@socketsecurity/lib 6.0.8 → 6.0.10

package/dist/external-tools/uv/from-download.js

@@ -0,0 +1,50 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_paths_socket = require('../../paths/socket.js');
+const require_external_tools_from_download = require('../from-download.js');
+const require_external_tools_uv_asset_names = require('./asset-names.js');
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+
+//#region src/external-tools/uv/from-download.ts
+/**
+* @file `uvFromDownload()` — fetches upstream uv and returns a `ResolvedUv`
+*   pointing at the extracted binary. uv tarballs wrap the binary in a
+*   `<asset-stem>/` directory; the extractor strips that level so the binary
+*   sits at the cache-dir root.
+*/
+async function uvFromDownload(options) {
+	const { cacheDir, downloader, integrity, platformArch, version } = {
+		__proto__: null,
+		...options
+	};
+	const url = require_external_tools_uv_asset_names.getUvDownloadUrl({
+		version,
+		platformArch
+	});
+	const entry = require_external_tools_uv_asset_names.getUvAssetEntry(platformArch);
+	if (!url || !entry) return;
+	const archiveExt = entry.asset.endsWith(".zip") ? ".zip" : ".tar.gz";
+	const extractedDir = cacheDir ?? node_path.default.join(require_paths_socket.getSocketDlxDir(), "uv", version, platformArch);
+	const archive = await require_external_tools_from_download.downloadAndExtractTool({
+		url,
+		name: `uv-${version}-${platformArch}${archiveExt}`,
+		integrity,
+		extractedDir,
+		extractOptions: { strip: 1 },
+		downloader
+	});
+	const binary = node_process.default.platform === "win32" ? "uv.exe" : "uv";
+	return {
+		path: node_path.default.join(extractedDir, binary),
+		source: "download",
+		integrity: archive.integrity
+	};
+}
+
+//#endregion
+exports.uvFromDownload = uvFromDownload;

package/dist/external-tools/uv/from-path.d.ts

@@ -0,0 +1,5 @@
+/**
+ * @file `uvFromPath()` — looks for `uv` on the system PATH.
+ */
+import type { ResolvedUv } from './types';
+export declare function uvFromPath(): Promise<ResolvedUv | undefined>;

package/dist/external-tools/uv/from-path.js

@@ -0,0 +1,22 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_bin_which = require('../../bin/which.js');
+
+//#region src/external-tools/uv/from-path.ts
+/**
+* @file `uvFromPath()` — looks for `uv` on the system PATH.
+*/
+async function uvFromPath() {
+	const onPath = await require_bin_which.which("uv", { nothrow: true });
+	/* c8 ignore start - reached only when uv is NOT on PATH. */
+	if (typeof onPath !== "string") return;
+	/* c8 ignore stop */
+	return {
+		path: onPath,
+		source: "path"
+	};
+}
+
+//#endregion
+exports.uvFromPath = uvFromPath;

package/dist/external-tools/uv/from-vfs.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @file `uvFromVfs()` — extracts the uv binary from the smol binary's VFS.
+ *   Returns `undefined` when the binary doesn't have uv bundled.
+ */
+import type { ResolvedUv } from './types';
+export declare const UV_VFS_KEY = "uv";
+export declare function uvFromVfs(): Promise<ResolvedUv | undefined>;

package/dist/external-tools/uv/from-vfs.js

@@ -0,0 +1,26 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_smol_vfs = require('../../smol/vfs.js');
+
+//#region src/external-tools/uv/from-vfs.ts
+/**
+* @file `uvFromVfs()` — extracts the uv binary from the smol binary's VFS.
+*   Returns `undefined` when the binary doesn't have uv bundled.
+*/
+const UV_VFS_KEY = "uv";
+async function uvFromVfs() {
+	const vfs = require_smol_vfs.getSmolVfs();
+	if (!vfs) return;
+	/* c8 ignore start - smol Node binary only. */
+	if (!vfs.has("uv")) return;
+	return {
+		path: await vfs.extract("uv"),
+		source: "vfs"
+	};
+	/* c8 ignore stop */
+}
+
+//#endregion
+exports.UV_VFS_KEY = UV_VFS_KEY;
+exports.uvFromVfs = uvFromVfs;

