@socketsecurity/lib 6.0.2 → 6.0.4

package/dist/external-tools/uv/from-vfs.js

@@ -1,47 +1,26 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var from_vfs_exports = {};
-__export(from_vfs_exports, {
-  UV_VFS_KEY: () => UV_VFS_KEY,
-  uvFromVfs: () => uvFromVfs
-});
-module.exports = __toCommonJS(from_vfs_exports);
-var import_vfs = require("../../smol/vfs");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_smol_vfs = require('../../smol/vfs.js');
+
+//#region src/external-tools/uv/from-vfs.ts
+/**
+* @file `uvFromVfs()` — extracts the uv binary from the smol binary's VFS.
+*   Returns `undefined` when the binary doesn't have uv bundled.
+*/
 const UV_VFS_KEY = "uv";
 async function uvFromVfs() {
-  const vfs = (0, import_vfs.getSmolVfs)();
-  if (!vfs) {
-    return void 0;
-  }
-  if (!vfs.has(UV_VFS_KEY)) {
-    return void 0;
-  }
-  const realPath = await vfs.extract(UV_VFS_KEY);
-  return {
-    path: realPath,
-    source: "vfs"
-  };
+	const vfs = /* @__PURE__ */ require_smol_vfs.getSmolVfs();
+	if (!vfs) return;
+	/* c8 ignore start - smol Node binary only. */
+	if (!vfs.has("uv")) return;
+	return {
+		path: await vfs.extract("uv"),
+		source: "vfs"
+	};
+	/* c8 ignore stop */
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  UV_VFS_KEY,
-  uvFromVfs
-});
+
+//#endregion
+exports.UV_VFS_KEY = UV_VFS_KEY;
+exports.uvFromVfs = uvFromVfs;

package/dist/external-tools/uv/resolve.js

@@ -1,73 +1,52 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var resolve_exports = {};
-__export(resolve_exports, {
-  cacheKey: () => cacheKey,
-  doResolveUv: () => doResolveUv,
-  resetUvResolution: () => resetUvResolution,
-  resolveUv: () => resolveUv
-});
-module.exports = __toCommonJS(resolve_exports);
-var import_from_download = require("./from-download");
-var import_from_path = require("./from-path");
-var import_from_vfs = require("./from-vfs");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_external_tools_uv_from_download = require('./from-download.js');
+const require_external_tools_uv_from_path = require('./from-path.js');
+const require_external_tools_uv_from_vfs = require('./from-vfs.js');
+
+//#region src/external-tools/uv/resolve.ts
+/**
+* @file `resolveUv()` — uv resolution entry point. Tries each source in order:
+*
+*   1. VFS — smol binary's embedded uv (if packed)
+*   2. PATH — `uv` on the system PATH
+*   3. download — upstream GitHub release archive (only when `downloadIfMissing`
+*      is passed) Returns `undefined` if all of the enabled sources miss.
+*      Memoized per option-shape.
+*/
 const resolutionCache = /* @__PURE__ */ new Map();
 function cacheKey(opts) {
-  if (!opts?.downloadIfMissing) {
-    return "local-only";
-  }
-  const { cacheDir, integrity, platformArch, version } = opts.downloadIfMissing;
-  const integrityKey = typeof integrity === "string" ? integrity : integrity ? `${integrity.type}:${integrity.value}` : "";
-  return `dl:${version}:${platformArch}:${integrityKey}:${cacheDir ?? ""}`;
+	if (!opts?.downloadIfMissing) return "local-only";
+	const { cacheDir, integrity, platformArch, version } = opts.downloadIfMissing;
+	return `dl:${version}:${platformArch}:${typeof integrity === "string" ? integrity : integrity ? `${integrity.type}:${integrity.value}` : ""}:${cacheDir ?? ""}`;
 }
 async function doResolveUv(opts) {
-  const fromVfs = await (0, import_from_vfs.uvFromVfs)();
-  if (fromVfs) {
-    return fromVfs;
-  }
-  const fromPath = await (0, import_from_path.uvFromPath)();
-  if (fromPath) {
-    return fromPath;
-  }
-  if (opts?.downloadIfMissing) {
-    return (0, import_from_download.uvFromDownload)(opts.downloadIfMissing);
-  }
-  return void 0;
+	const fromVfs = await require_external_tools_uv_from_vfs.uvFromVfs();
+	/* c8 ignore start - smol Node binary only. */
+	if (fromVfs) return fromVfs;
+	/* c8 ignore stop */
+	const fromPath = await require_external_tools_uv_from_path.uvFromPath();
+	if (fromPath) return fromPath;
+	if (opts?.downloadIfMissing) return require_external_tools_uv_from_download.uvFromDownload(opts.downloadIfMissing);
 }
+/* c8 ignore start - test-only escape hatch. */
 function resetUvResolution() {
-  resolutionCache.clear();
+	resolutionCache.clear();
 }
+/* c8 ignore stop */
 function resolveUv(opts) {
-  const key = cacheKey(opts);
-  let cached = resolutionCache.get(key);
-  if (!cached) {
-    cached = doResolveUv(opts);
-    resolutionCache.set(key, cached);
-  }
-  return cached;
+	const key = cacheKey(opts);
+	let cached = resolutionCache.get(key);
+	if (!cached) {
+		cached = doResolveUv(opts);
+		resolutionCache.set(key, cached);
+	}
+	return cached;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  cacheKey,
-  doResolveUv,
-  resetUvResolution,
-  resolveUv
-});
+
+//#endregion
+exports.cacheKey = cacheKey;
+exports.doResolveUv = doResolveUv;
+exports.resetUvResolution = resetUvResolution;
+exports.resolveUv = resolveUv;

