@socketsecurity/lib 6.0.9 → 6.0.10

package/dist/env/providers.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @file CI/host provider detection, re-exported from std-env — not
+ *   reimplemented. std-env is a devDependency, inlined by the bundler.
+ */
+export { detectProvider, provider, providerInfo } from '../external/std-env';
+export type { ProviderInfo, ProviderName } from '../external/std-env';

package/dist/env/providers.js

@@ -0,0 +1,23 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+let src_external_std_env = require("../external/std-env");
+
+Object.defineProperty(exports, 'detectProvider', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.detectProvider;
+  }
+});
+Object.defineProperty(exports, 'provider', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.provider;
+  }
+});
+Object.defineProperty(exports, 'providerInfo', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.providerInfo;
+  }
+});

package/dist/env/proxy.js

@@ -86,7 +86,7 @@ function createEnvProxy(base, overrides) {
 			return lookupEnvValue(prop);
 		},
 		ownKeys(_target) {
-			return [...new Set([...require_primordials_object.ObjectKeys(base), ...overrides ? require_primordials_object.ObjectKeys(overrides) : []])];
+			return [.../* @__PURE__ */ new Set([...require_primordials_object.ObjectKeys(base), ...overrides ? require_primordials_object.ObjectKeys(overrides) : []])];
 		},
 		getOwnPropertyDescriptor(_target, prop) {
 			if (typeof prop !== "string") return;