package/dist/external-tools/uv/resolve.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @file `resolveUv()` — uv resolution entry point. Tries each source in order:
+ *
+ *   1. VFS — smol binary's embedded uv (if packed)
+ *   2. PATH — `uv` on the system PATH
+ *   3. download — upstream GitHub release archive (only when `downloadIfMissing`
+ *      is passed) Returns `undefined` if all of the enabled sources miss.
+ *      Memoized per option-shape.
+ */
+import type { BinaryDownloader } from '../from-download';
+import type { HashSpec } from '../../integrity';
+import type { ResolvedUv } from './types';
+export interface ResolveUvOptions {
+    downloadIfMissing?: {
+        version: string;
+        platformArch: string;
+        integrity?: HashSpec | undefined;
+        cacheDir?: string | undefined;
+        downloader?: BinaryDownloader | undefined;
+    } | undefined;
+}
+export declare function cacheKey(options: ResolveUvOptions | undefined): string;
+export declare function doResolveUv(options?: ResolveUvOptions | undefined): Promise<ResolvedUv | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
+export declare function resetUvResolution(): void;
+export declare function resolveUv(options?: ResolveUvOptions | undefined): Promise<ResolvedUv | undefined>;

package/dist/external-tools/uv/resolve.js

@@ -0,0 +1,64 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../../primordials/map-set.js');
+const require_external_tools_uv_from_download = require('./from-download.js');
+const require_external_tools_uv_from_path = require('./from-path.js');
+const require_external_tools_uv_from_vfs = require('./from-vfs.js');
+
+//#region src/external-tools/uv/resolve.ts
+/**
+* @file `resolveUv()` — uv resolution entry point. Tries each source in order:
+*
+*   1. VFS — smol binary's embedded uv (if packed)
+*   2. PATH — `uv` on the system PATH
+*   3. download — upstream GitHub release archive (only when `downloadIfMissing`
+*      is passed) Returns `undefined` if all of the enabled sources miss.
+*      Memoized per option-shape.
+*/
+const resolutionCache = new require_primordials_map_set.MapCtor();
+function cacheKey(options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	if (!opts?.downloadIfMissing) return "local-only";
+	const { cacheDir, integrity, platformArch, version } = opts.downloadIfMissing;
+	return `dl:${version}:${platformArch}:${typeof integrity === "string" ? integrity : integrity ? `${integrity.type}:${integrity.value}` : ""}:${cacheDir ?? ""}`;
+}
+async function doResolveUv(options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const fromVfs = await require_external_tools_uv_from_vfs.uvFromVfs();
+	/* c8 ignore start - smol Node binary only. */
+	if (fromVfs) return fromVfs;
+	/* c8 ignore stop */
+	const fromPath = await require_external_tools_uv_from_path.uvFromPath();
+	if (fromPath) return fromPath;
+	if (opts?.downloadIfMissing) return require_external_tools_uv_from_download.uvFromDownload(opts.downloadIfMissing);
+}
+/* c8 ignore start - test-only escape hatch. */
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
+function resetUvResolution() {
+	resolutionCache.clear();
+}
+/* c8 ignore stop */
+function resolveUv(options) {
+	const key = cacheKey(options);
+	let cached = resolutionCache.get(key);
+	if (!cached) {
+		cached = doResolveUv(options);
+		resolutionCache.set(key, cached);
+	}
+	return cached;
+}
+
+//#endregion
+exports.cacheKey = cacheKey;
+exports.doResolveUv = doResolveUv;
+exports.resetUvResolution = resetUvResolution;
+exports.resolveUv = resolveUv;

