@socketsecurity/lib 6.0.2 → 6.0.4

package/dist/dlx/binary.js

@@ -1,194 +1,154 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var binary_exports = {};
-__export(binary_exports, {
-  cleanDlxCache: () => import_binary_cache2.cleanDlxCache,
-  dlxBinary: () => dlxBinary,
-  downloadBinary: () => import_binary_download2.downloadBinary,
-  downloadBinaryFile: () => import_binary_download2.downloadBinaryFile,
-  executeBinary: () => executeBinary,
-  getBinaryCacheMetadataPath: () => import_binary_cache2.getBinaryCacheMetadataPath,
-  getDlxCachePath: () => import_binary_cache2.getDlxCachePath,
-  isBinaryCacheValid: () => import_binary_cache2.isBinaryCacheValid,
-  listDlxCache: () => import_binary_cache2.listDlxCache,
-  writeBinaryCacheMetadata: () => import_binary_cache2.writeBinaryCacheMetadata
-});
-module.exports = __toCommonJS(binary_exports);
-var import_node_process = __toESM(require("node:process"));
-var import_platform = require("../constants/platform");
-var import_time = require("../constants/time");
-var import_read_json = require("../fs/read-json");
-var import_safe = require("../fs/safe");
-var import_normalize = require("../paths/normalize");
-var import_child = require("../process/spawn/child");
-var import_cache = require("./cache");
-var import_integrity = require("../integrity");
-var import_array = require("../primordials/array");
-var import_error = require("../primordials/error");
-var import_fs = require("../node/fs");
-var import_path = require("../node/path");
-var import_binary_cache = require("./binary-cache");
-var import_binary_download = require("./binary-download");
-var import_binary_cache2 = require("./binary-cache");
-var import_binary_download2 = require("./binary-download");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_primordials_error = require('../primordials/error.js');
+const require_integrity = require('../integrity.js');
+const require_constants_platform = require('../constants/platform.js');
+const require_paths_normalize = require('../paths/normalize.js');
+const require_primordials_array = require('../primordials/array.js');
+const require_node_fs = require('../node/fs.js');
+const require_node_path = require('../node/path.js');
+const require_fs_read_json = require('../fs/read-json.js');
+const require_process_spawn_child = require('../process/spawn/child.js');
+const require_fs_safe = require('../fs/safe.js');
+const require_constants_time = require('../constants/time.js');
+const require_dlx_binary_cache = require('./binary-cache.js');
+const require_dlx_cache = require('./cache.js');
+const require_dlx_binary_download = require('./binary-download.js');
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+
+//#region src/dlx/binary.ts
+/**
+* @file DLX binary execution utilities for Socket ecosystem. High-level entry
+*   points for downloading standalone URL-hosted binaries (not npm packages —
+*   see `./package` for those) and executing them with cross-platform shell
+*   handling.
+*
+*   - `dlxBinary` — download (if needed) + execute
+*   - `executeBinary` — execute an already-cached binary Supporting surface lives
+*     in sibling leaves and is re-exported here so existing `dlx/binary`
+*     importers keep working unchanged:
+*   - lazy `node:fs` / `node:path` / `node:crypto` + LRU cache — `./_internal`
+*   - types — `./binary-types`
+*   - on-disk cache metadata — `./binary-cache`
+*   - download + integrity verification — `./binary-download`
+*/
+/**
+* Download and execute a binary from a URL with caching.
