@socketsecurity/lib 6.0.5 → 6.0.7

package/dist/constants/node.js

@@ -14,10 +14,10 @@ node_process = require_runtime.__toESM(node_process);
 *   and feature-detection flags for APIs that vary across Node releases.
 */
 const NODE_VERSION = node_process.default.version;
-let _nodeDisableSigusr1Flags;
-let _nodeHardenFlags;
-let _nodeNoWarningsFlags;
-let _nodePermissionFlags;
+let nodeDisableSigusr1Flags;
+let nodeHardenFlags;
+let nodeNoWarningsFlags;
+let nodePermissionFlags;
 /**
 * Get the absolute path to the currently running Node.js binary.
 *
@@ -42,11 +42,11 @@ function getMaintainedNodeVersions() {
 * @returns A non-empty array of CLI flags suitable for passing to `node`.
 */
 function getNodeDisableSigusr1Flags() {
-	if (_nodeDisableSigusr1Flags === void 0)
+	if (nodeDisableSigusr1Flags === void 0)
  /* c8 ignore start - --no-inspect fallback fires only on Node
 	runtimes pre-v22.14 / v23.7 / v24.8; tests run on Node 24+. */
-	_nodeDisableSigusr1Flags = supportsNodeDisableSigusr1Flag() ? ["--disable-sigusr1"] : ["--no-inspect"];
-	return _nodeDisableSigusr1Flags;
+	nodeDisableSigusr1Flags = supportsNodeDisableSigusr1Flag() ? ["--disable-sigusr1"] : ["--no-inspect"];
+	return nodeDisableSigusr1Flags;
 }
 /**
 * Get the hardening flags Socket applies when spawning Node.js subprocesses.
@@ -58,7 +58,7 @@ function getNodeDisableSigusr1Flags() {
 * @returns A non-empty array of CLI flags suitable for passing to `node`.
 */
 function getNodeHardenFlags() {
-	if (_nodeHardenFlags === void 0) {
+	if (nodeHardenFlags === void 0) {
 		const major = getNodeMajorVersion();
 		const flags = ["--disable-proto=delete"];
 		if (major >= 24) {
@@ -69,9 +69,9 @@ function getNodeHardenFlags() {
 		/* c8 ignore start */
 		if (major >= 22) flags.push("--force-node-api-uncaught-exceptions-policy");
 		/* c8 ignore stop */
-		_nodeHardenFlags = flags;
+		nodeHardenFlags = flags;
 	}
-	return _nodeHardenFlags;
+	return nodeHardenFlags;
 }
 /**
 * Get the major component of the current Node.js version.
@@ -99,8 +99,8 @@ function getNodeMinorVersion() {
 * @returns A non-empty array of CLI flags suitable for passing to `node`.
 */
 function getNodeNoWarningsFlags() {
-	if (_nodeNoWarningsFlags === void 0) _nodeNoWarningsFlags = ["--no-warnings", "--no-deprecation"];
-	return _nodeNoWarningsFlags;
+	if (nodeNoWarningsFlags === void 0) nodeNoWarningsFlags = ["--no-warnings", "--no-deprecation"];
+	return nodeNoWarningsFlags;
 }
 /**
 * Get the patch component of the current Node.js version.
@@ -121,13 +121,13 @@ function getNodePatchVersion() {
 * @returns The permission flag list (possibly empty) for the current runtime.
 */
 function getNodePermissionFlags() {
-	if (_nodePermissionFlags === void 0) if (getNodeMajorVersion() >= 24) _nodePermissionFlags = [
+	if (nodePermissionFlags === void 0) if (getNodeMajorVersion() >= 24) nodePermissionFlags = [
 		"--allow-fs-read=*",
 		"--allow-fs-write=*",
 		"--allow-child-process"
 	];
-	else _nodePermissionFlags = [];
-	return _nodePermissionFlags;
+	else nodePermissionFlags = [];
+	return nodePermissionFlags;
 }
 /**
 * Get the full Node.js version string from `process.version`.
@@ -219,6 +219,36 @@ function supportsNodeRun() {
 	/* c8 ignore stop */
 }
 /**
+* Check whether the current runtime can execute TypeScript source directly
+* (`.ts` files via `node foo.ts`), with or without a flag. Type-stripping went
+* stable in Node.js 22.6 (under `--strip-types`, also accepted as the
+* deprecated alias `--experimental-strip-types`) and default-on in Node 24.
+*
+* Pair with {@link supportsNodeStripTypesDefault} to decide whether a flag needs
+* to be passed.
+*
+* @returns `true` when the runtime can run TypeScript (Node 22.6+).
+*/
+function supportsNodeStripTypes() {
+	const major = getNodeMajorVersion();
+	/* c8 ignore start - 22-specific arm; tests run on a single Node major. */
+	return major >= 23 || major === 22 && getNodeMinorVersion() >= 6;
+	/* c8 ignore stop */
+}
+/**
+* Check whether the current runtime strips TypeScript types **by default** (no
+* flag needed). Became default-on in Node.js 24.
+*
+* Use case: deciding whether a wrapper script needs to pass `--strip-types`
+* when invoking `node foo.ts`. On Node 24+ the flag is redundant; on 22.6 –
+* 23.x it's required.
+*
+* @returns `true` when no `--strip-types` flag is needed (Node 24+).
+*/
+function supportsNodeStripTypesDefault() {
+	return getNodeMajorVersion() >= 24;
+}
+/**
 * Check whether this process was spawned with an IPC channel. When `true`,
 * `process.send()` is callable to message the parent process.
 *
@@ -250,4 +280,6 @@ exports.supportsNodeDisableWarningFlag = supportsNodeDisableWarningFlag;
 exports.supportsNodePermissionFlag = supportsNodePermissionFlag;
 exports.supportsNodeRequireModule = supportsNodeRequireModule;
 exports.supportsNodeRun = supportsNodeRun;
+exports.supportsNodeStripTypes = supportsNodeStripTypes;
+exports.supportsNodeStripTypesDefault = supportsNodeStripTypesDefault;
 exports.supportsProcessSend = supportsProcessSend;

