@socketsecurity/lib 6.0.7 → 6.0.8

package/dist/external-tools/sbt/resolve.d.ts

@@ -25,7 +25,7 @@ export interface ResolveSbtOptions {
         downloader?: BinaryDownloader | undefined;
     } | undefined;
 }
-export declare function cacheKey(opts: ResolveSbtOptions | undefined): string;
-export declare function doResolveSbt(opts?: ResolveSbtOptions | undefined): Promise<ResolvedSbt | undefined>;
+export declare function cacheKey(options: ResolveSbtOptions | undefined): string;
+export declare function doResolveSbt(options?: ResolveSbtOptions | undefined): Promise<ResolvedSbt | undefined>;
 export declare function resetSbtResolution(): void;
-export declare function resolveSbt(opts?: ResolveSbtOptions | undefined): Promise<ResolvedSbt | undefined>;
+export declare function resolveSbt(options?: ResolveSbtOptions | undefined): Promise<ResolvedSbt | undefined>;

package/dist/external-tools/sbt/resolve.js

@@ -20,30 +20,38 @@ const require_external_tools_sbt_from_vfs = require('./from-vfs.js');
 *      Memoized per option-shape.
 */
 const resolutionCache = new require_primordials_map_set.MapCtor();
-function cacheKey(opts) {
-	if (!opts?.downloadIfMissing) return "local-only";
-	const { cacheDir, integrity, version } = opts.downloadIfMissing;
+function cacheKey(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
+	if (!options?.downloadIfMissing) return "local-only";
+	const { cacheDir, integrity, version } = options.downloadIfMissing;
 	return `dl:${version}:${typeof integrity === "string" ? integrity : integrity ? `${integrity.type}:${integrity.value}` : ""}:${cacheDir ?? ""}`;
 }
-async function doResolveSbt(opts) {
+async function doResolveSbt(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const fromVfs = await require_external_tools_sbt_from_vfs.sbtFromVfs();
 	/* c8 ignore start - smol Node binary only. */
 	if (fromVfs) return fromVfs;
 	/* c8 ignore stop */
 	const fromPath = await require_external_tools_sbt_from_path.sbtFromPath();
 	if (fromPath) return fromPath;
-	if (opts?.downloadIfMissing) return require_external_tools_sbt_from_download.sbtFromDownload(opts.downloadIfMissing);
+	if (options?.downloadIfMissing) return require_external_tools_sbt_from_download.sbtFromDownload(options.downloadIfMissing);
 }
 /* c8 ignore start - test-only escape hatch. */
 function resetSbtResolution() {
 	resolutionCache.clear();
 }
 /* c8 ignore stop */
-function resolveSbt(opts) {
-	const key = cacheKey(opts);
+function resolveSbt(options) {
+	const key = cacheKey(options);
 	let cached = resolutionCache.get(key);
 	if (!cached) {
-		cached = doResolveSbt(opts);
+		cached = doResolveSbt(options);
 		resolutionCache.set(key, cached);
 	}
 	return cached;

package/dist/external-tools/skillspector/from-dlx.d.ts

@@ -21,4 +21,4 @@ export interface SkillSpectorFromDlxOptions {
      */
     readonly cacheDir?: string | undefined;
 }
-export declare function skillspectorFromDlx(opts: SkillSpectorFromDlxOptions): Promise<ResolvedSkillSpector | undefined>;
+export declare function skillspectorFromDlx(options: SkillSpectorFromDlxOptions): Promise<ResolvedSkillSpector | undefined>;

package/dist/external-tools/skillspector/from-dlx.js

@@ -18,10 +18,17 @@ node_path = require_runtime.__toESM(node_path);
 *     venv when its `skillspector` entry-point already exists.
 */
 const UPSTREAM_REPO = "https://github.com/NVIDIA/skillspector.git";
-async function skillspectorFromDlx(opts) {
-	const { sha } = opts;
+async function skillspectorFromDlx(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
+	const { sha } = {
+		__proto__: null,
+		...options
+	};
 	if (!sha) return;
-	const cacheDir = opts.cacheDir ?? node_path.default.join(require_paths_socket.getSocketDlxDir(), "skillspector", sha);
+	const cacheDir = options.cacheDir ?? node_path.default.join(require_paths_socket.getSocketDlxDir(), "skillspector", sha);
 	const installSpec = `git+${UPSTREAM_REPO}@${sha}`;
 	try {
 		return {

