@socketsecurity/lib 6.0.8 → 6.0.10

package/dist/bin/resolve.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_constants_platform = require('../constants/platform.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_constants_platform = require('../constants/platform.js');
 const require_paths_normalize = require('../paths/normalize.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');

package/dist/bin/shadow.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+let _socketsecurity_lib_paths_normalize = require("@socketsecurity/lib/paths/normalize");
 
 //#region src/bin/shadow.ts
 /**
@@ -20,7 +21,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 */
 function isShadowBinPath(dirPath) {
 	if (!dirPath) return false;
-	return dirPath.replace(/\\/g, "/").includes("node_modules/.bin");
+	return (0, _socketsecurity_lib_paths_normalize.normalizePath)(dirPath).includes("node_modules/.bin");
 }
 
 //#endregion

package/dist/bin/which.d.ts

@@ -8,9 +8,11 @@
  *   through `resolveRealBinSync` so the caller gets the underlying script path
  *   (e.g., `npm-cli.js`) rather than the wrapper. Default `nothrow: true` so a
  *   missing binary returns `undefined` instead of bubbling a `which` package
- *   error. Caching matches `_internal.binPathCache` and `binPathAllCache`. Both
- *   caches validate hits with `existsSync` so a tool reinstall mid-session
- *   doesn't return a stale path.
+ *   error. `whichLocalBin` resolves a tool from the project-local
+ *   `node_modules/.bin` (the inverse of `findRealBin`, which skips it). Caching
+ *   matches `_internal.binPathCache` and `binPathAllCache`. Both caches
+ *   validate hits with `existsSync` so a tool reinstall mid-session doesn't
+ *   return a stale path.
  */
 import type { WhichOptions } from './types';
 /**
@@ -47,6 +49,29 @@ import type { WhichOptions } from './types';
  *   path, the original path, or null if not found.
  */
 export declare function which(binName: string, options?: WhichOptions): Promise<string | string[] | null>;
+/**
+ * Resolve a tool installed in the project-local `node_modules/.bin` to its
+ * ABSOLUTE path. This is the inverse of findRealBin: that helper SKIPS
+ * node_modules/.bin (shadow bins) to find the real package manager behind a
+ * tool's shim, whereas whichLocalBin WANTS the local bin — it is for spawning a
+ * dev dependency's own CLI (oxlint, vitest, tsc) directly instead of through
+ * `pnpm exec`. Returns the platform-correct absolute path (the .cmd / .exe shim
+ * on Windows, the symlink on POSIX), falling back to a plain PATH lookup, or
+ * undefined when the tool resolves nowhere. `options.cwd` overrides the project
+ * root whose node_modules/.bin is searched (default process.cwd()); an explicit
+ * `options.path` replaces that local bin dir entirely.
+ *
+ * In npm's terminology this is "local" (vs "global" with `-g`): a locally
+ * installed package's executables are linked into node_modules/.bin. See
+ * https://docs.npmjs.com/cli/v11/configuring-npm/folders#executables.
+ *
+ * @example
+ *   ;```typescript
+ *   whichLocalBin('oxlint') // '/repo/node_modules/.bin/oxlint'
+ *   whichLocalBin('missing') // undefined
+ *   ```
+ */
+export declare function whichLocalBin(binName: string, options?: WhichOptions): string | undefined;
 /**
  * Find a binary in the system PATH and resolve to the real underlying script
  * asynchronously. Resolves wrapper scripts (.cmd, .ps1, shell scripts) to the

package/dist/bin/which.js

@@ -5,8 +5,11 @@ const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_paths_predicates = require('../paths/predicates.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_node_fs = require('../node/fs.js');
+const require_node_path = require('../node/path.js');
 const require_bin__internal = require('./_internal.js');
 const require_bin_resolve = require('./resolve.js');
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
 let src_external_which = require("../external/which");
 src_external_which = require_runtime.__toESM(src_external_which);
 