+*
+* @example
+*   ;```typescript
+*   const result = await dlxBinary(['--version'], {
+*     url: 'https://example.com/tool-linux-x64',
+*     name: 'tool',
+*   })
+*   await result.spawnPromise
+*   ```
+*/
 async function dlxBinary(args, options, spawnExtra) {
-  const {
-    cacheTtl = import_time.DLX_BINARY_CACHE_TTL,
-    force: userForce = false,
-    hash,
-    integrity: rawIntegrity,
-    name,
-    sha256: rawSha256,
-    spawnOptions,
-    url,
-    yes
-  } = { __proto__: null, ...options };
-  let integrity = rawIntegrity;
-  let sha256 = rawSha256;
-  if (hash !== void 0) {
-    const normalized = (0, import_integrity.normalizeHash)(hash);
-    if (normalized.type === "integrity") {
-      integrity = normalized.value;
-    } else {
-      sha256 = normalized.value;
-    }
-  }
-  const fs = (0, import_fs.getNodeFs)();
-  const path = (0, import_path.getNodePath)();
-  const force = yes === true ? true : userForce;
-  const cacheDir = (0, import_binary_cache.getDlxCachePath)();
-  const binaryName = name || `binary-${import_node_process.default.platform}-${(0, import_platform.getArch)()}`;
-  const spec = `${url}:${binaryName}`;
-  const cacheKey = (0, import_cache.generateCacheKey)(spec);
-  const cacheEntryDir = path.join(cacheDir, cacheKey);
-  const binaryPath = (0, import_normalize.normalizePath)(path.join(cacheEntryDir, binaryName));
-  let downloaded = false;
-  let computedIntegrity = integrity;
-  if (!force && fs.existsSync(cacheEntryDir) && await (0, import_binary_cache.isBinaryCacheValid)(cacheEntryDir, cacheTtl)) {
-    try {
-      const metaPath = (0, import_binary_cache.getBinaryCacheMetadataPath)(cacheEntryDir);
-      const metadata = await (0, import_read_json.readJson)(metaPath, { throws: false });
-      if (metadata && typeof metadata === "object" && !(0, import_array.ArrayIsArray)(metadata) && typeof metadata["integrity"] === "string") {
-        computedIntegrity = metadata["integrity"];
-        if (!fs.existsSync(binaryPath)) {
-          downloaded = true;
-        }
-      } else {
-        downloaded = true;
-      }
-    } catch {
-      downloaded = true;
-    }
-  } else {
-    downloaded = true;
-  }
-  if (downloaded) {
-    try {
-      await (0, import_safe.safeMkdir)(cacheEntryDir);
-    } catch (e) {
-      const code = e.code;
-      if (code === "EACCES" || code === "EPERM") {
-        throw new import_error.ErrorCtor(
-          `Permission denied creating binary cache directory: ${cacheEntryDir}
-Please check directory permissions or run with appropriate access.`,
-          { cause: e }
-        );
-      }
-      if (code === "EROFS") {
-        throw new import_error.ErrorCtor(
-          `Cannot create binary cache directory on read-only filesystem: ${cacheEntryDir}
-Ensure the filesystem is writable or set SOCKET_DLX_DIR to a writable location.`,
-          { cause: e }
-        );
-      }
-      throw new import_error.ErrorCtor(
-        `Failed to create binary cache directory: ${cacheEntryDir}`,
-        { cause: e }
-      );
-    }
-    computedIntegrity = await (0, import_binary_download.downloadBinaryFile)(
-      url,
-      binaryPath,
-      integrity,
-      sha256
-    );
-    const stats = await fs.promises.stat(binaryPath);
-    await (0, import_binary_cache.writeBinaryCacheMetadata)(
-      cacheEntryDir,
-      cacheKey,
-      url,
-      computedIntegrity || "",
-      stats.size
-    );
-  }
-  const needsShell = import_platform.WIN32 && /\.(?:bat|cmd|ps1)$/i.test(binaryPath);
-  const finalSpawnOptions = needsShell ? {
-    ...spawnOptions,
-    env: {
-      ...spawnOptions?.env,
-      PATH: `${cacheEntryDir}${path.delimiter}${import_node_process.default.env["PATH"] || ""}`
-    },
-    shell: true
-  } : spawnOptions;
-  const spawnPromise = (0, import_child.spawn)(binaryPath, args, finalSpawnOptions, spawnExtra);
