@socketsecurity/lib 6.0.5 → 6.0.7

package/dist/packages/edit-class.js

@@ -24,7 +24,7 @@ let src_external__npmcli_package_json_lib_sort = require("../external/@npmcli/pa
 *
 *   - `getEditablePackageJsonClass` — lazy class accessor (Webpack-safe)
 */
-let _EditablePackageJsonClass;
+let cachedEditablePackageJsonClass;
 /**
 * Get the EditablePackageJson class for package.json manipulation.
 *
@@ -35,9 +35,8 @@ let _EditablePackageJsonClass;
 *   console.log(pkg.content.name)
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
 function getEditablePackageJsonClass() {
-	if (_EditablePackageJsonClass === void 0) _EditablePackageJsonClass = class EditablePackageJson extends src_external__npmcli_package_json.default {
+	if (cachedEditablePackageJsonClass === void 0) cachedEditablePackageJsonClass = class EditablePackageJson extends src_external__npmcli_package_json.default {
 		static fixSteps = src_external__npmcli_package_json.default.fixSteps;
 		static normalizeSteps = src_external__npmcli_package_json.default.normalizeSteps;
 		static prepareSteps = src_external__npmcli_package_json.default.prepareSteps;
@@ -52,20 +51,20 @@ function getEditablePackageJsonClass() {
 			const path = this._path;
 			if (!path) return "";
 			if (require_primordials_string.StringPrototypeEndsWith(path, "package.json")) return path;
-			return (/* @__PURE__ */ require_node_path.getNodePath()).join(path, "package.json");
+			return require_node_path.getNodePath().join(path, "package.json");
 		}
 		static async create(path, opts = {}) {
-			const p = new _EditablePackageJsonClass();
+			const p = new cachedEditablePackageJsonClass();
 			await p.create(path);
 			return opts.data ? p.update(opts.data) : p;
 		}
 		static async fix(path, opts) {
-			const p = new _EditablePackageJsonClass();
+			const p = new cachedEditablePackageJsonClass();
 			await p.load(path, true);
 			return await p.fix(opts);
 		}
 		static async load(path, opts = {}) {
-			const p = new _EditablePackageJsonClass();
+			const p = new cachedEditablePackageJsonClass();
 			if (!opts.create) return await p.load(path);
 			try {
 				return await p.load(path);
@@ -75,12 +74,12 @@ function getEditablePackageJsonClass() {
 			}
 		}
 		static async normalize(path, opts) {
-			const p = new _EditablePackageJsonClass();
+			const p = new cachedEditablePackageJsonClass();
 			await p.load(path);
 			return await p.normalize(opts);
 		}
 		static async prepare(path, opts) {
-			const p = new _EditablePackageJsonClass();
+			const p = new cachedEditablePackageJsonClass();
 			await p.load(path, true);
 			return await p.prepare(opts);
 		}
@@ -104,7 +103,7 @@ function getEditablePackageJsonClass() {
 		}
 		async load(path, create) {
 			this._path = path;
-			const { promises: fsPromises } = /* @__PURE__ */ require_node_fs.getNodeFs();
+			const { promises: fsPromises } = require_node_fs.getNodeFs();
 			let parseErr;
 			try {
 				this._readFileContent = await (0, src_external__npmcli_package_json_lib_read_package.read)(this.filename);
@@ -113,7 +112,7 @@ function getEditablePackageJsonClass() {
 				parseErr = e;
 			}
 			if (parseErr) {
-				const indexFile = (/* @__PURE__ */ require_node_path.getNodePath()).resolve(this.path || "", "index.js");
