@socketsecurity/lib 5.28.0 → 6.0.0

package/dist/external/p-map.js

@@ -1,4 +1,10 @@
-const { AggregateErrorCtor: _p_AggregateErrorCtor, MapCtor: _p_MapCtor, NumberIsSafeInteger: _p_NumberIsSafeInteger, PromiseCtor: _p_PromiseCtor, TypeErrorCtor: _p_TypeErrorCtor } = require('../primordials.js')
+const { AggregateErrorCtor: _p_AggregateErrorCtor, TypeErrorCtor: _p_TypeErrorCtor } = require('../primordials/error.js')
+const { MapCtor: _p_MapCtor } = require('../primordials/map-set.js')
+
+const { NumberIsSafeInteger: _p_NumberIsSafeInteger } = require('../primordials/number.js')
+
+const { PromiseCtor: _p_PromiseCtor } = require('../primordials/promise.js')
+
 "use strict";
 /**
  * Bundled from p-map

package/dist/external/pico-pack.js

@@ -1,4 +1,20 @@
-const { AggregateErrorCtor: _p_AggregateErrorCtor, ArrayIsArray: _p_ArrayIsArray, ArrayPrototypeFlatMap: _p_ArrayPrototypeFlatMap, ArrayPrototypeUnshift: _p_ArrayPrototypeUnshift, ErrorCtor: _p_ErrorCtor, MapCtor: _p_MapCtor, MathAbs: _p_MathAbs, MathMax: _p_MathMax, MathMin: _p_MathMin, MathPow: _p_MathPow, NumberIsFinite: _p_NumberIsFinite, NumberIsInteger: _p_NumberIsInteger, NumberIsSafeInteger: _p_NumberIsSafeInteger, NumberParseInt: _p_NumberParseInt, ObjectAssign: _p_ObjectAssign, ObjectCreate: _p_ObjectCreate, ObjectDefineProperty: _p_ObjectDefineProperty, ObjectKeys: _p_ObjectKeys, PromiseAll: _p_PromiseAll, PromiseCtor: _p_PromiseCtor, PromiseRace: _p_PromiseRace, PromiseResolve: _p_PromiseResolve, RangeErrorCtor: _p_RangeErrorCtor, RegExpCtor: _p_RegExpCtor, SetCtor: _p_SetCtor, StringFromCharCode: _p_StringFromCharCode, StringPrototypeCharAt: _p_StringPrototypeCharAt, StringPrototypeCharCodeAt: _p_StringPrototypeCharCodeAt, StringPrototypeEndsWith: _p_StringPrototypeEndsWith, StringPrototypeLocaleCompare: _p_StringPrototypeLocaleCompare, StringPrototypePadStart: _p_StringPrototypePadStart, StringPrototypeRepeat: _p_StringPrototypeRepeat, StringPrototypeStartsWith: _p_StringPrototypeStartsWith, SyntaxErrorCtor: _p_SyntaxErrorCtor, TypeErrorCtor: _p_TypeErrorCtor } = require('../primordials.js')
+const { ArrayIsArray: _p_ArrayIsArray, ArrayPrototypeFlatMap: _p_ArrayPrototypeFlatMap, ArrayPrototypeUnshift: _p_ArrayPrototypeUnshift } = require('../primordials/array.js')
+const { AggregateErrorCtor: _p_AggregateErrorCtor, ErrorCtor: _p_ErrorCtor, RangeErrorCtor: _p_RangeErrorCtor, SyntaxErrorCtor: _p_SyntaxErrorCtor, TypeErrorCtor: _p_TypeErrorCtor } = require('../primordials/error.js')
+
+const { MapCtor: _p_MapCtor, SetCtor: _p_SetCtor } = require('../primordials/map-set.js')
+
+const { MathAbs: _p_MathAbs, MathMax: _p_MathMax, MathMin: _p_MathMin, MathPow: _p_MathPow } = require('../primordials/math.js')
+
+const { NumberIsFinite: _p_NumberIsFinite, NumberIsInteger: _p_NumberIsInteger, NumberIsSafeInteger: _p_NumberIsSafeInteger, NumberParseInt: _p_NumberParseInt } = require('../primordials/number.js')
+
+const { ObjectAssign: _p_ObjectAssign, ObjectCreate: _p_ObjectCreate, ObjectDefineProperty: _p_ObjectDefineProperty, ObjectKeys: _p_ObjectKeys } = require('../primordials/object.js')
+
+const { PromiseAll: _p_PromiseAll, PromiseCtor: _p_PromiseCtor, PromiseRace: _p_PromiseRace, PromiseResolve: _p_PromiseResolve } = require('../primordials/promise.js')
+
+const { RegExpCtor: _p_RegExpCtor } = require('../primordials/regexp.js')
+
+const { StringFromCharCode: _p_StringFromCharCode, StringPrototypeCharAt: _p_StringPrototypeCharAt, StringPrototypeCharCodeAt: _p_StringPrototypeCharCodeAt, StringPrototypeEndsWith: _p_StringPrototypeEndsWith, StringPrototypeLocaleCompare: _p_StringPrototypeLocaleCompare, StringPrototypePadStart: _p_StringPrototypePadStart, StringPrototypeRepeat: _p_StringPrototypeRepeat, StringPrototypeStartsWith: _p_StringPrototypeStartsWith } = require('../primordials/string.js')
+
 "use strict";
 /**
  * Bundled from pico-pack

