mrs-toolbox-cli 9.1.8 → 9.1.9

package/npm-cache/_cacache/content-v2/sha512/{ed/27/a07a43ddbb1b2a2f8f2362d5745374eff52be2f835315a5a473ca2b8aef1138a5260a93af2c808a9a10e632eccd7103da79b8690043499a584ce47dc5dbd → a5/da/6d766f942b22f35bf46ccee1a11d5e0e265fe66ef4e8c321e54d7de901756ce367c36c47ef0e85263f7a43344f3cb62a1c97821f2366ebd23062414b4e86}

@@ -3714,7 +3714,7 @@
   "dist-tags": {
     "latest": "0.5.21"
   },
-  "_rev": "3344-916daac63761e13a",
+  "_rev": "3459-32e2437b2daef89d",
   "_id": "source-map-support",
   "readme": "# Source Map Support\n[![Build Status](https://travis-ci.org/evanw/node-source-map-support.svg?branch=master)](https://travis-ci.org/evanw/node-source-map-support)\n\nThis module provides source map support for stack traces in node via the [V8 stack trace API](https://github.com/v8/v8/wiki/Stack-Trace-API). It uses the [source-map](https://github.com/mozilla/source-map) module to replace the paths and line numbers of source-mapped files with their original paths and line numbers. The output mimics node's stack trace format with the goal of making every compile-to-JS language more of a first-class citizen. Source maps are completely general (not specific to any one language) so you can use source maps with multiple compile-to-JS languages in the same node process.\n\n## Installation and Usage\n\n#### Node support\n\n```\n$ npm install source-map-support\n```\n\nSource maps can be generated using libraries such as [source-map-index-generator](https://github.com/twolfson/source-map-index-generator). Once you have a valid source map, place a source mapping comment somewhere in the file (usually done automatically or with an option by your transpiler):\n\n```\n//# sourceMappingURL=path/to/source.map\n```\n\nIf multiple sourceMappingURL comments exist in one file, the last sourceMappingURL comment will be\nrespected (e.g. if a file mentions the comment in code, or went through multiple transpilers).\nThe path should either be absolute or relative to the compiled file.\n\nFrom here you have two options.\n\n##### CLI Usage\n\n```bash\nnode -r source-map-support/register compiled.js\n```\n\n##### Programmatic Usage\n\nPut the following line at the top of the compiled file.\n\n```js\nrequire('source-map-support').install();\n```\n\nIt is also possible to install the source map support directly by\nrequiring the `register` module which can be handy with ES6:\n\n```js\nimport 'source-map-support/register'\n\n// Instead of:\nimport sourceMapSupport from 'source-map-support'\nsourceMapSupport.install()\n```\nNote: if you're using babel-register, it includes source-map-support already.\n\nIt is also very useful with Mocha:\n\n```\n$ mocha --require source-map-support/register tests/\n```\n\n#### Browser support\n\nThis library also works in Chrome. While the DevTools console already supports source maps, the V8 engine doesn't and `Error.prototype.stack` will be incorrect without this library. Everything will just work if you deploy your source files using [browserify](http://browserify.org/). Just make sure to pass the `--debug` flag to the browserify command so your source maps are included in the bundled code.\n\nThis library also works if you use another build process or just include the source files directly. In this case, include the file `browser-source-map-support.js` in your page and call `sourceMapSupport.install()`. It contains the whole library already bundled for the browser using browserify.\n\n```html\n<script src=\"browser-source-map-support.js\"></script>\n<script>sourceMapSupport.install();</script>\n```\n\nThis library also works if you use AMD (Asynchronous Module Definition), which is used in tools like [RequireJS](http://requirejs.org/). Just list `browser-source-map-support` as a dependency:\n\n```html\n<script>\n  define(['browser-source-map-support'], function(sourceMapSupport) {\n    sourceMapSupport.install();\n  });\n</script>\n```\n\n## Options\n\nThis module installs two things: a change to the `stack` property on `Error` objects and a handler for uncaught exceptions that mimics node's default exception handler (the handler can be seen in the demos below). You may want to disable the handler if you have your own uncaught exception handler. This can be done by passing an argument to the installer:\n\n```js\nrequire('source-map-support').install({\n  handleUncaughtExceptions: false\n});\n```\n\nThis module loads source maps from the filesystem by default. You can provide alternate loading behavior through a callback as shown below. For example, [Meteor](https://github.com/meteor) keeps all source maps cached in memory to avoid disk access.\n\n```js\nrequire('source-map-support').install({\n  retrieveSourceMap: function(source) {\n    if (source === 'compiled.js') {\n      return {\n        url: 'original.js',\n        map: fs.readFileSync('compiled.js.map', 'utf8')\n      };\n    }\n    return null;\n  }\n});\n```\n\nThe module will by default assume a browser environment if XMLHttpRequest and window are defined. If either of these do not exist it will instead assume a node environment.\nIn some rare cases, e.g. when running a browser emulation and where both variables are also set, you can explictly specify the environment to be either 'browser' or 'node'.\n\n```js\nrequire('source-map-support').install({\n  environment: 'node'\n});\n```\n\nTo support files with inline source maps, the `hookRequire` options can be specified, which will monitor all source files for inline source maps.\n\n\n```js\nrequire('source-map-support').install({\n  hookRequire: true\n});\n```\n\nThis monkey patches the `require` module loading chain, so is not enabled by default and is not recommended for any sort of production usage.\n\n## Demos\n\n#### Basic Demo\n\noriginal.js:\n\n```js\nthrow new Error('test'); // This is the original code\n```\n\ncompiled.js:\n\n```js\nrequire('source-map-support').install();\n\nthrow new Error('test'); // This is the compiled code\n// The next line defines the sourceMapping.\n//# sourceMappingURL=compiled.js.map\n```\n\ncompiled.js.map:\n\n```json\n{\n  \"version\": 3,\n  \"file\": \"compiled.js\",\n  \"sources\": [\"original.js\"],\n  \"names\": [],\n  \"mappings\": \";;AAAA,MAAM,IAAI\"\n}\n```\n\nRun compiled.js using node (notice how the stack trace uses original.js instead of compiled.js):\n\n```\n$ node compiled.js\n\noriginal.js:1\nthrow new Error('test'); // This is the original code\n      ^\nError: test\n    at Object.<anonymous> (original.js:1:7)\n    at Module._compile (module.js:456:26)\n    at Object.Module._extensions..js (module.js:474:10)\n    at Module.load (module.js:356:32)\n    at Function.Module._load (module.js:312:12)\n    at Function.Module.runMain (module.js:497:10)\n    at startup (node.js:119:16)\n    at node.js:901:3\n```\n\n#### TypeScript Demo\n\ndemo.ts:\n\n```typescript\ndeclare function require(name: string);\nrequire('source-map-support').install();\nclass Foo {\n  constructor() { this.bar(); }\n  bar() { throw new Error('this is a demo'); }\n}\nnew Foo();\n```\n\nCompile and run the file using the TypeScript compiler from the terminal:\n\n```\n$ npm install source-map-support typescript\n$ node_modules/typescript/bin/tsc -sourcemap demo.ts\n$ node demo.js\n\ndemo.ts:5\n  bar() { throw new Error('this is a demo'); }\n                ^\nError: this is a demo\n    at Foo.bar (demo.ts:5:17)\n    at new Foo (demo.ts:4:24)\n    at Object.<anonymous> (demo.ts:7:1)\n    at Module._compile (module.js:456:26)\n    at Object.Module._extensions..js (module.js:474:10)\n    at Module.load (module.js:356:32)\n    at Function.Module._load (module.js:312:12)\n    at Function.Module.runMain (module.js:497:10)\n    at startup (node.js:119:16)\n    at node.js:901:3\n```\n\nThere is also the option to use `-r source-map-support/register` with typescript, without the need add the `require('source-map-support').install()` in the code base:\n\n```\n$ npm install source-map-support typescript\n$ node_modules/typescript/bin/tsc  -sourcemap demo.ts\n$ node -r source-map-support/register demo.js\n\ndemo.ts:5\n  bar() { throw new Error('this is a demo'); }\n                ^\nError: this is a demo\n    at Foo.bar (demo.ts:5:17)\n    at new Foo (demo.ts:4:24)\n    at Object.