@socketsecurity/lib 6.0.6 → 6.0.8

package/dist/fs/read-json-cache.d.ts

@@ -5,10 +5,12 @@
  *
  *   - Stat-validated keys: a `stat()` call before serving a cache hit ensures the
  *     file hasn't changed (mtime + size mismatch ⇒ cache miss, re-read).
- *   - Defensive clone on hit: every hit returns `structuredClone(parsed)` so
- *     callers can mutate the returned object without poisoning the cache for
- *     the next reader. The clone cost is far less than re-read + re-parse for
- *     anything bigger than a trivial JSON document.
+ *   - Defensive clone on hit: every hit returns a JSON round-trip clone
+ *     (`JSON.parse(JSON.stringify(parsed))`) so callers can mutate the returned
+ *     object without poisoning the cache for the next reader. The clone cost is
+ *     far less than re-read + re-parse for anything bigger than a trivial JSON
+ *     document, and the round-trip is faster than `structuredClone` over the
+ *     JSON subset these values always belong to.
  *   - Reviver opt-out: when the caller passes a `reviver` function, we skip the
  *     cache. Function identity isn't safely hashable across boundaries, and the
  *     reviver can produce a different shape from the same bytes.
@@ -28,6 +30,13 @@
  *     CWDs would get separate cache entries — correct but pessimistic.
  */
 import type { JsonValue } from '../json/types';
+export interface CacheEntry {
+    ino: number;
+    size: number;
+    mtimeMs: number;
+    parsed: JsonValue;
+    insertedAt: number;
+}
 /**
  * Drop all cached entries. Tests call this between cases that depend on a fresh
  * read; long-running daemons can call it on file-watcher invalidation events

package/dist/fs/read-json-cache.js

@@ -6,6 +6,7 @@ const require_primordials_error = require('../primordials/error.js');
 const require_primordials_number = require('../primordials/number.js');
 const require_primordials_map_set = require('../primordials/map-set.js');
 const require_primordials_date = require('../primordials/date.js');
+const require_primordials_json = require('../primordials/json.js');
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
 
@@ -17,10 +18,12 @@ node_process = require_runtime.__toESM(node_process);
 *
 *   - Stat-validated keys: a `stat()` call before serving a cache hit ensures the
 *     file hasn't changed (mtime + size mismatch ⇒ cache miss, re-read).
-*   - Defensive clone on hit: every hit returns `structuredClone(parsed)` so
-*     callers can mutate the returned object without poisoning the cache for
-*     the next reader. The clone cost is far less than re-read + re-parse for
-*     anything bigger than a trivial JSON document.
+*   - Defensive clone on hit: every hit returns a JSON round-trip clone
+*     (`JSON.parse(JSON.stringify(parsed))`) so callers can mutate the returned
+*     object without poisoning the cache for the next reader. The clone cost is
+*     far less than re-read + re-parse for anything bigger than a trivial JSON
+*     document, and the round-trip is faster than `structuredClone` over the
+*     JSON subset these values always belong to.
 *   - Reviver opt-out: when the caller passes a `reviver` function, we skip the
 *     cache. Function identity isn't safely hashable across boundaries, and the
 *     reviver can produce a different shape from the same bytes.
@@ -85,7 +88,7 @@ function getCachedJson(key, ino, size, mtimeMs) {
 		return;
 	}
 	hits += 1;
-	return structuredClone(entry.parsed);
+	return require_primordials_json.JSONParse(require_primordials_json.JSONStringify(entry.parsed));
 }
 /**
 * Snapshot diagnostics. Useful for tests and for tooling that wants to log
@@ -131,7 +134,7 @@ function setCachedJson(key, ino, size, mtimeMs, parsed) {
 		ino,
 		size,
 		mtimeMs,
-		parsed: structuredClone(parsed),
+		parsed: require_primordials_json.JSONParse(require_primordials_json.JSONStringify(parsed)),
 		insertedAt: require_primordials_date.DateNow()
 	});
 }