package/dist/external/pony-cause.js

@@ -1,4 +1,4 @@
-const { SetCtor: _p_SetCtor } = require('../primordials.js')
+const { SetCtor: _p_SetCtor } = require('../primordials/map-set.js')
 "use strict";
 /**
  * Bundled from pony-cause

package/dist/external/spdx-pack.js

@@ -1,4 +1,6 @@
-const { ErrorCtor: _p_ErrorCtor, ObjectKeys: _p_ObjectKeys } = require('../primordials.js')
+const { ErrorCtor: _p_ErrorCtor } = require('../primordials/error.js')
+const { ObjectKeys: _p_ObjectKeys } = require('../primordials/object.js')
+
 "use strict";
 /**
  * Bundled from spdx-pack

package/dist/external/supports-color.js

@@ -2,7 +2,7 @@
 
 // Re-export from external-pack bundle for better deduplication.
 const { supportsColor } = require('./external-pack')
-const { ObjectAssign: _p_ObjectAssign } = require('../primordials.js')
+const { ObjectAssign: _p_ObjectAssign } = require('../primordials/object.js')
 
 // supports-color is an ESM module, re-export all properties.
 const exported = supportsColor.default || supportsColor

package/dist/external/tar-fs.js

@@ -1,4 +1,18 @@
-const { ArrayCtor: _p_ArrayCtor, ArrayIsArray: _p_ArrayIsArray, BufferAlloc: _p_BufferAlloc, BufferAllocUnsafe: _p_BufferAllocUnsafe, BufferAllocUnsafeSlow: _p_BufferAllocUnsafeSlow, BufferByteLength: _p_BufferByteLength, BufferConcat: _p_BufferConcat, BufferFrom: _p_BufferFrom, BufferIsBuffer: _p_BufferIsBuffer, BufferIsEncoding: _p_BufferIsEncoding, DateCtor: _p_DateCtor, ErrorCtor: _p_ErrorCtor, MathFloor: _p_MathFloor, MathLog: _p_MathLog, MathMax: _p_MathMax, MathMin: _p_MathMin, MathPow: _p_MathPow, ObjectDefineProperty: _p_ObjectDefineProperty, ObjectKeys: _p_ObjectKeys, PromiseCtor: _p_PromiseCtor, PromiseResolve: _p_PromiseResolve, StringFromCharCode: _p_StringFromCharCode, StringFromCodePoint: _p_StringFromCodePoint, StringPrototypeStartsWith: _p_StringPrototypeStartsWith, TypeErrorCtor: _p_TypeErrorCtor } = require('../primordials.js')
+const { ArrayCtor: _p_ArrayCtor, ArrayIsArray: _p_ArrayIsArray } = require('../primordials/array.js')
+const { BufferAlloc: _p_BufferAlloc, BufferAllocUnsafe: _p_BufferAllocUnsafe, BufferAllocUnsafeSlow: _p_BufferAllocUnsafeSlow, BufferByteLength: _p_BufferByteLength, BufferConcat: _p_BufferConcat, BufferFrom: _p_BufferFrom, BufferIsBuffer: _p_BufferIsBuffer, BufferIsEncoding: _p_BufferIsEncoding } = require('../primordials/buffer.js')
+
+const { DateCtor: _p_DateCtor } = require('../primordials/date.js')
+
+const { ErrorCtor: _p_ErrorCtor, TypeErrorCtor: _p_TypeErrorCtor } = require('../primordials/error.js')
+
+const { MathFloor: _p_MathFloor, MathLog: _p_MathLog, MathMax: _p_MathMax, MathMin: _p_MathMin, MathPow: _p_MathPow } = require('../primordials/math.js')
+
+const { ObjectDefineProperty: _p_ObjectDefineProperty, ObjectKeys: _p_ObjectKeys } = require('../primordials/object.js')
+
+const { PromiseCtor: _p_PromiseCtor, PromiseResolve: _p_PromiseResolve } = require('../primordials/promise.js')
+
+const { StringFromCharCode: _p_StringFromCharCode, StringFromCodePoint: _p_StringFromCodePoint, StringPrototypeStartsWith: _p_StringPrototypeStartsWith } = require('../primordials/string.js')
+
 "use strict";
 /**
  * Bundled from tar-fs

