@socketsecurity/lib 6.0.5 → 6.0.7

package/dist/events/exit/_internal.js

@@ -8,67 +8,63 @@ const originalProcessEmit = globalProcess?.emit;
 const platform = globalProcess?.platform ?? "";
 const originalProcessReallyExit = globalProcess?.reallyExit;
 const WIN32 = platform === "win32";
-let _events;
-let _emitter;
-let _loaded = false;
-let _signals;
+let events;
+let emitter;
+let loaded = false;
+let signals;
 /* c8 ignore start - Only called from signal-listener body and
 processEmit/processReallyExit interceptors, all of which are
 c8-ignored. Cannot be reached from the test runner. */
-/* @__NO_SIDE_EFFECTS__ */
 function emit(event, code, signal) {
-	const emitter = /* @__PURE__ */ getEmitter();
-	if (emitter.emitted?.[event]) return;
-	if (emitter.emitted) emitter.emitted[event] = true;
-	emitter.emit(event, code, signal);
+	const sigEmitter = getEmitter();
+	if (sigEmitter.emitted?.[event]) return;
+	if (sigEmitter.emitted) sigEmitter.emitted[event] = true;
+	sigEmitter.emit(event, code, signal);
 }
 /* c8 ignore stop */
-/* @__NO_SIDE_EFFECTS__ */
 function getEmitter() {
-	/* c8 ignore start */
-	if (_emitter === void 0) {
-		if (globalProcess?.__signal_exit_emitter__) _emitter = globalProcess.__signal_exit_emitter__;
+	/* c8 ignore start - cross-copy signal-exit init, unreachable from test runner */
+	if (emitter === void 0) {
+		if (globalProcess?.__signal_exit_emitter__) emitter = globalProcess.__signal_exit_emitter__;
 		else if (globalProcess) {
-			const EventEmitter = (/* @__PURE__ */ getEvents()).EventEmitter;
-			_emitter = globalProcess.__signal_exit_emitter__ = new EventEmitter();
-			_emitter.count = 0;
-			_emitter.emitted = { __proto__: null };
+			const EventEmitterClass = getEvents().EventEmitter;
+			emitter = globalProcess.__signal_exit_emitter__ = new EventEmitterClass();
+			emitter.count = 0;
+			emitter.emitted = { __proto__: null };
 		}
-		if (_emitter && !_emitter.infinite) {
-			_emitter.setMaxListeners(Number.POSITIVE_INFINITY);
-			_emitter.infinite = true;
+		if (emitter && !emitter.infinite) {
+			emitter.setMaxListeners(Number.POSITIVE_INFINITY);
+			emitter.infinite = true;
 		}
 	}
 	/* c8 ignore stop */
-	return _emitter;
+	return emitter;
 }
-/* @__NO_SIDE_EFFECTS__ */
 function getEvents() {
-	/* c8 ignore start */
-	if (_events === void 0) _events = /* @__PURE__ */ require("node:events");
+	/* c8 ignore start - lazy require, second-call branch unreachable from test runner */
+	if (events === void 0) events = /*@__PURE__*/ require("node:events");
 	/* c8 ignore stop */
-	return _events;
+	return events;
 }
 /**
 * Get the cached signal list. Triggers lazy init on first call; after `load()`
 * runs it returns the filtered subset of successfully registered signals
 * instead of the full default list.
 */
-/* @__NO_SIDE_EFFECTS__ */
 function getSignals() {
-	if (_signals === void 0) {
-		_signals = [
+	if (signals === void 0) {
+		signals = [
 			"SIGABRT",
 			"SIGALRM",
 			"SIGHUP",
 			"SIGINT",
 			"SIGTERM"
 		];
-		/* c8 ignore start */
-		if (!WIN32) _signals.push("SIGVTALRM", "SIGXCPU", "SIGXFSZ", "SIGUSR2", "SIGTRAP", "SIGSYS", "SIGQUIT", "SIGIOT");
-		if (platform === "linux") _signals.push("SIGIO", "SIGPOLL", "SIGPWR", "SIGSTKFLT", "SIGUNUSED");
+		/* c8 ignore start - platform-specific signal lists run only on their target OS */
+		if (!WIN32) signals.push("SIGVTALRM", "SIGXCPU", "SIGXFSZ", "SIGUSR2", "SIGTRAP", "SIGSYS", "SIGQUIT", "SIGIOT");
+		if (platform === "linux") signals.push("SIGIO", "SIGPOLL", "SIGPWR", "SIGSTKFLT", "SIGUNUSED");
 	}
-	return _signals;
+	return signals;
 }
 /**
 * Read the loaded flag from a sibling leaf (lifecycle / on-exit).