package/dist/external-tools/uv/types.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @file Shared types for uv resolution. uv is Astral's Python package manager
+ *   used by socket-basics for Python project bootstrap. Ships per-platform
+ *   archives that wrap the `uv` binary one level deep.
+ */
+import type { ResolvedToolIntegrity } from '../from-download';
+export type UvSource = 'download' | 'path' | 'vfs';
+/**
+ * A resolved uv installation.
+ */
+export interface ResolvedUv {
+    /**
+     * Absolute path to the `uv` executable.
+     */
+    readonly path: string;
+    /**
+     * Which resolver tier found this.
+     */
+    readonly source: UvSource;
+    /**
+     * See {@link ResolvedToolIntegrity}.
+     */
+    readonly integrity?: ResolvedToolIntegrity | undefined;
+}

package/dist/external-tools/uv/types.js

@@ -0,0 +1,2 @@
+"use strict";
+/* Socket Lib - Built with rolldown */

package/dist/fleet/repo-config.d.ts

@@ -0,0 +1,55 @@
+/**
+ * @file Fleet-convention config reader: a per-repo override (`.config/repo`)
+ *   layered over the cascaded fleet default (`.config/fleet`). A thin wrapper
+ *   over the generic `config/layers` reader that returns the named `{ fleet,
+ *   repo }` shape Socket callers use, plus the `{ fleet, repo }` array-merge
+ *   convenience. The generic, convention-agnostic primitives
+ *   (`readConfigLayers`, `mergeConfigArray`) live in `config/layers`. Lives in
+ *   the published lib because it is the only import root the
+ *   `.git-hooks/_shared` and `.claude/hooks/_shared` trees (which do not
+ *   cross-import) plus `.config/*` can all reach.
+ */
+export declare const FLEET_LAYER_DIRS: readonly string[];
+export interface RepoConfigTiers<T> {
+    fleet: T | undefined;
+    repo: T | undefined;
+}
+export interface ResolveRepoConfigOptions {
+    repoRoot?: string | undefined;
+    cwd?: string | undefined;
+}
+/**
+ * Concatenate one array-valued key across the fleet + repo tiers. Fleet entries
+ * first, then repo entries. Convenience over `mergeConfigArray` for the `{
+ * fleet, repo }` shape.
+ *
+ * @param tiers - The `{ fleet, repo }` from `resolveRepoConfig`.
+ * @param key - The array-valued property to concatenate.
+ *
+ * @returns Fleet entries followed by repo entries; `[]` when neither is an
+ *   array.
+ *
+ * @unused No internal or Socket consumers.
+ */
+export declare function mergeRepoConfigArray<T extends Record<string, unknown>, K extends keyof T>(tiers: RepoConfigTiers<T>, key: K): Array<T[K] extends Array<infer E> ? E : never>;
+/**
+ * Fleet-convention reader: a repo override (`.config/repo`) layered over the
+ * cascaded fleet default (`.config/fleet`). A thin wrapper over
+ * `readConfigLayers` that returns the named `{ fleet, repo }` shape callers
+ * already use; either tier is `undefined` when absent or unparseable.
+ *
+ * @example
+ *   ;```typescript
+ *   const { fleet, repo } = resolveRepoConfig<VitestTiers>('vitest')
+ *   const nonIsolated = [
+ *     ...(fleet?.nonIsolated ?? []),
+ *     ...(repo?.nonIsolated ?? []),
+ *   ]
+ *   ```
+ *
+ * @param name - Base name of the config file (no directory, no `.json`).
+ * @param options - `repoRoot` / `cwd` for path resolution.
+ *
+ * @returns `{ fleet, repo }` parsed tiers; either may be `undefined`.
+ */
+export declare function resolveRepoConfig<T = unknown>(name: string, options?: ResolveRepoConfigOptions | undefined): RepoConfigTiers<T>;