@@ -21,9 +24,11 @@ src_external_which = require_runtime.__toESM(src_external_which);
 *   through `resolveRealBinSync` so the caller gets the underlying script path
 *   (e.g., `npm-cli.js`) rather than the wrapper. Default `nothrow: true` so a
 *   missing binary returns `undefined` instead of bubbling a `which` package
-*   error. Caching matches `_internal.binPathCache` and `binPathAllCache`. Both
-*   caches validate hits with `existsSync` so a tool reinstall mid-session
-*   doesn't return a stale path.
+*   error. `whichLocalBin` resolves a tool from the project-local
+*   `node_modules/.bin` (the inverse of `findRealBin`, which skips it). Caching
+*   matches `_internal.binPathCache` and `binPathAllCache`. Both caches
+*   validate hits with `existsSync` so a tool reinstall mid-session doesn't
+*   return a stale path.
 */
 /**
 * Find an executable in the system PATH asynchronously.
@@ -67,6 +72,42 @@ async function which(binName, options) {
 	}
 }
 /**
+* Resolve a tool installed in the project-local `node_modules/.bin` to its
+* ABSOLUTE path. This is the inverse of findRealBin: that helper SKIPS
+* node_modules/.bin (shadow bins) to find the real package manager behind a
+* tool's shim, whereas whichLocalBin WANTS the local bin — it is for spawning a
+* dev dependency's own CLI (oxlint, vitest, tsc) directly instead of through
+* `pnpm exec`. Returns the platform-correct absolute path (the .cmd / .exe shim
+* on Windows, the symlink on POSIX), falling back to a plain PATH lookup, or
+* undefined when the tool resolves nowhere. `options.cwd` overrides the project
+* root whose node_modules/.bin is searched (default process.cwd()); an explicit
+* `options.path` replaces that local bin dir entirely.
+*
+* In npm's terminology this is "local" (vs "global" with `-g`): a locally
+* installed package's executables are linked into node_modules/.bin. See
+* https://docs.npmjs.com/cli/v11/configuring-npm/folders#executables.
+*
+* @example
+*   ;```typescript
+*   whichLocalBin('oxlint') // '/repo/node_modules/.bin/oxlint'
+*   whichLocalBin('missing') // undefined
+*   ```
+*/
+function whichLocalBin(binName, options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const path = require_node_path.getNodePath();
+	const local = whichSync(binName, {
+		nothrow: true,
+		path: opts.path ?? path.join(opts.cwd ?? node_process.default.cwd(), "node_modules", ".bin")
+	});
+	if (typeof local === "string") return local;
+	const found = whichSync(binName, { nothrow: true });
+	return typeof found === "string" ? found : void 0;
+}
+/**
 * Find a binary in the system PATH and resolve to the real underlying script
 * asynchronously. Resolves wrapper scripts (.cmd, .ps1, shell scripts) to the
 * actual .js files they execute.
@@ -215,6 +256,7 @@ function whichSync(binName, options) {
 
 //#endregion
 exports.which = which;
+exports.whichLocalBin = whichLocalBin;
 exports.whichReal = whichReal;
 exports.whichRealSync = whichRealSync;
 exports.whichSync = whichSync;

package/dist/cacache/_internal.d.ts

@@ -2,9 +2,17 @@
  * @file Accessor for the vendored `cacache` module. Centralised so other
  *   `cacache/*` leaves stay decoupled from the import path — if the vendoring
  *   moves, only this leaf updates.
+ *   Snapshot safety: the vendored `cacache` resolves through the npm-pack
+ *   bundle, whose module-eval constructs a live native `[Foreign]` handle.
+ *   Importing it at module load pins that handle into the heap and aborts
+ *   `node --build-snapshot`, so the require is deferred to first use and
+ *   memoized.
  */
+import type cacache from '../external/cacache';
 /**
- * Get the cacache module for cache operations.
+ * Get the cacache module for cache operations. Required lazily on first call so
+ * importing a `cacache/*` leaf does not pull in the native-handle-bearing
+ * npm-pack bundle.
  *
  * @example
  *   ;```typescript
@@ -12,4 +20,4 @@
  *   const entries = await cacache.ls(cacheDir)
  *   ```
  */
-export declare function getCacache(): import("../external/cacache").CacacheInstance;
+export declare function getCacache(): typeof cacache;

package/dist/cacache/_internal.js

@@ -1,18 +1,13 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
-let src_external_cacache = require("../external/cacache");
-src_external_cacache = require_runtime.__toESM(src_external_cacache);
 
 //#region src/cacache/_internal.ts
+let cached;
 /**
-* @file Accessor for the vendored `cacache` module. Centralised so other
-*   `cacache/*` leaves stay decoupled from the import path — if the vendoring
-*   moves, only this leaf updates.
-*/
-/**
-* Get the cacache module for cache operations.
+* Get the cacache module for cache operations. Required lazily on first call so
+* importing a `cacache/*` leaf does not pull in the native-handle-bearing
+* npm-pack bundle.
 *
 * @example
 *   ;```typescript
@@ -21,7 +16,8 @@ src_external_cacache = require_runtime.__toESM(src_external_cacache);
 *   ```
 */
 function getCacache() {
-	return src_external_cacache.default;
+	if (cached === void 0) cached = require("../external/cacache");
+	return cached;
 }
 