@@ -76,7 +72,7 @@ function getSignals() {
 * @private
 */
 function isLoaded() {
-	return _loaded;
+	return loaded;
 }
 /**
 * Set the `loaded` flag from a sibling leaf (load / unload).
@@ -84,7 +80,7 @@ function isLoaded() {
 * @private
 */
 function setLoaded(value) {
-	_loaded = value;
+	loaded = value;
 }
 /**
 * Replace the cached signal list (used by `load()`'s filter step).
@@ -92,7 +88,7 @@ function setLoaded(value) {
 * @private
 */
 function setSignals(value) {
-	_signals = value;
+	signals = value;
 }
 
 //#endregion

package/dist/events/exit/handler.js

@@ -24,25 +24,24 @@ const require_events_exit_lifecycle = require('./lifecycle.js');
 *   remove()
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
 function onExit(cb, options) {
 	/* c8 ignore start */
 	if (!require_events_exit__internal.globalProcess) return function remove() {};
 	/* c8 ignore stop */
 	if (typeof cb !== "function") throw new require_primordials_error.TypeErrorCtor("a callback must be provided for exit handler");
-	if (require_events_exit__internal.isLoaded() === false) /* @__PURE__ */ require_events_exit_lifecycle.load();
+	if (require_events_exit__internal.isLoaded() === false) require_events_exit_lifecycle.load();
 	const { alwaysLast } = {
 		__proto__: null,
 		...options
 	};
 	let eventName = "exit";
 	if (alwaysLast) eventName = "afterexit";
-	const emitter = /* @__PURE__ */ require_events_exit__internal.getEmitter();
+	const emitter = require_events_exit__internal.getEmitter();
 	emitter.on(eventName, cb);
 	return function remove() {
 		emitter.removeListener(eventName, cb);
 		/* c8 ignore start */
-		if (!emitter.listeners("exit").length && !emitter.listeners("afterexit").length) /* @__PURE__ */ require_events_exit_lifecycle.unload();
+		if (!emitter.listeners("exit").length && !emitter.listeners("afterexit").length) require_events_exit_lifecycle.unload();
 		/* c8 ignore stop */
 	};
 }

package/dist/events/exit/intercept.js

@@ -14,7 +14,6 @@ const require_events_exit__internal = require('./_internal.js');
 */
 /* c8 ignore start - processEmit + processReallyExit interceptors
 only fire on real process exit/emit; can't be triggered in-test. */
-/* @__NO_SIDE_EFFECTS__ */
 function processEmit(eventName, exitCode, ...args) {
 	if (eventName === "exit") {
 		let actualExitCode = exitCode;
@@ -28,8 +27,8 @@ function processEmit(eventName, exitCode, ...args) {
 			...args
 		]);
 		const numExitCode = typeof actualExitCode === "number" ? actualExitCode : void 0;
-		/* @__PURE__ */ require_events_exit__internal.emit("exit", numExitCode, void 0);
-		/* @__PURE__ */ require_events_exit__internal.emit("afterexit", numExitCode, void 0);
+		require_events_exit__internal.emit("exit", numExitCode, void 0);
+		require_events_exit__internal.emit("afterexit", numExitCode, void 0);
 		return result;
 	}
 	return require_primordials_reflect.ReflectApply(require_events_exit__internal.originalProcessEmit, this, [
@@ -38,12 +37,11 @@ function processEmit(eventName, exitCode, ...args) {
 		...args
 	]);
 }
-/* @__NO_SIDE_EFFECTS__ */
 function processReallyExit(code) {
 	const exitCode = code || 0;
 	if (require_events_exit__internal.globalProcess) require_events_exit__internal.globalProcess.exitCode = exitCode;
-	/* @__PURE__ */ require_events_exit__internal.emit("exit", exitCode, void 0);
-	/* @__PURE__ */ require_events_exit__internal.emit("afterexit", exitCode, void 0);
+	require_events_exit__internal.emit("exit", exitCode, void 0);
+	require_events_exit__internal.emit("afterexit", exitCode, void 0);
 	require_primordials_reflect.ReflectApply(require_events_exit__internal.originalProcessReallyExit, require_events_exit__internal.globalProcess, [exitCode]);
 	throw new require_primordials_error.ErrorCtor("processReallyExit should never return");
 }

package/dist/events/exit/lifecycle.js

@@ -11,26 +11,26 @@ const require_events_exit_intercept = require('./intercept.js');
 *   calls `unload()`; keeping them in the same leaf avoids an inter-leaf import
 *   cycle.