package/dist/fleet/repo-config.js

@@ -0,0 +1,81 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_config_layers = require('../config/layers.js');
+
+//#region src/fleet/repo-config.ts
+/**
+* @file Fleet-convention config reader: a per-repo override (`.config/repo`)
+*   layered over the cascaded fleet default (`.config/fleet`). A thin wrapper
+*   over the generic `config/layers` reader that returns the named `{ fleet,
+*   repo }` shape Socket callers use, plus the `{ fleet, repo }` array-merge
+*   convenience. The generic, convention-agnostic primitives
+*   (`readConfigLayers`, `mergeConfigArray`) live in `config/layers`. Lives in
+*   the published lib because it is the only import root the
+*   `.git-hooks/_shared` and `.claude/hooks/_shared` trees (which do not
+*   cross-import) plus `.config/*` can all reach.
+*/
+const FLEET_LAYER_DIRS = [".config/fleet", ".config/repo"];
+/**
+* Concatenate one array-valued key across the fleet + repo tiers. Fleet entries
+* first, then repo entries. Convenience over `mergeConfigArray` for the `{
+* fleet, repo }` shape.
+*
+* @param tiers - The `{ fleet, repo }` from `resolveRepoConfig`.
+* @param key - The array-valued property to concatenate.
+*
+* @returns Fleet entries followed by repo entries; `[]` when neither is an
+*   array.
+*
+* @unused No internal or Socket consumers.
+*/
+function mergeRepoConfigArray(tiers, key) {
+	return require_config_layers.mergeConfigArray([tiers.fleet, tiers.repo], key);
+}
+/**
+* Fleet-convention reader: a repo override (`.config/repo`) layered over the
+* cascaded fleet default (`.config/fleet`). A thin wrapper over
+* `readConfigLayers` that returns the named `{ fleet, repo }` shape callers
+* already use; either tier is `undefined` when absent or unparseable.
+*
+* @example
+*   ;```typescript
+*   const { fleet, repo } = resolveRepoConfig<VitestTiers>('vitest')
+*   const nonIsolated = [
+*     ...(fleet?.nonIsolated ?? []),
+*     ...(repo?.nonIsolated ?? []),
+*   ]
+*   ```
+*
+* @param name - Base name of the config file (no directory, no `.json`).
+* @param options - `repoRoot` / `cwd` for path resolution.
+*
+* @returns `{ fleet, repo }` parsed tiers; either may be `undefined`.
+*/
+function resolveRepoConfig(name, options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const base = {
+		cwd: opts.cwd,
+		rootDir: opts.repoRoot
+	};
+	const [fleet] = require_config_layers.readConfigLayers(name, {
+		...base,
+		dirs: [FLEET_LAYER_DIRS[0]]
+	});
+	const [repo] = require_config_layers.readConfigLayers(name, {
+		...base,
+		dirs: [FLEET_LAYER_DIRS[1]]
+	});
+	return {
+		fleet,
+		repo
+	};
+}
+
+//#endregion
+exports.FLEET_LAYER_DIRS = FLEET_LAYER_DIRS;
+exports.mergeRepoConfigArray = mergeRepoConfigArray;
+exports.resolveRepoConfig = resolveRepoConfig;

package/dist/fs/_internal.d.ts

@@ -2,7 +2,7 @@
  * @file Private state shared between `fs/safe` and `fs/path-cache`. The `_`
  *   prefix keeps this module out of the generated package.json `exports` map
  *   (the `dist/**\/_*` ignore pattern in
- *   `scripts/post-build/make-package-exports.mts` filters it out), so it is not
+ *   `scripts/fleet/make-package-exports.mts` filters it out), so it is not
  *   part of the public surface — it exists only to give the two leaves above a
  *   common owner for the allowed-directory cache. The cache is invalidated by
  *   `invalidatePathCache()` in `fs/path-cache.ts` whenever paths are rewired in