+				const indexFile = require_node_path.getNodePath().resolve(this.path || "", "index.js");
 				let indexFileContent;
 				try {
 					indexFileContent = await fsPromises.readFile(indexFile, "utf8");
@@ -151,7 +150,7 @@ function getEditablePackageJsonClass() {
 			})) return false;
 			const content = require_json_format.stripFormattingSymbols(this.content);
 			const fileContent = require_json_format.stringifyWithFormatting(options?.sort ? (0, src_external__npmcli_package_json_lib_sort.packageSort)(content) : content, require_json_format.getFormattingFromContent(this.content));
-			const { promises: fsPromises } = /* @__PURE__ */ require_node_fs.getNodeFs();
+			const { promises: fsPromises } = require_node_fs.getNodeFs();
 			await fsPromises.writeFile(this.filename, fileContent);
 			this._readFileContent = fileContent;
 			this._readFileJson = (0, src_external__npmcli_package_json_lib_read_package.parse)(fileContent);
@@ -165,12 +164,12 @@ function getEditablePackageJsonClass() {
 			};
 			const { [Symbol.for("indent")]: indent, [Symbol.for("newline")]: newline, ...rest } = this.content;
 			const content = sort ? (0, src_external__npmcli_package_json_lib_sort.packageSort)(rest) : rest;
-			if (ignoreWhitespace && (/* @__PURE__ */ require_node_util.getNodeUtil()).isDeepStrictEqual(content, this._readFileJson)) return false;
+			if (ignoreWhitespace && require_node_util.getNodeUtil().isDeepStrictEqual(content, this._readFileJson)) return false;
 			const format = indent === void 0 || indent === null ? "  " : indent;
 			const eol = newline === void 0 || newline === null ? "\n" : newline;
 			const fileContent = `${require_primordials_json.JSONStringify(content, void 0, format)}\n`.replace(/\n/g, eol);
 			if (!ignoreWhitespace && fileContent.trim() === this._readFileContent.trim()) return false;
-			(/* @__PURE__ */ require_node_fs.getNodeFs()).writeFileSync(this.filename, fileContent);
+			require_node_fs.getNodeFs().writeFileSync(this.filename, fileContent);
 			this._readFileContent = fileContent;
 			this._readFileJson = (0, src_external__npmcli_package_json_lib_read_package.parse)(fileContent);
 			return true;
@@ -187,7 +186,7 @@ function getEditablePackageJsonClass() {
 			if (!this._canSave || this.content === void 0) return false;
 			const { [Symbol.for("indent")]: indent, [Symbol.for("newline")]: newline, ...rest } = this.content;
 			const content = sort ? (0, src_external__npmcli_package_json_lib_sort.packageSort)(rest) : rest;
-			if (ignoreWhitespace && (/* @__PURE__ */ require_node_util.getNodeUtil()).isDeepStrictEqual(content, this._readFileJson)) return false;
+			if (ignoreWhitespace && require_node_util.getNodeUtil().isDeepStrictEqual(content, this._readFileJson)) return false;
 			const format = indent === void 0 || indent === null ? "  " : indent;
 			const eol = newline === void 0 || newline === null ? "\n" : newline;
 			const fileContent = `${require_primordials_json.JSONStringify(content, void 0, format)}\n`.replace(/\n/g, eol);
@@ -195,7 +194,7 @@ function getEditablePackageJsonClass() {
 			return true;
 		}
 	};
-	return _EditablePackageJsonClass;
+	return cachedEditablePackageJsonClass;
 }
 