package/dist/fs/read-json.js

@@ -49,7 +49,6 @@ const require_json_parse = require('../json/parse.js');
 * @returns Promise resolving to parsed JSON value, or undefined if throws is
 *   false and an error occurs.
 */
-/*@__NO_SIDE_EFFECTS__*/
 async function readJson(filepath, options) {
 	const { cache, reviver, throws, ...fsOptions } = {
 		__proto__: null,
@@ -57,7 +56,7 @@ async function readJson(filepath, options) {
 	};
 	const shouldThrow = throws === void 0 || !!throws;
 	const cacheEnabled = cache !== false && reviver === void 0;
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const fs = require_node_fs.getNodeFs();
 	const pathStr = String(filepath);
 	if (cacheEnabled) try {
 		const stat = await fs.promises.stat(filepath);
@@ -82,7 +81,7 @@ async function readJson(filepath, options) {
 		}
 		return;
 	}
-	const parsed = /* @__PURE__ */ require_json_parse.parseJson(content, {
+	const parsed = require_json_parse.parseJson(content, {
 		filepath: pathStr,
 		reviver,
 		throws: shouldThrow
@@ -123,7 +122,6 @@ async function readJson(filepath, options) {
 * @returns Parsed JSON value, or undefined if throws is false and an error
 *   occurs.
 */
-/*@__NO_SIDE_EFFECTS__*/
 function readJsonSync(filepath, options) {
 	const { cache, reviver, throws, ...fsOptions } = {
 		__proto__: null,
@@ -131,7 +129,7 @@ function readJsonSync(filepath, options) {
 	};
 	const shouldThrow = throws === void 0 || !!throws;
 	const cacheEnabled = cache !== false && reviver === void 0;
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const fs = require_node_fs.getNodeFs();
 	const pathStr = String(filepath);
 	if (cacheEnabled) try {
 		const stat = fs.statSync(filepath);
@@ -156,7 +154,7 @@ function readJsonSync(filepath, options) {
 		}
 		return;
 	}
-	const parsed = /* @__PURE__ */ require_json_parse.parseJson(content, {
+	const parsed = require_json_parse.parseJson(content, {
 		filepath: pathStr,
 		reviver,
 		throws: shouldThrow

package/dist/fs/resolve-module.js

@@ -3,9 +3,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_node_path = require('../node/path.js');
-let node_module = require("node:module");
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
+let node_module = require("node:module");
 
 //#region src/fs/resolve-module.ts
 /**
@@ -22,7 +22,7 @@ function requireResolveFrom(fromDir, specifier, options) {
 		__proto__: null,
 		...options
 	};
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const path = require_node_path.getNodePath();
 	const anchor = path.join(path.resolve(fromDir), "noop.js");
 	try {
 		return (0, node_module.createRequire)(anchor).resolve(specifier);
@@ -32,7 +32,11 @@ function requireResolveFrom(fromDir, specifier, options) {
 	}
 }
 function requireResolveFromCwd(specifier, options) {
-	return options && options.nothrow ? requireResolveFrom(node_process.default.cwd(), specifier, { nothrow: true }) : requireResolveFrom(node_process.default.cwd(), specifier);
+	options = {
+		__proto__: null,
+		...options
+	};
+	return options?.nothrow ? requireResolveFrom(node_process.default.cwd(), specifier, { nothrow: true }) : requireResolveFrom(node_process.default.cwd(), specifier);
 }
 
 //#endregion

package/dist/fs/safe.d.ts

@@ -5,7 +5,7 @@
  *   true`. The mkdir helpers default to `recursive: true` and swallow `EEXIST`
  *   so concurrent callers don't race-condition each other.
  */
-import './path-cache';
+import './allowed-dirs-cache';
 import type { MakeDirectoryOptions, PathLike } from 'node:fs';
 import type { deleteAsync as deleteAsyncType, deleteSync as deleteSyncType } from '../external/del';
 import type { RemoveOptions } from './types';