package/dist/constants/packages.js

@@ -20,12 +20,12 @@ src_external_pacote = require_runtime.__toESM(src_external_pacote);
 *   categories), the pacote cache path, lifecycle script names, and known
 *   package extensions used during manifest processing.
 */
-let _lifecycleScriptNames;
-let _packageDefaultNodeRange;
-let _packageDefaultSocketCategories;
-let _packageExtensions;
-let _pacoteCachePath;
-let _packumentCache;
+let cachedLifecycleScriptNames;
+let cachedPackageDefaultNodeRange;
+let cachedPackageDefaultSocketCategories;
+let cachedPackageExtensions;
+let cachedPacoteCachePath;
+let cachedPackumentCache;
 const PACKAGE = "package";
 const AT_LATEST = "@latest";
 const LATEST = "latest";
@@ -35,28 +35,24 @@ const PACKAGE_DEFAULT_VERSION = "1.0.0";
 * force a re-fetch of registry metadata.
 */
 function clearPackumentCache() {
-	/* c8 ignore next 3 */
-	if (_packumentCache !== void 0) _packumentCache.clear();
+	/* c8 ignore next 3 - uninitialized-cache branch unreachable in tests */
+	if (cachedPackumentCache !== void 0) cachedPackumentCache.clear();
 }
-/* @__NO_SIDE_EFFECTS__ */
 function getLifecycleScriptNames() {
-	if (_lifecycleScriptNames === void 0) _lifecycleScriptNames = require_primordials_array.ArrayFrom(require_constants_lifecycle_script_names.lifecycleScriptNames);
-	return _lifecycleScriptNames;
+	if (cachedLifecycleScriptNames === void 0) cachedLifecycleScriptNames = require_primordials_array.ArrayFrom(require_constants_lifecycle_script_names.lifecycleScriptNames);
+	return cachedLifecycleScriptNames;
 }
-/* @__NO_SIDE_EFFECTS__ */
 function getPackageDefaultNodeRange() {
-	if (_packageDefaultNodeRange === void 0) _packageDefaultNodeRange = require_constants_package_default_node_range.packageDefaultNodeRange;
-	return _packageDefaultNodeRange;
+	if (cachedPackageDefaultNodeRange === void 0) cachedPackageDefaultNodeRange = require_constants_package_default_node_range.packageDefaultNodeRange;
+	return cachedPackageDefaultNodeRange;
 }
-/* @__NO_SIDE_EFFECTS__ */
 function getPackageDefaultSocketCategories() {
-	if (_packageDefaultSocketCategories === void 0) _packageDefaultSocketCategories = require_constants_package_default_socket_categories.packageDefaultSocketCategories;
-	return _packageDefaultSocketCategories;
+	if (cachedPackageDefaultSocketCategories === void 0) cachedPackageDefaultSocketCategories = require_constants_package_default_socket_categories.packageDefaultSocketCategories;
+	return cachedPackageDefaultSocketCategories;
 }
-/* @__NO_SIDE_EFFECTS__ */
 function getPackageExtensions() {
-	if (_packageExtensions === void 0) _packageExtensions = require_primordials_object.ObjectEntries(require_pkg_ext_data.packageExtensions);
-	return _packageExtensions;
+	if (cachedPackageExtensions === void 0) cachedPackageExtensions = require_primordials_object.ObjectEntries(require_pkg_ext_data.packageExtensions);
+	return cachedPackageExtensions;
 }
 const PACKUMENT_CACHE_MAX = 500;
 var BoundedPackumentCache = class extends Map {
@@ -71,22 +67,20 @@ var BoundedPackumentCache = class extends Map {
 		return super.set(key, value);
 	}
 };