package/dist/external-tools/uv/types.js

@@ -1,18 +1,2 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var types_exports = {};
-module.exports = __toCommonJS(types_exports);
+/* Socket Lib - Built with rolldown */

package/dist/fs/_internal.js

@@ -1,48 +1,46 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var internal_exports = {};
-__export(internal_exports, {
-  clearAllowedDirectories: () => clearAllowedDirectories,
-  getAllowedDirectories: () => getAllowedDirectories
-});
-module.exports = __toCommonJS(internal_exports);
-var import_path = require("../node/path");
-var import_socket = require("../paths/socket");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_node_path = require('../node/path.js');
+const require_paths_socket = require('../paths/socket.js');
+
+//#region src/fs/_internal.ts
+/**
+* @file Private state shared between `fs/safe` and `fs/path-cache`. The `_`
+*   prefix keeps this module out of the generated package.json `exports` map
+*   (the `dist/**\/_*` ignore pattern in
+*   `scripts/fix/generate-package-exports.mts` filters it out), so it is not
+*   part of the public surface — it exists only to give the two leaves above a
+*   common owner for the allowed-directory cache. The cache is invalidated by
+*   `invalidatePathCache()` in `fs/path-cache.ts` whenever paths are rewired in
+*   tests (`paths/rewire.ts` registers `invalidatePathCache` as one of its
+*   cache callbacks); `getAllowedDirectories()` rehydrates on next call.
+*/
 let _cachedAllowedDirs;
+/**
+* Clear the cached allowed-directories list. Used by `invalidatePathCache()`
+* when test path rewiring changes any of the underlying paths so the next read
+* picks up the new resolved values.
+*/
 function clearAllowedDirectories() {
-  _cachedAllowedDirs = void 0;
+	_cachedAllowedDirs = void 0;
 }
+/**
+* Get resolved allowed directories for safe deletion with lazy caching. These
+* directories are resolved once and cached for the process lifetime.
+*/
 function getAllowedDirectories() {
-  if (_cachedAllowedDirs === void 0) {
-    const path = (0, import_path.getNodePath)();
-    _cachedAllowedDirs = [
-      path.resolve((0, import_socket.getOsTmpDir)()),
-      path.resolve((0, import_socket.getSocketCacacheDir)()),
-      path.resolve((0, import_socket.getSocketUserDir)())
-    ];
-  }
-  return _cachedAllowedDirs;
+	if (_cachedAllowedDirs === void 0) {
+		const path = /* @__PURE__ */ require_node_path.getNodePath();
+		_cachedAllowedDirs = [
+			path.resolve(require_paths_socket.getOsTmpDir()),
+			path.resolve(require_paths_socket.getSocketCacacheDir()),
+			path.resolve(require_paths_socket.getSocketUserDir())
+		];
+	}
+	return _cachedAllowedDirs;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  clearAllowedDirectories,
-  getAllowedDirectories
-});
+
+//#endregion
+exports.clearAllowedDirectories = clearAllowedDirectories;
+exports.getAllowedDirectories = getAllowedDirectories;

package/dist/fs/access.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @file Synchronous file-access predicates — boolean "can this process do X to
+ *   this path?" checks over `fs.accessSync`. Prefer these only where the answer
+ *   drives a user-facing decision (e.g. "is the cache dir writable, so I can
+ *   pick a fallback?"). For "I'm about to write, can I?" do NOT pre-check —
+ *   just attempt the write and handle the error; a check-then-act gap is a
+ *   TOCTOU race. `canAccess` (F_OK) overlaps `existsSync`; use `existsSync` for
+ *   plain existence, these for permission bits.
+ */
+import type { PathLike } from 'node:fs';
+/**
+ * Does the process have `mode` access to `path`? Wraps `fs.accessSync`,
+ * returning a boolean instead of throwing. Default mode is `F_OK` (existence).
+ *
+ * @param path - Path to check.
+ * @param mode - `fs.constants` bit (`F_OK` / `R_OK` / `W_OK` / `X_OK`).
+ *
+ * @returns True if the access check succeeds.
+ */
+export declare function canAccess(path: PathLike, mode?: number | undefined): boolean;
+/**
+ * Can the process execute `path`? (`X_OK`)
+ */
+export declare function canExecute(path: PathLike): boolean;
+/**
+ * Can the process read `path`? (`R_OK`)
+ */
+export declare function canRead(path: PathLike): boolean;
+/**
+ * Can the process write `path`? (`W_OK`)
+ */
+export declare function canWrite(path: PathLike): boolean;