 //#endregion

package/dist/packages/edit.js

@@ -3,9 +3,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_paths_predicates = require('../paths/predicates.js');
 const require_primordials_json = require('../primordials/json.js');
-const require_packages_normalize = require('./normalize.js');
-const require_paths_packages = require('../paths/packages.js');
 const require_packages_edit_class = require('./edit-class.js');
+const require_paths_packages = require('../paths/packages.js');
+const require_packages_normalize = require('./normalize.js');
 
 //#region src/packages/edit.ts
 /**
@@ -35,18 +35,17 @@ const require_packages_edit_class = require('./edit-class.js');
 *   )
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
 async function toEditablePackageJson(pkgJson, options) {
 	const { path: filepath, ...restOptions } = {
 		__proto__: null,
 		...options
 	};
 	const { normalize, ...normalizeOptions } = restOptions;
-	const EditablePackageJson = /* @__PURE__ */ require_packages_edit_class.getEditablePackageJsonClass();
-	if (typeof filepath !== "string") return new EditablePackageJson().fromContent(normalize ? /* @__PURE__ */ require_packages_normalize.normalizePackageJson(pkgJson, normalizeOptions) : pkgJson);
-	const pkgJsonPath = /* @__PURE__ */ require_paths_packages.resolvePackageJsonDirname(filepath);
-	return (await EditablePackageJson.load(pkgJsonPath, { create: true })).fromJSON(`${require_primordials_json.JSONStringify(normalize ? /* @__PURE__ */ require_packages_normalize.normalizePackageJson(pkgJson, {
-		.../* @__PURE__ */ require_paths_predicates.isNodeModules(pkgJsonPath) ? {} : { preserve: ["repository"] },
+	const EditablePackageJson = require_packages_edit_class.getEditablePackageJsonClass();
+	if (typeof filepath !== "string") return new EditablePackageJson().fromContent(normalize ? require_packages_normalize.normalizePackageJson(pkgJson, normalizeOptions) : pkgJson);
+	const pkgJsonPath = require_paths_packages.resolvePackageJsonDirname(filepath);
+	return (await EditablePackageJson.load(pkgJsonPath, { create: true })).fromJSON(`${require_primordials_json.JSONStringify(normalize ? require_packages_normalize.normalizePackageJson(pkgJson, {
+		...require_paths_predicates.isNodeModules(pkgJsonPath) ? {} : { preserve: ["repository"] },
 		...normalizeOptions
 	}) : pkgJson, void 0, 2)}\n`);
 }
@@ -62,18 +61,17 @@ async function toEditablePackageJson(pkgJson, options) {
 *   )
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
 function toEditablePackageJsonSync(pkgJson, options) {
 	const { path: filepath, ...restOptions } = {
 		__proto__: null,
 		...options
 	};
 	const { normalize, ...normalizeOptions } = restOptions;
-	const EditablePackageJson = /* @__PURE__ */ require_packages_edit_class.getEditablePackageJsonClass();
-	if (typeof filepath !== "string") return new EditablePackageJson().fromContent(normalize ? /* @__PURE__ */ require_packages_normalize.normalizePackageJson(pkgJson, normalizeOptions) : pkgJson);
-	const pkgJsonPath = /* @__PURE__ */ require_paths_packages.resolvePackageJsonDirname(filepath);
-	return new EditablePackageJson().create(pkgJsonPath).fromJSON(`${require_primordials_json.JSONStringify(normalize ? /* @__PURE__ */ require_packages_normalize.normalizePackageJson(pkgJson, {
-		.../* @__PURE__ */ require_paths_predicates.isNodeModules(pkgJsonPath) ? {} : { preserve: ["repository"] },
+	const EditablePackageJson = require_packages_edit_class.getEditablePackageJsonClass();
+	if (typeof filepath !== "string") return new EditablePackageJson().fromContent(normalize ? require_packages_normalize.normalizePackageJson(pkgJson, normalizeOptions) : pkgJson);
+	const pkgJsonPath = require_paths_packages.resolvePackageJsonDirname(filepath);
+	return new EditablePackageJson().create(pkgJsonPath).fromJSON(`${require_primordials_json.JSONStringify(normalize ? require_packages_normalize.normalizePackageJson(pkgJson, {
+		...require_paths_predicates.isNodeModules(pkgJsonPath) ? {} : { preserve: ["repository"] },
 		...normalizeOptions
 	}) : pkgJson, void 0, 2)}\n`);
 }

