@socketsecurity/lib 6.0.6 → 6.0.8

package/dist/constants/node.js

@@ -14,10 +14,10 @@ node_process = require_runtime.__toESM(node_process);
 *   and feature-detection flags for APIs that vary across Node releases.
 */
 const NODE_VERSION = node_process.default.version;
-let _nodeDisableSigusr1Flags;
-let _nodeHardenFlags;
-let _nodeNoWarningsFlags;
-let _nodePermissionFlags;
+let nodeDisableSigusr1Flags;
+let nodeHardenFlags;
+let nodeNoWarningsFlags;
+let nodePermissionFlags;
 /**
 * Get the absolute path to the currently running Node.js binary.
 *
@@ -42,11 +42,11 @@ function getMaintainedNodeVersions() {
 * @returns A non-empty array of CLI flags suitable for passing to `node`.
 */
 function getNodeDisableSigusr1Flags() {
-	if (_nodeDisableSigusr1Flags === void 0)
+	if (nodeDisableSigusr1Flags === void 0)
  /* c8 ignore start - --no-inspect fallback fires only on Node
 	runtimes pre-v22.14 / v23.7 / v24.8; tests run on Node 24+. */
-	_nodeDisableSigusr1Flags = supportsNodeDisableSigusr1Flag() ? ["--disable-sigusr1"] : ["--no-inspect"];
-	return _nodeDisableSigusr1Flags;
+	nodeDisableSigusr1Flags = supportsNodeDisableSigusr1Flag() ? ["--disable-sigusr1"] : ["--no-inspect"];
+	return nodeDisableSigusr1Flags;
 }
 /**
 * Get the hardening flags Socket applies when spawning Node.js subprocesses.
@@ -58,7 +58,7 @@ function getNodeDisableSigusr1Flags() {
 * @returns A non-empty array of CLI flags suitable for passing to `node`.
 */
 function getNodeHardenFlags() {
-	if (_nodeHardenFlags === void 0) {
+	if (nodeHardenFlags === void 0) {
 		const major = getNodeMajorVersion();
 		const flags = ["--disable-proto=delete"];
 		if (major >= 24) {
@@ -69,9 +69,9 @@ function getNodeHardenFlags() {
 		/* c8 ignore start */
 		if (major >= 22) flags.push("--force-node-api-uncaught-exceptions-policy");
 		/* c8 ignore stop */
-		_nodeHardenFlags = flags;
+		nodeHardenFlags = flags;
 	}
-	return _nodeHardenFlags;
+	return nodeHardenFlags;
 }
 /**
 * Get the major component of the current Node.js version.
@@ -99,8 +99,8 @@ function getNodeMinorVersion() {
 * @returns A non-empty array of CLI flags suitable for passing to `node`.
 */
 function getNodeNoWarningsFlags() {
-	if (_nodeNoWarningsFlags === void 0) _nodeNoWarningsFlags = ["--no-warnings", "--no-deprecation"];
-	return _nodeNoWarningsFlags;
+	if (nodeNoWarningsFlags === void 0) nodeNoWarningsFlags = ["--no-warnings", "--no-deprecation"];
+	return nodeNoWarningsFlags;
 }
 /**
 * Get the patch component of the current Node.js version.
@@ -121,13 +121,13 @@ function getNodePatchVersion() {
 * @returns The permission flag list (possibly empty) for the current runtime.
 */
 function getNodePermissionFlags() {
-	if (_nodePermissionFlags === void 0) if (getNodeMajorVersion() >= 24) _nodePermissionFlags = [
+	if (nodePermissionFlags === void 0) if (getNodeMajorVersion() >= 24) nodePermissionFlags = [
 		"--allow-fs-read=*",
 		"--allow-fs-write=*",
 		"--allow-child-process"
 	];
-	else _nodePermissionFlags = [];
-	return _nodePermissionFlags;
+	else nodePermissionFlags = [];
+	return nodePermissionFlags;
 }
 /**
 * Get the full Node.js version string from `process.version`.
@@ -219,6 +219,36 @@ function supportsNodeRun() {
 	/* c8 ignore stop */
 }
 /**
+* Check whether the current runtime can execute TypeScript source directly
+* (`.ts` files via `node foo.ts`), with or without a flag. Type-stripping went
+* stable in Node.js 22.6 (under `--strip-types`, also accepted as the
+* deprecated alias `--experimental-strip-types`) and default-on in Node 24.
+*
+* Pair with {@link supportsNodeStripTypesDefault} to decide whether a flag needs
+* to be passed.
+*
+* @returns `true` when the runtime can run TypeScript (Node 22.6+).
+*/
+function supportsNodeStripTypes() {
+	const major = getNodeMajorVersion();
+	/* c8 ignore start - 22-specific arm; tests run on a single Node major. */
+	return major >= 23 || major === 22 && getNodeMinorVersion() >= 6;
+	/* c8 ignore stop */
+}
+/**
+* Check whether the current runtime strips TypeScript types **by default** (no
+* flag needed). Became default-on in Node.js 24.
+*
+* Use case: deciding whether a wrapper script needs to pass `--strip-types`
+* when invoking `node foo.ts`. On Node 24+ the flag is redundant; on 22.6 –
+* 23.x it's required.
+*
+* @returns `true` when no `--strip-types` flag is needed (Node 24+).
+*/
+function supportsNodeStripTypesDefault() {
+	return getNodeMajorVersion() >= 24;
+}
+/**
 * Check whether this process was spawned with an IPC channel. When `true`,
 * `process.send()` is callable to message the parent process.
 *
@@ -250,4 +280,6 @@ exports.supportsNodeDisableWarningFlag = supportsNodeDisableWarningFlag;
 exports.supportsNodePermissionFlag = supportsNodePermissionFlag;
 exports.supportsNodeRequireModule = supportsNodeRequireModule;
 exports.supportsNodeRun = supportsNodeRun;
+exports.supportsNodeStripTypes = supportsNodeStripTypes;
+exports.supportsNodeStripTypesDefault = supportsNodeStripTypesDefault;
 exports.supportsProcessSend = supportsProcessSend;