-/* @__NO_SIDE_EFFECTS__ */
 function getPackumentCache() {
-	if (_packumentCache === void 0) _packumentCache = new BoundedPackumentCache();
-	return _packumentCache;
+	if (cachedPackumentCache === void 0) cachedPackumentCache = new BoundedPackumentCache();
+	return cachedPackumentCache;
 }
-/* @__NO_SIDE_EFFECTS__ */
 function getPacoteCachePath() {
-	if (_pacoteCachePath === void 0) try {
+	if (cachedPacoteCachePath === void 0) try {
 		const PacoteFetcherBase = require_primordials_reflect.ReflectGetPrototypeOf(src_external_pacote.default.RegistryFetcher.prototype)?.constructor;
 		/* c8 ignore start */
 		const cachePath = PacoteFetcherBase ? new PacoteFetcherBase("x", {}).cache : "";
-		_pacoteCachePath = cachePath ? /* @__PURE__ */ require_paths_normalize.normalizePath(cachePath) : "";
+		cachedPacoteCachePath = cachePath ? require_paths_normalize.normalizePath(cachePath) : "";
 	} catch {
-		_pacoteCachePath = "";
+		cachedPacoteCachePath = "";
 	}
-	return _pacoteCachePath;
+	return cachedPacoteCachePath;
 }
 
 //#endregion

package/dist/constants/platform.d.ts

@@ -14,15 +14,42 @@ export type Libc = 'glibc' | 'musl';
  */
 export type Platform = NodeJS.Platform;
 /**
- * Get the current CPU architecture (memoized).
+ * Get the current CPU architecture (memoized), e.g. `x64`, `arm64`.
  */
 export declare function getArch(): Arch;
 /**
- * Get the current platform (memoized).
+ * Get the host libc variant (memoized): `'musl'` on Alpine-and-similar,
+ * `'glibc'` on other Linux, `undefined` off-Linux. Detected by probing for the
+ * musl dynamic linker. The single source of truth for libc detection —
+ * tool-specific resolvers (`getPythonArch`, `getJreArch`) call this rather than
+ * re-probing.
  */
-export declare function getPlatform(): Platform;
+export declare function getLibc(): Libc | undefined;
+/**
+ * Get the current OS (memoized), e.g. `darwin`, `linux`, `win32` — the raw
+ * `process.platform` value.
+ */
+export declare function getOs(): Platform;
+/**
+ * Get the current host **target** in the pnpm `pack-app` vocabulary (memoized):
+ * `<os>-<arch>[-<libc>]`, e.g. `darwin-arm64`, `linux-x64`, `win32-x64`,
+ * `linux-x64-musl`. Raw Node `process.platform`/`process.arch` joined with `-`,
+ * plus a `-musl` suffix on Alpine. This is the fleet-general naming for
+ * non-python / non-JRE tools (matches pnpm's release assets,
+ * `pnpm-<os>-<arch>[-<libc>].{tar.gz,zip}`). Tool-specific resolvers that need
+ * a different vocabulary own their own helper — see `getPythonArch`
+ * (python-build- standalone) / `getJreArch` (Adoptium).
+ */
+export declare function getTarget(): string;
 export declare const DARWIN: boolean;
 export declare const WIN32: boolean;
+/**
+ * True when this process was launched as a Chrome (or Chromium) native
+ * messaging host. Chrome passes the extension origin URL
+ * (`chrome-extension://<id>/`) as `process.argv[2]`; no other invocation shape
+ * produces that prefix.
+ */
+export declare const NATIVE_MESSAGING_HOST: boolean;
 export declare const S_IXUSR = 64;
 export declare const S_IXGRP = 8;
 export declare const S_IXOTH = 1;