 */
-let _sigListeners;
-/* @__NO_SIDE_EFFECTS__ */
+let signalListenerMap;
 function getSignalListeners() {
-	if (_sigListeners === void 0) {
-		_sigListeners = { __proto__: null };
-		const emitter = /* @__PURE__ */ require_events_exit__internal.getEmitter();
-		const sigs = /* @__PURE__ */ require_events_exit__internal.getSignals();
+	if (signalListenerMap === void 0) {
+		signalListenerMap = { __proto__: null };
+		const emitter = require_events_exit__internal.getEmitter();
+		const sigs = require_events_exit__internal.getSignals();
 		/* c8 ignore start - Signal-listener body fires only on real
 		process signals; can't be triggered in-test without subprocess
 		infrastructure. */
-		for (const sig of sigs) _sigListeners[sig] = function listener() {
+		for (const sig of sigs) signalListenerMap[sig] = function listener() {
 			if ((require_events_exit__internal.globalProcess?.listeners(sig) || []).length === emitter.count) {
-				/* @__PURE__ */ require_events_exit__internal.emit("exit", void 0, sig);
-				/* @__PURE__ */ require_events_exit__internal.emit("afterexit", void 0, sig);
+				unload();
+				require_events_exit__internal.emit("exit", void 0, sig);
+				require_events_exit__internal.emit("afterexit", void 0, sig);
 				const killSig = require_events_exit__internal.WIN32 && sig === "SIGHUP" ? "SIGINT" : sig;
 				require_events_exit__internal.globalProcess?.kill(require_events_exit__internal.globalProcess?.pid, killSig);
 			}
 		};
 	}
-	return _sigListeners;
+	return signalListenerMap;
 }
 /**
 * Load signal handlers and hook into process exit events.
@@ -41,18 +41,17 @@ function getSignalListeners() {
 *   // Signal handlers are now active
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
 function load() {
 	/* c8 ignore next - !globalProcess never fires in Node tests. */
 	if (require_events_exit__internal.isLoaded() || !require_events_exit__internal.globalProcess) return;
 	require_events_exit__internal.setLoaded(true);
 	const proc = require_events_exit__internal.globalProcess;
-	const emitter = /* @__PURE__ */ require_events_exit__internal.getEmitter();
+	const emitter = require_events_exit__internal.getEmitter();
 	/* c8 ignore start */
 	if (emitter.count !== void 0) emitter.count += 1;
 	/* c8 ignore stop */
-	const sigs = /* @__PURE__ */ require_events_exit__internal.getSignals();
-	const sigListeners = /* @__PURE__ */ getSignalListeners();
+	const sigs = require_events_exit__internal.getSignals();
+	const sigListeners = getSignalListeners();
 	require_events_exit__internal.setSignals(sigs.filter((sig) => {
 		try {
 			proc.on(sig, sigListeners[sig]);
@@ -73,14 +72,13 @@ function load() {
 *   // Signal handlers are now removed
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
 function unload() {
 	/* c8 ignore start */
 	if (!require_events_exit__internal.isLoaded() || !require_events_exit__internal.globalProcess) return;
 	/* c8 ignore stop */
 	require_events_exit__internal.setLoaded(false);
-	const sigs = /* @__PURE__ */ require_events_exit__internal.getSignals();
-	const sigListeners = /* @__PURE__ */ getSignalListeners();
+	const sigs = require_events_exit__internal.getSignals();
+	const sigListeners = getSignalListeners();
 	for (const sig of sigs) try {
 		require_events_exit__internal.globalProcess.removeListener(sig, sigListeners[sig]);
 	} catch {}
@@ -88,7 +86,7 @@ function unload() {
 	/* c8 ignore start */
 	if (require_events_exit__internal.originalProcessReallyExit !== void 0) require_events_exit__internal.globalProcess.reallyExit = require_events_exit__internal.originalProcessReallyExit;
 	/* c8 ignore stop */
-	const emitter = /* @__PURE__ */ require_events_exit__internal.getEmitter();
+	const emitter = require_events_exit__internal.getEmitter();
 	/* c8 ignore start */
 	if (emitter.count !== void 0) emitter.count -= 1;
 	/* c8 ignore stop */

package/dist/events/exit/signals.js

@@ -19,9 +19,8 @@ const require_events_exit__internal = require('./_internal.js');
 *   console.log(sigs) // ['SIGABRT', 'SIGALRM', 'SIGHUP', ...]
