@socketsecurity/lib 6.0.5 → 6.0.6

package/dist/events/exit/intercept.js

@@ -14,7 +14,7 @@ const require_events_exit__internal = require('./_internal.js');
 */
 /* c8 ignore start - processEmit + processReallyExit interceptors
 only fire on real process exit/emit; can't be triggered in-test. */
-/* @__NO_SIDE_EFFECTS__ */
+/*@__NO_SIDE_EFFECTS__*/
 function processEmit(eventName, exitCode, ...args) {
 	if (eventName === "exit") {
 		let actualExitCode = exitCode;
@@ -38,7 +38,7 @@ function processEmit(eventName, exitCode, ...args) {
 		...args
 	]);
 }
-/* @__NO_SIDE_EFFECTS__ */
+/*@__NO_SIDE_EFFECTS__*/
 function processReallyExit(code) {
 	const exitCode = code || 0;
 	if (require_events_exit__internal.globalProcess) require_events_exit__internal.globalProcess.exitCode = exitCode;

package/dist/events/exit/lifecycle.js

@@ -12,7 +12,7 @@ const require_events_exit_intercept = require('./intercept.js');
 *   cycle.
 */
 let _sigListeners;
-/* @__NO_SIDE_EFFECTS__ */
+/*@__NO_SIDE_EFFECTS__*/
 function getSignalListeners() {
 	if (_sigListeners === void 0) {
 		_sigListeners = { __proto__: null };
@@ -41,7 +41,7 @@ function getSignalListeners() {
 *   // Signal handlers are now active
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
+/*@__NO_SIDE_EFFECTS__*/
 function load() {
 	/* c8 ignore next - !globalProcess never fires in Node tests. */
 	if (require_events_exit__internal.isLoaded() || !require_events_exit__internal.globalProcess) return;
@@ -73,7 +73,7 @@ function load() {
 *   // Signal handlers are now removed
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
+/*@__NO_SIDE_EFFECTS__*/
 function unload() {
 	/* c8 ignore start */
 	if (!require_events_exit__internal.isLoaded() || !require_events_exit__internal.globalProcess) return;

package/dist/events/exit/signals.js

@@ -19,7 +19,7 @@ const require_events_exit__internal = require('./_internal.js');
 *   console.log(sigs) // ['SIGABRT', 'SIGALRM', 'SIGHUP', ...]
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
+/*@__NO_SIDE_EFFECTS__*/
 function signals() {
 	return /* @__PURE__ */ require_events_exit__internal.getSignals();
 }