package/dist/constants/platform.js

@@ -2,38 +2,98 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_node_os = require('../node/os.js');
+let node_fs = require("node:fs");
 
 //#region src/constants/platform.ts
 /**
 * @file Platform detection and OS-specific constants.
 */
-let _arch;
+let memoizedArch;
 /**
-* Get the current CPU architecture (memoized).
+* Get the current CPU architecture (memoized), e.g. `x64`, `arm64`.
 */
 function getArch() {
-	if (_arch === void 0) _arch = (/* @__PURE__ */ require_node_os.getNodeOs()).arch();
-	return _arch;
+	if (memoizedArch === void 0) memoizedArch = require_node_os.getNodeOs().arch();
+	return memoizedArch;
 }
-let _platform;
+const MUSL_LINKERS = [
+	"/lib/ld-musl-x86_64.so.1",
+	"/lib/ld-musl-aarch64.so.1",
+	"/usr/lib/ld-musl-x86_64.so.1",
+	"/usr/lib/ld-musl-aarch64.so.1"
+];
+let memoizedLibc;
+let memoizedLibcProbed = false;
 /**
-* Get the current platform (memoized).
+* Get the host libc variant (memoized): `'musl'` on Alpine-and-similar,
+* `'glibc'` on other Linux, `undefined` off-Linux. Detected by probing for the
+* musl dynamic linker. The single source of truth for libc detection —
+* tool-specific resolvers (`getPythonArch`, `getJreArch`) call this rather than
+* re-probing.
 */
-function getPlatform() {
-	if (_platform === void 0) _platform = (/* @__PURE__ */ require_node_os.getNodeOs()).platform();
-	return _platform;
+function getLibc() {
+	if (!memoizedLibcProbed) {
+		memoizedLibcProbed = true;
+		/* c8 ignore start - Linux-only filesystem probe. */
+		if (getOs() !== "linux") memoizedLibc = void 0;
+		else {
+			memoizedLibc = "glibc";
+			for (let i = 0, { length } = MUSL_LINKERS; i < length; i += 1) if ((0, node_fs.existsSync)(MUSL_LINKERS[i])) {
+				memoizedLibc = "musl";
+				break;
+			}
+		}
+	}
+	return memoizedLibc;
 }
-const DARWIN = getPlatform() === "darwin";
-const WIN32 = getPlatform() === "win32";
+let memoizedOs;
+/**
+* Get the current OS (memoized), e.g. `darwin`, `linux`, `win32` — the raw
+* `process.platform` value.
+*/
+function getOs() {
+	if (memoizedOs === void 0) memoizedOs = require_node_os.getNodeOs().platform();
+	return memoizedOs;
+}
+let memoizedTarget;
+/**
+* Get the current host **target** in the pnpm `pack-app` vocabulary (memoized):
+* `<os>-<arch>[-<libc>]`, e.g. `darwin-arm64`, `linux-x64`, `win32-x64`,
+* `linux-x64-musl`. Raw Node `process.platform`/`process.arch` joined with `-`,
+* plus a `-musl` suffix on Alpine. This is the fleet-general naming for
+* non-python / non-JRE tools (matches pnpm's release assets,
+* `pnpm-<os>-<arch>[-<libc>].{tar.gz,zip}`). Tool-specific resolvers that need
+* a different vocabulary own their own helper — see `getPythonArch`
+* (python-build- standalone) / `getJreArch` (Adoptium).
+*/
+function getTarget() {
+	if (memoizedTarget === void 0) {
+		const libcSuffix = getLibc() === "musl" ? "-musl" : "";
+		memoizedTarget = `${getOs()}-${getArch()}${libcSuffix}`;
+	}
+	return memoizedTarget;
+}
+const DARWIN = getOs() === "darwin";
+const WIN32 = getOs() === "win32";
+/**
+* True when this process was launched as a Chrome (or Chromium) native
+* messaging host. Chrome passes the extension origin URL
+* (`chrome-extension://<id>/`) as `process.argv[2]`; no other invocation shape
+* produces that prefix.
+*/
+const NATIVE_MESSAGING_HOST = typeof process !== "undefined" && typeof process.argv[2] === "string" && process.argv[2].startsWith("chrome-extension://");
 const S_IXUSR = 64;
 const S_IXGRP = 8;
 const S_IXOTH = 1;
 