package/dist/fs/safe.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_arrays_predicates = require('../arrays/predicates.js');
 const require_primordials_string = require('../primordials/string.js');
 const require_paths__internal = require('../paths/_internal.js');
 const require_primordials_array = require('../primordials/array.js');
@@ -8,7 +9,6 @@ const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
 const require_errors_predicates = require('../errors/predicates.js');
 const require_primordials_globals = require('../primordials/globals.js');
-const require_arrays_predicates = require('../arrays/predicates.js');
 const require_objects_mutate = require('../objects/mutate.js');
 const require_promises_retry = require('../promises/retry.js');
 const require_fs__internal = require('./_internal.js');
@@ -28,11 +28,10 @@ const defaultRemoveOptions = require_objects_mutate.objectFreeze({
 	recursive: true,
 	retryDelay: 200
 });
-let _del;
-/*@__NO_SIDE_EFFECTS__*/
+let delModule;
 function getDel() {
-	if (_del === void 0) _del = /*@__PURE__*/ require("../external/del");
-	return _del;
+	if (delModule === void 0) delModule = /*@__PURE__*/ require("../external/del");
+	return delModule;
 }
 /**
 * Safely delete a file or directory asynchronously with built-in protections.
@@ -75,11 +74,11 @@ async function safeDelete(filepath, options) {
 		__proto__: null,
 		...options
 	};
-	const patterns = require_arrays_predicates.isArray(filepath) ? filepath.map(require_paths__internal.pathLikeToString) : [/* @__PURE__ */ require_paths__internal.pathLikeToString(filepath)];
+	const patterns = require_arrays_predicates.isArray(filepath) ? filepath.map(require_paths__internal.pathLikeToString) : [require_paths__internal.pathLikeToString(filepath)];
 	/* c8 ignore start */
 	let shouldForce = opts.force !== false;
 	if (!shouldForce && patterns.length > 0) {
-		const path = /* @__PURE__ */ require_node_path.getNodePath();
+		const path = require_node_path.getNodePath();
 		const allowedDirs = require_fs__internal.getAllowedDirectories();
 		if (patterns.every((pattern) => {
 			const resolvedPath = path.resolve(pattern);
@@ -95,8 +94,8 @@ async function safeDelete(filepath, options) {
 	const maxRetries = opts.maxRetries ?? defaultRemoveOptions.maxRetries;
 	const retryDelay = opts.retryDelay ?? defaultRemoveOptions.retryDelay;
 	/* c8 ignore start - External del call */
-	const del = /* @__PURE__ */ getDel();
-	await /* @__PURE__ */ require_promises_retry.pRetry(async () => {
+	const del = getDel();
+	await require_promises_retry.pRetry(async () => {
 		await del.deleteAsync(patterns, {
 			dryRun: false,
 			force: shouldForce,
@@ -151,11 +150,11 @@ function safeDeleteSync(filepath, options) {
 		__proto__: null,
 		...options
 	};
-	const patterns = require_arrays_predicates.isArray(filepath) ? filepath.map(require_paths__internal.pathLikeToString) : [/* @__PURE__ */ require_paths__internal.pathLikeToString(filepath)];
+	const patterns = require_arrays_predicates.isArray(filepath) ? filepath.map(require_paths__internal.pathLikeToString) : [require_paths__internal.pathLikeToString(filepath)];
 	/* c8 ignore start */
 	let shouldForce = opts.force !== false;
 	if (!shouldForce && patterns.length > 0) {
-		const path = /* @__PURE__ */ require_node_path.getNodePath();
+		const path = require_node_path.getNodePath();
 		const allowedDirs = require_fs__internal.getAllowedDirectories();
 		if (patterns.every((pattern) => {
 			const resolvedPath = path.resolve(pattern);
@@ -171,7 +170,7 @@ function safeDeleteSync(filepath, options) {
 	const maxRetries = opts.maxRetries ?? defaultRemoveOptions.maxRetries;
 	const retryDelay = opts.retryDelay ?? defaultRemoveOptions.retryDelay;
 	/* c8 ignore start - External del call */
-	const del = /* @__PURE__ */ getDel();
+	const del = getDel();
 	let lastError;
 	let delay = retryDelay;
 	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
@@ -225,7 +224,7 @@ function safeDeleteSync(filepath, options) {
 * @returns Promise that resolves when directory is created or already exists
 */
 async function safeMkdir(path, options) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const fs = require_node_fs.getNodeFs();
 	const opts = {
 		__proto__: null,
 		recursive: true,
@@ -269,7 +268,7 @@ async function safeMkdir(path, options) {
 *   settings.
 */
 function safeMkdirSync(path, options) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const fs = require_node_fs.getNodeFs();
 	const opts = {
 		__proto__: null,
 		recursive: true,

