@socketsecurity/lib 6.0.3 → 6.0.5

package/dist/external-tools/bazel/asset-names.js

@@ -1,96 +1,104 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var asset_names_exports = {};
-__export(asset_names_exports, {
-  BAZEL_ASSET_MAP: () => BAZEL_ASSET_MAP,
-  getBazelAssetEntry: () => getBazelAssetEntry,
-  getBazelDownloadUrl: () => getBazelDownloadUrl
-});
-module.exports = __toCommonJS(asset_names_exports);
-var import_object = require("../../primordials/object");
-const BAZEL_ASSET_MAP = (0, import_object.ObjectFreeze)({
-  __proto__: null,
-  "darwin-arm64": (0, import_object.ObjectFreeze)({
-    __proto__: null,
-    suffix: "darwin-arm64",
-    native: true,
-    note: void 0
-  }),
-  "darwin-x64": (0, import_object.ObjectFreeze)({
-    __proto__: null,
-    suffix: "darwin-x86_64",
-    native: true,
-    note: void 0
-  }),
-  "linux-arm64": (0, import_object.ObjectFreeze)({
-    __proto__: null,
-    suffix: "linux-arm64",
-    native: true,
-    note: void 0
-  }),
-  "linux-arm64-musl": (0, import_object.ObjectFreeze)({
-    __proto__: null,
-    suffix: "linux-arm64",
-    native: false,
-    note: "Runs under gcompat on Alpine; `apk add gcompat` required."
-  }),
-  "linux-x64": (0, import_object.ObjectFreeze)({
-    __proto__: null,
-    suffix: "linux-x86_64",
-    native: true,
-    note: void 0
-  }),
-  "linux-x64-musl": (0, import_object.ObjectFreeze)({
-    __proto__: null,
-    suffix: "linux-x86_64",
-    native: false,
-    note: "Runs under gcompat on Alpine; `apk add gcompat` required."
-  }),
-  "win-arm64": (0, import_object.ObjectFreeze)({
-    __proto__: null,
-    suffix: "windows-x86_64.exe",
-    native: false,
-    note: "Runs under Prism x86_64 emulation on Windows ARM64."
-  }),
-  "win-x64": (0, import_object.ObjectFreeze)({
-    __proto__: null,
-    suffix: "windows-x86_64.exe",
-    native: true,
-    note: void 0
-  })
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_object = require('../../primordials/object.js');
+
+//#region src/external-tools/bazel/asset-names.ts
+/**
+* @file Upstream Bazel release asset-name mapping per `platform-arch`. Bazel's
+*   GitHub Releases use a consistent naming pattern
+*   (`bazel-<version>-<os>-<arch>[.exe]`); this leaf encodes the platform-arch
+*   → suffix map so the bazelisk-style downloader can build the right URL
+*   without spreading the convention. Bazel publishes native binaries for 5 of
+*   socket's 8 targets. The 3 gap targets use compat-layer fallbacks:
+*
+*   - `linux-x64-musl` / `linux-arm64-musl` → glibc binary + gcompat (user must
+*     `apk add gcompat` on Alpine)
+*   - `win-arm64` → Windows x64 binary via Prism emulation Callers can read
+*     `BAZEL_ASSET_MAP[platformArch].native` to see whether the binary is
+*     native to the target or runs under a compat layer.
+*/
+const BAZEL_ASSET_MAP = require_primordials_object.ObjectFreeze({
+	__proto__: null,
+	"darwin-arm64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		suffix: "darwin-arm64",
+		native: true,
+		note: void 0
+	}),
+	"darwin-x64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		suffix: "darwin-x86_64",
+		native: true,
+		note: void 0
+	}),
+	"linux-arm64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		suffix: "linux-arm64",
+		native: true,
+		note: void 0
+	}),
+	"linux-arm64-musl": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		suffix: "linux-arm64",
+		native: false,
+		note: "Runs under gcompat on Alpine; `apk add gcompat` required."
+	}),
+	"linux-x64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		suffix: "linux-x86_64",
+		native: true,
+		note: void 0
+	}),
+	"linux-x64-musl": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		suffix: "linux-x86_64",
+		native: false,
+		note: "Runs under gcompat on Alpine; `apk add gcompat` required."
+	}),
+	"win-arm64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		suffix: "windows-x86_64.exe",
+		native: false,
+		note: "Runs under Prism x86_64 emulation on Windows ARM64."
+	}),
+	"win-x64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		suffix: "windows-x86_64.exe",
+		native: true,
+		note: void 0
+	})
 });
 function getBazelAssetEntry(platformArch) {
-  return BAZEL_ASSET_MAP[platformArch];
+	return BAZEL_ASSET_MAP[platformArch];
 }
+/**
+* Build the GitHub release-asset download URL for an upstream Bazel binary.
+* Returns `undefined` when no entry exists for the requested platform-arch.
+*
+* Note: the underlying asset may be a compat-layer build (see
+* `BazelAssetEntry.native`). Callers that require a native binary should check
+* `getBazelAssetEntry(platformArch).native` before downloading.
+*
+* Reference: https://github.com/bazelbuild/bazel/releases.
+*
+* @example
+*   ;```typescript
+*   const url = getBazelDownloadUrl({
+*     version: '7.4.1',
+*     platformArch: 'darwin-arm64',
+*   })
+*   // → 'https://github.com/bazelbuild/bazel/releases/download/7.4.1/bazel-7.4.1-darwin-arm64'
+*   ```
+*/
 function getBazelDownloadUrl(opts) {
-  const { platformArch, version } = opts;
-  const entry = BAZEL_ASSET_MAP[platformArch];
-  if (!entry) {
-    return void 0;
-  }
-  return `https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-${entry.suffix}`;
+	const { platformArch, version } = opts;
+	const entry = BAZEL_ASSET_MAP[platformArch];
+	if (!entry) return;
+	return `https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-${entry.suffix}`;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  BAZEL_ASSET_MAP,
-  getBazelAssetEntry,
-  getBazelDownloadUrl
-});
+
+//#endregion
+exports.BAZEL_ASSET_MAP = BAZEL_ASSET_MAP;
+exports.getBazelAssetEntry = getBazelAssetEntry;
+exports.getBazelDownloadUrl = getBazelDownloadUrl;

