@socketsecurity/lib 6.0.6 → 6.0.8

package/dist/crypto/hash.js

@@ -7,10 +7,31 @@ const require_node_crypto = require('../node/crypto.js');
 /**
 * @file Crypto hash helpers that prefer Node builtins where available. Probes
 *   `node:crypto.hash()` (added v21.7.0 / v20.12.0) and falls back to the
-*   streaming `createHash().update().digest()` chain on older runtimes.
+*   streaming `createHash().update().digest()` chain on older runtimes. Which
+*   digest goes where (integrity = sha512 trust boundary; checksum = sha256
+*   interop shape; cache keys = truncated, never trust): see
+*   `docs/hash-algorithms.md`.
 */
-let _hash;
-let _hashProbed = false;
+let cachedNativeHash;
+let nativeHashProbed = false;
+const BLOB_HASH_PREFIX = "Q";
+/**
+* Compute the Socket content-address of `bytes`: `Q` +
+* base64url(sha256(bytes)).
+*
+* Matches the blob store's hash scheme so a fetched blob can be verified
+* against the hash it was requested by.
+*
+* @example
+*   ;```typescript
+*   import { blobHashOf } from '@socketsecurity/lib/crypto/hash'
+*
+*   blobHashOf(new TextEncoder().encode('hello'))
+*   ```
+*/
+function blobHashOf(bytes) {
+	return BLOB_HASH_PREFIX + hash("sha256", bytes, "base64url");
+}
 /**
 * Compute a one-shot cryptographic hash.
 *
@@ -33,11 +54,10 @@ let _hashProbed = false;
 *   // 'z4PhNX7vuL3xVChQ1m2AB9Yg5AULVxXcg/SpIdNs6c5H0NE8XYXysP+DGNKHfuwvY7kxvUdBeoGlODJ6+SfaPg=='
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function hash(algorithm, data, outputEncoding) {
-	const native = /* @__PURE__ */ nativeHash();
+	const native = nativeHash();
 	if (native !== void 0) return native(algorithm, data, outputEncoding);
-	return (/* @__PURE__ */ require_node_crypto.getNodeCrypto()).createHash(algorithm).update(data).digest(outputEncoding);
+	return require_node_crypto.getNodeCrypto().createHash(algorithm).update(data).digest(outputEncoding);
 }
 /**
 * Resolve `crypto.hash` (or `undefined` if the runtime predates it).
@@ -46,16 +66,30 @@ function hash(algorithm, data, outputEncoding) {
 *
 * @internal
 */
-/*@__NO_SIDE_EFFECTS__*/
 function nativeHash() {
-	if (!_hashProbed) {
-		const fn = (/* @__PURE__ */ require_node_crypto.getNodeCrypto()).hash;
-		if (typeof fn === "function") _hash = fn;
-		_hashProbed = true;
+	if (!nativeHashProbed) {
+		const fn = require_node_crypto.getNodeCrypto().hash;
+		if (typeof fn === "function") cachedNativeHash = fn;
+		nativeHashProbed = true;
 	}
-	return _hash;
+	return cachedNativeHash;
+}
+/**
+* Throw if `bytes` does not content-address to `blobHash`. Both `Q`-prefixed
+* (single blob) and `S`-prefixed (file-stream) hashes share the sha256 digest
+* body, so both verify against the same digest; the leading discriminator char
+* is dropped before comparison.
+*
+* @throws {Error} When the recomputed digest does not match `blobHash`.
+*/
+function verifyBlobHash(blobHash, bytes) {
+	const expectedDigest = blobHash.slice(1);
+	const actualDigest = hash("sha256", bytes, "base64url");
+	if (actualDigest !== expectedDigest) throw new Error(`blob integrity check failed for ${blobHash}: content hashes to ${BLOB_HASH_PREFIX}${actualDigest}`);
 }
 