package/dist/fs/unique.js

@@ -33,12 +33,11 @@ const require_node_path = require('../node/path.js');
 * @returns Normalized unique filepath (original if it doesn't exist, or with
 *   number suffix)
 */
-/*@__NO_SIDE_EFFECTS__*/
 function uniqueSync(filepath) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const fs = require_node_fs.getNodeFs();
+	const path = require_node_path.getNodePath();
 	const filepathStr = String(filepath);
-	if (!fs.existsSync(filepathStr)) return /* @__PURE__ */ require_paths_normalize.normalizePath(filepathStr);
+	if (!fs.existsSync(filepathStr)) return require_paths_normalize.normalizePath(filepathStr);
 	const dirname = path.dirname(filepathStr);
 	const ext = path.extname(filepathStr);
 	const basename = path.basename(filepathStr, ext);
@@ -48,7 +47,7 @@ function uniqueSync(filepath) {
 		uniquePath = path.join(dirname, `${basename}-${counter}${ext}`);
 		counter++;
 	} while (fs.existsSync(uniquePath));
-	return /* @__PURE__ */ require_paths_normalize.normalizePath(uniquePath);
+	return require_paths_normalize.normalizePath(uniquePath);
 }
 
 //#endregion

package/dist/fs/validate.js

@@ -42,11 +42,10 @@ const require_fs_access = require('./access.js');
 *
 * @returns Object with `validPaths` (readable) and `invalidPaths` (unreadable)
 */
-/*@__NO_SIDE_EFFECTS__*/
 function validateFiles(filepaths) {
 	const validPaths = [];
 	const invalidPaths = [];
-	for (const filepath of filepaths) if (/* @__PURE__ */ require_fs_access.canRead(filepath)) validPaths.push(filepath);
+	for (const filepath of filepaths) if (require_fs_access.canRead(filepath)) validPaths.push(filepath);
 	else invalidPaths.push(filepath);
 	return {
 		__proto__: null,

package/dist/fs/write-json.js

@@ -26,7 +26,6 @@ const NEWLINE_REGEX = /\n/g;
 *
 * @returns Formatted JSON string
 */
-/*@__NO_SIDE_EFFECTS__*/
 function stringify(json, EOL, finalEOL, replacer, spaces = 2) {
 	const EOF = finalEOL ? EOL : "";
 	return `${require_primordials_string.StringPrototypeReplace(require_primordials_json.JSONStringify(json, replacer, spaces), NEWLINE_REGEX, EOL)}${EOF}`;
@@ -65,8 +64,8 @@ async function writeJson(filepath, jsonContent, options) {
 		__proto__: null,
 		...typeof options === "string" ? { encoding: options } : options
 	};
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const jsonString = /* @__PURE__ */ stringify(jsonContent, EOL || "\n", finalEOL !== void 0 ? finalEOL : true, replacer, spaces);
+	const fs = require_node_fs.getNodeFs();
+	const jsonString = stringify(jsonContent, EOL || "\n", finalEOL !== void 0 ? finalEOL : true, replacer, spaces);
 	await fs.promises.writeFile(filepath, jsonString, {
 		encoding: "utf8",
 		...fsOptions,
@@ -102,8 +101,8 @@ function writeJsonSync(filepath, jsonContent, options) {
 		__proto__: null,
 		...typeof options === "string" ? { encoding: options } : options
 	};
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const jsonString = /* @__PURE__ */ stringify(jsonContent, EOL || "\n", finalEOL !== void 0 ? finalEOL : true, replacer, spaces);
+	const fs = require_node_fs.getNodeFs();
+	const jsonString = stringify(jsonContent, EOL || "\n", finalEOL !== void 0 ? finalEOL : true, replacer, spaces);
 	fs.writeFileSync(filepath, jsonString, {
 		encoding: "utf8",
 		...fsOptions,

