integrity = normalized.value;
     } else {
       sha256 = normalized.value;
     }
   }
-  const fs = /* @__PURE__ */ getFs();
-  const path = /* @__PURE__ */ getPath();
+  const fs = (0, import_fs.getNodeFs)();
+  const path = (0, import_path.getNodePath)();
   const force = yes === true ? true : userForce;
-  const cacheDir = getDlxCachePath();
+  const cacheDir = (0, import_binary_cache.getDlxCachePath)();
   const binaryName = name || `binary-${import_node_process.default.platform}-${(0, import_platform.getArch)()}`;
   const spec = `${url}:${binaryName}`;
   const cacheKey = (0, import_cache.generateCacheKey)(spec);
@@ -153,11 +92,11 @@ async function dlxBinary(args, options, spawnExtra) {
   const binaryPath = (0, import_normalize.normalizePath)(path.join(cacheEntryDir, binaryName));
   let downloaded = false;
   let computedIntegrity = integrity;
-  if (!force && fs.existsSync(cacheEntryDir) && await isBinaryCacheValid(cacheEntryDir, cacheTtl)) {
+  if (!force && fs.existsSync(cacheEntryDir) && await (0, import_binary_cache.isBinaryCacheValid)(cacheEntryDir, cacheTtl)) {
     try {
-      const metaPath = getBinaryCacheMetadataPath(cacheEntryDir);
-      const metadata = await (0, import_fs.readJson)(metaPath, { throws: false });
-      if (metadata && typeof metadata === "object" && !(0, import_primordials.ArrayIsArray)(metadata) && typeof metadata["integrity"] === "string") {
+      const metaPath = (0, import_binary_cache.getBinaryCacheMetadataPath)(cacheEntryDir);
+      const metadata = await (0, import_read_json.readJson)(metaPath, { throws: false });
+      if (metadata && typeof metadata === "object" && !(0, import_array.ArrayIsArray)(metadata) && typeof metadata["integrity"] === "string") {
         computedIntegrity = metadata["integrity"];
         if (!fs.existsSync(binaryPath)) {
           downloaded = true;
@@ -173,36 +112,36 @@ async function dlxBinary(args, options, spawnExtra) {
   }
   if (downloaded) {
     try {
-      await (0, import_fs.safeMkdir)(cacheEntryDir);
+      await (0, import_safe.safeMkdir)(cacheEntryDir);
     } catch (e) {
       const code = e.code;
       if (code === "EACCES" || code === "EPERM") {
-        throw new import_primordials.ErrorCtor(
+        throw new import_error.ErrorCtor(
           `Permission denied creating binary cache directory: ${cacheEntryDir}
 Please check directory permissions or run with appropriate access.`,
           { cause: e }
         );
       }
       if (code === "EROFS") {
-        throw new import_primordials.ErrorCtor(
+        throw new import_error.ErrorCtor(
           `Cannot create binary cache directory on read-only filesystem: ${cacheEntryDir}
 Ensure the filesystem is writable or set SOCKET_DLX_DIR to a writable location.`,
           { cause: e }
         );
       }
-      throw new import_primordials.ErrorCtor(
+      throw new import_error.ErrorCtor(
         `Failed to create binary cache directory: ${cacheEntryDir}`,
         { cause: e }
       );
     }
-    computedIntegrity = await downloadBinaryFile(
+    computedIntegrity = await (0, import_binary_download.downloadBinaryFile)(
       url,
       binaryPath,
       integrity,
       sha256
     );
     const stats = await fs.promises.stat(binaryPath);
-    await writeBinaryCacheMetadata(
+    await (0, import_binary_cache.writeBinaryCacheMetadata)(
       cacheEntryDir,
       cacheKey,
       url,
@@ -215,7 +154,7 @@ Ensure the filesystem is writable or set SOCKET_DLX_DIR to a writable location.`
     ...spawnOptions,
     env: {
       ...spawnOptions?.env,
-      PATH: `${cacheEntryDir}${(/* @__PURE__ */ getPath()).delimiter}${import_node_process.default.env["PATH"] || ""}`
+      PATH: `${cacheEntryDir}${path.delimiter}${import_node_process.default.env["PATH"] || ""}`
     },
     shell: true
   } : spawnOptions;
@@ -226,137 +165,9 @@ Ensure the filesystem is writable or set SOCKET_DLX_DIR to a writable location.`
     spawnPromise
   };
 }
-async function downloadBinary(options) {
-  const {
-    cacheTtl = import_time.DLX_BINARY_CACHE_TTL,
-    force = false,
-    hash: hash2,
-    integrity: rawIntegrity,
-    name,
