@socketsecurity/lib 6.0.3 → 6.0.5

package/dist/constants/node.js

@@ -1,194 +1,253 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var node_exports = {};
-__export(node_exports, {
-  ESNEXT: () => ESNEXT,
-  NODE_SEA_FUSE: () => NODE_SEA_FUSE,
-  getExecPath: () => getExecPath,
-  getMaintainedNodeVersions: () => getMaintainedNodeVersions,
-  getNodeDisableSigusr1Flags: () => getNodeDisableSigusr1Flags,
-  getNodeHardenFlags: () => getNodeHardenFlags,
-  getNodeMajorVersion: () => getNodeMajorVersion,
-  getNodeMinorVersion: () => getNodeMinorVersion,
-  getNodeNoWarningsFlags: () => getNodeNoWarningsFlags,
-  getNodePatchVersion: () => getNodePatchVersion,
-  getNodePermissionFlags: () => getNodePermissionFlags,
-  getNodeVersion: () => getNodeVersion,
-  supportsNodeCompileCacheApi: () => supportsNodeCompileCacheApi,
-  supportsNodeCompileCacheEnvVar: () => supportsNodeCompileCacheEnvVar,
-  supportsNodeDisableSigusr1Flag: () => supportsNodeDisableSigusr1Flag,
-  supportsNodeDisableWarningFlag: () => supportsNodeDisableWarningFlag,
-  supportsNodePermissionFlag: () => supportsNodePermissionFlag,
-  supportsNodeRequireModule: () => supportsNodeRequireModule,
-  supportsNodeRun: () => supportsNodeRun,
-  supportsProcessSend: () => supportsProcessSend
-});
-module.exports = __toCommonJS(node_exports);
-var import_node_process = __toESM(require("node:process"));
-var import_maintained_node_versions = require("./maintained-node-versions");
-var import_number = require("../primordials/number");
-const NODE_VERSION = import_node_process.default.version;
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_primordials_number = require('../primordials/number.js');
+const require_constants_maintained_node_versions = require('./maintained-node-versions.js');
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+
+//#region src/constants/node.ts
+/**
+* @file Node.js runtime version and capability helpers. Provides getters for
+*   the current Node version (major/minor/patch), the maintained-versions list,
+*   and feature-detection flags for APIs that vary across Node releases.
+*/
+const NODE_VERSION = node_process.default.version;
 let _nodeDisableSigusr1Flags;
 let _nodeHardenFlags;
 let _nodeNoWarningsFlags;
 let _nodePermissionFlags;
+/**
+* Get the absolute path to the currently running Node.js binary.
+*
+* @returns The value of `process.execPath`.
+*/
 function getExecPath() {
-  return import_node_process.default.execPath;
+	return node_process.default.execPath;
 }
+/**
+* Get the list of Node.js major versions currently under long-term support.
+*
+* @returns The static `maintainedNodeVersions` array shared across the library.
+*/
 function getMaintainedNodeVersions() {
-  return import_maintained_node_versions.maintainedNodeVersions;
-}
+	return require_constants_maintained_node_versions.maintainedNodeVersions;
+}
+/**
+* Get the flags used to block Node.js debugger attachment via SIGUSR1. Returns
+* `['--disable-sigusr1']` on runtimes that support it and falls back to
+* `['--no-inspect']` on older versions.
+*
+* @returns A non-empty array of CLI flags suitable for passing to `node`.
+*/
 function getNodeDisableSigusr1Flags() {
-  if (_nodeDisableSigusr1Flags === void 0) {
-    _nodeDisableSigusr1Flags = supportsNodeDisableSigusr1Flag() ? ["--disable-sigusr1"] : ["--no-inspect"];
-  }
-  return _nodeDisableSigusr1Flags;
-}
+	if (_nodeDisableSigusr1Flags === void 0)
+ /* c8 ignore start - --no-inspect fallback fires only on Node
+	runtimes pre-v22.14 / v23.7 / v24.8; tests run on Node 24+. */
+	_nodeDisableSigusr1Flags = supportsNodeDisableSigusr1Flag() ? ["--disable-sigusr1"] : ["--no-inspect"];
+	return _nodeDisableSigusr1Flags;
+}
+/**
+* Get the hardening flags Socket applies when spawning Node.js subprocesses.
+* Always includes `--disable-proto=delete`. Also adds `--permission` plus the
+* grants from {@link getNodePermissionFlags} on Node 24+,
+* `--experimental-permission` on Node 20-23, and
+* `--force-node-api-uncaught-exceptions-policy` on Node 22+.
+*
+* @returns A non-empty array of CLI flags suitable for passing to `node`.