<anonymous> (demo.ts:7:1)\n    at Module._compile (module.js:456:26)\n    at Object.Module._extensions..js (module.js:474:10)\n    at Module.load (module.js:356:32)\n    at Function.Module._load (module.js:312:12)\n    at Function.Module.runMain (module.js:497:10)\n    at startup (node.js:119:16)\n    at node.js:901:3\n```\n\n#### CoffeeScript Demo\n\ndemo.coffee:\n\n```coffee\nrequire('source-map-support').install()\nfoo = ->\n  bar = -> throw new Error 'this is a demo'\n  bar()\nfoo()\n```\n\nCompile and run the file using the CoffeeScript compiler from the terminal:\n\n```sh\n$ npm install source-map-support coffeescript\n$ node_modules/.bin/coffee --map --compile demo.coffee\n$ node demo.js\n\ndemo.coffee:3\n  bar = -> throw new Error 'this is a demo'\n                     ^\nError: this is a demo\n    at bar (demo.coffee:3:22)\n    at foo (demo.coffee:4:3)\n    at Object.<anonymous> (demo.coffee:5:1)\n    at Object.<anonymous> (demo.coffee:1:1)\n    at Module._compile (module.js:456:26)\n    at Object.Module._extensions..js (module.js:474:10)\n    at Module.load (module.js:356:32)\n    at Function.Module._load (module.js:312:12)\n    at Function.Module.runMain (module.js:497:10)\n    at startup (node.js:119:16)\n```\n\n## Tests\n\nThis repo contains both automated tests for node and manual tests for the browser. The automated tests can be run using mocha (type `mocha` in the root directory). To run the manual tests:\n\n* Build the tests using `build.js`\n* Launch the HTTP server (`npm run serve-tests`) and visit\n  * http://127.0.0.1:1336/amd-test\n  * http://127.0.0.1:1336/browser-test\n  * http://127.0.0.1:1336/browserify-test - **Currently not working** due to a bug with browserify (see [pull request #66](https://github.com/evanw/node-source-map-support/pull/66) for details).\n* For `header-test`, run `server.js` inside that directory and visit http://127.0.0.1:1337/\n\n## License\n\nThis code is available under the [MIT license](http://opensource.org/licenses/MIT).",
   "_attachments": {}

package/npm-cache/_cacache/content-v2/sha512/a6/{63/2ceac1abec8d3f541be3c47ddef506a428995303dd25e8e0e7b00bc92852ef623313c15e776aa5c4dedd718f897a5066db443510e6ee5b0d10212aeca036 → 74/b99620bd09eface84f1f26dd8c064ac54bb9fdc0967e85fa52c149fc849496005c4260f00726f36b891f596af276c9f57f4783ae3e651749715bca5521f6}

@@ -3641,7 +3641,7 @@
   "dist-tags": {
     "latest": "2.0.1"
   },
-  "_rev": "959-8029e6f58ef0a4fe",
+  "_rev": "996-dbaebb948e1b99d1",
   "_id": "path-scurry",
   "readme": "# path-scurry\n\nExtremely high performant utility for building tools that read\nthe file system, minimizing filesystem and path string munging\noperations to the greatest degree possible.\n\n## Ugh, yet another file traversal thing on npm?\n\nYes. None of the existing ones gave me exactly what I wanted.\n\n## Well what is it you wanted?\n\nWhile working on [glob](http://npm.im/glob), I found that I\nneeded a module to very efficiently manage the traversal over a\nfolder tree, such that:\n\n1. No `readdir()` or `stat()` would ever be called on the same\n   file or directory more than one time.\n2. No `readdir()` calls would be made if we can be reasonably\n   sure that the path is not a directory. (Ie, a previous\n   `readdir()` or `stat()` covered the path, and\n   `ent.isDirectory()` is false.)\n3. `path.resolve()`, `dirname()`, `basename()`, and other\n   string-parsing/munging operations are be minimized. This means\n   it has to track \"provisional\" child nodes that may not exist\n   (and if we find that they _don't_ exist, store that\n   information as well, so we don't have to ever check again).\n4. The API is not limited to use as a stream/iterator/etc. There\n   are many cases where an API like node's `fs` is preferrable.\n5. It's more important to prevent excess syscalls than to be up\n   to date, but it should be smart enough to know what it\n   _doesn't_ know, and go get it seamlessly when requested.\n6. Do not blow up the JS heap allocation if operating on a\n   directory with a huge number of entries.\n7. Handle all the weird aspects of Windows paths, like UNC paths\n   and drive letters and wrongway slashes, so that the consumer\n   can return canonical platform-specific paths without having to\n   parse or join or do any error-prone string munging.\n\n## PERFORMANCE\n\nJavaScript people throw around the word \"blazing\" a lot. I hope\nthat this module doesn't blaze anyone. But it does go very fast,\nin the cases it's optimized for, if used properly.\n\nPathScurry provides ample opportunities to get extremely good\nperformance, as well as several options to trade performance for\nconvenience.\n\nBenchmarks can be run by executing `npm run bench`.\n\nAs is always the case, doing more means going slower, doing less\nmeans going faster, and there are trade offs between speed and\nmemory usage.\n\nPathScurry makes heavy use of [LRUCache](http://npm.im/lru-cache)\nto efficiently cache whatever it can, and `Path` objects remain\nin the graph for the lifetime of the walker, so repeated calls\nwith a single PathScurry object will be extremely fast. However,\nadding items to a cold cache means \"doing more\", so in those\ncases, we pay a price. Nothing is free, but every effort has been\nmade to reduce costs wherever possible.\n\nAlso, note that a \"cache as long as possible\" approach means that\nchanges to the filesystem may not be reflected in the results of\nrepeated PathScurry operations.\n\nFor resolving string paths, `PathScurry` ranges from 5-50 times\nfaster than `path.resolve` on repeated resolutions, but around\n100 to 1000 times _slower_ on the first resolution. If your\nprogram is spending a lot of time resolving the _same_ paths\nrepeatedly (like, thousands or millions of times), then this can\nbe beneficial. But both implementations are pretty fast, and\nspeeding up an infrequent operation from 4µs to 400ns is not\ngoing to move the needle on your app's performance.\n\nFor walking file system directory trees, a lot depends on how\noften a given PathScurry object will be used, and also on the\nwalk method used.\n\nWith default settings on a folder tree of 100,000 items,\nconsisting of around a 10-to-1 ratio of normal files to\ndirectories, PathScurry performs comparably to\n[@nodelib/fs.walk](http://npm.im/@nodelib/fs.walk), which is the\nfastest and most reliable file system walker I could find. As far\nas I can tell, it's almost impossible to go much faster in a\nNode.js program, just based on how fast you can push syscalls out\nto the fs thread pool.\n\nOn my machine, that is about 1000-1200 completed walks per second\nfor async or stream walks, and around 500-600 walks per second\nsynchronously.\n\nIn the warm cache state, PathScurry's performance increases\naround 4x for async `for await` iteration, 10-15x faster for\nstreams and synchronous `for of` iteration, and anywhere from 30x\nto 80x faster for the rest.\n\n```\n# walk 100,000 fs entries, 10/1 file/dir ratio\n# operations / ms\n New PathScurry object  |  Reuse PathScurry object\n     stream:  1112.589  |  13974.917\nsync stream:   492.718  |  15028.343\n async walk:  1095.648  |  32706.395\n  sync walk:   527.632  |  46129.772\n async iter:  1288.821  |   5045.510\n  sync iter:   498.496  |  17920.746\n```\n\nA hand-rolled walk calling `entry.readdir()` and recursing\nthrough the entries can benefit even more from caching, with\ngreater flexibility and without the overhead of streams or\ngenerators.\n\nThe cold cache state is still limited by the costs of file system\noperations, but with a warm cache, the only bottleneck is CPU\nspeed and VM optimizations. Of course, in that case, some care\nmust be taken to ensure that you don't lose performance as a\nresult of silly mistakes, like calling `readdir()` on entries\nthat you know are not directories.\n\n```\n# manual recursive iteration functions\n      cold cache  |  warm cache\nasync:  1164.901  |  17923.320\n   cb:  1101.127  |  40999.344\nzalgo:  1082.240  |  66689.936\n sync:   526.935  |  87097.591\n```\n\nIn this case, the speed improves by around 10-20x in the async\ncase, 40x in the case of using `entry.readdirCB` with protections\nagainst synchronous callbacks, and 50-100x with callback\ndeferrals disabled, and _several hundred times faster_ for\nsynchronous iteration.\n\nIf you can think of a case that is not covered in these\nbenchmarks, or an implementation that performs significantly\nbetter than PathScurry, please [let me\nknow](https://github.com/isaacs/path-scurry/issues).