package/dist/constants/packages.d.ts

@@ -17,5 +17,8 @@ export declare function getLifecycleScriptNames(): string[];
 export declare function getPackageDefaultNodeRange(): string | undefined;
 export declare function getPackageDefaultSocketCategories(): readonly string[];
 export declare function getPackageExtensions(): Iterable<[string, unknown]>;
+export declare class BoundedPackumentCache extends Map<string, unknown> {
+    set(key: string, value: unknown): this;
+}
 export declare function getPackumentCache(): Map<string, unknown>;
 export declare function getPacoteCachePath(): string;

package/dist/constants/packages.js

@@ -2,9 +2,9 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_primordials_object = require('../primordials/object.js');
 const require_paths_normalize = require('../paths/normalize.js');
 const require_primordials_array = require('../primordials/array.js');
-const require_primordials_object = require('../primordials/object.js');
 const require_primordials_reflect = require('../primordials/reflect.js');
 const require_constants_lifecycle_script_names = require('./lifecycle-script-names.js');
 const require_constants_package_default_node_range = require('./package-default-node-range.js');
@@ -20,12 +20,12 @@ src_external_pacote = require_runtime.__toESM(src_external_pacote);
 *   categories), the pacote cache path, lifecycle script names, and known
 *   package extensions used during manifest processing.
 */
-let _lifecycleScriptNames;
-let _packageDefaultNodeRange;
-let _packageDefaultSocketCategories;
-let _packageExtensions;
-let _pacoteCachePath;
-let _packumentCache;
+let cachedLifecycleScriptNames;
+let cachedPackageDefaultNodeRange;
+let cachedPackageDefaultSocketCategories;
+let cachedPackageExtensions;
+let cachedPacoteCachePath;
+let cachedPackumentCache;
 const PACKAGE = "package";
 const AT_LATEST = "@latest";
 const LATEST = "latest";
@@ -35,28 +35,24 @@ const PACKAGE_DEFAULT_VERSION = "1.0.0";
 * force a re-fetch of registry metadata.
 */
 function clearPackumentCache() {
-	/* c8 ignore next 3 */
-	if (_packumentCache !== void 0) _packumentCache.clear();
+	/* c8 ignore next 3 - uninitialized-cache branch unreachable in tests */
+	if (cachedPackumentCache !== void 0) cachedPackumentCache.clear();
 }
-/*@__NO_SIDE_EFFECTS__*/
 function getLifecycleScriptNames() {
-	if (_lifecycleScriptNames === void 0) _lifecycleScriptNames = require_primordials_array.ArrayFrom(require_constants_lifecycle_script_names.lifecycleScriptNames);
-	return _lifecycleScriptNames;
+	if (cachedLifecycleScriptNames === void 0) cachedLifecycleScriptNames = require_primordials_array.ArrayFrom(require_constants_lifecycle_script_names.lifecycleScriptNames);
+	return cachedLifecycleScriptNames;
 }
-/*@__NO_SIDE_EFFECTS__*/
 function getPackageDefaultNodeRange() {
-	if (_packageDefaultNodeRange === void 0) _packageDefaultNodeRange = require_constants_package_default_node_range.packageDefaultNodeRange;
-	return _packageDefaultNodeRange;
+	if (cachedPackageDefaultNodeRange === void 0) cachedPackageDefaultNodeRange = require_constants_package_default_node_range.packageDefaultNodeRange;
+	return cachedPackageDefaultNodeRange;
 }
-/*@__NO_SIDE_EFFECTS__*/
 function getPackageDefaultSocketCategories() {
-	if (_packageDefaultSocketCategories === void 0) _packageDefaultSocketCategories = require_constants_package_default_socket_categories.packageDefaultSocketCategories;
-	return _packageDefaultSocketCategories;
+	if (cachedPackageDefaultSocketCategories === void 0) cachedPackageDefaultSocketCategories = require_constants_package_default_socket_categories.packageDefaultSocketCategories;
+	return cachedPackageDefaultSocketCategories;
 }
-/*@__NO_SIDE_EFFECTS__*/
 function getPackageExtensions() {
-	if (_packageExtensions === void 0) _packageExtensions = require_primordials_object.ObjectEntries(require_pkg_ext_data.packageExtensions);
-	return _packageExtensions;
+	if (cachedPackageExtensions === void 0) cachedPackageExtensions = require_primordials_object.ObjectEntries(require_pkg_ext_data.packageExtensions);
+	return cachedPackageExtensions;
 }
 const PACKUMENT_CACHE_MAX = 500;
 var BoundedPackumentCache = class extends Map {
@@ -71,26 +67,25 @@ var BoundedPackumentCache = class extends Map {
 		return super.set(key, value);
 	}
 };
-/*@__NO_SIDE_EFFECTS__*/
 function getPackumentCache() {
-	if (_packumentCache === void 0) _packumentCache = new BoundedPackumentCache();
-	return _packumentCache;
+	if (cachedPackumentCache === void 0) cachedPackumentCache = new BoundedPackumentCache();
+	return cachedPackumentCache;
 }
-/*@__NO_SIDE_EFFECTS__*/
 function getPacoteCachePath() {
-	if (_pacoteCachePath === void 0) try {
+	if (cachedPacoteCachePath === void 0) try {
 		const PacoteFetcherBase = require_primordials_reflect.ReflectGetPrototypeOf(src_external_pacote.default.RegistryFetcher.prototype)?.constructor;
 		/* c8 ignore start */
 		const cachePath = PacoteFetcherBase ? new PacoteFetcherBase("x", {}).cache : "";
-		_pacoteCachePath = cachePath ? /* @__PURE__ */ require_paths_normalize.normalizePath(cachePath) : "";
+		cachedPacoteCachePath = cachePath ? require_paths_normalize.normalizePath(cachePath) : "";
 	} catch {
-		_pacoteCachePath = "";
+		cachedPacoteCachePath = "";
 	}
-	return _pacoteCachePath;
+	return cachedPacoteCachePath;
 }
 
 //#endregion
 exports.AT_LATEST = AT_LATEST;
+exports.BoundedPackumentCache = BoundedPackumentCache;
 exports.LATEST = LATEST;
 exports.PACKAGE = PACKAGE;
 exports.PACKAGE_DEFAULT_VERSION = PACKAGE_DEFAULT_VERSION;