package/dist/external-tools/bazel/from-download.js

@@ -1,49 +1,55 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var from_download_exports = {};
-__export(from_download_exports, {
-  bazelFromDownload: () => bazelFromDownload
-});
-module.exports = __toCommonJS(from_download_exports);
-var import_from_download = require("../from-download");
-var import_asset_names = require("./asset-names");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_external_tools_from_download = require('../from-download.js');
+const require_external_tools_bazel_asset_names = require('./asset-names.js');
+
+//#region src/external-tools/bazel/from-download.ts
+/**
+* @file `bazelFromDownload()` — fetches the upstream Bazel binary and returns a
+*   `ResolvedBazel` pointing at the cached executable. Bazel ships as a single
+*   executable per platform (no tar/zip wrapper), so this tier uses
+*   `downloadToolArchive` directly — no extraction step. The dlx downloader
+*   already chmods the file to 0o755 on POSIX, so the cached path is runnable
+*   as soon as it lands on disk. Returns `undefined` when Bazel doesn't publish
+*   a build for the target `platformArch` (no entry in `BAZEL_ASSET_MAP`).
+*   Trust-on-first-use: pass `integrity` from `external-tools.json` when
+*   available. Omit on first install; the underlying call computes the SRI and
+*   writes it into the dlx cache metadata so a follow-up `external-tools.json`
+*   update can pin it.
+*/
+/**
+* Resolve Bazel by downloading the upstream binary. Returns the standard
+* `ResolvedBazel` shape with `source: 'download'`.
+*
+* @example
+*   ;```typescript
+*   const bazel = await bazelFromDownload({
+*     version: '7.4.1',
+*     platformArch: 'darwin-arm64',
+*   })
+*   // → { path: '/.../bazel-7.4.1-darwin-arm64', source: 'download' }
+*   ```
+*/
 async function bazelFromDownload(opts) {
-  const { downloader, integrity, platformArch, version } = opts;
-  const url = (0, import_asset_names.getBazelDownloadUrl)({ version, platformArch });
-  if (!url) {
-    return void 0;
-  }
-  const archive = await (0, import_from_download.downloadToolArchive)({
-    url,
-    name: `bazel-${version}-${platformArch}`,
-    integrity,
-    downloader
-  });
-  return {
-    path: archive.archivePath,
-    source: "download",
-    integrity: archive.integrity
-  };
+	const { downloader, integrity, platformArch, version } = opts;
+	const url = require_external_tools_bazel_asset_names.getBazelDownloadUrl({
+		version,
+		platformArch
+	});
+	if (!url) return;
+	const archive = await require_external_tools_from_download.downloadToolArchive({
+		url,
+		name: `bazel-${version}-${platformArch}`,
+		integrity,
+		downloader
+	});
+	return {
+		path: archive.archivePath,
+		source: "download",
+		integrity: archive.integrity
+	};
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  bazelFromDownload
-});
+
+//#endregion
+exports.bazelFromDownload = bazelFromDownload;