package/dist/fs/_internal.js

@@ -9,7 +9,7 @@ const require_paths_socket = require('../paths/socket.js');
 * @file Private state shared between `fs/safe` and `fs/path-cache`. The `_`
 *   prefix keeps this module out of the generated package.json `exports` map
 *   (the `dist/**\/_*` ignore pattern in
-*   `scripts/post-build/make-package-exports.mts` filters it out), so it is not
+*   `scripts/fleet/make-package-exports.mts` filters it out), so it is not
 *   part of the public surface — it exists only to give the two leaves above a
 *   common owner for the allowed-directory cache. The cache is invalidated by
 *   `invalidatePathCache()` in `fs/path-cache.ts` whenever paths are rewired in

package/dist/fs/access.d.ts

@@ -20,6 +20,8 @@ import type { PathLike } from 'node:fs';
 export declare function canAccess(path: PathLike, mode?: number | undefined): boolean;
 /**
  * Can the process execute `path`? (`X_OK`)
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function canExecute(path: PathLike): boolean;
 /**

package/dist/fs/access.js

@@ -38,6 +38,8 @@ function canAccess(path, mode) {
 }
 /**
 * Can the process execute `path`? (`X_OK`)
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function canExecute(path) {
 	return canAccess(path, require_node_fs.getNodeFs().constants.X_OK);

package/dist/fs/copy.d.ts

@@ -0,0 +1,88 @@
+/**
+ * @file Recursive copy for a file or directory tree, with three destination
+ *   modes (see {@link CopyMode}). Plain `fs.cp` (even with `force`) overwrites
+ *   files present in the source but never deletes destination files absent from
+ *   it, so copying onto an existing target leaves stale leftovers behind. The
+ *   `'pave'` mode makes the destination an exact copy of the source by staging
+ *   a fresh tree in a sibling temp directory and swapping it in with a single
+ *   rename — atomic, with no stale survivors.
+ */
+import type { PathLike } from 'node:fs';
+/**
+ * Named values for {@link CopyMode}. A frozen object rather than a TypeScript
+ * `enum` so the declaration is erasable (enums emit runtime helper code).
+ */
+export declare const CopyMode: Readonly<{
+    readonly Fill: 'fill';
+    readonly Overlay: 'overlay';
+    readonly Pave: 'pave';
+}>;
+/**
+ * How {@link copy} treats an existing destination.
+ *
+ * - `'overlay'` (default) — overwrite files present in the source but leave any
+ *   pre-existing destination-only files in place (a recursive `fs.cp`).
+ * - `'pave'` — replace the destination so it becomes an exact copy of the source;
+ *   destination entries absent from the source do not survive. The swap is
+ *   atomic (a sibling temp directory is renamed into place), so a partial tree
+ *   is never observable.
+ * - `'fill'` — copy only what the destination lacks: existing files stay
+ *   untouched (no-clobber), missing ones are added. Never throws on an existing
+ *   file.
+ *
+ * Maps to `cp` (overlay), `rsync --delete` / robocopy `/MIR` (pave), and
+ * `cp -n` (fill).
+ */
+export type CopyMode = (typeof CopyMode)[keyof typeof CopyMode];
+/**
+ * Options for {@link copy}.
+ */
+export interface CopyOptions {
+    /**
+     * Dereference symlinks — copy what each points to rather than the link
+     * itself.
+     *
+     * @default false
+     */
+    dereference?: boolean | undefined;
+    /**
+     * Predicate deciding which entries to copy. Return `false` to skip an entry
+     * (and, for a directory, everything beneath it). Receives resolved source
+     * and destination paths, matching `node:fs` `cp`'s `filter`.
+     */
+    filter?: ((source: string, destination: string) => boolean) | undefined;
+    /**
+     * How to treat an existing destination. See {@link CopyMode}.
+     *
+     * @default 'overlay'
+     */
+    mode?: CopyMode | undefined;
+    /**
+     * Abort signal to cancel the operation.
+     */
+    signal?: AbortSignal | undefined;
+}
+/**
+ * Recursively copy a file or directory tree from `from` to `to`.
+ *
+ * Works for both files and directories. The `mode` option chooses how an
+ * existing destination is treated — overlay (default), pave, or fill; see
+ * {@link CopyMode}.
+ *
+ * @example
+ *   ;```ts
+ *   // Overlay (default) — overwrite collisions, keep files already in dest:
+ *   await copy('./src', './dest')
+ *
+ *   // Pave — dest ends up identical to src, no stale survivors:
+ *   await copy('./vendor/upstream', './deps/upstream', { mode: CopyMode.Pave })
+ *
+ *   // Fill — add only what's missing, never overwrite an existing file:
+ *   await copy('./defaults', './config', { mode: CopyMode.Fill })
+ *   ```
+ *
+ * @param from - Source file or directory to copy.
+ * @param to - Destination path.
+ * @param options - Copy options (mode, filter, dereference, abort signal).
+ */
+export declare function copy(from: PathLike, to: PathLike, options?: CopyOptions | undefined): Promise<void>;

