@socketsecurity/lib 6.0.5 → 6.0.7

package/dist/external-tools/from-pip-venv.js

@@ -0,0 +1,98 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_bin_which = require('../bin/which.js');
+const require_process_spawn_child = require('../process/spawn/child.js');
+const require_fs_safe = require('../fs/safe.js');
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+
+//#region src/external-tools/from-pip-venv.ts
+/**
+* @file Generic "venv-install tier" for external-tools resolvers. Parallel to
+*   `from-download.ts` — that one handles single-binary tools downloaded as
+*   GitHub release assets; this one handles Python packages installed into a
+*   single-purpose venv. Per-tool resolvers (skillspector, future Python CLIs)
+*   compose their fourth tier on top of these helpers. Two helpers:
+*
+*   - `createPipVenv` — `python -m venv <cacheDir>` + `pip install <spec>`.
+*     Idempotent: hits the existing venv when its entry-point already exists.
+*     Stops at "venv created, entry-point present."
+*   - `findPython` — locates `python3` (or `python` on Windows) on PATH. Returns
+*     the absolute path or `undefined` when no Python is available. What this
+*     does NOT do:
+*   - Decide where the venv lives. The caller picks the cache dir (typically
+*     under `getSocketDlxDir()`); we just create the venv there.
+*   - Verify package integrity beyond pip's own wheel-hash mechanism. Pinning is
+*     the caller's responsibility: pass exact-version `<pkg>==<ver>` or git-SHA
+*     `git+...@<sha>`.
+*   - Re-resolve when the cache is stale. The cache key is derived by the caller
+*     from the install spec; a re-pin produces a new dir.
+*/
+/**
+* Create (or reuse) a venv at `cacheDir` and pip-install `installSpec` into it.
+* Returns the entry-point path + a `created` flag. Throws when:
+*
+* - No Python interpreter is on PATH (and none was passed via `python`).
+* - `python -m venv` fails.
+* - `pip install` fails.
+* - The install succeeded but the entry-point was not created (caller passed a
+*   wrong `entryPoint` name, or the package has no console script).
+*/
+async function createPipVenv(opts) {
+	const { cacheDir, entryPoint, installSpec } = opts;
+	const entryBin = pipVenvEntryPointPath(cacheDir, entryPoint);
+	if ((0, node_fs.existsSync)(entryBin)) return {
+		entryPointPath: entryBin,
+		created: false
+	};
+	const python = opts.python ?? await findPython();
+	if (!python) throw new Error("createPipVenv: no Python interpreter on PATH (looked for python3, python)");
+	await require_fs_safe.safeMkdir(node_path.default.dirname(cacheDir), { recursive: true });
+	await require_process_spawn_child.spawn(python, [
+		"-m",
+		"venv",
+		"--clear",
+		cacheDir
+	], { stdio: "pipe" });
+	const venvPython = pipVenvEntryPointPath(cacheDir, "python");
+	if (!(0, node_fs.existsSync)(venvPython)) throw new Error(`createPipVenv: venv created at ${cacheDir} but ${venvPython} is missing`);
+	await require_process_spawn_child.spawn(venvPython, [
+		"-m",
+		"pip",
+		"install",
+		"--no-input",
+		"--disable-pip-version-check",
+		installSpec
+	], { stdio: "pipe" });
+	if (!(0, node_fs.existsSync)(entryBin)) throw new Error(`createPipVenv: pip install ${installSpec} succeeded but entry-point ${entryPoint} was not created at ${entryBin}`);
+	return {
+		entryPointPath: entryBin,
+		created: true
+	};
+}
+/**
+* Locate a Python interpreter. Prefer `python3` on macOS/Linux, fall back to
+* `python` (the Windows convention). Returns `undefined` when neither is on
+* PATH.
+*/
+async function findPython() {
+	const candidates = node_process.default.platform === "win32" ? ["python", "python3"] : ["python3", "python"];
+	for (let i = 0, { length } = candidates; i < length; i += 1) {
+		const found = await require_bin_which.which(candidates[i], { nothrow: true });
+		if (typeof found === "string") return found;
+	}
+}
+function pipVenvEntryPointPath(venvDir, entryPoint) {
+	if (node_process.default.platform === "win32") return node_path.default.join(venvDir, "Scripts", `${entryPoint}.exe`);
+	return node_path.default.join(venvDir, "bin", entryPoint);
+}
+
+//#endregion
+exports.createPipVenv = createPipVenv;
+exports.findPython = findPython;
+exports.pipVenvEntryPointPath = pipVenvEntryPointPath;

