@socketsecurity/lib 6.0.6 → 6.0.8

package/dist/integrity.d.ts

@@ -1,21 +1,9 @@
-/**
- * @file Integrity specification helpers for downloads and file verification.
- *   Used by `dlx/binary-download` and external-tools resolvers; safe to consume
- *   from any module that needs to verify bytes against an expected hash. Single
- *   supported format per flavor:
- *
- *   - integrity: SRI with sha512 only (what npm registry returns)
- *   - checksum: sha256 hex (what `shasum -a 256` produces; common for binary
- *     release assets on GitHub) Callers may pass a {@link HashSpec} as a bare
- *     string (sniffed via format) or as an explicit `{ type, value }` object.
- *     The normalized form carried around internally is always the object.
- */
 /**
  * Tagged union representing an expected hash.
  *
  * @example
  *   // Bare SRI (sniffed as integrity):
- *   'sha512-abc...'
+ *   'sha256-NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs='
  *
  * @example
  *   // Bare sha256 hex (sniffed as checksum):
@@ -23,7 +11,7 @@
  *
  * @example
  *   // Explicit:
- *   { type: 'integrity', value: 'sha512-abc...' }
+ *   { type: 'integrity', value: 'sha512-...' }
  *   { type: 'checksum', value: 'a1b2c3...' }
  */
 export type HashSpec = string | {
@@ -50,22 +38,95 @@ export interface ComputedHashes {
      */
     integrity: string;
     /**
-     * SHA-256 hex (64 chars). Matches `shasum -a 256`.
+     * Sha256 hex (64 chars). Matches `shasum -a 256`.
      */
     checksum: string;
 }
+/**
+ * Parsed components of an integrity string.
+ */
+export interface ParsedIntegrity {
+    /**
+     * SRI algorithm: `'sha256' | 'sha384' | 'sha512'`.
+     */
+    algorithm: string;
+    /**
+     * Base64-encoded digest body (everything after the `-`).
+     */
+    body: string;
+}
+/**
+ * Convert a sha256 hex checksum to its SRI integrity form (`sha256-<base64>`).
+ * Idempotent on integrity input — call this on user-supplied data without first
+ * sniffing the format.
+ *
+ * The default algorithm is `'sha256'` because this converts a _checksum_, and
+ * checksums are sha256 by fleet convention (the GitHub-SHA256SUMS interop shape
+ * its only caller, `checksum-file.ts`, parses). Do NOT flip this default to
+ * sha512: this function only relabels the hex bytes, it does not re-hash, so a
+ * sha512 label on a 256-bit digest would be a lie. The canonical algorithm for
+ * OUR-side integrity values is sha512 — emitted by `computeHashes` as the
+ * `integrity` (`sha512-<base64>`) field; sha256 is reserved for
+ * upstream-SHASUMS interop and content addressing. Pass an explicit algorithm
+ * if you have a hex digest from `sha384` or `sha512` (the function does not
+ * verify hex length against the algorithm — caller's responsibility).
+ *
+ * @example
+ *   ;```typescript
+ *   checksumToIntegrity(
+ *     '3620a0fcaf81ecd3aaeccd5965919d90dbc913f4d07a96e11e7cafc2c785054b',
+ *   )
+ *   // 'sha256-NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs='
+ *
+ *   checksumToIntegrity('sha256-NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs=')
+ *   // 'sha256-NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs=' (idempotent)
+ *   ```
+ *
+ * @throws TypeError when the input is neither a recognized SRI nor a hex
+ *   digest.
+ */
+export declare function checksumToIntegrity(input: string, algorithm?: string): string;
 /**
  * Compute both integrity (sha512 SRI) and checksum (sha256 hex) for a buffer of
  * bytes.
  */
 export declare function computeHashes(bytes: Buffer): ComputedHashes;
-export declare function isChecksumString(s: string): boolean;
-export declare function isIntegrityString(s: string): boolean;
+/**
+ * Convert a sha256 SRI integrity string to its hex checksum form (64 lowercase
+ * chars). Idempotent on checksum input.
+ *
+ * Throws on `sha384` and `sha512` SRI — checksums are sha256-only by fleet
+ * convention. Callers that need a hex digest for those algorithms can call
+ * `parseIntegrity(sri)` and decode `.body` manually.
+ *
+ * @example
+ *   ;```typescript
+ *   integrityToChecksum('sha256-NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs=')
+ *   // '3620a0fcaf81ecd3aaeccd5965919d90dbc913f4d07a96e11e7cafc2c785054b'
+ *
+ *   integrityToChecksum(
+ *     '3620a0fcaf81ecd3aaeccd5965919d90dbc913f4d07a96e11e7cafc2c785054b',
+ *   )
+ *   // '3620a0fcaf81ecd3aaeccd5965919d90dbc913f4d07a96e11e7cafc2c785054b' (idempotent)
+ *   ```
+ *
+ * @throws TypeError when the input is neither a recognized SRI nor a hex
+ *   checksum, or when the input is a non-sha256 SRI.
+ */
+export declare function integrityToChecksum(input: string): string;
+/**
+ * True when `s` is a sha256 hex checksum (exactly 64 hex chars).
+ */
+export declare function isChecksum(s: string): boolean;
+/**
+ * True when `s` is a W3C SRI integrity string: `sha(256|384|512)-<base64>`.
+ */
+export declare function isIntegrity(s: string): boolean;
 /**
  * Normalize a {@link HashSpec} to its canonical `{ type, value }` form.
  *
  * - Object form is trusted (its `value` is validated for shape).
- * - Bare string matching sha512 SRI → integrity.
+ * - Bare string matching SRI → integrity.
  * - Bare string of 64 hex chars → checksum.
  * - Anything else throws TypeError.
  *
@@ -73,6 +134,19 @@ export declare function isIntegrityString(s: string): boolean;
  *   object's value doesn't match its declared type.
  */
 export declare function normalizeHash(spec: HashSpec): NormalizedHash;
+/**
+ * Split an integrity string into its `{ algorithm, body }` components. `body`
+ * is the base64-encoded digest (everything after the algorithm + dash).
+ *
+ * @example
+ *   ;```typescript
+ *   parseIntegrity('sha256-NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs=')
+ *   // { algorithm: 'sha256', body: 'NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs=' }
+ *   ```
+ *
+ * @throws Error when the input is not a valid SRI integrity string.
+ */
+export declare function parseIntegrity(sri: string): ParsedIntegrity;
 /**
  * Verify computed hashes against an expected {@link NormalizedHash}. Uses
  * `crypto.timingSafeEqual` for constant-time comparison.