package/dist/external-tools/bazel/from-path.js

@@ -1,41 +1,30 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var from_path_exports = {};
-__export(from_path_exports, {
-  bazelFromPath: () => bazelFromPath
-});
-module.exports = __toCommonJS(from_path_exports);
-var import_which = require("../../bin/which");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_bin_which = require('../../bin/which.js');
+
+//#region src/external-tools/bazel/from-path.ts
+/**
+* @file `bazelFromPath()` — looks for `bazelisk` first, then `bazel`, on the
+*   system PATH. Bazelisk is preferred because it honors `.bazelversion` and
+*   downloads the project-pinned Bazel into its own cache — closer to what real
+*   Bazel users want. Returns `undefined` if neither is found on PATH.
+*/
 async function bazelFromPath() {
-  const bazelisk = await (0, import_which.which)("bazelisk", { nothrow: true });
-  if (typeof bazelisk === "string") {
-    return { path: bazelisk, source: "path" };
-  }
-  const bazel = await (0, import_which.which)("bazel", { nothrow: true });
-  if (typeof bazel === "string") {
-    return { path: bazel, source: "path" };
-  }
-  return void 0;
+	const bazelisk = await require_bin_which.which("bazelisk", { nothrow: true });
+	/* c8 ignore start - reached only when bazelisk is on PATH. */
+	if (typeof bazelisk === "string") return {
+		path: bazelisk,
+		source: "path"
+	};
+	/* c8 ignore stop */
+	const bazel = await require_bin_which.which("bazel", { nothrow: true });
+	/* c8 ignore start - reached only when bazel is on PATH. */
+	if (typeof bazel === "string") return {
+		path: bazel,
+		source: "path"
+	};
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  bazelFromPath
-});
+
+//#endregion
+exports.bazelFromPath = bazelFromPath;

package/dist/external-tools/bazel/read-bazel-version-file.js

@@ -1,61 +1,39 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var read_bazel_version_file_exports = {};
-__export(read_bazel_version_file_exports, {
-  readBazelVersionFile: () => readBazelVersionFile
-});
-module.exports = __toCommonJS(read_bazel_version_file_exports);
-var import_node_path = __toESM(require("node:path"));
-var import_read_file = require("../../fs/read-file");
-var import_string = require("../../primordials/string");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_primordials_string = require('../../primordials/string.js');
+const require_fs_read_file = require('../../fs/read-file.js');
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+
+//#region src/external-tools/bazel/read-bazel-version-file.ts
+/**
+* @file `readBazelVersionFile(workspaceDir)` — walks up from `workspaceDir`
+*   looking for a `.bazelversion` file (the Bazel/Bazelisk convention for
+*   pinning the project's Bazel version). Returns the trimmed contents as a
+*   version string, or `undefined` when no file is found before reaching the
+*   filesystem root. The walk respects the "first `.bazelversion` wins"
+*   convention used by Bazelisk itself. Some special values that
+*   `.bazelversion` can hold (`latest`, `last_green`, `rolling`, etc.) are
+*   returned verbatim; resolution of those into concrete X.Y.Z versions is the
+*   orchestrator's job.
+*/
 const BAZEL_VERSION_FILE = ".bazelversion";
 async function readBazelVersionFile(startDir) {
-  let current = import_node_path.default.resolve(startDir);
-  while (true) {
-    const candidate = import_node_path.default.join(current, BAZEL_VERSION_FILE);
-    const content = await (0, import_read_file.safeReadFile)(candidate, { encoding: "utf8" });
-    if (content !== void 0) {
-      const hashIdx = (0, import_string.StringPrototypeIndexOf)(content, "#");
-      const base = hashIdx === -1 ? content : (0, import_string.StringPrototypeSlice)(content, 0, hashIdx);
-      const version = (0, import_string.StringPrototypeTrim)(base);
-      return version.length > 0 ? version : void 0;
-    }
-    const parent = import_node_path.default.dirname(current);
-    if (parent === current) {
-      return void 0;
-    }
-    current = parent;
-  }
+	let current = node_path.default.resolve(startDir);
+	while (true) {
+		const content = await /* @__PURE__ */ require_fs_read_file.safeReadFile(node_path.default.join(current, BAZEL_VERSION_FILE), { encoding: "utf8" });
+		if (content !== void 0) {
+			const hashIdx = require_primordials_string.StringPrototypeIndexOf(content, "#");
+			const version = require_primordials_string.StringPrototypeTrim(hashIdx === -1 ? content : require_primordials_string.StringPrototypeSlice(content, 0, hashIdx));
+			return version.length > 0 ? version : void 0;
+		}
+		const parent = node_path.default.dirname(current);
+		if (parent === current) return;
+		current = parent;
+	}
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  readBazelVersionFile
-});
+
+//#endregion
+exports.readBazelVersionFile = readBazelVersionFile;