package/dist/external-tools/janus/asset-names.js

@@ -26,7 +26,7 @@ const JANUS_ASSET_MAP = require_primordials_object.ObjectFreeze({
 * supported set. Use this from `from-download.ts` to throw a helpful error
 * rather than letting the URL builder silently return undefined.
 */
-const JANUS_SUPPORTED_PLATFORM_ARCHES = require_primordials_object.ObjectFreeze(Object.keys(JANUS_ASSET_MAP));
+const JANUS_SUPPORTED_PLATFORM_ARCHES = require_primordials_object.ObjectFreeze(require_primordials_object.ObjectKeys(JANUS_ASSET_MAP));
 function getJanusAssetEntry(platformArch) {
 	return JANUS_ASSET_MAP[platformArch];
 }

package/dist/external-tools/janus/from-download.js

@@ -2,6 +2,7 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_primordials_error = require('../../primordials/error.js');
 const require_paths_socket = require('../../paths/socket.js');
 const require_external_tools_from_download = require('../from-download.js');
 const require_external_tools_janus_asset_names = require('./asset-names.js');
@@ -20,15 +21,12 @@ node_path = require_runtime.__toESM(node_path);
 */
 async function janusFromDownload(opts) {
 	const { cacheDir, downloader, integrity, platformArch, version } = opts;
-	if (!require_external_tools_janus_asset_names.JANUS_SUPPORTED_PLATFORM_ARCHES.includes(platformArch)) {
-		const supported = require_external_tools_janus_asset_names.JANUS_SUPPORTED_PLATFORM_ARCHES.map((p) => `\`${p}\``).join(", ");
-		throw new Error(`janusFromDownload: platformArch must be one of [${supported}], got \`${platformArch}\`. Upstream janus only publishes the macOS arm64 build (see https://github.com/divmain/janus/releases); request \`darwin-arm64\` or use a different tool for other platforms.`);
-	}
+	if (!require_external_tools_janus_asset_names.JANUS_SUPPORTED_PLATFORM_ARCHES.includes(platformArch)) throw new require_primordials_error.ErrorCtor(`janusFromDownload: platformArch must be one of [${require_external_tools_janus_asset_names.JANUS_SUPPORTED_PLATFORM_ARCHES.map((p) => `\`${p}\``).join(", ")}], got \`${platformArch}\`. Upstream janus only publishes the macOS arm64 build (see https://github.com/divmain/janus/releases); request \`darwin-arm64\` or use a different tool for other platforms.`);
 	const url = require_external_tools_janus_asset_names.getJanusDownloadUrl({
 		version,
 		platformArch
 	});
-	if (!url) throw new Error(`janusFromDownload: no upstream asset for janus@${version} on \`${platformArch}\`. The platform is in the supported set but the version may be missing; check https://github.com/divmain/janus/releases/tag/v${version}.`);
+	if (!url) throw new require_primordials_error.ErrorCtor(`janusFromDownload: no upstream asset for janus@${version} on \`${platformArch}\`. The platform is in the supported set but the version may be missing; check https://github.com/divmain/janus/releases/tag/v${version}.`);
 	const extractedDir = cacheDir ?? node_path.default.join(require_paths_socket.getSocketWheelhouseDir(), "janus", version, platformArch);
 	const archive = await require_external_tools_from_download.downloadAndExtractTool({
 		url,