package/dist/external/@sinclair/typebox/value.js

@@ -4071,7 +4071,11 @@ var require_extends_check = /* @__PURE__ */ __commonJSMin(((exports) => {
 		return Visit(left, right) === ExtendsResult.False ? ExtendsResult.False : index_10.TypeGuard.IsOptional(left) && !index_10.TypeGuard.IsOptional(right) ? ExtendsResult.False : ExtendsResult.True;
 	}
 	function FromObjectRight(left, right) {
-		return index_10.TypeGuard.IsUnknown(left) ? ExtendsResult.False : index_10.TypeGuard.IsAny(left) ? ExtendsResult.Union : index_10.TypeGuard.IsNever(left) || index_10.TypeGuard.IsLiteralString(left) && IsObjectStringLike(right) || index_10.TypeGuard.IsLiteralNumber(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsLiteralBoolean(left) && IsObjectBooleanLike(right) || index_10.TypeGuard.IsSymbol(left) && IsObjectSymbolLike(right) || index_10.TypeGuard.IsBigInt(left) && IsObjectBigIntLike(right) || index_10.TypeGuard.IsString(left) && IsObjectStringLike(right) || index_10.TypeGuard.IsSymbol(left) && IsObjectSymbolLike(right) || index_10.TypeGuard.IsNumber(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsInteger(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsBoolean(left) && IsObjectBooleanLike(right) || index_10.TypeGuard.IsUint8Array(left) && IsObjectUint8ArrayLike(right) || index_10.TypeGuard.IsDate(left) && IsObjectDateLike(right) || index_10.TypeGuard.IsConstructor(left) && IsObjectConstructorLike(right) || index_10.TypeGuard.IsFunction(left) && IsObjectFunctionLike(right) ? ExtendsResult.True : index_10.TypeGuard.IsRecord(left) && index_10.TypeGuard.IsString(RecordKey(left)) ? right[index_8.Hint] === "Record" ? ExtendsResult.True : ExtendsResult.False : index_10.TypeGuard.IsRecord(left) && index_10.TypeGuard.IsNumber(RecordKey(left)) ? IsObjectPropertyCount(right, 0) ? ExtendsResult.True : ExtendsResult.False : ExtendsResult.False;
+		return index_10.TypeGuard.IsUnknown(left) ? ExtendsResult.False : index_10.TypeGuard.IsAny(left) ? ExtendsResult.Union : index_10.TypeGuard.IsNever(left) || index_10.TypeGuard.IsLiteralString(left) && IsObjectStringLike(right) || index_10.TypeGuard.IsLiteralNumber(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsLiteralBoolean(left) && IsObjectBooleanLike(right) || index_10.TypeGuard.IsSymbol(left) && IsObjectSymbolLike(right) || index_10.TypeGuard.IsBigInt(left) && IsObjectBigIntLike(right) || index_10.TypeGuard.IsString(left) && IsObjectStringLike(right) || index_10.TypeGuard.IsSymbol(left) && IsObjectSymbolLike(right) || index_10.TypeGuard.IsNumber(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsInteger(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsBoolean(left) && IsObjectBooleanLike(right) || index_10.TypeGuard.IsUint8Array(left) && IsObjectUint8ArrayLike(right) || index_10.TypeGuard.IsDate(left) && IsObjectDateLike(right) || index_10.TypeGuard.IsConstructor(left) && IsObjectConstructorLike(right) || index_10.TypeGuard.IsFunction(left) && IsObjectFunctionLike(right) ? ExtendsResult.True : index_10.TypeGuard.IsRecord(left) && index_10.TypeGuard.IsString(RecordKey(left)) ? (() => {
+			return right[index_8.Hint] === "Record" ? ExtendsResult.True : ExtendsResult.False;
+		})() : index_10.TypeGuard.IsRecord(left) && index_10.TypeGuard.IsNumber(RecordKey(left)) ? (() => {
+			return IsObjectPropertyCount(right, 0) ? ExtendsResult.True : ExtendsResult.False;
+		})() : ExtendsResult.False;
 	}
 	function FromObject(left, right) {
 		return IsStructuralRight(right) ? StructuralRight(left, right) : index_10.TypeGuard.IsRecord(right) ? FromRecordRight(left, right) : !index_10.TypeGuard.IsObject(right) ? ExtendsResult.False : (() => {

package/dist/external/@sinclair/typebox.js

@@ -4284,7 +4284,11 @@ var require_extends_check = /* @__PURE__ */ __commonJSMin(((exports) => {
 		return Visit(left, right) === ExtendsResult.False ? ExtendsResult.False : index_10.TypeGuard.IsOptional(left) && !index_10.TypeGuard.IsOptional(right) ? ExtendsResult.False : ExtendsResult.True;
 	}
 	function FromObjectRight(left, right) {
-		return index_10.TypeGuard.IsUnknown(left) ? ExtendsResult.False : index_10.TypeGuard.IsAny(left) ? ExtendsResult.Union : index_10.TypeGuard.IsNever(left) || index_10.TypeGuard.IsLiteralString(left) && IsObjectStringLike(right) || index_10.TypeGuard.IsLiteralNumber(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsLiteralBoolean(left) && IsObjectBooleanLike(right) || index_10.TypeGuard.IsSymbol(left) && IsObjectSymbolLike(right) || index_10.TypeGuard.IsBigInt(left) && IsObjectBigIntLike(right) || index_10.TypeGuard.IsString(left) && IsObjectStringLike(right) || index_10.TypeGuard.IsSymbol(left) && IsObjectSymbolLike(right) || index_10.TypeGuard.IsNumber(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsInteger(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsBoolean(left) && IsObjectBooleanLike(right) || index_10.TypeGuard.IsUint8Array(left) && IsObjectUint8ArrayLike(right) || index_10.TypeGuard.IsDate(left) && IsObjectDateLike(right) || index_10.TypeGuard.IsConstructor(left) && IsObjectConstructorLike(right) || index_10.TypeGuard.IsFunction(left) && IsObjectFunctionLike(right) ? ExtendsResult.True : index_10.TypeGuard.IsRecord(left) && index_10.TypeGuard.IsString(RecordKey(left)) ? right[index_8.Hint] === "Record" ? ExtendsResult.True : ExtendsResult.False : index_10.TypeGuard.IsRecord(left) && index_10.TypeGuard.IsNumber(RecordKey(left)) ? IsObjectPropertyCount(right, 0) ? ExtendsResult.True : ExtendsResult.False : ExtendsResult.False;
+		return index_10.TypeGuard.IsUnknown(left) ? ExtendsResult.False : index_10.TypeGuard.IsAny(left) ? ExtendsResult.Union : index_10.TypeGuard.IsNever(left) || index_10.TypeGuard.IsLiteralString(left) && IsObjectStringLike(right) || index_10.TypeGuard.IsLiteralNumber(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsLiteralBoolean(left) && IsObjectBooleanLike(right) || index_10.TypeGuard.IsSymbol(left) && IsObjectSymbolLike(right) || index_10.TypeGuard.IsBigInt(left) && IsObjectBigIntLike(right) || index_10.TypeGuard.IsString(left) && IsObjectStringLike(right) || index_10.TypeGuard.IsSymbol(left) && IsObjectSymbolLike(right) || index_10.TypeGuard.IsNumber(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsInteger(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsBoolean(left) && IsObjectBooleanLike(right) || index_10.TypeGuard.IsUint8Array(left) && IsObjectUint8ArrayLike(right) || index_10.TypeGuard.IsDate(left) && IsObjectDateLike(right) || index_10.TypeGuard.IsConstructor(left) && IsObjectConstructorLike(right) || index_10.TypeGuard.IsFunction(left) && IsObjectFunctionLike(right) ? ExtendsResult.True : index_10.TypeGuard.IsRecord(left) && index_10.TypeGuard.IsString(RecordKey(left)) ? (() => {
+			return right[index_8.Hint] === "Record" ? ExtendsResult.True : ExtendsResult.False;
+		})() : index_10.TypeGuard.IsRecord(left) && index_10.TypeGuard.IsNumber(RecordKey(left)) ? (() => {
+			return IsObjectPropertyCount(right, 0) ? ExtendsResult.True : ExtendsResult.False;
+		})() : ExtendsResult.False;
 	}
 	function FromObject(left, right) {
 		return IsStructuralRight(right) ? StructuralRight(left, right) : index_10.TypeGuard.IsRecord(right) ? FromRecordRight(left, right) : !index_10.TypeGuard.IsObject(right) ? ExtendsResult.False : (() => {