package/dist/constants/platform.d.ts

@@ -14,15 +14,42 @@ export type Libc = 'glibc' | 'musl';
  */
 export type Platform = NodeJS.Platform;
 /**
- * Get the current CPU architecture (memoized).
+ * Get the current CPU architecture (memoized), e.g. `x64`, `arm64`.
  */
 export declare function getArch(): Arch;
 /**
- * Get the current platform (memoized).
+ * Get the host libc variant (memoized): `'musl'` on Alpine-and-similar,
+ * `'glibc'` on other Linux, `undefined` off-Linux. Detected by probing for the
+ * musl dynamic linker. The single source of truth for libc detection —
+ * tool-specific resolvers (`getPythonArch`, `getJreArch`) call this rather than
+ * re-probing.
  */
-export declare function getPlatform(): Platform;
+export declare function getLibc(): Libc | undefined;
+/**
+ * Get the current OS (memoized), e.g. `darwin`, `linux`, `win32` — the raw
+ * `process.platform` value.
+ */
+export declare function getOs(): Platform;
+/**
+ * Get the current host **target** in the pnpm `pack-app` vocabulary (memoized):
+ * `<os>-<arch>[-<libc>]`, e.g. `darwin-arm64`, `linux-x64`, `win32-x64`,
+ * `linux-x64-musl`. Raw Node `process.platform`/`process.arch` joined with `-`,
+ * plus a `-musl` suffix on Alpine. This is the fleet-general naming for
+ * non-python / non-JRE tools (matches pnpm's release assets,
+ * `pnpm-<os>-<arch>[-<libc>].{tar.gz,zip}`). Tool-specific resolvers that need
+ * a different vocabulary own their own helper — see `getPythonArch`
+ * (python-build- standalone) / `getJreArch` (Adoptium).
+ */
+export declare function getTarget(): string;
 export declare const DARWIN: boolean;
 export declare const WIN32: boolean;
+/**
+ * True when this process was launched as a Chrome (or Chromium) native
+ * messaging host. Chrome passes the extension origin URL
+ * (`chrome-extension://<id>/`) as `process.argv[2]`; no other invocation shape
+ * produces that prefix.
+ */
+export declare const NATIVE_MESSAGING_HOST: boolean;
 export declare const S_IXUSR = 64;
 export declare const S_IXGRP = 8;
 export declare const S_IXOTH = 1;

package/dist/constants/platform.js

@@ -2,38 +2,98 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_node_os = require('../node/os.js');
+let node_fs = require("node:fs");
 
 //#region src/constants/platform.ts
 /**
 * @file Platform detection and OS-specific constants.
 */
-let _arch;
+let memoizedArch;
 /**
-* Get the current CPU architecture (memoized).
+* Get the current CPU architecture (memoized), e.g. `x64`, `arm64`.
 */
 function getArch() {
-	if (_arch === void 0) _arch = (/* @__PURE__ */ require_node_os.getNodeOs()).arch();
-	return _arch;
+	if (memoizedArch === void 0) memoizedArch = require_node_os.getNodeOs().arch();
+	return memoizedArch;
 }
-let _platform;
+const MUSL_LINKERS = [