package/dist/external-tools/janus/from-vfs.js

@@ -10,7 +10,7 @@ const require_smol_vfs = require('../../smol/vfs.js');
 */
 const JANUS_VFS_KEY = "janus";
 async function janusFromVfs() {
-	const vfs = /* @__PURE__ */ require_smol_vfs.getSmolVfs();
+	const vfs = require_smol_vfs.getSmolVfs();
 	if (!vfs) return;
 	/* c8 ignore start - smol Node binary only. */
 	if (!vfs.has("janus")) return;

package/dist/external-tools/janus/resolve.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../../primordials/map-set.js');
 const require_external_tools_janus_from_download = require('./from-download.js');
 const require_external_tools_janus_from_path = require('./from-path.js');
 const require_external_tools_janus_from_vfs = require('./from-vfs.js');
@@ -18,7 +19,7 @@ const require_external_tools_janus_from_vfs = require('./from-vfs.js');
 *      platform-arch isn't shipped by upstream janus (currently darwin-arm64
 *      only). Memoized per option-shape.
 */
-const resolutionCache = /* @__PURE__ */ new Map();
+const resolutionCache = new require_primordials_map_set.MapCtor();
 function cacheKey(opts) {
 	if (!opts?.downloadIfMissing) return "local-only";
 	const { cacheDir, integrity, platformArch, version } = opts.downloadIfMissing;

package/dist/external-tools/janus/types.d.ts

@@ -20,5 +20,5 @@ export interface ResolvedJanus {
     /**
      * See {@link ResolvedToolIntegrity}.
      */
-    readonly integrity?: ResolvedToolIntegrity;
+    readonly integrity?: ResolvedToolIntegrity | undefined;
 }

package/dist/external-tools/jre/detect-platform-arch.d.ts

@@ -1,8 +1,12 @@
 /**
- * @file `getCurrentPlatformArch()` — resolves the current machine to a
- *   `platform-arch` string suitable for the Adoptium asset-name map. Wraps
- *   `getPlatformArch` from `src/releases/socket-btm` so external-tools modules
- *   don't need to know about releases' platform/arch typing. Returns
- *   `undefined` on unsupported platform/arch combos.
+ * @file `getJreArch()` — resolves the current machine to a `platform-arch`
+ *   string suitable for the Adoptium `ADOPTIUM_QUERY_MAP` keys (e.g.
+ *   `darwin-arm64`, `linux-x64-musl`, `win-x64`). Self-contained: owns the
+ *   Adoptium vocabulary end to end (Node's `win32` → `win`, an Alpine `-musl`
+ *   suffix on Linux) rather than reusing the shared `getPlatformArch` /
+ *   `detectLibc` — Adoptium ships a distinct `alpine-linux` channel, so the JRE
+ *   key set differs from both the release-binary naming and
+ *   python-build-standalone (see `getPythonArch`). Returns `undefined` on an
+ *   unsupported platform/arch.
  */
-export declare function getCurrentPlatformArch(): string | undefined;
+export declare function getJreArch(): string | undefined;

package/dist/external-tools/jre/detect-platform-arch.js

@@ -2,27 +2,42 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../../_virtual/_rolldown/runtime.js');
-const require_releases_socket_btm = require('../../releases/socket-btm.js');
+const require_constants_platform = require('../../constants/platform.js');
+const require_primordials_object = require('../../primordials/object.js');
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
 
