@socketsecurity/lib 6.0.6 → 6.0.7

package/dist/constants/packages.js

@@ -20,12 +20,12 @@ src_external_pacote = require_runtime.__toESM(src_external_pacote);
 *   categories), the pacote cache path, lifecycle script names, and known
 *   package extensions used during manifest processing.
 */
-let _lifecycleScriptNames;
-let _packageDefaultNodeRange;
-let _packageDefaultSocketCategories;
-let _packageExtensions;
-let _pacoteCachePath;
-let _packumentCache;
+let cachedLifecycleScriptNames;
+let cachedPackageDefaultNodeRange;
+let cachedPackageDefaultSocketCategories;
+let cachedPackageExtensions;
+let cachedPacoteCachePath;
+let cachedPackumentCache;
 const PACKAGE = "package";
 const AT_LATEST = "@latest";
 const LATEST = "latest";
@@ -35,28 +35,24 @@ const PACKAGE_DEFAULT_VERSION = "1.0.0";
 * force a re-fetch of registry metadata.
 */
 function clearPackumentCache() {
-	/* c8 ignore next 3 */
-	if (_packumentCache !== void 0) _packumentCache.clear();
+	/* c8 ignore next 3 - uninitialized-cache branch unreachable in tests */
+	if (cachedPackumentCache !== void 0) cachedPackumentCache.clear();
 }
-/*@__NO_SIDE_EFFECTS__*/
 function getLifecycleScriptNames() {
-	if (_lifecycleScriptNames === void 0) _lifecycleScriptNames = require_primordials_array.ArrayFrom(require_constants_lifecycle_script_names.lifecycleScriptNames);
-	return _lifecycleScriptNames;
+	if (cachedLifecycleScriptNames === void 0) cachedLifecycleScriptNames = require_primordials_array.ArrayFrom(require_constants_lifecycle_script_names.lifecycleScriptNames);
+	return cachedLifecycleScriptNames;
 }
-/*@__NO_SIDE_EFFECTS__*/
 function getPackageDefaultNodeRange() {
-	if (_packageDefaultNodeRange === void 0) _packageDefaultNodeRange = require_constants_package_default_node_range.packageDefaultNodeRange;
-	return _packageDefaultNodeRange;
+	if (cachedPackageDefaultNodeRange === void 0) cachedPackageDefaultNodeRange = require_constants_package_default_node_range.packageDefaultNodeRange;
+	return cachedPackageDefaultNodeRange;
 }
-/*@__NO_SIDE_EFFECTS__*/
 function getPackageDefaultSocketCategories() {
-	if (_packageDefaultSocketCategories === void 0) _packageDefaultSocketCategories = require_constants_package_default_socket_categories.packageDefaultSocketCategories;
-	return _packageDefaultSocketCategories;
+	if (cachedPackageDefaultSocketCategories === void 0) cachedPackageDefaultSocketCategories = require_constants_package_default_socket_categories.packageDefaultSocketCategories;
+	return cachedPackageDefaultSocketCategories;
 }
-/*@__NO_SIDE_EFFECTS__*/
 function getPackageExtensions() {
-	if (_packageExtensions === void 0) _packageExtensions = require_primordials_object.ObjectEntries(require_pkg_ext_data.packageExtensions);
-	return _packageExtensions;
+	if (cachedPackageExtensions === void 0) cachedPackageExtensions = require_primordials_object.ObjectEntries(require_pkg_ext_data.packageExtensions);
+	return cachedPackageExtensions;
 }
 const PACKUMENT_CACHE_MAX = 500;
 var BoundedPackumentCache = class extends Map {
@@ -71,22 +67,20 @@ var BoundedPackumentCache = class extends Map {
 		return super.set(key, value);
 	}
 };
-/*@__NO_SIDE_EFFECTS__*/
 function getPackumentCache() {
-	if (_packumentCache === void 0) _packumentCache = new BoundedPackumentCache();
-	return _packumentCache;
+	if (cachedPackumentCache === void 0) cachedPackumentCache = new BoundedPackumentCache();
+	return cachedPackumentCache;
 }
-/*@__NO_SIDE_EFFECTS__*/
 function getPacoteCachePath() {
-	if (_pacoteCachePath === void 0) try {
+	if (cachedPacoteCachePath === void 0) try {
 		const PacoteFetcherBase = require_primordials_reflect.ReflectGetPrototypeOf(src_external_pacote.default.RegistryFetcher.prototype)?.constructor;
 		/* c8 ignore start */
 		const cachePath = PacoteFetcherBase ? new PacoteFetcherBase("x", {}).cache : "";
-		_pacoteCachePath = cachePath ? /* @__PURE__ */ require_paths_normalize.normalizePath(cachePath) : "";
+		cachedPacoteCachePath = cachePath ? require_paths_normalize.normalizePath(cachePath) : "";
 	} catch {
-		_pacoteCachePath = "";
+		cachedPacoteCachePath = "";
 	}
-	return _pacoteCachePath;
+	return cachedPacoteCachePath;
 }
 