 //#endregion
+exports.blobHashOf = blobHashOf;
 exports.hash = hash;
-exports.nativeHash = nativeHash;
+exports.nativeHash = nativeHash;
+exports.verifyBlobHash = verifyBlobHash;

package/dist/debug/_internal.js

@@ -22,7 +22,7 @@ src_external_debug = require_runtime.__toESM(src_external_debug);
 */
 const logger = require_logger_default.getDefaultLogger();
 const debugByNamespace = new require_primordials_map_set.MapCtor();
-let _pointingTriangle;
+let pointingTriangle;
 /**
 * Custom log function for debug output.
 *
@@ -32,9 +32,8 @@ let _pointingTriangle;
 only fires when debugJs emits, which requires DEBUG=* env var
 set at the right module-load timing. Tests use the SOCKET_DEBUG
 path which writes via logger.info directly. */
-/*@__NO_SIDE_EFFECTS__*/
 function customLog(...args) {
-	const util = /* @__PURE__ */ require_node_util.getNodeUtil();
+	const util = require_node_util.getNodeUtil();
 	const inspectOpts = src_external_debug.default.inspectOpts ? {
 		...src_external_debug.default.inspectOpts,
 		showHidden: src_external_debug.default.inspectOpts.showHidden === null ? void 0 : src_external_debug.default.inspectOpts.showHidden,
@@ -53,10 +52,9 @@ function customLog(...args) {
 /* c8 ignore start - First-call init for module-level glyph; only
 one of the 5 debug functions hits the body. The unicode-fallback
 arm also fires only on terminals without unicode support. */
-/*@__NO_SIDE_EFFECTS__*/
 function getPointingTriangle() {
-	if (_pointingTriangle === void 0) _pointingTriangle = (0, src_external__socketregistry_is_unicode_supported.default)() ? "▸" : ">";
-	return _pointingTriangle;
+	if (pointingTriangle === void 0) pointingTriangle = (0, src_external__socketregistry_is_unicode_supported.default)() ? "▸" : ">";
+	return pointingTriangle;
 }
 /* c8 ignore stop */
 

package/dist/debug/caller-info.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_primordials_string = require('../primordials/string.js');
 const require_objects_predicates = require('../objects/predicates.js');
+const require_primordials_string = require('../primordials/string.js');
 
 //#region src/debug/caller-info.ts
 /**
@@ -16,7 +16,6 @@ const require_objects_predicates = require('../objects/predicates.js');
 *
 * @private
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getCallerInfo(stackOffset = 3) {
 	let name = "";
 	const captureStackTrace = Error.captureStackTrace;
@@ -33,14 +32,14 @@ function getCallerInfo(stackOffset = 3) {
 				if (lineCount < stackOffset) lineStart = i + 1;
 				else {
 					const line = stack.slice(lineStart, i).trimStart();
-					const match = /(?<=^at\s+).*?(?=\s+\(|$)/.exec(line)?.[0];
+					const match = /(?<=^at\s+).*?(?=$|\s+\()/.exec(line)?.[0];
 					/* c8 ignore next - Defensive guard; real V8 stack frames
 					always start with 'at '. */
 					if (match) {
 						name = match.replace(/^(?:async|bound|get|new|set)\s+/, "");
 						if (require_primordials_string.StringPrototypeStartsWith(name, "Object.")) {
 							const afterDot = require_primordials_string.StringPrototypeSlice(name, 7);
-							if (!/* @__PURE__ */ require_objects_predicates.hasOwn(Object, afterDot)) name = afterDot;
+							if (!require_objects_predicates.hasOwn(Object, afterDot)) name = afterDot;
 						}
 					}
 					break;

package/dist/debug/namespace.d.ts

@@ -33,3 +33,10 @@ export declare function isDebugNs(namespaces: string | undefined): boolean;
  * @private
  */
 export declare function isEnabled(namespaces: string | undefined): boolean;
+/**
+ * Whether SOCKET_DEBUG enables debug output. A namespace value like `*` or
+ * `socket:foo` enables it (these aren't boolean literals, so `envAsBoolean`
+ * alone would wrongly read them as false); an explicit boolean-false (`0`,
+ * `false`, `no`) or an empty/unset value disables it.
+ */
+export declare function isSocketDebugEnabled(): boolean;