package/dist/fs/access.js

@@ -0,0 +1,66 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_node_fs = require('../node/fs.js');
+const require_smol_path = require('../smol/path.js');
+
+//#region src/fs/access.ts
+/**
+* @file Synchronous file-access predicates — boolean "can this process do X to
+*   this path?" checks over `fs.accessSync`. Prefer these only where the answer
+*   drives a user-facing decision (e.g. "is the cache dir writable, so I can
+*   pick a fallback?"). For "I'm about to write, can I?" do NOT pre-check —
+*   just attempt the write and handle the error; a check-then-act gap is a
+*   TOCTOU race. `canAccess` (F_OK) overlaps `existsSync`; use `existsSync` for
+*   plain existence, these for permission bits.
+*/
+/**
+* Does the process have `mode` access to `path`? Wraps `fs.accessSync`,
+* returning a boolean instead of throwing. Default mode is `F_OK` (existence).
+*
+* @param path - Path to check.
+* @param mode - `fs.constants` bit (`F_OK` / `R_OK` / `W_OK` / `X_OK`).
+*
+* @returns True if the access check succeeds.
+*/
+/* @__NO_SIDE_EFFECTS__ */
+function canAccess(path, mode) {
+	/* c8 ignore start - native access arm only on socket-btm smol binaries; getSmolPath() is undefined on stock Node. */
+	const smolAccess = (/* @__PURE__ */ require_smol_path.getSmolPath())?.access;
+	if (smolAccess) return smolAccess(path, mode);
+	/* c8 ignore stop */
+	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	try {
+		fs.accessSync(path, mode);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Can the process execute `path`? (`X_OK`)
+*/
+/* @__NO_SIDE_EFFECTS__ */
+function canExecute(path) {
+	return /* @__PURE__ */ canAccess(path, (/* @__PURE__ */ require_node_fs.getNodeFs()).constants.X_OK);
+}
+/**
+* Can the process read `path`? (`R_OK`)
+*/
+/* @__NO_SIDE_EFFECTS__ */
+function canRead(path) {
+	return /* @__PURE__ */ canAccess(path, (/* @__PURE__ */ require_node_fs.getNodeFs()).constants.R_OK);
+}
+/**
+* Can the process write `path`? (`W_OK`)
+*/
+/* @__NO_SIDE_EFFECTS__ */
+function canWrite(path) {
+	return /* @__PURE__ */ canAccess(path, (/* @__PURE__ */ require_node_fs.getNodeFs()).constants.W_OK);
+}
+
+//#endregion
+exports.canAccess = canAccess;
+exports.canExecute = canExecute;
+exports.canRead = canRead;
+exports.canWrite = canWrite;