package/dist/fs/copy.js

@@ -0,0 +1,89 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_object = require('../primordials/object.js');
+const require_paths__internal = require('../paths/_internal.js');
+const require_node_fs = require('../node/fs.js');
+const require_node_path = require('../node/path.js');
+const require_fs_safe = require('./safe.js');
+const require_fs_unique = require('./unique.js');
+
+//#region src/fs/copy.ts
+/**
+* @file Recursive copy for a file or directory tree, with three destination
+*   modes (see {@link CopyMode}). Plain `fs.cp` (even with `force`) overwrites
+*   files present in the source but never deletes destination files absent from
+*   it, so copying onto an existing target leaves stale leftovers behind. The
+*   `'pave'` mode makes the destination an exact copy of the source by staging
+*   a fresh tree in a sibling temp directory and swapping it in with a single
+*   rename — atomic, with no stale survivors.
+*/
+/**
+* Named values for {@link CopyMode}. A frozen object rather than a TypeScript
+* `enum` so the declaration is erasable (enums emit runtime helper code).
+*/
+const CopyMode = require_primordials_object.ObjectFreeze({
+	Fill: "fill",
+	Overlay: "overlay",
+	Pave: "pave"
+});
+/**
+* Recursively copy a file or directory tree from `from` to `to`.
+*
+* Works for both files and directories. The `mode` option chooses how an
+* existing destination is treated — overlay (default), pave, or fill; see
+* {@link CopyMode}.
+*
+* @example
+*   ;```ts
+*   // Overlay (default) — overwrite collisions, keep files already in dest:
+*   await copy('./src', './dest')
+*
+*   // Pave — dest ends up identical to src, no stale survivors:
+*   await copy('./vendor/upstream', './deps/upstream', { mode: CopyMode.Pave })
+*
+*   // Fill — add only what's missing, never overwrite an existing file:
+*   await copy('./defaults', './config', { mode: CopyMode.Fill })
+*   ```
+*
+* @param from - Source file or directory to copy.
+* @param to - Destination path.
+* @param options - Copy options (mode, filter, dereference, abort signal).
+*/
+async function copy(from, to, options) {
+	const fs = require_node_fs.getNodeFs();
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const { mode } = opts;
+	const fromStr = require_paths__internal.pathLikeToString(from);
+	const toStr = require_paths__internal.pathLikeToString(to);
+	const cpOptions = {
+		__proto__: null,
+		dereference: opts.dereference === true,
+		force: mode !== CopyMode.Fill,
+		recursive: true,
+		...opts.filter ? { filter: opts.filter } : {}
+	};
+	if (mode !== CopyMode.Pave) {
+		await fs.promises.cp(fromStr, toStr, cpOptions);
+		return;
+	}
+	const path = require_node_path.getNodePath();
+	const tmp = require_fs_unique.uniqueSync(`${toStr}.tmp`);
+	try {
+		await fs.promises.cp(fromStr, tmp, cpOptions);
+		await require_fs_safe.safeMkdir(path.dirname(toStr));
+		await require_fs_safe.safeDelete(toStr, { signal: opts.signal });
+		await fs.promises.rename(tmp, toStr);
+	} catch (e) {
+		/* c8 ignore start - best-effort cleanup of the staged copy on failure */
+		await require_fs_safe.safeDelete(tmp, { signal: opts.signal });
+		throw e;
+	}
+}
+
+//#endregion
+exports.CopyMode = CopyMode;
+exports.copy = copy;