 //#endregion
 exports.DARWIN = DARWIN;
+exports.NATIVE_MESSAGING_HOST = NATIVE_MESSAGING_HOST;
 exports.S_IXGRP = S_IXGRP;
 exports.S_IXOTH = S_IXOTH;
 exports.S_IXUSR = S_IXUSR;
 exports.WIN32 = WIN32;
 exports.getArch = getArch;
-exports.getPlatform = getPlatform;
+exports.getLibc = getLibc;
+exports.getOs = getOs;
+exports.getTarget = getTarget;

package/dist/constants/runtime.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @file Runtime environment detection constants. All checks use only
+ *   `typeof`-safe global probes so this module is safe to import in browser,
+ *   Node.js, Deno, Bun, and bundled contexts alike.
+ */
+/**
+ * True when running inside a Node.js process. Detected via
+ * `process.versions.node` — present in Node, absent in browsers and Deno/Bun
+ * which expose a different `process.versions` shape (or no `process` at all).
+ */
+export declare const IS_NODE: boolean;
+/**
+ * True when running in a browser context (window + document both defined).
+ * Note: Chrome extensions have `window` in popup contexts but not in service
+ * workers — check `IS_SERVICE_WORKER` for that case.
+ */
+export declare const IS_BROWSER: boolean;
+/**
+ * True when running inside a Web Worker / Chrome MV3 service worker. `self` is
+ * defined without `window` in worker contexts.
+ */
+export declare const IS_WORKER: boolean;

package/dist/constants/runtime.js

@@ -0,0 +1,32 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+//#region src/constants/runtime.ts
+/**
+* @file Runtime environment detection constants. All checks use only
+*   `typeof`-safe global probes so this module is safe to import in browser,
+*   Node.js, Deno, Bun, and bundled contexts alike.
+*/
+/**
+* True when running inside a Node.js process. Detected via
+* `process.versions.node` — present in Node, absent in browsers and Deno/Bun
+* which expose a different `process.versions` shape (or no `process` at all).
+*/
+const IS_NODE = typeof process !== "undefined" && typeof process.versions !== "undefined" && typeof process.versions.node === "string";
+/**
+* True when running in a browser context (window + document both defined).
+* Note: Chrome extensions have `window` in popup contexts but not in service
+* workers — check `IS_SERVICE_WORKER` for that case.
+*/
+const IS_BROWSER = typeof window !== "undefined" && typeof document !== "undefined";
+/**
+* True when running inside a Web Worker / Chrome MV3 service worker. `self` is
+* defined without `window` in worker contexts.
+*/
+const IS_WORKER = typeof self !== "undefined" && typeof window === "undefined" && typeof document === "undefined";
+
+//#endregion
+exports.IS_BROWSER = IS_BROWSER;
+exports.IS_NODE = IS_NODE;
+exports.IS_WORKER = IS_WORKER;

package/dist/constants/socket.js

@@ -33,7 +33,7 @@ const SOCKET_REGISTRY_APP_NAME = "registry";
 const SOCKET_WHEELHOUSE_APP_NAME = "wheelhouse";
 const SOCKET_APP_PREFIX = "_";
 const SOCKET_LIB_NAME = "@socketsecurity/lib";
-const SOCKET_LIB_VERSION = "6.0.5";
+const SOCKET_LIB_VERSION = "6.0.7";
 const SOCKET_IPC_HANDSHAKE = "SOCKET_IPC_HANDSHAKE";
 const CACHE_SOCKET_API_DIR = "socket-api";
 const REGISTRY = "registry";