\n\n## USAGE\n\n```ts\n// hybrid module, load with either method\nimport { PathScurry, Path } from 'path-scurry'\n// or:\nconst { PathScurry, Path } = require('path-scurry')\n\n// very simple example, say we want to find and\n// delete all the .DS_Store files in a given path\n// note that the API is very similar to just a\n// naive walk with fs.readdir()\nimport { unlink } from 'fs/promises'\n\n// easy way, iterate over the directory and do the thing\nconst pw = new PathScurry(process.cwd())\nfor await (const entry of pw) {\n  if (entry.isFile() && entry.name === '.DS_Store') {\n    unlink(entry.fullpath())\n  }\n}\n\n// here it is as a manual recursive method\nconst walk = async (entry: Path) => {\n  const promises: Promise<any> = []\n  // readdir doesn't throw on non-directories, it just doesn't\n  // return any entries, to save stack trace costs.\n  // Items are returned in arbitrary unsorted order\n  for (const child of await pw.readdir(entry)) {\n    // each child is a Path object\n    if (child.name === '.DS_Store' && child.isFile()) {\n      // could also do pw.resolve(entry, child.name),\n      // just like fs.readdir walking, but .fullpath is\n      // a *slightly* more efficient shorthand.\n      promises.push(unlink(child.fullpath()))\n    } else if (child.isDirectory()) {\n      promises.push(walk(child))\n    }\n  }\n  return Promise.all(promises)\n}\n\nwalk(pw.cwd).then(() => {\n  console.log('all .DS_Store files removed')\n})\n\nconst pw2 = new PathScurry('/a/b/c') // pw2.cwd is the Path for /a/b/c\nconst relativeDir = pw2.cwd.resolve('../x') // Path entry for '/a/b/x'\nconst relative2 = pw2.cwd.resolve('/a/b/d/../x') // same path, same entry\nassert.equal(relativeDir, relative2)\n```\n\n## API\n\n[Full TypeDoc API](https://isaacs.github.io/path-scurry)\n\nThere are platform-specific classes exported, but for the most\npart, the default `PathScurry` and `Path` exports are what you\nmost likely need, unless you are testing behavior for other\nplatforms.\n\nIntended public API is documented here, but the full\ndocumentation does include internal types, which should not be\naccessed directly.\n\n### Interface `PathScurryOpts`\n\nThe type of the `options` argument passed to the `PathScurry`\nconstructor.\n\n- `nocase`: Boolean indicating that file names should be compared\n  case-insensitively. Defaults to `true` on darwin and win32\n  implementations, `false` elsewhere.\n\n  **Warning** Performing case-insensitive matching on a\n  case-sensitive filesystem will result in occasionally very\n  bizarre behavior. Performing case-sensitive matching on a\n  case-insensitive filesystem may negatively impact performance.\n\n- `childrenCacheSize`: Number of child entries to cache, in order\n  to speed up `resolve()` and `readdir()` calls. Defaults to\n  `16 * 1024` (ie, `16384`).\n\n  Setting it to a higher value will run the risk of JS heap\n  allocation errors on large directory trees. Setting it to `256`\n  or smaller will significantly reduce the construction time and\n  data consumption overhead, but with the downside of operations\n  being slower on large directory trees. Setting it to `0` will\n  mean that effectively no operations are cached, and this module\n  will be roughly the same speed as `fs` for file system\n  operations, and _much_ slower than `path.resolve()` for\n  repeated path resolution.\n\n- `fs` An object that will be used to override the default `fs`\n  methods. Any methods that are not overridden will use Node's\n  built-in implementations.\n\n  - lstatSync\n  - readdir (callback `withFileTypes` Dirent variant, used for\n    readdirCB and most walks)\n  - readdirSync\n  - readlinkSync\n  - realpathSync\n  - promises: Object containing the following async methods:\n    - lstat\n    - readdir (Dirent variant only)\n    - readlink\n    - realpath\n\n### Interface `WalkOptions`\n\nThe options object that may be passed to all walk methods.\n\n- `withFileTypes`: Boolean, default true. Indicates that `Path`\n  objects should be returned. Set to `false` to get string paths\n  instead.\n- `follow`: Boolean, default false. Attempt to read directory\n  entries from symbolic links. Otherwise, only actual directories\n  are traversed. Regardless of this setting, a given target path\n  will only ever be walked once, meaning that a symbolic link to\n  a previously traversed directory will never be followed.\n\n  Setting this imposes a slight performance penalty, because\n  `readlink` must be called on all symbolic links encountered, in\n  order to avoid infinite cycles.\n\n- `filter`: Function `(entry: Path) => boolean`. If provided,\n  will prevent the inclusion of any entry for which it returns a\n  falsey value. This will not prevent directories from being\n  traversed if they do not pass the filter, though it will\n  prevent the directories themselves from being included in the\n  results. By default, if no filter is provided, then all entries\n  are included in the results.\n- `walkFilter`: Function `(entry: Path) => boolean`. If provided,\n  will prevent the traversal of any directory (or in the case of\n  `follow:true` symbolic links to directories) for which the\n  function returns false. This will not prevent the directories\n  themselves from being included in the result set. Use `filter`\n  for that.\n\nNote that TypeScript return types will only be inferred properly\nfrom static analysis if the `withFileTypes` option is omitted, or\na constant `true` or `false` value.\n\n### Class `PathScurry`\n\nThe main interface. Defaults to an appropriate class based on the\ncurrent platform.\n\nUse `PathScurryWin32`, `PathScurryDarwin`, or `PathScurryPosix`\nif implementation-specific behavior is desired.\n\nAll walk methods may be called with a `WalkOptions` argument to\nwalk over the object's current working directory with the\nsupplied options.\n\n#### `async pw.walk(entry?: string | Path | WalkOptions, opts?: WalkOptions)`\n\nWalk the directory tree according to the options provided,\nresolving to an array of all entries found.\n\n#### `pw.walkSync(entry?: string | Path | WalkOptions, opts?: WalkOptions)`\n\nWalk the directory tree according to the options provided,\nreturning an array of all entries found.\n\n#### `pw.iterate(entry?: string | Path | WalkOptions, opts?: WalkOptions)`\n\nIterate over the directory asynchronously, for use with `for\nawait of`. This is also the default async iterator method.\n\n#### `pw.iterateSync(entry?: string | Path | WalkOptions, opts?: WalkOptions)`\n\nIterate over the directory synchronously, for use with `for of`.\nThis is also the default sync iterator method.\n\n#### `pw.stream(entry?: string | Path | WalkOptions, opts?: WalkOptions)`\n\nReturn a [Minipass](http://npm.im/minipass) stream that emits\neach entry or path string in the walk. Results are made available\nasynchronously.\n\n#### `pw.streamSync(entry?: string | Path | WalkOptions, opts?: WalkOptions)`\n\nReturn a [Minipass](http://npm.im/minipass) stream that emits\neach entry or path string in the walk. Results are made available\nsynchronously, meaning that the walk will complete in a single\ntick if the stream is fully consumed.\n\n#### `pw.cwd`\n\nPath object representing the current working directory for the\nPathScurry.\n\n#### `pw.chdir(path: string)`\n\nSet the new effective current working directory for the scurry\nobject, so that `path.relative()` and `path.relativePosix()`\nreturn values relative to the new cwd path.\n\n#### `pw.depth(path?: Path | string): number`\n\nReturn the depth of the specified path (or the PathScurry cwd)\nwithin the directory tree.\n\nRoot entries have a depth of `0`.\n\n#### `pw.resolve(...paths: string[])`\n\nCaching `path.resolve()`.\n\nSignificantly faster than `path.resolve()` if called repeatedly\nwith the same paths. Significantly slower otherwise, as it builds\nout the cached Path entries.\n\nTo get a `Path` object resolved from the `PathScurry`, use\n`pw.cwd.resolve(path)`. Note that `Path.resolve` only takes a\nsingle string argument, not multiple.\n\n#### `pw.resolvePosix(...paths: string[])`\n\nCaching `path.resolve()`, but always using posix style paths.\n\nThis is identical to `pw.resolve(...paths)` on posix systems (ie,\neverywhere except Windows).\n\nOn Windows, it returns the full absolute UNC path using `/`\nseparators. Ie, instead of `'C:\\\\foo\\\\bar`, it would return\n`//?/C:/foo/bar`.\n\n#### `pw.relative(path: string | Path): string`\n\nReturn the relative path from the PathWalker cwd to the supplied\npath string or entry.\n\nIf the nearest common ancestor is the root, then an absolute path\nis returned.\n\n#### `pw.relativePosix(path: string | Path): string`\n\nReturn the relative path from the PathWalker cwd to the supplied\npath string or entry, using `/` path separators.\n\nIf the nearest common ancestor is the root, then an absolute path\nis returned.