+	"/lib/ld-musl-x86_64.so.1",
+	"/lib/ld-musl-aarch64.so.1",
+	"/usr/lib/ld-musl-x86_64.so.1",
+	"/usr/lib/ld-musl-aarch64.so.1"
+];
+let memoizedLibc;
+let memoizedLibcProbed = false;
 /**
-* Get the current platform (memoized).
+* Get the host libc variant (memoized): `'musl'` on Alpine-and-similar,
+* `'glibc'` on other Linux, `undefined` off-Linux. Detected by probing for the
+* musl dynamic linker. The single source of truth for libc detection —
+* tool-specific resolvers (`getPythonArch`, `getJreArch`) call this rather than
+* re-probing.
 */
-function getPlatform() {
-	if (_platform === void 0) _platform = (/* @__PURE__ */ require_node_os.getNodeOs()).platform();
-	return _platform;
+function getLibc() {
+	if (!memoizedLibcProbed) {
+		memoizedLibcProbed = true;
+		/* c8 ignore start - Linux-only filesystem probe. */
+		if (getOs() !== "linux") memoizedLibc = void 0;
+		else {
+			memoizedLibc = "glibc";
+			for (let i = 0, { length } = MUSL_LINKERS; i < length; i += 1) if ((0, node_fs.existsSync)(MUSL_LINKERS[i])) {
+				memoizedLibc = "musl";
+				break;
+			}
+		}
+	}
+	return memoizedLibc;
 }
-const DARWIN = getPlatform() === "darwin";
-const WIN32 = getPlatform() === "win32";
+let memoizedOs;
+/**
+* Get the current OS (memoized), e.g. `darwin`, `linux`, `win32` — the raw
+* `process.platform` value.
+*/
+function getOs() {
+	if (memoizedOs === void 0) memoizedOs = require_node_os.getNodeOs().platform();
+	return memoizedOs;
+}
+let memoizedTarget;
+/**
+* Get the current host **target** in the pnpm `pack-app` vocabulary (memoized):
+* `<os>-<arch>[-<libc>]`, e.g. `darwin-arm64`, `linux-x64`, `win32-x64`,
+* `linux-x64-musl`. Raw Node `process.platform`/`process.arch` joined with `-`,
+* plus a `-musl` suffix on Alpine. This is the fleet-general naming for
+* non-python / non-JRE tools (matches pnpm's release assets,
+* `pnpm-<os>-<arch>[-<libc>].{tar.gz,zip}`). Tool-specific resolvers that need
+* a different vocabulary own their own helper — see `getPythonArch`
+* (python-build- standalone) / `getJreArch` (Adoptium).
+*/
+function getTarget() {
+	if (memoizedTarget === void 0) {
+		const libcSuffix = getLibc() === "musl" ? "-musl" : "";
+		memoizedTarget = `${getOs()}-${getArch()}${libcSuffix}`;
+	}
+	return memoizedTarget;
+}
+const DARWIN = getOs() === "darwin";
+const WIN32 = getOs() === "win32";
+/**
+* True when this process was launched as a Chrome (or Chromium) native
+* messaging host. Chrome passes the extension origin URL
+* (`chrome-extension://<id>/`) as `process.argv[2]`; no other invocation shape
+* produces that prefix.
+*/
+const NATIVE_MESSAGING_HOST = typeof process !== "undefined" && typeof process.argv[2] === "string" && process.argv[2].startsWith("chrome-extension://");
 const S_IXUSR = 64;
 const S_IXGRP = 8;
 const S_IXOTH = 1;
 