 //#endregion

package/dist/cache/ttl/_internal.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @file Private internals shared by the `cache/ttl/*` stores — the TTL /
+ *   prefix / memo-cap defaults, the clock-skew-aware expiry predicate, the
+ *   wildcard key matcher, and the LRU insertion-order setter. One owner so the
+ *   node store (`./store`, cacache-backed) and the browser store
+ *   (`./browser`, adapter-backed) cannot drift on expiry or matching
+ *   semantics. Pure helpers over primordials only — no `node:*`, no
+ *   `process`, so both stores stay importable from browser bundles.
+ */
+import type { TtlCacheEntry } from './types';
+export declare const DEFAULT_MEMO_MAX_SIZE = 1000;
+export declare const DEFAULT_PREFIX = "ttl-cache";
+export declare const DEFAULT_TTL_MS: number;
+/**
+ * Create a matcher for a key pattern (with wildcard support) against FULL
+ * (prefixed) cache keys. Without a wildcard the pattern is a plain prefix
+ * match; with wildcards the pattern is anchored both ends so `foo*bar`
+ * matches exactly `foo<anything>bar`.
+ */
+export declare function createKeyMatcher(prefix: string, pattern: string): (fullKey: string) => boolean;
+/**
+ * Check if an entry is expired for the given ttl. Also detects clock skew by
+ * treating a suspiciously far-future `expiresAt` (more than 10 seconds past
+ * the expected `now + ttl` horizon) as expired.
+ */
+export declare function isExpiredEntry(entry: TtlCacheEntry<unknown>, ttl: number): boolean;
+/**
+ * Set an entry in a memo Map capped at `maxSize`, using the Map's
+ * insertion-order semantics as the LRU list: an existing key is deleted first
+ * so the re-insert moves it to the tail, and when the cap is hit the oldest
+ * entry (first key in iteration order) is evicted.
+ */
+export declare function lruSet(map: Map<string, TtlCacheEntry<unknown>>, maxSize: number, key: string, entry: TtlCacheEntry<unknown>): void;

package/dist/cache/ttl/_internal.js

@@ -0,0 +1,68 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_string = require('../../primordials/string.js');
+const require_primordials_regexp = require('../../primordials/regexp.js');
+const require_primordials_date = require('../../primordials/date.js');
+
+//#region src/cache/ttl/_internal.ts
+/**
+* @file Private internals shared by the `cache/ttl/*` stores — the TTL /
+*   prefix / memo-cap defaults, the clock-skew-aware expiry predicate, the
+*   wildcard key matcher, and the LRU insertion-order setter. One owner so the
+*   node store (`./store`, cacache-backed) and the browser store
+*   (`./browser`, adapter-backed) cannot drift on expiry or matching
+*   semantics. Pure helpers over primordials only — no `node:*`, no
+*   `process`, so both stores stay importable from browser bundles.
+*/
+const DEFAULT_MEMO_MAX_SIZE = 1e3;
+const DEFAULT_PREFIX = "ttl-cache";
+const DEFAULT_TTL_MS = 300 * 1e3;
+const MAX_FUTURE_SKEW_MS = 1e4;
+/**
+* Create a matcher for a key pattern (with wildcard support) against FULL
+* (prefixed) cache keys. Without a wildcard the pattern is a plain prefix
+* match; with wildcards the pattern is anchored both ends so `foo*bar`
+* matches exactly `foo<anything>bar`.
+*/
+function createKeyMatcher(prefix, pattern) {
+	const fullPattern = `${prefix}:${pattern}`;
+	if (!pattern.includes("*")) return (fullKey) => require_primordials_string.StringPrototypeStartsWith(fullKey, fullPattern);
+	const regex = new require_primordials_regexp.RegExpCtor(`^${require_primordials_string.StringPrototypeReplaceAll(require_primordials_string.StringPrototypeReplaceAll(fullPattern, /[.+?^${}()|[\]\\]/g, "\\$&"), "*", ".*")}$`);
+	return (fullKey) => require_primordials_regexp.RegExpPrototypeTest(regex, fullKey);
+}
+/**
+* Check if an entry is expired for the given ttl. Also detects clock skew by
+* treating a suspiciously far-future `expiresAt` (more than 10 seconds past
+* the expected `now + ttl` horizon) as expired.
+*/
+function isExpiredEntry(entry, ttl) {
+	const now = require_primordials_date.DateNow();
+	if (entry.expiresAt > now + ttl + MAX_FUTURE_SKEW_MS) return true;
+	return now > entry.expiresAt;
+}
+/**
+* Set an entry in a memo Map capped at `maxSize`, using the Map's
+* insertion-order semantics as the LRU list: an existing key is deleted first
+* so the re-insert moves it to the tail, and when the cap is hit the oldest
+* entry (first key in iteration order) is evicted.
+*/
+function lruSet(map, maxSize, key, entry) {
+	if (map.has(key)) map.delete(key);
+	else if (map.size >= maxSize) {
+		const oldest = map.keys().next().value;
+		/* c8 ignore start - defensive unreachable branch */
+		if (oldest === void 0) return;
+		/* c8 ignore stop */
+		map.delete(oldest);
+	}
+	map.set(key, entry);
+}
+
+//#endregion
+exports.DEFAULT_MEMO_MAX_SIZE = DEFAULT_MEMO_MAX_SIZE;
+exports.DEFAULT_PREFIX = DEFAULT_PREFIX;
+exports.DEFAULT_TTL_MS = DEFAULT_TTL_MS;
+exports.createKeyMatcher = createKeyMatcher;
+exports.isExpiredEntry = isExpiredEntry;
+exports.lruSet = lruSet;

package/dist/cache/ttl/browser.d.ts

@@ -0,0 +1,56 @@
+/**
+ * @file `createBrowserTtlCache` — browser-safe sibling of `createTtlCache`
+ *   (`./store`). Same two-tier design and `TtlCache` contract, but the
+ *   persistent tier is an injected `TtlCacheStorage` adapter (wrap
+ *   `chrome.storage.local`, `sessionStorage` / `localStorage`, IndexedDB, …)
+ *   instead of cacache, so the module's import graph stays primordials-only —
+ *   safe for Chrome MV3 service workers, content scripts, popups, and web
+ *   workers. Shared semantics live in `./_internal` (one owner, so the node
+ *   and browser stores cannot drift): TTL default, clock-skew detection, LRU
+ *   memo eviction via Map insertion order, prefix namespacing, wildcard
+ *   matching. `getOrFetch` deduplicates concurrent fetches for the same key
+ *   (thundering-herd protection), and single-key methods throw on `*`.
+ *   Differences from `./store` (cacache-specific pieces that don't map):
+ *
+ *   - No cacache `ls.stream` — `getAll` / `deleteAll` / `clear` enumerate the
+ *     persistent tier only when the adapter provides the optional `keys()`
+ *     (e.g. `chrome.storage.local.get(null)`, `sessionStorage.key(i)`). Without
+ *     it they still cover the memo tier, and delete those memo keys from
+ *     storage too; storage-only entries from previous sessions are then
+ *     unreachable by wildcard but still expire per-entry on read.
+ *   - No storage supplied ⇒ memo-only cache (all operations stay correct).
+ *   - A corrupt or shape-invalid storage entry is treated as a miss and deleted
+ *     best-effort; storage failures never throw — the memo tier is the source
+ *     of truth, mirroring store.ts's cacache error handling.
+ */
+import type { BrowserTtlCacheOptions, TtlCache } from './types';
+/**
+ * Create a browser-safe TTL cache instance. Same contract as
+ * `createTtlCache`, with the persistent tier backed by the injected
+ * `storage` adapter (or absent, for a memo-only cache).
+ *
+ * @example
+ *   ;```typescript
+ *   const cache = createBrowserTtlCache({
+ *     prefix: 'my-extension',
+ *     storage: {
+ *       async getItem(key) {
+ *         return (await chrome.storage.local.get(key))[key]
+ *       },
+ *       async keys() {
+ *         return Object.keys(await chrome.storage.local.get(null))
+ *       },
+ *       async removeItem(key) {
+ *         await chrome.storage.local.remove(key)
+ *       },
+ *       async setItem(key, value) {
+ *         await chrome.storage.local.set({ [key]: value })
+ *       },
+ *     },
+ *     ttl: 60_000,
+ *   })
+ *   await cache.set('key', { value: 42 })
+ *   const data = await cache.get('key') // { value: 42 }
+ *   ```
+ */
+export declare function createBrowserTtlCache(options?: BrowserTtlCacheOptions | undefined): TtlCache;