package/dist/debug/namespace.js

@@ -23,7 +23,6 @@ src_external_debug = require_runtime.__toESM(src_external_debug);
 *
 * @private
 */
-/*@__NO_SIDE_EFFECTS__*/
 function extractOptions(namespaces) {
 	return namespaces !== null && typeof namespaces === "object" ? {
 		__proto__: null,
@@ -38,12 +37,11 @@ function extractOptions(namespaces) {
 *
 * @private
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getDebugJsInstance(namespace) {
 	let inst = require_debug__internal.debugByNamespace.get(namespace);
 	/* c8 ignore start */
 	if (inst) return inst;
-	if (!/* @__PURE__ */ require_env_debug.getDebug() && /* @__PURE__ */ require_env_socket.getSocketDebug() && (namespace === "error" || namespace === "notice")) src_external_debug.default.enable(namespace);
+	if (!require_env_debug.getDebug() && require_env_socket.getSocketDebug() && (namespace === "error" || namespace === "notice")) src_external_debug.default.enable(namespace);
 	/* c8 ignore stop */
 	/* c8 ignore next - External debug library call */
 	inst = (0, src_external_debug.default)(namespace);
@@ -54,33 +52,43 @@ function getDebugJsInstance(namespace) {
 /**
 * Check if debug mode is enabled.
 */
-/*@__NO_SIDE_EFFECTS__*/
 function isDebug() {
-	return !!/* @__PURE__ */ require_env_socket.getSocketDebug();
+	return isSocketDebugEnabled();
 }
 /**
 * Check if debug mode is enabled.
 */
-/*@__NO_SIDE_EFFECTS__*/
 function isDebugNs(namespaces) {
-	return !!/* @__PURE__ */ require_env_socket.getSocketDebug() && /* @__PURE__ */ isEnabled(namespaces);
+	return isSocketDebugEnabled() && isEnabled(namespaces);
 }
 /**
 * Check if debug is enabled for given namespaces.
 *
 * @private
 */
-/*@__NO_SIDE_EFFECTS__*/
 function isEnabled(namespaces) {
-	if (!/* @__PURE__ */ require_env_socket.getSocketDebug()) return false;
+	if (!require_env_socket.getSocketDebug()) return false;
 	if (typeof namespaces !== "string" || !namespaces || namespaces === "*") return true;
 	const split = namespaces.trim().replace(/\s+/g, ",").split(",").filter(Boolean);
 	const names = [];
 	const skips = [];
 	for (const ns of split) if (require_primordials_string.StringPrototypeStartsWith(ns, "-")) skips.push(ns.slice(1));
 	else names.push(ns);
-	if (names.length && !names.some((ns) => (/* @__PURE__ */ getDebugJsInstance(ns)).enabled)) return false;
-	return skips.every((ns) => !(/* @__PURE__ */ getDebugJsInstance(ns)).enabled);
+	if (names.length && !names.some((ns) => getDebugJsInstance(ns).enabled)) return false;
+	return skips.every((ns) => !getDebugJsInstance(ns).enabled);
+}
+/**
+* Whether SOCKET_DEBUG enables debug output. A namespace value like `*` or
+* `socket:foo` enables it (these aren't boolean literals, so `envAsBoolean`
+* alone would wrongly read them as false); an explicit boolean-false (`0`,
+* `false`, `no`) or an empty/unset value disables it.
+*/
+function isSocketDebugEnabled() {
+	const value = require_env_socket.getSocketDebug();
+	if (!value) return false;
+	const lower = value.trim().toLowerCase();
+	if (lower === "0" || lower === "false" || lower === "no") return false;
+	return true;
 }
 
 //#endregion
@@ -88,4 +96,5 @@ exports.extractOptions = extractOptions;
 exports.getDebugJsInstance = getDebugJsInstance;
 exports.isDebug = isDebug;
 exports.isDebugNs = isDebugNs;
-exports.isEnabled = isEnabled;
+exports.isEnabled = isEnabled;
+exports.isSocketDebugEnabled = isSocketDebugEnabled;