package/dist/env/rewire.d.ts

@@ -8,6 +8,7 @@
  *   - Compatible with vi.stubEnv() - reads from process.env as final fallback
  *   - Thread-safe for concurrent test execution
  */
+import type { AsyncLocalStorage } from 'node:async_hooks';
 import { getNodeAsyncHooks } from '../node/async-hooks';
 export type EnvOverrides = Map<string, string | undefined>;
 /**
@@ -50,6 +51,27 @@ export declare const getAsyncHooks: typeof getNodeAsyncHooks;
  * @internal Used by env getters to support test rewiring
  */
 export declare function getEnvValue(key: string): string | undefined;
+/**
+ * Get the current isolated-override map, or undefined when none is active.
+ * Off Node (browser bundles) there is no AsyncLocalStorage and no isolated
+ * context — env getters fall straight through to the other tiers.
+ *
+ * @private
+ */
+export declare function getIsolatedOverrides(): EnvOverrides | undefined;
+/**
+ * Get the process-scoped AsyncLocalStorage used for nested env overrides
+ * (withEnv/withEnvSync).
+ *
+ * Constructed LAZILY (memoized) rather than at module-eval: an
+ * AsyncLocalStorage holds a live native handle, and constructing it at import
+ * time pins that handle into every module transitively importing this leaf —
+ * aborting V8 --build-snapshot serialization. Deferring to first use keeps the
+ * single-store semantics while leaving module import snapshot-safe.
+ *
+ * @private
+ */
+export declare function getIsolatedOverridesStorage(): AsyncLocalStorage<EnvOverrides>;
 /**
  * Check if an environment variable has been overridden.
  *
@@ -100,6 +122,16 @@ export declare function isInEnv(key: string): boolean;
  *   ```
  */
 export declare function resetEnv(): void;
+/**
+ * Read `process.env` without assuming a real Node `process`. Probes the
+ * GLOBAL `process` via `typeof` (no `node:process` import — webpack throws
+ * UnhandledSchemeError on `node:` specifiers before the `browser`-field stubs
+ * apply), so browser bundles load this leaf cleanly and env getters read as
+ * unset instead of throwing.
+ *
+ * @private
+ */
+export declare function safeProcessEnv(): Record<string, string | undefined> | undefined;
 /**
  * Set an environment variable override for testing. This does not modify
  * process.env, only affects env getters.

package/dist/env/rewire.js

@@ -1,31 +1,18 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_constants_runtime = require('../constants/runtime.js');
 const require_primordials_object = require('../primordials/object.js');
 const require_objects_predicates = require('../objects/predicates.js');
 const require_env_boolean = require('./boolean.js');
 const require_node_async_hooks = require('../node/async-hooks.js');
 const require_primordials_map_set = require('../primordials/map-set.js');
-let node_process = require("node:process");
-node_process = require_runtime.__toESM(node_process);
 
 //#region src/env/rewire.ts
-/**
-* @file Environment variable rewiring utilities for testing. Uses
-*   AsyncLocalStorage for context-isolated overrides that work with concurrent
-*   tests. Features:
-*
-*   - Context-isolated overrides via withEnv() for advanced use cases
-*   - Test-friendly setEnv/clearEnv/resetEnv that work in beforeEach/afterEach
-*   - Compatible with vi.stubEnv() - reads from process.env as final fallback
-*   - Thread-safe for concurrent test execution
-*/
-const { AsyncLocalStorage } = require_node_async_hooks.getNodeAsyncHooks();
-const isolatedOverridesStorage = new AsyncLocalStorage();
+let isolatedOverridesStorage;
 const sharedOverridesSymbol = Symbol.for("@socketsecurity/lib/env/rewire/test-overrides");
 const globalThisRef = globalThis;
-if (require_env_boolean.envAsBoolean(node_process.default.env["VITEST"]) && !globalThisRef[sharedOverridesSymbol]) globalThisRef[sharedOverridesSymbol] = new require_primordials_map_set.MapCtor();
+if (require_env_boolean.envAsBoolean(safeProcessEnv()?.["VITEST"]) && !globalThisRef[sharedOverridesSymbol]) globalThisRef[sharedOverridesSymbol] = new require_primordials_map_set.MapCtor();
 const sharedOverrides = globalThisRef[sharedOverridesSymbol];
 /**
 * Clear a specific environment variable override.
@@ -69,10 +56,39 @@ const getAsyncHooks = require_node_async_hooks.getNodeAsyncHooks;
 * @internal Used by env getters to support test rewiring
 */
 function getEnvValue(key) {
-	const isolatedOverrides = isolatedOverridesStorage.getStore();
+	const isolatedOverrides = getIsolatedOverrides();
 	if (isolatedOverrides?.has(key)) return isolatedOverrides.get(key);
 	if (sharedOverrides?.has(key)) return sharedOverrides.get(key);
-	return node_process.default.env[key];
+	return safeProcessEnv()?.[key];
+}
+/**
+* Get the current isolated-override map, or undefined when none is active.
+* Off Node (browser bundles) there is no AsyncLocalStorage and no isolated
+* context — env getters fall straight through to the other tiers.
+*
+* @private
+*/
+function getIsolatedOverrides() {
+	return require_constants_runtime.IS_NODE ? getIsolatedOverridesStorage().getStore() : void 0;
+}
+/**
+* Get the process-scoped AsyncLocalStorage used for nested env overrides
+* (withEnv/withEnvSync).
+*
+* Constructed LAZILY (memoized) rather than at module-eval: an
+* AsyncLocalStorage holds a live native handle, and constructing it at import
+* time pins that handle into every module transitively importing this leaf —
+* aborting V8 --build-snapshot serialization. Deferring to first use keeps the