package/dist/external/which.js

@@ -1,4 +1,14 @@
-const { ArrayPrototypeUnshift: _p_ArrayPrototypeUnshift, ErrorCtor: _p_ErrorCtor, ObjectAssign: _p_ObjectAssign, ObjectDefineProperty: _p_ObjectDefineProperty, ObjectGetOwnPropertyDescriptor: _p_ObjectGetOwnPropertyDescriptor, RegExpCtor: _p_RegExpCtor, SetCtor: _p_SetCtor, StringPrototypeSubstring: _p_StringPrototypeSubstring } = require('../primordials.js')
+const { ArrayPrototypeUnshift: _p_ArrayPrototypeUnshift } = require('../primordials/array.js')
+const { ErrorCtor: _p_ErrorCtor } = require('../primordials/error.js')
+
+const { SetCtor: _p_SetCtor } = require('../primordials/map-set.js')
+
+const { ObjectAssign: _p_ObjectAssign, ObjectDefineProperty: _p_ObjectDefineProperty, ObjectGetOwnPropertyDescriptor: _p_ObjectGetOwnPropertyDescriptor } = require('../primordials/object.js')
+
+const { RegExpCtor: _p_RegExpCtor } = require('../primordials/regexp.js')
+
+const { StringPrototypeSubstring: _p_StringPrototypeSubstring } = require('../primordials/string.js')
+
 "use strict";
 /**
  * Bundled from which

package/dist/external/yargs-parser.js

@@ -1,4 +1,18 @@
-const { ArrayIsArray: _p_ArrayIsArray, JSONParse: _p_JSONParse, MathFloor: _p_MathFloor, MathMin: _p_MathMin, NumberIsSafeInteger: _p_NumberIsSafeInteger, ObjectAssign: _p_ObjectAssign, ObjectCreate: _p_ObjectCreate, ObjectDefineProperty: _p_ObjectDefineProperty, ObjectEntries: _p_ObjectEntries, ObjectKeys: _p_ObjectKeys, RegExpCtor: _p_RegExpCtor, SetCtor: _p_SetCtor, StringPrototypeCharAt: _p_StringPrototypeCharAt, StringPrototypeSubstring: _p_StringPrototypeSubstring } = require('../primordials.js')
+const { ArrayIsArray: _p_ArrayIsArray } = require('../primordials/array.js')
+const { JSONParse: _p_JSONParse } = require('../primordials/json.js')
+
+const { SetCtor: _p_SetCtor } = require('../primordials/map-set.js')
+
+const { MathFloor: _p_MathFloor, MathMin: _p_MathMin } = require('../primordials/math.js')
+
+const { NumberIsSafeInteger: _p_NumberIsSafeInteger } = require('../primordials/number.js')
+
+const { ObjectAssign: _p_ObjectAssign, ObjectCreate: _p_ObjectCreate, ObjectDefineProperty: _p_ObjectDefineProperty, ObjectEntries: _p_ObjectEntries, ObjectKeys: _p_ObjectKeys } = require('../primordials/object.js')
+
+const { RegExpCtor: _p_RegExpCtor } = require('../primordials/regexp.js')
+
+const { StringPrototypeCharAt: _p_StringPrototypeCharAt, StringPrototypeSubstring: _p_StringPrototypeSubstring } = require('../primordials/string.js')
+
 "use strict";
 /**
  * Bundled from yargs-parser