-  return {
-    binaryPath,
-    downloaded,
-    spawnPromise
-  };
+	const { cacheTtl = require_constants_time.DLX_BINARY_CACHE_TTL, force: userForce = false, hash, integrity: rawIntegrity, name, sha256: rawSha256, spawnOptions, url, yes } = {
+		__proto__: null,
+		...options
+	};
+	let integrity = rawIntegrity;
+	let sha256 = rawSha256;
+	if (hash !== void 0) {
+		const normalized = require_integrity.normalizeHash(hash);
+		if (normalized.type === "integrity") integrity = normalized.value;
+		else sha256 = normalized.value;
+	}
+	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const force = yes === true ? true : userForce;
+	const cacheDir = require_dlx_binary_cache.getDlxCachePath();
+	const binaryName = name || `binary-${node_process.default.platform}-${require_constants_platform.getArch()}`;
+	const cacheKey = require_dlx_cache.generateCacheKey(`${url}:${binaryName}`);
+	const cacheEntryDir = path.join(cacheDir, cacheKey);
+	const binaryPath = /* @__PURE__ */ require_paths_normalize.normalizePath(path.join(cacheEntryDir, binaryName));
+	let downloaded = false;
+	let computedIntegrity = integrity;
+	if (!force && fs.existsSync(cacheEntryDir) && await require_dlx_binary_cache.isBinaryCacheValid(cacheEntryDir, cacheTtl)) try {
+		const metadata = await /* @__PURE__ */ require_fs_read_json.readJson(require_dlx_binary_cache.getBinaryCacheMetadataPath(cacheEntryDir), { throws: false });
+		if (metadata && typeof metadata === "object" && !require_primordials_array.ArrayIsArray(metadata) && typeof metadata["integrity"] === "string") {
+			computedIntegrity = metadata["integrity"];
+			if (!fs.existsSync(binaryPath)) downloaded = true;
+		} else downloaded = true;
+	} catch {
+		downloaded = true;
+	}
+	else downloaded = true;
+	if (downloaded) {
+		try {
+			await require_fs_safe.safeMkdir(cacheEntryDir);
+		} catch (e) {
+			const code = e.code;
+			if (code === "EACCES" || code === "EPERM") throw new require_primordials_error.ErrorCtor(`Permission denied creating binary cache directory: ${cacheEntryDir}\nPlease check directory permissions or run with appropriate access.`, { cause: e });
+			if (code === "EROFS") throw new require_primordials_error.ErrorCtor(`Cannot create binary cache directory on read-only filesystem: ${cacheEntryDir}\nEnsure the filesystem is writable or set SOCKET_DLX_DIR to a writable location.`, { cause: e });
+			throw new require_primordials_error.ErrorCtor(`Failed to create binary cache directory: ${cacheEntryDir}`, { cause: e });
+		}
+		computedIntegrity = await require_dlx_binary_download.downloadBinaryFile(url, binaryPath, integrity, sha256);
+		const stats = await fs.promises.stat(binaryPath);
+		await require_dlx_binary_cache.writeBinaryCacheMetadata(cacheEntryDir, cacheKey, url, computedIntegrity || "", stats.size);
+	}
+	const spawnPromise = require_process_spawn_child.spawn(binaryPath, args, require_constants_platform.WIN32 && /\.(?:bat|cmd|ps1)$/i.test(binaryPath) ? {
+		...spawnOptions,
+		env: {
+			...spawnOptions?.env,
+			PATH: `${cacheEntryDir}${path.delimiter}${node_process.default.env["PATH"] || ""}`
+		},
+		shell: true
+	} : spawnOptions, spawnExtra);
+	return {
+		binaryPath,
+		downloaded,
+		spawnPromise
+	};
 }
+/**
+* Execute a cached binary without re-downloading. Similar to executePackage
+* from dlx/package. Binary must have been previously downloaded via
+* downloadBinary or dlxBinary.
+*
+* @example
+*   ;```typescript
+*   const { binaryPath } = await downloadBinary({
+*     url: 'https://example.com/tool-linux-x64',
+*     name: 'tool',
+*   })
+*   const result = executeBinary(binaryPath, ['--help'])
+*   ```
+*
+* @param binaryPath Path to the cached binary (from downloadBinary result)
+* @param args Arguments to pass to the binary.
+* @param spawnOptions Spawn options for execution.
+* @param spawnExtra Extra spawn configuration.