package/dist/integrity.js

@@ -1,51 +1,123 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('./_virtual/_rolldown/runtime.js');
 const require_crypto_hash = require('./crypto/hash.js');
 const require_primordials_buffer = require('./primordials/buffer.js');
 const require_primordials_error = require('./primordials/error.js');
-const require_primordials_string = require('./primordials/string.js');
 let node_crypto = require("node:crypto");
+node_crypto = require_runtime.__toESM(node_crypto);
 
 //#region src/integrity.ts
 /**
-* @file Integrity specification helpers for downloads and file verification.
-*   Used by `dlx/binary-download` and external-tools resolvers; safe to consume
-*   from any module that needs to verify bytes against an expected hash. Single
-*   supported format per flavor:
+* @file Integrity + checksum helpers. The fleet uses two named hash flavors:
 *
-*   - integrity: SRI with sha512 only (what npm registry returns)
-*   - checksum: sha256 hex (what `shasum -a 256` produces; common for binary
-*     release assets on GitHub) Callers may pass a {@link HashSpec} as a bare
-*     string (sniffed via format) or as an explicit `{ type, value }` object.
-*     The normalized form carried around internally is always the object.
+*   - **integrity** — W3C Subresource Integrity string:
+*     `sha(256|384|512)-<base64>`. The same shape the npm registry returns and
+*     the `<script integrity>` HTML attribute accepts. Algorithm is embedded.
+*   - **checksum** — sha256 hex digest, exactly 64 lowercase chars. The shape
+*     produced by `shasum -a 256` and used in GitHub-release SHA256SUMS files.
+*     Conversion is direction-specific so the names read in English:
+*     `checksumToIntegrity(hex)` and `integrityToChecksum(sri)`. Both are
+*     idempotent on the destination format (pass an SRI to
+*     `checksumToIntegrity`, get the same SRI back) so callers can apply them
+*     without first sniffing the input shape. "SSRI" is just another name for
+*     Subresource Integrity — this module is the only one that should mention
+*     it, and only inside `parseIntegrity` to extract the embedded algorithm +
+*     body.
 */
-const INTEGRITY_PREFIX = "sha512-";
-const INTEGRITY_BODY_RE = /^[A-Za-z0-9+/=]+$/;
+const INTEGRITY_RE = /^(sha(?:256|384|512))-([A-Za-z0-9+/]+=*)$/;
 const CHECKSUM_RE = /^[a-f0-9]{64}$/i;
 /**
+* Convert a sha256 hex checksum to its SRI integrity form (`sha256-<base64>`).
+* Idempotent on integrity input — call this on user-supplied data without first
+* sniffing the format.
+*
+* The default algorithm is `'sha256'` because this converts a _checksum_, and
+* checksums are sha256 by fleet convention (the GitHub-SHA256SUMS interop shape
+* its only caller, `checksum-file.ts`, parses). Do NOT flip this default to
+* sha512: this function only relabels the hex bytes, it does not re-hash, so a
+* sha512 label on a 256-bit digest would be a lie. The canonical algorithm for
+* OUR-side integrity values is sha512 — emitted by `computeHashes` as the
+* `integrity` (`sha512-<base64>`) field; sha256 is reserved for
+* upstream-SHASUMS interop and content addressing. Pass an explicit algorithm
+* if you have a hex digest from `sha384` or `sha512` (the function does not
+* verify hex length against the algorithm — caller's responsibility).
+*
+* @example
+*   ;```typescript
+*   checksumToIntegrity(
+*     '3620a0fcaf81ecd3aaeccd5965919d90dbc913f4d07a96e11e7cafc2c785054b',
+*   )
+*   // 'sha256-NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs='