package/dist/external-tools/skillspector/resolve.d.ts

@@ -26,8 +26,8 @@ export interface ResolveSkillSpectorOptions {
      */
     readonly localOnly?: boolean | undefined;
 }
-export declare function cacheKey(opts: ResolveSkillSpectorOptions): string;
-export declare function doResolveSkillSpector(opts: ResolveSkillSpectorOptions): Promise<ResolvedSkillSpector | undefined>;
+export declare function cacheKey(options: ResolveSkillSpectorOptions): string;
+export declare function doResolveSkillSpector(options: ResolveSkillSpectorOptions): Promise<ResolvedSkillSpector | undefined>;
 /**
  * Memoizing wrapper around {@link doResolveSkillSpector}.
  */

package/dist/external-tools/skillspector/resolve.js

@@ -19,20 +19,28 @@ const require_external_tools_skillspector_from_vfs = require('./from-vfs.js');
 *      sha+cacheDir+localOnly tuple.
 */
 const resolutionCache = new require_primordials_map_set.MapCtor();
-function cacheKey(opts) {
-	return `${opts.sha ?? ""}|${opts.cacheDir ?? ""}|${opts.localOnly ? "local" : "full"}`;
+function cacheKey(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
+	return `${options.sha ?? ""}|${options.cacheDir ?? ""}|${options.localOnly ? "local" : "full"}`;
 }
-async function doResolveSkillSpector(opts) {
+async function doResolveSkillSpector(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const fromVfs = await require_external_tools_skillspector_from_vfs.skillspectorFromVfs();
 	/* c8 ignore start - smol Node binary only. */
 	if (fromVfs) return fromVfs;
 	/* c8 ignore stop */
 	const fromPath = await require_external_tools_skillspector_from_path.skillspectorFromPath();
 	if (fromPath) return fromPath;
-	if (opts.localOnly || !opts.sha) return;
+	if (options.localOnly || !options.sha) return;
 	return require_external_tools_skillspector_from_dlx.skillspectorFromDlx({
-		sha: opts.sha,
-		cacheDir: opts.cacheDir
+		sha: options.sha,
+		cacheDir: options.cacheDir
 	});
 }
 /**

package/dist/external-tools/synp/asset-names.d.ts

@@ -11,4 +11,4 @@ export interface SynpPackageOptions {
 /**
  * Build the npm package spec string for the requested synp version.
  */
-export declare function getSynpPackageSpec(opts: SynpPackageOptions): string;
+export declare function getSynpPackageSpec(options: SynpPackageOptions): string;

package/dist/external-tools/synp/asset-names.js

@@ -6,8 +6,12 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 /**
 * Build the npm package spec string for the requested synp version.
 */
-function getSynpPackageSpec(opts) {
-	return `synp@${opts.version}`;
+function getSynpPackageSpec(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
+	return `synp@${options.version}`;
 }
 
 //#endregion

package/dist/external-tools/synp/from-download.d.ts

@@ -15,4 +15,4 @@ export interface SynpFromDownloadOptions {
      */
     integrity?: string | undefined;
 }
-export declare function synpFromDownload(opts: SynpFromDownloadOptions): Promise<ResolvedSynp>;
+export declare function synpFromDownload(options: SynpFromDownloadOptions): Promise<ResolvedSynp>;

package/dist/external-tools/synp/from-download.js

@@ -10,8 +10,11 @@ const require_external_tools_synp_asset_names = require('./asset-names.js');
 *   `dlx/package` and returns a `ResolvedSynp` pointing at the resolved bin
 *   shim.
 */
-async function synpFromDownload(opts) {
-	const { integrity, version } = opts;
+async function synpFromDownload(options) {
+	const { integrity, version } = {
+		__proto__: null,
+		...options
+	};
 	const { binaryPath } = await require_dlx_package.downloadNpmPackage({
 		spec: require_external_tools_synp_asset_names.getSynpPackageSpec({ version }),
 		binaryName: "synp",