package/dist/external/@socketregistry/packageurl-js.js

@@ -6113,6 +6113,33 @@ var require_dist = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			return `vers:${this.scheme}/${ArrayPrototypeJoin(parts, "|")}`;
 		}
 	};
+	0 && (module.exports = {
+		Err,
+		Ok,
+		PURL_Type,
+		PackageURL,
+		PurlBuilder,
+		PurlComponent,
+		PurlError,
+		PurlInjectionError,
+		PurlQualifierNames,
+		PurlType,
+		ResultUtils,
+		UrlConverter,
+		Vers,
+		compare,
+		containsInjectionCharacters,
+		createMatcher,
+		equals,
+		err,
+		findInjectionCharCode,
+		formatInjectionChar,
+		matches,
+		ok,
+		parseNpmSpecifier,
+		stringify,
+		stringifySpec
+	});
 }));
 /*!
 Copyright (c) the purl authors

package/dist/external-tools/bazel/resolve.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../../primordials/map-set.js');
 const require_external_tools_bazel_from_download = require('./from-download.js');
 const require_external_tools_bazel_from_path = require('./from-path.js');
 
@@ -21,7 +22,7 @@ const require_external_tools_bazel_from_path = require('./from-path.js');
 *      `downloadIfMissing` produces two distinct cache entries so the second
 *      call can fall through to the download tier.
 */
-const resolutionCache = /* @__PURE__ */ new Map();
+const resolutionCache = new require_primordials_map_set.MapCtor();
 function cacheKey(opts) {
 	if (!opts?.downloadIfMissing) return "local-only";
 	const { integrity, platformArch, version } = opts.downloadIfMissing;

package/dist/external-tools/cdxgen/resolve.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../../primordials/map-set.js');
 const require_external_tools_cdxgen_from_download = require('./from-download.js');
 const require_external_tools_cdxgen_from_path = require('./from-path.js');
 const require_external_tools_cdxgen_from_vfs = require('./from-vfs.js');
@@ -20,7 +21,7 @@ const require_external_tools_cdxgen_from_vfs = require('./from-vfs.js');
 *      `undefined` if all of the enabled sources miss. Memoized per
 *      option-shape.
 */
-const resolutionCache = /* @__PURE__ */ new Map();
+const resolutionCache = new require_primordials_map_set.MapCtor();
 function cacheKey(opts) {
 	if (!opts?.downloadIfMissing) return "local-only";
 	const { cacheDir, integrity, platformArch, variant, version } = opts.downloadIfMissing;

