@socketsecurity/lib 6.0.2 → 6.0.4

package/dist/archives/zip.js

@@ -1,124 +1,88 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var zip_exports = {};
-__export(zip_exports, {
-  extractZip: () => extractZip
-});
-module.exports = __toCommonJS(zip_exports);
-var import_safe = require("../fs/safe");
-var import_normalize = require("../paths/normalize");
-var import_array = require("../primordials/array");
-var import_error = require("../primordials/error");
-var import_map_set = require("../primordials/map-set");
-var import_promise = require("../primordials/promise");
-var import_internal = require("./_internal");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_error = require('../primordials/error.js');
+const require_paths_normalize = require('../paths/normalize.js');
+const require_primordials_array = require('../primordials/array.js');
+const require_primordials_map_set = require('../primordials/map-set.js');
+const require_node_path = require('../node/path.js');
+const require_archives__internal = require('./_internal.js');
+const require_fs_safe = require('../fs/safe.js');
+const require_primordials_promise = require('../primordials/promise.js');
+
+//#region src/archives/zip.ts
+/**
+* @file Zip extraction with security limits and path traversal validation. Uses
+*   adm-zip under the hood; pre-validates every entry before extraction so the
+*   disk-write phase can't be tricked into escaping the target directory.
+*/
+/**
+* Extract a zip archive to a directory.
+*
+* @example
+*   ;```typescript
+*   await extractZip('/tmp/archive.zip', '/tmp/output')
+*   await extractZip('/tmp/archive.zip', '/tmp/output', { strip: 1 })
+*   ```
+*
+* @param archivePath - Path to zip file.
+* @param outputDir - Directory to extract to.
+* @param options - Extraction options.
+*/
 async function extractZip(archivePath, outputDir, options = {}) {
-  (0, import_internal.assertArchiveExists)(archivePath);
-  const {
-    maxEntries = import_internal.DEFAULT_MAX_ENTRIES,
-    maxFileSize = import_internal.DEFAULT_MAX_FILE_SIZE,
-    maxTotalSize = import_internal.DEFAULT_MAX_TOTAL_SIZE,
-    strip = 0
-  } = options;
-  const normalizedOutputDir = (0, import_normalize.normalizePath)(outputDir);
-  await (0, import_safe.safeMkdir)(normalizedOutputDir);
-  const AdmZip = (0, import_internal.getAdmZip)();
-  const zip = new AdmZip(archivePath);
-  const path = (0, import_internal.getPath)();
-  const entries = zip.getEntries();
-  if (entries.length > maxEntries) {
-    throw new import_error.ErrorCtor(
-      `Archive has too many entries: ${entries.length} (limit: ${maxEntries})`
-    );
-  }
-  let totalExtractedSize = 0;
-  for (const entry of entries) {
-    if (entry.isDirectory) {
-      continue;
-    }
-    if (entry.entryName.includes("\0")) {
-      throw new import_error.ErrorCtor(
-        `Invalid null byte in archive entry name: ${entry.entryName}`
-      );
-    }
-    const uncompressedSize = entry.header.size;
-    if (uncompressedSize > maxFileSize) {
-      throw new import_error.ErrorCtor(
-        `File size exceeds limit: ${entry.entryName} (${uncompressedSize} bytes > ${maxFileSize} bytes)`
-      );
-    }
-    totalExtractedSize += uncompressedSize;
-    if (totalExtractedSize > maxTotalSize) {
-      throw new import_error.ErrorCtor(
-        `Total extracted size exceeds limit: ${totalExtractedSize} bytes > ${maxTotalSize} bytes`
-      );
-    }
-    const parts = entry.entryName.split("/");
-    if (parts.length <= strip) {
-      continue;
-    }
-    const strippedPath = (0, import_array.ArrayPrototypeSlice)(parts, strip).join("/");
-    const targetPath = path.join(normalizedOutputDir, strippedPath);
-    (0, import_internal.validatePathWithinBase)(targetPath, normalizedOutputDir, entry.entryName);
-  }
-  if (strip === 0) {
-    for (const entry of entries) {
-      if (!entry.isDirectory) {
-        const targetPath = path.join(normalizedOutputDir, entry.entryName);
-        (0, import_internal.validatePathWithinBase)(targetPath, normalizedOutputDir, entry.entryName);
-      }
-    }
-    zip.extractAllTo(normalizedOutputDir, true);
-  } else {
-    const path2 = (0, import_internal.getPath)();
-    const entries2 = zip.getEntries();
-    const dirsToCreate = new import_map_set.SetCtor();
-    for (const entry of entries2) {
-      if (entry.isDirectory) {
-        continue;
-      }
-      const parts = entry.entryName.split("/");
-      if (parts.length <= strip) {
-        continue;
-      }
-      const strippedPath = (0, import_array.ArrayPrototypeSlice)(parts, strip).join("/");
-      const targetPath = path2.join(normalizedOutputDir, strippedPath);
-      dirsToCreate.add(path2.dirname(targetPath));
-    }
-    await (0, import_promise.PromiseAll)((0, import_array.ArrayFrom)(dirsToCreate).map((dir) => (0, import_safe.safeMkdir)(dir)));
-    for (const entry of entries2) {
-      if (entry.isDirectory) {
-        continue;
-      }
-      const parts = entry.entryName.split("/");