package/dist/external-tools/bazel/asset-names.d.ts

@@ -0,0 +1,66 @@
+/**
+ * @file Upstream Bazel release asset-name mapping per `platform-arch`. Bazel's
+ *   GitHub Releases use a consistent naming pattern
+ *   (`bazel-<version>-<os>-<arch>[.exe]`); this leaf encodes the platform-arch
+ *   → suffix map so the bazelisk-style downloader can build the right URL
+ *   without spreading the convention. Bazel publishes native binaries for 5 of
+ *   socket's 8 targets. The 3 gap targets use compat-layer fallbacks:
+ *
+ *   - `linux-x64-musl` / `linux-arm64-musl` → glibc binary + gcompat (user must
+ *     `apk add gcompat` on Alpine)
+ *   - `win-arm64` → Windows x64 binary via Prism emulation Callers can read
+ *     `BAZEL_ASSET_MAP[platformArch].native` to see whether the binary is
+ *     native to the target or runs under a compat layer.
+ */
+export interface BazelAssetEntry {
+    /**
+     * Asset-name suffix appended to `bazel-<version>-`.
+     */
+    readonly suffix: string;
+    /**
+     * `true` if this is an upstream-native build; `false` if it runs via compat.
+     */
+    readonly native: boolean;
+    /**
+     * Human-readable note about compatibility quirks (if any).
+     */
+    readonly note: string | undefined;
+}
+export declare const BAZEL_ASSET_MAP: Readonly<Record<string, BazelAssetEntry>>;
+export declare function getBazelAssetEntry(platformArch: string): BazelAssetEntry | undefined;
+/**
+ * Options for {@link getBazelDownloadUrl}.
+ */
+export interface BazelDownloadOptions {
+    /**
+     * Bazel release version, e.g. `'7.4.1'`. Passed verbatim into the release tag
+     * — the helper doesn't validate against bazel's release feed, it just formats
+     * the URL.
+     */
+    version: string;
+    /**
+     * Fleet platform-arch token — looked up in `BAZEL_ASSET_MAP`. Returns
+     * `undefined` when no entry exists for the target.
+     */
+    platformArch: string;
+}
+/**
+ * Build the GitHub release-asset download URL for an upstream Bazel binary.
+ * Returns `undefined` when no entry exists for the requested platform-arch.
+ *
+ * Note: the underlying asset may be a compat-layer build (see
+ * `BazelAssetEntry.native`). Callers that require a native binary should check
+ * `getBazelAssetEntry(platformArch).native` before downloading.
+ *
+ * Reference: https://github.com/bazelbuild/bazel/releases.
+ *
+ * @example
+ *   ;```typescript
+ *   const url = getBazelDownloadUrl({
+ *     version: '7.4.1',
+ *     platformArch: 'darwin-arm64',
+ *   })
+ *   // → 'https://github.com/bazelbuild/bazel/releases/download/7.4.1/bazel-7.4.1-darwin-arm64'
+ *   ```
+ */
+export declare function getBazelDownloadUrl(opts: BazelDownloadOptions): string | undefined;