package/dist/external-tools/from-pip-venv.d.ts

@@ -0,0 +1,73 @@
+/**
+ * @file Generic "venv-install tier" for external-tools resolvers. Parallel to
+ *   `from-download.ts` — that one handles single-binary tools downloaded as
+ *   GitHub release assets; this one handles Python packages installed into a
+ *   single-purpose venv. Per-tool resolvers (skillspector, future Python CLIs)
+ *   compose their fourth tier on top of these helpers. Two helpers:
+ *
+ *   - `createPipVenv` — `python -m venv <cacheDir>` + `pip install <spec>`.
+ *     Idempotent: hits the existing venv when its entry-point already exists.
+ *     Stops at "venv created, entry-point present."
+ *   - `findPython` — locates `python3` (or `python` on Windows) on PATH. Returns
+ *     the absolute path or `undefined` when no Python is available. What this
+ *     does NOT do:
+ *   - Decide where the venv lives. The caller picks the cache dir (typically
+ *     under `getSocketDlxDir()`); we just create the venv there.
+ *   - Verify package integrity beyond pip's own wheel-hash mechanism. Pinning is
+ *     the caller's responsibility: pass exact-version `<pkg>==<ver>` or git-SHA
+ *     `git+...@<sha>`.
+ *   - Re-resolve when the cache is stale. The cache key is derived by the caller
+ *     from the install spec; a re-pin produces a new dir.
+ */
+export interface CreatePipVenvOptions {
+    /**
+     * Absolute path to the venv directory. Created if missing; reused if the
+     * entry-point already exists inside it.
+     */
+    readonly cacheDir: string;
+    /**
+     * Name of the entry-point executable. Matches the package's
+     * `[project.scripts]` key (or the package name when it's the same).
+     */
+    readonly entryPoint: string;
+    /**
+     * Pip-install argument — either `<pkg>==<version>` (PyPI exact pin) or
+     * `git+<https-url>@<sha>` (git-SHA pin). Anything else is rejected.
+     */
+    readonly installSpec: string;
+    /**
+     * Optional override for the Python interpreter. Defaults to
+     * {@link findPython}.
+     */
+    readonly python?: string | undefined;
+}
+export interface CreatePipVenvResult {
+    /**
+     * Absolute path to the entry-point binary inside the venv. Always set when
+     * `created` or the cache was already populated.
+     */
+    readonly entryPointPath: string;
+    /**
+     * `true` when this call created the venv (and ran pip install); `false` when
+     * the existing cache was reused.
+     */
+    readonly created: boolean;
+}
+/**
+ * Create (or reuse) a venv at `cacheDir` and pip-install `installSpec` into it.
+ * Returns the entry-point path + a `created` flag. Throws when:
+ *
+ * - No Python interpreter is on PATH (and none was passed via `python`).
+ * - `python -m venv` fails.
+ * - `pip install` fails.
+ * - The install succeeded but the entry-point was not created (caller passed a
+ *   wrong `entryPoint` name, or the package has no console script).
+ */
+export declare function createPipVenv(opts: CreatePipVenvOptions): Promise<CreatePipVenvResult>;
+/**
+ * Locate a Python interpreter. Prefer `python3` on macOS/Linux, fall back to
+ * `python` (the Windows convention). Returns `undefined` when neither is on
+ * PATH.
+ */
+export declare function findPython(): Promise<string | undefined>;
+export declare function pipVenvEntryPointPath(venvDir: string, entryPoint: string): string;