package/dist/external-tools/synp/resolve.d.ts

@@ -15,7 +15,7 @@ export interface ResolveSynpOptions {
         integrity?: string | undefined;
     } | undefined;
 }
-export declare function cacheKey(opts: ResolveSynpOptions | undefined): string;
-export declare function doResolveSynp(opts?: ResolveSynpOptions | undefined): Promise<ResolvedSynp | undefined>;
+export declare function cacheKey(options: ResolveSynpOptions | undefined): string;
+export declare function doResolveSynp(options?: ResolveSynpOptions | undefined): Promise<ResolvedSynp | undefined>;
 export declare function resetSynpResolution(): void;
-export declare function resolveSynp(opts?: ResolveSynpOptions | undefined): Promise<ResolvedSynp | undefined>;
+export declare function resolveSynp(options?: ResolveSynpOptions | undefined): Promise<ResolvedSynp | undefined>;

package/dist/external-tools/synp/resolve.js

@@ -18,30 +18,38 @@ const require_external_tools_synp_from_vfs = require('./from-vfs.js');
 *      per option-shape.
 */
 const resolutionCache = new require_primordials_map_set.MapCtor();
-function cacheKey(opts) {
-	if (!opts?.downloadIfMissing) return "local-only";
-	const { integrity, version } = opts.downloadIfMissing;
+function cacheKey(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
+	if (!options?.downloadIfMissing) return "local-only";
+	const { integrity, version } = options.downloadIfMissing;
 	return `dl:${version}:${integrity ?? ""}`;
 }
-async function doResolveSynp(opts) {
+async function doResolveSynp(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const fromVfs = await require_external_tools_synp_from_vfs.synpFromVfs();
 	/* c8 ignore start - smol Node binary only. */
 	if (fromVfs) return fromVfs;
 	/* c8 ignore stop */
 	const fromPath = await require_external_tools_synp_from_path.synpFromPath();
 	if (fromPath) return fromPath;
-	if (opts?.downloadIfMissing) return require_external_tools_synp_from_download.synpFromDownload(opts.downloadIfMissing);
+	if (options?.downloadIfMissing) return require_external_tools_synp_from_download.synpFromDownload(options.downloadIfMissing);
 }
 /* c8 ignore start - test-only escape hatch. */
 function resetSynpResolution() {
 	resolutionCache.clear();
 }
 /* c8 ignore stop */
-function resolveSynp(opts) {
-	const key = cacheKey(opts);
+function resolveSynp(options) {
+	const key = cacheKey(options);
 	let cached = resolutionCache.get(key);
 	if (!cached) {
-		cached = doResolveSynp(opts);
+		cached = doResolveSynp(options);
 		resolutionCache.set(key, cached);
 	}
 	return cached;

package/dist/external-tools/trivy/asset-names.d.ts

@@ -31,4 +31,4 @@ export interface TrivyDownloadOptions {
  *
  * Reference: https://github.com/aquasecurity/trivy/releases.
  */
-export declare function getTrivyDownloadUrl(opts: TrivyDownloadOptions): string | undefined;
+export declare function getTrivyDownloadUrl(options: TrivyDownloadOptions): string | undefined;

package/dist/external-tools/trivy/asset-names.js

@@ -44,8 +44,11 @@ function getTrivyAssetEntry(platformArch) {
 *
 * Reference: https://github.com/aquasecurity/trivy/releases.
 */
-function getTrivyDownloadUrl(opts) {
-	const { platformArch, version } = opts;
+function getTrivyDownloadUrl(options) {
+	const { platformArch, version } = {
+		__proto__: null,
+		...options
+	};
 	const entry = TRIVY_ASSET_MAP[platformArch];
 	if (!entry) return;
 	return `https://github.com/aquasecurity/trivy/releases/download/v${version}/trivy_${version}_${entry.suffix}`;

package/dist/external-tools/trivy/from-download.d.ts

@@ -14,4 +14,4 @@ export interface TrivyFromDownloadOptions {
     cacheDir?: string | undefined;
     downloader?: BinaryDownloader | undefined;
 }
-export declare function trivyFromDownload(opts: TrivyFromDownloadOptions): Promise<ResolvedTrivy | undefined>;
+export declare function trivyFromDownload(options: TrivyFromDownloadOptions): Promise<ResolvedTrivy | undefined>;

package/dist/external-tools/trivy/from-download.js

@@ -5,10 +5,10 @@ const require_runtime = require('../../_virtual/_rolldown/runtime.js');
 const require_paths_socket = require('../../paths/socket.js');
 const require_external_tools_from_download = require('../from-download.js');
 const require_external_tools_trivy_asset_names = require('./asset-names.js');
-let node_path = require("node:path");
-node_path = require_runtime.__toESM(node_path);
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
 