package/dist/cover/code.js

@@ -38,18 +38,18 @@ function calculateMetric(data) {
 async function getCodeCoverage(options) {
 	const { coveragePath, generateIfMissing } = {
 		__proto__: null,
-		coveragePath: (/* @__PURE__ */ require_node_path.getNodePath()).join(node_process.default.cwd(), "coverage/coverage-final.json"),
+		coveragePath: require_node_path.getNodePath().join(node_process.default.cwd(), "coverage/coverage-final.json"),
 		generateIfMissing: false,
 		...options
 	};
 	if (!coveragePath) throw new require_primordials_error.ErrorCtor("Coverage path is required");
-	if (!(/* @__PURE__ */ require_node_fs.getNodeFs()).existsSync(coveragePath)) if (generateIfMissing) await require_process_spawn_child.spawn("vitest", ["run", "--coverage"], {
+	if (!require_node_fs.getNodeFs().existsSync(coveragePath)) if (generateIfMissing) await require_process_spawn_child.spawn("vitest", ["run", "--coverage"], {
 		cwd: node_process.default.cwd(),
 		stdio: "inherit"
 	});
 	else throw new require_primordials_error.ErrorCtor(`Coverage file not found at "${coveragePath}". Run tests with coverage first.`);
-	const coverageData = await /* @__PURE__ */ require_fs_read_json.readJson(coveragePath);
-	if (!/* @__PURE__ */ require_objects_predicates.isPlainObject(coverageData)) throw new require_primordials_error.ErrorCtor(`Invalid coverage data format in "${coveragePath}"`);
+	const coverageData = await require_fs_read_json.readJson(coveragePath);
+	if (!require_objects_predicates.isPlainObject(coverageData)) throw new require_primordials_error.ErrorCtor(`Invalid coverage data format in "${coveragePath}"`);
 	const totals = {
 		__proto__: null,
 		branches: {
@@ -75,16 +75,16 @@ async function getCodeCoverage(options) {
 	};
 	const v8Data = coverageData;
 	for (const fileCoverage of require_primordials_object.ObjectValues(v8Data)) {
-		if (!/* @__PURE__ */ require_objects_predicates.isPlainObject(fileCoverage)) continue;
+		if (!require_objects_predicates.isPlainObject(fileCoverage)) continue;
 		const fc = fileCoverage;
-		if (fc.s && /* @__PURE__ */ require_objects_predicates.isPlainObject(fc.s)) {
+		if (fc.s && require_objects_predicates.isPlainObject(fc.s)) {
 			const statementCounts = require_primordials_object.ObjectValues(fc.s);
 			for (const count of statementCounts) if (typeof count === "number") {
 				totals.statements.total += 1;
 				if (count > 0) totals.statements.covered += 1;
 			}
 		}
-		if (fc.b && /* @__PURE__ */ require_objects_predicates.isPlainObject(fc.b)) {
+		if (fc.b && require_objects_predicates.isPlainObject(fc.b)) {
 			const branchCounts = require_primordials_object.ObjectValues(fc.b);
 			for (const branches of branchCounts) if (require_primordials_array.ArrayIsArray(branches)) {
 				for (const count of branches) if (typeof count === "number") {
@@ -93,7 +93,7 @@ async function getCodeCoverage(options) {
 				}
 			}
 		}
-		if (fc.f && /* @__PURE__ */ require_objects_predicates.isPlainObject(fc.f)) {
+		if (fc.f && require_objects_predicates.isPlainObject(fc.f)) {
 			const functionCounts = require_primordials_object.ObjectValues(fc.f);
 			for (const count of functionCounts) if (typeof count === "number") {
 				totals.functions.total += 1;