package/dist/external-tools/from-pip-venv.js

@@ -0,0 +1,98 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_bin_which = require('../bin/which.js');
+const require_process_spawn_child = require('../process/spawn/child.js');
+const require_fs_safe = require('../fs/safe.js');
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+
+//#region src/external-tools/from-pip-venv.ts
+/**
+* @file Generic "venv-install tier" for external-tools resolvers. Parallel to
+*   `from-download.ts` — that one handles single-binary tools downloaded as
+*   GitHub release assets; this one handles Python packages installed into a
+*   single-purpose venv. Per-tool resolvers (skillspector, future Python CLIs)
+*   compose their fourth tier on top of these helpers. Two helpers:
+*
+*   - `createPipVenv` — `python -m venv <cacheDir>` + `pip install <spec>`.
+*     Idempotent: hits the existing venv when its entry-point already exists.
+*     Stops at "venv created, entry-point present."
+*   - `findPython` — locates `python3` (or `python` on Windows) on PATH. Returns
+*     the absolute path or `undefined` when no Python is available. What this
+*     does NOT do:
+*   - Decide where the venv lives. The caller picks the cache dir (typically
+*     under `getSocketDlxDir()`); we just create the venv there.
+*   - Verify package integrity beyond pip's own wheel-hash mechanism. Pinning is
+*     the caller's responsibility: pass exact-version `<pkg>==<ver>` or git-SHA
+*     `git+...@<sha>`.
+*   - Re-resolve when the cache is stale. The cache key is derived by the caller
+*     from the install spec; a re-pin produces a new dir.
+*/
+/**
+* Create (or reuse) a venv at `cacheDir` and pip-install `installSpec` into it.
+* Returns the entry-point path + a `created` flag. Throws when:
+*
+* - No Python interpreter is on PATH (and none was passed via `python`).
+* - `python -m venv` fails.
+* - `pip install` fails.
+* - The install succeeded but the entry-point was not created (caller passed a
+*   wrong `entryPoint` name, or the package has no console script).
+*/
+async function createPipVenv(opts) {
+	const { cacheDir, entryPoint, installSpec } = opts;
+	const entryBin = pipVenvEntryPointPath(cacheDir, entryPoint);
+	if ((0, node_fs.existsSync)(entryBin)) return {
+		entryPointPath: entryBin,
+		created: false
+	};
+	const python = opts.python ?? await findPython();
+	if (!python) throw new Error("createPipVenv: no Python interpreter on PATH (looked for python3, python)");
+	await require_fs_safe.safeMkdir(node_path.default.dirname(cacheDir), { recursive: true });
+	await require_process_spawn_child.spawn(python, [
+		"-m",
+		"venv",
+		"--clear",
+		cacheDir
+	], { stdio: "pipe" });
+	const venvPython = pipVenvEntryPointPath(cacheDir, "python");
+	if (!(0, node_fs.existsSync)(venvPython)) throw new Error(`createPipVenv: venv created at ${cacheDir} but ${venvPython} is missing`);
+	await require_process_spawn_child.spawn(venvPython, [
+		"-m",
+		"pip",
+		"install",
+		"--no-input",
+		"--disable-pip-version-check",
+		installSpec
+	], { stdio: "pipe" });
+	if (!(0, node_fs.existsSync)(entryBin)) throw new Error(`createPipVenv: pip install ${installSpec} succeeded but entry-point ${entryPoint} was not created at ${entryBin}`);
+	return {
+		entryPointPath: entryBin,
+		created: true
+	};
+}
+/**
+* Locate a Python interpreter. Prefer `python3` on macOS/Linux, fall back to
+* `python` (the Windows convention). Returns `undefined` when neither is on
+* PATH.
+*/
+async function findPython() {
+	const candidates = node_process.default.platform === "win32" ? ["python", "python3"] : ["python3", "python"];
+	for (let i = 0, { length } = candidates; i < length; i += 1) {
+		const found = await require_bin_which.which(candidates[i], { nothrow: true });
+		if (typeof found === "string") return found;
+	}
+}
+function pipVenvEntryPointPath(venvDir, entryPoint) {
+	if (node_process.default.platform === "win32") return node_path.default.join(venvDir, "Scripts", `${entryPoint}.exe`);
+	return node_path.default.join(venvDir, "bin", entryPoint);
+}
+
+//#endregion
+exports.createPipVenv = createPipVenv;
+exports.findPython = findPython;
+exports.pipVenvEntryPointPath = pipVenvEntryPointPath;

package/dist/external-tools/janus/asset-names.js

@@ -26,7 +26,7 @@ const JANUS_ASSET_MAP = require_primordials_object.ObjectFreeze({
 * supported set. Use this from `from-download.ts` to throw a helpful error
 * rather than letting the URL builder silently return undefined.
 */
-const JANUS_SUPPORTED_PLATFORM_ARCHES = require_primordials_object.ObjectFreeze(Object.keys(JANUS_ASSET_MAP));
+const JANUS_SUPPORTED_PLATFORM_ARCHES = require_primordials_object.ObjectFreeze(require_primordials_object.ObjectKeys(JANUS_ASSET_MAP));
 function getJanusAssetEntry(platformArch) {
 	return JANUS_ASSET_MAP[platformArch];
 }