 *   ```
 */
-/* @__NO_SIDE_EFFECTS__ */
 function signals() {
-	return /* @__PURE__ */ require_events_exit__internal.getSignals();
+	return require_events_exit__internal.getSignals();
 }
 
 //#endregion

package/dist/events/exit/types.d.ts

@@ -4,18 +4,19 @@
  *   emitter, emitted-signal map, and listener map. Pure types, no runtime side
  *   effects.
  */
+import type { EventEmitter } from 'node:events';
 export type EmittedSignals = {
     [signal: string]: boolean;
 };
-export type SignalExitEmitter = import('node:events').EventEmitter & {
-    count?: number;
-    emitted?: EmittedSignals;
-    infinite?: boolean;
+export type SignalExitEmitter = EventEmitter & {
+    count?: number | undefined;
+    emitted?: EmittedSignals | undefined;
+    infinite?: boolean | undefined;
 };
 export type SignalListener = () => void;
 export type SignalListenerMap = {
     [signal: string]: SignalListener;
 };
 export interface OnExitOptions {
-    alwaysLast?: boolean;
+    alwaysLast?: boolean | undefined;
 }

package/dist/external/@npmcli/package-json.js

@@ -2388,7 +2388,7 @@ var require_commonjs$5 = /* @__PURE__ */ __commonJSMin(((exports) => {
 }));
 
 //#endregion
-//#region node_modules/.pnpm/brace-expansion@5.0.5/node_modules/brace-expansion/dist/commonjs/index.js
+//#region node_modules/.pnpm/brace-expansion@5.0.6/node_modules/brace-expansion/dist/commonjs/index.js
 var require_commonjs$4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.EXPANSION_MAX = void 0;
@@ -2504,7 +2504,7 @@ var require_commonjs$4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 				}
 				const pad = n.some(isPadded);
 				N = [];
-				for (let i = x; test(i, y); i += incr) {
+				for (let i = x; test(i, y) && N.length < max; i += incr) {
 					let c;
 					if (isAlphaSequence) {
 						c = String.fromCharCode(i);

package/dist/external/@sinclair/typebox/value.js

@@ -4071,7 +4071,11 @@ var require_extends_check = /* @__PURE__ */ __commonJSMin(((exports) => {
 		return Visit(left, right) === ExtendsResult.False ? ExtendsResult.False : index_10.TypeGuard.IsOptional(left) && !index_10.TypeGuard.IsOptional(right) ? ExtendsResult.False : ExtendsResult.True;
 	}
 	function FromObjectRight(left, right) {
-		return index_10.TypeGuard.IsUnknown(left) ? ExtendsResult.False : index_10.TypeGuard.IsAny(left) ? ExtendsResult.Union : index_10.TypeGuard.IsNever(left) || index_10.TypeGuard.IsLiteralString(left) && IsObjectStringLike(right) || index_10.TypeGuard.IsLiteralNumber(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsLiteralBoolean(left) && IsObjectBooleanLike(right) || index_10.TypeGuard.IsSymbol(left) && IsObjectSymbolLike(right) || index_10.TypeGuard.IsBigInt(left) && IsObjectBigIntLike(right) || index_10.TypeGuard.IsString(left) && IsObjectStringLike(right) || index_10.TypeGuard.IsSymbol(left) && IsObjectSymbolLike(right) || index_10.TypeGuard.IsNumber(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsInteger(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsBoolean(left) && IsObjectBooleanLike(right) || index_10.TypeGuard.IsUint8Array(left) && IsObjectUint8ArrayLike(right) || index_10.TypeGuard.IsDate(left) && IsObjectDateLike(right) || index_10.TypeGuard.IsConstructor(left) && IsObjectConstructorLike(right) || index_10.TypeGuard.IsFunction(left) && IsObjectFunctionLike(right) ? ExtendsResult.True : index_10.TypeGuard.IsRecord(left) && index_10.TypeGuard.IsString(RecordKey(left)) ? right[index_8.Hint] === "Record" ? ExtendsResult.True : ExtendsResult.False : index_10.TypeGuard.IsRecord(left) && index_10.TypeGuard.IsNumber(RecordKey(left)) ? IsObjectPropertyCount(right, 0) ? ExtendsResult.True : ExtendsResult.False : ExtendsResult.False;