-      if (parts.length <= strip) {
-        continue;
-      }
-      const strippedPath = (0, import_array.ArrayPrototypeSlice)(parts, strip).join("/");
-      const targetPath = path2.join(normalizedOutputDir, strippedPath);
-      zip.extractEntryTo(entry, path2.dirname(targetPath), false, true);
-    }
-  }
+	require_archives__internal.assertArchiveExists(archivePath);
+	const { maxEntries = require_archives__internal.DEFAULT_MAX_ENTRIES, maxFileSize = require_archives__internal.DEFAULT_MAX_FILE_SIZE, maxTotalSize = require_archives__internal.DEFAULT_MAX_TOTAL_SIZE, strip = 0 } = options;
+	const normalizedOutputDir = /* @__PURE__ */ require_paths_normalize.normalizePath(outputDir);
+	await require_fs_safe.safeMkdir(normalizedOutputDir);
+	const zip = new (/* @__PURE__ */ require_archives__internal.getAdmZip())(archivePath);
+	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const entries = zip.getEntries();
+	/* c8 ignore start */
+	if (entries.length > maxEntries) throw new require_primordials_error.ErrorCtor(`Archive has too many entries: ${entries.length} (limit: ${maxEntries})`);
+	/* c8 ignore stop */
+	let totalExtractedSize = 0;
+	for (const entry of entries) {
+		if (entry.isDirectory) continue;
+		/* c8 ignore start */
+		if (entry.entryName.includes("\0")) throw new require_primordials_error.ErrorCtor(`Invalid null byte in archive entry name: ${entry.entryName}`);
+		/* c8 ignore stop */
+		const uncompressedSize = entry.header.size;
+		if (uncompressedSize > maxFileSize) throw new require_primordials_error.ErrorCtor(`File size exceeds limit: ${entry.entryName} (${uncompressedSize} bytes > ${maxFileSize} bytes)`);
+		totalExtractedSize += uncompressedSize;
+		if (totalExtractedSize > maxTotalSize) throw new require_primordials_error.ErrorCtor(`Total extracted size exceeds limit: ${totalExtractedSize} bytes > ${maxTotalSize} bytes`);
+		const parts = entry.entryName.split("/");
+		if (parts.length <= strip) continue;
+		const strippedPath = require_primordials_array.ArrayPrototypeSlice(parts, strip).join("/");
+		require_archives__internal.validatePathWithinBase(path.join(normalizedOutputDir, strippedPath), normalizedOutputDir, entry.entryName);
+	}
+	/* c8 ignore start */
+	if (strip === 0) {
+		for (const entry of entries) if (!entry.isDirectory) require_archives__internal.validatePathWithinBase(path.join(normalizedOutputDir, entry.entryName), normalizedOutputDir, entry.entryName);
+		zip.extractAllTo(normalizedOutputDir, true);
+	} else {
+		const path = /* @__PURE__ */ require_node_path.getNodePath();
+		const entries = zip.getEntries();
+		const dirsToCreate = new require_primordials_map_set.SetCtor();
+		for (const entry of entries) {
+			if (entry.isDirectory) continue;
+			const parts = entry.entryName.split("/");
+			if (parts.length <= strip) continue;
+			const strippedPath = require_primordials_array.ArrayPrototypeSlice(parts, strip).join("/");
+			const targetPath = path.join(normalizedOutputDir, strippedPath);
+			dirsToCreate.add(path.dirname(targetPath));
+		}
+		await require_primordials_promise.PromiseAll(require_primordials_array.ArrayFrom(dirsToCreate).map((dir) => require_fs_safe.safeMkdir(dir)));
+		for (const entry of entries) {
+			if (entry.isDirectory) continue;
+			const parts = entry.entryName.split("/");
+			if (parts.length <= strip) continue;
+			const strippedPath = require_primordials_array.ArrayPrototypeSlice(parts, strip).join("/");
+			const targetPath = path.join(normalizedOutputDir, strippedPath);
+			zip.extractEntryTo(entry, path.dirname(targetPath), false, true);
+		}
+	}
+	/* c8 ignore stop */
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  extractZip
-});
+
+//#endregion
+exports.extractZip = extractZip;

package/dist/argv/flag-predicates.js

@@ -1,118 +1,220 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var flag_predicates_exports = {};
-__export(flag_predicates_exports, {
-  getLogLevel: () => getLogLevel,
-  isAll: () => isAll,
-  isChanged: () => isChanged,
-  isCoverage: () => isCoverage,
-  isDebug: () => isDebug,
-  isDryRun: () => isDryRun,
-  isFix: () => isFix,
-  isForce: () => isForce,
-  isHelp: () => isHelp,
-  isJson: () => isJson,
-  isQuiet: () => isQuiet,
-  isStaged: () => isStaged,
-  isUpdate: () => isUpdate,
-  isVerbose: () => isVerbose,
-  isWatch: () => isWatch,
-  makeFlagPredicate: () => makeFlagPredicate
-});
-module.exports = __toCommonJS(flag_predicates_exports);
-var import_node_process = __toESM(require("node:process"));
-var import_array = require("../primordials/array");
-const processArg = [...import_node_process.default.argv];
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_primordials_array = require('../primordials/array.js');
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+
+//#region src/argv/flag-predicates.ts
+/**
+* @file Flag predicates — `is*` checks across parsed `FlagValues`, raw
+*   `process.argv`, or no input. Split out of `argv/flags.ts` for size hygiene.