+* single-store semantics while leaving module import snapshot-safe.
+*
+* @private
+*/
+function getIsolatedOverridesStorage() {
+	if (isolatedOverridesStorage === void 0) {
+		const { AsyncLocalStorage } = require_node_async_hooks.getNodeAsyncHooks();
+		isolatedOverridesStorage = new AsyncLocalStorage();
+	}
+	return isolatedOverridesStorage;
 }
 /**
 * Check if an environment variable has been overridden.
@@ -91,7 +107,7 @@ function getEnvValue(key) {
 * @returns `true` if the variable has been overridden, `false` otherwise
 */
 function hasOverride(key) {
-	return !!(isolatedOverridesStorage.getStore()?.has(key) || sharedOverrides?.has(key));
+	return !!(getIsolatedOverrides()?.has(key) || sharedOverrides?.has(key));
 }
 /**
 * Check if an environment variable exists (has a key), checking overrides
@@ -112,9 +128,10 @@ function hasOverride(key) {
 * @internal Used by env getters to check for key presence (not value truthiness)
 */
 function isInEnv(key) {
-	if (isolatedOverridesStorage.getStore()?.has(key)) return true;
+	if (getIsolatedOverrides()?.has(key)) return true;
 	if (sharedOverrides?.has(key)) return true;
-	return require_objects_predicates.hasOwn(node_process.default.env, key);
+	const env = safeProcessEnv();
+	return env ? require_objects_predicates.hasOwn(env, key) : false;
 }
 /**
 * Clear all environment variable overrides. Useful in afterEach hooks to ensure
@@ -133,6 +150,18 @@ function resetEnv() {
 	sharedOverrides?.clear();
 }
 /**
+* Read `process.env` without assuming a real Node `process`. Probes the
+* GLOBAL `process` via `typeof` (no `node:process` import — webpack throws
+* UnhandledSchemeError on `node:` specifiers before the `browser`-field stubs
+* apply), so browser bundles load this leaf cleanly and env getters read as
+* unset instead of throwing.
+*
+* @private
+*/
+function safeProcessEnv() {
+	return typeof process !== "undefined" && process ? process.env : void 0;
+}
+/**
 * Set an environment variable override for testing. This does not modify
 * process.env, only affects env getters.
 *
@@ -193,7 +222,7 @@ function setEnv(key, value) {
 */
 async function withEnv(overrides, fn) {
 	const map = new require_primordials_map_set.MapCtor(require_primordials_object.ObjectEntries(overrides));
-	return await isolatedOverridesStorage.run(map, fn);
+	return await getIsolatedOverridesStorage().run(map, fn);
 }
 /**
 * Synchronous version of withEnv for non-async code.
@@ -211,16 +240,19 @@ async function withEnv(overrides, fn) {
 */
 function withEnvSync(overrides, fn) {
 	const map = new require_primordials_map_set.MapCtor(require_primordials_object.ObjectEntries(overrides));
-	return isolatedOverridesStorage.run(map, fn);
+	return getIsolatedOverridesStorage().run(map, fn);
 }
 
 //#endregion
 exports.clearEnv = clearEnv;
 exports.getAsyncHooks = getAsyncHooks;
 exports.getEnvValue = getEnvValue;
+exports.getIsolatedOverrides = getIsolatedOverrides;
+exports.getIsolatedOverridesStorage = getIsolatedOverridesStorage;
 exports.hasOverride = hasOverride;
 exports.isInEnv = isInEnv;
 exports.resetEnv = resetEnv;
+exports.safeProcessEnv = safeProcessEnv;
 exports.setEnv = setEnv;
 exports.withEnv = withEnv;
 exports.withEnvSync = withEnvSync;

package/dist/env/runtimes.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @file JS runtime detection, re-exported from std-env — not reimplemented.
+ *   std-env is a devDependency, inlined by the bundler.
+ *   `isNode` is omitted: socket-lib's `constants/runtime` `IS_NODE` (a
+ *   typeof-safe global probe) already owns Node detection. The edge/alt-runtime
+ *   flags below have no socket-lib equivalent.
+ */
+export { isBun, isDeno, isEdgeLight, isFastly, isNetlify, isWorkerd, runtime, runtimeInfo, } from '../external/std-env';
+export type { RuntimeInfo, RuntimeName } from '../external/std-env';

package/dist/env/runtimes.js

@@ -0,0 +1,53 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+let src_external_std_env = require("../external/std-env");
+
+Object.defineProperty(exports, 'isBun', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.isBun;
+  }
+});
+Object.defineProperty(exports, 'isDeno', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.isDeno;
+  }
+});
+Object.defineProperty(exports, 'isEdgeLight', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.isEdgeLight;
+  }
+});
+Object.defineProperty(exports, 'isFastly', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.isFastly;
+  }
+});
+Object.defineProperty(exports, 'isNetlify', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.isNetlify;
+  }
+});
+Object.defineProperty(exports, 'isWorkerd', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.isWorkerd;
+  }
+});
+Object.defineProperty(exports, 'runtime', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.runtime;
+  }
+});
+Object.defineProperty(exports, 'runtimeInfo', {
+  enumerable: true,
+  get: function () {
+    return src_external_std_env.runtimeInfo;
+  }
+});

package/dist/env/socket-cli.d.ts

@@ -122,8 +122,11 @@ export declare function getSocketCliConfig(): string | undefined;
  */
 export declare function getSocketCliFix(): string | undefined;
 /**
- * Socket CLI GitHub authentication token. Checks SOCKET_CLI_GITHUB_TOKEN,
- * SOCKET_SECURITY_GITHUB_PAT, then falls back to GITHUB_TOKEN.
+ * Socket CLI GitHub authentication token. Checks SOCKET_CLI_GITHUB_TOKEN, then
+ * SOCKET_SECURITY_GITHUB_PAT. It does NOT fall back to the generic GITHUB_TOKEN