package/dist/debug/output.js

@@ -39,10 +39,9 @@ function debug(...args) {
 *   debugCache('miss', 'socket-sdk:scans:xyz', { ttl: 60000 })
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function debugCache(operation, key, meta) {
-	if (!/* @__PURE__ */ require_env_socket.getSocketDebug()) return;
-	const prefix = `[CACHE] ${/* @__PURE__ */ require_debug_caller_info.getCallerInfo(3) || "cache"} ${/* @__PURE__ */ require_debug__internal.getPointingTriangle()} ${operation}: ${key}`;
+	if (!require_env_socket.getSocketDebug()) return;
+	const prefix = `[CACHE] ${require_debug_caller_info.getCallerInfo(3) || "cache"} ${require_debug__internal.getPointingTriangle()} ${operation}: ${key}`;
 	const args = meta !== void 0 ? [prefix, meta] : [prefix];
 	require_primordials_reflect.ReflectApply(require_debug__internal.logger.info, require_debug__internal.logger, args);
 }
@@ -52,10 +51,10 @@ function debugCache(operation, key, meta) {
 * message. Optional third argument is metadata object.
 */
 function debugCacheNs(namespacesOrOpts, operation, key, meta) {
-	const options = /* @__PURE__ */ require_debug_namespace.extractOptions(namespacesOrOpts);
+	const options = require_debug_namespace.extractOptions(namespacesOrOpts);
 	const { namespaces } = options;
-	if (!/* @__PURE__ */ require_debug_namespace.isEnabled(namespaces)) return;
-	const prefix = `[CACHE] ${/* @__PURE__ */ require_debug_caller_info.getCallerInfo(4) || "cache"} ${/* @__PURE__ */ require_debug__internal.getPointingTriangle()} ${operation}: ${key}`;
+	if (!require_debug_namespace.isEnabled(namespaces)) return;
+	const prefix = `[CACHE] ${require_debug_caller_info.getCallerInfo(4) || "cache"} ${require_debug__internal.getPointingTriangle()} ${operation}: ${key}`;
 	const logArgs = meta !== void 0 ? [prefix, meta] : [prefix];
 	const spinnerInstance = options.spinner || require_spinner_default.getDefaultSpinner();
 	const wasSpinning = spinnerInstance?.isSpinning;
@@ -74,13 +73,13 @@ function debugDir(obj, inspectOpts) {
 * Debug output for object inspection with caller info.
 */
 function debugDirNs(namespacesOrOpts, obj, inspectOpts) {
-	const options = /* @__PURE__ */ require_debug_namespace.extractOptions(namespacesOrOpts);
+	const options = require_debug_namespace.extractOptions(namespacesOrOpts);
 	const { namespaces } = options;
-	if (!/* @__PURE__ */ require_debug_namespace.isEnabled(namespaces)) return;
+	if (!require_debug_namespace.isEnabled(namespaces)) return;
 	/* c8 ignore start */
-	const callerName = /* @__PURE__ */ require_debug_caller_info.getCallerInfo(4) || "anonymous";
+	const callerName = require_debug_caller_info.getCallerInfo(4) || "anonymous";
 	/* c8 ignore stop */
-	const pointingTriangle = /* @__PURE__ */ require_debug__internal.getPointingTriangle();
+	const pointingTriangle = require_debug__internal.getPointingTriangle();
 	let opts = inspectOpts;
 	/* c8 ignore start */
 	if (opts === void 0) {
@@ -109,15 +108,15 @@ function debugLog(...args) {
 * Debug logging function with caller info.
 */
 function debugLogNs(namespacesOrOpts, ...args) {
-	const options = /* @__PURE__ */ require_debug_namespace.extractOptions(namespacesOrOpts);
+	const options = require_debug_namespace.extractOptions(namespacesOrOpts);
 	const { namespaces } = options;
-	if (!/* @__PURE__ */ require_debug_namespace.isEnabled(namespaces)) return;
+	if (!require_debug_namespace.isEnabled(namespaces)) return;
 	/* c8 ignore start */