-    sha256: rawSha256,
-    url
-  } = { __proto__: null, ...options };
-  let integrity = rawIntegrity;
-  let sha256 = rawSha256;
-  if (hash2 !== void 0) {
-    const normalized = (0, import_integrity.normalizeHash)(hash2);
-    if (normalized.type === "integrity") {
-      integrity = normalized.value;
-    } else {
-      sha256 = normalized.value;
-    }
-  }
-  const fs = /* @__PURE__ */ getFs();
-  const path = /* @__PURE__ */ getPath();
-  const cacheDir = getDlxCachePath();
-  const binaryName = name || `binary-${import_node_process.default.platform}-${(0, import_platform.getArch)()}`;
-  const spec = `${url}:${binaryName}`;
-  const cacheKey = (0, import_cache.generateCacheKey)(spec);
-  const cacheEntryDir = path.join(cacheDir, cacheKey);
-  const binaryPath = (0, import_normalize.normalizePath)(path.join(cacheEntryDir, binaryName));
-  let downloaded = false;
-  if (!force && fs.existsSync(cacheEntryDir) && await isBinaryCacheValid(cacheEntryDir, cacheTtl)) {
-    downloaded = false;
-  } else {
-    try {
-      await (0, import_fs.safeMkdir)(cacheEntryDir);
-    } catch (e) {
-      const code = e.code;
-      if (code === "EACCES" || code === "EPERM") {
-        throw new import_primordials.ErrorCtor(
-          `Permission denied creating binary cache directory: ${cacheEntryDir}
-Please check directory permissions or run with appropriate access.`,
-          { cause: e }
-        );
-      }
-      if (code === "EROFS") {
-        throw new import_primordials.ErrorCtor(
-          `Cannot create binary cache directory on read-only filesystem: ${cacheEntryDir}
-Ensure the filesystem is writable or set SOCKET_DLX_DIR to a writable location.`,
-          { cause: e }
-        );
-      }
-      throw new import_primordials.ErrorCtor(
-        `Failed to create binary cache directory: ${cacheEntryDir}`,
-        { cause: e }
-      );
-    }
-    const computedIntegrity = await downloadBinaryFile(
-      url,
-      binaryPath,
-      integrity,
-      sha256
-    );
-    const stats = await fs.promises.stat(binaryPath);
-    await writeBinaryCacheMetadata(
-      cacheEntryDir,
-      cacheKey,
-      url,
-      computedIntegrity || "",
-      stats.size
-    );
-    downloaded = true;
-  }
-  return {
-    binaryPath,
-    downloaded
-  };
-}
-async function downloadBinaryFile(url, destPath, integrity, sha256) {
-  const crypto = /* @__PURE__ */ getCrypto();
-  const fs = /* @__PURE__ */ getFs();
-  const path = /* @__PURE__ */ getPath();
-  const cacheEntryDir = path.dirname(destPath);
-  const lockPath = path.join(cacheEntryDir, "concurrency.lock");
-  return await import_process_lock.processLock.withLock(
-    lockPath,
-    async () => {
-      if (fs.existsSync(destPath)) {
-        const stats = await fs.promises.stat(destPath);
-        if (stats.size > 0) {
-          const fileBuffer2 = await fs.promises.readFile(destPath);
-          return `sha512-${(0, import_crypto.hash)("sha512", fileBuffer2, "base64")}`;
-        }
-      }
-      try {
-        await (0, import_http_request.httpDownload)(url, destPath, sha256 ? { sha256 } : void 0);
-      } catch (e) {
-        throw new Error(
-          `Failed to download binary from ${url}
-Destination: ${destPath}
-Check your internet connection or verify the URL is accessible.`,
-          { cause: e }
-        );
-      }
-      const fileBuffer = await fs.promises.readFile(destPath);
-      const actualIntegrity = `sha512-${(0, import_crypto.hash)("sha512", fileBuffer, "base64")}`;
-      if (integrity) {
-        const integrityMatch = actualIntegrity.length === integrity.length && crypto.timingSafeEqual(
-          Buffer.from(actualIntegrity),
-          Buffer.from(integrity)
-        );
-        if (!integrityMatch) {
-          await (0, import_fs.safeDelete)(destPath);
-          throw new Error(
-            `Integrity mismatch: expected ${integrity}, got ${actualIntegrity}`
-          );
-        }
-      }
-      if (!import_platform.WIN32) {
-        await fs.promises.chmod(destPath, 493);
-      }
-      return actualIntegrity;
-    },
-    {
-      // Align with npm npx locking strategy.