package/dist/packages/exports.js

@@ -26,7 +26,6 @@ const require_objects_predicates = require('../objects/predicates.js');
 *   // types === './dist/index.d.ts'
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
 function findTypesForSubpath(entryExports, subpath) {
 	const queue = [entryExports];
 	let pos = 0;
@@ -36,14 +35,14 @@ function findTypesForSubpath(entryExports, subpath) {
 		if (require_arrays_predicates.isArray(value)) for (let i = 0, { length } = value; i < length; i += 1) {
 			const item = value[i];
 			if (item === subpath) return value.types;
-			if (/* @__PURE__ */ require_objects_predicates.isObject(item)) queue.push(item);
+			if (require_objects_predicates.isObject(item)) queue.push(item);
 		}
-		else if (/* @__PURE__ */ require_objects_predicates.isObject(value)) {
+		else if (require_objects_predicates.isObject(value)) {
 			const keys = require_primordials_object.ObjectGetOwnPropertyNames(value);
 			for (let i = 0, { length } = keys; i < length; i += 1) {
 				const item = value[keys[i]];
 				if (item === subpath) return value.types;
-				if (/* @__PURE__ */ require_objects_predicates.isObject(item)) queue.push(item);
+				if (require_objects_predicates.isObject(item)) queue.push(item);
 			}
 		}
 	}
@@ -57,20 +56,19 @@ function findTypesForSubpath(entryExports, subpath) {
 *   getExportFilePaths(exports) // ['./dist/index.js', './dist/utils.js']
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
 function getExportFilePaths(entryExports) {
-	if (!/* @__PURE__ */ require_objects_predicates.isObject(entryExports)) return [];
+	if (!require_objects_predicates.isObject(entryExports)) return [];
 	const paths = [];
 	for (const key of require_primordials_object.ObjectGetOwnPropertyNames(entryExports)) {
 		if (!require_primordials_string.StringPrototypeStartsWith(key, ".")) continue;
 		const value = entryExports[key];
 		if (typeof value === "string") require_primordials_array.ArrayPrototypePush(paths, value);
-		else if (/* @__PURE__ */ require_objects_predicates.isObject(value)) for (const subKey of require_primordials_object.ObjectGetOwnPropertyNames(value)) {
+		else if (require_objects_predicates.isObject(value)) for (const subKey of require_primordials_object.ObjectGetOwnPropertyNames(value)) {
 			const subValue = value[subKey];
 			if (typeof subValue === "string") require_primordials_array.ArrayPrototypePush(paths, subValue);
 			else if (require_arrays_predicates.isArray(subValue)) {
 				for (const item of subValue) if (typeof item === "string") require_primordials_array.ArrayPrototypePush(paths, item);
-				else if (/* @__PURE__ */ require_objects_predicates.isObject(item)) for (const nestedKey of require_primordials_object.ObjectGetOwnPropertyNames(item)) {
+				else if (require_objects_predicates.isObject(item)) for (const nestedKey of require_primordials_object.ObjectGetOwnPropertyNames(item)) {
 					const nestedValue = item[nestedKey];
 					if (typeof nestedValue === "string") require_primordials_array.ArrayPrototypePush(paths, nestedValue);
 				}
@@ -88,9 +86,8 @@ function getExportFilePaths(entryExports) {
 *   getSubpaths(exports) // ['.', './utils']
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
 function getSubpaths(entryExports) {
-	if (!/* @__PURE__ */ require_objects_predicates.isObject(entryExports)) return [];
+	if (!require_objects_predicates.isObject(entryExports)) return [];
 	return require_primordials_object.ObjectGetOwnPropertyNames(entryExports).filter((key) => require_primordials_string.StringPrototypeStartsWith(key, "."));
 }
 /**
@@ -102,9 +99,8 @@ function getSubpaths(entryExports) {
 *   isConditionalExports({ '.': './index.js' }) // false
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
 function isConditionalExports(entryExports) {
-	if (!/* @__PURE__ */ require_objects_predicates.isPlainObject(entryExports)) return false;
+	if (!require_objects_predicates.isPlainObject(entryExports)) return false;
 	const keys = require_primordials_object.ObjectGetOwnPropertyNames(entryExports);
 	const { length } = keys;
 	if (!length) return false;
@@ -123,9 +119,8 @@ function isConditionalExports(entryExports) {
 *   isSubpathExports({ import: './index.mjs' }) // false
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
 function isSubpathExports(entryExports) {
-	if (/* @__PURE__ */ require_objects_predicates.isPlainObject(entryExports)) {
+	if (require_objects_predicates.isPlainObject(entryExports)) {
 		const keys = require_primordials_object.ObjectGetOwnPropertyNames(entryExports);
 		for (let i = 0, { length } = keys; i < length; i += 1) if (keys[i]?.charCodeAt(0) === 46) return true;
 	}
@@ -143,11 +138,10 @@ function isSubpathExports(entryExports) {
 *   // { '.': './index.js' }
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
 function resolvePackageJsonEntryExports(entryExports) {
 	if (typeof entryExports === "string" || require_arrays_predicates.isArray(entryExports)) return { ".": entryExports };
-	if (/* @__PURE__ */ isConditionalExports(entryExports)) return entryExports;
-	return /* @__PURE__ */ require_objects_predicates.isObject(entryExports) ? entryExports : void 0;
+	if (isConditionalExports(entryExports)) return entryExports;
+	return require_objects_predicates.isObject(entryExports) ? entryExports : void 0;
 }
 