 //#endregion

package/dist/constants/platform.d.ts

@@ -14,15 +14,42 @@ export type Libc = 'glibc' | 'musl';
  */
 export type Platform = NodeJS.Platform;
 /**
- * Get the current CPU architecture (memoized).
+ * Get the current CPU architecture (memoized), e.g. `x64`, `arm64`.
  */
 export declare function getArch(): Arch;
 /**
- * Get the current platform (memoized).
+ * Get the host libc variant (memoized): `'musl'` on Alpine-and-similar,
+ * `'glibc'` on other Linux, `undefined` off-Linux. Detected by probing for the
+ * musl dynamic linker. The single source of truth for libc detection —
+ * tool-specific resolvers (`getPythonArch`, `getJreArch`) call this rather than
+ * re-probing.
  */
-export declare function getPlatform(): Platform;
+export declare function getLibc(): Libc | undefined;
+/**
+ * Get the current OS (memoized), e.g. `darwin`, `linux`, `win32` — the raw
+ * `process.platform` value.
+ */
+export declare function getOs(): Platform;
+/**
+ * Get the current host **target** in the pnpm `pack-app` vocabulary (memoized):
+ * `<os>-<arch>[-<libc>]`, e.g. `darwin-arm64`, `linux-x64`, `win32-x64`,
+ * `linux-x64-musl`. Raw Node `process.platform`/`process.arch` joined with `-`,
+ * plus a `-musl` suffix on Alpine. This is the fleet-general naming for
+ * non-python / non-JRE tools (matches pnpm's release assets,
+ * `pnpm-<os>-<arch>[-<libc>].{tar.gz,zip}`). Tool-specific resolvers that need
+ * a different vocabulary own their own helper — see `getPythonArch`
+ * (python-build- standalone) / `getJreArch` (Adoptium).
+ */
+export declare function getTarget(): string;
 export declare const DARWIN: boolean;
 export declare const WIN32: boolean;
+/**
+ * True when this process was launched as a Chrome (or Chromium) native
+ * messaging host. Chrome passes the extension origin URL
+ * (`chrome-extension://<id>/`) as `process.argv[2]`; no other invocation shape
+ * produces that prefix.
+ */
+export declare const NATIVE_MESSAGING_HOST: boolean;
 export declare const S_IXUSR = 64;
 export declare const S_IXGRP = 8;
 export declare const S_IXOTH = 1;

package/dist/constants/platform.js

@@ -2,38 +2,98 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_node_os = require('../node/os.js');
+let node_fs = require("node:fs");
 