package/dist/git/_internal.js

@@ -2,13 +2,13 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_buffer = require('../primordials/buffer.js');
+const require_primordials_object = require('../primordials/object.js');
+const require_primordials_map_set = require('../primordials/map-set.js');
 const require_primordials_string = require('../primordials/string.js');
 const require_paths_normalize = require('../paths/normalize.js');
 const require_primordials_array = require('../primordials/array.js');
-const require_primordials_map_set = require('../primordials/map-set.js');
 const require_node_path = require('../node/path.js');
 const require_primordials_date = require('../primordials/date.js');
-const require_primordials_object = require('../primordials/object.js');
 const require_primordials_json = require('../primordials/json.js');
 const require_bin_which = require('../bin/which.js');
 const require_ansi_strip = require('../ansi/strip.js');
@@ -27,7 +27,7 @@ const require_git_repo = require('./repo.js');
 const gitDiffCache = new require_primordials_map_set.MapCtor();
 const GIT_CACHE_MAX_SIZE = 100;
 const GIT_CACHE_TTL_MS = 2e3;
-let _gitPath;
+let cachedGitPath;
 function getCachedGitDiff(key) {
 	const entry = gitDiffCache.get(key);
 	if (!entry) return;
@@ -96,12 +96,12 @@ function getGitDiffSpawnArgs(cwd) {
 */
 function getGitPath() {
 	/* c8 ignore start */
-	if (_gitPath === void 0) {
+	if (cachedGitPath === void 0) {
 		const resolved = require_bin_which.whichSync("git", { nothrow: true });
-		_gitPath = typeof resolved === "string" ? resolved : "git";
+		cachedGitPath = typeof resolved === "string" ? resolved : "git";
 	}
 	/* c8 ignore stop */
-	return _gitPath;
+	return cachedGitPath;
 }
 /**
 * Execute git diff command asynchronously and parse results.
@@ -211,17 +211,17 @@ function parseGitDiffStdout(stdout, options, spawnCwd) {
 		__proto__: null,
 		...options
 	};
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const path = require_node_path.getNodePath();
 	const cwd = cwdOption === defaultRoot ? defaultRoot : require_git_repo.getCachedRealpath(cwdOption);
 	const rootPath = defaultRoot;
-	let rawFiles = stdout ? (/* @__PURE__ */ require_ansi_strip.stripAnsi(stdout)).split(/\r?\n/).map((line) => line.trimEnd()).filter((line) => line) : [];
+	let rawFiles = stdout ? require_ansi_strip.stripAnsi(stdout).split(/\r?\n/).map((line) => line.trimEnd()).filter((line) => line) : [];
 	if (porcelain) rawFiles = rawFiles.map((line) => {
 		/* c8 ignore next */
 		return line.length > 3 ? require_primordials_string.StringPrototypeSubstring(line, 3) : line;
 	});
-	const files = absolute ? rawFiles.map((relPath) => /* @__PURE__ */ require_paths_normalize.normalizePath(path.join(rootPath, relPath))) : rawFiles.map((relPath) => /* @__PURE__ */ require_paths_normalize.normalizePath(relPath));
+	const files = absolute ? rawFiles.map((relPath) => require_paths_normalize.normalizePath(path.join(rootPath, relPath))) : rawFiles.map((relPath) => require_paths_normalize.normalizePath(relPath));
 	if (cwd === rootPath) return files;
-	const matcher = /* @__PURE__ */ require_globs_matcher.getGlobMatcher([`${/* @__PURE__ */ require_paths_normalize.normalizePath(path.relative(rootPath, cwd))}/**`], {
+	const matcher = require_globs_matcher.getGlobMatcher([`${require_paths_normalize.normalizePath(path.relative(rootPath, cwd))}/**`], {
 		...matcherOptions,
 		absolute,
 		cwd: rootPath
@@ -251,7 +251,7 @@ function stableKey(value) {
 	return require_primordials_json.JSONStringify(value, (_key, val) => {
 		if (val && typeof val === "object" && !require_primordials_array.ArrayIsArray(val)) {
 			const sorted = {};
-			for (const k of require_primordials_object.ObjectKeys(val).sort()) sorted[k] = val[k];
+			for (const k of require_primordials_object.ObjectKeys(val).toSorted()) sorted[k] = val[k];
 			return sorted;
 		}
 		return val;