\n\nOn posix platforms (ie, all platforms except Windows), this is\nidentical to `pw.relative(path)`.\n\nOn Windows systems, it returns the resulting string as a\n`/`-delimited path. If an absolute path is returned (because the\ntarget does not share a common ancestor with `pw.cwd`), then a\nfull absolute UNC path will be returned. Ie, instead of\n`'C:\\\\foo\\\\bar`, it would return `//?/C:/foo/bar`.\n\n#### `pw.basename(path: string | Path): string`\n\nReturn the basename of the provided string or Path.\n\n#### `pw.dirname(path: string | Path): string`\n\nReturn the parent directory of the supplied string or Path.\n\n#### `async pw.readdir(dir = pw.cwd, opts = { withFileTypes: true })`\n\nRead the directory and resolve to an array of strings if\n`withFileTypes` is explicitly set to `false` or Path objects\notherwise.\n\nCan be called as `pw.readdir({ withFileTypes: boolean })` as\nwell.\n\nReturns `[]` if no entries are found, or if any error occurs.\n\nNote that TypeScript return types will only be inferred properly\nfrom static analysis if the `withFileTypes` option is omitted, or\na constant `true` or `false` value.\n\n#### `pw.readdirSync(dir = pw.cwd, opts = { withFileTypes: true })`\n\nSynchronous `pw.readdir()`\n\n#### `async pw.readlink(link = pw.cwd, opts = { withFileTypes: false })`\n\nCall `fs.readlink` on the supplied string or Path object, and\nreturn the result.\n\nCan be called as `pw.readlink({ withFileTypes: boolean })` as\nwell.\n\nReturns `undefined` if any error occurs (for example, if the\nargument is not a symbolic link), or a `Path` object if\n`withFileTypes` is explicitly set to `true`, or a string\notherwise.\n\nNote that TypeScript return types will only be inferred properly\nfrom static analysis if the `withFileTypes` option is omitted, or\na constant `true` or `false` value.\n\n#### `pw.readlinkSync(link = pw.cwd, opts = { withFileTypes: false })`\n\nSynchronous `pw.readlink()`\n\n#### `async pw.lstat(entry = pw.cwd)`\n\nCall `fs.lstat` on the supplied string or Path object, and fill\nin as much information as possible, returning the updated `Path`\nobject.\n\nReturns `undefined` if the entry does not exist, or if any error\nis encountered.\n\nNote that some `Stats` data (such as `ino`, `dev`, and `mode`)\nwill not be supplied. For those things, you'll need to call\n`fs.lstat` yourself.\n\n#### `pw.lstatSync(entry = pw.cwd)`\n\nSynchronous `pw.lstat()`\n\n#### `pw.realpath(entry = pw.cwd, opts = { withFileTypes: false })`\n\nCall `fs.realpath` on the supplied string or Path object, and\nreturn the realpath if available.\n\nReturns `undefined` if any error occurs.\n\nMay be called as `pw.realpath({ withFileTypes: boolean })` to run\non `pw.cwd`.\n\n#### `pw.realpathSync(entry = pw.cwd, opts = { withFileTypes: false })`\n\nSynchronous `pw.realpath()`\n\n### Class `Path` implements [fs.Dirent](https://nodejs.org/docs/latest/api/fs.html#class-fsdirent)\n\nObject representing a given path on the filesystem, which may or\nmay not exist.\n\nNote that the actual class in use will be either `PathWin32` or\n`PathPosix`, depending on the implementation of `PathScurry` in\nuse. They differ in the separators used to split and join path\nstrings, and the handling of root paths.\n\nIn `PathPosix` implementations, paths are split and joined using\nthe `'/'` character, and `'/'` is the only root path ever in use.\n\nIn `PathWin32` implementations, paths are split using either\n`'/'` or `'\\\\'` and joined using `'\\\\'`, and multiple roots may\nbe in use based on the drives and UNC paths encountered. UNC\npaths such as `//?/C:/` that identify a drive letter, will be\ntreated as an alias for the same root entry as their associated\ndrive letter (in this case `'C:\\\\'`).\n\n#### `path.name`\n\nName of this file system entry.\n\n**Important**: _always_ test the path name against any test\nstring using the `isNamed` method, and not by directly comparing\nthis string. Otherwise, unicode path strings that the system sees\nas identical will not be properly treated as the same path,\nleading to incorrect behavior and possible security issues.\n\n#### `path.isNamed(name: string): boolean`\n\nReturn true if the path is a match for the given path name. This\nhandles case sensitivity and unicode normalization.\n\nNote: even on case-sensitive systems, it is **not** safe to test\nthe equality of the `.name` property to determine whether a given\npathname matches, due to unicode normalization mismatches.\n\nAlways use this method instead of testing the `path.name`\nproperty directly.\n\n#### `path.isCWD`\n\nSet to true if this `Path` object is the current working\ndirectory of the `PathScurry` collection that contains it.\n\n#### `path.getType()`\n\nReturns the type of the Path object, `'File'`, `'Directory'`,\netc.\n\n#### `path.isType(t: type)`\n\nReturns true if `is{t}()` returns true.\n\nFor example, `path.isType('Directory')` is equivalent to\n`path.isDirectory()`.\n\n#### `path.depth()`\n\nReturn the depth of the Path entry within the directory tree.\nRoot paths have a depth of `0`.\n\n#### `path.fullpath()`\n\nThe fully resolved path to the entry.\n\n#### `path.fullpathPosix()`\n\nThe fully resolved path to the entry, using `/` separators.\n\nOn posix systems, this is identical to `path.fullpath()`. On\nwindows, this will return a fully resolved absolute UNC path\nusing `/` separators. Eg, instead of `'C:\\\\foo\\\\bar'`, it will\nreturn `'//?/C:/foo/bar'`.\n\n#### `path.isFile()`, `path.isDirectory()`, etc.\n\nSame as the identical `fs.Dirent.isX()` methods.\n\n#### `path.isUnknown()`\n\nReturns true if the path's type is unknown. Always returns true\nwhen the path is known to not exist.\n\n#### `path.resolve(p: string)`\n\nReturn a `Path` object associated with the provided path string\nas resolved from the current Path object.\n\n#### `path.relative(): string`\n\nReturn the relative path from the PathWalker cwd to the supplied\npath string or entry.\n\nIf the nearest common ancestor is the root, then an absolute path\nis returned.\n\n#### `path.relativePosix(): string`\n\nReturn the relative path from the PathWalker cwd to the supplied\npath string or entry, using `/` path separators.\n\nIf the nearest common ancestor is the root, then an absolute path\nis returned.\n\nOn posix platforms (ie, all platforms except Windows), this is\nidentical to `pw.relative(path)`.\n\nOn Windows systems, it returns the resulting string as a\n`/`-delimited path. If an absolute path is returned (because the\ntarget does not share a common ancestor with `pw.cwd`), then a\nfull absolute UNC path will be returned. Ie, instead of\n`'C:\\\\foo\\\\bar`, it would return `//?/C:/foo/bar`.\n\n#### `async path.readdir()`\n\nReturn an array of `Path` objects found by reading the associated\npath entry.\n\nIf path is not a directory, or if any error occurs, returns `[]`,\nand marks all children as provisional and non-existent.\n\n#### `path.readdirSync()`\n\nSynchronous `path.readdir()`\n\n#### `async path.readlink()`\n\nReturn the `Path` object referenced by the `path` as a symbolic\nlink.\n\nIf the `path` is not a symbolic link, or any error occurs,\nreturns `undefined`.\n\n#### `path.readlinkSync()`\n\nSynchronous `path.readlink()`\n\n#### `async path.lstat()`\n\nCall `lstat` on the path object, and fill it in with details\ndetermined.\n\nIf path does not exist, or any other error occurs, returns\n`undefined`, and marks the path as \"unknown\" type.\n\n#### `path.lstatSync()`\n\nSynchronous `path.lstat()`\n\n#### `async path.realpath()`\n\nCall `realpath` on the path, and return a Path object\ncorresponding to the result, or `undefined` if any error occurs.\n\n#### `path.realpathSync()`\n\nSynchornous `path.realpath()`",
   "_attachments": {}

package/npm-cache/_cacache/content-v2/sha512/{43/e2/9e4c8659d729635df12e659e3a73abcc28644ebf63784b6be809dac7aaac73428417cd6404ec0af6569b1a04d69d1f4723f113424033abf5d2bd81ade724 → a7/f8/c211ebfc7996d3f2257d6c3fcfe16719ec360cbbf8fdc8817e7162e5795c7742e25e1d35970bebef9f85ee035890b2e8204e2cc1b2849eb9e71df7b2dfe0}

@@ -969,7 +969,7 @@
   "dist-tags": {
     "latest": "0.11.0"
   },
-  "_rev": "911-9e7b8d9cd4f7a0cc",
+  "_rev": "948-75c9230a6e2d1105",
   "_id": "@pkgjs/parseargs",