package/dist/external-tools/janus/from-download.js

@@ -2,6 +2,7 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_primordials_error = require('../../primordials/error.js');
 const require_paths_socket = require('../../paths/socket.js');
 const require_external_tools_from_download = require('../from-download.js');
 const require_external_tools_janus_asset_names = require('./asset-names.js');
@@ -20,15 +21,12 @@ node_path = require_runtime.__toESM(node_path);
 */
 async function janusFromDownload(opts) {
 	const { cacheDir, downloader, integrity, platformArch, version } = opts;
-	if (!require_external_tools_janus_asset_names.JANUS_SUPPORTED_PLATFORM_ARCHES.includes(platformArch)) {
-		const supported = require_external_tools_janus_asset_names.JANUS_SUPPORTED_PLATFORM_ARCHES.map((p) => `\`${p}\``).join(", ");
-		throw new Error(`janusFromDownload: platformArch must be one of [${supported}], got \`${platformArch}\`. Upstream janus only publishes the macOS arm64 build (see https://github.com/divmain/janus/releases); request \`darwin-arm64\` or use a different tool for other platforms.`);
-	}
+	if (!require_external_tools_janus_asset_names.JANUS_SUPPORTED_PLATFORM_ARCHES.includes(platformArch)) throw new require_primordials_error.ErrorCtor(`janusFromDownload: platformArch must be one of [${require_external_tools_janus_asset_names.JANUS_SUPPORTED_PLATFORM_ARCHES.map((p) => `\`${p}\``).join(", ")}], got \`${platformArch}\`. Upstream janus only publishes the macOS arm64 build (see https://github.com/divmain/janus/releases); request \`darwin-arm64\` or use a different tool for other platforms.`);
 	const url = require_external_tools_janus_asset_names.getJanusDownloadUrl({
 		version,
 		platformArch
 	});
-	if (!url) throw new Error(`janusFromDownload: no upstream asset for janus@${version} on \`${platformArch}\`. The platform is in the supported set but the version may be missing; check https://github.com/divmain/janus/releases/tag/v${version}.`);
+	if (!url) throw new require_primordials_error.ErrorCtor(`janusFromDownload: no upstream asset for janus@${version} on \`${platformArch}\`. The platform is in the supported set but the version may be missing; check https://github.com/divmain/janus/releases/tag/v${version}.`);
 	const extractedDir = cacheDir ?? node_path.default.join(require_paths_socket.getSocketWheelhouseDir(), "janus", version, platformArch);
 	const archive = await require_external_tools_from_download.downloadAndExtractTool({
 		url,

package/dist/external-tools/janus/resolve.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../../primordials/map-set.js');
 const require_external_tools_janus_from_download = require('./from-download.js');
 const require_external_tools_janus_from_path = require('./from-path.js');
 const require_external_tools_janus_from_vfs = require('./from-vfs.js');
@@ -18,7 +19,7 @@ const require_external_tools_janus_from_vfs = require('./from-vfs.js');
 *      platform-arch isn't shipped by upstream janus (currently darwin-arm64
 *      only). Memoized per option-shape.
 */
-const resolutionCache = /* @__PURE__ */ new Map();
+const resolutionCache = new require_primordials_map_set.MapCtor();
 function cacheKey(opts) {
 	if (!opts?.downloadIfMissing) return "local-only";
 	const { cacheDir, integrity, platformArch, version } = opts.downloadIfMissing;

package/dist/external-tools/jre/from-download.js

@@ -2,6 +2,7 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_primordials_string = require('../../primordials/string.js');
 const require_paths_socket = require('../../paths/socket.js');
 const require_external_tools_from_download = require('../from-download.js');
 const require_external_tools_jre_asset_names = require('./asset-names.js');
@@ -53,7 +54,7 @@ async function jreFromDownload(opts) {
 	const extractedDir = cacheDir ?? node_path.default.join(require_paths_socket.getSocketDlxDir(), "jre", String(version), platformArch);
 	const archive = await require_external_tools_from_download.downloadAndExtractTool({
 		url,
-		name: `adoptium-jre-${version}-${platformArch}${platformArch.startsWith("win-") ? ".zip" : ".tar.gz"}`,
+		name: `adoptium-jre-${version}-${platformArch}${require_primordials_string.StringPrototypeStartsWith(platformArch, "win-") ? ".zip" : ".tar.gz"}`,
 		integrity,
 		extractedDir,
 		extractOptions: { strip: 1 },

package/dist/external-tools/jre/resolve.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../../primordials/map-set.js');
 const require_external_tools_jre_from_download = require('./from-download.js');
 const require_external_tools_jre_from_java_home = require('./from-java-home.js');
 const require_external_tools_jre_from_path = require('./from-path.js');
@@ -26,7 +27,7 @@ const require_external_tools_jre_from_vfs = require('./from-vfs.js');
 *      `resetJreResolution()` clears the cache so tests can exercise the
 *      resolver fresh.
 */
-const resolutionCache = /* @__PURE__ */ new Map();
+const resolutionCache = new require_primordials_map_set.MapCtor();
 function cacheKey(opts) {
 	if (!opts?.downloadIfMissing) return "local-only";
 	const { cacheDir, integrity, platformArch, version } = opts.downloadIfMissing;

package/dist/external-tools/manifest.js

@@ -2,8 +2,10 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_error = require('../primordials/error.js');
+const require_primordials_string = require('../primordials/string.js');
 const require_integrity = require('../integrity.js');
 const require_primordials_array = require('../primordials/array.js');
+const require_primordials_object = require('../primordials/object.js');
 const require_fs_read_json = require('../fs/read-json.js');
 