 //#endregion
 exports.DARWIN = DARWIN;
+exports.NATIVE_MESSAGING_HOST = NATIVE_MESSAGING_HOST;
 exports.S_IXGRP = S_IXGRP;
 exports.S_IXOTH = S_IXOTH;
 exports.S_IXUSR = S_IXUSR;
 exports.WIN32 = WIN32;
 exports.getArch = getArch;
-exports.getPlatform = getPlatform;
+exports.getLibc = getLibc;
+exports.getOs = getOs;
+exports.getTarget = getTarget;

package/dist/constants/runtime.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @file Runtime environment detection constants. All checks use only
+ *   `typeof`-safe global probes so this module is safe to import in browser,
+ *   Node.js, Deno, Bun, and bundled contexts alike.
+ */
+/**
+ * True when running inside a Node.js process. Detected via
+ * `process.versions.node` — present in Node, absent in browsers and Deno/Bun
+ * which expose a different `process.versions` shape (or no `process` at all).
+ */
+export declare const IS_NODE: boolean;
+/**
+ * True when running in a browser context (window + document both defined).
+ * Note: Chrome extensions have `window` in popup contexts but not in service
+ * workers — check `IS_SERVICE_WORKER` for that case.
+ */
+export declare const IS_BROWSER: boolean;
+/**
+ * True when running inside a Web Worker / Chrome MV3 service worker. `self` is
+ * defined without `window` in worker contexts.
+ */
+export declare const IS_WORKER: boolean;

package/dist/constants/runtime.js

@@ -0,0 +1,32 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+//#region src/constants/runtime.ts
+/**
+* @file Runtime environment detection constants. All checks use only
+*   `typeof`-safe global probes so this module is safe to import in browser,
+*   Node.js, Deno, Bun, and bundled contexts alike.
+*/
+/**
+* True when running inside a Node.js process. Detected via
+* `process.versions.node` — present in Node, absent in browsers and Deno/Bun
+* which expose a different `process.versions` shape (or no `process` at all).
+*/
+const IS_NODE = typeof process !== "undefined" && typeof process.versions !== "undefined" && typeof process.versions.node === "string";
+/**
+* True when running in a browser context (window + document both defined).
+* Note: Chrome extensions have `window` in popup contexts but not in service
+* workers — check `IS_SERVICE_WORKER` for that case.
+*/
+const IS_BROWSER = typeof window !== "undefined" && typeof document !== "undefined";
+/**
+* True when running inside a Web Worker / Chrome MV3 service worker. `self` is
+* defined without `window` in worker contexts.
+*/
+const IS_WORKER = typeof self !== "undefined" && typeof window === "undefined" && typeof document === "undefined";
+
+//#endregion
+exports.IS_BROWSER = IS_BROWSER;
+exports.IS_NODE = IS_NODE;
+exports.IS_WORKER = IS_WORKER;