   "readme": "<!-- omit in toc -->\n# parseArgs\n\n[![Coverage][coverage-image]][coverage-url]\n\nPolyfill of `util.parseArgs()`\n\n## `util.parseArgs([config])`\n\n<!-- YAML\nadded: v18.3.0\nchanges:\n  - version: REPLACEME\n    pr-url: https://github.com/nodejs/node/pull/43459\n    description: add support for returning detailed parse information\n                 using `tokens` in input `config` and returned properties.\n-->\n\n> Stability: 1 - Experimental\n\n* `config` {Object} Used to provide arguments for parsing and to configure\n  the parser. `config` supports the following properties:\n  * `args` {string\\[]} array of argument strings. **Default:** `process.argv`\n    with `execPath` and `filename` removed.\n  * `options` {Object} Used to describe arguments known to the parser.\n    Keys of `options` are the long names of options and values are an\n    {Object} accepting the following properties:\n    * `type` {string} Type of argument, which must be either `boolean` or `string`.\n    * `multiple` {boolean} Whether this option can be provided multiple\n      times. If `true`, all values will be collected in an array. If\n      `false`, values for the option are last-wins. **Default:** `false`.\n    * `short` {string} A single character alias for the option.\n    * `default` {string | boolean | string\\[] | boolean\\[]} The default option\n      value when it is not set by args. It must be of the same type as the\n      the `type` property. When `multiple` is `true`, it must be an array.\n  * `strict` {boolean} Should an error be thrown when unknown arguments\n    are encountered, or when arguments are passed that do not match the\n    `type` configured in `options`.\n    **Default:** `true`.\n  * `allowPositionals` {boolean} Whether this command accepts positional\n    arguments.\n    **Default:** `false` if `strict` is `true`, otherwise `true`.\n  * `tokens` {boolean} Return the parsed tokens. This is useful for extending\n    the built-in behavior, from adding additional checks through to reprocessing\n    the tokens in different ways.\n    **Default:** `false`.\n\n* Returns: {Object} The parsed command line arguments:\n  * `values` {Object} A mapping of parsed option names with their {string}\n    or {boolean} values.\n  * `positionals` {string\\[]} Positional arguments.\n  * `tokens` {Object\\[] | undefined} See [parseArgs tokens](#parseargs-tokens)\n    section. Only returned if `config` includes `tokens: true`.\n\nProvides a higher level API for command-line argument parsing than interacting\nwith `process.argv` directly. Takes a specification for the expected arguments\nand returns a structured object with the parsed options and positionals.\n\n```mjs\nimport { parseArgs } from 'node:util';\nconst args = ['-f', '--bar', 'b'];\nconst options = {\n  foo: {\n    type: 'boolean',\n    short: 'f'\n  },\n  bar: {\n    type: 'string'\n  }\n};\nconst {\n  values,\n  positionals\n} = parseArgs({ args, options });\nconsole.log(values, positionals);\n// Prints: [Object: null prototype] { foo: true, bar: 'b' } []\n```\n\n```cjs\nconst { parseArgs } = require('node:util');\nconst args = ['-f', '--bar', 'b'];\nconst options = {\n  foo: {\n    type: 'boolean',\n    short: 'f'\n  },\n  bar: {\n    type: 'string'\n  }\n};\nconst {\n  values,\n  positionals\n} = parseArgs({ args, options });\nconsole.log(values, positionals);\n// Prints: [Object: null prototype] { foo: true, bar: 'b' } []\n```\n\n`util.parseArgs` is experimental and behavior may change. Join the\nconversation in [pkgjs/parseargs][] to contribute to the design.\n\n### `parseArgs` `tokens`\n\nDetailed parse information is available for adding custom behaviours by\nspecifying `tokens: true` in the configuration.\nThe returned tokens have properties describing:\n\n* all tokens\n  * `kind` {string} One of 'option', 'positional', or 'option-terminator'.\n  * `index` {number} Index of element in `args` containing token. So the\n    source argument for a token is `args[token.index]`.\n* option tokens\n  * `name` {string} Long name of option.\n  * `rawName` {string} How option used in args, like `-f` of `--foo`.\n  * `value` {string | undefined} Option value specified in args.\n    Undefined for boolean options.\n  * `inlineValue` {boolean | undefined} Whether option value specified inline,\n    like `--foo=bar`.\n* positional tokens\n  * `value` {string} The value of the positional argument in args (i.e. `args[index]`).\n* option-terminator token\n\nThe returned tokens are in the order encountered in the input args. Options\nthat appear more than once in args produce a token for each use. Short option\ngroups like `-xy` expand to a token for each option. So `-xxx` produces\nthree tokens.\n\nFor example to use the returned tokens to add support for a negated option\nlike `--no-color`, the tokens can be reprocessed to change the value stored\nfor the negated option.\n\n```mjs\nimport { parseArgs } from 'node:util';\n\nconst options = {\n  'color': { type: 'boolean' },\n  'no-color': { type: 'boolean' },\n  'logfile': { type: 'string' },\n  'no-logfile': { type: 'boolean' },\n};\nconst { values, tokens } = parseArgs({ options, tokens: true });\n\n// Reprocess the option tokens and overwrite the returned values.\ntokens\n  .filter((token) => token.kind === 'option')\n  .forEach((token) => {\n    if (token.name.startsWith('no-')) {\n      // Store foo:false for --no-foo\n      const positiveName = token.name.slice(3);\n      values[positiveName] = false;\n      delete values[token.name];\n    } else {\n      // Resave value so last one wins if both --foo and --no-foo.\n      values[token.name] = token.value ?? true;\n    }\n  });\n\nconst color = values.color;\nconst logfile = values.logfile ?? 'default.log';\n\nconsole.log({ logfile, color });\n```\n\n```cjs\nconst { parseArgs } = require('node:util');\n\nconst options = {\n  'color': { type: 'boolean' },\n  'no-color': { type: 'boolean' },\n  'logfile': { type: 'string' },\n  'no-logfile': { type: 'boolean' },\n};\nconst { values, tokens } = parseArgs({ options, tokens: true });\n\n// Reprocess the option tokens and overwrite the returned values.\ntokens\n  .filter((token) => token.kind === 'option')\n  .forEach((token) => {\n    if (token.name.startsWith('no-')) {\n      // Store foo:false for --no-foo\n      const positiveName = token.name.slice(3);\n      values[positiveName] = false;\n      delete values[token.name];\n    } else {\n      // Resave value so last one wins if both --foo and --no-foo.\n      values[token.name] = token.value ?? true;\n    }\n  });\n\nconst color = values.color;\nconst logfile = values.logfile ?? 'default.log';\n\nconsole.log({ logfile, color });\n```\n\nExample usage showing negated options, and when an option is used\nmultiple ways then last one wins.\n\n```console\n$ node negate.js\n{ logfile: 'default.log', color: undefined }\n$ node negate.js --no-logfile --no-color\n{ logfile: false, color: false }\n$ node negate.js --logfile=test.log --color\n{ logfile: 'test.log', color: true }\n$ node negate.js --no-logfile --logfile=test.log --color --no-color\n{ logfile: 'test.log', color: false }\n```\n\n-----\n\n<!-- omit in toc -->\n## Table of Contents\n- [`util.parseArgs([config])`](#utilparseargsconfig)\n- [Scope](#scope)\n- [Version Matchups](#version-matchups)\n- [🚀 Getting Started](#-getting-started)\n- [🙌 Contributing](#-contributing)\n- [💡 `process.mainArgs` Proposal](#-processmainargs-proposal)\n  - [Implementation:](#implementation)\n- [📃 Examples](#-examples)\n- [F.A.Qs](#faqs)\n- [Links & Resources](#links--resources)\n\n-----\n\n## Scope\n\nIt is already possible to build great arg parsing modules on top of what Node.js provides; the prickly API is abstracted away by these modules. Thus, process.parseArgs() is not necessarily intended for library authors; it is intended for developers of simple CLI tools, ad-hoc scripts, deployed Node.js applications, and learning materials.\n\nIt is exceedingly difficult to provide an API which would both be friendly to these Node.js users while being extensible enough for libraries to build upon. We chose to prioritize these use cases because these are currently not well-served by Node.js' API.\n\n----\n\n## Version Matchups\n\n| Node.js | @pkgjs/parseArgs |\n| -- | -- |\n| [v18.3.0](https://nodejs.org/docs/latest-v18.x/api/util.html#utilparseargsconfig) | [v0.9.1](https://github.com/pkgjs/parseargs/tree/v0.9.1#utilparseargsconfig) |\n| [v16.17.0](https://nodejs.org/dist/latest-v16.x/docs/api/util.html#utilparseargsconfig), [v18.7.0](https://nodejs.org/docs/latest-v18.x/api/util.html#utilparseargsconfig) | [0.10.0](https://github.com/pkgjs/parseargs/tree/v0.10.0#utilparseargsconfig) |\n\n----\n\n## 🚀 Getting Started\n\n1. **Install dependencies.**\n\n   ```bash\n   npm install\n   ```\n\n2. **Open the index.js file and start editing!