-      staleMs: 5e3,
-      touchIntervalMs: 2e3
-    }
-  );
-}
 function executeBinary(binaryPath, args, spawnOptions, spawnExtra) {
   const needsShell = import_platform.WIN32 && /\.(?:bat|cmd|ps1)$/i.test(binaryPath);
-  const path = /* @__PURE__ */ getPath();
+  const path = (0, import_path.getNodePath)();
   const cacheEntryDir = path.dirname(binaryPath);
   const finalSpawnOptions = needsShell ? {
     ...spawnOptions,
@@ -368,98 +179,6 @@ function executeBinary(binaryPath, args, spawnOptions, spawnExtra) {
   } : spawnOptions;
   return (0, import_spawn.spawn)(binaryPath, args, finalSpawnOptions, spawnExtra);
 }
-function getBinaryCacheMetadataPath(cacheEntryPath) {
-  return (/* @__PURE__ */ getPath()).join(cacheEntryPath, ".dlx-metadata.json");
-}
-const getDlxCachePath = import_socket.getSocketDlxDir;
-async function isBinaryCacheValid(cacheEntryPath, cacheTtl) {
-  const fs = /* @__PURE__ */ getFs();
-  try {
-    const metaPath = getBinaryCacheMetadataPath(cacheEntryPath);
-    if (!fs.existsSync(metaPath)) {
-      return false;
-    }
-    const metadata = await (0, import_fs.readJson)(metaPath, { throws: false });
-    if (!(0, import_objects.isObjectObject)(metadata)) {
-      return false;
-    }
-    const now = (0, import_primordials.DateNow)();
-    const timestamp = metadata["timestamp"];
-    if (typeof timestamp !== "number" || timestamp <= 0) {
-      return false;
-    }
-    const age = now - timestamp;
-    if (age < 0) {
-      return false;
-    }
-    return age < cacheTtl;
-  } catch {
-    return false;
-  }
-}
-async function listDlxCache() {
-  const cacheDir = getDlxCachePath();
-  const fs = /* @__PURE__ */ getFs();
-  if (!fs.existsSync(cacheDir)) {
-    return [];
-  }
-  const results = [];
-  const now = (0, import_primordials.DateNow)();
-  const path = /* @__PURE__ */ getPath();
-  const entries = await fs.promises.readdir(cacheDir);
-  for (const entry of entries) {
-    const entryPath = path.join(cacheDir, entry);
-    try {
-      if (!await (0, import_fs.isDir)(entryPath)) {
-        continue;
-      }
-      const metaPath = getBinaryCacheMetadataPath(entryPath);
-      const metadata = await (0, import_fs.readJson)(metaPath, { throws: false });
-      if (!metadata || typeof metadata !== "object" || (0, import_primordials.ArrayIsArray)(metadata)) {
-        continue;
-      }
-      const metaObj = metadata;
-      const source = metaObj["source"];
-      const url = source?.["url"] || metaObj["url"] || "";
-      const files = await fs.promises.readdir(entryPath);
-      const binaryFile = (0, import_primordials.ArrayPrototypeFind)(
-        files,
-        (f) => !(0, import_primordials.StringPrototypeStartsWith)(f, ".")