+*
+*   checksumToIntegrity('sha256-NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs=')
+*   // 'sha256-NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs=' (idempotent)
+*   ```
+*
+* @throws TypeError when the input is neither a recognized SRI nor a hex
+*   digest.
+*/
+function checksumToIntegrity(input, algorithm = "sha256") {
+	if (isIntegrity(input)) return input;
+	if (!/^[a-f0-9]+$/i.test(input)) throw new require_primordials_error.TypeErrorCtor(`checksumToIntegrity: expected a hex digest or SRI string, got: ${input}`);
+	return `${algorithm}-${require_primordials_buffer.BufferPrototypeToString(require_primordials_buffer.BufferFrom(input, "hex"), "base64")}`;
+}
+/**
 * Compute both integrity (sha512 SRI) and checksum (sha256 hex) for a buffer of
 * bytes.
 */
 function computeHashes(bytes) {
 	return {
-		integrity: `sha512-${/* @__PURE__ */ require_crypto_hash.hash("sha512", bytes, "base64")}`,
-		checksum: /* @__PURE__ */ require_crypto_hash.hash("sha256", bytes, "hex")
+		integrity: `sha512-${require_crypto_hash.hash("sha512", bytes, "base64")}`,
+		checksum: require_crypto_hash.hash("sha256", bytes, "hex")
 	};
 }
-function isChecksumString(s) {
+/**
+* Convert a sha256 SRI integrity string to its hex checksum form (64 lowercase
+* chars). Idempotent on checksum input.
+*
+* Throws on `sha384` and `sha512` SRI — checksums are sha256-only by fleet
+* convention. Callers that need a hex digest for those algorithms can call
+* `parseIntegrity(sri)` and decode `.body` manually.
+*
+* @example
+*   ;```typescript
+*   integrityToChecksum('sha256-NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs=')
+*   // '3620a0fcaf81ecd3aaeccd5965919d90dbc913f4d07a96e11e7cafc2c785054b'
+*
+*   integrityToChecksum(
+*     '3620a0fcaf81ecd3aaeccd5965919d90dbc913f4d07a96e11e7cafc2c785054b',
+*   )
+*   // '3620a0fcaf81ecd3aaeccd5965919d90dbc913f4d07a96e11e7cafc2c785054b' (idempotent)
+*   ```
+*
+* @throws TypeError when the input is neither a recognized SRI nor a hex
+*   checksum, or when the input is a non-sha256 SRI.
+*/
+function integrityToChecksum(input) {
+	if (isChecksum(input)) return input;
+	const parsed = parseIntegrity(input);
+	if (parsed.algorithm !== "sha256") throw new require_primordials_error.TypeErrorCtor(`integrityToChecksum: ${parsed.algorithm} integrity has no 64-hex-char checksum form — checksums are sha256-only by fleet convention.`);
+	return require_primordials_buffer.BufferPrototypeToString(require_primordials_buffer.BufferFrom(parsed.body, "base64"), "hex");
+}
+/**
+* True when `s` is a sha256 hex checksum (exactly 64 hex chars).
+*/
+function isChecksum(s) {
 	return CHECKSUM_RE.test(s);
 }
-function isIntegrityString(s) {
-	if (!require_primordials_string.StringPrototypeStartsWith(s, INTEGRITY_PREFIX)) return false;
-	const body = require_primordials_string.StringPrototypeSlice(s, 7);
-	return body.length > 0 && INTEGRITY_BODY_RE.test(body);
+/**
+* True when `s` is a W3C SRI integrity string: `sha(256|384|512)-<base64>`.
+*/
+function isIntegrity(s) {
+	return INTEGRITY_RE.test(s);
 }
 /**
 * Normalize a {@link HashSpec} to its canonical `{ type, value }` form.
 *
 * - Object form is trusted (its `value` is validated for shape).
-* - Bare string matching sha512 SRI → integrity.
+* - Bare string matching SRI → integrity.
 * - Bare string of 64 hex chars → checksum.
 * - Anything else throws TypeError.
 *
@@ -55,31 +127,51 @@ function isIntegrityString(s) {
 function normalizeHash(spec) {