package/dist/fs/find.js

@@ -20,7 +20,6 @@ node_process = require_runtime.__toESM(node_process);
 *   visiting root itself, so a match at e.g. `/.foo` was never found. The
 *   current shape visits root, then breaks.
 */
-const abortSignal = require_process_abort.getAbortSignal();
 /**
 * Find a file or directory by traversing up parent directories. Searches from
 * the starting directory upward to the filesystem root. Useful for finding
@@ -44,7 +43,7 @@ const abortSignal = require_process_abort.getAbortSignal();
 * @returns Normalized absolute path if found, undefined otherwise
 */
 async function findUp(name, options) {
-	const { cwd = node_process.default.cwd(), signal = abortSignal } = {
+	const { cwd = node_process.default.cwd(), signal = require_process_abort.getAbortSignal() } = {
 		__proto__: null,
 		...options
 	};

package/dist/fs/inspect.d.ts

@@ -94,7 +94,7 @@ export declare function isSymlinkSync(filepath: PathLike): boolean;
  *
  * @returns Promise resolving to Stats object, or undefined on error
  */
-export declare function safeStat(filepath: PathLike): Promise<import("fs").Stats | undefined>;
+export declare function safeStat(filepath: PathLike): Promise<import("node:fs").Stats | undefined>;
 /**
  * Safely get file stats synchronously, returning undefined on error. Useful for
  * checking file existence and properties without error handling. Returns
@@ -114,4 +114,4 @@ export declare function safeStat(filepath: PathLike): Promise<import("fs").Stats
  *
  * @returns Stats object, or undefined on error
  */
-export declare function safeStatSync(filepath: PathLike): import("fs").BigIntStats | import("fs").Stats | undefined;
+export declare function safeStatSync(filepath: PathLike): import("node:fs").BigIntStats | import("node:fs").Stats | undefined;

package/dist/fs/read-file.js

@@ -15,7 +15,6 @@ const require_fs_encoding = require('./encoding.js');
 *   the default and any string encoding return a string. The runtime fast-path
 *   normalizes encoding once and forwards untouched options to `node:fs`.
 */
-const abortSignal = require_process_abort.getAbortSignal();
 /**
 * Read a file as binary data asynchronously. Returns a Buffer without encoding
 * the contents. Useful for reading images, archives, or other binary formats.
@@ -37,7 +36,7 @@ const abortSignal = require_process_abort.getAbortSignal();
 async function readFileBinary(filepath, options) {
 	const opts = typeof options === "string" ? { encoding: options } : options;
 	return await require_node_fs.getNodeFs().promises.readFile(filepath, {
-		signal: abortSignal,
+		signal: require_process_abort.getAbortSignal(),
 		...opts,
 		encoding: void 0
 	});
@@ -88,7 +87,7 @@ function readFileBinarySync(filepath, options) {
 async function readFileUtf8(filepath, options) {
 	const opts = typeof options === "string" ? { encoding: options } : options;
 	return await require_node_fs.getNodeFs().promises.readFile(filepath, {
-		signal: abortSignal,
+		signal: require_process_abort.getAbortSignal(),
 		...opts,
 		encoding: "utf8"
 	});
@@ -138,7 +137,7 @@ async function safeReadFile(filepath, options) {
 	try {
 		return await fs.promises.readFile(filepath, {
 			__proto__: null,
-			signal: abortSignal,
+			signal: require_process_abort.getAbortSignal(),
 			...readOpts,
 			encoding
 		});