+		return index_10.TypeGuard.IsUnknown(left) ? ExtendsResult.False : index_10.TypeGuard.IsAny(left) ? ExtendsResult.Union : index_10.TypeGuard.IsNever(left) || index_10.TypeGuard.IsLiteralString(left) && IsObjectStringLike(right) || index_10.TypeGuard.IsLiteralNumber(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsLiteralBoolean(left) && IsObjectBooleanLike(right) || index_10.TypeGuard.IsSymbol(left) && IsObjectSymbolLike(right) || index_10.TypeGuard.IsBigInt(left) && IsObjectBigIntLike(right) || index_10.TypeGuard.IsString(left) && IsObjectStringLike(right) || index_10.TypeGuard.IsSymbol(left) && IsObjectSymbolLike(right) || index_10.TypeGuard.IsNumber(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsInteger(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsBoolean(left) && IsObjectBooleanLike(right) || index_10.TypeGuard.IsUint8Array(left) && IsObjectUint8ArrayLike(right) || index_10.TypeGuard.IsDate(left) && IsObjectDateLike(right) || index_10.TypeGuard.IsConstructor(left) && IsObjectConstructorLike(right) || index_10.TypeGuard.IsFunction(left) && IsObjectFunctionLike(right) ? ExtendsResult.True : index_10.TypeGuard.IsRecord(left) && index_10.TypeGuard.IsString(RecordKey(left)) ? (() => {
+			return right[index_8.Hint] === "Record" ? ExtendsResult.True : ExtendsResult.False;
+		})() : index_10.TypeGuard.IsRecord(left) && index_10.TypeGuard.IsNumber(RecordKey(left)) ? (() => {
+			return IsObjectPropertyCount(right, 0) ? ExtendsResult.True : ExtendsResult.False;
+		})() : ExtendsResult.False;
 	}
 	function FromObject(left, right) {
 		return IsStructuralRight(right) ? StructuralRight(left, right) : index_10.TypeGuard.IsRecord(right) ? FromRecordRight(left, right) : !index_10.TypeGuard.IsObject(right) ? ExtendsResult.False : (() => {

package/dist/external/@sinclair/typebox.js

@@ -4284,7 +4284,11 @@ var require_extends_check = /* @__PURE__ */ __commonJSMin(((exports) => {
 		return Visit(left, right) === ExtendsResult.False ? ExtendsResult.False : index_10.TypeGuard.IsOptional(left) && !index_10.TypeGuard.IsOptional(right) ? ExtendsResult.False : ExtendsResult.True;
 	}
 	function FromObjectRight(left, right) {
-		return index_10.TypeGuard.IsUnknown(left) ? ExtendsResult.False : index_10.TypeGuard.IsAny(left) ? ExtendsResult.Union : index_10.TypeGuard.IsNever(left) || index_10.TypeGuard.IsLiteralString(left) && IsObjectStringLike(right) || index_10.TypeGuard.IsLiteralNumber(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsLiteralBoolean(left) && IsObjectBooleanLike(right) || index_10.TypeGuard.IsSymbol(left) && IsObjectSymbolLike(right) || index_10.TypeGuard.IsBigInt(left) && IsObjectBigIntLike(right) || index_10.TypeGuard.IsString(left) && IsObjectStringLike(right) || index_10.TypeGuard.IsSymbol(left) && IsObjectSymbolLike(right) || index_10.TypeGuard.IsNumber(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsInteger(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsBoolean(left) && IsObjectBooleanLike(right) || index_10.TypeGuard.IsUint8Array(left) && IsObjectUint8ArrayLike(right) || index_10.TypeGuard.IsDate(left) && IsObjectDateLike(right) || index_10.TypeGuard.IsConstructor(left) && IsObjectConstructorLike(right) || index_10.TypeGuard.IsFunction(left) && IsObjectFunctionLike(right) ? ExtendsResult.True : index_10.TypeGuard.IsRecord(left) && index_10.TypeGuard.IsString(RecordKey(left)) ? right[index_8.Hint] === "Record" ? ExtendsResult.True : ExtendsResult.False : index_10.TypeGuard.IsRecord(left) && index_10.TypeGuard.IsNumber(RecordKey(left)) ? IsObjectPropertyCount(right, 0) ? ExtendsResult.True : ExtendsResult.False : ExtendsResult.False;
+		return index_10.TypeGuard.IsUnknown(left) ? ExtendsResult.False : index_10.TypeGuard.IsAny(left) ? ExtendsResult.Union : index_10.TypeGuard.IsNever(left) || index_10.TypeGuard.IsLiteralString(left) && IsObjectStringLike(right) || index_10.TypeGuard.IsLiteralNumber(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsLiteralBoolean(left) && IsObjectBooleanLike(right) || index_10.TypeGuard.IsSymbol(left) && IsObjectSymbolLike(right) || index_10.TypeGuard.IsBigInt(left) && IsObjectBigIntLike(right) || index_10.TypeGuard.IsString(left) && IsObjectStringLike(right) || index_10.TypeGuard.IsSymbol(left) && IsObjectSymbolLike(right) || index_10.TypeGuard.IsNumber(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsInteger(left) && IsObjectNumberLike(right) || index_10.TypeGuard.IsBoolean(left) && IsObjectBooleanLike(right) || index_10.TypeGuard.IsUint8Array(left) && IsObjectUint8ArrayLike(right) || index_10.TypeGuard.IsDate(left) && IsObjectDateLike(right) || index_10.TypeGuard.IsConstructor(left) && IsObjectConstructorLike(right) || index_10.TypeGuard.IsFunction(left) && IsObjectFunctionLike(right) ? ExtendsResult.True : index_10.TypeGuard.IsRecord(left) && index_10.TypeGuard.IsString(RecordKey(left)) ? (() => {
+			return right[index_8.Hint] === "Record" ? ExtendsResult.True : ExtendsResult.False;
+		})() : index_10.TypeGuard.IsRecord(left) && index_10.TypeGuard.IsNumber(RecordKey(left)) ? (() => {
+			return IsObjectPropertyCount(right, 0) ? ExtendsResult.True : ExtendsResult.False;
+		})() : ExtendsResult.False;
 	}
 	function FromObject(left, right) {
 		return IsStructuralRight(right) ? StructuralRight(left, right) : index_10.TypeGuard.IsRecord(right) ? FromRecordRight(left, right) : !index_10.TypeGuard.IsObject(right) ? ExtendsResult.False : (() => {

package/dist/external/@socketregistry/packageurl-js.js

@@ -6113,6 +6113,33 @@ var require_dist = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			return `vers:${this.scheme}/${ArrayPrototypeJoin(parts, "|")}`;
 		}
 	};
+	0 && (module.exports = {
+		Err,
+		Ok,
+		PURL_Type,
+		PackageURL,
+		PurlBuilder,
+		PurlComponent,
+		PurlError,
+		PurlInjectionError,
+		PurlQualifierNames,
+		PurlType,
+		ResultUtils,
+		UrlConverter,
+		Vers,
+		compare,
+		containsInjectionCharacters,
+		createMatcher,
+		equals,
+		err,
+		findInjectionCharCode,
+		formatInjectionChar,
+		matches,
+		ok,
+		parseNpmSpecifier,
+		stringify,
+		stringifySpec
+	});
 }));
 /*!