package/dist/fs/encoding.js

@@ -1,102 +1,85 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var encoding_exports = {};
-__export(encoding_exports, {
-  normalizeEncoding: () => normalizeEncoding,
-  normalizeEncodingSlow: () => normalizeEncodingSlow
-});
-module.exports = __toCommonJS(encoding_exports);
-// @__NO_SIDE_EFFECTS__
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+//#region src/fs/encoding.ts
+/**
+* Normalize encoding string to canonical form. Handles common encodings inline
+* for performance, delegates to slowCases for others.
+*
+* Based on Node.js internal/util.js normalizeEncoding implementation.
+*
+* @example
+*   ;```ts
+*   normalizeEncoding('UTF-8') // Returns 'utf8'
+*   normalizeEncoding('binary') // Returns 'latin1'
+*   normalizeEncoding('ucs-2') // Returns 'utf16le'
+*   normalizeEncoding(null) // Returns 'utf8'
+*   ```
+*
+* @param enc - Encoding to normalize (can be null/undefined)
+*
+* @returns Normalized encoding string, defaults to 'utf8'
+*
+* @see https://github.com/nodejs/node/blob/ae62b36d442b7bf987e85ae6e0df0f02cc1bb17f/lib/internal/util.js#L247-L310
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function normalizeEncoding(enc) {
-  return enc == null || enc === "utf8" || enc === "utf-8" ? "utf8" : /* @__PURE__ */ normalizeEncodingSlow(enc);
+	return enc == null || enc === "utf8" || enc === "utf-8" ? "utf8" : /* @__PURE__ */ normalizeEncodingSlow(enc);
 }
-// @__NO_SIDE_EFFECTS__
+/**
+* Move the "slow cases" to a separate function to make sure this function gets
+* inlined properly. That prioritizes the common case.
+*
+* Based on Node.js internal/util.js normalizeEncoding implementation.
+*
+* @example
+*   ;```typescript
+*   normalizeEncodingSlow('ucs2') // 'utf16le'
+*   normalizeEncodingSlow('LATIN1') // 'latin1'
+*   normalizeEncodingSlow('binary') // 'latin1'
+*   ```
+*
+* @param enc - Encoding to normalize.
+*
+* @returns Normalized encoding string, defaults to 'utf8' for unknown encodings
+*
+* @see https://github.com/nodejs/node/blob/ae62b36d442b7bf987e85ae6e0df0f02cc1bb17f/lib/internal/util.js#L247-L310
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function normalizeEncodingSlow(enc) {
-  const { length } = enc;
-  if (length === 4) {
-    if (enc === "ucs2" || enc === "UCS2") {
-      return "utf16le";
-    }
-    if (enc.toLowerCase() === "ucs2") {
-      return "utf16le";
-    }
-  } else if (length === 3 && enc === "hex" || enc === "HEX" || enc.toLowerCase() === "hex") {
-    return "hex";
-  } else if (length === 5) {
-    if (enc === "ascii") {
-      return "ascii";
-    }
-    if (enc === "ucs-2") {
-      return "utf16le";
-    }
-    if (enc === "ASCII") {
-      return "ascii";
-    }
-    if (enc === "UCS-2") {
-      return "utf16le";
-    }
-    enc = enc.toLowerCase();
-    if (enc === "ascii") {
-      return "ascii";
-    }
-    if (enc === "ucs-2") {
-      return "utf16le";
-    }
-  } else if (length === 6) {
-    if (enc === "base64") {
-      return "base64";
-    }
-    if (enc === "latin1" || enc === "binary") {
-      return "latin1";
-    }
-    if (enc === "BASE64") {
-      return "base64";
-    }
-    if (enc === "LATIN1" || enc === "BINARY") {
-      return "latin1";
-    }
-    enc = enc.toLowerCase();
-    if (enc === "base64") {
-      return "base64";
-    }
-    if (enc === "latin1" || enc === "binary") {
-      return "latin1";
-    }
-  } else if (length === 7) {
-    if (enc === "utf16le" || enc === "UTF16LE" || enc.toLowerCase() === "utf16le") {
-      return "utf16le";
-    }
-  } else if (length === 8) {
-    if (enc === "utf-16le" || enc === "UTF-16LE" || enc.toLowerCase() === "utf-16le") {
-      return "utf16le";
-    }
-  } else if (length === 9) {
-    if (enc === "base64url" || enc === "BASE64URL" || enc.toLowerCase() === "base64url") {
-      return "base64url";
-    }
-  }
-  return "utf8";
+	const { length } = enc;
+	if (length === 4) {
+		if (enc === "ucs2" || enc === "UCS2") return "utf16le";
+		if (enc.toLowerCase() === "ucs2") return "utf16le";
+	} else if (length === 3 && enc === "hex" || enc === "HEX" || enc.toLowerCase() === "hex") return "hex";
+	else if (length === 5) {
+		if (enc === "ascii") return "ascii";
+		if (enc === "ucs-2") return "utf16le";
+		if (enc === "ASCII") return "ascii";
+		if (enc === "UCS-2") return "utf16le";
+		enc = enc.toLowerCase();
+		if (enc === "ascii") return "ascii";
+		if (enc === "ucs-2") return "utf16le";
+	} else if (length === 6) {
+		if (enc === "base64") return "base64";
+		if (enc === "latin1" || enc === "binary") return "latin1";
+		if (enc === "BASE64") return "base64";
+		if (enc === "LATIN1" || enc === "BINARY") return "latin1";
+		enc = enc.toLowerCase();
+		if (enc === "base64") return "base64";
+		if (enc === "latin1" || enc === "binary") return "latin1";
+	} else if (length === 7) {
+		if (enc === "utf16le" || enc === "UTF16LE" || enc.toLowerCase() === "utf16le") return "utf16le";
+	} else if (length === 8) {
+		if (enc === "utf-16le" || enc === "UTF-16LE" || enc.toLowerCase() === "utf-16le") return "utf16le";
+	} else if (length === 9) {
+		if (enc === "base64url" || enc === "BASE64URL" || enc.toLowerCase() === "base64url") return "base64url";
+	}
+	/* c8 ignore stop */
+	return "utf8";
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  normalizeEncoding,
-  normalizeEncodingSlow
-});
+
+//#endregion
+exports.normalizeEncoding = normalizeEncoding;
+exports.normalizeEncodingSlow = normalizeEncodingSlow;