 //#region src/external-tools/jre/detect-platform-arch.ts
 /**
-* @file `getCurrentPlatformArch()` — resolves the current machine to a
-*   `platform-arch` string suitable for the Adoptium asset-name map. Wraps
-*   `getPlatformArch` from `src/releases/socket-btm` so external-tools modules
-*   don't need to know about releases' platform/arch typing. Returns
-*   `undefined` on unsupported platform/arch combos.
+* @file `getJreArch()` — resolves the current machine to a `platform-arch`
+*   string suitable for the Adoptium `ADOPTIUM_QUERY_MAP` keys (e.g.
+*   `darwin-arm64`, `linux-x64-musl`, `win-x64`). Self-contained: owns the
+*   Adoptium vocabulary end to end (Node's `win32` → `win`, an Alpine `-musl`
+*   suffix on Linux) rather than reusing the shared `getPlatformArch` /
+*   `detectLibc` — Adoptium ships a distinct `alpine-linux` channel, so the JRE
+*   key set differs from both the release-binary naming and
+*   python-build-standalone (see `getPythonArch`). Returns `undefined` on an
+*   unsupported platform/arch.
 */
-function getCurrentPlatformArch() {
-	/* c8 ignore start - depends on process.platform/arch. */
-	try {
-		return require_releases_socket_btm.getPlatformArch(node_process.default.platform, node_process.default.arch, require_releases_socket_btm.detectLibc());
-	} catch {
-		return;
-	}
+const NODE_PLATFORM_TO_JRE = require_primordials_object.ObjectFreeze({
+	__proto__: null,
+	darwin: "darwin",
+	linux: "linux",
+	win32: "win"
+});
+const NODE_ARCH_TO_JRE = require_primordials_object.ObjectFreeze({
+	__proto__: null,
+	arm64: "arm64",
+	x64: "x64"
+});
+function getJreArch() {
+	/* c8 ignore start - depends on process.platform/arch + libc probe. */
+	const platform = NODE_PLATFORM_TO_JRE[node_process.default.platform];
+	const arch = NODE_ARCH_TO_JRE[node_process.default.arch];
+	if (!platform || !arch) return;
+	return `${platform}-${arch}${platform === "linux" && require_constants_platform.getLibc() === "musl" ? "-musl" : ""}`;
 	/* c8 ignore stop */
 }
 
 //#endregion
-exports.getCurrentPlatformArch = getCurrentPlatformArch;
+exports.getJreArch = getJreArch;

package/dist/external-tools/jre/from-download.js

@@ -2,6 +2,7 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_primordials_string = require('../../primordials/string.js');
 const require_paths_socket = require('../../paths/socket.js');
 const require_external_tools_from_download = require('../from-download.js');
 const require_external_tools_jre_asset_names = require('./asset-names.js');
@@ -53,7 +54,7 @@ async function jreFromDownload(opts) {
 	const extractedDir = cacheDir ?? node_path.default.join(require_paths_socket.getSocketDlxDir(), "jre", String(version), platformArch);
 	const archive = await require_external_tools_from_download.downloadAndExtractTool({
 		url,
-		name: `adoptium-jre-${version}-${platformArch}${platformArch.startsWith("win-") ? ".zip" : ".tar.gz"}`,
+		name: `adoptium-jre-${version}-${platformArch}${require_primordials_string.StringPrototypeStartsWith(platformArch, "win-") ? ".zip" : ".tar.gz"}`,
 		integrity,
 		extractedDir,
 		extractOptions: { strip: 1 },

package/dist/external-tools/jre/from-vfs.js

@@ -25,7 +25,7 @@ node_process = require_runtime.__toESM(node_process);
 */
 const JRE_VFS_KEY = "jre";
 async function jreFromVfs() {
-	const vfs = /* @__PURE__ */ require_smol_vfs.getSmolVfs();
+	const vfs = require_smol_vfs.getSmolVfs();
 	if (!vfs) return;
 	/* c8 ignore start - smol Node binary only. */
 	if (!vfs.has("jre")) return;

package/dist/external-tools/jre/resolve.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../../primordials/map-set.js');
 const require_external_tools_jre_from_download = require('./from-download.js');
 const require_external_tools_jre_from_java_home = require('./from-java-home.js');
 const require_external_tools_jre_from_path = require('./from-path.js');
@@ -26,7 +27,7 @@ const require_external_tools_jre_from_vfs = require('./from-vfs.js');
 *      `resetJreResolution()` clears the cache so tests can exercise the
 *      resolver fresh.
 */
-const resolutionCache = /* @__PURE__ */ new Map();
+const resolutionCache = new require_primordials_map_set.MapCtor();
 function cacheKey(opts) {
 	if (!opts?.downloadIfMissing) return "local-only";
 	const { cacheDir, integrity, platformArch, version } = opts.downloadIfMissing;