package/dist/constants/socket.d.ts

@@ -21,12 +21,8 @@ export declare const SOCKET_GITHUB_ORG = "SocketDev";
 export declare const SOCKET_REGISTRY_REPO_NAME = "socket-registry";
 export declare const SOCKET_REGISTRY_PACKAGE_NAME = "@socketsecurity/registry";
 export declare const SOCKET_REGISTRY_NPM_ORG = "socketregistry";
-export declare const SOCKET_CLI_APP_NAME = "socket";
-export declare const SOCKET_DLX_APP_NAME = "dlx";
-export declare const SOCKET_FIREWALL_APP_NAME = "sfw";
-export declare const SOCKET_REGISTRY_APP_NAME = "registry";
-export declare const SOCKET_WHEELHOUSE_APP_NAME = "wheelhouse";
-export declare const SOCKET_APP_PREFIX = "_";
+export declare const SOCKET_DIR_PREFIX = "_";
+export declare const SOCKET_DIR: Readonly<Record<'cacache' | 'dlx' | 'state' | 'wheelhouse', string>>;
 export declare const SOCKET_LIB_NAME = "@socketsecurity/lib";
 export declare const SOCKET_LIB_VERSION: string;
 export declare const SOCKET_IPC_HANDSHAKE = "SOCKET_IPC_HANDSHAKE";

package/dist/constants/socket.js

@@ -26,14 +26,16 @@ const SOCKET_GITHUB_ORG = "SocketDev";
 const SOCKET_REGISTRY_REPO_NAME = "socket-registry";
 const SOCKET_REGISTRY_PACKAGE_NAME = "@socketsecurity/registry";
 const SOCKET_REGISTRY_NPM_ORG = "socketregistry";
-const SOCKET_CLI_APP_NAME = "socket";
-const SOCKET_DLX_APP_NAME = "dlx";
-const SOCKET_FIREWALL_APP_NAME = "sfw";
-const SOCKET_REGISTRY_APP_NAME = "registry";
-const SOCKET_WHEELHOUSE_APP_NAME = "wheelhouse";
-const SOCKET_APP_PREFIX = "_";
+const SOCKET_DIR_PREFIX = "_";
+const SOCKET_DIR = {
+	__proto__: null,
+	cacache: `${"_"}cacache`,
+	dlx: `${"_"}dlx`,
+	state: `${"_"}state`,
+	wheelhouse: `${"_"}wheelhouse`
+};
 const SOCKET_LIB_NAME = "@socketsecurity/lib";
-const SOCKET_LIB_VERSION = "6.0.6";
+const SOCKET_LIB_VERSION = "6.0.8";
 const SOCKET_IPC_HANDSHAKE = "SOCKET_IPC_HANDSHAKE";
 const CACHE_SOCKET_API_DIR = "socket-api";
 const REGISTRY = "registry";
@@ -45,14 +47,12 @@ exports.REGISTRY = REGISTRY;
 exports.REGISTRY_SCOPE_DELIMITER = REGISTRY_SCOPE_DELIMITER;
 exports.SOCKET_API_BASE_URL = SOCKET_API_BASE_URL;
 exports.SOCKET_API_TOKENS_URL = SOCKET_API_TOKENS_URL;
-exports.SOCKET_APP_PREFIX = SOCKET_APP_PREFIX;
-exports.SOCKET_CLI_APP_NAME = SOCKET_CLI_APP_NAME;
 exports.SOCKET_CONTACT_URL = SOCKET_CONTACT_URL;
 exports.SOCKET_DASHBOARD_URL = SOCKET_DASHBOARD_URL;
-exports.SOCKET_DLX_APP_NAME = SOCKET_DLX_APP_NAME;
+exports.SOCKET_DIR = SOCKET_DIR;
+exports.SOCKET_DIR_PREFIX = SOCKET_DIR_PREFIX;
 exports.SOCKET_DOCS_CONTACT_URL = SOCKET_DOCS_CONTACT_URL;
 exports.SOCKET_DOCS_URL = SOCKET_DOCS_URL;
-exports.SOCKET_FIREWALL_APP_NAME = SOCKET_FIREWALL_APP_NAME;
 exports.SOCKET_GITHUB_ORG = SOCKET_GITHUB_ORG;
 exports.SOCKET_IPC_HANDSHAKE = SOCKET_IPC_HANDSHAKE;
 exports.SOCKET_LIB_NAME = SOCKET_LIB_NAME;
@@ -61,12 +61,10 @@ exports.SOCKET_OVERRIDE_SCOPE = SOCKET_OVERRIDE_SCOPE;
 exports.SOCKET_PRICING_URL = SOCKET_PRICING_URL;
 exports.SOCKET_PUBLIC_API_KEY = SOCKET_PUBLIC_API_KEY;
 exports.SOCKET_PUBLIC_API_TOKEN = SOCKET_PUBLIC_API_TOKEN;
-exports.SOCKET_REGISTRY_APP_NAME = SOCKET_REGISTRY_APP_NAME;
 exports.SOCKET_REGISTRY_NPM_ORG = SOCKET_REGISTRY_NPM_ORG;
 exports.SOCKET_REGISTRY_PACKAGE_NAME = SOCKET_REGISTRY_PACKAGE_NAME;
 exports.SOCKET_REGISTRY_REPO_NAME = SOCKET_REGISTRY_REPO_NAME;
 exports.SOCKET_REGISTRY_SCOPE = SOCKET_REGISTRY_SCOPE;
 exports.SOCKET_SECURITY_SCOPE = SOCKET_SECURITY_SCOPE;
 exports.SOCKET_STATUS_URL = SOCKET_STATUS_URL;
-exports.SOCKET_WEBSITE_URL = SOCKET_WEBSITE_URL;
-exports.SOCKET_WHEELHOUSE_APP_NAME = SOCKET_WHEELHOUSE_APP_NAME;
+exports.SOCKET_WEBSITE_URL = SOCKET_WEBSITE_URL;