+*/
 function getNodeHardenFlags() {
-  if (_nodeHardenFlags === void 0) {
-    const major = getNodeMajorVersion();
-    const flags = ["--disable-proto=delete"];
-    if (major >= 24) {
-      flags.push("--permission");
-      flags.push(...getNodePermissionFlags());
-    } else if (major >= 20) {
-      flags.push("--experimental-permission");
-    }
-    if (major >= 22) {
-      flags.push("--force-node-api-uncaught-exceptions-policy");
-    }
-    _nodeHardenFlags = flags;
-  }
-  return _nodeHardenFlags;
-}
+	if (_nodeHardenFlags === void 0) {
+		const major = getNodeMajorVersion();
+		const flags = ["--disable-proto=delete"];
+		if (major >= 24) {
+			flags.push("--permission");
+			flags.push(...getNodePermissionFlags());
+		} else if (major >= 20) flags.push("--experimental-permission");
+		/* c8 ignore stop */
+		/* c8 ignore start */
+		if (major >= 22) flags.push("--force-node-api-uncaught-exceptions-policy");
+		/* c8 ignore stop */
+		_nodeHardenFlags = flags;
+	}
+	return _nodeHardenFlags;
+}
+/**
+* Get the major component of the current Node.js version.
+*
+* @returns The major version number, or `0` if it cannot be parsed.
+*/
 function getNodeMajorVersion() {
-  const major = NODE_VERSION.slice(1).split(".")[0] ?? "0";
-  return (0, import_number.NumberParseInt)(major, 10) || 0;
-}
+	return require_primordials_number.NumberParseInt(NODE_VERSION.slice(1).split(".")[0] ?? "0", 10) || 0;
+	/* c8 ignore stop */
+}
+/**
+* Get the minor component of the current Node.js version.
+*
+* @returns The minor version number, or `0` if it cannot be parsed.
+*/
 function getNodeMinorVersion() {
-  return (0, import_number.NumberParseInt)(NODE_VERSION.split(".")[1] ?? "0", 10);
-}
+	/* c8 ignore start */
+	return require_primordials_number.NumberParseInt(NODE_VERSION.split(".")[1] ?? "0", 10);
+	/* c8 ignore stop */
+}
+/**
+* Get the flags that silence Node.js runtime warnings and deprecation notices.
+* Always returns `['--no-warnings', '--no-deprecation']` across all versions.
+*
+* @returns A non-empty array of CLI flags suitable for passing to `node`.
+*/
 function getNodeNoWarningsFlags() {
-  if (_nodeNoWarningsFlags === void 0) {
-    _nodeNoWarningsFlags = ["--no-warnings", "--no-deprecation"];
-  }
-  return _nodeNoWarningsFlags;
-}
+	if (_nodeNoWarningsFlags === void 0) _nodeNoWarningsFlags = ["--no-warnings", "--no-deprecation"];
+	return _nodeNoWarningsFlags;
+}
+/**
+* Get the patch component of the current Node.js version.
+*
+* @returns The patch version number, or `0` if it cannot be parsed.
+*/
 function getNodePatchVersion() {
-  return (0, import_number.NumberParseInt)(NODE_VERSION.split(".")[2] ?? "0", 10);
-}
+	/* c8 ignore start */
+	return require_primordials_number.NumberParseInt(NODE_VERSION.split(".")[2] ?? "0", 10);
+	/* c8 ignore stop */
+}
+/**
+* Get the permission-grant flags needed to run npm under Node.js 24+'s
+* `--permission` model. The array is non-empty only on Node.js 24+ and includes
+* `--allow-fs-read=*`, `--allow-fs-write=*`, and `--allow-child-process`. Older
+* versions return an empty array.
+*
+* @returns The permission flag list (possibly empty) for the current runtime.
+*/
 function getNodePermissionFlags() {
-  if (_nodePermissionFlags === void 0) {
-    const major = getNodeMajorVersion();
-    if (major >= 24) {
-      _nodePermissionFlags = [
-        // Allow reading from the entire filesystem (npm needs to read package.json, node_modules, etc.).
-        "--allow-fs-read=*",
-        // Allow writing to the entire filesystem (npm needs to write to node_modules, cache, etc.).
-        "--allow-fs-write=*",
-        // Allow spawning child processes (npm needs to run lifecycle scripts, git, etc.).
