test(regexps,promises): cover feature-detect fallback branches

Normal test runs on Node 24+ / 22+ bind escapeRegExp and
withResolvers to their native implementations at module import
time, leaving the hand-rolled fallback branches entirely
unexecuted. Add explicit fallback coverage by deleting the
native method from the global before re-importing the module
with `vi.resetModules()`.

regexps.ts fallback (10 tests):
- is a function after fallback binding
- encodes leading [0-9A-Za-z] as \xHH (spec §22.2.5.1 step 3.a)
- backslash-prefixes SyntaxCharacter + `/`
- emits ControlEscape letter forms (\t\n\v\f\r)
- hex-escapes otherPunctuators (,-=<>#&!%:;@~'`+dquote)
- hex-escapes whitespace / line terminators (space, NBSP, LS,
  PS, ZWNBSP) with correct \xHH vs \uXXXX choice by codepoint
- round-trips arbitrary literal strings
- byte-identical output vs native across ASCII 0-127, selected
  non-ASCII (NBSP, ZWNBSP, LS, PS, surrogates), and multi-char
  strings — proves zero behavioral drift between paths

promises.ts withResolvers fallback (8 tests):
- function identity + return shape
- resolve/reject roundtrip
- thenable adoption on resolve
- settle-once semantics (later calls ignored across resolve/reject)
- returned object has Object.prototype (§27.2.4.9 step 3)
- promise/resolve/reject are own enumerable properties (steps 4-6)

Each `afterEach` restores the native method and calls
`vi.resetModules()` so the fallback state does not leak into
later suites that import the module via a cached reference.

Boosts src/regexps.ts from 13.9% → 100% line coverage; src/
promises.ts withResolvers branch from 0% → 100%.

Author: jdalton

test/unit/promises.test.mts

@@ -21,7 +21,7 @@ import {
   resolveRetryOptions,
   withResolvers,
 } from '@socketsecurity/lib/promises'
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 
 describe('promises', () => {
   describe('resolveRetryOptions', () => {
@@ -1143,4 +1143,104 @@ describe('promises', () => {
       expect(keys).toContain('reject')
     })
   })
+
+  // Explicit coverage of the fallback branch. On Node 20.12+ / 22+ the
+  // module binds to native `Promise.withResolvers` at import time, so
+  // normal runs exercise only the native path. Here we delete the native
+  // method and re-import the module fresh, forcing the feature-detect
+  // to pick the closure fallback.
+  describe('withResolvers — fallback implementation', () => {
+    const hadNative =
+      typeof (Promise as unknown as { withResolvers?: unknown })
+        .withResolvers === 'function'
+    const nativeWithResolvers = hadNative
+      ? (
+          Promise as unknown as {
+            withResolvers: () => unknown
+          }
+        ).withResolvers
+      : undefined
+
+    afterEach(() => {
+      if (hadNative && nativeWithResolvers) {
+        ;(
+          Promise as unknown as { withResolvers: () => unknown }
+        ).withResolvers = nativeWithResolvers
+      }
+      vi.resetModules()
+    })
+
+    async function loadFallback(): Promise<
+      () => { promise: Promise<unknown>; resolve: Function; reject: Function }
+    > {
+      delete (Promise as unknown as { withResolvers?: unknown }).withResolvers
+      vi.resetModules()
+      const mod = await import('@socketsecurity/lib/promises')
+      return mod.withResolvers as () => {
+        promise: Promise<unknown>
+        resolve: Function
+        reject: Function
+      }
+    }
+
+    it('fallback is a function', async () => {
+      const fallback = await loadFallback()
+      expect(typeof fallback).toBe('function')
+    })
+
+    it('fallback returns { promise, resolve, reject } with correct types', async () => {
+      const fallback = await loadFallback()
+      const d = fallback()
+      expect(d.promise).toBeInstanceOf(Promise)
+      expect(typeof d.resolve).toBe('function')
+      expect(typeof d.reject).toBe('function')
+    })
+
+    it('fallback resolves the promise with the provided value', async () => {
+      const fallback = await loadFallback()
+      const d = fallback()
+      d.resolve('ok')
+      await expect(d.promise).resolves.toBe('ok')
+    })
+
+    it('fallback rejects the promise with the provided reason', async () => {
+      const fallback = await loadFallback()
+      const d = fallback()
+      const err = new Error('nope')
+      d.reject(err)
+      await expect(d.promise).rejects.toBe(err)
+    })
+
+    it('fallback adopts a thenable passed to resolve', async () => {
+      const fallback = await loadFallback()
+      const d = fallback()
+      d.resolve(Promise.resolve(99))
+      await expect(d.promise).resolves.toBe(99)
+    })
+
+    it('fallback settle-once semantics (later calls ignored)', async () => {
+      const fallback = await loadFallback()
+      const d = fallback()
+      d.resolve('first')
+      d.resolve('second')
+      d.reject(new Error('late'))
+      await expect(d.promise).resolves.toBe('first')
+    })
+
+    // Spec §27.2.4.9 step 3: return object has Object.prototype.
+    it('fallback returns an ordinary object, not a Promise subclass', async () => {
+      const fallback = await loadFallback()
+      const d = fallback()
+      expect(Object.getPrototypeOf(d)).toBe(Object.prototype)
+    })
+
+    it('fallback properties are own + enumerable', async () => {
+      const fallback = await loadFallback()
+      const d = fallback()
+      const keys = Object.keys(d)
+      expect(keys).toContain('promise')
+      expect(keys).toContain('resolve')
+      expect(keys).toContain('reject')
+    })
+  })
 })