package/dist/cover/code.js

@@ -3,12 +3,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_error = require('../primordials/error.js');
+const require_primordials_object = require('../primordials/object.js');
+const require_objects_predicates = require('../objects/predicates.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
-const require_primordials_object = require('../primordials/object.js');
 const require_fs_read_json = require('../fs/read-json.js');
-const require_objects_predicates = require('../objects/predicates.js');
 const require_process_spawn_child = require('../process/spawn/child.js');
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
@@ -38,18 +38,18 @@ function calculateMetric(data) {
 async function getCodeCoverage(options) {
 	const { coveragePath, generateIfMissing } = {
 		__proto__: null,
-		coveragePath: (/* @__PURE__ */ require_node_path.getNodePath()).join(node_process.default.cwd(), "coverage/coverage-final.json"),
+		coveragePath: require_node_path.getNodePath().join(node_process.default.cwd(), "coverage/coverage-final.json"),
 		generateIfMissing: false,
 		...options
 	};
 	if (!coveragePath) throw new require_primordials_error.ErrorCtor("Coverage path is required");
-	if (!(/* @__PURE__ */ require_node_fs.getNodeFs()).existsSync(coveragePath)) if (generateIfMissing) await require_process_spawn_child.spawn("vitest", ["run", "--coverage"], {
+	if (!require_node_fs.getNodeFs().existsSync(coveragePath)) if (generateIfMissing) await require_process_spawn_child.spawn("vitest", ["run", "--coverage"], {
 		cwd: node_process.default.cwd(),
 		stdio: "inherit"
 	});
 	else throw new require_primordials_error.ErrorCtor(`Coverage file not found at "${coveragePath}". Run tests with coverage first.`);
-	const coverageData = await /* @__PURE__ */ require_fs_read_json.readJson(coveragePath);
-	if (!/* @__PURE__ */ require_objects_predicates.isPlainObject(coverageData)) throw new require_primordials_error.ErrorCtor(`Invalid coverage data format in "${coveragePath}"`);
+	const coverageData = await require_fs_read_json.readJson(coveragePath);
+	if (!require_objects_predicates.isPlainObject(coverageData)) throw new require_primordials_error.ErrorCtor(`Invalid coverage data format in "${coveragePath}"`);
 	const totals = {
 		__proto__: null,
 		branches: {
@@ -75,16 +75,16 @@ async function getCodeCoverage(options) {
 	};
 	const v8Data = coverageData;
 	for (const fileCoverage of require_primordials_object.ObjectValues(v8Data)) {
-		if (!/* @__PURE__ */ require_objects_predicates.isPlainObject(fileCoverage)) continue;
+		if (!require_objects_predicates.isPlainObject(fileCoverage)) continue;
 		const fc = fileCoverage;
-		if (fc.s && /* @__PURE__ */ require_objects_predicates.isPlainObject(fc.s)) {
+		if (fc.s && require_objects_predicates.isPlainObject(fc.s)) {
 			const statementCounts = require_primordials_object.ObjectValues(fc.s);
 			for (const count of statementCounts) if (typeof count === "number") {
 				totals.statements.total += 1;
 				if (count > 0) totals.statements.covered += 1;
 			}
 		}
-		if (fc.b && /* @__PURE__ */ require_objects_predicates.isPlainObject(fc.b)) {
+		if (fc.b && require_objects_predicates.isPlainObject(fc.b)) {
 			const branchCounts = require_primordials_object.ObjectValues(fc.b);
 			for (const branches of branchCounts) if (require_primordials_array.ArrayIsArray(branches)) {
 				for (const count of branches) if (typeof count === "number") {
@@ -93,7 +93,7 @@ async function getCodeCoverage(options) {
 				}
 			}
 		}
-		if (fc.f && /* @__PURE__ */ require_objects_predicates.isPlainObject(fc.f)) {
+		if (fc.f && require_objects_predicates.isPlainObject(fc.f)) {
 			const functionCounts = require_primordials_object.ObjectValues(fc.f);
 			for (const count of functionCounts) if (typeof count === "number") {
 				totals.functions.total += 1;