-        "--allow-child-process"
-      ];
-    } else {
-      _nodePermissionFlags = [];
-    }
-  }
-  return _nodePermissionFlags;
-}
+	if (_nodePermissionFlags === void 0) if (getNodeMajorVersion() >= 24) _nodePermissionFlags = [
+		"--allow-fs-read=*",
+		"--allow-fs-write=*",
+		"--allow-child-process"
+	];
+	else _nodePermissionFlags = [];
+	return _nodePermissionFlags;
+}
+/**
+* Get the full Node.js version string from `process.version`.
+*
+* @returns The runtime version, including the leading `v` (e.g. `v22.11.0`).
+*/
 function getNodeVersion() {
-  return NODE_VERSION;
-}
+	return NODE_VERSION;
+}
+/**
+* Check whether the current runtime exposes the `module.enableCompileCache()`
+* API. The API is available on Node.js 24+.
+*
+* @returns `true` when the current runtime is Node.js 24 or newer.
+*/
 function supportsNodeCompileCacheApi() {
-  const major = getNodeMajorVersion();
-  return major >= 24;
-}
+	return getNodeMajorVersion() >= 24;
+}
+/**
+* Check whether the current runtime honors the `NODE_COMPILE_CACHE` env var.
+* Env-var-based compile caching is available on Node.js 22+.
+*
+* @returns `true` when the current runtime is Node.js 22 or newer.
+*/
 function supportsNodeCompileCacheEnvVar() {
-  const major = getNodeMajorVersion();
-  return major >= 22;
-}
+	return getNodeMajorVersion() >= 22;
+}
+/**
+* Check whether the current runtime supports the `--disable-sigusr1` CLI flag.
+* Flag landed in v22.14.0 and v23.7.0 and was stabilized in v22.20.0 /
+* v24.8.0.
+*
+* @returns `true` when the runtime exposes `--disable-sigusr1`.
+*/
 function supportsNodeDisableSigusr1Flag() {
-  const major = getNodeMajorVersion();
-  const minor = getNodeMinorVersion();
-  if (major >= 24) {
-    return minor >= 8;
-  }
-  if (major === 23) {
-    return minor >= 7;
-  }
-  if (major === 22) {
-    return minor >= 14;
-  }
-  return false;
-}
+	const major = getNodeMajorVersion();
+	const minor = getNodeMinorVersion();
+	/* c8 ignore start */
+	if (major >= 24) return minor >= 8;
+	/* c8 ignore stop */
+	/* c8 ignore start - Version-specific arms; tests run on a single
+	Node major. Each branch fires only on its target major. */
+	if (major === 23) return minor >= 7;
+	if (major === 22) return minor >= 14;
+	return false;
+	/* c8 ignore stop */
+}
+/**
+* Check whether the current runtime supports the `--disable-warning` CLI flag.
+* The flag is available on Node.js 21+.
+*
+* @returns `true` when the current runtime is Node.js 21 or newer.
+*/
 function supportsNodeDisableWarningFlag() {
-  const major = getNodeMajorVersion();
-  return major >= 21;
-}
+	return getNodeMajorVersion() >= 21;
+}
+/**
+* Check whether the current runtime supports the permission model CLI flags
+* (`--experimental-permission` on Node 20-23, `--permission` on Node 24+).
+*
+* @returns `true` when the current runtime is Node.js 20 or newer.
+*/
 function supportsNodePermissionFlag() {
-  const major = getNodeMajorVersion();
-  return major >= 20;
-}
+	return getNodeMajorVersion() >= 20;
+}
+/**
+* Check whether `require()` can synchronously load ESM modules. Requires
+* Node.js 22.12+ or Node.js 23+.
+*
+* @returns `true` when the runtime supports `require()`-ing ES modules.
+*/
 function supportsNodeRequireModule() {
-  const major = getNodeMajorVersion();
-  return major >= 23 || major === 22 && getNodeMinorVersion() >= 12;
-}
+	const major = getNodeMajorVersion();
+	/* c8 ignore start */
+	return major >= 23 || major === 22 && getNodeMinorVersion() >= 12;
+	/* c8 ignore stop */
+}
+/**
+* Check whether the current runtime supports `node --run <script>`. Requires
+* Node.js 22.11+ or Node.js 23+.
+*
+* @returns `true` when the runtime can execute package.json scripts via
+*   `--run`.
+*/
 function supportsNodeRun() {
-  const major = getNodeMajorVersion();
-  return major >= 23 || major === 22 && getNodeMinorVersion() >= 11;
-}
+	const major = getNodeMajorVersion();
+	/* c8 ignore start */
+	return major >= 23 || major === 22 && getNodeMinorVersion() >= 11;
+	/* c8 ignore stop */
+}
+/**
+* Check whether this process was spawned with an IPC channel. When `true`,
+* `process.send()` is callable to message the parent process.