 Copyright (c) the purl authors

package/dist/external/npm-pack.js

@@ -2432,7 +2432,7 @@ var require_commonjs$8 = /* @__PURE__ */ __commonJSMin(((exports) => {
 }));
 
 //#endregion
-//#region node_modules/.pnpm/brace-expansion@5.0.5/node_modules/brace-expansion/dist/commonjs/index.js
+//#region node_modules/.pnpm/brace-expansion@5.0.6/node_modules/brace-expansion/dist/commonjs/index.js
 var require_commonjs$7 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.EXPANSION_MAX = void 0;
@@ -2548,7 +2548,7 @@ var require_commonjs$7 = /* @__PURE__ */ __commonJSMin(((exports) => {
 				}
 				const pad = n.some(isPadded);
 				N = [];
-				for (let i = x; test(i, y); i += incr) {
+				for (let i = x; test(i, y) && N.length < max; i += incr) {
 					let c;
 					if (isAlphaSequence) {
 						c = String.fromCharCode(i);

package/dist/external-tools/bazel/read-bazel-version-file.js

@@ -23,7 +23,7 @@ const BAZEL_VERSION_FILE = ".bazelversion";
 async function readBazelVersionFile(startDir) {
 	let current = node_path.default.resolve(startDir);
 	while (true) {
-		const content = await /* @__PURE__ */ require_fs_read_file.safeReadFile(node_path.default.join(current, BAZEL_VERSION_FILE), { encoding: "utf8" });
+		const content = await require_fs_read_file.safeReadFile(node_path.default.join(current, BAZEL_VERSION_FILE), { encoding: "utf8" });
 		if (content !== void 0) {
 			const hashIdx = require_primordials_string.StringPrototypeIndexOf(content, "#");
 			const version = require_primordials_string.StringPrototypeTrim(hashIdx === -1 ? content : require_primordials_string.StringPrototypeSlice(content, 0, hashIdx));

package/dist/external-tools/bazel/resolve.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../../primordials/map-set.js');
 const require_external_tools_bazel_from_download = require('./from-download.js');
 const require_external_tools_bazel_from_path = require('./from-path.js');
 
@@ -21,7 +22,7 @@ const require_external_tools_bazel_from_path = require('./from-path.js');
 *      `downloadIfMissing` produces two distinct cache entries so the second
 *      call can fall through to the download tier.
 */
-const resolutionCache = /* @__PURE__ */ new Map();
+const resolutionCache = new require_primordials_map_set.MapCtor();
 function cacheKey(opts) {
 	if (!opts?.downloadIfMissing) return "local-only";
 	const { integrity, platformArch, version } = opts.downloadIfMissing;

package/dist/external-tools/bazel/types.d.ts

@@ -18,5 +18,5 @@ export interface ResolvedBazel {
     /**
      * See {@link ResolvedToolIntegrity}.
      */
-    readonly integrity?: ResolvedToolIntegrity;
+    readonly integrity?: ResolvedToolIntegrity | undefined;
 }

package/dist/external-tools/cdxgen/from-vfs.js

@@ -10,7 +10,7 @@ const require_smol_vfs = require('../../smol/vfs.js');
 */
 const CDXGEN_VFS_KEY = "cdxgen";
 async function cdxgenFromVfs() {
-	const vfs = /* @__PURE__ */ require_smol_vfs.getSmolVfs();
+	const vfs = require_smol_vfs.getSmolVfs();
 	if (!vfs) return;
 	/* c8 ignore start - smol Node binary only. */
 	if (!vfs.has("cdxgen")) return;

package/dist/external-tools/cdxgen/resolve.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../../primordials/map-set.js');
 const require_external_tools_cdxgen_from_download = require('./from-download.js');
 const require_external_tools_cdxgen_from_path = require('./from-path.js');
 const require_external_tools_cdxgen_from_vfs = require('./from-vfs.js');
@@ -20,7 +21,7 @@ const require_external_tools_cdxgen_from_vfs = require('./from-vfs.js');
 *      `undefined` if all of the enabled sources miss. Memoized per
 *      option-shape.
 */
-const resolutionCache = /* @__PURE__ */ new Map();
+const resolutionCache = new require_primordials_map_set.MapCtor();
 function cacheKey(opts) {
 	if (!opts?.downloadIfMissing) return "local-only";
 	const { cacheDir, integrity, platformArch, variant, version } = opts.downloadIfMissing;

package/dist/external-tools/cdxgen/types.d.ts

@@ -29,5 +29,5 @@ export interface ResolvedCdxgen {
     /**
      * See {@link ResolvedToolIntegrity}.
      */
-    readonly integrity?: ResolvedToolIntegrity;
+    readonly integrity?: ResolvedToolIntegrity | undefined;
 }

package/dist/external-tools/from-download.d.ts

@@ -68,7 +68,7 @@ export interface DownloadAndExtractOptions extends DownloadOptions {
  *   const { extractedDir, integrity } = await downloadAndExtractTool({
  *     url: 'https://example.com/jre-21-darwin-arm64.tar.gz',
  *     name: 'jre-21-darwin-arm64',
- *     extractedDir: '/Users/me/.cache/socket/jre/21/darwin-arm64',
+ *     extractedDir: '/Users/<user>/.cache/socket/jre/21/darwin-arm64',
  *     extractOptions: { strip: 1 },
  *   })
  *   // Caller constructs ResolvedJre from extractedDir.