 	if (typeof spec === "object" && spec !== null) {
 		if (spec.type === "integrity") {
-			if (!isIntegrityString(spec.value)) throw new require_primordials_error.TypeErrorCtor(`Expected SRI integrity string "sha512-<base64>", got: ${spec.value}`);
+			if (!isIntegrity(spec.value)) throw new require_primordials_error.TypeErrorCtor(`normalizeHash: expected SRI integrity "sha(256|384|512)-<base64>", got: ${spec.value}`);
 			return {
 				type: "integrity",
 				value: spec.value
 			};
 		}
 		if (spec.type === "checksum") {
-			if (!isChecksumString(spec.value)) throw new require_primordials_error.TypeErrorCtor(`Expected sha256 hex string (64 hex chars), got: ${spec.value}`);
+			if (!isChecksum(spec.value)) throw new require_primordials_error.TypeErrorCtor(`normalizeHash: expected sha256 hex checksum (64 hex chars), got: ${spec.value}`);
 			return {
 				type: "checksum",
 				value: spec.value
 			};
 		}
-		throw new require_primordials_error.TypeErrorCtor(`Unknown hash type: ${spec.type}`);
+		throw new require_primordials_error.TypeErrorCtor(`normalizeHash: unknown hash type: ${spec.type}`);
 	}
-	if (typeof spec !== "string") throw new require_primordials_error.TypeErrorCtor(`HashSpec must be a string or { type, value } object, got: ${typeof spec}`);
-	if (isIntegrityString(spec)) return {
+	if (typeof spec !== "string") throw new require_primordials_error.TypeErrorCtor(`normalizeHash: expected string or { type, value }, got: ${typeof spec}`);
+	if (isIntegrity(spec)) return {
 		type: "integrity",
 		value: spec
 	};
-	if (isChecksumString(spec)) return {
+	if (isChecksum(spec)) return {
 		type: "checksum",
 		value: spec
 	};
-	throw new require_primordials_error.TypeErrorCtor(`Unrecognized hash format. Expected SRI integrity ("sha512-<base64>") or sha256 hex (64 hex chars), got: ${spec}`);
+	throw new require_primordials_error.TypeErrorCtor(`normalizeHash: unrecognized hash format. Expected SRI integrity ("sha(256|384|512)-<base64>") or sha256 hex checksum (64 hex chars), got: ${spec}`);
+}
+/**
+* Split an integrity string into its `{ algorithm, body }` components. `body`
+* is the base64-encoded digest (everything after the algorithm + dash).
+*
+* @example
+*   ;```typescript
+*   parseIntegrity('sha256-NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs=')
+*   // { algorithm: 'sha256', body: 'NiCg/K+B7NOq7M1ZZZGdkNvJE/TQepbhHnyvwseFBUs=' }
+*   ```
+*
+* @throws Error when the input is not a valid SRI integrity string.
+*/
+function parseIntegrity(sri) {
+	const m = INTEGRITY_RE.exec(sri);
+	if (!m) throw new require_primordials_error.ErrorCtor(`parseIntegrity: invalid SRI format: ${sri}`);
+	return {
+		algorithm: m[1],
+		body: m[2]
+	};
 }
 /**
 * Verify computed hashes against an expected {@link NormalizedHash}. Uses
@@ -92,7 +184,7 @@ function verifyHash(expected, computed) {
 	const actual = expected.type === "integrity" ? computed.integrity : computed.checksum;
 	const expectedBuf = require_primordials_buffer.BufferFrom(expected.value);
 	const actualBuf = require_primordials_buffer.BufferFrom(actual);
-	if (expectedBuf.length !== actualBuf.length || !(0, node_crypto.timingSafeEqual)(expectedBuf, actualBuf)) throw new DlxHashMismatchError(expected, computed);
+	if (expectedBuf.length !== actualBuf.length || !node_crypto.default.timingSafeEqual(expectedBuf, actualBuf)) throw new DlxHashMismatchError(expected, computed);
 }
 /**
 * Thrown when an expected hash doesn't match the computed hash of the
@@ -112,8 +204,11 @@ var DlxHashMismatchError = class extends Error {
 