test/unit/regexps.test.mts

@@ -16,7 +16,7 @@
  * native `RegExp.escape` (Node 24+) or our hand-rolled fallback.
  */
 
-import { describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 
 import { escapeRegExp } from '@socketsecurity/lib/regexps'
 
@@ -152,4 +152,152 @@ describe('regexps', () => {
       expect(re.test('vX2X3-release')).toBe(false)
     })
   })
+
+  // Explicit coverage of the fallback branch. On Node 24+ the module binds
+  // to native `RegExp.escape` at import time, so normal test runs exercise
+  // only the native path. Here we unbind the native method and re-import
+  // the module fresh, forcing the feature-detect to select the fallback.
+  // Each assertion also runs against the current (possibly-native) export
+  // so the two paths are proven equivalent on identical inputs.
+  describe('escapeRegExp — fallback implementation', () => {
+    const hadNative =
+      typeof (RegExp as unknown as { escape?: unknown }).escape === 'function'
+    const nativeEscape = hadNative
+      ? (RegExp as unknown as { escape: (s: string) => string }).escape
+      : undefined
+
+    afterEach(() => {
+      // Restore native between tests so we don't leak state to later
+      // suites that may import regexps via a cached module.
+      if (hadNative && nativeEscape) {
+        ;(RegExp as unknown as { escape: (s: string) => string }).escape =
+          nativeEscape
+      }
+      vi.resetModules()
+    })
+
+    async function loadFallback(): Promise<(s: string) => string> {
+      // Delete the native method so the module's typeof check picks
+      // the fallback on re-import.
+      delete (RegExp as unknown as { escape?: unknown }).escape
+      vi.resetModules()
+      const mod = await import('@socketsecurity/lib/regexps')
+      return mod.escapeRegExp
+    }
+
+    it('is still a function after the fallback branch is selected', async () => {
+      const fallback = await loadFallback()
+      expect(typeof fallback).toBe('function')
+    })
+
+    it('fallback encodes leading letter/digit as \\xHH', async () => {
+      const fallback = await loadFallback()
+      expect(fallback('a')).toBe('\\x61')
+      expect(fallback('Z')).toBe('\\x5a')
+      expect(fallback('0')).toBe('\\x30')
+      // Trailing letters/digits are verbatim.
+      expect(fallback('abc').startsWith('\\x61')).toBe(true)
+      expect(fallback('abc').endsWith('bc')).toBe(true)
+    })
+
+    it('fallback backslash-prefixes SyntaxCharacter + /', async () => {
+      const fallback = await loadFallback()
+      for (const ch of '^$\\.*+?()[]{}|/') {
+        expect(fallback(ch)).toBe('\\' + ch)
+      }
+    })
+
+    it('fallback emits ControlEscape letter forms', async () => {
+      const fallback = await loadFallback()
+      expect(fallback('\t')).toBe('\\t')
+      expect(fallback('\n')).toBe('\\n')
+      expect(fallback('\v')).toBe('\\v')