 //#region src/constants/platform.ts
 /**
 * @file Platform detection and OS-specific constants.
 */
-let _arch;
+let memoizedArch;
 /**
-* Get the current CPU architecture (memoized).
+* Get the current CPU architecture (memoized), e.g. `x64`, `arm64`.
 */
 function getArch() {
-	if (_arch === void 0) _arch = (/* @__PURE__ */ require_node_os.getNodeOs()).arch();
-	return _arch;
+	if (memoizedArch === void 0) memoizedArch = require_node_os.getNodeOs().arch();
+	return memoizedArch;
 }
-let _platform;
+const MUSL_LINKERS = [
+	"/lib/ld-musl-x86_64.so.1",
+	"/lib/ld-musl-aarch64.so.1",
+	"/usr/lib/ld-musl-x86_64.so.1",
+	"/usr/lib/ld-musl-aarch64.so.1"
+];
+let memoizedLibc;
+let memoizedLibcProbed = false;
 /**
-* Get the current platform (memoized).
+* Get the host libc variant (memoized): `'musl'` on Alpine-and-similar,
+* `'glibc'` on other Linux, `undefined` off-Linux. Detected by probing for the
+* musl dynamic linker. The single source of truth for libc detection —
+* tool-specific resolvers (`getPythonArch`, `getJreArch`) call this rather than
+* re-probing.
 */
-function getPlatform() {
-	if (_platform === void 0) _platform = (/* @__PURE__ */ require_node_os.getNodeOs()).platform();
-	return _platform;
+function getLibc() {
+	if (!memoizedLibcProbed) {
+		memoizedLibcProbed = true;
+		/* c8 ignore start - Linux-only filesystem probe. */
+		if (getOs() !== "linux") memoizedLibc = void 0;
+		else {
+			memoizedLibc = "glibc";
+			for (let i = 0, { length } = MUSL_LINKERS; i < length; i += 1) if ((0, node_fs.existsSync)(MUSL_LINKERS[i])) {
+				memoizedLibc = "musl";
+				break;
+			}
+		}
+	}
+	return memoizedLibc;
 }
-const DARWIN = getPlatform() === "darwin";
-const WIN32 = getPlatform() === "win32";
+let memoizedOs;
+/**
+* Get the current OS (memoized), e.g. `darwin`, `linux`, `win32` — the raw
+* `process.platform` value.
+*/
+function getOs() {
+	if (memoizedOs === void 0) memoizedOs = require_node_os.getNodeOs().platform();
+	return memoizedOs;
+}
+let memoizedTarget;
+/**
+* Get the current host **target** in the pnpm `pack-app` vocabulary (memoized):
+* `<os>-<arch>[-<libc>]`, e.g. `darwin-arm64`, `linux-x64`, `win32-x64`,
+* `linux-x64-musl`. Raw Node `process.platform`/`process.arch` joined with `-`,
+* plus a `-musl` suffix on Alpine. This is the fleet-general naming for
+* non-python / non-JRE tools (matches pnpm's release assets,
+* `pnpm-<os>-<arch>[-<libc>].{tar.gz,zip}`). Tool-specific resolvers that need
+* a different vocabulary own their own helper — see `getPythonArch`
+* (python-build- standalone) / `getJreArch` (Adoptium).
+*/
+function getTarget() {
+	if (memoizedTarget === void 0) {
+		const libcSuffix = getLibc() === "musl" ? "-musl" : "";
+		memoizedTarget = `${getOs()}-${getArch()}${libcSuffix}`;
+	}
+	return memoizedTarget;
+}
+const DARWIN = getOs() === "darwin";
+const WIN32 = getOs() === "win32";
+/**
+* True when this process was launched as a Chrome (or Chromium) native
+* messaging host. Chrome passes the extension origin URL
+* (`chrome-extension://<id>/`) as `process.argv[2]`; no other invocation shape
+* produces that prefix.
+*/
+const NATIVE_MESSAGING_HOST = typeof process !== "undefined" && typeof process.argv[2] === "string" && process.argv[2].startsWith("chrome-extension://");
 const S_IXUSR = 64;
 const S_IXGRP = 8;
 const S_IXOTH = 1;
 
 //#endregion
 exports.DARWIN = DARWIN;
+exports.NATIVE_MESSAGING_HOST = NATIVE_MESSAGING_HOST;
 exports.S_IXGRP = S_IXGRP;
 exports.S_IXOTH = S_IXOTH;
 exports.S_IXUSR = S_IXUSR;
 exports.WIN32 = WIN32;
 exports.getArch = getArch;
-exports.getPlatform = getPlatform;
+exports.getLibc = getLibc;
+exports.getOs = getOs;
+exports.getTarget = getTarget;