+*   Every predicate follows the same 3-branch shape, so they're built via a
+*   single `makeFlagPredicate` factory:
+*
+*   1. no input → consult the frozen `processArg` snapshot
+*   2. string[] input → `Array.includes` lookup of each flag form
+*   3. FlagValues input → boolean-coerce each key Long forms, short aliases, and
+*      `FlagValues` keys are all configurable per predicate (e.g. `isQuiet`
+*      accepts both `--quiet` and `--silent`).
+*/
+const processArg = [...node_process.default.argv];
+/**
+* Build a flag predicate that accepts `FlagValues`, `string[]`, or `undefined`
+* (in which case it consults the frozen `processArg`).
+*
+* @private
+*
+* @param longFlags - Long-form flags to match in argv arrays (e.g. `['--quiet',
+*   '--silent']`).
+* @param shortFlags - Short-form flags to match in argv arrays (e.g. `['-q']`).
+* @param keys - `FlagValues` keys to coerce when given a parsed object
+*   (defaults to the first long flag with `--` stripped).
+*/
 function makeFlagPredicate(longFlags, shortFlags = [], keys = [longFlags[0].replace(/^--/, "")]) {
-  const argvForms = [...longFlags, ...shortFlags];
-  return function check(input) {
-    if (!input) {
-      return argvForms.some((f) => processArg.includes(f));
-    }
-    if ((0, import_array.ArrayIsArray)(input)) {
-      return argvForms.some((f) => (0, import_array.ArrayPrototypeIncludes)(input, f));
-    }
-    return keys.some((k) => !!input[k]);
-  };
+	const argvForms = [...longFlags, ...shortFlags];
+	return function check(input) {
+		/* c8 ignore start */
+		if (!input) return argvForms.some((f) => processArg.includes(f));
+		/* c8 ignore stop */
+		if (require_primordials_array.ArrayIsArray(input)) return argvForms.some((f) => require_primordials_array.ArrayPrototypeIncludes(input, f));
+		return keys.some((k) => !!input[k]);
+	};
 }
+/**
+* Check if all flag is set. Accepts FlagValues object, process.argv array, or
+* undefined (uses process.argv).
+*
+* @example
+*   ;```typescript
+*   isAll({ all: true }) // true
+*   isAll(['--all']) // true
+*   ```
+*/
 const isAll = makeFlagPredicate(["--all"]);
+/**
+* Check if changed files mode is enabled.
+*
+* @example
+*   ;```typescript
+*   isChanged({ changed: true }) // true
+*   isChanged(['--changed']) // true
+*   ```
+*/
 const isChanged = makeFlagPredicate(["--changed"]);
-const isCoverage = makeFlagPredicate(
-  ["--coverage", "--cover"],
-  [],
-  ["coverage", "cover"]
-);
+/**
+* Check if coverage mode is enabled. Checks both 'coverage' and 'cover' flags.
+*
+* @example
+*   ;```typescript
+*   isCoverage({ coverage: true }) // true
+*   isCoverage(['--cover']) // true
+*   ```
+*/
+const isCoverage = makeFlagPredicate(["--coverage", "--cover"], [], ["coverage", "cover"]);
+/**
+* Check if debug mode is enabled.
+*
+* @example
+*   ;```typescript
+*   isDebug({ debug: true }) // true
+*   isDebug(['--debug']) // true
+*   ```
+*/
 const isDebug = makeFlagPredicate(["--debug"]);
+/**
+* Check if dry-run mode is enabled.