+*
+* @returns `true` when the current process has an IPC channel to its parent.
+*/
 function supportsProcessSend() {
-  return typeof import_node_process.default.send === "function";
+	return typeof node_process.default.send === "function";
 }
 const ESNEXT = "esnext";
 const NODE_SEA_FUSE = "NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2";
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  ESNEXT,
-  NODE_SEA_FUSE,
-  getExecPath,
-  getMaintainedNodeVersions,
-  getNodeDisableSigusr1Flags,
-  getNodeHardenFlags,
-  getNodeMajorVersion,
-  getNodeMinorVersion,
-  getNodeNoWarningsFlags,
-  getNodePatchVersion,
-  getNodePermissionFlags,
-  getNodeVersion,
-  supportsNodeCompileCacheApi,
-  supportsNodeCompileCacheEnvVar,
-  supportsNodeDisableSigusr1Flag,
-  supportsNodeDisableWarningFlag,
-  supportsNodePermissionFlag,
-  supportsNodeRequireModule,
-  supportsNodeRun,
-  supportsProcessSend
-});
+
+//#endregion
+exports.ESNEXT = ESNEXT;
+exports.NODE_SEA_FUSE = NODE_SEA_FUSE;
+exports.getExecPath = getExecPath;
+exports.getMaintainedNodeVersions = getMaintainedNodeVersions;
+exports.getNodeDisableSigusr1Flags = getNodeDisableSigusr1Flags;
+exports.getNodeHardenFlags = getNodeHardenFlags;
+exports.getNodeMajorVersion = getNodeMajorVersion;
+exports.getNodeMinorVersion = getNodeMinorVersion;
+exports.getNodeNoWarningsFlags = getNodeNoWarningsFlags;
+exports.getNodePatchVersion = getNodePatchVersion;
+exports.getNodePermissionFlags = getNodePermissionFlags;
+exports.getNodeVersion = getNodeVersion;
+exports.supportsNodeCompileCacheApi = supportsNodeCompileCacheApi;
+exports.supportsNodeCompileCacheEnvVar = supportsNodeCompileCacheEnvVar;
+exports.supportsNodeDisableSigusr1Flag = supportsNodeDisableSigusr1Flag;
+exports.supportsNodeDisableWarningFlag = supportsNodeDisableWarningFlag;
+exports.supportsNodePermissionFlag = supportsNodePermissionFlag;
+exports.supportsNodeRequireModule = supportsNodeRequireModule;
+exports.supportsNodeRun = supportsNodeRun;
+exports.supportsProcessSend = supportsProcessSend;

package/dist/constants/package-default-node-range.js

@@ -1,42 +1,17 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var package_default_node_range_exports = {};
-__export(package_default_node_range_exports, {
-  packageDefaultNodeRange: () => packageDefaultNodeRange
-});
-module.exports = __toCommonJS(package_default_node_range_exports);
-var import_maintained_node_versions = require("./maintained-node-versions");
-var semver = __toESM(require("../external/semver"));
-const packageDefaultNodeRange = `>=${semver.parse(import_maintained_node_versions.maintainedNodeVersions.last).major}`;
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  packageDefaultNodeRange
-});
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_constants_maintained_node_versions = require('./maintained-node-versions.js');
+let src_external_semver = require("../external/semver");
+src_external_semver = require_runtime.__toESM(src_external_semver);
+
+//#region src/constants/package-default-node-range.ts
+/**
+* @file Default Node.js version range for packages.
+*/
+/* c8 ignore next - External semver call */
+const packageDefaultNodeRange = `>=${src_external_semver.parse(require_constants_maintained_node_versions.maintainedNodeVersions.last).major}`;
+
+//#endregion
+exports.packageDefaultNodeRange = packageDefaultNodeRange;

package/dist/constants/package-default-socket-categories.js

@@ -1,31 +1,13 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var package_default_socket_categories_exports = {};
-__export(package_default_socket_categories_exports, {
-  packageDefaultSocketCategories: () => packageDefaultSocketCategories
-});
-module.exports = __toCommonJS(package_default_socket_categories_exports);
-var import_object = require("../primordials/object");
-const packageDefaultSocketCategories = (0, import_object.ObjectFreeze)(["cleanup"]);
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  packageDefaultSocketCategories
-});
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_object = require('../primordials/object.js');
+
+//#region src/constants/package-default-socket-categories.ts
+/**
+* @file Default Socket security categories for packages.
+*/
+const packageDefaultSocketCategories = require_primordials_object.ObjectFreeze(["cleanup"]);
+
+//#endregion
+exports.packageDefaultSocketCategories = packageDefaultSocketCategories;