package/dist/external-tools/bazel/asset-names.js

@@ -0,0 +1,96 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var asset_names_exports = {};
+__export(asset_names_exports, {
+  BAZEL_ASSET_MAP: () => BAZEL_ASSET_MAP,
+  getBazelAssetEntry: () => getBazelAssetEntry,
+  getBazelDownloadUrl: () => getBazelDownloadUrl
+});
+module.exports = __toCommonJS(asset_names_exports);
+var import_object = require("../../primordials/object");
+const BAZEL_ASSET_MAP = (0, import_object.ObjectFreeze)({
+  __proto__: null,
+  "darwin-arm64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "darwin-arm64",
+    native: true,
+    note: void 0
+  }),
+  "darwin-x64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "darwin-x86_64",
+    native: true,
+    note: void 0
+  }),
+  "linux-arm64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "linux-arm64",
+    native: true,
+    note: void 0
+  }),
+  "linux-arm64-musl": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "linux-arm64",
+    native: false,
+    note: "Runs under gcompat on Alpine; `apk add gcompat` required."
+  }),
+  "linux-x64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "linux-x86_64",
+    native: true,
+    note: void 0
+  }),
+  "linux-x64-musl": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "linux-x86_64",
+    native: false,
+    note: "Runs under gcompat on Alpine; `apk add gcompat` required."
+  }),
+  "win-arm64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "windows-x86_64.exe",
+    native: false,
+    note: "Runs under Prism x86_64 emulation on Windows ARM64."
+  }),
+  "win-x64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "windows-x86_64.exe",
+    native: true,
+    note: void 0
+  })
+});
+function getBazelAssetEntry(platformArch) {
+  return BAZEL_ASSET_MAP[platformArch];
+}
+function getBazelDownloadUrl(opts) {
+  const { platformArch, version } = opts;
+  const entry = BAZEL_ASSET_MAP[platformArch];
+  if (!entry) {
+    return void 0;
+  }
+  return `https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-${entry.suffix}`;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  BAZEL_ASSET_MAP,
+  getBazelAssetEntry,
+  getBazelDownloadUrl
+});

package/dist/external-tools/bazel/from-download.d.ts

@@ -0,0 +1,49 @@
+/**
+ * @file `bazelFromDownload()` — fetches the upstream Bazel binary and returns a
+ *   `ResolvedBazel` pointing at the cached executable. Bazel ships as a single
+ *   executable per platform (no tar/zip wrapper), so this tier uses
+ *   `downloadToolArchive` directly — no extraction step. The dlx downloader
+ *   already chmods the file to 0o755 on POSIX, so the cached path is runnable
+ *   as soon as it lands on disk. Returns `undefined` when Bazel doesn't publish
+ *   a build for the target `platformArch` (no entry in `BAZEL_ASSET_MAP`).
+ *   Trust-on-first-use: pass `integrity` from `external-tools.json` when
+ *   available. Omit on first install; the underlying call computes the SRI and
+ *   writes it into the dlx cache metadata so a follow-up `external-tools.json`
+ *   update can pin it.
+ */
+import type { BinaryDownloader } from '../from-download';
+import type { HashSpec } from '../../integrity';
+import type { ResolvedBazel } from './types';
+export interface BazelFromDownloadOptions {
+    /**
+     * Bazel release version, e.g. `'7.4.1'`.
+     */
+    version: string;
+    /**
+     * Fleet platform-arch token, e.g. `'darwin-arm64'`.
+     */
+    platformArch: string;
+    /**
+     * Optional pinned integrity from `external-tools.json`.
+     */
+    integrity?: HashSpec | undefined;
+    /**
+     * Inject a custom downloader. Forwarded to the underlying
+     * `downloadToolArchive`. Defaults to dlx.
+     */
+    downloader?: BinaryDownloader | undefined;
+}
+/**
+ * Resolve Bazel by downloading the upstream binary. Returns the standard
+ * `ResolvedBazel` shape with `source: 'download'`.
+ *
+ * @example
+ *   ;```typescript
+ *   const bazel = await bazelFromDownload({
+ *     version: '7.4.1',
+ *     platformArch: 'darwin-arm64',
+ *   })
+ *   // → { path: '/.../bazel-7.4.1-darwin-arm64', source: 'download' }
+ *   ```
+ */
+export declare function bazelFromDownload(opts: BazelFromDownloadOptions): Promise<ResolvedBazel | undefined>;