 //#region src/external-tools/manifest.ts
@@ -59,7 +61,7 @@ function parseChecksum(raw, toolName, platformKey) {
 function parseChecksums(raw, toolName) {
 	if (!isObject(raw)) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' is missing a 'checksums' object`);
 	const out = {};
-	for (const platformKey of Object.keys(raw)) out[platformKey] = parseChecksum(raw[platformKey], toolName, platformKey);
+	for (const platformKey of require_primordials_object.ObjectKeys(raw)) out[platformKey] = parseChecksum(raw[platformKey], toolName, platformKey);
 	return out;
 }
 function parseToolEntry(raw, toolName) {
@@ -106,15 +108,15 @@ async function readExternalToolsManifest(filepath) {
 	const raw = await /* @__PURE__ */ require_fs_read_json.readJson(filepath);
 	if (!isObject(raw)) throw new require_primordials_error.ErrorCtor(`external-tools.json: expected top-level object, got: ${typeof raw}`);
 	const tools = {};
-	for (const toolName of Object.keys(raw)) {
-		if (toolName.startsWith("$")) continue;
+	for (const toolName of require_primordials_object.ObjectKeys(raw)) {
+		if (require_primordials_string.StringPrototypeStartsWith(toolName, "$")) continue;
 		tools[toolName] = parseToolEntry(raw[toolName], toolName);
 	}
 	return { tools };
 }
 function tryParseFlavored(raw, toolName) {
 	const flavors = {};
-	for (const key of Object.keys(raw)) {
+	for (const key of require_primordials_object.ObjectKeys(raw)) {
 		const value = raw[key];
 		if (!isObject(value)) continue;
 		const rf = value;
@@ -126,7 +128,7 @@ function tryParseFlavored(raw, toolName) {
 			checksums: parseChecksums(rf.checksums, `${toolName}.${key}`)
 		};
 	}
-	if (Object.keys(flavors).length === 0) return;
+	if (require_primordials_object.ObjectKeys(flavors).length === 0) return;
 	return {
 		description: String(raw["description"] ?? ""),
 		version: String(raw["version"] ?? ""),

package/dist/external-tools/opengrep/resolve.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../../primordials/map-set.js');
 const require_external_tools_opengrep_from_download = require('./from-download.js');
 const require_external_tools_opengrep_from_path = require('./from-path.js');
 const require_external_tools_opengrep_from_vfs = require('./from-vfs.js');
@@ -16,7 +17,7 @@ const require_external_tools_opengrep_from_vfs = require('./from-vfs.js');
 *      passed) Returns `undefined` if all of the enabled sources miss. Memoized
 *      per option-shape.
 */
-const resolutionCache = /* @__PURE__ */ new Map();
+const resolutionCache = new require_primordials_map_set.MapCtor();
 function cacheKey(opts) {
 	if (!opts?.downloadIfMissing) return "local-only";
 	const { cacheDir, integrity, platformArch, version } = opts.downloadIfMissing;

package/dist/external-tools/sbt/resolve.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../../primordials/map-set.js');
 const require_external_tools_sbt_from_download = require('./from-download.js');
 const require_external_tools_sbt_from_path = require('./from-path.js');
 const require_external_tools_sbt_from_vfs = require('./from-vfs.js');
@@ -18,7 +19,7 @@ const require_external_tools_sbt_from_vfs = require('./from-vfs.js');
 *      download-sourced SBT is the `sbt` script, which finds its own JRE.
 *      Memoized per option-shape.
 */
-const resolutionCache = /* @__PURE__ */ new Map();
+const resolutionCache = new require_primordials_map_set.MapCtor();
 function cacheKey(opts) {
 	if (!opts?.downloadIfMissing) return "local-only";
 	const { cacheDir, integrity, version } = opts.downloadIfMissing;