package/dist/git/changed.js

@@ -136,11 +136,11 @@ async function isChanged(pathname, options) {
 		...options,
 		absolute: false
 	});
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const path = require_node_path.getNodePath();
 	const resolvedPathname = require_git_repo.getCachedRealpath(pathname);
 	/* c8 ignore start */
 	const baseCwd = options?.cwd ? require_git_repo.getCachedRealpath(options["cwd"]) : require_git_repo.getCwd();
-	return require_primordials_array.ArrayPrototypeIncludes(files, /* @__PURE__ */ require_paths_normalize.normalizePath(path.relative(baseCwd, resolvedPathname)));
+	return require_primordials_array.ArrayPrototypeIncludes(files, require_paths_normalize.normalizePath(path.relative(baseCwd, resolvedPathname)));
 }
 /**
 * Check if a file or directory has any git changes.
@@ -182,12 +182,12 @@ function isChangedSync(pathname, options) {
 		...options,
 		absolute: false
 	});
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const path = require_node_path.getNodePath();
 	try {
 		const resolvedPathname = require_git_repo.getCachedRealpath(pathname);
 		/* c8 ignore start */
 		const baseCwd = options?.cwd ? require_git_repo.getCachedRealpath(options["cwd"]) : require_git_repo.getCwd();
-		return require_primordials_array.ArrayPrototypeIncludes(files, /* @__PURE__ */ require_paths_normalize.normalizePath(path.relative(baseCwd, resolvedPathname)));
+		return require_primordials_array.ArrayPrototypeIncludes(files, require_paths_normalize.normalizePath(path.relative(baseCwd, resolvedPathname)));
 	} catch {
 		return false;
 	}

package/dist/git/repo.js

@@ -1,12 +1,10 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_map_set = require('../primordials/map-set.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
-let node_process = require("node:process");
-node_process = require_runtime.__toESM(node_process);
+const require_primordials_process = require('../primordials/process.js');
 
 //#region src/git/repo.ts
 /**
@@ -41,8 +39,8 @@ const gitRootCache = new require_primordials_map_set.MapCtor();
 * @returns Git repository root path, or `startPath` if not found.
 */
 function findGitRoot(startPath) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const fs = require_node_fs.getNodeFs();
+	const path = require_node_path.getNodePath();
 	/* c8 ignore start */
 	const cached = gitRootCache.get(startPath);
 	if (cached) {
@@ -75,7 +73,7 @@ function findGitRoot(startPath) {
 * realpath resolution is restricted.
 */
 function getCachedRealpath(pathname) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const fs = require_node_fs.getNodeFs();
 	const cached = realpathCache.get(pathname);
 	/* c8 ignore start */
 	if (cached) {
@@ -112,7 +110,7 @@ function getCachedRealpath(pathname) {
 * @returns The resolved real path of `process.cwd()`.
 */
 function getCwd() {
-	return getCachedRealpath(node_process.default.cwd());
+	return getCachedRealpath(require_primordials_process.processCwd());
 }
 
 //#endregion

package/dist/git/staged.js

@@ -44,6 +44,10 @@ const require_git__internal = require('./_internal.js');
 * @returns Promise resolving to array of staged file paths.
 */
 async function getStagedFiles(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const args = require_git__internal.getGitDiffSpawnArgs(options?.cwd).staged;
 	return await require_git__internal.innerDiff(args, options);
 }
@@ -79,6 +83,10 @@ async function getStagedFiles(options) {
 * @returns Array of staged file paths.
 */
 function getStagedFilesSync(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const args = require_git__internal.getGitDiffSpawnArgs(options?.cwd).staged;
 	return require_git__internal.innerDiffSync(args, options);
 }
@@ -121,11 +129,11 @@ async function isStaged(pathname, options) {
 		...options,
 		absolute: false
 	});
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const path = require_node_path.getNodePath();
 	const resolvedPathname = require_git_repo.getCachedRealpath(pathname);
 	/* c8 ignore start */
 	const baseCwd = options?.cwd ? require_git_repo.getCachedRealpath(options["cwd"]) : require_git_repo.getCwd();
-	return require_primordials_array.ArrayPrototypeIncludes(files, /* @__PURE__ */ require_paths_normalize.normalizePath(path.relative(baseCwd, resolvedPathname)));
+	return require_primordials_array.ArrayPrototypeIncludes(files, require_paths_normalize.normalizePath(path.relative(baseCwd, resolvedPathname)));
 }
 /**
 * Check if a file or directory is staged for commit.
@@ -167,11 +175,11 @@ function isStagedSync(pathname, options) {
 		...options,
 		absolute: false
 	});
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const path = require_node_path.getNodePath();
 	const resolvedPathname = require_git_repo.getCachedRealpath(pathname);
 	/* c8 ignore start */
 	const baseCwd = options?.cwd ? require_git_repo.getCachedRealpath(options["cwd"]) : require_git_repo.getCwd();
-	return require_primordials_array.ArrayPrototypeIncludes(files, /* @__PURE__ */ require_paths_normalize.normalizePath(path.relative(baseCwd, resolvedPathname)));
+	return require_primordials_array.ArrayPrototypeIncludes(files, require_paths_normalize.normalizePath(path.relative(baseCwd, resolvedPathname)));
 }
 