 //#endregion
 exports.DlxHashMismatchError = DlxHashMismatchError;
+exports.checksumToIntegrity = checksumToIntegrity;
 exports.computeHashes = computeHashes;
-exports.isChecksumString = isChecksumString;
-exports.isIntegrityString = isIntegrityString;
+exports.integrityToChecksum = integrityToChecksum;
+exports.isChecksum = isChecksum;
+exports.isIntegrity = isIntegrity;
 exports.normalizeHash = normalizeHash;
+exports.parseIntegrity = parseIntegrity;
 exports.verifyHash = verifyHash;

package/dist/ipc/directory.js

@@ -27,8 +27,8 @@ node_process = require_runtime.__toESM(node_process);
 * @internal
 */
 async function ensureIpcDirectory(filePath) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
-	const dir = (/* @__PURE__ */ require_node_path.getNodePath()).dirname(filePath);
+	const fs = require_node_fs.getNodeFs();
+	const dir = require_node_path.getNodePath().dirname(filePath);
 	await fs.promises.mkdir(dir, {
 		recursive: true,
 		mode: 448

package/dist/ipc/paths.js

@@ -46,7 +46,7 @@ node_process = require_runtime.__toESM(node_process);
 */
 function getIpcStubPath(appName) {
 	const tempDir = require_paths_socket.getOsTmpDir();
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const path = require_node_path.getNodePath();
 	const stubDir = path.join(tempDir, ".socket-ipc", appName);
 	return path.join(stubDir, `stub-${node_process.default.pid}.json`);
 }

package/dist/ipc/write.js

@@ -60,7 +60,7 @@ async function writeIpcStub(appName, data) {
 		pid: node_process.default.pid,
 		timestamp: require_primordials_date.DateNow()
 	});
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const fs = require_node_fs.getNodeFs();
 	const flags = fs.constants.O_CREAT | fs.constants.O_WRONLY | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW;
 	let handle;
 	try {