 //#endregion

package/dist/packages/fetch.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @file Network-facing package helpers: the lazily-initialized
+ *   make-fetch-happen fetcher (shared cache) and GitHub tarball-URL resolution
+ *   for a package spec.
+ */
+import makeFetchHappen from '../external/make-fetch-happen';
+export declare function getFetcher(): ReturnType<typeof makeFetchHappen.defaults>;
+/**
+ * Resolve GitHub tarball URL for a package specifier.
+ *
+ * @example
+ *   ;```typescript
+ *   const url = await resolveGitHubTgzUrl('my-pkg@1.0.0', '/tmp/my-project')
+ *   ```
+ */
+export declare function resolveGitHubTgzUrl(pkgNameOrId: string, where?: unknown): Promise<string>;

package/dist/packages/fetch.js

@@ -0,0 +1,81 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_objects_predicates = require('../objects/predicates.js');
+const require_constants_packages = require('../constants/packages.js');
+const require_packages_specs = require('./specs.js');
+const require_packages_read = require('./read.js');
+let src_external_npm_package_arg = require("../external/npm-package-arg");
+src_external_npm_package_arg = require_runtime.__toESM(src_external_npm_package_arg);
+let src_external_make_fetch_happen = require("../external/make-fetch-happen");
+src_external_make_fetch_happen = require_runtime.__toESM(src_external_make_fetch_happen);
+
+//#region src/packages/fetch.ts
+/**
+* @file Network-facing package helpers: the lazily-initialized
+*   make-fetch-happen fetcher (shared cache) and GitHub tarball-URL resolution
+*   for a package spec.
+*/
+const pacoteCachePath = require_constants_packages.getPacoteCachePath();
+let cachedFetcher;
+function getFetcher() {
+	if (cachedFetcher === void 0) cachedFetcher = src_external_make_fetch_happen.default.defaults({
+		cachePath: pacoteCachePath,
+		cache: "force-cache"
+	});
+	return cachedFetcher;
+}
+/**
+* Resolve GitHub tarball URL for a package specifier.
+*
+* @example
+*   ;```typescript
+*   const url = await resolveGitHubTgzUrl('my-pkg@1.0.0', '/tmp/my-project')
+*   ```
+*/
+async function resolveGitHubTgzUrl(pkgNameOrId, where) {
+	const whereIsPkgJson = require_objects_predicates.isPlainObject(where);
+	const pkgJson = whereIsPkgJson ? where : await require_packages_read.readPackageJson(where, { normalize: true });
+	if (!pkgJson) return "";
+	const { version } = pkgJson;
+	const parsedSpec = (0, src_external_npm_package_arg.default)(pkgNameOrId, whereIsPkgJson ? void 0 : where);
+	if (require_packages_specs.isGitHubTgzSpec(parsedSpec)) return parsedSpec.saveSpec || "";
+	const isGitHubUrl = require_packages_specs.isGitHubUrlSpec(parsedSpec);
+	const repository = pkgJson.repository;
+	const { project, user } = (isGitHubUrl ? parsedSpec.hosted : require_packages_specs.getRepoUrlDetails(repository?.url)) || {
+		project: "",
+		user: ""
+	};
+	/* c8 ignore start - External GitHub API calls */
+	if (user && project) {
+		const fetcher = getFetcher();
+		let apiUrl = "";
+		if (isGitHubUrl) apiUrl = require_packages_specs.gitHubTagRefUrl(user, project, parsedSpec.gitCommittish || "");
+		else {
+			const versionStr = version;
+			apiUrl = require_packages_specs.gitHubTagRefUrl(user, project, `v${versionStr}`);
+			if (!(await fetcher(apiUrl, { method: "head" })).ok) {
+				apiUrl = require_packages_specs.gitHubTagRefUrl(user, project, versionStr);
+				if (!(await fetcher(apiUrl, { method: "head" })).ok) apiUrl = "";
+			}
+		}
+		if (apiUrl) {
+			const resp = await fetcher(apiUrl);
+			let json;
+			try {
+				json = await resp.json();
+			} catch {
+				json = void 0;
+			}
+			const sha = json?.object?.sha;
+			if (sha) return require_packages_specs.gitHubTgzUrl(user, project, sha);
+		}
+	}
+	/* c8 ignore stop */
+	return "";
+}
+
+//#endregion
+exports.getFetcher = getFetcher;
+exports.resolveGitHubTgzUrl = resolveGitHubTgzUrl;