**\n\n3. **Test your code by calling parseArgs through our test file**\n\n   ```bash\n   npm test\n   ```\n\n----\n\n## 🙌 Contributing\n\nAny person who wants to contribute to the initiative is welcome! Please first read the [Contributing Guide](CONTRIBUTING.md)\n\nAdditionally, reading the [`Examples w/ Output`](#-examples-w-output) section of this document will be the best way to familiarize yourself with the target expected behavior for parseArgs() once it is fully implemented.\n\nThis package was implemented using [tape](https://www.npmjs.com/package/tape) as its test harness.\n\n----\n\n## 💡 `process.mainArgs` Proposal\n\n> Note: This can be moved forward independently of the `util.parseArgs()` proposal/work.\n\n### Implementation:\n\n```javascript\nprocess.mainArgs = process.argv.slice(process._exec ? 1 : 2)\n```\n\n----\n\n## 📃 Examples\n\n```js\nconst { parseArgs } = require('@pkgjs/parseargs');\n```\n\n```js\nconst { parseArgs } = require('@pkgjs/parseargs');\n// specify the options that may be used\nconst options = {\n  foo: { type: 'string'},\n  bar: { type: 'boolean' },\n};\nconst args = ['--foo=a', '--bar'];\nconst { values, positionals } = parseArgs({ args, options });\n// values = { foo: 'a', bar: true }\n// positionals = []\n```\n\n```js\nconst { parseArgs } = require('@pkgjs/parseargs');\n// type:string & multiple\nconst options = {\n  foo: {\n    type: 'string',\n    multiple: true,\n  },\n};\nconst args = ['--foo=a', '--foo', 'b'];\nconst { values, positionals } = parseArgs({ args, options });\n// values = { foo: [ 'a', 'b' ] }\n// positionals = []\n```\n\n```js\nconst { parseArgs } = require('@pkgjs/parseargs');\n// shorts\nconst options = {\n  foo: {\n    short: 'f',\n    type: 'boolean'\n  },\n};\nconst args = ['-f', 'b'];\nconst { values, positionals } = parseArgs({ args, options, allowPositionals: true });\n// values = { foo: true }\n// positionals = ['b']\n```\n\n```js\nconst { parseArgs } = require('@pkgjs/parseargs');\n// unconfigured\nconst options = {};\nconst args = ['-f', '--foo=a', '--bar', 'b'];\nconst { values, positionals } = parseArgs({ strict: false, args, options, allowPositionals: true });\n// values = { f: true, foo: 'a', bar: true }\n// positionals = ['b']\n```\n\n----\n\n## F.A.Qs\n\n- Is `cmd --foo=bar baz` the same as `cmd baz --foo=bar`?\n  - yes\n- Does the parser execute a function?\n  - no\n- Does the parser execute one of several functions, depending on input?\n  - no\n- Can subcommands take options that are distinct from the main command?\n  - no\n- Does it output generated help when no options match?\n  - no\n- Does it generated short usage?  Like: `usage: ls [-ABCFGHLOPRSTUWabcdefghiklmnopqrstuwx1] [file ...]`\n  - no (no usage/help at all)\n- Does the user provide the long usage text?  For each option?  For the whole command?\n  - no\n- Do subcommands (if implemented) have their own usage output?\n  - no\n- Does usage print if the user runs `cmd --help`?\n  - no\n- Does it set `process.exitCode`?\n  - no\n- Does usage print to stderr or stdout?\n  - N/A\n- Does it check types?  (Say, specify that an option is a boolean, number, etc.)\n  - no\n- Can an option have more than one type?  (string or false, for example)\n  - no\n- Can the user define a type?  (Say, `type: path` to call `path.resolve()` on the argument.)\n  - no\n- Does a `--foo=0o22` mean 0, 22, 18, or \"0o22\"?\n  - `\"0o22\"`\n- Does it coerce types?\n  - no\n- Does `--no-foo` coerce to `--foo=false`?  For all options?  Only boolean options?\n  - no, it sets `{values:{'no-foo': true}}`\n- Is `--foo` the same as `--foo=true`?  Only for known booleans?  Only at the end?\n  - no, they are not the same. There is no special handling of `true` as a value so it is just another string.\n- Does it read environment variables?  Ie, is `FOO=1 cmd` the same as `cmd --foo=1`?\n  - no\n- Do unknown arguments raise an error?  Are they parsed?  Are they treated as positional arguments?\n  - no, they are parsed, not treated as positionals\n- Does `--` signal the end of options?\n  - yes\n- Is `--` included as a positional?\n  - no\n- Is `program -- foo` the same as `program foo`?\n  - yes, both store `{positionals:['foo']}`\n- Does the API specify whether a `--` was present/relevant?\n  - no\n- Is `-bar` the same as `--bar`?\n  - no, `-bar` is a short option or options, with expansion logic that follows the\n    [Utility Syntax Guidelines in POSIX.1-2017](https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html). `-bar` expands to `-b`, `-a`, `-r`.\n- Is `---foo` the same as `--foo`?\n  - no\n  - the first is a long option named `'-foo'`\n  - the second is a long option named `'foo'`\n- Is `-` a positional? ie, `bash some-test.sh | tap -`\n  - yes\n\n## Links & Resources\n\n* [Initial Tooling Issue](https://github.com/nodejs/tooling/issues/19)\n* [Initial Proposal](https://github.com/nodejs/node/pull/35015)\n* [parseArgs Proposal](https://github.com/nodejs/node/pull/42675)\n\n[coverage-image]: https://img.shields.io/nycrc/pkgjs/parseargs\n[coverage-url]: https://github.com/pkgjs/parseargs/blob/main/.nycrc\n[pkgjs/parseargs]: https://github.com/pkgjs/parseargs",
   "_attachments": {}

package/npm-cache/_cacache/content-v2/sha512/{2d/78/e1f9c079895e6380b813f9b655e7f8c604ffd3868299963f5deb4846df80c1a992ed679224d2522c5d8dd1b1039b03ea3ca04948bddf69cc0eadd0b94d09 → a8/79/5dc77753caad78edf5e8e816dd5bf52b406614bfe4e76a1c9fe84ed2d9d13f140e87f85881d34c59deadc631bdae1a2859018dfc4541af02e454aa6b67c6}

@@ -758,7 +758,7 @@
   "dist-tags": {
     "latest": "5.2.1"
   },
-  "_rev": "3650-b1165e26defc5df9",
+  "_rev": "3766-a964e24648e7e55a",
   "_id": "safe-buffer",
   "readme": "# safe-buffer [![travis][travis-image]][travis-url] [![npm][npm-image]][npm-url] [![downloads][downloads-image]][downloads-url] [![javascript style guide][standard-image]][standard-url]\n\n[travis-image]: https://img.shields.io/travis/feross/safe-buffer/master.svg\n[travis-url]: https://travis-ci.org/feross/safe-buffer\n[npm-image]: https://img.shields.io/npm/v/safe-buffer.svg\n[npm-url]: https://npmjs.org/package/safe-buffer\n[downloads-image]: https://img.shields.io/npm/dm/safe-buffer.svg\n[downloads-url]: https://npmjs.org/package/safe-buffer\n[standard-image]: https://img.shields.io/badge/code_style-standard-brightgreen.svg\n[standard-url]: https://standardjs.com\n\n#### Safer Node.js Buffer API\n\n**Use the new Node.js Buffer APIs (`Buffer.from`, `Buffer.alloc`,\n`Buffer.allocUnsafe`, `Buffer.allocUnsafeSlow`) in all versions of Node.js.**\n\n**Uses the built-in implementation when available.**\n\n## install\n\n```\nnpm install safe-buffer\n```\n\n## usage\n\nThe goal of this package is to provide a safe replacement for the node.js `Buffer`.\n\nIt's a drop-in replacement for `Buffer`. You can use it by adding one `require` line to\nthe top of your node.js modules:\n\n```js\nvar Buffer = require('safe-buffer').Buffer\n\n// Existing buffer code will continue to work without issues:\n\nnew Buffer('hey', 'utf8')\nnew Buffer([1, 2, 3], 'utf8')\nnew Buffer(obj)\nnew Buffer(16) // create an uninitialized buffer (potentially unsafe)\n\n// But you can use these new explicit APIs to make clear what you want:\n\nBuffer.from('hey', 'utf8') // convert from many types to a Buffer\nBuffer.alloc(16) // create a zero-filled buffer (safe)\nBuffer.allocUnsafe(16) // create an uninitialized buffer (potentially unsafe)\n```\n\n## api\n\n### Class Method: Buffer.from(array)\n<!-- YAML\nadded: v3.0.0\n-->\n\n* `array` {Array}\n\nAllocates a new `Buffer` using an `array` of octets.\n\n```js\nconst buf = Buffer.from([0x62,0x75,0x66,0x66,0x65,0x72]);\n  // creates a new Buffer containing ASCII bytes\n  // ['b','u','f','f','e','r']\n```\n\nA `TypeError` will be thrown if `array` is not an `Array`.\n\n### Class Method: Buffer.from(arrayBuffer[, byteOffset[, length]])\n<!-- YAML\nadded: v5.10.0\n-->\n\n* `arrayBuffer` {ArrayBuffer} The `.buffer` property of a `TypedArray` or\n  a `new ArrayBuffer()`\n* `byteOffset` {Number} Default: `0`\n* `length` {Number} Default: `arrayBuffer.length - byteOffset`\n\nWhen passed a reference to the `.buffer` property of a `TypedArray` instance,\nthe newly created `Buffer` will share the same allocated memory as the\nTypedArray.\n\n```js\nconst arr = new Uint16Array(2);\narr[0] = 5000;\narr[1] = 4000;\n\nconst buf = Buffer.from(arr.buffer); // shares the memory with arr;\n\nconsole.log(buf);\n  // Prints: <Buffer 88 13 a0 0f>\n\n// changing the TypedArray changes the Buffer also\narr[1] = 6000;\n\nconsole.log(buf);\n  // Prints: <Buffer 88 13 70 17>\n```\n\nThe optional `byteOffset` and `length` arguments specify a memory range within\nthe `arrayBuffer` that will be shared by the `Buffer`.