package/dist/ipc-cli/get.js

@@ -12,21 +12,21 @@ const require_primordials_object = require('../primordials/object.js');
 *   `@socketsecurity/lib/ipc` (`getIpcStubPath`, `writeIpcStub`) for cases
 *   where data exceeds env-var size limits.
 */
-let _ipcObject;
+let ipcObject;
 async function getIpc(key) {
-	if (_ipcObject === void 0) {
-		_ipcObject = {};
+	if (ipcObject === void 0) {
+		ipcObject = {};
 		const { env } = process;
-		if (env["SOCKET_CLI_FIX"]) _ipcObject.SOCKET_CLI_FIX = env["SOCKET_CLI_FIX"];
-		if (env["SOCKET_CLI_OPTIMIZE"]) _ipcObject.SOCKET_CLI_OPTIMIZE = env["SOCKET_CLI_OPTIMIZE"] === "true" || env["SOCKET_CLI_OPTIMIZE"] === "1";
-		if (env["SOCKET_CLI_SHADOW_ACCEPT_RISKS"]) _ipcObject.SOCKET_CLI_SHADOW_ACCEPT_RISKS = env["SOCKET_CLI_SHADOW_ACCEPT_RISKS"] === "true" || env["SOCKET_CLI_SHADOW_ACCEPT_RISKS"] === "1";
-		if (env["SOCKET_CLI_SHADOW_API_TOKEN"]) _ipcObject.SOCKET_CLI_SHADOW_API_TOKEN = env["SOCKET_CLI_SHADOW_API_TOKEN"];
-		if (env["SOCKET_CLI_SHADOW_BIN"]) _ipcObject.SOCKET_CLI_SHADOW_BIN = env["SOCKET_CLI_SHADOW_BIN"];
-		if (env["SOCKET_CLI_SHADOW_PROGRESS"]) _ipcObject.SOCKET_CLI_SHADOW_PROGRESS = env["SOCKET_CLI_SHADOW_PROGRESS"] === "true" || env["SOCKET_CLI_SHADOW_PROGRESS"] === "1";
-		if (env["SOCKET_CLI_SHADOW_SILENT"]) _ipcObject.SOCKET_CLI_SHADOW_SILENT = env["SOCKET_CLI_SHADOW_SILENT"] === "true" || env["SOCKET_CLI_SHADOW_SILENT"] === "1";
-		require_primordials_object.ObjectFreeze(_ipcObject);
+		if (env["SOCKET_CLI_FIX"]) ipcObject.SOCKET_CLI_FIX = env["SOCKET_CLI_FIX"];
+		if (env["SOCKET_CLI_OPTIMIZE"]) ipcObject.SOCKET_CLI_OPTIMIZE = env["SOCKET_CLI_OPTIMIZE"] === "1" || env["SOCKET_CLI_OPTIMIZE"] === "true";
+		if (env["SOCKET_CLI_SHADOW_ACCEPT_RISKS"]) ipcObject.SOCKET_CLI_SHADOW_ACCEPT_RISKS = env["SOCKET_CLI_SHADOW_ACCEPT_RISKS"] === "1" || env["SOCKET_CLI_SHADOW_ACCEPT_RISKS"] === "true";
+		if (env["SOCKET_CLI_SHADOW_API_TOKEN"]) ipcObject.SOCKET_CLI_SHADOW_API_TOKEN = env["SOCKET_CLI_SHADOW_API_TOKEN"];
+		if (env["SOCKET_CLI_SHADOW_BIN"]) ipcObject.SOCKET_CLI_SHADOW_BIN = env["SOCKET_CLI_SHADOW_BIN"];
+		if (env["SOCKET_CLI_SHADOW_PROGRESS"]) ipcObject.SOCKET_CLI_SHADOW_PROGRESS = env["SOCKET_CLI_SHADOW_PROGRESS"] === "1" || env["SOCKET_CLI_SHADOW_PROGRESS"] === "true";
+		if (env["SOCKET_CLI_SHADOW_SILENT"]) ipcObject.SOCKET_CLI_SHADOW_SILENT = env["SOCKET_CLI_SHADOW_SILENT"] === "1" || env["SOCKET_CLI_SHADOW_SILENT"] === "true";
+		require_primordials_object.ObjectFreeze(ipcObject);
 	}
-	return key ? _ipcObject[key] : _ipcObject;
+	return key ? ipcObject[key] : ipcObject;
 }
 
 //#endregion

package/dist/json/edit.js

@@ -6,10 +6,10 @@ const require_primordials_error = require('../primordials/error.js');
 const require_node_fs = require('../node/fs.js');
 const require_primordials_json = require('../primordials/json.js');
 const require_errors_predicates = require('../errors/predicates.js');
+const require_promises_timers = require('../promises/timers.js');
 const require_json_format = require('./format.js');
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
-let node_timers_promises = require("node:timers/promises");
 
