"use strict";
/* Socket Lib - Built with rolldown */
Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
const require_runtime = require('../_virtual/_rolldown/runtime.js');
const require_primordials_error = require('../primordials/error.js');
const require_node_fs = require('../node/fs.js');
const require_node_path = require('../node/path.js');
let node_process = require("node:process");
node_process = require_runtime.__toESM(node_process);

//#region src/ipc/directory.ts
/**
* @file Stub-directory creation + permission audit. The IPC directory is
*   created with 0o700 so other users can't read or plant files; on POSIX we
*   also verify ownership and permission bits before any write, since a
*   pre-existing directory could belong to a different user or have permissive
*   modes inherited from umask.
*/
/**
* Ensure IPC directory exists for stub file creation. Uses restrictive (0o700)
* permissions so other users cannot read or write stub files. On POSIX, after
* `mkdir` we verify the directory is owned by the current user and not
* world/group-writable — protects against a prior local attacker pre-creating
* `.socket-ipc/<app>/` with permissive modes and planting symlinks for stub
* filenames. Throws if the directory fails the check.
*
* @internal
*/
async function ensureIpcDirectory(filePath) {
	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
	const dir = (/* @__PURE__ */ require_node_path.getNodePath()).dirname(filePath);
	await fs.promises.mkdir(dir, {
		recursive: true,
		mode: 448
	});
	/* c8 ignore start */
	if (node_process.default.platform === "win32") return;
	/* c8 ignore stop */
	const stats = await fs.promises.lstat(dir);
	/* c8 ignore start */
	if (!stats.isDirectory()) throw new require_primordials_error.ErrorCtor(`IPC path is not a directory: ${dir}`);
	/* c8 ignore stop */
	const getuid = node_process.default.getuid;
	/* c8 ignore next - process.getuid is always present on POSIX. */
	const ownUid = typeof getuid === "function" ? getuid.call(node_process.default) : -1;
	/* c8 ignore next 5 - Cross-user ownership guard fires only if the
	IPC directory was created by a different uid; can't be triggered
	in-test without spawning a separate user. */
	if (ownUid !== -1 && stats.uid !== ownUid) throw new require_primordials_error.ErrorCtor(`IPC directory ${dir} is owned by another user (uid ${stats.uid}); refusing to use it.`);
	/* c8 ignore next 7 - chmod-tightening fires only if umask leaves
	group/other bits set; default Node umask 0o022 strips group-write
	but keeps group/other read+execute, so the value depends on the
	CI runner's umask. */
	if ((stats.mode & 63) !== 0) await fs.promises.chmod(dir, 448);
}

//#endregion
exports.ensureIpcDirectory = ensureIpcDirectory;