 //#region src/external-tools/trivy/from-download.ts
 /**
@@ -17,8 +17,11 @@ node_process = require_runtime.__toESM(node_process);
 *   Windows ships zip; `downloadAndExtractTool` auto-detects the format from
 *   the archive name.
 */
-async function trivyFromDownload(opts) {
-	const { cacheDir, downloader, integrity, platformArch, version } = opts;
+async function trivyFromDownload(options) {
+	const { cacheDir, downloader, integrity, platformArch, version } = {
+		__proto__: null,
+		...options
+	};
 	const url = require_external_tools_trivy_asset_names.getTrivyDownloadUrl({
 		version,
 		platformArch

package/dist/external-tools/trivy/resolve.d.ts

@@ -20,7 +20,7 @@ export interface ResolveTrivyOptions {
         downloader?: BinaryDownloader | undefined;
     } | undefined;
 }
-export declare function cacheKey(opts: ResolveTrivyOptions | undefined): string;
-export declare function doResolveTrivy(opts?: ResolveTrivyOptions | undefined): Promise<ResolvedTrivy | undefined>;
+export declare function cacheKey(options: ResolveTrivyOptions | undefined): string;
+export declare function doResolveTrivy(options?: ResolveTrivyOptions | undefined): Promise<ResolvedTrivy | undefined>;
 export declare function resetTrivyResolution(): void;
-export declare function resolveTrivy(opts?: ResolveTrivyOptions | undefined): Promise<ResolvedTrivy | undefined>;
+export declare function resolveTrivy(options?: ResolveTrivyOptions | undefined): Promise<ResolvedTrivy | undefined>;

package/dist/external-tools/trivy/resolve.js

@@ -18,30 +18,38 @@ const require_external_tools_trivy_from_vfs = require('./from-vfs.js');
 *      Memoized per option-shape.
 */
 const resolutionCache = new require_primordials_map_set.MapCtor();
-function cacheKey(opts) {
-	if (!opts?.downloadIfMissing) return "local-only";
-	const { cacheDir, integrity, platformArch, version } = opts.downloadIfMissing;
+function cacheKey(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
+	if (!options?.downloadIfMissing) return "local-only";
+	const { cacheDir, integrity, platformArch, version } = options.downloadIfMissing;
 	return `dl:${version}:${platformArch}:${typeof integrity === "string" ? integrity : integrity ? `${integrity.type}:${integrity.value}` : ""}:${cacheDir ?? ""}`;
 }
-async function doResolveTrivy(opts) {
+async function doResolveTrivy(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const fromVfs = await require_external_tools_trivy_from_vfs.trivyFromVfs();
 	/* c8 ignore start - smol Node binary only. */
 	if (fromVfs) return fromVfs;
 	/* c8 ignore stop */
 	const fromPath = await require_external_tools_trivy_from_path.trivyFromPath();
 	if (fromPath) return fromPath;
-	if (opts?.downloadIfMissing) return require_external_tools_trivy_from_download.trivyFromDownload(opts.downloadIfMissing);
+	if (options?.downloadIfMissing) return require_external_tools_trivy_from_download.trivyFromDownload(options.downloadIfMissing);
 }
 /* c8 ignore start - test-only escape hatch. */
 function resetTrivyResolution() {
 	resolutionCache.clear();
 }
 /* c8 ignore stop */
-function resolveTrivy(opts) {
-	const key = cacheKey(opts);
+function resolveTrivy(options) {
+	const key = cacheKey(options);
 	let cached = resolutionCache.get(key);
 	if (!cached) {
-		cached = doResolveTrivy(opts);
+		cached = doResolveTrivy(options);
 		resolutionCache.set(key, cached);
 	}
 	return cached;

package/dist/external-tools/trufflehog/asset-names.d.ts

@@ -31,4 +31,4 @@ export interface TrufflehogDownloadOptions {
  *
  * Reference: https://github.com/trufflesecurity/trufflehog/releases.
  */
-export declare function getTrufflehogDownloadUrl(opts: TrufflehogDownloadOptions): string | undefined;
+export declare function getTrufflehogDownloadUrl(options: TrufflehogDownloadOptions): string | undefined;