package/dist/cover/formatters.js

@@ -95,13 +95,13 @@ function formatCoverage(options) {
 	if (format === "simple") return overall;
 	let output = "";
 	output += "Code Coverage:\n";
-	output += /* @__PURE__ */ require_strings_format.indentString(`Statements: ${code.statements.percent}%\n`, { count: 2 });
-	output += /* @__PURE__ */ require_strings_format.indentString(`Branches: ${code.branches.percent}%\n`, { count: 2 });
-	output += /* @__PURE__ */ require_strings_format.indentString(`Functions: ${code.functions.percent}%\n`, { count: 2 });
-	output += /* @__PURE__ */ require_strings_format.indentString(`Lines: ${code.lines.percent}%\n`, { count: 2 });
+	output += require_strings_format.indentString(`Statements: ${code.statements.percent}%\n`, { count: 2 });
+	output += require_strings_format.indentString(`Branches: ${code.branches.percent}%\n`, { count: 2 });
+	output += require_strings_format.indentString(`Functions: ${code.functions.percent}%\n`, { count: 2 });
+	output += require_strings_format.indentString(`Lines: ${code.lines.percent}%\n`, { count: 2 });
 	if (type) {
 		output += "\nType Coverage:\n";
-		output += /* @__PURE__ */ require_strings_format.indentString(`${type.percent}% (${type.covered}/${type.total})\n`, { count: 2 });
+		output += require_strings_format.indentString(`${type.percent}% (${type.covered}/${type.total})\n`, { count: 2 });
 	}
 	const overallValue = require_primordials_number.NumberParseFloat(overall);
 	const emoji = getCoverageEmoji(require_primordials_number.NumberIsNaN(overallValue) ? 0 : overallValue);

package/dist/crypto/hash.d.ts

@@ -1,8 +1,27 @@
 /**
  * @file Crypto hash helpers that prefer Node builtins where available. Probes
  *   `node:crypto.hash()` (added v21.7.0 / v20.12.0) and falls back to the
- *   streaming `createHash().update().digest()` chain on older runtimes.
+ *   streaming `createHash().update().digest()` chain on older runtimes. Which
+ *   digest goes where (integrity = sha512 trust boundary; checksum = sha256
+ *   interop shape; cache keys = truncated, never trust): see
+ *   `docs/hash-algorithms.md`.
  */
+import type { hash as NodeHash } from 'node:crypto';
+/**
+ * Compute the Socket content-address of `bytes`: `Q` +
+ * base64url(sha256(bytes)).
+ *
+ * Matches the blob store's hash scheme so a fetched blob can be verified
+ * against the hash it was requested by.
+ *
+ * @example
+ *   ;```typescript
+ *   import { blobHashOf } from '@socketsecurity/lib/crypto/hash'
+ *
+ *   blobHashOf(new TextEncoder().encode('hello'))
+ *   ```
+ */
+export declare function blobHashOf(bytes: NodeJS.ArrayBufferView): string;
 /**
  * Compute a one-shot cryptographic hash.
  *
@@ -33,4 +52,13 @@ export declare function hash(algorithm: string, data: string | NodeJS.ArrayBuffe
  *
  * @internal
  */
-export declare function nativeHash(): typeof import('node:crypto').hash | undefined;
+export declare function nativeHash(): typeof NodeHash | undefined;
+/**
+ * Throw if `bytes` does not content-address to `blobHash`. Both `Q`-prefixed
+ * (single blob) and `S`-prefixed (file-stream) hashes share the sha256 digest
+ * body, so both verify against the same digest; the leading discriminator char
+ * is dropped before comparison.
+ *
+ * @throws {Error} When the recomputed digest does not match `blobHash`.
+ */
+export declare function verifyBlobHash(blobHash: string, bytes: NodeJS.ArrayBufferView): void;