-      );
-      if (binaryFile) {
-        const binaryPath = path.join(entryPath, binaryFile);
-        const binaryStats = await fs.promises.stat(binaryPath);
-        results.push({
-          age: now - (metaObj["timestamp"] || 0),
-          integrity: metaObj["integrity"] || "",
-          name: binaryFile,
-          size: binaryStats.size,
-          url
-        });
-      }
-    } catch {
-    }
-  }
-  return results;
-}
-async function writeBinaryCacheMetadata(cacheEntryPath, cacheKey, url, integrity, size) {
-  const metaPath = getBinaryCacheMetadataPath(cacheEntryPath);
-  const metadata = {
-    version: "1.0.0",
-    cache_key: cacheKey,
-    timestamp: (0, import_primordials.DateNow)(),
-    integrity,
-    size,
-    source: {
-      type: "download",
-      url
-    }
-  };
-  const fs = /* @__PURE__ */ getFs();
-  const tmpPath = `${metaPath}.tmp.${import_node_process.default.pid}`;
-  await fs.promises.writeFile(tmpPath, JSON.stringify(metadata, null, 2));
-  await fs.promises.rename(tmpPath, metaPath);
-}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   cleanDlxCache,

package/dist/dlx/cache.d.ts

@@ -1,32 +1,37 @@
-/** @fileoverview Cache key generation utilities for DLX package installations. */
 /**
- * Generate a cache directory name using npm/npx approach.
- * Uses first 16 characters of SHA-512 hash (like npm/npx).
+ * @file Cache key generation utilities for DLX package installations.
+ */
+/**
+ * Generate a cache directory name using npm/npx approach. Uses first 16
+ * characters of SHA-512 hash (like npm/npx).
  *
  * Rationale for SHA-512 truncated (vs full SHA-256):
+ *
  * - Matches npm/npx ecosystem behavior
  * - Shorter paths for Windows MAX_PATH compatibility (260 chars)
  * - 16 hex chars = 64 bits = acceptable collision risk for local cache
  * - Collision probability ~1 in 18 quintillion with 1000 entries
  *
  * Input strategy (aligned with npx):
- * - npx uses package spec strings (e.g., '@scope/pkg@1.0.0', 'prettier@3.0.0')
+ *
+ * - Npx uses package spec strings (e.g., '@scope/pkg@1.0.0', 'prettier@3.0.0')
  * - Caller provides complete spec string with version for accurate cache keying
- * - For package installs: Use PURL-style spec with version
- *   Examples: 'npm:prettier@3.0.0', 'pypi:requests@2.31.0', 'gem:rails@7.0.0'
- *   Note: Socket uses shorthand format without 'pkg:' prefix
- *   (handled by @socketregistry/packageurl-js)
+ * - For package installs: Use PURL-style spec with version Examples:
+ *   'npm:prettier@3.0.0', 'pypi:requests@2.31.0', 'gem:rails@7.0.0' Note:
+ *   Socket uses shorthand format without 'pkg:' prefix (handled by
+ *
+ * @example
+ *   ;```typescript
+ *   const key = generateCacheKey('prettier@3.0.0')
+ *   // e.g. 'a1b2c3d4e5f67890'
+ *   ```
+ *
+ * @socketregistry/packageurl-js)
  * - For binary downloads: Use URL:name for uniqueness
  *
  * Reference: npm/cli v11.6.2 libnpmexec/lib/index.js#L233-L244
  * https://github.com/npm/cli/blob/v11.6.2/workspaces/libnpmexec/lib/index.js#L233-L244
- * Implementation: packages.map().sort().join('\n') → SHA-512 → slice(0,16)
- * npx hashes the package spec (name@version), not just name
- *
- * @example
- * ```typescript
- * const key = generateCacheKey('prettier@3.0.0')
- * // e.g. 'a1b2c3d4e5f67890'
- * ```
+ * Implementation: packages.map().sort().join('\n') → SHA-512 → slice(0,16) npx
+ * hashes the package spec (name@version), not just name.
  */
 export declare function generateCacheKey(spec: string): string;

package/dist/dlx/cache.js

@@ -23,9 +23,9 @@ __export(cache_exports, {
   generateCacheKey: () => generateCacheKey
 });
 module.exports = __toCommonJS(cache_exports);
-var import_crypto = require("../crypto");
+var import_hash = require("../crypto/hash");
 function generateCacheKey(spec) {
-  return (0, import_crypto.hash)("sha512", spec, "hex").substring(0, 16);
+  return (0, import_hash.hash)("sha512", spec, "hex").substring(0, 16);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {