@socketsecurity/lib 6.0.8 → 6.0.10

package/dist/debug/output.js

@@ -1,19 +1,18 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_constants_runtime = require('../constants/runtime.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_primordials_date = require('../primordials/date.js');
 const require_primordials_reflect = require('../primordials/reflect.js');
 const require_strings_format = require('../strings/format.js');
+const require_logger_default = require('../logger/default.js');
 const require_env_socket = require('../env/socket.js');
 const require_node_util = require('../node/util.js');
 const require_debug__internal = require('./_internal.js');
 const require_debug_namespace = require('./namespace.js');
 const require_spinner_default = require('../spinner/default.js');
 const require_debug_caller_info = require('./caller-info.js');
-let src_external_debug = require("../external/debug");
-src_external_debug = require_runtime.__toESM(src_external_debug);
 
 //#region src/debug/output.ts
 /**
@@ -43,7 +42,8 @@ function debugCache(operation, key, meta) {
 	if (!require_env_socket.getSocketDebug()) return;
 	const prefix = `[CACHE] ${require_debug_caller_info.getCallerInfo(3) || "cache"} ${require_debug__internal.getPointingTriangle()} ${operation}: ${key}`;
 	const args = meta !== void 0 ? [prefix, meta] : [prefix];
-	require_primordials_reflect.ReflectApply(require_debug__internal.logger.info, require_debug__internal.logger, args);
+	const logger = require_logger_default.getDefaultLogger();
+	require_primordials_reflect.ReflectApply(logger.info, logger, args);
 }
 /**
 * Debug output for cache operations with caller info. First argument is the
@@ -56,10 +56,11 @@ function debugCacheNs(namespacesOrOpts, operation, key, meta) {
 	if (!require_debug_namespace.isEnabled(namespaces)) return;
 	const prefix = `[CACHE] ${require_debug_caller_info.getCallerInfo(4) || "cache"} ${require_debug__internal.getPointingTriangle()} ${operation}: ${key}`;
 	const logArgs = meta !== void 0 ? [prefix, meta] : [prefix];
-	const spinnerInstance = options.spinner || require_spinner_default.getDefaultSpinner();
+	const spinnerInstance = options.spinner || getSpinner();
 	const wasSpinning = spinnerInstance?.isSpinning;
 	spinnerInstance?.stop();
-	require_primordials_reflect.ReflectApply(require_debug__internal.logger.info, require_debug__internal.logger, logArgs);
+	const logger = require_logger_default.getDefaultLogger();
+	require_primordials_reflect.ReflectApply(logger.info, logger, logArgs);
 	if (wasSpinning) spinnerInstance?.start();
 }
 /**
@@ -81,9 +82,9 @@ function debugDirNs(namespacesOrOpts, obj, inspectOpts) {
 	/* c8 ignore stop */
 	const pointingTriangle = require_debug__internal.getPointingTriangle();
 	let opts = inspectOpts;
-	/* c8 ignore start */
+	/* c8 ignore start - inspectOpts fallback needs DEBUG_INSPECT_OPTIONS env */
 	if (opts === void 0) {
-		const debugOpts = src_external_debug.default.inspectOpts;
+		const debugOpts = require_debug__internal.getDebugJs().inspectOpts;
 		if (debugOpts) opts = {
 			...debugOpts,
 			showHidden: debugOpts.showHidden === null ? void 0 : debugOpts.showHidden,
@@ -91,11 +92,12 @@ function debugDirNs(namespacesOrOpts, obj, inspectOpts) {
 		};
 	}
 	/* c8 ignore stop */
-	const spinnerInstance = options.spinner || require_spinner_default.getDefaultSpinner();
+	const spinnerInstance = options.spinner || getSpinner();
 	const wasSpinning = spinnerInstance?.isSpinning;
 	spinnerInstance?.stop();
-	require_debug__internal.logger.info(`[DEBUG] ${callerName} ${pointingTriangle} object inspection:`);
-	require_debug__internal.logger.dir(obj, inspectOpts);
+	const logger = require_logger_default.getDefaultLogger();
+	logger.info(`[DEBUG] ${callerName} ${pointingTriangle} object inspection:`);
+	logger.dir(obj, inspectOpts);
 	if (wasSpinning) spinnerInstance?.start();
 }
 /**
@@ -117,10 +119,11 @@ function debugLogNs(namespacesOrOpts, ...args) {
 	const pointingTriangle = require_debug__internal.getPointingTriangle();
 	const text = require_primordials_array.ArrayPrototypeAt(args, 0);
 	const logArgs = typeof text === "string" ? [require_strings_format.applyLinePrefix(`${callerName} ${pointingTriangle} ${text}`, { prefix: "[DEBUG] " }), ...require_primordials_array.ArrayPrototypeSlice(args, 1)] : [`[DEBUG] ${callerName} ${pointingTriangle}`, ...args];
-	const spinnerInstance = options.spinner || require_spinner_default.getDefaultSpinner();
+	const spinnerInstance = options.spinner || getSpinner();
 	const wasSpinning = spinnerInstance?.isSpinning;
 	spinnerInstance?.stop();
-	require_primordials_reflect.ReflectApply(require_debug__internal.logger.info, require_debug__internal.logger, logArgs);
+	const logger = require_logger_default.getDefaultLogger();
+	require_primordials_reflect.ReflectApply(logger.info, logger, logArgs);
 	if (wasSpinning) spinnerInstance?.start();
 }
 /**
@@ -136,10 +139,11 @@ function debugNs(namespacesOrOpts, ...args) {
 	const pointingTriangle = require_debug__internal.getPointingTriangle();
 	const text = require_primordials_array.ArrayPrototypeAt(args, 0);
 	const logArgs = typeof text === "string" ? [require_strings_format.applyLinePrefix(`${name} ${pointingTriangle} ${text}`, { prefix: "[DEBUG] " }), ...require_primordials_array.ArrayPrototypeSlice(args, 1)] : args;
-	const spinnerInstance = options.spinner || require_spinner_default.getDefaultSpinner();
+	const spinnerInstance = options.spinner || getSpinner();
 	const wasSpinning = spinnerInstance?.isSpinning;
 	spinnerInstance?.stop();
-	require_primordials_reflect.ReflectApply(require_debug__internal.logger.info, require_debug__internal.logger, logArgs);
+	const logger = require_logger_default.getDefaultLogger();
+	require_primordials_reflect.ReflectApply(logger.info, logger, logArgs);
 	if (wasSpinning) spinnerInstance?.start();
 }
 /**
@@ -176,6 +180,18 @@ function debugtime(label) {
 	};
 	return impl;
 }
+/**
+* Resolve the default spinner on Node; off Node (browser bundles) there is no
+* spinner — callers no-op through their optional chains. Construction is
+* deferred to first debug write (every call site sits behind the `isEnabled`
+* / `getSocketDebug` gates), so a browser bundle never constructs the
+* node-bound spinner even when debug output is force-enabled.
+*
+* @private
+*/
+function getSpinner() {
+	return require_constants_runtime.IS_NODE ? require_spinner_default.getDefaultSpinner() : void 0;
+}
 
 //#endregion
 exports.debug = debug;
@@ -187,4 +203,5 @@ exports.debugLog = debugLog;
 exports.debugLogNs = debugLogNs;
 exports.debugNs = debugNs;
 exports.debuglog = debuglog;
-exports.debugtime = debugtime;
+exports.debugtime = debugtime;
+exports.getSpinner = getSpinner;

package/dist/dlx/binary-cache.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
-const require_objects_predicates = require('../objects/predicates.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_objects_predicates = require('../objects/predicates.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');

package/dist/dlx/binary-resolution.js

@@ -3,8 +3,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_error = require('../primordials/error.js');
-const require_constants_platform = require('../constants/platform.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_constants_platform = require('../constants/platform.js');
 const require_paths_normalize = require('../paths/normalize.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
@@ -70,10 +70,13 @@ function findBinaryPath(packageDir, packageName, binaryName) {
 				packageName.split("/").pop() ?? packageName,
 				packageName.replace(/^@[^/]+\//, "")
 			].filter(Boolean);
-			for (const candidate of candidates) if (candidate && binObj[candidate]) {
-				binName = candidate;
-				binPath = binObj[candidate];
-				break;
+			for (let i = 0, { length } = candidates; i < length; i += 1) {
+				const candidate = candidates[i];
+				if (candidate && binObj[candidate]) {
+					binName = candidate;
+					binPath = binObj[candidate];
+					break;
+				}
 			}
 			if (!binPath && binKeys.length > 0) {
 				binName = binKeys[0];

package/dist/dlx/firewall.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_error = require('../primordials/error.js');
-const require_primordials_map_set = require('../primordials/map-set.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_primordials_map_set = require('../primordials/map-set.js');
 const require_primordials_promise = require('../primordials/promise.js');
 const require_http_request_user_agent = require('../http-request/user-agent.js');
 const require_http_request_node = require('../http-request/node.js');

package/dist/dlx/lockfile.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
-const require_integrity = require('../integrity.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_integrity = require('../integrity.js');
 const require_node_fs = require('../node/fs.js');
 const require_node_path = require('../node/path.js');
 const require_primordials_date = require('../primordials/date.js');

package/dist/eco/npm/npm/parse-lockfile.js

@@ -3,8 +3,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_error = require('../../../primordials/error.js');
 const require_primordials_object = require('../../../primordials/object.js');
-const require_primordials_map_set = require('../../../primordials/map-set.js');
 const require_primordials_string = require('../../../primordials/string.js');
+const require_primordials_map_set = require('../../../primordials/map-set.js');
 const require_primordials_array = require('../../../primordials/array.js');
 const require_primordials_json = require('../../../primordials/json.js');
 const require_errors_message = require('../../../errors/message.js');
@@ -134,7 +134,8 @@ function parseV1(data, rootDeps) {
 			const key = `${name}@${typeof pkg.version === "string" ? pkg.version : "0.0.0"}`;
 			if (visited.has(key)) continue;
 			if (packageIndex[name] === void 0) {
-				require_primordials_array.ArrayPrototypePush(packages, buildPackageRef(name, pkg));
+				const ref = buildPackageRef(name, pkg);
+				require_primordials_array.ArrayPrototypePush(packages, ref);
 				packageIndex[name] = packages.length - 1;
 			}
 			if (pkg.dependencies && typeof pkg.dependencies === "object") {

package/dist/eco/npm/vlt/exec.d.ts

@@ -3,7 +3,7 @@
  *   The dir exists so downstream code can import from a stable canonical path;
  *   populate when first concrete need arrives. vlt lockfile is `vlt-lock.json`.
  *   Reference: socket-sdxgen/src/parsers/vlt/. vlt does not support overrides,
- *   so fleet code that needs override support should branch around it (see
+ *   so Socket code that needs override support should branch around it (see
  *   socket-cli/packages/cli/src/commands/optimize/ for the canonical pattern of
  *   agent-conditional logic).
  */

package/dist/eco/npm/vlt/exec.js

@@ -9,7 +9,7 @@ const require_primordials_error = require('../../../primordials/error.js');
 *   The dir exists so downstream code can import from a stable canonical path;
 *   populate when first concrete need arrives. vlt lockfile is `vlt-lock.json`.
 *   Reference: socket-sdxgen/src/parsers/vlt/. vlt does not support overrides,
-*   so fleet code that needs override support should branch around it (see
+*   so Socket code that needs override support should branch around it (see
 *   socket-cli/packages/cli/src/commands/optimize/ for the canonical pattern of
 *   agent-conditional logic).
 */

package/dist/eco/npm/yarnpkg/yarn/parse-lockfile.js

@@ -1,9 +1,9 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_primordials_math = require('../../../../primordials/math.js');
 const require_primordials_object = require('../../../../primordials/object.js');
 const require_primordials_string = require('../../../../primordials/string.js');
+const require_primordials_math = require('../../../../primordials/math.js');
 const require_primordials_array = require('../../../../primordials/array.js');
 const require_smol_manifest = require('../../../../smol/manifest.js');
 const require_eco_npm_yarnpkg_yarn_parse_yarn_descriptor = require('./parse-yarn-descriptor.js');

package/dist/env/agents.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @file AI coding-agent detection, re-exported from std-env — not
+ *   reimplemented. std-env is a devDependency, inlined by the bundler.
+ */
+export { agent, agentInfo, detectAgent, isAgent } from '../external/std-env';
+export type { AgentInfo, AgentName } from '../external/std-env';

package/dist/env/agents.js

@@ -0,0 +1,29 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+let src_external_std_env = require("../external/std-env");
+
+Object.defineProperty(exports, 'agent', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.agent;
+  }
+});
+Object.defineProperty(exports, 'agentInfo', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.agentInfo;
+  }
+});
+Object.defineProperty(exports, 'detectAgent', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.detectAgent;
+  }
+});
+Object.defineProperty(exports, 'isAgent', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.isAgent;
+  }
+});

package/dist/env/flags.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @file Environment flag booleans, re-exported from std-env — not
+ *   reimplemented. std-env is a devDependency; the bundler inlines it, so dist
+ *   carries the logic with no runtime std-env import.
+ *   Only the flags socket-lib does NOT already own live here. CI, DEBUG,
+ *   NODE_ENV, test, platform, and Node-version detection are handled by
+ *   socket-lib's own rewire-aware getters and constants (`env/ci` `getCI`,
+ *   `env/debug` `getDebug`, `env/node-env` `getNodeEnv`, `env/test` `isTest`,
+ *   `constants/platform`, `constants/node`, `constants/runtime`), so std-env's
+ *   overlapping flags are intentionally not re-exported.
+ */
+export { hasTTY, isColorSupported, isMinimal } from '../external/std-env';

package/dist/env/flags.js

@@ -0,0 +1,23 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+let src_external_std_env = require("../external/std-env");
+
+Object.defineProperty(exports, 'hasTTY', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.hasTTY;
+  }
+});
+Object.defineProperty(exports, 'isColorSupported', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.isColorSupported;
+  }
+});
+Object.defineProperty(exports, 'isMinimal', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.isMinimal;
+  }
+});

package/dist/env/github-status.js

@@ -13,12 +13,12 @@ const require_http_request_node = require('../http-request/node.js');
 *   most 8 seconds to startup (configurable timeout) and fails open on network
 *   error so a down status page never blocks a healthy workflow.
 */
-const MONITORED_COMPONENT_IDS = new Map([
+const MONITORED_COMPONENT_IDS = /* @__PURE__ */ new Map([
 	["br0l2tvcx85d", "Actions"],
 	["8l4ygp009s5s", "Git Operations"],
 	["brv1bkgrwx7q", "API Requests"]
 ]);
-const SEVERITY = new Map([
+const SEVERITY = /* @__PURE__ */ new Map([
 	["major_outage", 4],
 	["partial_outage", 3],
 	["degraded_performance", 2],

package/dist/env/providers.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @file CI/host provider detection, re-exported from std-env — not
+ *   reimplemented. std-env is a devDependency, inlined by the bundler.
+ */
+export { detectProvider, provider, providerInfo } from '../external/std-env';
+export type { ProviderInfo, ProviderName } from '../external/std-env';

package/dist/env/providers.js

@@ -0,0 +1,23 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+let src_external_std_env = require("../external/std-env");
+
+Object.defineProperty(exports, 'detectProvider', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.detectProvider;
+  }
+});
+Object.defineProperty(exports, 'provider', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.provider;
+  }
+});
+Object.defineProperty(exports, 'providerInfo', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.providerInfo;
+  }
+});

package/dist/env/proxy.js

@@ -86,7 +86,7 @@ function createEnvProxy(base, overrides) {
 			return lookupEnvValue(prop);
 		},
 		ownKeys(_target) {
-			return [...new Set([...require_primordials_object.ObjectKeys(base), ...overrides ? require_primordials_object.ObjectKeys(overrides) : []])];
+			return [.../* @__PURE__ */ new Set([...require_primordials_object.ObjectKeys(base), ...overrides ? require_primordials_object.ObjectKeys(overrides) : []])];
 		},
 		getOwnPropertyDescriptor(_target, prop) {
 			if (typeof prop !== "string") return;

package/dist/env/rewire.d.ts

@@ -8,7 +8,8 @@
  *   - Compatible with vi.stubEnv() - reads from process.env as final fallback
  *   - Thread-safe for concurrent test execution
  */
-import type * as asyncHooksModule from 'node:async_hooks';
+import type { AsyncLocalStorage } from 'node:async_hooks';
+import { getNodeAsyncHooks } from '../node/async-hooks';
 export type EnvOverrides = Map<string, string | undefined>;
 /**
  * Clear a specific environment variable override.
@@ -25,11 +26,13 @@ export type EnvOverrides = Map<string, string | undefined>;
  */
 export declare function clearEnv(key: string): void;
 /**
- * Lazily load the async_hooks module to avoid Webpack errors.
+ * Lazily load the async_hooks module. Aliases the canonical `node/async-hooks`
+ * accessor (single owner of the bundler-safe require); kept as an export so
+ * this module's surface is unchanged.
  *
  * @private
  */
-export declare function getAsyncHooks(): typeof asyncHooksModule;
+export declare const getAsyncHooks: typeof getNodeAsyncHooks;
 /**
  * Get an environment variable value, checking overrides first.
  *
@@ -48,6 +51,27 @@ export declare function getAsyncHooks(): typeof asyncHooksModule;
  * @internal Used by env getters to support test rewiring
  */
 export declare function getEnvValue(key: string): string | undefined;
+/**
+ * Get the current isolated-override map, or undefined when none is active.
+ * Off Node (browser bundles) there is no AsyncLocalStorage and no isolated
+ * context — env getters fall straight through to the other tiers.
+ *
+ * @private
+ */
+export declare function getIsolatedOverrides(): EnvOverrides | undefined;
+/**
+ * Get the process-scoped AsyncLocalStorage used for nested env overrides
+ * (withEnv/withEnvSync).
+ *
+ * Constructed LAZILY (memoized) rather than at module-eval: an
+ * AsyncLocalStorage holds a live native handle, and constructing it at import
+ * time pins that handle into every module transitively importing this leaf —
+ * aborting V8 --build-snapshot serialization. Deferring to first use keeps the
+ * single-store semantics while leaving module import snapshot-safe.
+ *
+ * @private
+ */
+export declare function getIsolatedOverridesStorage(): AsyncLocalStorage<EnvOverrides>;
 /**
  * Check if an environment variable has been overridden.
  *
@@ -98,6 +122,16 @@ export declare function isInEnv(key: string): boolean;
  *   ```
  */
 export declare function resetEnv(): void;
+/**
+ * Read `process.env` without assuming a real Node `process`. Probes the
+ * GLOBAL `process` via `typeof` (no `node:process` import — webpack throws
+ * UnhandledSchemeError on `node:` specifiers before the `browser`-field stubs
+ * apply), so browser bundles load this leaf cleanly and env getters read as
+ * unset instead of throwing.
+ *
+ * @private
+ */
+export declare function safeProcessEnv(): Record<string, string | undefined> | undefined;
 /**
  * Set an environment variable override for testing. This does not modify
  * process.env, only affects env getters.

package/dist/env/rewire.js

@@ -1,31 +1,18 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_constants_runtime = require('../constants/runtime.js');
 const require_primordials_object = require('../primordials/object.js');
 const require_objects_predicates = require('../objects/predicates.js');
 const require_env_boolean = require('./boolean.js');
+const require_node_async_hooks = require('../node/async-hooks.js');
 const require_primordials_map_set = require('../primordials/map-set.js');
-let node_process = require("node:process");
-node_process = require_runtime.__toESM(node_process);
 
 //#region src/env/rewire.ts
-/**
-* @file Environment variable rewiring utilities for testing. Uses
-*   AsyncLocalStorage for context-isolated overrides that work with concurrent
-*   tests. Features:
-*
-*   - Context-isolated overrides via withEnv() for advanced use cases
-*   - Test-friendly setEnv/clearEnv/resetEnv that work in beforeEach/afterEach
-*   - Compatible with vi.stubEnv() - reads from process.env as final fallback
-*   - Thread-safe for concurrent test execution
-*/
-let asyncHooks;
-const { AsyncLocalStorage } = getAsyncHooks();
-const isolatedOverridesStorage = new AsyncLocalStorage();
+let isolatedOverridesStorage;
 const sharedOverridesSymbol = Symbol.for("@socketsecurity/lib/env/rewire/test-overrides");
 const globalThisRef = globalThis;
-if (require_env_boolean.envAsBoolean(node_process.default.env["VITEST"]) && !globalThisRef[sharedOverridesSymbol]) globalThisRef[sharedOverridesSymbol] = new require_primordials_map_set.MapCtor();
+if (require_env_boolean.envAsBoolean(safeProcessEnv()?.["VITEST"]) && !globalThisRef[sharedOverridesSymbol]) globalThisRef[sharedOverridesSymbol] = new require_primordials_map_set.MapCtor();
 const sharedOverrides = globalThisRef[sharedOverridesSymbol];
 /**
 * Clear a specific environment variable override.
@@ -44,14 +31,13 @@ function clearEnv(key) {
 	sharedOverrides?.delete(key);
 }
 /**
-* Lazily load the async_hooks module to avoid Webpack errors.
+* Lazily load the async_hooks module. Aliases the canonical `node/async-hooks`
+* accessor (single owner of the bundler-safe require); kept as an export so
+* this module's surface is unchanged.
 *
 * @private
 */
-function getAsyncHooks() {
-	if (asyncHooks === void 0) asyncHooks = /*@__PURE__*/ require("node:async_hooks");
-	return asyncHooks;
-}
+const getAsyncHooks = require_node_async_hooks.getNodeAsyncHooks;
 /**
 * Get an environment variable value, checking overrides first.
 *
@@ -70,10 +56,39 @@ function getAsyncHooks() {
 * @internal Used by env getters to support test rewiring
 */
 function getEnvValue(key) {
-	const isolatedOverrides = isolatedOverridesStorage.getStore();
+	const isolatedOverrides = getIsolatedOverrides();
 	if (isolatedOverrides?.has(key)) return isolatedOverrides.get(key);
 	if (sharedOverrides?.has(key)) return sharedOverrides.get(key);
-	return node_process.default.env[key];
+	return safeProcessEnv()?.[key];
+}
+/**
+* Get the current isolated-override map, or undefined when none is active.
+* Off Node (browser bundles) there is no AsyncLocalStorage and no isolated
+* context — env getters fall straight through to the other tiers.
+*
+* @private
+*/
+function getIsolatedOverrides() {
+	return require_constants_runtime.IS_NODE ? getIsolatedOverridesStorage().getStore() : void 0;
+}
+/**
+* Get the process-scoped AsyncLocalStorage used for nested env overrides
+* (withEnv/withEnvSync).
+*
+* Constructed LAZILY (memoized) rather than at module-eval: an
+* AsyncLocalStorage holds a live native handle, and constructing it at import
+* time pins that handle into every module transitively importing this leaf —
+* aborting V8 --build-snapshot serialization. Deferring to first use keeps the
+* single-store semantics while leaving module import snapshot-safe.
+*
+* @private
+*/
+function getIsolatedOverridesStorage() {
+	if (isolatedOverridesStorage === void 0) {
+		const { AsyncLocalStorage } = require_node_async_hooks.getNodeAsyncHooks();
+		isolatedOverridesStorage = new AsyncLocalStorage();
+	}
+	return isolatedOverridesStorage;
 }
 /**
 * Check if an environment variable has been overridden.
@@ -92,7 +107,7 @@ function getEnvValue(key) {
 * @returns `true` if the variable has been overridden, `false` otherwise
 */
 function hasOverride(key) {
-	return !!(isolatedOverridesStorage.getStore()?.has(key) || sharedOverrides?.has(key));
+	return !!(getIsolatedOverrides()?.has(key) || sharedOverrides?.has(key));
 }
 /**
 * Check if an environment variable exists (has a key), checking overrides
@@ -113,9 +128,10 @@ function hasOverride(key) {
 * @internal Used by env getters to check for key presence (not value truthiness)
 */
 function isInEnv(key) {
-	if (isolatedOverridesStorage.getStore()?.has(key)) return true;
+	if (getIsolatedOverrides()?.has(key)) return true;
 	if (sharedOverrides?.has(key)) return true;
-	return require_objects_predicates.hasOwn(node_process.default.env, key);
+	const env = safeProcessEnv();
+	return env ? require_objects_predicates.hasOwn(env, key) : false;
 }
 /**
 * Clear all environment variable overrides. Useful in afterEach hooks to ensure
@@ -134,6 +150,18 @@ function resetEnv() {
 	sharedOverrides?.clear();
 }
 /**
+* Read `process.env` without assuming a real Node `process`. Probes the
+* GLOBAL `process` via `typeof` (no `node:process` import — webpack throws
+* UnhandledSchemeError on `node:` specifiers before the `browser`-field stubs
+* apply), so browser bundles load this leaf cleanly and env getters read as
+* unset instead of throwing.
+*
+* @private
+*/
+function safeProcessEnv() {
+	return typeof process !== "undefined" && process ? process.env : void 0;
+}
+/**
 * Set an environment variable override for testing. This does not modify
 * process.env, only affects env getters.
 *
@@ -194,7 +222,7 @@ function setEnv(key, value) {
 */
 async function withEnv(overrides, fn) {
 	const map = new require_primordials_map_set.MapCtor(require_primordials_object.ObjectEntries(overrides));
-	return await isolatedOverridesStorage.run(map, fn);
+	return await getIsolatedOverridesStorage().run(map, fn);
 }
 /**
 * Synchronous version of withEnv for non-async code.
@@ -212,16 +240,19 @@ async function withEnv(overrides, fn) {
 */
 function withEnvSync(overrides, fn) {
 	const map = new require_primordials_map_set.MapCtor(require_primordials_object.ObjectEntries(overrides));
-	return isolatedOverridesStorage.run(map, fn);
+	return getIsolatedOverridesStorage().run(map, fn);
 }
 
 //#endregion
 exports.clearEnv = clearEnv;
 exports.getAsyncHooks = getAsyncHooks;
 exports.getEnvValue = getEnvValue;
+exports.getIsolatedOverrides = getIsolatedOverrides;
+exports.getIsolatedOverridesStorage = getIsolatedOverridesStorage;
 exports.hasOverride = hasOverride;
 exports.isInEnv = isInEnv;
 exports.resetEnv = resetEnv;
+exports.safeProcessEnv = safeProcessEnv;
 exports.setEnv = setEnv;
 exports.withEnv = withEnv;
 exports.withEnvSync = withEnvSync;

package/dist/env/runtimes.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @file JS runtime detection, re-exported from std-env — not reimplemented.
+ *   std-env is a devDependency, inlined by the bundler.
+ *   `isNode` is omitted: socket-lib's `constants/runtime` `IS_NODE` (a
+ *   typeof-safe global probe) already owns Node detection. The edge/alt-runtime
+ *   flags below have no socket-lib equivalent.
+ */
+export { isBun, isDeno, isEdgeLight, isFastly, isNetlify, isWorkerd, runtime, runtimeInfo, } from '../external/std-env';
+export type { RuntimeInfo, RuntimeName } from '../external/std-env';