package/dist/external-tools/skillspector/from-dlx.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @file `skillspectorFromDlx()` — DLX-venv tier of SkillSpector resolution.
+ *   Creates a single-purpose venv under `~/.socket/_dlx/skillspector/<sha>/`
+ *   and pip-installs the pinned git SHA. Returns `undefined` when:
+ *
+ *   - No Python interpreter is on PATH (host lacks Python 3.12+).
+ *   - The venv-create or pip-install command fails. Idempotent: hits the cached
+ *     venv when its `skillspector` entry-point already exists.
+ */
+import type { ResolvedSkillSpector } from './types';
+export interface SkillSpectorFromDlxOptions {
+    /**
+     * Pinned upstream SHA. Combined with the canonical NVIDIA/skillspector repo
+     * URL to form the pip-install spec
+     * `git+https://github.com/NVIDIA/skillspector.git@<sha>`.
+     */
+    readonly sha: string;
+    /**
+     * Cache directory override. Defaults to `getSocketDlxDir() +
+     * 'skillspector/<sha>'`. Tests pass a tmpdir.
+     */
+    readonly cacheDir?: string | undefined;
+}
+export declare function skillspectorFromDlx(opts: SkillSpectorFromDlxOptions): Promise<ResolvedSkillSpector | undefined>;

package/dist/external-tools/skillspector/from-dlx.js

@@ -0,0 +1,41 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_paths_socket = require('../../paths/socket.js');
+const require_external_tools_from_pip_venv = require('../from-pip-venv.js');
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+
+//#region src/external-tools/skillspector/from-dlx.ts
+/**
+* @file `skillspectorFromDlx()` — DLX-venv tier of SkillSpector resolution.
+*   Creates a single-purpose venv under `~/.socket/_dlx/skillspector/<sha>/`
+*   and pip-installs the pinned git SHA. Returns `undefined` when:
+*
+*   - No Python interpreter is on PATH (host lacks Python 3.12+).
+*   - The venv-create or pip-install command fails. Idempotent: hits the cached
+*     venv when its `skillspector` entry-point already exists.
+*/
+const UPSTREAM_REPO = "https://github.com/NVIDIA/skillspector.git";
+async function skillspectorFromDlx(opts) {
+	const { sha } = opts;
+	if (!sha) return;
+	const cacheDir = opts.cacheDir ?? node_path.default.join(require_paths_socket.getSocketDlxDir(), "skillspector", sha);
+	const installSpec = `git+${UPSTREAM_REPO}@${sha}`;
+	try {
+		return {
+			path: (await require_external_tools_from_pip_venv.createPipVenv({
+				cacheDir,
+				entryPoint: "skillspector",
+				installSpec
+			})).entryPointPath,
+			source: "dlx"
+		};
+	} catch {
+		return;
+	}
+}
+
+//#endregion
+exports.skillspectorFromDlx = skillspectorFromDlx;

package/dist/external-tools/skillspector/from-path.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @file `skillspectorFromPath()` — `which skillspector` lookup. Reports
+ *   `source: 'pipx'` when the resolved path lives under a `pipx/venvs/`
+ *   directory (the dev's `pipx install skillspector` path); reports `source:
+ *   'path'` otherwise (a one-off binary on PATH).
+ */
+import type { ResolvedSkillSpector } from './types';
+export declare function skillspectorFromPath(): Promise<ResolvedSkillSpector | undefined>;

package/dist/external-tools/skillspector/from-path.js

@@ -0,0 +1,32 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_bin_which = require('../../bin/which.js');
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+
+//#region src/external-tools/skillspector/from-path.ts
+/**
+* @file `skillspectorFromPath()` — `which skillspector` lookup. Reports
+*   `source: 'pipx'` when the resolved path lives under a `pipx/venvs/`
+*   directory (the dev's `pipx install skillspector` path); reports `source:
+*   'path'` otherwise (a one-off binary on PATH).
+*/
+const PIPX_PATH_SEGMENT_RE = /pipx[/\\]venvs[/\\]/;
+async function skillspectorFromPath() {
+	const resolved = await require_bin_which.which("skillspector", { nothrow: true });
+	if (typeof resolved !== "string") return;
+	const normalized = node_path.default.normalize(resolved);
+	if (PIPX_PATH_SEGMENT_RE.test(normalized)) return {
+		path: normalized,
+		source: "pipx"
+	};
+	return {
+		path: normalized,
+		source: "path"
+	};
+}
+
+//#endregion
+exports.skillspectorFromPath = skillspectorFromPath;

package/dist/external-tools/skillspector/from-vfs.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @file `skillspectorFromVfs()` — extracts SkillSpector from the smol Node VFS
+ *   if it's bundled. Returns `undefined` when the binary doesn't carry
+ *   skillspector.
+ */
+import type { ResolvedSkillSpector } from './types';
+export declare const SKILLSPECTOR_VFS_KEY = "skillspector";
+export declare function skillspectorFromVfs(): Promise<ResolvedSkillSpector | undefined>;