package/dist/cache/ttl/browser.js

@@ -0,0 +1,257 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_error = require('../../primordials/error.js');
+const require_primordials_string = require('../../primordials/string.js');
+const require_primordials_math = require('../../primordials/math.js');
+const require_primordials_map_set = require('../../primordials/map-set.js');
+const require_primordials_date = require('../../primordials/date.js');
+const require_primordials_json = require('../../primordials/json.js');
+const require_cache_ttl__internal = require('./_internal.js');
+
+//#region src/cache/ttl/browser.ts
+/**
+* @file `createBrowserTtlCache` — browser-safe sibling of `createTtlCache`
+*   (`./store`). Same two-tier design and `TtlCache` contract, but the
+*   persistent tier is an injected `TtlCacheStorage` adapter (wrap
+*   `chrome.storage.local`, `sessionStorage` / `localStorage`, IndexedDB, …)
+*   instead of cacache, so the module's import graph stays primordials-only —
+*   safe for Chrome MV3 service workers, content scripts, popups, and web
+*   workers. Shared semantics live in `./_internal` (one owner, so the node
+*   and browser stores cannot drift): TTL default, clock-skew detection, LRU
+*   memo eviction via Map insertion order, prefix namespacing, wildcard
+*   matching. `getOrFetch` deduplicates concurrent fetches for the same key
+*   (thundering-herd protection), and single-key methods throw on `*`.
+*   Differences from `./store` (cacache-specific pieces that don't map):
+*
+*   - No cacache `ls.stream` — `getAll` / `deleteAll` / `clear` enumerate the
+*     persistent tier only when the adapter provides the optional `keys()`
+*     (e.g. `chrome.storage.local.get(null)`, `sessionStorage.key(i)`). Without
+*     it they still cover the memo tier, and delete those memo keys from
+*     storage too; storage-only entries from previous sessions are then
+*     unreachable by wildcard but still expire per-entry on read.
+*   - No storage supplied ⇒ memo-only cache (all operations stay correct).
+*   - A corrupt or shape-invalid storage entry is treated as a miss and deleted
+*     best-effort; storage failures never throw — the memo tier is the source
+*     of truth, mirroring store.ts's cacache error handling.
+*/
+/**
+* Create a browser-safe TTL cache instance. Same contract as
+* `createTtlCache`, with the persistent tier backed by the injected
+* `storage` adapter (or absent, for a memo-only cache).
+*
+* @example
+*   ;```typescript
+*   const cache = createBrowserTtlCache({
+*     prefix: 'my-extension',
+*     storage: {
+*       async getItem(key) {
+*         return (await chrome.storage.local.get(key))[key]
+*       },
+*       async keys() {
+*         return Object.keys(await chrome.storage.local.get(null))
+*       },
+*       async removeItem(key) {
+*         await chrome.storage.local.remove(key)
+*       },
+*       async setItem(key, value) {
+*         await chrome.storage.local.set({ [key]: value })
+*       },
+*     },
+*     ttl: 60_000,
+*   })
+*   await cache.set('key', { value: 42 })
+*   const data = await cache.get('key') // { value: 42 }
+*   ```
+*/
+function createBrowserTtlCache(options) {
+	const opts = {
+		__proto__: null,
+		memoize: true,
+		memoMaxSize: require_cache_ttl__internal.DEFAULT_MEMO_MAX_SIZE,
+		prefix: require_cache_ttl__internal.DEFAULT_PREFIX,
+		storage: void 0,
+		ttl: require_cache_ttl__internal.DEFAULT_TTL_MS,
+		...options
+	};
+	if (opts.prefix?.includes("*")) throw new require_primordials_error.TypeErrorCtor("Cache prefix cannot contain wildcards (*). Use clear({ prefix: \"pattern*\" }) for wildcard matching.");
+	const { storage } = opts;
+	const memoCache = new require_primordials_map_set.MapCtor();
+	const memoMaxSize = require_primordials_math.MathMax(1, opts.memoMaxSize ?? 1e3);
+	const prefix = opts.prefix ?? "ttl-cache";
+	const ttl = opts.ttl ?? 3e5;
+	const fullPrefix = `${prefix}:`;
+	/**
+	* Build full cache key with prefix.
+	*/
+	function buildKey(key) {
+		return `${fullPrefix}${key}`;
+	}
+	/**
+	* Best-effort deletion from the storage adapter — failures are swallowed.
+	*/
+	async function removeQuietly(fullKey) {
+		if (!storage) return;
+		try {
+			await storage.removeItem(fullKey);
+		} catch {}
+	}
+	/**
+	* List the storage adapter's keys via its optional `keys()`. Returns an
+	* empty list when the adapter has no enumeration or when it fails.
+	*/
+	async function listStorageKeys() {
+		if (!storage?.keys) return [];
+		try {
+			return await storage.keys();
+		} catch {
+			return [];
+		}
+	}
+	/**
+	* Read + parse + validate one entry from the storage adapter. Returns the
+	* live entry, or undefined on miss / corrupt / shape-invalid / expired —
+	* deleting dead entries best-effort.
+	*/
+	async function readStorageEntry(fullKey) {
+		if (!storage) return;
+		let raw;
+		try {
+			raw = await storage.getItem(fullKey);
+		} catch {
+			return;
+		}
+		if (typeof raw !== "string") return;
+		let parsed;
+		try {
+			parsed = require_primordials_json.JSONParse(raw);
+		} catch {
+			await removeQuietly(fullKey);
+			return;
+		}
+		if (parsed === null || typeof parsed !== "object" || typeof parsed.expiresAt !== "number") {
+			await removeQuietly(fullKey);
+			return;
+		}
+		const entry = parsed;
+		if (require_cache_ttl__internal.isExpiredEntry(entry, ttl)) {
+			await removeQuietly(fullKey);
+			return;
+		}
+		return entry;
+	}
+	async function get(key) {
+		if (require_primordials_string.StringPrototypeIncludes(key, "*")) throw new require_primordials_error.TypeErrorCtor("Cache key cannot contain wildcards (*). Use getAll(pattern) to retrieve multiple entries.");
+		const fullKey = buildKey(key);
+		if (opts.memoize) {
+			const memoEntry = memoCache.get(fullKey);
+			if (memoEntry && !require_cache_ttl__internal.isExpiredEntry(memoEntry, ttl)) {
+				require_cache_ttl__internal.lruSet(memoCache, memoMaxSize, fullKey, memoEntry);
+				return memoEntry.data;
+			}
+			if (memoEntry) memoCache.delete(fullKey);
+		}
+		const entry = await readStorageEntry(fullKey);
+		if (entry) {
+			if (opts.memoize) require_cache_ttl__internal.lruSet(memoCache, memoMaxSize, fullKey, entry);
+			return entry.data;
+		}
+	}
+	async function getAll(pattern) {
+		const results = new require_primordials_map_set.MapCtor();
+		const matches = require_cache_ttl__internal.createKeyMatcher(prefix, pattern);
+		if (opts.memoize) for (const { 0: fullKey, 1: entry } of memoCache.entries()) {
+			if (!matches(fullKey)) continue;
+			if (require_cache_ttl__internal.isExpiredEntry(entry, ttl)) {
+				memoCache.delete(fullKey);
+				continue;
+			}