package/dist/external-tools/trufflehog/asset-names.js

@@ -47,8 +47,11 @@ function getTrufflehogAssetEntry(platformArch) {
 *
 * Reference: https://github.com/trufflesecurity/trufflehog/releases.
 */
-function getTrufflehogDownloadUrl(opts) {
-	const { platformArch, version } = opts;
+function getTrufflehogDownloadUrl(options) {
+	const { platformArch, version } = {
+		__proto__: null,
+		...options
+	};
 	const entry = TRUFFLEHOG_ASSET_MAP[platformArch];
 	if (!entry) return;
 	return `https://github.com/trufflesecurity/trufflehog/releases/download/v${version}/trufflehog_${version}_${entry.suffix}`;

package/dist/external-tools/trufflehog/from-download.d.ts

@@ -34,4 +34,4 @@ export interface TrufflehogFromDownloadOptions {
      */
     downloader?: BinaryDownloader | undefined;
 }
-export declare function trufflehogFromDownload(opts: TrufflehogFromDownloadOptions): Promise<ResolvedTrufflehog | undefined>;
+export declare function trufflehogFromDownload(options: TrufflehogFromDownloadOptions): Promise<ResolvedTrufflehog | undefined>;

package/dist/external-tools/trufflehog/from-download.js

@@ -5,10 +5,10 @@ const require_runtime = require('../../_virtual/_rolldown/runtime.js');
 const require_paths_socket = require('../../paths/socket.js');
 const require_external_tools_from_download = require('../from-download.js');
 const require_external_tools_trufflehog_asset_names = require('./asset-names.js');
-let node_path = require("node:path");
-node_path = require_runtime.__toESM(node_path);
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
 
 //#region src/external-tools/trufflehog/from-download.ts
 /**
@@ -20,8 +20,11 @@ node_process = require_runtime.__toESM(node_process);
 *   check, no network. Trust-on-first-use: pass `integrity` from
 *   `external-tools.json` when available.
 */
-async function trufflehogFromDownload(opts) {
-	const { cacheDir, downloader, integrity, platformArch, version } = opts;
+async function trufflehogFromDownload(options) {
+	const { cacheDir, downloader, integrity, platformArch, version } = {
+		__proto__: null,
+		...options
+	};
 	const url = require_external_tools_trufflehog_asset_names.getTrufflehogDownloadUrl({
 		version,
 		platformArch

package/dist/external-tools/trufflehog/resolve.d.ts

@@ -24,7 +24,7 @@ export interface ResolveTrufflehogOptions {
         downloader?: BinaryDownloader | undefined;
     } | undefined;
 }
-export declare function cacheKey(opts: ResolveTrufflehogOptions | undefined): string;
-export declare function doResolveTrufflehog(opts?: ResolveTrufflehogOptions | undefined): Promise<ResolvedTrufflehog | undefined>;
+export declare function cacheKey(options: ResolveTrufflehogOptions | undefined): string;
+export declare function doResolveTrufflehog(options?: ResolveTrufflehogOptions | undefined): Promise<ResolvedTrufflehog | undefined>;
 export declare function resetTrufflehogResolution(): void;
-export declare function resolveTrufflehog(opts?: ResolveTrufflehogOptions | undefined): Promise<ResolvedTrufflehog | undefined>;
+export declare function resolveTrufflehog(options?: ResolveTrufflehogOptions | undefined): Promise<ResolvedTrufflehog | undefined>;