-	const callerName = /* @__PURE__ */ require_debug_caller_info.getCallerInfo(4) || "anonymous";
+	const callerName = require_debug_caller_info.getCallerInfo(4) || "anonymous";
 	/* c8 ignore stop */
-	const pointingTriangle = /* @__PURE__ */ require_debug__internal.getPointingTriangle();
+	const pointingTriangle = require_debug__internal.getPointingTriangle();
 	const text = require_primordials_array.ArrayPrototypeAt(args, 0);
-	const logArgs = typeof text === "string" ? [/* @__PURE__ */ require_strings_format.applyLinePrefix(`${callerName} ${pointingTriangle} ${text}`, { prefix: "[DEBUG] " }), ...require_primordials_array.ArrayPrototypeSlice(args, 1)] : [`[DEBUG] ${callerName} ${pointingTriangle}`, ...args];
+	const logArgs = typeof text === "string" ? [require_strings_format.applyLinePrefix(`${callerName} ${pointingTriangle} ${text}`, { prefix: "[DEBUG] " }), ...require_primordials_array.ArrayPrototypeSlice(args, 1)] : [`[DEBUG] ${callerName} ${pointingTriangle}`, ...args];
 	const spinnerInstance = options.spinner || require_spinner_default.getDefaultSpinner();
 	const wasSpinning = spinnerInstance?.isSpinning;
 	spinnerInstance?.stop();
@@ -128,15 +127,15 @@ function debugLogNs(namespacesOrOpts, ...args) {
 * Debug output with caller info.
 */
 function debugNs(namespacesOrOpts, ...args) {
-	const options = /* @__PURE__ */ require_debug_namespace.extractOptions(namespacesOrOpts);
+	const options = require_debug_namespace.extractOptions(namespacesOrOpts);
 	const { namespaces } = options;
-	if (!/* @__PURE__ */ require_debug_namespace.isEnabled(namespaces)) return;
+	if (!require_debug_namespace.isEnabled(namespaces)) return;
 	/* c8 ignore start */
-	const name = /* @__PURE__ */ require_debug_caller_info.getCallerInfo(4) || "anonymous";
+	const name = require_debug_caller_info.getCallerInfo(4) || "anonymous";
 	/* c8 ignore stop */
-	const pointingTriangle = /* @__PURE__ */ require_debug__internal.getPointingTriangle();
+	const pointingTriangle = require_debug__internal.getPointingTriangle();
 	const text = require_primordials_array.ArrayPrototypeAt(args, 0);
-	const logArgs = typeof text === "string" ? [/* @__PURE__ */ require_strings_format.applyLinePrefix(`${name} ${pointingTriangle} ${text}`, { prefix: "[DEBUG] " }), ...require_primordials_array.ArrayPrototypeSlice(args, 1)] : args;
+	const logArgs = typeof text === "string" ? [require_strings_format.applyLinePrefix(`${name} ${pointingTriangle} ${text}`, { prefix: "[DEBUG] " }), ...require_primordials_array.ArrayPrototypeSlice(args, 1)] : args;
 	const spinnerInstance = options.spinner || require_spinner_default.getDefaultSpinner();
 	const wasSpinning = spinnerInstance?.isSpinning;
 	spinnerInstance?.stop();
@@ -147,17 +146,15 @@ function debugNs(namespacesOrOpts, ...args) {
 * Create a Node.js util.debuglog compatible function. Returns a function that
 * conditionally writes debug messages to stderr.
 */
-/*@__NO_SIDE_EFFECTS__*/
 function debuglog(section) {
-	return (/* @__PURE__ */ require_node_util.getNodeUtil()).debuglog(section);
+	return require_node_util.getNodeUtil().debuglog(section);
 }
 /**
 * Create timing functions for measuring code execution time. Returns an object
 * with start() and end() methods, plus a callable function.
 */
-/*@__NO_SIDE_EFFECTS__*/
 function debugtime(label) {
-	const util = /* @__PURE__ */ require_node_util.getNodeUtil();
+	const util = require_node_util.getNodeUtil();
 	let startTime;
 	const impl = () => {
 		if (startTime === void 0) startTime = require_primordials_date.DateNow();