+			results.set(require_primordials_string.StringPrototypeSlice(fullKey, fullPrefix.length), entry.data);
+		}
+		for (const fullKey of await listStorageKeys()) {
+			if (!require_primordials_string.StringPrototypeStartsWith(fullKey, fullPrefix) || !matches(fullKey)) continue;
+			const originalKey = require_primordials_string.StringPrototypeSlice(fullKey, fullPrefix.length);
+			if (results.has(originalKey)) continue;
+			const entry = await readStorageEntry(fullKey);
+			if (!entry) continue;
+			results.set(originalKey, entry.data);
+			if (opts.memoize) require_cache_ttl__internal.lruSet(memoCache, memoMaxSize, fullKey, entry);
+		}
+		return results;
+	}
+	async function set(key, data) {
+		if (require_primordials_string.StringPrototypeIncludes(key, "*")) throw new require_primordials_error.TypeErrorCtor("Cache key cannot contain wildcards (*). Wildcards are only supported in clear({ prefix: \"pattern*\" }).");
+		const fullKey = buildKey(key);
+		const entry = {
+			data,
+			expiresAt: require_primordials_date.DateNow() + ttl
+		};
+		if (opts.memoize) require_cache_ttl__internal.lruSet(memoCache, memoMaxSize, fullKey, entry);
+		if (storage) try {
+			await storage.setItem(fullKey, require_primordials_json.JSONStringify(entry));
+		} catch {}
+	}
+	const inflightRequests = new require_primordials_map_set.MapCtor();
+	async function getOrFetch(key, fetcher) {
+		const fullKey = buildKey(key);
+		const preexisting = inflightRequests.get(fullKey);
+		if (preexisting) return await preexisting;
+		const cached = await get(key);
+		if (cached !== void 0) return cached;
+		const rechecked = inflightRequests.get(fullKey);
+		if (rechecked) return await rechecked;
+		const promise = (async () => {
+			try {
+				const data = await fetcher();
+				await set(key, data);
+				return data;
+			} finally {
+				inflightRequests.delete(fullKey);
+			}
+		})();
+		inflightRequests.set(fullKey, promise);
+		return await promise;
+	}
+	async function deleteEntry(key) {
+		if (require_primordials_string.StringPrototypeIncludes(key, "*")) throw new require_primordials_error.TypeErrorCtor("Cache key cannot contain wildcards (*). Use deleteAll(pattern) to remove multiple entries.");
+		const fullKey = buildKey(key);
+		memoCache.delete(fullKey);
+		await removeQuietly(fullKey);
+	}
+	async function deleteAll(pattern) {
+		const matches = pattern ? require_cache_ttl__internal.createKeyMatcher(prefix, pattern) : void 0;
+		const removedKeys = new require_primordials_map_set.SetCtor();
+		for (const fullKey of memoCache.keys()) if (!matches || matches(fullKey)) removedKeys.add(fullKey);
+		for (const fullKey of await listStorageKeys()) {
+			if (!require_primordials_string.StringPrototypeStartsWith(fullKey, fullPrefix)) continue;
+			if (!matches || matches(fullKey)) removedKeys.add(fullKey);
+		}
+		for (const fullKey of removedKeys) {
+			memoCache.delete(fullKey);
+			await removeQuietly(fullKey);
+		}
+		return removedKeys.size;
+	}
+	async function clear(clearOptions) {
+		if ({
+			__proto__: null,
+			...clearOptions
+		}.memoOnly) {
+			memoCache.clear();
+			return;
+		}
+		await deleteAll();
+	}
+	return {
+		clear,
+		delete: deleteEntry,
+		deleteAll,
+		get,
+		getAll,
+		getOrFetch,
+		set
+	};
+}
+
+//#endregion
+exports.createBrowserTtlCache = createBrowserTtlCache;