\n\n```js\nconst ab = new ArrayBuffer(10);\nconst buf = Buffer.from(ab, 0, 2);\nconsole.log(buf.length);\n  // Prints: 2\n```\n\nA `TypeError` will be thrown if `arrayBuffer` is not an `ArrayBuffer`.\n\n### Class Method: Buffer.from(buffer)\n<!-- YAML\nadded: v3.0.0\n-->\n\n* `buffer` {Buffer}\n\nCopies the passed `buffer` data onto a new `Buffer` instance.\n\n```js\nconst buf1 = Buffer.from('buffer');\nconst buf2 = Buffer.from(buf1);\n\nbuf1[0] = 0x61;\nconsole.log(buf1.toString());\n  // 'auffer'\nconsole.log(buf2.toString());\n  // 'buffer' (copy is not changed)\n```\n\nA `TypeError` will be thrown if `buffer` is not a `Buffer`.\n\n### Class Method: Buffer.from(str[, encoding])\n<!-- YAML\nadded: v5.10.0\n-->\n\n* `str` {String} String to encode.\n* `encoding` {String} Encoding to use, Default: `'utf8'`\n\nCreates a new `Buffer` containing the given JavaScript string `str`. If\nprovided, the `encoding` parameter identifies the character encoding.\nIf not provided, `encoding` defaults to `'utf8'`.\n\n```js\nconst buf1 = Buffer.from('this is a tést');\nconsole.log(buf1.toString());\n  // prints: this is a tést\nconsole.log(buf1.toString('ascii'));\n  // prints: this is a tC)st\n\nconst buf2 = Buffer.from('7468697320697320612074c3a97374', 'hex');\nconsole.log(buf2.toString());\n  // prints: this is a tést\n```\n\nA `TypeError` will be thrown if `str` is not a string.\n\n### Class Method: Buffer.alloc(size[, fill[, encoding]])\n<!-- YAML\nadded: v5.10.0\n-->\n\n* `size` {Number}\n* `fill` {Value} Default: `undefined`\n* `encoding` {String} Default: `utf8`\n\nAllocates a new `Buffer` of `size` bytes. If `fill` is `undefined`, the\n`Buffer` will be *zero-filled*.\n\n```js\nconst buf = Buffer.alloc(5);\nconsole.log(buf);\n  // <Buffer 00 00 00 00 00>\n```\n\nThe `size` must be less than or equal to the value of\n`require('buffer').kMaxLength` (on 64-bit architectures, `kMaxLength` is\n`(2^31)-1`). Otherwise, a [`RangeError`][] is thrown. A zero-length Buffer will\nbe created if a `size` less than or equal to 0 is specified.\n\nIf `fill` is specified, the allocated `Buffer` will be initialized by calling\n`buf.fill(fill)`. See [`buf.fill()`][] for more information.\n\n```js\nconst buf = Buffer.alloc(5, 'a');\nconsole.log(buf);\n  // <Buffer 61 61 61 61 61>\n```\n\nIf both `fill` and `encoding` are specified, the allocated `Buffer` will be\ninitialized by calling `buf.fill(fill, encoding)`. For example:\n\n```js\nconst buf = Buffer.alloc(11, 'aGVsbG8gd29ybGQ=', 'base64');\nconsole.log(buf);\n  // <Buffer 68 65 6c 6c 6f 20 77 6f 72 6c 64>\n```\n\nCalling `Buffer.alloc(size)` can be significantly slower than the alternative\n`Buffer.allocUnsafe(size)` but ensures that the newly created `Buffer` instance\ncontents will *never contain sensitive data*.\n\nA `TypeError` will be thrown if `size` is not a number.\n\n### Class Method: Buffer.allocUnsafe(size)\n<!-- YAML\nadded: v5.10.0\n-->\n\n* `size` {Number}\n\nAllocates a new *non-zero-filled* `Buffer` of `size` bytes.  The `size` must\nbe less than or equal to the value of `require('buffer').kMaxLength` (on 64-bit\narchitectures, `kMaxLength` is `(2^31)-1`). Otherwise, a [`RangeError`][] is\nthrown. A zero-length Buffer will be created if a `size` less than or equal to\n0 is specified.\n\nThe underlying memory for `Buffer` instances created in this way is *not\ninitialized*. The contents of the newly created `Buffer` are unknown and\n*may contain sensitive data*. Use [`buf.fill(0)`][] to initialize such\n`Buffer` instances to zeroes.\n\n```js\nconst buf = Buffer.allocUnsafe(5);\nconsole.log(buf);\n  // <Buffer 78 e0 82 02 01>\n  // (octets will be different, every time)\nbuf.fill(0);\nconsole.log(buf);\n  // <Buffer 00 00 00 00 00>\n```\n\nA `TypeError` will be thrown if `size` is not a number.\n\nNote that the `Buffer` module pre-allocates an internal `Buffer` instance of\nsize `Buffer.poolSize` that is used as a pool for the fast allocation of new\n`Buffer` instances created using `Buffer.allocUnsafe(size)` (and the deprecated\n`new Buffer(size)` constructor) only when `size` is less than or equal to\n`Buffer.poolSize >> 1` (floor of `Buffer.poolSize` divided by two). The default\nvalue of `Buffer.poolSize` is `8192` but can be modified.\n\nUse of this pre-allocated internal memory pool is a key difference between\ncalling `Buffer.alloc(size, fill)` vs. `Buffer.allocUnsafe(size).fill(fill)`.\nSpecifically, `Buffer.alloc(size, fill)` will *never* use the internal Buffer\npool, while `Buffer.allocUnsafe(size).fill(fill)` *will* use the internal\nBuffer pool if `size` is less than or equal to half `Buffer.poolSize`. The\ndifference is subtle but can be important when an application requires the\nadditional performance that `Buffer.allocUnsafe(size)` provides.\n\n### Class Method: Buffer.allocUnsafeSlow(size)\n<!-- YAML\nadded: v5.10.0\n-->\n\n* `size` {Number}\n\nAllocates a new *non-zero-filled* and non-pooled `Buffer` of `size` bytes.  The\n`size` must be less than or equal to the value of\n`require('buffer').kMaxLength` (on 64-bit architectures, `kMaxLength` is\n`(2^31)-1`). Otherwise, a [`RangeError`][] is thrown. A zero-length Buffer will\nbe created if a `size` less than or equal to 0 is specified.\n\nThe underlying memory for `Buffer` instances created in this way is *not\ninitialized*. The contents of the newly created `Buffer` are unknown and\n*may contain sensitive data*. Use [`buf.fill(0)`][] to initialize such\n`Buffer` instances to zeroes.\n\nWhen using `Buffer.allocUnsafe()` to allocate new `Buffer` instances,\nallocations under 4KB are, by default, sliced from a single pre-allocated\n`Buffer`. This allows applications to avoid the garbage collection overhead of\ncreating many individually allocated Buffers. This approach improves both\nperformance and memory usage by eliminating the need to track and cleanup as\nmany `Persistent` objects.\n\nHowever, in the case where a developer may need to retain a small chunk of\nmemory from a pool for an indeterminate amount of time, it may be appropriate\nto create an un-pooled Buffer instance using `Buffer.allocUnsafeSlow()` then\ncopy out the relevant bits.\n\n```js\n// need to keep around a few small chunks of memory\nconst store = [];\n\nsocket.on('readable', () => {\n  const data = socket.read();\n  // allocate for retained data\n  const sb = Buffer.allocUnsafeSlow(10);\n  // copy the data into the new allocation\n  data.copy(sb, 0, 0, 10);\n  store.push(sb);\n});\n```\n\nUse of `Buffer.allocUnsafeSlow()` should be used only as a last resort *after*\na developer has observed undue memory retention in their applications.\n\nA `TypeError` will be thrown if `size` is not a number.\n\n### All the Rest\n\nThe rest of the `Buffer` API is exactly the same as in node.js.\n[See the docs](https://nodejs.org/api/buffer.html).\n\n\n## Related links\n\n- [Node.js issue: Buffer(number) is unsafe](https://github.com/nodejs/node/issues/4660)\n- [Node.js Enhancement Proposal: Buffer.from/Buffer.alloc/Buffer.zalloc/Buffer() soft-deprecate](https://github.com/nodejs/node-eps/pull/4)\n\n## Why is `Buffer` unsafe?\n\nToday, the node.js `Buffer` constructor is overloaded to handle many different argument\ntypes like `String`, `Array`, `Object`, `TypedArrayView` (`Uint8Array`, etc.),\n`ArrayBuffer`, and also `Number`.\n\nThe API is optimized for convenience: you can throw any type at it, and it will try to do\nwhat you want.\n\nBecause the Buffer constructor is so powerful, you often see code like this:\n\n```js\n// Convert UTF-8 strings to hex\nfunction toHex (str) {\n  return new Buffer(str).toString('hex')\n}\n```\n\n***But what happens if `toHex` is called with a `Number` argument?***\n\n### Remote Memory Disclosure\n\nIf an attacker can make your program call the `Buffer` constructor with a `Number`\nargument, then they can make it allocate uninitialized memory from the node.js process.\nThis could potentially disclose TLS private keys, user data, or database passwords.\n\nWhen the `Buffer` constructor is passed a `Number` argument, it returns an\n**UNINITIALIZED** block of memory of the specified `size`. When you create a `Buffer` like\nthis, you **MUST** overwrite the contents before returning it to the user.\n\nFrom the [node.js docs](https://nodejs.org/api/buffer.html#buffer_new_buffer_size):\n\n> `new Buffer(size)`\n>\n> - `size` Number\n>\n> The underlying memory for `Buffer` instances created in this way is not initialized.\n> **The contents of a newly created `Buffer` are unknown and could contain sensitive\n> data.