package/dist/external-tools/bazel/resolve-asset-url.js

@@ -1,42 +1,27 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var resolve_asset_url_exports = {};
-__export(resolve_asset_url_exports, {
-  resolveBazelAssetUrl: () => resolveBazelAssetUrl
-});
-module.exports = __toCommonJS(resolve_asset_url_exports);
-var import_asset_names = require("./asset-names");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_external_tools_bazel_asset_names = require('./asset-names.js');
+
+//#region src/external-tools/bazel/resolve-asset-url.ts
+/**
+* @file `resolveBazelAssetUrl(version, platformArch)` — builds the upstream
+*   GitHub Releases download URL for a Bazel binary. Returns `undefined` if the
+*   platform-arch isn't in our asset map. Bazel publishes to
+*   https://github.com/bazelbuild/bazel/releases/download/<X.Y.Z>/bazel-<X.Y.Z>-<suffix>
+*   where `<suffix>` is one of `darwin-arm64`, `darwin-x86_64`, `linux-arm64`,
+*   `linux-x86_64`, `windows-x86_64.exe`.
+*/
 function resolveBazelAssetUrl(version, platformArch) {
-  const entry = (0, import_asset_names.getBazelAssetEntry)(platformArch);
-  if (!entry) {
-    return void 0;
-  }
-  const filename = `bazel-${version}-${entry.suffix}`;
-  return {
-    url: `https://github.com/bazelbuild/bazel/releases/download/${version}/${filename}`,
-    filename,
-    native: entry.native
-  };
+	const entry = require_external_tools_bazel_asset_names.getBazelAssetEntry(platformArch);
+	if (!entry) return;
+	const filename = `bazel-${version}-${entry.suffix}`;
+	return {
+		url: `https://github.com/bazelbuild/bazel/releases/download/${version}/${filename}`,
+		filename,
+		native: entry.native
+	};
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  resolveBazelAssetUrl
-});
+
+//#endregion
+exports.resolveBazelAssetUrl = resolveBazelAssetUrl;

package/dist/external-tools/bazel/resolve-bazel-version.js

@@ -1,59 +1,37 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var resolve_bazel_version_exports = {};
-__export(resolve_bazel_version_exports, {
-  resolveBazelVersion: () => resolveBazelVersion
-});
-module.exports = __toCommonJS(resolve_bazel_version_exports);
-var import_node_process = __toESM(require("node:process"));
-var import_github_listing = require("../../releases/github-listing");
-var import_read_bazel_version_file = require("./read-bazel-version-file");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_releases_github_listing = require('../../releases/github-listing.js');
+const require_external_tools_bazel_read_bazel_version_file = require('./read-bazel-version-file.js');
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+
+//#region src/external-tools/bazel/resolve-bazel-version.ts
+/**
+* @file `resolveBazelVersion({ cwd })` — picks the Bazel version to run for a
+*   project, matching the bazelisk precedence:
+*
+*   1. `USE_BAZEL_VERSION` env var
+*   2. `.bazelversion` walking up from `cwd`
+*   3. Fallback to the latest stable release queried from GitHub Releases (via
+*      socket-lib's `getLatestRelease`, which already handles GH_TOKEN auth,
+*      retry, and the REST/GraphQL fallback). Returns `undefined` only if both
+*      steps 2 and 3 fail with no env override — in that case the caller
+*      surfaces an actionable error.
+*/
 async function resolveBazelVersion(options) {
-  const cwd = options?.cwd ?? import_node_process.default.cwd();
-  const envOverride = import_node_process.default.env["USE_BAZEL_VERSION"];
-  if (envOverride && envOverride.length > 0) {
-    return envOverride;
-  }
-  const fromFile = await (0, import_read_bazel_version_file.readBazelVersionFile)(cwd);
-  if (fromFile) {
-    return fromFile;
-  }
-  const latest = await (0, import_github_listing.getLatestRelease)(
-    "",
-    { owner: "bazelbuild", repo: "bazel" },
-    { nothrow: true }
-  );
-  return latest ?? void 0;
+	const cwd = options?.cwd ?? node_process.default.cwd();
+	const envOverride = node_process.default.env["USE_BAZEL_VERSION"];
+	if (envOverride && envOverride.length > 0) return envOverride;
+	const fromFile = await require_external_tools_bazel_read_bazel_version_file.readBazelVersionFile(cwd);
+	if (fromFile) return fromFile;
+	return await require_releases_github_listing.getLatestRelease("", {
+		owner: "bazelbuild",
+		repo: "bazel"
+	}, { nothrow: true }) ?? void 0;
+	/* c8 ignore stop */
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  resolveBazelVersion
-});
+
+//#endregion
+exports.resolveBazelVersion = resolveBazelVersion;