+      expect(fallback('\f')).toBe('\\f')
+      expect(fallback('\r')).toBe('\\r')
+    })
+
+    it('fallback hex-escapes the otherPunctuators set', async () => {
+      const fallback = await loadFallback()
+      for (const ch of ',-=<>#&!%:;@~\'`"') {
+        const cp = ch.codePointAt(0)!
+        expect(fallback(ch)).toBe('\\x' + cp.toString(16).padStart(2, '0'))
+      }
+    })
+
+    it('fallback hex-escapes whitespace and line terminators', async () => {
+      const fallback = await loadFallback()
+      // Space, NBSP → \xHH (cp ≤ 0xFF).
+      expect(fallback(' ')).toBe('\\x20')
+      expect(fallback('\u00a0')).toBe('\\xa0')
+      // LS (U+2028), PS (U+2029), ZWNBSP (U+FEFF) → \uXXXX (cp > 0xFF).
+      expect(fallback('\u2028')).toBe('\\u2028')
+      expect(fallback('\u2029')).toBe('\\u2029')
+      expect(fallback('\ufeff')).toBe('\\ufeff')
+    })
+
+    it('fallback round-trips arbitrary inputs as literal matches', async () => {
+      const fallback = await loadFallback()
+      for (const s of [
+        'test.file',
+        'a-z',
+        '[test]',
+        'hello世界',
+        'v1.2.3-release',
+        '',
+        '*.{js,ts}',
+        'price: $50+',
+      ]) {
+        const re = new RegExp(`^${fallback(s)}$`)
+        expect(re.test(s)).toBe(true)
+      }
+    })
+
+    // Proves the two paths produce byte-identical output for every ASCII
+    // code point, so callers that cache the escaped form don't see
+    // different strings depending on Node version.
+    it('fallback output is byte-identical to native across ASCII 0-127', async () => {
+      if (!hadNative || !nativeEscape) {
+        return // Only meaningful when native exists to diff against.
+      }
+      const fallback = await loadFallback()
+      for (let cp = 0; cp < 128; cp++) {
+        const s = String.fromCodePoint(cp)
+        expect(fallback(s), `diverged at cp 0x${cp.toString(16)}`).toBe(
+          nativeEscape(s),
+        )
+      }
+    })
+
+    it('fallback output is byte-identical to native for representative non-ASCII', async () => {
+      if (!hadNative || !nativeEscape) {
+        return
+      }
+      const fallback = await loadFallback()
+      for (const cp of [0xa0, 0xfeff, 0x2028, 0x2029, 0xd800, 0xdc00]) {
+        const s = String.fromCodePoint(cp)
+        expect(fallback(s)).toBe(nativeEscape(s))
+      }
+    })
+
+    it('fallback output is byte-identical to native for multi-char strings', async () => {
+      if (!hadNative || !nativeEscape) {
+        return
+      }
+      const fallback = await loadFallback()
+      for (const s of [
+        'abc',
+        'foo.bar',
+        '[test]',
+        'a-z',
+        'hello world',
+        'v1.2.3-release',
+        'test.file',
+        '*.{js,ts}',
+        'hello世界',
+        'test\t\n',
+      ]) {
+        expect(fallback(s)).toBe(nativeEscape(s))
+      }
+    })
+  })
 })