package/dist/external-tools/jre/types.d.ts

@@ -23,6 +23,6 @@ export interface ResolvedJre {
     /**
      * See {@link ResolvedToolIntegrity}.
      */
-    readonly integrity?: ResolvedToolIntegrity;
+    readonly integrity?: ResolvedToolIntegrity | undefined;
 }
 export type { AdoptiumAssetQuery };

package/dist/external-tools/manifest.d.ts

@@ -9,10 +9,10 @@
  *   integrity-string validation. Shape: { "<tool-name>": { "description":
  *   "human-readable summary", "version": "1.7.2", "release": "asset" |
  *   "tarball" | ..., "repository": "github:owner/repo", "notes": [...],
- *   "checksums": { "<platform-arch>": { "asset": "<asset-filename>",
+ *   "platforms": { "<platform-arch>": { "asset": "<asset-filename>",
  *   "integrity": "sha256-base64=" } } } } Some tools have flavor variants (e.g.
  *   sfw's `free` / `enterprise`) that wrap the `{repository, binaryName,
- *   checksums}` triple under a flavor key. Use `getToolFlavor` for those. Some
+ *   platforms}` triple under a flavor key. Use `getToolFlavor` for those. Some
  *   entries (e.g. `rust`) describe a system tool with a different shape —
  *   they're skipped by `getTool` and fully readable only via the raw
  *   `readManifest` returning unknown.
@@ -42,7 +42,7 @@ export interface ToolChecksum {
     integrity: string;
 }
 /**
- * A downloadable-binary tool entry. `checksums` is keyed by the fleet's
+ * A downloadable-binary tool entry. `platforms` is keyed by the fleet's
  * platform-arch token (`darwin-arm64`, `linux-x64-musl`, `win-x64`, etc. — same
  * vocabulary as `getPlatformArch`).
  */
@@ -53,12 +53,12 @@ export interface ToolEntry {
     repository: string;
     binaryName?: string | undefined;
     notes?: readonly string[] | undefined;
-    checksums: Readonly<Record<string, ToolChecksum>>;
+    platforms: Readonly<Record<string, ToolChecksum>>;
 }
 /**
  * A flavored tool entry — sfw is the canonical example, with `free` and
  * `enterprise` variants sharing the same outer `description` / `version` /
- * `release` but each carrying its own `{repository, binaryName, checksums}`.
+ * `release` but each carrying its own `{repository, binaryName, platforms}`.
  */
 export interface FlavoredToolEntry {
     description: string;
@@ -70,7 +70,7 @@ export interface FlavoredToolEntry {
 export interface ToolFlavor {
     repository: string;
     binaryName?: string | undefined;
-    checksums: Readonly<Record<string, ToolChecksum>>;
+    platforms: Readonly<Record<string, ToolChecksum>>;
 }
 /**
  * Parsed manifest. `tools` is a flat map; the values are unions because some
@@ -93,7 +93,7 @@ export type ManifestEntry = {
 };
 export declare function isObject(value: unknown): value is Record<string, unknown>;
 export declare function parseChecksum(raw: unknown, toolName: string, platformKey: string): ToolChecksum;
-export declare function parseChecksums(raw: unknown, toolName: string): Record<string, ToolChecksum>;
+export declare function parsePlatforms(raw: unknown, toolName: string): Record<string, ToolChecksum>;
 export declare function parseToolEntry(raw: unknown, toolName: string): ManifestEntry;
 /**
  * Read an `external-tools.json` file from disk and return the parsed manifest.

package/dist/external-tools/manifest.js

@@ -3,7 +3,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_error = require('../primordials/error.js');
 const require_integrity = require('../integrity.js');
+const require_primordials_string = require('../primordials/string.js');
 const require_primordials_array = require('../primordials/array.js');
+const require_primordials_object = require('../primordials/object.js');
 const require_fs_read_json = require('../fs/read-json.js');
 