+ * — callers wanting the standard token compose `getGitHubToken()` on top (as
+ * the CLI's own token wrapper does), keeping the CLI-specific and generic token
+ * concerns separate.
  *
  * @example
  *   ;```typescript

package/dist/env/socket-cli.js

@@ -146,8 +146,11 @@ function getSocketCliFix() {
 	return require_env_rewire.getEnvValue("SOCKET_CLI_FIX");
 }
 /**
-* Socket CLI GitHub authentication token. Checks SOCKET_CLI_GITHUB_TOKEN,
-* SOCKET_SECURITY_GITHUB_PAT, then falls back to GITHUB_TOKEN.
+* Socket CLI GitHub authentication token. Checks SOCKET_CLI_GITHUB_TOKEN, then
+* SOCKET_SECURITY_GITHUB_PAT. It does NOT fall back to the generic GITHUB_TOKEN
+* — callers wanting the standard token compose `getGitHubToken()` on top (as
+* the CLI's own token wrapper does), keeping the CLI-specific and generic token
+* concerns separate.
 *
 * @example
 *   ;```typescript
@@ -160,7 +163,7 @@ function getSocketCliFix() {
 * @returns GitHub token or undefined
 */
 function getSocketCliGithubToken() {
-	return require_env_rewire.getEnvValue("SOCKET_CLI_GITHUB_TOKEN") || require_env_rewire.getEnvValue("SOCKET_SECURITY_GITHUB_PAT") || require_env_rewire.getEnvValue("GITHUB_TOKEN");
+	return require_env_rewire.getEnvValue("SOCKET_CLI_GITHUB_TOKEN") || require_env_rewire.getEnvValue("SOCKET_SECURITY_GITHUB_PAT") || void 0;
 }
 /**
 * Whether to skip Socket CLI API token requirement (alternative name).

package/dist/errors/predicates.d.ts

@@ -6,8 +6,9 @@
  */
 /**
  * Reference to the native ES2025 `Error.isError` when the running engine ships
- * it, otherwise `undefined`. Exposed separately so tests and callers can detect
- * the fast-path without re-probing.
+ * it, otherwise `undefined`. Consumes the single primordial snapshot
+ * ({@link ErrorIsError}) rather than re-probing the global — one capture point.
+ * Exposed separately so tests and callers can detect the fast-path.
  */
 export declare const isErrorBuiltin: ((value: unknown) => value is Error) | undefined;
 /**

package/dist/errors/predicates.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_error = require('../primordials/error.js');
 const require_primordials_object = require('../primordials/object.js');
 const require_primordials_string = require('../primordials/string.js');
 
@@ -13,10 +14,11 @@ const require_primordials_string = require('../primordials/string.js');
 */
 /**
 * Reference to the native ES2025 `Error.isError` when the running engine ships
-* it, otherwise `undefined`. Exposed separately so tests and callers can detect
-* the fast-path without re-probing.
+* it, otherwise `undefined`. Consumes the single primordial snapshot
+* ({@link ErrorIsError}) rather than re-probing the global — one capture point.
+* Exposed separately so tests and callers can detect the fast-path.
 */
-const isErrorBuiltin = Error.isError;
+const isErrorBuiltin = require_primordials_error.ErrorIsError;
 /**
 * Narrow a caught value to a Node.js `ErrnoException` — an Error with a `.code`
 * string set by libuv/syscall failures (e.g. `'ENOENT'`, `'EACCES'`, `'EBUSY'`,

package/dist/errors/stack.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_errors_predicates = require('./predicates.js');
 let src_external_pony_cause = require("../external/pony-cause");
 
 //#region src/errors/stack.ts
@@ -18,7 +19,7 @@ let src_external_pony_cause = require("../external/pony-cause");
 * errorStack(e) })` safely.
 */
 function errorStack(value) {
-	if (isError(value)) return (0, src_external_pony_cause.stackWithCauses)(value);
+	if (require_errors_predicates.isError(value)) return (0, src_external_pony_cause.stackWithCauses)(value);
 }
 
 //#endregion

package/dist/events/exit/_internal.d.ts

@@ -15,29 +15,7 @@ export declare const globalProcess: (NodeJS.Process & {
     __signal_exit_emitter__?: EventEmitter | undefined;
     reallyExit?: ((code?: number | undefined) => never) | undefined;
 }) | undefined;
-export declare const originalProcessEmit: {
-    (event: "beforeExit", code: number): boolean;
-    (event: "disconnect"): boolean;
-    (event: "exit", code: number): boolean;
-    (event: "rejectionHandled", promise: Promise<unknown>): boolean;
-    (event: "uncaughtException", error: Error): boolean;
-    (event: "uncaughtExceptionMonitor", error: Error): boolean;
-    (event: "unhandledRejection", reason: unknown, promise: Promise<unknown>): boolean;
-    (event: "warning", warning: Error): boolean;
-    (event: "message", message: unknown, sendHandle: import("child_process").SendHandle): NodeJS.Process & {
-        __signal_exit_emitter__?: EventEmitter | undefined;
-        reallyExit?: ((code?: number | undefined) => never) | undefined;
-    };
-    (event: NodeJS.Signals, signal?: NodeJS.Signals): boolean;
-    (event: "multipleResolves", type: NodeJS.MultipleResolveType, promise: Promise<unknown>, value: unknown): NodeJS.Process & {
-        __signal_exit_emitter__?: EventEmitter | undefined;
-        reallyExit?: ((code?: number | undefined) => never) | undefined;
-    };
-    (event: "worker", listener: NodeJS.WorkerListener): NodeJS.Process & {
-        __signal_exit_emitter__?: EventEmitter | undefined;
-        reallyExit?: ((code?: number | undefined) => never) | undefined;
-    };
-} | undefined;
+export declare const originalProcessEmit: NodeJS.Process['emit'] | undefined;
 export declare const platform: string;
 export declare const originalProcessReallyExit: ((code?: number | undefined) => never) | undefined;
 export declare const WIN32: boolean;