package/dist/external-tools/trufflehog/resolve.js

@@ -18,30 +18,38 @@ const require_external_tools_trufflehog_from_vfs = require('./from-vfs.js');
 *      per option-shape; same caching semantics as `resolveJre()`.
 */
 const resolutionCache = new require_primordials_map_set.MapCtor();
-function cacheKey(opts) {
-	if (!opts?.downloadIfMissing) return "local-only";
-	const { cacheDir, integrity, platformArch, version } = opts.downloadIfMissing;
+function cacheKey(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
+	if (!options?.downloadIfMissing) return "local-only";
+	const { cacheDir, integrity, platformArch, version } = options.downloadIfMissing;
 	return `dl:${version}:${platformArch}:${typeof integrity === "string" ? integrity : integrity ? `${integrity.type}:${integrity.value}` : ""}:${cacheDir ?? ""}`;
 }
-async function doResolveTrufflehog(opts) {
+async function doResolveTrufflehog(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const fromVfs = await require_external_tools_trufflehog_from_vfs.trufflehogFromVfs();
 	/* c8 ignore start - smol Node binary only. */
 	if (fromVfs) return fromVfs;
 	/* c8 ignore stop */
 	const fromPath = await require_external_tools_trufflehog_from_path.trufflehogFromPath();
 	if (fromPath) return fromPath;
-	if (opts?.downloadIfMissing) return require_external_tools_trufflehog_from_download.trufflehogFromDownload(opts.downloadIfMissing);
+	if (options?.downloadIfMissing) return require_external_tools_trufflehog_from_download.trufflehogFromDownload(options.downloadIfMissing);
 }
 /* c8 ignore start - test-only escape hatch. */
 function resetTrufflehogResolution() {
 	resolutionCache.clear();
 }
 /* c8 ignore stop */
-function resolveTrufflehog(opts) {
-	const key = cacheKey(opts);
+function resolveTrufflehog(options) {
+	const key = cacheKey(options);
 	let cached = resolutionCache.get(key);
 	if (!cached) {
-		cached = doResolveTrufflehog(opts);
+		cached = doResolveTrufflehog(options);
 		resolutionCache.set(key, cached);
 	}
 	return cached;

package/dist/fs/allowed-dirs-cache.d.ts

@@ -4,7 +4,17 @@
  *   `invalidatePathCache` with `paths/rewire.ts` so test-time path overrides
  *   flush the cache; the registration is the module's only side effect, so
  *   callers that just need to flush the cache imperatively can call
- *   `invalidatePathCache()` directly without that side effect repeating.
+ *   `invalidatePathCache()` directly without that side effect repeating. The
+ *   registration is deferred to a microtask (`registerInvalidationCallback`)
+ *   rather than run at top-level module load. This module sits in a require
+ *   cycle (`allowed-dirs-cache → _internal → paths/socket → …`); in the bundled
+ *   CJS the `registerCacheInvalidation` import binding from `paths/rewire` is
+ *   not yet initialized when this module first evaluates, so a synchronous
+ *   top-level call threw `registerCacheInvalidation is not defined` at require
+ *   time. Deferring to a microtask runs the call after the module graph has
+ *   settled, breaking the init-order hazard while keeping the load-time
+ *   registration contract (the callback is in place before any test hook
+ *   fires).
  */
 /**
  * Invalidate the cached allowed directories. Called automatically by the
@@ -19,3 +29,19 @@
  * @internal Used for test rewiring
  */
 export declare function invalidatePathCache(): void;
+/**
+ * Register `invalidatePathCache` with the rewire module after the current
+ * module-init turn, so the circular import is fully wired before the call.
+ * Guarded + self-rescheduling: in the require cycle (`allowed-dirs-cache →
+ * _internal → paths/socket → … → rewire`) the `registerCacheInvalidation` live
+ * binding can still be in its temporal dead zone when the first microtask fires
+ * under some import orders (vitest loads many modules concurrently), throwing
+ * `registerCacheInvalidation is not defined`. So check the binding is callable;
+ * if not, re-defer to the next microtask. The registration is a test-seam
+ * best-effort (it lets path-rewire flush this cache), so a bounded retry that
+ * lands on a later turn is correct — and a never-resolving binding (production,
+ * where rewire is unused) simply stops retrying without throwing.
+ *
+ * @internal
+ */
+export declare function registerInvalidationCallback(attempt?: number): void;