 //#endregion

package/dist/git/tracked.d.ts

@@ -0,0 +1,84 @@
+/**
+ * @file Tracked-status + submodule-membership probes for a working-tree path.
+ *   `isTracked` answers "does git track this exact path?"; `getSubmodulePaths`
+ *   lists the repo's submodule mount points; `isInSubmodule` answers "does this
+ *   path live inside one?"; `isUntrackedNonSubmodulePath` composes them into
+ *   the safe-to-touch condition for cleanup tooling — never delete a tracked
+ *   file or reach into a submodule's own tree (which would dirty it).
+ */
+/**
+ * The repo's submodule mount points as normalized, repo-root-relative paths
+ * (e.g. `vendor/acorn`). Reads `git config` on `.gitmodules`, so it lists
+ * declared submodules whether or not they are initialized — the case a
+ * stderr-message check on `git ls-files` misses.
+ *
+ * @example
+ *   ;```typescript
+ *   await getSubmodulePaths()
+ *   // => ['packages/acorn/upstream/acorn', 'vendor/mbedtls']
+ *   ```
+ */
+export declare function getSubmodulePaths(options?: GitPathOptions | undefined): Promise<string[]>;
+/**
+ * Whether `targetPath` lives inside one of the repo's submodules. Resolves the
+ * submodule list itself; for a batch sweep prefer `getSubmodulePaths` once plus
+ * `pathIsUnderSubmodule` per path.
+ *
+ * @example
+ *   ;```typescript
+ *   await isInSubmodule('vendor/mbedtls/x.py')  // => true
+ *   await isInSubmodule('src/index.ts')         // => false
+ *   ```
+ */
+export declare function isInSubmodule(targetPath: string, options?: GitPathOptions | undefined): Promise<boolean>;
+export interface GitPathOptions {
+    /**
+     * The git working-tree directory the path is resolved against.
+     *
+     * @default process.cwd()
+     */
+    cwd?: string | undefined;
+}
+/**
+ * Whether git tracks `targetPath` exactly. Uses `git ls-files --error-unmatch`,
+ * which exits non-zero for an untracked path. A path inside a submodule, or one
+ * git does not know, returns `false`.
+ *
+ * @example
+ *   ;```typescript
+ *   await isTracked('src/index.ts')        // => true
+ *   await isTracked('.DS_Store')           // => false
+ *   ```
+ */
+export declare function isTracked(targetPath: string, options?: GitPathOptions | undefined): Promise<boolean>;
+/**
+ * Whether `targetPath` is git does NOT track AND does not live inside a
+ * submodule — the safe-to-touch condition for cleanup tooling. A tracked path
+ * is a deliberate file; a submodule-internal path belongs to that submodule's
+ * own git (touching it would dirty the submodule). Composes `isTracked` +
+ * `getSubmodulePaths`/`pathIsUnderSubmodule`. Fails closed — any check error
+ * resolves to `false`.
+ *
+ * For a batch sweep, call `getSubmodulePaths` once and compose `isTracked` +
+ * `pathIsUnderSubmodule` per path to avoid re-reading `.gitmodules` each time.
+ *
+ * @example
+ *   ;```typescript
+ *   await isUntrackedNonSubmodulePath('.DS_Store')        // => true
+ *   await isUntrackedNonSubmodulePath('src/index.ts')     // => false (tracked)
+ *   await isUntrackedNonSubmodulePath('vendor/sub/x.pyc') // => false (submodule)
+ *   ```
+ */
+export declare function isUntrackedNonSubmodulePath(targetPath: string, options?: GitPathOptions | undefined): Promise<boolean>;
+/**
+ * Whether `relativePath` (repo-root-relative) lies at or under any of
+ * `submodulePaths`. Pure — pass the result of `getSubmodulePaths` so the git
+ * read happens once for a whole sweep.
+ *
+ * @example
+ *   ;```typescript
+ *   pathIsUnderSubmodule('vendor/mbedtls/scripts/__pycache__', ['vendor/mbedtls'])
+ *   // => true
+ *   ```
+ */
+export declare function pathIsUnderSubmodule(relativePath: string, submodulePaths: string[]): boolean;