package/dist/debug/types.d.ts

@@ -5,17 +5,17 @@
  *   types, no runtime side effects.
  */
 export interface DebugOptions {
-    namespaces?: string;
+    namespaces?: string | undefined;
     spinner?: {
         isSpinning: boolean;
         stop(): void;
         start(): void;
-    };
+    } | undefined;
     [key: string]: unknown;
 }
 export type NamespacesOrOptions = string | DebugOptions;
 export interface InspectOptions {
-    depth?: number | null;
-    colors?: boolean;
+    depth?: number | null | undefined;
+    colors?: boolean | undefined;
     [key: string]: unknown;
 }

package/dist/dlx/arborist.js

@@ -3,10 +3,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_error = require('../primordials/error.js');
+const require_primordials_object = require('../primordials/object.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
-const require_primordials_object = require('../primordials/object.js');
 const require_primordials_json = require('../primordials/json.js');
 const require_paths_socket = require('../paths/socket.js');
 let src_external__npmcli_arborist = require("../external/@npmcli/arborist");
@@ -37,6 +37,10 @@ src_external__npmcli_arborist = require_runtime.__toESM(src_external__npmcli_arb
 * false.
 */
 function getBaseArboristOptions(installPath, options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	return {
 		__proto__: null,
 		path: installPath,
@@ -56,7 +60,7 @@ function getBaseArboristOptions(installPath, options) {
 * N deps did we pin?").
 */
 function readSingleDependency(packageJsonPath) {
-	const names = require_primordials_object.ObjectKeys(require_primordials_json.JSONParse((/* @__PURE__ */ require_node_fs.getNodeFs()).readFileSync(packageJsonPath, "utf8")).dependencies ?? {});
+	const names = require_primordials_object.ObjectKeys(require_primordials_json.JSONParse(require_node_fs.getNodeFs().readFileSync(packageJsonPath, "utf8")).dependencies ?? {});
 	if (names.length !== 1) throw new require_primordials_error.ErrorCtor(`safeIdealTree expects exactly one top-level dependency in ${packageJsonPath}, found ${names.length}`);
 	return names[0];
 }
@@ -95,9 +99,12 @@ function readTopLevelFromIdealTree(tree, targetName) {
 * with no `add` list skips the write.
 */
 async function safeIdealTree(options) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
-	const { before, path: installPath, quiet = true } = options;
+	const fs = require_node_fs.getNodeFs();
+	const path = require_node_path.getNodePath();
+	const { before, path: installPath, quiet = true } = {
+		__proto__: null,
+		...options
+	};
 	const targetName = readSingleDependency(path.join(installPath, "package.json"));
 	const arb = new src_external__npmcli_arborist.default({
 		...getBaseArboristOptions(installPath, { quiet }),
@@ -125,7 +132,10 @@ async function safeIdealTree(options) {
 * This is the strongest form of pinning pnpm/npm offer.
 */
 async function safeReify(options) {
-	const { packageLock = true, path: installPath, quiet = true } = options;
+	const { packageLock = true, path: installPath, quiet = true } = {
+		__proto__: null,
+		...options
+	};
 	/* c8 ignore next - External Arborist call */
 	await new src_external__npmcli_arborist.default({
 		...getBaseArboristOptions(installPath, { quiet }),
@@ -146,8 +156,8 @@ async function safeReify(options) {
 * pnpm-style equivalent: minimum-release-age=<minutes>
 */
 async function writeSafeNpmrc(installPath, options) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const fs = require_node_fs.getNodeFs();
+	const path = require_node_path.getNodePath();
 	const { minReleaseDays, minReleaseMins } = {
 		__proto__: null,
 		...options