package/dist/fs/allowed-dirs-cache.js

@@ -11,7 +11,17 @@ const require_fs__internal = require('./_internal.js');
 *   `invalidatePathCache` with `paths/rewire.ts` so test-time path overrides
 *   flush the cache; the registration is the module's only side effect, so
 *   callers that just need to flush the cache imperatively can call
-*   `invalidatePathCache()` directly without that side effect repeating.
+*   `invalidatePathCache()` directly without that side effect repeating. The
+*   registration is deferred to a microtask (`registerInvalidationCallback`)
+*   rather than run at top-level module load. This module sits in a require
+*   cycle (`allowed-dirs-cache → _internal → paths/socket → …`); in the bundled
+*   CJS the `registerCacheInvalidation` import binding from `paths/rewire` is
+*   not yet initialized when this module first evaluates, so a synchronous
+*   top-level call threw `registerCacheInvalidation is not defined` at require
+*   time. Deferring to a microtask runs the call after the module graph has
+*   settled, breaking the init-order hazard while keeping the load-time
+*   registration contract (the callback is in place before any test hook
+*   fires).
 */
 /**
 * Invalidate the cached allowed directories. Called automatically by the
@@ -28,7 +38,32 @@ const require_fs__internal = require('./_internal.js');
 function invalidatePathCache() {
 	require_fs__internal.clearAllowedDirectories();
 }
-require_paths_rewire.registerCacheInvalidation(invalidatePathCache);
+/**
+* Register `invalidatePathCache` with the rewire module after the current
+* module-init turn, so the circular import is fully wired before the call.
+* Guarded + self-rescheduling: in the require cycle (`allowed-dirs-cache →
+* _internal → paths/socket → … → rewire`) the `registerCacheInvalidation` live
+* binding can still be in its temporal dead zone when the first microtask fires
+* under some import orders (vitest loads many modules concurrently), throwing
+* `registerCacheInvalidation is not defined`. So check the binding is callable;
+* if not, re-defer to the next microtask. The registration is a test-seam
+* best-effort (it lets path-rewire flush this cache), so a bounded retry that
+* lands on a later turn is correct — and a never-resolving binding (production,
+* where rewire is unused) simply stops retrying without throwing.
+*
+* @internal
+*/
+function registerInvalidationCallback(attempt = 0) {
+	try {
+		if (typeof require_paths_rewire.registerCacheInvalidation === "function") {
+			require_paths_rewire.registerCacheInvalidation(invalidatePathCache);
+			return;
+		}
+	} catch {}
+	if (attempt < 10) queueMicrotask(() => registerInvalidationCallback(attempt + 1));
+}
+queueMicrotask(() => registerInvalidationCallback());
 
 //#endregion
-exports.invalidatePathCache = invalidatePathCache;
+exports.invalidatePathCache = invalidatePathCache;
+exports.registerInvalidationCallback = registerInvalidationCallback;

package/dist/fs/find.js

@@ -2,11 +2,11 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_arrays_predicates = require('../arrays/predicates.js');
 const require_paths_normalize = require('../paths/normalize.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
 const require_process_abort = require('../process/abort.js');
-const require_arrays_predicates = require('../arrays/predicates.js');
 const require_smol_path = require('../smol/path.js');
 const require_paths_walk = require('../paths/walk.js');
 let node_process = require("node:process");

package/dist/fs/read-json-cache.d.ts

@@ -30,6 +30,13 @@
  *     CWDs would get separate cache entries — correct but pessimistic.
  */
 import type { JsonValue } from '../json/types';
+export interface CacheEntry {
+    ino: number;
+    size: number;
+    mtimeMs: number;
+    parsed: JsonValue;
+    insertedAt: number;
+}
 /**
  * Drop all cached entries. Tests call this between cases that depend on a fresh
  * read; long-running daemons can call it on file-watcher invalidation events

package/dist/fs/resolve-module.js

@@ -3,9 +3,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_node_path = require('../node/path.js');
-let node_module = require("node:module");
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
+let node_module = require("node:module");
 
 //#region src/fs/resolve-module.ts
 /**
@@ -32,7 +32,11 @@ function requireResolveFrom(fromDir, specifier, options) {
 	}
 }
 function requireResolveFromCwd(specifier, options) {
-	return options && options.nothrow ? requireResolveFrom(node_process.default.cwd(), specifier, { nothrow: true }) : requireResolveFrom(node_process.default.cwd(), specifier);
+	options = {
+		__proto__: null,
+		...options
+	};
+	return options?.nothrow ? requireResolveFrom(node_process.default.cwd(), specifier, { nothrow: true }) : requireResolveFrom(node_process.default.cwd(), specifier);
 }
 
 //#endregion

package/dist/fs/safe.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_arrays_predicates = require('../arrays/predicates.js');
 const require_primordials_string = require('../primordials/string.js');
 const require_paths__internal = require('../paths/_internal.js');
 const require_primordials_array = require('../primordials/array.js');
@@ -8,7 +9,6 @@ const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
 const require_errors_predicates = require('../errors/predicates.js');
 const require_primordials_globals = require('../primordials/globals.js');
-const require_arrays_predicates = require('../arrays/predicates.js');
 const require_objects_mutate = require('../objects/mutate.js');
 const require_promises_retry = require('../promises/retry.js');
 const require_fs__internal = require('./_internal.js');