 //#region src/external-tools/manifest.ts
@@ -18,10 +20,10 @@ const require_fs_read_json = require('../fs/read-json.js');
 *   integrity-string validation. Shape: { "<tool-name>": { "description":
 *   "human-readable summary", "version": "1.7.2", "release": "asset" |
 *   "tarball" | ..., "repository": "github:owner/repo", "notes": [...],
-*   "checksums": { "<platform-arch>": { "asset": "<asset-filename>",
+*   "platforms": { "<platform-arch>": { "asset": "<asset-filename>",
 *   "integrity": "sha256-base64=" } } } } Some tools have flavor variants (e.g.
 *   sfw's `free` / `enterprise`) that wrap the `{repository, binaryName,
-*   checksums}` triple under a flavor key. Use `getToolFlavor` for those. Some
+*   platforms}` triple under a flavor key. Use `getToolFlavor` for those. Some
 *   entries (e.g. `rust`) describe a system tool with a different shape —
 *   they're skipped by `getTool` and fully readable only via the raw
 *   `readManifest` returning unknown.
@@ -50,16 +52,16 @@ function parseChecksum(raw, toolName, platformKey) {
 	if (!isObject(raw)) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' checksum entry '${platformKey}' must be an object, got: ${typeof raw}`);
 	const r = raw;
 	if (typeof r.asset !== "string" || r.asset.length === 0) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' platform '${platformKey}' is missing a non-empty 'asset' string`);
-	if (typeof r.integrity !== "string" || !require_integrity.isIntegrityString(r.integrity)) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' platform '${platformKey}' has an invalid 'integrity' (expected SRI sha512 or sha256 form): ${r.integrity}`);
+	if (typeof r.integrity !== "string" || !require_integrity.isIntegrity(r.integrity)) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' platform '${platformKey}' has an invalid 'integrity' (expected SRI sha512 or sha256 form): ${r.integrity}`);
 	return {
 		asset: r.asset,
 		integrity: r.integrity
 	};
 }
-function parseChecksums(raw, toolName) {
-	if (!isObject(raw)) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' is missing a 'checksums' object`);
+function parsePlatforms(raw, toolName) {
+	if (!isObject(raw)) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' is missing a 'platforms' object`);
 	const out = {};
-	for (const platformKey of Object.keys(raw)) out[platformKey] = parseChecksum(raw[platformKey], toolName, platformKey);
+	for (const platformKey of require_primordials_object.ObjectKeys(raw)) out[platformKey] = parseChecksum(raw[platformKey], toolName, platformKey);
 	return out;
 }
 function parseToolEntry(raw, toolName) {
@@ -68,7 +70,7 @@ function parseToolEntry(raw, toolName) {
 		raw
 	};
 	const r = raw;
-	if (isObject(r.checksums)) {
+	if (isObject(r.platforms)) {
 		if (typeof r.description !== "string" || typeof r.version !== "string" || typeof r.release !== "string" || typeof r.repository !== "string") return {
 			kind: "other",
 			raw
@@ -82,7 +84,7 @@ function parseToolEntry(raw, toolName) {
 				repository: r.repository,
 				binaryName: typeof r.binaryName === "string" ? r.binaryName : void 0,
 				notes: require_primordials_array.ArrayIsArray(r.notes) ? r.notes : void 0,
-				checksums: parseChecksums(r.checksums, toolName)
+				platforms: parsePlatforms(r.platforms, toolName)
 			}
 		};
 	}
@@ -103,30 +105,30 @@ function parseToolEntry(raw, toolName) {
 * callers can handle them out-of-band without blocking the manifest read.
 */
 async function readExternalToolsManifest(filepath) {
-	const raw = await /* @__PURE__ */ require_fs_read_json.readJson(filepath);
+	const raw = await require_fs_read_json.readJson(filepath);
 	if (!isObject(raw)) throw new require_primordials_error.ErrorCtor(`external-tools.json: expected top-level object, got: ${typeof raw}`);
 	const tools = {};
-	for (const toolName of Object.keys(raw)) {
-		if (toolName.startsWith("$")) continue;
+	for (const toolName of require_primordials_object.ObjectKeys(raw)) {
+		if (require_primordials_string.StringPrototypeStartsWith(toolName, "$")) continue;
 		tools[toolName] = parseToolEntry(raw[toolName], toolName);
 	}
 	return { tools };
 }
 function tryParseFlavored(raw, toolName) {
 	const flavors = {};
-	for (const key of Object.keys(raw)) {
+	for (const key of require_primordials_object.ObjectKeys(raw)) {
 		const value = raw[key];
 		if (!isObject(value)) continue;
 		const rf = value;
-		if (!isObject(rf.checksums)) continue;
+		if (!isObject(rf.platforms)) continue;
 		if (typeof rf.repository !== "string") continue;
 		flavors[key] = {
 			repository: rf.repository,
 			binaryName: typeof rf.binaryName === "string" ? rf.binaryName : void 0,
-			checksums: parseChecksums(rf.checksums, `${toolName}.${key}`)
+			platforms: parsePlatforms(rf.platforms, `${toolName}.${key}`)
 		};
 	}
-	if (Object.keys(flavors).length === 0) return;
+	if (require_primordials_object.ObjectKeys(flavors).length === 0) return;
 	return {
 		description: String(raw["description"] ?? ""),
 		version: String(raw["version"] ?? ""),
@@ -141,7 +143,7 @@ exports.getTool = getTool;
 exports.getToolFlavor = getToolFlavor;
 exports.isObject = isObject;
 exports.parseChecksum = parseChecksum;
-exports.parseChecksums = parseChecksums;
+exports.parsePlatforms = parsePlatforms;
 exports.parseToolEntry = parseToolEntry;
 exports.readExternalToolsManifest = readExternalToolsManifest;
 exports.tryParseFlavored = tryParseFlavored;