package/dist/constants/runtime.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @file Runtime environment detection constants. All checks use only
+ *   `typeof`-safe global probes so this module is safe to import in browser,
+ *   Node.js, Deno, Bun, and bundled contexts alike.
+ */
+/**
+ * True when running inside a Node.js process. Detected via
+ * `process.versions.node` — present in Node, absent in browsers and Deno/Bun
+ * which expose a different `process.versions` shape (or no `process` at all).
+ */
+export declare const IS_NODE: boolean;
+/**
+ * True when running in a browser context (window + document both defined).
+ * Note: Chrome extensions have `window` in popup contexts but not in service
+ * workers — check `IS_SERVICE_WORKER` for that case.
+ */
+export declare const IS_BROWSER: boolean;
+/**
+ * True when running inside a Web Worker / Chrome MV3 service worker. `self` is
+ * defined without `window` in worker contexts.
+ */
+export declare const IS_WORKER: boolean;

package/dist/constants/runtime.js

@@ -0,0 +1,32 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+//#region src/constants/runtime.ts
+/**
+* @file Runtime environment detection constants. All checks use only
+*   `typeof`-safe global probes so this module is safe to import in browser,
+*   Node.js, Deno, Bun, and bundled contexts alike.
+*/
+/**
+* True when running inside a Node.js process. Detected via
+* `process.versions.node` — present in Node, absent in browsers and Deno/Bun
+* which expose a different `process.versions` shape (or no `process` at all).
+*/
+const IS_NODE = typeof process !== "undefined" && typeof process.versions !== "undefined" && typeof process.versions.node === "string";
+/**
+* True when running in a browser context (window + document both defined).
+* Note: Chrome extensions have `window` in popup contexts but not in service
+* workers — check `IS_SERVICE_WORKER` for that case.
+*/
+const IS_BROWSER = typeof window !== "undefined" && typeof document !== "undefined";
+/**
+* True when running inside a Web Worker / Chrome MV3 service worker. `self` is
+* defined without `window` in worker contexts.
+*/
+const IS_WORKER = typeof self !== "undefined" && typeof window === "undefined" && typeof document === "undefined";
+
+//#endregion
+exports.IS_BROWSER = IS_BROWSER;
+exports.IS_NODE = IS_NODE;
+exports.IS_WORKER = IS_WORKER;

package/dist/constants/socket.js

@@ -33,7 +33,7 @@ const SOCKET_REGISTRY_APP_NAME = "registry";
 const SOCKET_WHEELHOUSE_APP_NAME = "wheelhouse";
 const SOCKET_APP_PREFIX = "_";
 const SOCKET_LIB_NAME = "@socketsecurity/lib";
-const SOCKET_LIB_VERSION = "6.0.6";
+const SOCKET_LIB_VERSION = "6.0.7";
 const SOCKET_IPC_HANDSHAKE = "SOCKET_IPC_HANDSHAKE";
 const CACHE_SOCKET_API_DIR = "socket-api";
 const REGISTRY = "registry";

package/dist/cover/code.js

@@ -38,18 +38,18 @@ function calculateMetric(data) {
 async function getCodeCoverage(options) {
 	const { coveragePath, generateIfMissing } = {
 		__proto__: null,
-		coveragePath: (/* @__PURE__ */ require_node_path.getNodePath()).join(node_process.default.cwd(), "coverage/coverage-final.json"),
+		coveragePath: require_node_path.getNodePath().join(node_process.default.cwd(), "coverage/coverage-final.json"),
 		generateIfMissing: false,
 		...options
 	};
 	if (!coveragePath) throw new require_primordials_error.ErrorCtor("Coverage path is required");
-	if (!(/* @__PURE__ */ require_node_fs.getNodeFs()).existsSync(coveragePath)) if (generateIfMissing) await require_process_spawn_child.spawn("vitest", ["run", "--coverage"], {
+	if (!require_node_fs.getNodeFs().existsSync(coveragePath)) if (generateIfMissing) await require_process_spawn_child.spawn("vitest", ["run", "--coverage"], {
 		cwd: node_process.default.cwd(),
 		stdio: "inherit"
 	});
 	else throw new require_primordials_error.ErrorCtor(`Coverage file not found at "${coveragePath}". Run tests with coverage first.`);
-	const coverageData = await /* @__PURE__ */ require_fs_read_json.readJson(coveragePath);
-	if (!/* @__PURE__ */ require_objects_predicates.isPlainObject(coverageData)) throw new require_primordials_error.ErrorCtor(`Invalid coverage data format in "${coveragePath}"`);
+	const coverageData = await require_fs_read_json.readJson(coveragePath);
+	if (!require_objects_predicates.isPlainObject(coverageData)) throw new require_primordials_error.ErrorCtor(`Invalid coverage data format in "${coveragePath}"`);
 	const totals = {
 		__proto__: null,
 		branches: {
@@ -75,16 +75,16 @@ async function getCodeCoverage(options) {
 	};
 	const v8Data = coverageData;
 	for (const fileCoverage of require_primordials_object.ObjectValues(v8Data)) {
-		if (!/* @__PURE__ */ require_objects_predicates.isPlainObject(fileCoverage)) continue;
+		if (!require_objects_predicates.isPlainObject(fileCoverage)) continue;
 		const fc = fileCoverage;
-		if (fc.s && /* @__PURE__ */ require_objects_predicates.isPlainObject(fc.s)) {
+		if (fc.s && require_objects_predicates.isPlainObject(fc.s)) {
 			const statementCounts = require_primordials_object.ObjectValues(fc.s);
 			for (const count of statementCounts) if (typeof count === "number") {
 				totals.statements.total += 1;
 				if (count > 0) totals.statements.covered += 1;
 			}
 		}
-		if (fc.b && /* @__PURE__ */ require_objects_predicates.isPlainObject(fc.b)) {
+		if (fc.b && require_objects_predicates.isPlainObject(fc.b)) {
 			const branchCounts = require_primordials_object.ObjectValues(fc.b);
 			for (const branches of branchCounts) if (require_primordials_array.ArrayIsArray(branches)) {
 				for (const count of branches) if (typeof count === "number") {
@@ -93,7 +93,7 @@ async function getCodeCoverage(options) {
 				}
 			}
 		}
-		if (fc.f && /* @__PURE__ */ require_objects_predicates.isPlainObject(fc.f)) {
+		if (fc.f && require_objects_predicates.isPlainObject(fc.f)) {
 			const functionCounts = require_primordials_object.ObjectValues(fc.f);
 			for (const count of functionCounts) if (typeof count === "number") {
 				totals.functions.total += 1;

package/dist/cover/formatters.js

@@ -95,13 +95,13 @@ function formatCoverage(options) {
 	if (format === "simple") return overall;
 	let output = "";
 	output += "Code Coverage:\n";
-	output += /* @__PURE__ */ require_strings_format.indentString(`Statements: ${code.statements.percent}%\n`, { count: 2 });
-	output += /* @__PURE__ */ require_strings_format.indentString(`Branches: ${code.branches.percent}%\n`, { count: 2 });
-	output += /* @__PURE__ */ require_strings_format.indentString(`Functions: ${code.functions.percent}%\n`, { count: 2 });
-	output += /* @__PURE__ */ require_strings_format.indentString(`Lines: ${code.lines.percent}%\n`, { count: 2 });
+	output += require_strings_format.indentString(`Statements: ${code.statements.percent}%\n`, { count: 2 });
+	output += require_strings_format.indentString(`Branches: ${code.branches.percent}%\n`, { count: 2 });
+	output += require_strings_format.indentString(`Functions: ${code.functions.percent}%\n`, { count: 2 });
+	output += require_strings_format.indentString(`Lines: ${code.lines.percent}%\n`, { count: 2 });
 	if (type) {
 		output += "\nType Coverage:\n";
-		output += /* @__PURE__ */ require_strings_format.indentString(`${type.percent}% (${type.covered}/${type.total})\n`, { count: 2 });
+		output += require_strings_format.indentString(`${type.percent}% (${type.covered}/${type.total})\n`, { count: 2 });
 	}
 	const overallValue = require_primordials_number.NumberParseFloat(overall);
 	const emoji = getCoverageEmoji(require_primordials_number.NumberIsNaN(overallValue) ? 0 : overallValue);

package/dist/crypto/hash.d.ts

@@ -3,6 +3,22 @@
  *   `node:crypto.hash()` (added v21.7.0 / v20.12.0) and falls back to the
  *   streaming `createHash().update().digest()` chain on older runtimes.
  */
+import type { hash as NodeHash } from 'node:crypto';
+/**
+ * Compute the Socket content-address of `bytes`: `Q` +
+ * base64url(sha256(bytes)).
+ *
+ * Matches the blob store's hash scheme so a fetched blob can be verified
+ * against the hash it was requested by.
+ *
+ * @example
+ *   ;```typescript
+ *   import { blobHashOf } from '@socketsecurity/lib/crypto/hash'
+ *
+ *   blobHashOf(new TextEncoder().encode('hello'))
+ *   ```
+ */
+export declare function blobHashOf(bytes: NodeJS.ArrayBufferView): string;
 /**
  * Compute a one-shot cryptographic hash.
  *
@@ -33,4 +49,13 @@ export declare function hash(algorithm: string, data: string | NodeJS.ArrayBuffe
  *
  * @internal
  */
-export declare function nativeHash(): typeof import('node:crypto').hash | undefined;
+export declare function nativeHash(): typeof NodeHash | undefined;
+/**
+ * Throw if `bytes` does not content-address to `blobHash`. Both `Q`-prefixed
+ * (single blob) and `S`-prefixed (file-stream) hashes share the sha256 digest
+ * body, so both verify against the same digest; the leading discriminator char
+ * is dropped before comparison.
+ *
+ * @throws {Error} When the recomputed digest does not match `blobHash`.
+ */
+export declare function verifyBlobHash(blobHash: string, bytes: NodeJS.ArrayBufferView): void;

package/dist/crypto/hash.js

@@ -9,8 +9,26 @@ const require_node_crypto = require('../node/crypto.js');
 *   `node:crypto.hash()` (added v21.7.0 / v20.12.0) and falls back to the
 *   streaming `createHash().update().digest()` chain on older runtimes.
 */
-let _hash;
-let _hashProbed = false;
+let cachedNativeHash;
+let nativeHashProbed = false;
+const BLOB_HASH_PREFIX = "Q";
+/**
+* Compute the Socket content-address of `bytes`: `Q` +
+* base64url(sha256(bytes)).
+*
+* Matches the blob store's hash scheme so a fetched blob can be verified
+* against the hash it was requested by.
+*
+* @example
+*   ;```typescript
+*   import { blobHashOf } from '@socketsecurity/lib/crypto/hash'
+*
+*   blobHashOf(new TextEncoder().encode('hello'))
+*   ```
+*/
+function blobHashOf(bytes) {
+	return BLOB_HASH_PREFIX + hash("sha256", bytes, "base64url");
+}
 /**
 * Compute a one-shot cryptographic hash.
 *
@@ -33,11 +51,10 @@ let _hashProbed = false;
 *   // 'z4PhNX7vuL3xVChQ1m2AB9Yg5AULVxXcg/SpIdNs6c5H0NE8XYXysP+DGNKHfuwvY7kxvUdBeoGlODJ6+SfaPg=='
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function hash(algorithm, data, outputEncoding) {
-	const native = /* @__PURE__ */ nativeHash();
+	const native = nativeHash();
 	if (native !== void 0) return native(algorithm, data, outputEncoding);
-	return (/* @__PURE__ */ require_node_crypto.getNodeCrypto()).createHash(algorithm).update(data).digest(outputEncoding);
+	return require_node_crypto.getNodeCrypto().createHash(algorithm).update(data).digest(outputEncoding);
 }
 /**
 * Resolve `crypto.hash` (or `undefined` if the runtime predates it).
@@ -46,16 +63,30 @@ function hash(algorithm, data, outputEncoding) {
 *
 * @internal
 */
-/*@__NO_SIDE_EFFECTS__*/
 function nativeHash() {
-	if (!_hashProbed) {
-		const fn = (/* @__PURE__ */ require_node_crypto.getNodeCrypto()).hash;
-		if (typeof fn === "function") _hash = fn;
-		_hashProbed = true;
+	if (!nativeHashProbed) {
+		const fn = require_node_crypto.getNodeCrypto().hash;
+		if (typeof fn === "function") cachedNativeHash = fn;
+		nativeHashProbed = true;
 	}
-	return _hash;
+	return cachedNativeHash;
+}
+/**
+* Throw if `bytes` does not content-address to `blobHash`. Both `Q`-prefixed
+* (single blob) and `S`-prefixed (file-stream) hashes share the sha256 digest
+* body, so both verify against the same digest; the leading discriminator char
+* is dropped before comparison.
+*
+* @throws {Error} When the recomputed digest does not match `blobHash`.
+*/
+function verifyBlobHash(blobHash, bytes) {
+	const expectedDigest = blobHash.slice(1);
+	const actualDigest = hash("sha256", bytes, "base64url");
+	if (actualDigest !== expectedDigest) throw new Error(`blob integrity check failed for ${blobHash}: content hashes to ${BLOB_HASH_PREFIX}${actualDigest}`);
 }
 