+*
+* @example
+*   ;```typescript
+*   isDryRun({ 'dry-run': true }) // true
+*   isDryRun(['--dry-run']) // true
+*   ```
+*/
 const isDryRun = makeFlagPredicate(["--dry-run"], [], ["dry-run"]);
+/**
+* Check if fix/autofix mode is enabled.
+*
+* @example
+*   ;```typescript
+*   isFix({ fix: true }) // true
+*   isFix(['--fix']) // true
+*   ```
+*/
 const isFix = makeFlagPredicate(["--fix"]);
+/**
+* Check if force mode is enabled.
+*
+* @example
+*   ;```typescript
+*   isForce({ force: true }) // true
+*   isForce(['--force']) // true
+*   ```
+*/
 const isForce = makeFlagPredicate(["--force"]);
+/**
+* Check if help flag is set.
+*
+* @example
+*   ;```typescript
+*   isHelp({ help: true }) // true
+*   isHelp(['-h']) // true
+*   ```
+*/
 const isHelp = makeFlagPredicate(["--help"], ["-h"]);
+/**
+* Check if JSON output is requested.
+*
+* @example
+*   ;```typescript
+*   isJson({ json: true }) // true
+*   isJson(['--json']) // true
+*   ```
+*/
 const isJson = makeFlagPredicate(["--json"]);
-const isQuiet = makeFlagPredicate(
-  ["--quiet", "--silent"],
-  [],
-  ["quiet", "silent"]
-);
+/**
+* Check if quiet/silent mode is enabled.
+*
+* @example
+*   ;```typescript
+*   isQuiet({ quiet: true }) // true
+*   isQuiet(['--silent']) // true
+*   ```
+*/
+const isQuiet = makeFlagPredicate(["--quiet", "--silent"], [], ["quiet", "silent"]);
+/**
+* Check if staged files mode is enabled.
+*
+* @example
+*   ;```typescript
+*   isStaged({ staged: true }) // true
+*   isStaged(['--staged']) // true
+*   ```
+*/
 const isStaged = makeFlagPredicate(["--staged"]);
+/**
+* Check if update mode is enabled (for snapshots, dependencies, etc).
+*
+* @example
+*   ;```typescript
+*   isUpdate({ update: true }) // true
+*   isUpdate(['-u']) // true
+*   ```
+*/
 const isUpdate = makeFlagPredicate(["--update"], ["-u"]);
+/**
+* Check if verbose mode is enabled.
+*
+* @example
+*   ;```typescript
+*   isVerbose({ verbose: true }) // true
+*   isVerbose(['--verbose']) // true
+*   ```
+*/
 const isVerbose = makeFlagPredicate(["--verbose"]);
+/**
+* Check if watch mode is enabled.
+*
+* @example
+*   ;```typescript
+*   isWatch({ watch: true }) // true
+*   isWatch(['-w']) // true
+*   ```
+*/
 const isWatch = makeFlagPredicate(["--watch"], ["-w"]);
+/**
+* Get the appropriate log level based on flags. Returns 'silent', 'error',
+* 'warn', 'info', 'verbose', or 'debug'.
+*
+* @example
+*   ;```typescript
+*   getLogLevel() // 'info' (default)
+*   getLogLevel({ quiet: true }) // 'silent'
+*   getLogLevel(['--debug']) // 'debug'
+*   ```
+*/
 function getLogLevel(input) {
-  if (isQuiet(input)) {
-    return "silent";
-  }
-  if (isDebug(input)) {
-    return "debug";
-  }
-  if (isVerbose(input)) {
-    return "verbose";
-  }
-  return "info";
+	if (isQuiet(input)) return "silent";
+	if (isDebug(input)) return "debug";
+	if (isVerbose(input)) return "verbose";
+	return "info";
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  getLogLevel,
-  isAll,
-  isChanged,
-  isCoverage,
-  isDebug,
-  isDryRun,
-  isFix,
-  isForce,
-  isHelp,
-  isJson,
-  isQuiet,
-  isStaged,
-  isUpdate,
-  isVerbose,
-  isWatch,
-  makeFlagPredicate
-});
+
+//#endregion
+exports.getLogLevel = getLogLevel;
+exports.isAll = isAll;
+exports.isChanged = isChanged;
+exports.isCoverage = isCoverage;
+exports.isDebug = isDebug;
+exports.isDryRun = isDryRun;
+exports.isFix = isFix;
+exports.isForce = isForce;
+exports.isHelp = isHelp;
+exports.isJson = isJson;
+exports.isQuiet = isQuiet;
+exports.isStaged = isStaged;
+exports.isUpdate = isUpdate;
+exports.isVerbose = isVerbose;
+exports.isWatch = isWatch;
+exports.makeFlagPredicate = makeFlagPredicate;