package/dist/external-tools/bazel/from-download.js

@@ -0,0 +1,49 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var from_download_exports = {};
+__export(from_download_exports, {
+  bazelFromDownload: () => bazelFromDownload
+});
+module.exports = __toCommonJS(from_download_exports);
+var import_from_download = require("../from-download");
+var import_asset_names = require("./asset-names");
+async function bazelFromDownload(opts) {
+  const { downloader, integrity, platformArch, version } = opts;
+  const url = (0, import_asset_names.getBazelDownloadUrl)({ version, platformArch });
+  if (!url) {
+    return void 0;
+  }
+  const archive = await (0, import_from_download.downloadToolArchive)({
+    url,
+    name: `bazel-${version}-${platformArch}`,
+    integrity,
+    downloader
+  });
+  return {
+    path: archive.archivePath,
+    source: "download",
+    integrity: archive.integrity
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  bazelFromDownload
+});

package/dist/external-tools/bazel/from-path.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @file `bazelFromPath()` — looks for `bazelisk` first, then `bazel`, on the
+ *   system PATH. Bazelisk is preferred because it honors `.bazelversion` and
+ *   downloads the project-pinned Bazel into its own cache — closer to what real
+ *   Bazel users want. Returns `undefined` if neither is found on PATH.
+ */
+import type { ResolvedBazel } from './types';
+export declare function bazelFromPath(): Promise<ResolvedBazel | undefined>;

package/dist/external-tools/bazel/from-path.js

@@ -0,0 +1,41 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var from_path_exports = {};
+__export(from_path_exports, {
+  bazelFromPath: () => bazelFromPath
+});
+module.exports = __toCommonJS(from_path_exports);
+var import_which = require("../../bin/which");
+async function bazelFromPath() {
+  const bazelisk = await (0, import_which.which)("bazelisk", { nothrow: true });
+  if (typeof bazelisk === "string") {
+    return { path: bazelisk, source: "path" };
+  }
+  const bazel = await (0, import_which.which)("bazel", { nothrow: true });
+  if (typeof bazel === "string") {
+    return { path: bazel, source: "path" };
+  }
+  return void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  bazelFromPath
+});

package/dist/external-tools/bazel/read-bazel-version-file.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @file `readBazelVersionFile(workspaceDir)` — walks up from `workspaceDir`
+ *   looking for a `.bazelversion` file (the Bazel/Bazelisk convention for
+ *   pinning the project's Bazel version). Returns the trimmed contents as a
+ *   version string, or `undefined` when no file is found before reaching the
+ *   filesystem root. The walk respects the "first `.bazelversion` wins"
+ *   convention used by Bazelisk itself. Some special values that
+ *   `.bazelversion` can hold (`latest`, `last_green`, `rolling`, etc.) are
+ *   returned verbatim; resolution of those into concrete X.Y.Z versions is the
+ *   orchestrator's job.
+ */
+export declare function readBazelVersionFile(startDir: string): Promise<string | undefined>;

package/dist/external-tools/bazel/read-bazel-version-file.js

@@ -0,0 +1,61 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var read_bazel_version_file_exports = {};
+__export(read_bazel_version_file_exports, {
+  readBazelVersionFile: () => readBazelVersionFile
+});
+module.exports = __toCommonJS(read_bazel_version_file_exports);
+var import_node_path = __toESM(require("node:path"));
+var import_read_file = require("../../fs/read-file");
+var import_string = require("../../primordials/string");
+const BAZEL_VERSION_FILE = ".bazelversion";
+async function readBazelVersionFile(startDir) {
+  let current = import_node_path.default.resolve(startDir);
+  while (true) {
+    const candidate = import_node_path.default.join(current, BAZEL_VERSION_FILE);
+    const content = await (0, import_read_file.safeReadFile)(candidate, { encoding: "utf8" });
+    if (content !== void 0) {
+      const hashIdx = (0, import_string.StringPrototypeIndexOf)(content, "#");
+      const base = hashIdx === -1 ? content : (0, import_string.StringPrototypeSlice)(content, 0, hashIdx);
+      const version = (0, import_string.StringPrototypeTrim)(base);
+      return version.length > 0 ? version : void 0;
+    }
+    const parent = import_node_path.default.dirname(current);
+    if (parent === current) {
+      return void 0;
+    }
+    current = parent;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  readBazelVersionFile
+});