package/dist/cover/formatters.js

@@ -95,13 +95,13 @@ function formatCoverage(options) {
 	if (format === "simple") return overall;
 	let output = "";
 	output += "Code Coverage:\n";
-	output += /* @__PURE__ */ require_strings_format.indentString(`Statements: ${code.statements.percent}%\n`, { count: 2 });
-	output += /* @__PURE__ */ require_strings_format.indentString(`Branches: ${code.branches.percent}%\n`, { count: 2 });
-	output += /* @__PURE__ */ require_strings_format.indentString(`Functions: ${code.functions.percent}%\n`, { count: 2 });
-	output += /* @__PURE__ */ require_strings_format.indentString(`Lines: ${code.lines.percent}%\n`, { count: 2 });
+	output += require_strings_format.indentString(`Statements: ${code.statements.percent}%\n`, { count: 2 });
+	output += require_strings_format.indentString(`Branches: ${code.branches.percent}%\n`, { count: 2 });
+	output += require_strings_format.indentString(`Functions: ${code.functions.percent}%\n`, { count: 2 });
+	output += require_strings_format.indentString(`Lines: ${code.lines.percent}%\n`, { count: 2 });
 	if (type) {
 		output += "\nType Coverage:\n";
-		output += /* @__PURE__ */ require_strings_format.indentString(`${type.percent}% (${type.covered}/${type.total})\n`, { count: 2 });
+		output += require_strings_format.indentString(`${type.percent}% (${type.covered}/${type.total})\n`, { count: 2 });
 	}
 	const overallValue = require_primordials_number.NumberParseFloat(overall);
 	const emoji = getCoverageEmoji(require_primordials_number.NumberIsNaN(overallValue) ? 0 : overallValue);

package/dist/crypto/hash.d.ts

@@ -3,6 +3,22 @@
  *   `node:crypto.hash()` (added v21.7.0 / v20.12.0) and falls back to the
  *   streaming `createHash().update().digest()` chain on older runtimes.
  */
+import type { hash as NodeHash } from 'node:crypto';
+/**
+ * Compute the Socket content-address of `bytes`: `Q` +
+ * base64url(sha256(bytes)).
+ *
+ * Matches the blob store's hash scheme so a fetched blob can be verified
+ * against the hash it was requested by.
+ *
+ * @example
+ *   ;```typescript
+ *   import { blobHashOf } from '@socketsecurity/lib/crypto/hash'
+ *
+ *   blobHashOf(new TextEncoder().encode('hello'))
+ *   ```
+ */
+export declare function blobHashOf(bytes: NodeJS.ArrayBufferView): string;
 /**
  * Compute a one-shot cryptographic hash.
  *
@@ -33,4 +49,13 @@ export declare function hash(algorithm: string, data: string | NodeJS.ArrayBuffe
  *
  * @internal
  */
-export declare function nativeHash(): typeof import('node:crypto').hash | undefined;
+export declare function nativeHash(): typeof NodeHash | undefined;
+/**
+ * Throw if `bytes` does not content-address to `blobHash`. Both `Q`-prefixed
+ * (single blob) and `S`-prefixed (file-stream) hashes share the sha256 digest
+ * body, so both verify against the same digest; the leading discriminator char
+ * is dropped before comparison.
+ *
+ * @throws {Error} When the recomputed digest does not match `blobHash`.
+ */
+export declare function verifyBlobHash(blobHash: string, bytes: NodeJS.ArrayBufferView): void;