package/dist/packages/find.d.ts

@@ -0,0 +1,55 @@
+/**
+ * @file Find the nearest package.json (or other marker) walking up from an
+ *   `import.meta` — the package-domain wrapper over the generic `findUpSync`
+ *   lookup in `fs/find`. Lives here (not in `paths/`) because it touches the
+ *   filesystem; `paths/packages.ts` stays pure path-string shaping.
+ */
+export interface FindUpPackageJsonOptions {
+    /**
+     * Names to look for. Defaults to `['package.json']`. Pass alternate markers
+     * for non-package roots (e.g. `['pnpm-workspace.yaml']` for the workspace
+     * root in a pnpm monorepo).
+     */
+    names?: readonly string[] | undefined;
+    /**
+     * Optional ancestor boundary. Useful when a script is run from a deeply
+     * nested fixture and you don't want to escape the test's tmpdir. Defaults to
+     * the filesystem root.
+     */
+    stopAt?: string | undefined;
+}
+/**
+ * Find the nearest `package.json` walking up from `import.meta`. Returns the
+ * absolute path to the file (normalized to forward slashes), matching the
+ * `findUp` / `findUpSync` return shape. Throws when no marker is found — every
+ * script using this helper lives inside a package and should resolve.
+ *
+ * Use this instead of `path.join(__dirname, '..', '..'[, '..'])`. The ascent
+ * count is computed at runtime from the actual filesystem layout, not
+ * hard-coded into the source, so the helper stays correct across refactors that
+ * move scripts between directories.
+ *
+ * Pair with `readPackageJson` to find AND parse the nearest package.json:
+ *
+ * @example
+ *   ;```ts
+ *   const pkgJsonPath = findUpPackageJson(import.meta)
+ *   // → '/abs/path/to/package.json'
+ *   const pkg = await readPackageJson(pkgJsonPath)
+ *   console.log(pkg?.name)
+ *
+ *   // Workspace root in a pnpm monorepo:
+ *   const wsRoot = findUpPackageJson(import.meta, {
+ *     names: ['pnpm-workspace.yaml'],
+ *   })
+ *   ```
+ *
+ * @param meta - `import.meta` from the calling script.
+ * @param options - Override marker name(s) or set a stopAt boundary.
+ *
+ * @returns Absolute, normalized path to the marker file.
+ *
+ * @throws When no marker is found between the script and the filesystem root
+ *   (or `stopAt`).
+ */
+export declare function findUpPackageJson(meta: ImportMeta, options?: FindUpPackageJsonOptions | undefined): string;