 //#endregion
+exports.blobHashOf = blobHashOf;
 exports.hash = hash;
-exports.nativeHash = nativeHash;
+exports.nativeHash = nativeHash;
+exports.verifyBlobHash = verifyBlobHash;

package/dist/debug/_internal.js

@@ -22,7 +22,7 @@ src_external_debug = require_runtime.__toESM(src_external_debug);
 */
 const logger = require_logger_default.getDefaultLogger();
 const debugByNamespace = new require_primordials_map_set.MapCtor();
-let _pointingTriangle;
+let pointingTriangle;
 /**
 * Custom log function for debug output.
 *
@@ -32,9 +32,8 @@ let _pointingTriangle;
 only fires when debugJs emits, which requires DEBUG=* env var
 set at the right module-load timing. Tests use the SOCKET_DEBUG
 path which writes via logger.info directly. */
-/*@__NO_SIDE_EFFECTS__*/
 function customLog(...args) {
-	const util = /* @__PURE__ */ require_node_util.getNodeUtil();
+	const util = require_node_util.getNodeUtil();
 	const inspectOpts = src_external_debug.default.inspectOpts ? {
 		...src_external_debug.default.inspectOpts,
 		showHidden: src_external_debug.default.inspectOpts.showHidden === null ? void 0 : src_external_debug.default.inspectOpts.showHidden,
@@ -53,10 +52,9 @@ function customLog(...args) {
 /* c8 ignore start - First-call init for module-level glyph; only
 one of the 5 debug functions hits the body. The unicode-fallback
 arm also fires only on terminals without unicode support. */
-/*@__NO_SIDE_EFFECTS__*/
 function getPointingTriangle() {
-	if (_pointingTriangle === void 0) _pointingTriangle = (0, src_external__socketregistry_is_unicode_supported.default)() ? "▸" : ">";
-	return _pointingTriangle;
+	if (pointingTriangle === void 0) pointingTriangle = (0, src_external__socketregistry_is_unicode_supported.default)() ? "▸" : ">";
+	return pointingTriangle;
 }
 /* c8 ignore stop */
 

package/dist/debug/caller-info.js

@@ -16,7 +16,6 @@ const require_objects_predicates = require('../objects/predicates.js');
 *
 * @private
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getCallerInfo(stackOffset = 3) {
 	let name = "";
 	const captureStackTrace = Error.captureStackTrace;
@@ -33,14 +32,14 @@ function getCallerInfo(stackOffset = 3) {
 				if (lineCount < stackOffset) lineStart = i + 1;
 				else {
 					const line = stack.slice(lineStart, i).trimStart();
-					const match = /(?<=^at\s+).*?(?=\s+\(|$)/.exec(line)?.[0];
+					const match = /(?<=^at\s+).*?(?=$|\s+\()/.exec(line)?.[0];
 					/* c8 ignore next - Defensive guard; real V8 stack frames
 					always start with 'at '. */
 					if (match) {
 						name = match.replace(/^(?:async|bound|get|new|set)\s+/, "");
 						if (require_primordials_string.StringPrototypeStartsWith(name, "Object.")) {
 							const afterDot = require_primordials_string.StringPrototypeSlice(name, 7);
-							if (!/* @__PURE__ */ require_objects_predicates.hasOwn(Object, afterDot)) name = afterDot;
+							if (!require_objects_predicates.hasOwn(Object, afterDot)) name = afterDot;
 						}
 					}
 					break;

package/dist/debug/namespace.d.ts

@@ -33,3 +33,10 @@ export declare function isDebugNs(namespaces: string | undefined): boolean;
  * @private
  */
 export declare function isEnabled(namespaces: string | undefined): boolean;
+/**
+ * Whether SOCKET_DEBUG enables debug output. A namespace value like `*` or
+ * `socket:foo` enables it (these aren't boolean literals, so `envAsBoolean`
+ * alone would wrongly read them as false); an explicit boolean-false (`0`,
+ * `false`, `no`) or an empty/unset value disables it.
+ */
+export declare function isSocketDebugEnabled(): boolean;