package/dist/external-tools/from-download.js

@@ -44,7 +44,7 @@ let node_fs = require("node:fs");
 *   const { extractedDir, integrity } = await downloadAndExtractTool({
 *     url: 'https://example.com/jre-21-darwin-arm64.tar.gz',
 *     name: 'jre-21-darwin-arm64',
-*     extractedDir: '/Users/me/.cache/socket/jre/21/darwin-arm64',
+*     extractedDir: '/Users/<user>/.cache/socket/jre/21/darwin-arm64',
 *     extractOptions: { strip: 1 },
 *   })
 *   // Caller constructs ResolvedJre from extractedDir.

package/dist/external-tools/from-pip-venv.d.ts

@@ -0,0 +1,73 @@
+/**
+ * @file Generic "venv-install tier" for external-tools resolvers. Parallel to
+ *   `from-download.ts` — that one handles single-binary tools downloaded as
+ *   GitHub release assets; this one handles Python packages installed into a
+ *   single-purpose venv. Per-tool resolvers (skillspector, future Python CLIs)
+ *   compose their fourth tier on top of these helpers. Two helpers:
+ *
+ *   - `createPipVenv` — `python -m venv <cacheDir>` + `pip install <spec>`.
+ *     Idempotent: hits the existing venv when its entry-point already exists.
+ *     Stops at "venv created, entry-point present."
+ *   - `findPython` — locates `python3` (or `python` on Windows) on PATH. Returns
+ *     the absolute path or `undefined` when no Python is available. What this
+ *     does NOT do:
+ *   - Decide where the venv lives. The caller picks the cache dir (typically
+ *     under `getSocketDlxDir()`); we just create the venv there.
+ *   - Verify package integrity beyond pip's own wheel-hash mechanism. Pinning is
+ *     the caller's responsibility: pass exact-version `<pkg>==<ver>` or git-SHA
+ *     `git+...@<sha>`.
+ *   - Re-resolve when the cache is stale. The cache key is derived by the caller
+ *     from the install spec; a re-pin produces a new dir.
+ */
+export interface CreatePipVenvOptions {
+    /**
+     * Absolute path to the venv directory. Created if missing; reused if the
+     * entry-point already exists inside it.
+     */
+    readonly cacheDir: string;
+    /**
+     * Name of the entry-point executable. Matches the package's
+     * `[project.scripts]` key (or the package name when it's the same).
+     */
+    readonly entryPoint: string;
+    /**
+     * Pip-install argument — either `<pkg>==<version>` (PyPI exact pin) or
+     * `git+<https-url>@<sha>` (git-SHA pin). Anything else is rejected.
+     */
+    readonly installSpec: string;
+    /**
+     * Optional override for the Python interpreter. Defaults to
+     * {@link findPython}.
+     */
+    readonly python?: string | undefined;
+}
+export interface CreatePipVenvResult {
+    /**
+     * Absolute path to the entry-point binary inside the venv. Always set when
+     * `created` or the cache was already populated.
+     */
+    readonly entryPointPath: string;
+    /**
+     * `true` when this call created the venv (and ran pip install); `false` when
+     * the existing cache was reused.
+     */
+    readonly created: boolean;
+}
+/**
+ * Create (or reuse) a venv at `cacheDir` and pip-install `installSpec` into it.
+ * Returns the entry-point path + a `created` flag. Throws when:
+ *
+ * - No Python interpreter is on PATH (and none was passed via `python`).
+ * - `python -m venv` fails.
+ * - `pip install` fails.
+ * - The install succeeded but the entry-point was not created (caller passed a
+ *   wrong `entryPoint` name, or the package has no console script).
+ */
+export declare function createPipVenv(opts: CreatePipVenvOptions): Promise<CreatePipVenvResult>;
+/**
+ * Locate a Python interpreter. Prefer `python3` on macOS/Linux, fall back to
+ * `python` (the Windows convention). Returns `undefined` when neither is on
+ * PATH.
+ */
+export declare function findPython(): Promise<string | undefined>;
+export declare function pipVenvEntryPointPath(venvDir: string, entryPoint: string): string;