+*
+* @returns The spawn promise for the running process
+*/
 function executeBinary(binaryPath, args, spawnOptions, spawnExtra) {
-  const needsShell = import_platform.WIN32 && /\.(?:bat|cmd|ps1)$/i.test(binaryPath);
-  const path = (0, import_path.getNodePath)();
-  const cacheEntryDir = path.dirname(binaryPath);
-  const finalSpawnOptions = needsShell ? {
-    ...spawnOptions,
-    env: {
-      ...spawnOptions?.env,
-      PATH: `${cacheEntryDir}${path.delimiter}${import_node_process.default.env["PATH"] || ""}`
-    },
-    shell: true
-  } : spawnOptions;
-  return (0, import_child.spawn)(binaryPath, args, finalSpawnOptions, spawnExtra);
+	const needsShell = require_constants_platform.WIN32 && /\.(?:bat|cmd|ps1)$/i.test(binaryPath);
+	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const cacheEntryDir = path.dirname(binaryPath);
+	return require_process_spawn_child.spawn(binaryPath, args, needsShell ? {
+		...spawnOptions,
+		env: {
+			...spawnOptions?.env,
+			PATH: `${cacheEntryDir}${path.delimiter}${node_process.default.env["PATH"] || ""}`
+		},
+		shell: true
+	} : spawnOptions, spawnExtra);
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  cleanDlxCache,
-  dlxBinary,
-  downloadBinary,
-  downloadBinaryFile,
-  executeBinary,
-  getBinaryCacheMetadataPath,
-  getDlxCachePath,
-  isBinaryCacheValid,
-  listDlxCache,
-  writeBinaryCacheMetadata
-});
+
+//#endregion
+exports.cleanDlxCache = require_dlx_binary_cache.cleanDlxCache;
+exports.dlxBinary = dlxBinary;
+exports.downloadBinary = require_dlx_binary_download.downloadBinary;
+exports.downloadBinaryFile = require_dlx_binary_download.downloadBinaryFile;
+exports.executeBinary = executeBinary;
+exports.getBinaryCacheMetadataPath = require_dlx_binary_cache.getBinaryCacheMetadataPath;
+exports.getDlxCachePath = require_dlx_binary_cache.getDlxCachePath;
+exports.isBinaryCacheValid = require_dlx_binary_cache.isBinaryCacheValid;
+exports.listDlxCache = require_dlx_binary_cache.listDlxCache;
+exports.writeBinaryCacheMetadata = require_dlx_binary_cache.writeBinaryCacheMetadata;

package/dist/dlx/cache.js

@@ -1,33 +1,48 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var cache_exports = {};
-__export(cache_exports, {
-  generateCacheKey: () => generateCacheKey
-});
-module.exports = __toCommonJS(cache_exports);
-var import_hash = require("../crypto/hash");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_crypto_hash = require('../crypto/hash.js');
+
+//#region src/dlx/cache.ts
+/**
+* @file Cache key generation utilities for DLX package installations.
+*/
+/**
+* Generate a cache directory name using npm/npx approach. Uses first 16
+* characters of SHA-512 hash (like npm/npx).
+*
+* Rationale for SHA-512 truncated (vs full SHA-256):
+*
+* - Matches npm/npx ecosystem behavior
+* - Shorter paths for Windows MAX_PATH compatibility (260 chars)
+* - 16 hex chars = 64 bits = acceptable collision risk for local cache
+* - Collision probability ~1 in 18 quintillion with 1000 entries
+*
+* Input strategy (aligned with npx):
+*
+* - Npx uses package spec strings (e.g., '@scope/pkg@1.0.0', 'prettier@3.0.0')
+* - Caller provides complete spec string with version for accurate cache keying
+* - For package installs: Use PURL-style spec with version Examples:
+*   'npm:prettier@3.0.0', 'pypi:requests@2.31.0', 'gem:rails@7.0.0' Note:
+*   Socket uses shorthand format without 'pkg:' prefix (handled by
+*
+* @example
+*   ;```typescript
+*   const key = generateCacheKey('prettier@3.0.0')
+*   // e.g. 'a1b2c3d4e5f67890'
+*   ```
+*
+* @socketregistry/packageurl-js)
+* - For binary downloads: Use URL:name for uniqueness
+*
+* Reference: npm/cli v11.6.2 libnpmexec/lib/index.js#L233-L244
+* https://github.com/npm/cli/blob/v11.6.2/workspaces/libnpmexec/lib/index.js#L233-L244
+* Implementation: packages.map().sort().join('\n') → SHA-512 → slice(0,16) npx
+* hashes the package spec (name@version), not just name.
+*/
 function generateCacheKey(spec) {
-  return (0, import_hash.hash)("sha512", spec, "hex").substring(0, 16);
+	return (/* @__PURE__ */ require_crypto_hash.hash("sha512", spec, "hex")).substring(0, 16);
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  generateCacheKey
-});
+
+//#endregion
+exports.generateCacheKey = generateCacheKey;