package/dist/external-tools/opengrep/from-vfs.js

@@ -11,7 +11,7 @@ const require_smol_vfs = require('../../smol/vfs.js');
 */
 const OPENGREP_VFS_KEY = "opengrep";
 async function opengrepFromVfs() {
-	const vfs = /* @__PURE__ */ require_smol_vfs.getSmolVfs();
+	const vfs = require_smol_vfs.getSmolVfs();
 	if (!vfs) return;
 	/* c8 ignore start - smol Node binary only. */
 	if (!vfs.has("opengrep")) return;

package/dist/external-tools/opengrep/resolve.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../../primordials/map-set.js');
 const require_external_tools_opengrep_from_download = require('./from-download.js');
 const require_external_tools_opengrep_from_path = require('./from-path.js');
 const require_external_tools_opengrep_from_vfs = require('./from-vfs.js');
@@ -16,7 +17,7 @@ const require_external_tools_opengrep_from_vfs = require('./from-vfs.js');
 *      passed) Returns `undefined` if all of the enabled sources miss. Memoized
 *      per option-shape.
 */
-const resolutionCache = /* @__PURE__ */ new Map();
+const resolutionCache = new require_primordials_map_set.MapCtor();
 function cacheKey(opts) {
 	if (!opts?.downloadIfMissing) return "local-only";
 	const { cacheDir, integrity, platformArch, version } = opts.downloadIfMissing;

package/dist/external-tools/opengrep/types.d.ts

@@ -20,5 +20,5 @@ export interface ResolvedOpengrep {
     /**
      * See {@link ResolvedToolIntegrity}.
      */
-    readonly integrity?: ResolvedToolIntegrity;
+    readonly integrity?: ResolvedToolIntegrity | undefined;
 }