** Use `buf.fill(0)` to initialize a Buffer to zeroes.\n\n(Emphasis our own.)\n\nWhenever the programmer intended to create an uninitialized `Buffer` you often see code\nlike this:\n\n```js\nvar buf = new Buffer(16)\n\n// Immediately overwrite the uninitialized buffer with data from another buffer\nfor (var i = 0; i < buf.length; i++) {\n  buf[i] = otherBuf[i]\n}\n```\n\n\n### Would this ever be a problem in real code?\n\nYes. It's surprisingly common to forget to check the type of your variables in a\ndynamically-typed language like JavaScript.\n\nUsually the consequences of assuming the wrong type is that your program crashes with an\nuncaught exception. But the failure mode for forgetting to check the type of arguments to\nthe `Buffer` constructor is more catastrophic.\n\nHere's an example of a vulnerable service that takes a JSON payload and converts it to\nhex:\n\n```js\n// Take a JSON payload {str: \"some string\"} and convert it to hex\nvar server = http.createServer(function (req, res) {\n  var data = ''\n  req.setEncoding('utf8')\n  req.on('data', function (chunk) {\n    data += chunk\n  })\n  req.on('end', function () {\n    var body = JSON.parse(data)\n    res.end(new Buffer(body.str).toString('hex'))\n  })\n})\n\nserver.listen(8080)\n```\n\nIn this example, an http client just has to send:\n\n```json\n{\n  \"str\": 1000\n}\n```\n\nand it will get back 1,000 bytes of uninitialized memory from the server.\n\nThis is a very serious bug. It's similar in severity to the\n[the Heartbleed bug](http://heartbleed.com/) that allowed disclosure of OpenSSL process\nmemory by remote attackers.\n\n\n### Which real-world packages were vulnerable?\n\n#### [`bittorrent-dht`](https://www.npmjs.com/package/bittorrent-dht)\n\n[Mathias Buus](https://github.com/mafintosh) and I\n([Feross Aboukhadijeh](http://feross.org/)) found this issue in one of our own packages,\n[`bittorrent-dht`](https://www.npmjs.com/package/bittorrent-dht). The bug would allow\nanyone on the internet to send a series of messages to a user of `bittorrent-dht` and get\nthem to reveal 20 bytes at a time of uninitialized memory from the node.js process.\n\nHere's\n[the commit](https://github.com/feross/bittorrent-dht/commit/6c7da04025d5633699800a99ec3fbadf70ad35b8)\nthat fixed it. We released a new fixed version, created a\n[Node Security Project disclosure](https://nodesecurity.io/advisories/68), and deprecated all\nvulnerable versions on npm so users will get a warning to upgrade to a newer version.\n\n#### [`ws`](https://www.npmjs.com/package/ws)\n\nThat got us wondering if there were other vulnerable packages. Sure enough, within a short\nperiod of time, we found the same issue in [`ws`](https://www.npmjs.com/package/ws), the\nmost popular WebSocket implementation in node.js.\n\nIf certain APIs were called with `Number` parameters instead of `String` or `Buffer` as\nexpected, then uninitialized server memory would be disclosed to the remote peer.\n\nThese were the vulnerable methods:\n\n```js\nsocket.send(number)\nsocket.ping(number)\nsocket.pong(number)\n```\n\nHere's a vulnerable socket server with some echo functionality:\n\n```js\nserver.on('connection', function (socket) {\n  socket.on('message', function (message) {\n    message = JSON.parse(message)\n    if (message.type === 'echo') {\n      socket.send(message.data) // send back the user's message\n    }\n  })\n})\n```\n\n`socket.send(number)` called on the server, will disclose server memory.\n\nHere's [the release](https://github.com/websockets/ws/releases/tag/1.0.1) where the issue\nwas fixed, with a more detailed explanation. Props to\n[Arnout Kazemier](https://github.com/3rd-Eden) for the quick fix. Here's the\n[Node Security Project disclosure](https://nodesecurity.io/advisories/67).\n\n\n### What's the solution?\n\nIt's important that node.js offers a fast way to get memory otherwise performance-critical\napplications would needlessly get a lot slower.\n\nBut we need a better way to *signal our intent* as programmers. **When we want\nuninitialized memory, we should request it explicitly.**\n\nSensitive functionality should not be packed into a developer-friendly API that loosely\naccepts many different types. This type of API encourages the lazy practice of passing\nvariables in without checking the type very carefully.\n\n#### A new API: `Buffer.allocUnsafe(number)`\n\nThe functionality of creating buffers with uninitialized memory should be part of another\nAPI. We propose `Buffer.allocUnsafe(number)`. This way, it's not part of an API that\nfrequently gets user input of all sorts of different types passed into it.\n\n```js\nvar buf = Buffer.allocUnsafe(16) // careful, uninitialized memory!\n\n// Immediately overwrite the uninitialized buffer with data from another buffer\nfor (var i = 0; i < buf.length; i++) {\n  buf[i] = otherBuf[i]\n}\n```\n\n\n### How do we fix node.js core?\n\nWe sent [a PR to node.js core](https://github.com/nodejs/node/pull/4514) (merged as\n`semver-major`) which defends against one case:\n\n```js\nvar str = 16\nnew Buffer(str, 'utf8')\n```\n\nIn this situation, it's implied that the programmer intended the first argument to be a\nstring, since they passed an encoding as a second argument. Today, node.js will allocate\nuninitialized memory in the case of `new Buffer(number, encoding)`, which is probably not\nwhat the programmer intended.\n\nBut this is only a partial solution, since if the programmer does `new Buffer(variable)`\n(without an `encoding` parameter) there's no way to know what they intended. If `variable`\nis sometimes a number, then uninitialized memory will sometimes be returned.\n\n### What's the real long-term fix?\n\nWe could deprecate and remove `new Buffer(number)` and use `Buffer.allocUnsafe(number)` when\nwe need uninitialized memory. But that would break 1000s of packages.\n\n~~We believe the best solution is to:~~\n\n~~1. Change `new Buffer(number)` to return safe, zeroed-out memory~~\n\n~~2. Create a new API for creating uninitialized Buffers. We propose: `Buffer.allocUnsafe(number)`~~\n\n#### Update\n\nWe now support adding three new APIs:\n\n- `Buffer.from(value)` - convert from any type to a buffer\n- `Buffer.alloc(size)` - create a zero-filled buffer\n- `Buffer.allocUnsafe(size)` - create an uninitialized buffer with given size\n\nThis solves the core problem that affected `ws` and `bittorrent-dht` which is\n`Buffer(variable)` getting tricked into taking a number argument.\n\nThis way, existing code continues working and the impact on the npm ecosystem will be\nminimal. Over time, npm maintainers can migrate performance-critical code to use\n`Buffer.allocUnsafe(number)` instead of `new Buffer(number)`.\n\n\n### Conclusion\n\nWe think there's a serious design issue with the `Buffer` API as it exists today. It\npromotes insecure software by putting high-risk functionality into a convenient API\nwith friendly \"developer ergonomics\".\n\nThis wasn't merely a theoretical exercise because we found the issue in some of the\nmost popular npm packages.\n\nFortunately, there's an easy fix that can be applied today. Use `safe-buffer` in place of\n`buffer`.\n\n```js\nvar Buffer = require('safe-buffer').Buffer\n```\n\nEventually, we hope that node.js core can switch to this new, safer behavior. We believe\nthe impact on the ecosystem would be minimal since it's not a breaking change.\nWell-maintained, popular packages would be updated to use `Buffer.alloc` quickly, while\nolder, insecure packages would magically become safe from this attack vector.\n\n\n## links\n\n- [Node.js PR: buffer: throw if both length and enc are passed](https://github.com/nodejs/node/pull/4514)\n- [Node Security Project disclosure for `ws`](https://nodesecurity.io/advisories/67)\n- [Node Security Project disclosure for`bittorrent-dht`](https://nodesecurity.io/advisories/68)\n\n\n## credit\n\nThe original issues in `bittorrent-dht`\n([disclosure](https://nodesecurity.io/advisories/68)) and\n`ws` ([disclosure](https://nodesecurity.io/advisories/67)) were discovered by\n[Mathias Buus](https://github.com/mafintosh) and\n[Feross Aboukhadijeh](http://feross.org/).\n\nThanks to [Adam Baldwin](https://github.com/evilpacket) for helping disclose these issues\nand for his work running the [Node Security Project](https://nodesecurity.io/).\n\nThanks to [John Hiesey](https://github.com/jhiesey) for proofreading this README and\nauditing the code.\n\n\n## license\n\nMIT. Copyright (C) [Feross Aboukhadijeh](http://feross.org)",
   "_attachments": {}