package/dist/dlx/binary-cache.js

@@ -2,6 +2,7 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_objects_predicates = require('../objects/predicates.js');
 const require_primordials_string = require('../primordials/string.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_node_fs = require('../node/fs.js');
@@ -9,7 +10,6 @@ const require_node_path = require('../node/path.js');
 const require_primordials_date = require('../primordials/date.js');
 const require_primordials_json = require('../primordials/json.js');
 const require_fs_read_json = require('../fs/read-json.js');
-const require_objects_predicates = require('../objects/predicates.js');
 const require_paths_socket = require('../paths/socket.js');
 const require_fs_safe = require('../fs/safe.js');
 const require_constants_time = require('../constants/time.js');
@@ -43,18 +43,18 @@ node_process = require_runtime.__toESM(node_process);
 */
 async function cleanDlxCache(maxAge = require_constants_time.DLX_BINARY_CACHE_TTL) {
 	const cacheDir = getDlxCachePath();
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const fs = require_node_fs.getNodeFs();
 	if (!fs.existsSync(cacheDir)) return 0;
 	let cleaned = 0;
 	const now = require_primordials_date.DateNow();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const path = require_node_path.getNodePath();
 	const entries = await fs.promises.readdir(cacheDir);
 	for (const entry of entries) {
 		const entryPath = path.join(cacheDir, entry);
 		const metaPath = getBinaryCacheMetadataPath(entryPath);
 		try {
 			if (!await (0, node_fs.existsSync)(entryPath)) continue;
-			const metadata = await /* @__PURE__ */ require_fs_read_json.readJson(metaPath, { throws: false });
+			const metadata = await require_fs_read_json.readJson(metaPath, { throws: false });
 			if (!metadata || typeof metadata !== "object" || require_primordials_array.ArrayIsArray(metadata)) continue;
 			const timestamp = metadata["timestamp"];
 			const age = typeof timestamp === "number" && timestamp > 0 ? now - timestamp : Number.POSITIVE_INFINITY;
@@ -86,7 +86,7 @@ async function cleanDlxCache(maxAge = require_constants_time.DLX_BINARY_CACHE_TT
 *   ```
 */
 function getBinaryCacheMetadataPath(cacheEntryPath) {
-	return (/* @__PURE__ */ require_node_path.getNodePath()).join(cacheEntryPath, ".dlx-metadata.json");
+	return require_node_path.getNodePath().join(cacheEntryPath, ".dlx-metadata.json");
 }
 /**
 * Get the DLX binary cache directory path. Alias of `getSocketDlxDir` — DLX
@@ -111,12 +111,12 @@ const getDlxCachePath = require_paths_socket.getSocketDlxDir;
 *   ```
 */
 async function isBinaryCacheValid(cacheEntryPath, cacheTtl) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const fs = require_node_fs.getNodeFs();
 	try {
 		const metaPath = getBinaryCacheMetadataPath(cacheEntryPath);
 		if (!fs.existsSync(metaPath)) return false;
-		const metadata = await /* @__PURE__ */ require_fs_read_json.readJson(metaPath, { throws: false });
-		if (!/* @__PURE__ */ require_objects_predicates.isPlainObject(metadata)) return false;
+		const metadata = await require_fs_read_json.readJson(metaPath, { throws: false });
+		if (!require_objects_predicates.isPlainObject(metadata)) return false;
 		const now = require_primordials_date.DateNow();
 		const timestamp = metadata["timestamp"];
 		if (typeof timestamp !== "number" || timestamp <= 0) return false;
@@ -140,17 +140,17 @@ async function isBinaryCacheValid(cacheEntryPath, cacheTtl) {
 */
 async function listDlxCache() {
 	const cacheDir = getDlxCachePath();
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const fs = require_node_fs.getNodeFs();
 	if (!fs.existsSync(cacheDir)) return [];
 	const results = [];
 	const now = require_primordials_date.DateNow();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const path = require_node_path.getNodePath();
 	const entries = await fs.promises.readdir(cacheDir);
 	for (const entry of entries) {
 		const entryPath = path.join(cacheDir, entry);
 		try {
 			if (!await (0, node_fs.existsSync)(entryPath)) continue;
-			const metadata = await /* @__PURE__ */ require_fs_read_json.readJson(getBinaryCacheMetadataPath(entryPath), { throws: false });
+			const metadata = await require_fs_read_json.readJson(getBinaryCacheMetadataPath(entryPath), { throws: false });
 			if (!metadata || typeof metadata !== "object" || require_primordials_array.ArrayIsArray(metadata)) continue;
 			const metaObj = metadata;
 			const url = metaObj["source"]?.["url"] || metaObj["url"] || "";
@@ -185,12 +185,12 @@ async function listDlxCache() {
 *   ```
 */
 async function readBinaryCacheMetadata(cacheEntryPath) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const fs = require_node_fs.getNodeFs();
 	try {
 		const metaPath = getBinaryCacheMetadataPath(cacheEntryPath);
 		if (!fs.existsSync(metaPath)) return;
-		const metadata = await /* @__PURE__ */ require_fs_read_json.readJson(metaPath, { throws: false });
-		if (!/* @__PURE__ */ require_objects_predicates.isPlainObject(metadata)) return;
+		const metadata = await require_fs_read_json.readJson(metaPath, { throws: false });
+		if (!require_objects_predicates.isPlainObject(metadata)) return;
 		return metadata;
 	} catch {
 		return;
@@ -224,7 +224,7 @@ async function writeBinaryCacheMetadata(cacheEntryPath, cacheKey, url, integrity