package/dist/crypto/hash.js

@@ -9,8 +9,26 @@ const require_node_crypto = require('../node/crypto.js');
 *   `node:crypto.hash()` (added v21.7.0 / v20.12.0) and falls back to the
 *   streaming `createHash().update().digest()` chain on older runtimes.
 */
-let _hash;
-let _hashProbed = false;
+let cachedNativeHash;
+let nativeHashProbed = false;
+const BLOB_HASH_PREFIX = "Q";
+/**
+* Compute the Socket content-address of `bytes`: `Q` +
+* base64url(sha256(bytes)).
+*
+* Matches the blob store's hash scheme so a fetched blob can be verified
+* against the hash it was requested by.
+*
+* @example
+*   ;```typescript
+*   import { blobHashOf } from '@socketsecurity/lib/crypto/hash'
+*
+*   blobHashOf(new TextEncoder().encode('hello'))
+*   ```
+*/
+function blobHashOf(bytes) {
+	return BLOB_HASH_PREFIX + hash("sha256", bytes, "base64url");
+}
 /**
 * Compute a one-shot cryptographic hash.
 *
@@ -33,11 +51,10 @@ let _hashProbed = false;
 *   // 'z4PhNX7vuL3xVChQ1m2AB9Yg5AULVxXcg/SpIdNs6c5H0NE8XYXysP+DGNKHfuwvY7kxvUdBeoGlODJ6+SfaPg=='
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
 function hash(algorithm, data, outputEncoding) {
-	const native = /* @__PURE__ */ nativeHash();
+	const native = nativeHash();
 	if (native !== void 0) return native(algorithm, data, outputEncoding);
-	return (/* @__PURE__ */ require_node_crypto.getNodeCrypto()).createHash(algorithm).update(data).digest(outputEncoding);
+	return require_node_crypto.getNodeCrypto().createHash(algorithm).update(data).digest(outputEncoding);
 }
 /**
 * Resolve `crypto.hash` (or `undefined` if the runtime predates it).
@@ -46,16 +63,30 @@ function hash(algorithm, data, outputEncoding) {
 *
 * @internal
 */
-/* @__NO_SIDE_EFFECTS__ */
 function nativeHash() {
-	if (!_hashProbed) {
-		const fn = (/* @__PURE__ */ require_node_crypto.getNodeCrypto()).hash;
-		if (typeof fn === "function") _hash = fn;
-		_hashProbed = true;
+	if (!nativeHashProbed) {
+		const fn = require_node_crypto.getNodeCrypto().hash;
+		if (typeof fn === "function") cachedNativeHash = fn;
+		nativeHashProbed = true;
 	}
-	return _hash;
+	return cachedNativeHash;
+}
+/**
+* Throw if `bytes` does not content-address to `blobHash`. Both `Q`-prefixed
+* (single blob) and `S`-prefixed (file-stream) hashes share the sha256 digest
+* body, so both verify against the same digest; the leading discriminator char
+* is dropped before comparison.
+*
+* @throws {Error} When the recomputed digest does not match `blobHash`.
+*/
+function verifyBlobHash(blobHash, bytes) {
+	const expectedDigest = blobHash.slice(1);
+	const actualDigest = hash("sha256", bytes, "base64url");
+	if (actualDigest !== expectedDigest) throw new Error(`blob integrity check failed for ${blobHash}: content hashes to ${BLOB_HASH_PREFIX}${actualDigest}`);
 }
 
 //#endregion
+exports.blobHashOf = blobHashOf;
 exports.hash = hash;
-exports.nativeHash = nativeHash;
+exports.nativeHash = nativeHash;
+exports.verifyBlobHash = verifyBlobHash;

package/dist/debug/_internal.js

@@ -22,7 +22,7 @@ src_external_debug = require_runtime.__toESM(src_external_debug);
 */
 const logger = require_logger_default.getDefaultLogger();
 const debugByNamespace = new require_primordials_map_set.MapCtor();
-let _pointingTriangle;
+let pointingTriangle;
 /**
 * Custom log function for debug output.
 *
@@ -32,9 +32,8 @@ let _pointingTriangle;
 only fires when debugJs emits, which requires DEBUG=* env var
 set at the right module-load timing. Tests use the SOCKET_DEBUG
 path which writes via logger.info directly. */
-/* @__NO_SIDE_EFFECTS__ */
 function customLog(...args) {
-	const util = /* @__PURE__ */ require_node_util.getNodeUtil();
+	const util = require_node_util.getNodeUtil();
 	const inspectOpts = src_external_debug.default.inspectOpts ? {
 		...src_external_debug.default.inspectOpts,
 		showHidden: src_external_debug.default.inspectOpts.showHidden === null ? void 0 : src_external_debug.default.inspectOpts.showHidden,
@@ -53,10 +52,9 @@ function customLog(...args) {
 /* c8 ignore start - First-call init for module-level glyph; only
 one of the 5 debug functions hits the body. The unicode-fallback
 arm also fires only on terminals without unicode support. */
-/* @__NO_SIDE_EFFECTS__ */
 function getPointingTriangle() {
-	if (_pointingTriangle === void 0) _pointingTriangle = (0, src_external__socketregistry_is_unicode_supported.default)() ? "▸" : ">";
-	return _pointingTriangle;
+	if (pointingTriangle === void 0) pointingTriangle = (0, src_external__socketregistry_is_unicode_supported.default)() ? "▸" : ">";
+	return pointingTriangle;
 }
 /* c8 ignore stop */