package/dist/debug/namespace.js

@@ -23,7 +23,6 @@ src_external_debug = require_runtime.__toESM(src_external_debug);
 *
 * @private
 */
-/*@__NO_SIDE_EFFECTS__*/
 function extractOptions(namespaces) {
 	return namespaces !== null && typeof namespaces === "object" ? {
 		__proto__: null,
@@ -38,12 +37,11 @@ function extractOptions(namespaces) {
 *
 * @private
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getDebugJsInstance(namespace) {
 	let inst = require_debug__internal.debugByNamespace.get(namespace);
 	/* c8 ignore start */
 	if (inst) return inst;
-	if (!/* @__PURE__ */ require_env_debug.getDebug() && /* @__PURE__ */ require_env_socket.getSocketDebug() && (namespace === "error" || namespace === "notice")) src_external_debug.default.enable(namespace);
+	if (!require_env_debug.getDebug() && require_env_socket.getSocketDebug() && (namespace === "error" || namespace === "notice")) src_external_debug.default.enable(namespace);
 	/* c8 ignore stop */
 	/* c8 ignore next - External debug library call */
 	inst = (0, src_external_debug.default)(namespace);
@@ -54,33 +52,43 @@ function getDebugJsInstance(namespace) {
 /**
 * Check if debug mode is enabled.
 */
-/*@__NO_SIDE_EFFECTS__*/
 function isDebug() {
-	return !!/* @__PURE__ */ require_env_socket.getSocketDebug();
+	return isSocketDebugEnabled();
 }
 /**
 * Check if debug mode is enabled.
 */
-/*@__NO_SIDE_EFFECTS__*/
 function isDebugNs(namespaces) {
-	return !!/* @__PURE__ */ require_env_socket.getSocketDebug() && /* @__PURE__ */ isEnabled(namespaces);
+	return isSocketDebugEnabled() && isEnabled(namespaces);
 }
 /**
 * Check if debug is enabled for given namespaces.
 *
 * @private
 */
-/*@__NO_SIDE_EFFECTS__*/
 function isEnabled(namespaces) {
-	if (!/* @__PURE__ */ require_env_socket.getSocketDebug()) return false;
+	if (!require_env_socket.getSocketDebug()) return false;
 	if (typeof namespaces !== "string" || !namespaces || namespaces === "*") return true;
 	const split = namespaces.trim().replace(/\s+/g, ",").split(",").filter(Boolean);
 	const names = [];
 	const skips = [];
 	for (const ns of split) if (require_primordials_string.StringPrototypeStartsWith(ns, "-")) skips.push(ns.slice(1));
 	else names.push(ns);
-	if (names.length && !names.some((ns) => (/* @__PURE__ */ getDebugJsInstance(ns)).enabled)) return false;
-	return skips.every((ns) => !(/* @__PURE__ */ getDebugJsInstance(ns)).enabled);
+	if (names.length && !names.some((ns) => getDebugJsInstance(ns).enabled)) return false;
+	return skips.every((ns) => !getDebugJsInstance(ns).enabled);
+}
+/**
+* Whether SOCKET_DEBUG enables debug output. A namespace value like `*` or
+* `socket:foo` enables it (these aren't boolean literals, so `envAsBoolean`
+* alone would wrongly read them as false); an explicit boolean-false (`0`,
+* `false`, `no`) or an empty/unset value disables it.
+*/
+function isSocketDebugEnabled() {
+	const value = require_env_socket.getSocketDebug();
+	if (!value) return false;
+	const lower = value.trim().toLowerCase();
+	if (lower === "0" || lower === "false" || lower === "no") return false;
+	return true;
 }
 
 //#endregion
@@ -88,4 +96,5 @@ exports.extractOptions = extractOptions;
 exports.getDebugJsInstance = getDebugJsInstance;
 exports.isDebug = isDebug;
 exports.isDebugNs = isDebugNs;
-exports.isEnabled = isEnabled;
+exports.isEnabled = isEnabled;
+exports.isSocketDebugEnabled = isSocketDebugEnabled;