 //#region src/json/edit.ts
 /**
@@ -17,7 +17,7 @@ let node_timers_promises = require("node:timers/promises");
 */
 const identSymbol = require_json_format.INDENT_SYMBOL;
 const newlineSymbol = require_json_format.NEWLINE_SYMBOL;
-let _EditableJsonClass;
+let editableJsonClass;
 /**
 * Get the EditableJson class for JSON file manipulation.
 *
@@ -31,24 +31,23 @@ let _EditableJsonClass;
 *   await config.save({ sort: true })
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getEditableJsonClass() {
-	if (_EditableJsonClass === void 0) _EditableJsonClass = class EditableJson {
-		_canSave = true;
-		_content = {};
-		_path = void 0;
-		_readFileContent = "";
-		_readFileJson = void 0;
+	if (editableJsonClass === void 0) editableJsonClass = class EditableJson {
+		canSave = true;
+		contentData = {};
+		pathValue = void 0;
+		readFileContent = "";
+		readFileJson = void 0;
 		get content() {
-			return this._content;
+			return this.contentData;
 		}
 		get filename() {
-			const path = this._path;
+			const path = this.pathValue;
 			if (!path) return "";
 			return path;
 		}
 		get path() {
-			return this._path;
+			return this.pathValue;
 		}
 		static async create(path, opts = { __proto__: null }) {
 			const instance = new EditableJson();
@@ -67,14 +66,14 @@ function getEditableJsonClass() {
 			/* c8 ignore stop */
 		}
 		create(path) {
-			this._path = path;
-			this._content = {};
-			this._canSave = true;
+			this.pathValue = path;
+			this.contentData = {};
+			this.canSave = true;
 			return this;
 		}
 		fromContent(data) {
-			this._content = data;
-			this._canSave = false;
+			this.contentData = data;
+			this.canSave = false;
 			return this;
 		}
 		fromJSON(data) {
@@ -83,49 +82,57 @@ function getEditableJsonClass() {
 			const newline = require_json_format.detectNewline(data);
 			parsed[identSymbol] = indent;
 			parsed[newlineSymbol] = newline;
-			this._content = parsed;
+			this.contentData = parsed;
 			return this;
 		}
 		async load(path) {
-			this._path = path;
-			this._readFileContent = await readFile(this.filename);
-			this.fromJSON(this._readFileContent);
-			this._readFileJson = require_primordials_json.JSONParse(this._readFileContent);
+			this.pathValue = path;
+			this.readFileContent = await readFile(this.filename);
+			this.fromJSON(this.readFileContent);
+			this.readFileJson = require_primordials_json.JSONParse(this.readFileContent);
 			return this;
 		}
 		async save(options) {
-			if (!this._canSave || this.content === void 0) throw new require_primordials_error.ErrorCtor("No file path to save to");
-			if (!require_json_format.shouldSave(this.content, this._readFileJson, this._readFileContent, options)) return false;
+			options = {
+				__proto__: null,
+				...options
+			};
+			if (!this.canSave || this.content === void 0) throw new require_primordials_error.ErrorCtor("No file path to save to");
+			if (!require_json_format.shouldSave(this.content, this.readFileJson, this.readFileContent, options)) return false;
 			const content = require_json_format.stripFormattingSymbols(this.content);
 			const fileContent = require_json_format.stringifyWithFormatting(options?.sort ? require_json_format.sortKeys(content) : content, require_json_format.getFormattingFromContent(this.content));
 			await retryWrite(this.filename, fileContent);
-			this._readFileContent = fileContent;
-			this._readFileJson = require_primordials_json.JSONParse(fileContent);
+			this.readFileContent = fileContent;
+			this.readFileJson = require_primordials_json.JSONParse(fileContent);
 			return true;
 		}
 		saveSync(options) {
-			if (!this._canSave || this.content === void 0) throw new require_primordials_error.ErrorCtor("No file path to save to");
-			if (!require_json_format.shouldSave(this.content, this._readFileJson, this._readFileContent, options)) return false;
+			options = {
+				__proto__: null,
+				...options
+			};
+			if (!this.canSave || this.content === void 0) throw new require_primordials_error.ErrorCtor("No file path to save to");
+			if (!require_json_format.shouldSave(this.content, this.readFileJson, this.readFileContent, options)) return false;
 			const content = require_json_format.stripFormattingSymbols(this.content);