package/dist/external-tools/python/asset-names.d.ts

@@ -0,0 +1,76 @@
+/**
+ * @file Python-build-standalone release asset mapping. Astral publishes
+ *   per-platform CPython archives under
+ *   https://github.com/astral-sh/python-build-standalone/releases/download/<tag>/.
+ *   Asset name shape: `cpython-<version>+<tag>-<triple>-install_only.tar.gz`.
+ *   The `install_only` flavor is a relocatable runtime (no build artifacts),
+ *   extracted one directory deep (`python/bin/python3`).
+ */
+/**
+ * Python-build-standalone default pin — the fleet-canonical CPython build,
+ * matching socket-cli's `bundle-tools.json`. Consumers that don't pass their
+ * own pin resolve against this. Bump it like any dependency (soak-aware), in
+ * lockstep with socket-cli (drift-watch). The `checksums` map is keyed by asset
+ * filename so the download tier verifies the exact tarball per platform.
+ */
+export declare const DEFAULT_PYTHON_PIN: Readonly<{
+    __proto__: null;
+    version: "3.11.14";
+    tag: "20260203";
+    checksums: Readonly<{
+        __proto__: null;
+        'cpython-3.11.14+20260203-aarch64-apple-darwin-install_only.tar.gz': "63e3352fefd3b6494f73f46f51c6581c57a7e0d98775e6e00229d14a67ec3ce9";
+        'cpython-3.11.14+20260203-aarch64-pc-windows-msvc-install_only.tar.gz': "cb7828c131a005da367f7dba3a561bed91619452de870e531ee03344b2ac346f";
+        'cpython-3.11.14+20260203-aarch64-unknown-linux-gnu-install_only.tar.gz': "7341a5a0acd65f2c7c7a228d8bafa6561d220ffed26293d6a02c15ae2ee86af5";
+        'cpython-3.11.14+20260203-aarch64-unknown-linux-musl-install_only.tar.gz': "f0e5988c108187b12eb4d53cbac33a499a8e38e1693104432e1faabbab14c664";
+        'cpython-3.11.14+20260203-x86_64-apple-darwin-install_only.tar.gz': "f3b63051a9b1ffb4f663d928ebaec4311435cb67f3bdfa5634953df93397f25e";
+        'cpython-3.11.14+20260203-x86_64-pc-windows-msvc-install_only.tar.gz': "d220beff465bdc97bf5874be8ffbf07278e5bdf9a064cab932b5d93b542e3e86";
+        'cpython-3.11.14+20260203-x86_64-unknown-linux-gnu-install_only.tar.gz': "67abde21b6e074b58c0f738f0c4802b23827a7d49707dcaf3ed4dadf572f3f37";
+        'cpython-3.11.14+20260203-x86_64-unknown-linux-musl-install_only.tar.gz': "290de5199a9647d4de4adcf13a79a7c59f060357853bf41fd6d1a69b4b5fd00c";
+    }>;
+}>;
+/**
+ * Resolve the current host to a python-build-standalone `platform-arch` key (a
+ * `PLATFORM_TRIPLES` key, e.g. `darwin-arm64`, `linux-x64-musl`, `win-x64`).
+ * Owns the python-build-standalone vocabulary end to end: Node's `win32`
+ * becomes `win`, and an Alpine host gets a `-musl` suffix so it resolves to the
+ * real musl triple (upstream ships both gnu and musl Linux builds). Returns
+ * `undefined` when the host platform/arch has no upstream prebuilt.
+ *
+ * Separate from `getJreArch` (jre/Adoptium vocabulary) and from the shared
+ * `getPlatformArch` — neither matches python-build-standalone's key set.
+ */
+export declare function getPythonArch(): string | undefined;
+export interface PythonAssetOptions {
+    /**
+     * CPython version, e.g. `3.11.14`.
+     */
+    readonly version: string;
+    /**
+     * Python-build-standalone release tag, e.g. `20260203`.
+     */
+    readonly tag: string;
+    /**
+     * Target `platform-arch`, e.g. `darwin-arm64`. Omit to auto-detect the
+     * current host via {@link getPythonArch}; pass an explicit value to resolve
+     * the asset for a different target (e.g. cross-platform packaging).
+     */
+    readonly arch?: string | undefined;
+}
+export interface PythonAsset {
+    /**
+     * Full asset filename:
+     * `cpython-<version>+<tag>-<triple>-install_only.tar.gz`.
+     */
+    readonly assetName: string;
+    /**
+     * Absolute download URL for the asset (with `+` percent-encoded as `%2B`).
+     */
+    readonly url: string;
+}
+/**
+ * Resolve the python-build-standalone download for a version + tag + platform.
+ * Returns the asset filename and URL, or `undefined` when the platform-arch has
+ * no upstream prebuilt.
+ */
+export declare function pythonAsset(opts: PythonAssetOptions): PythonAsset | undefined;