package/dist/packages/find.js

@@ -0,0 +1,65 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_paths_normalize = require('../paths/normalize.js');
+const require_node_path = require('../node/path.js');
+const require_fs_find = require('../fs/find.js');
+let node_url = require("node:url");
+
+//#region src/packages/find.ts
+/**
+* @file Find the nearest package.json (or other marker) walking up from an
+*   `import.meta` — the package-domain wrapper over the generic `findUpSync`
+*   lookup in `fs/find`. Lives here (not in `paths/`) because it touches the
+*   filesystem; `paths/packages.ts` stays pure path-string shaping.
+*/
+/**
+* Find the nearest `package.json` walking up from `import.meta`. Returns the
+* absolute path to the file (normalized to forward slashes), matching the
+* `findUp` / `findUpSync` return shape. Throws when no marker is found — every
+* script using this helper lives inside a package and should resolve.
+*
+* Use this instead of `path.join(__dirname, '..', '..'[, '..'])`. The ascent
+* count is computed at runtime from the actual filesystem layout, not
+* hard-coded into the source, so the helper stays correct across refactors that
+* move scripts between directories.
+*
+* Pair with `readPackageJson` to find AND parse the nearest package.json:
+*
+* @example
+*   ;```ts
+*   const pkgJsonPath = findUpPackageJson(import.meta)
+*   // → '/abs/path/to/package.json'
+*   const pkg = await readPackageJson(pkgJsonPath)
+*   console.log(pkg?.name)
+*
+*   // Workspace root in a pnpm monorepo:
+*   const wsRoot = findUpPackageJson(import.meta, {
+*     names: ['pnpm-workspace.yaml'],
+*   })
+*   ```
+*
+* @param meta - `import.meta` from the calling script.
+* @param options - Override marker name(s) or set a stopAt boundary.
+*
+* @returns Absolute, normalized path to the marker file.
+*
+* @throws When no marker is found between the script and the filesystem root
+*   (or `stopAt`).
+*/
+function findUpPackageJson(meta, options) {
+	const { names = ["package.json"], stopAt } = {
+		__proto__: null,
+		...options
+	};
+	const scriptPath = (0, node_url.fileURLToPath)(meta.url);
+	const found = require_fs_find.findUpSync(names, {
+		cwd: require_node_path.getNodePath().dirname(scriptPath),
+		stopAt
+	});
+	if (found === void 0) throw new Error(`findUpPackageJson: no ${names.join(" / ")} found between ${scriptPath} and ${stopAt ?? "filesystem root"}`);
+	return require_paths_normalize.normalizePath(found);
+}
+
+//#endregion
+exports.findUpPackageJson = findUpPackageJson;

package/dist/packages/isolation.js

@@ -3,18 +3,18 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_error = require('../primordials/error.js');
-const require_primordials_string = require('../primordials/string.js');
 const require_constants_platform = require('../constants/platform.js');
+const require_primordials_string = require('../primordials/string.js');
 const require_paths_conversion = require('../paths/conversion.js');
 const require_paths_predicates = require('../paths/predicates.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
-const require_primordials_object = require('../primordials/object.js');
 const require_primordials_json = require('../primordials/json.js');
+const require_primordials_object = require('../primordials/object.js');
 const require_errors_message = require('../errors/message.js');
 const require_process_spawn_child = require('../process/spawn/child.js');
 const require_paths_socket = require('../paths/socket.js');
-const require_packages_operations = require('./operations.js');
+const require_packages_read = require('./read.js');
 let src_external_npm_package_arg = require("../external/npm-package-arg");
 src_external_npm_package_arg = require_runtime.__toESM(src_external_npm_package_arg);
 