 			const fileContent = require_json_format.stringifyWithFormatting(options?.sort ? require_json_format.sortKeys(content) : content, require_json_format.getFormattingFromContent(this.content));
-			(/* @__PURE__ */ require_node_fs.getNodeFs()).writeFileSync(this.filename, fileContent);
-			this._readFileContent = fileContent;
-			this._readFileJson = require_primordials_json.JSONParse(fileContent);
+			require_node_fs.getNodeFs().writeFileSync(this.filename, fileContent);
+			this.readFileContent = fileContent;
+			this.readFileJson = require_primordials_json.JSONParse(fileContent);
 			return true;
 		}
 		update(content) {
-			this._content = {
-				...this._content,
+			this.contentData = {
+				...this.contentData,
 				...content
 			};
 			return this;
 		}
 		willSave(options) {
-			if (!this._canSave || this.content === void 0) return false;
-			return require_json_format.shouldSave(this.content, this._readFileJson, this._readFileContent, options);
+			if (!this.canSave || this.content === void 0) return false;
+			return require_json_format.shouldSave(this.content, this.readFileJson, this.readFileContent, options);
 		}
 	};
-	return _EditableJsonClass;
+	return editableJsonClass;
 }
 /**
 * Read file content from disk with retry logic for ENOENT errors.
@@ -133,7 +140,7 @@ function getEditableJsonClass() {
 * @private
 */
 async function readFile(filepath) {
-	const { promises: fsPromises } = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const { promises: fsPromises } = require_node_fs.getNodeFs();
 	/* c8 ignore start */
 	const maxRetries = node_process.default.platform === "win32" ? 5 : 1;
 	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
@@ -141,7 +148,7 @@ async function readFile(filepath) {
 	} catch (e) {
 		const isLastAttempt = attempt === maxRetries;
 		if (!(require_errors_predicates.isErrnoException(e) && e.code === "ENOENT") || isLastAttempt) throw e;
-		await (0, node_timers_promises.setTimeout)(node_process.default.platform === "win32" ? 50 * (attempt + 1) : 20);
+		await require_promises_timers.sleep(node_process.default.platform === "win32" ? 50 * (attempt + 1) : 20);
 	}
 	/* c8 ignore stop */
 	/* c8 ignore next 3 - Loop has 'return' on success and 'throw' in
@@ -156,22 +163,22 @@ async function readFile(filepath) {
 * @private
 */
 async function retryWrite(filepath, content, retries = 3, baseDelay = 10) {
-	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	const fs = require_node_fs.getNodeFs();
 	const { promises: fsPromises } = fs;
 	for (let attempt = 0; attempt <= retries; attempt++) try {
 		await fsPromises.writeFile(filepath, content);
 		/* c8 ignore start - Windows-only flush+verify loop. Tested on
 		Windows runners. */
 		if (node_process.default.platform === "win32") {
-			await (0, node_timers_promises.setTimeout)(50);
+			await require_promises_timers.sleep(50);
 			let accessRetries = 0;
 			const maxAccessRetries = 5;
 			while (accessRetries < maxAccessRetries) {
 				if (fs.existsSync(filepath)) {
-					await (0, node_timers_promises.setTimeout)(10);
+					await require_promises_timers.sleep(10);
 					break;
 				}
-				await (0, node_timers_promises.setTimeout)(20 * (accessRetries + 1));
+				await require_promises_timers.sleep(20 * (accessRetries + 1));
 				accessRetries++;
 			}
 		}
@@ -179,8 +186,8 @@ async function retryWrite(filepath, content, retries = 3, baseDelay = 10) {
 		return;
 	} catch (e) {
 		const isLastAttempt = attempt === retries;
-		if (!(require_errors_predicates.isErrnoException(e) && (e.code === "EPERM" || e.code === "EBUSY" || e.code === "ENOENT")) || isLastAttempt) throw e;
-		await (0, node_timers_promises.setTimeout)(baseDelay * 2 ** attempt);
+		if (!(require_errors_predicates.isErrnoException(e) && (e.code === "EBUSY" || e.code === "ENOENT" || e.code === "EPERM")) || isLastAttempt) throw e;
+		await require_promises_timers.sleep(baseDelay * 2 ** attempt);
 	}
 }
 

package/dist/json/format.js

@@ -165,7 +165,7 @@ function shouldSave(currentContent, originalContent, originalFileContent, option
 */
 function sortKeys(obj) {
 	const sorted = { __proto__: null };
-	const keys = require_primordials_object.ObjectKeys(obj).sort();
+	const keys = require_primordials_object.ObjectKeys(obj).toSorted();
 	for (const key of keys) sorted[key] = obj[key];
 	return sorted;
 }