 			url
 		}
 	};
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const fs = require_node_fs.getNodeFs();
 	const tmpPath = `${metaPath}.tmp.${node_process.default.pid}`;
 	await fs.promises.writeFile(tmpPath, require_primordials_json.JSONStringify(metadata, null, 2));
 	await fs.promises.rename(tmpPath, metaPath);

package/dist/dlx/binary-download.d.ts

@@ -9,7 +9,7 @@
 import type { DlxBinaryOptions } from './binary-types';
 /**
  * Download a binary from a URL with caching (without execution). Similar to
- * downloadPackage from dlx/package.
+ * downloadNpmPackage from dlx/package.
  *
  * Returns `{binaryPath, downloaded, integrity}`. The `integrity` field is the
  * SRI-formatted `sha512-<base64>` hash of the cached file — computed by the

package/dist/dlx/binary-download.js

@@ -31,7 +31,7 @@ node_process = require_runtime.__toESM(node_process);
 */
 /**
 * Download a binary from a URL with caching (without execution). Similar to
-* downloadPackage from dlx/package.
+* downloadNpmPackage from dlx/package.
 *
 * Returns `{binaryPath, downloaded, integrity}`. The `integrity` field is the
 * SRI-formatted `sha512-<base64>` hash of the cached file — computed by the
@@ -70,20 +70,20 @@ async function downloadBinary(options) {
 		if (normalized.type === "integrity") integrity = normalized.value;
 		else sha256 = normalized.value;
 	}
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const fs = require_node_fs.getNodeFs();
+	const path = require_node_path.getNodePath();
 	const cacheDir = require_dlx_binary_cache.getDlxCachePath();
 	const binaryName = name || `binary-${node_process.default.platform}-${require_constants_platform.getArch()}`;
 	const cacheKey = require_dlx_cache.generateCacheKey(`${url}:${binaryName}`);
 	const cacheEntryDir = path.join(cacheDir, cacheKey);
-	const binaryPath = /* @__PURE__ */ require_paths_normalize.normalizePath(path.join(cacheEntryDir, binaryName));
+	const binaryPath = require_paths_normalize.normalizePath(path.join(cacheEntryDir, binaryName));
 	let downloaded = false;
 	let actualIntegrity = "";
 	if (!force && fs.existsSync(cacheEntryDir) && await require_dlx_binary_cache.isBinaryCacheValid(cacheEntryDir, cacheTtl)) {
 		downloaded = false;
 		const cachedMeta = await require_dlx_binary_cache.readBinaryCacheMetadata(cacheEntryDir);
 		if (cachedMeta?.integrity) actualIntegrity = cachedMeta.integrity;
-		else actualIntegrity = `sha512-${/* @__PURE__ */ require_crypto_hash.hash("sha512", await fs.promises.readFile(binaryPath), "base64")}`;
+		else actualIntegrity = `sha512-${require_crypto_hash.hash("sha512", await fs.promises.readFile(binaryPath), "base64")}`;
 	} else {
 		try {
 			await require_fs_safe.safeMkdir(cacheEntryDir);
@@ -128,9 +128,9 @@ async function downloadBinary(options) {
 *   ```
 */
 async function downloadBinaryFile(url, destPath, integrity, sha256) {
-	const crypto = /* @__PURE__ */ require_node_crypto.getNodeCrypto();
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const crypto = require_node_crypto.getNodeCrypto();
+	const fs = require_node_fs.getNodeFs();
+	const path = require_node_path.getNodePath();
 	const cacheEntryDir = path.dirname(destPath);
 	const lockPath = path.join(cacheEntryDir, "concurrency.lock");
 	const verifyIntegrity = async (actualIntegrity) => {
@@ -142,7 +142,7 @@ async function downloadBinaryFile(url, destPath, integrity, sha256) {
 	};
 	const verifyCachedSha256 = async (fileBuffer) => {
 		if (!sha256) return;
-		const actualSha256 = /* @__PURE__ */ require_crypto_hash.hash("sha256", fileBuffer, "hex");
+		const actualSha256 = require_crypto_hash.hash("sha256", fileBuffer, "hex");
 		if (!(actualSha256.length === sha256.length && crypto.timingSafeEqual(require_primordials_buffer.BufferFrom(actualSha256), Buffer.from(sha256.toLowerCase())))) {
 			await require_fs_safe.safeDelete(destPath);
 			throw new require_primordials_error.ErrorCtor(`SHA-256 mismatch: expected ${sha256}, got ${actualSha256}`);
@@ -152,7 +152,7 @@ async function downloadBinaryFile(url, destPath, integrity, sha256) {
 		if (fs.existsSync(destPath)) {
 			if ((await fs.promises.stat(destPath)).size > 0) {
 				const fileBuffer = await fs.promises.readFile(destPath);
-				const actualIntegrity = `sha512-${/* @__PURE__ */ require_crypto_hash.hash("sha512", fileBuffer, "base64")}`;
+				const actualIntegrity = `sha512-${require_crypto_hash.hash("sha512", fileBuffer, "base64")}`;
 				await verifyIntegrity(actualIntegrity);
 				await verifyCachedSha256(fileBuffer);
 				return actualIntegrity;
@@ -163,7 +163,7 @@ async function downloadBinaryFile(url, destPath, integrity, sha256) {
 		} catch (e) {
 			throw new require_primordials_error.ErrorCtor(`Failed to download binary from ${url}\nDestination: ${destPath}\nCheck your internet connection or verify the URL is accessible.`, { cause: e });
 		}
-		const actualIntegrity = `sha512-${/* @__PURE__ */ require_crypto_hash.hash("sha512", await fs.promises.readFile(destPath), "base64")}`;
+		const actualIntegrity = `sha512-${require_crypto_hash.hash("sha512", await fs.promises.readFile(destPath), "base64")}`;
 		await verifyIntegrity(actualIntegrity);
 		if (!require_constants_platform.WIN32) await fs.promises.chmod(destPath, 493);
 		return actualIntegrity;