@@ -47,8 +47,8 @@ const FS_CP_OPTIONS = {
 * @throws {Error} When package installation or setup fails.
 */
 async function isolatePackage(packageSpec, options) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const fs = require_node_fs.getNodeFs();
+	const path = require_node_path.getNodePath();
 	const { imports, install, onPackageJson, sourcePath: optSourcePath } = {
 		__proto__: null,
 		...options
@@ -56,12 +56,12 @@ async function isolatePackage(packageSpec, options) {
 	let sourcePath = optSourcePath;
 	let packageName;
 	let spec;
-	if (/* @__PURE__ */ require_paths_predicates.isPath(packageSpec)) {
-		const trimmedPath = /* @__PURE__ */ require_paths_conversion.trimLeadingDotSlash(packageSpec);
-		const pathToResolve = /* @__PURE__ */ require_paths_predicates.isAbsolute(trimmedPath) ? trimmedPath : packageSpec;
+	if (require_paths_predicates.isPath(packageSpec)) {
+		const trimmedPath = require_paths_conversion.trimLeadingDotSlash(packageSpec);
+		const pathToResolve = require_paths_predicates.isAbsolute(trimmedPath) ? trimmedPath : packageSpec;
 		sourcePath = path.resolve(pathToResolve);
 		if (!fs.existsSync(sourcePath)) throw new require_primordials_error.ErrorCtor(`Source path does not exist: ${sourcePath}`);
-		const pkgJson = await /* @__PURE__ */ require_packages_operations.readPackageJson(sourcePath, { normalize: true });
+		const pkgJson = await require_packages_read.readPackageJson(sourcePath, { normalize: true });
 		if (!pkgJson) throw new require_primordials_error.ErrorCtor(`Could not read package.json from: ${sourcePath}`);
 		packageName = pkgJson.name;
 	} else {
@@ -71,7 +71,7 @@ async function isolatePackage(packageSpec, options) {
 			sourcePath = parsed.fetchSpec;
 			if (!sourcePath || !fs.existsSync(sourcePath)) throw new require_primordials_error.ErrorCtor(`Source path does not exist: ${sourcePath}`);
 			if (!packageName) {
-				const pkgJson = await /* @__PURE__ */ require_packages_operations.readPackageJson(sourcePath, { normalize: true });
+				const pkgJson = await require_packages_read.readPackageJson(sourcePath, { normalize: true });
 				if (!pkgJson) throw new require_primordials_error.ErrorCtor(`Could not read package.json from: ${sourcePath}`);
 				packageName = pkgJson.name;
 			}
@@ -97,7 +97,7 @@ async function isolatePackage(packageSpec, options) {
 			stdio: "pipe"
 		});
 		installedPath = path.join(packageTempDir, "node_modules", packageName);
-		originalPackageJson = await /* @__PURE__ */ require_packages_operations.readPackageJson(installedPath, { normalize: true });
+		originalPackageJson = await require_packages_read.readPackageJson(installedPath, { normalize: true });
 		if (sourcePath) {
 			const realInstalledPath = await resolveRealPath(installedPath);
 			if (await resolveRealPath(sourcePath) !== realInstalledPath) await fs.promises.cp(sourcePath, installedPath, FS_CP_OPTIONS);
@@ -135,7 +135,7 @@ async function isolatePackage(packageSpec, options) {
 * Merge and write package.json with original and new values.
 */
 async function mergePackageJson(pkgJsonPath, originalPkgJson) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const fs = require_node_fs.getNodeFs();
 	let pkgJson;
 	try {
 		pkgJson = require_primordials_json.JSONParse(await fs.promises.readFile(pkgJsonPath, "utf8"));
@@ -153,8 +153,8 @@ async function mergePackageJson(pkgJsonPath, originalPkgJson) {
 * caller still gets a usable absolute path either way.
 */
 async function resolveRealPath(pathStr) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const fs = require_node_fs.getNodeFs();
+	const path = require_node_path.getNodePath();
 	try {
 		return await fs.promises.realpath(pathStr);
 	} catch {