package/dist/external-tools/bazel/resolve-asset-url.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @file `resolveBazelAssetUrl(version, platformArch)` — builds the upstream
+ *   GitHub Releases download URL for a Bazel binary. Returns `undefined` if the
+ *   platform-arch isn't in our asset map. Bazel publishes to
+ *   https://github.com/bazelbuild/bazel/releases/download/<X.Y.Z>/bazel-<X.Y.Z>-<suffix>
+ *   where `<suffix>` is one of `darwin-arm64`, `darwin-x86_64`, `linux-arm64`,
+ *   `linux-x86_64`, `windows-x86_64.exe`.
+ */
+export interface BazelAssetUrl {
+    readonly url: string;
+    readonly filename: string;
+    readonly native: boolean;
+}
+export declare function resolveBazelAssetUrl(version: string, platformArch: string): BazelAssetUrl | undefined;

package/dist/external-tools/bazel/resolve-asset-url.js

@@ -0,0 +1,42 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var resolve_asset_url_exports = {};
+__export(resolve_asset_url_exports, {
+  resolveBazelAssetUrl: () => resolveBazelAssetUrl
+});
+module.exports = __toCommonJS(resolve_asset_url_exports);
+var import_asset_names = require("./asset-names");
+function resolveBazelAssetUrl(version, platformArch) {
+  const entry = (0, import_asset_names.getBazelAssetEntry)(platformArch);
+  if (!entry) {
+    return void 0;
+  }
+  const filename = `bazel-${version}-${entry.suffix}`;
+  return {
+    url: `https://github.com/bazelbuild/bazel/releases/download/${version}/${filename}`,
+    filename,
+    native: entry.native
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  resolveBazelAssetUrl
+});

package/dist/external-tools/bazel/resolve-bazel-version.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @file `resolveBazelVersion({ cwd })` — picks the Bazel version to run for a
+ *   project, matching the bazelisk precedence:
+ *
+ *   1. `USE_BAZEL_VERSION` env var
+ *   2. `.bazelversion` walking up from `cwd`
+ *   3. Fallback to the latest stable release queried from GitHub Releases (via
+ *      socket-lib's `getLatestRelease`, which already handles GH_TOKEN auth,
+ *      retry, and the REST/GraphQL fallback). Returns `undefined` only if both
+ *      steps 2 and 3 fail with no env override — in that case the caller
+ *      surfaces an actionable error.
+ */
+export interface ResolveBazelVersionOptions {
+    /**
+     * Working directory to walk up from for `.bazelversion`.
+     */
+    readonly cwd?: string | undefined;
+}
+export declare function resolveBazelVersion(options?: ResolveBazelVersionOptions | undefined): Promise<string | undefined>;

package/dist/external-tools/bazel/resolve-bazel-version.js

@@ -0,0 +1,59 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var resolve_bazel_version_exports = {};
+__export(resolve_bazel_version_exports, {
+  resolveBazelVersion: () => resolveBazelVersion
+});
+module.exports = __toCommonJS(resolve_bazel_version_exports);
+var import_node_process = __toESM(require("node:process"));
+var import_github_listing = require("../../releases/github-listing");
+var import_read_bazel_version_file = require("./read-bazel-version-file");
+async function resolveBazelVersion(options) {
+  const cwd = options?.cwd ?? import_node_process.default.cwd();
+  const envOverride = import_node_process.default.env["USE_BAZEL_VERSION"];
+  if (envOverride && envOverride.length > 0) {
+    return envOverride;
+  }
+  const fromFile = await (0, import_read_bazel_version_file.readBazelVersionFile)(cwd);
+  if (fromFile) {
+    return fromFile;
+  }
+  const latest = await (0, import_github_listing.getLatestRelease)(
+    "",
+    { owner: "bazelbuild", repo: "bazel" },
+    { nothrow: true }
+  );
+  return latest ?? void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  resolveBazelVersion
+});