@socketsecurity/lib 6.0.5 → 6.0.7

package/dist/external-tools/python/pin.js

@@ -0,0 +1,173 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_integrity = require('../../integrity.js');
+const require_constants_platform = require('../../constants/platform.js');
+const require_process_spawn_child = require('../../process/spawn/child.js');
+const require_fs_safe = require('../../fs/safe.js');
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+let node_os = require("node:os");
+node_os = require_runtime.__toESM(node_os);
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+
+//#region src/external-tools/python/pin.ts
+/**
+* @file `resolvePipPackagePin()` — the Python mirror of
+*   `resolveNpmPackagePin()` (dlx/lockfile). Resolves a pip spec and its full
+*   dependency closure WITHOUT installing into the interpreter, then returns
+*   everything needed to pin a reproducible, hash-verified install:
+*
+*   - the resolved top-level name + version,
+*   - the top-level artifact's hashes (sha512 SRI + sha256 hex), and
+*   - a fully-hashed `requirements.txt` body (`name==version --hash=sha256:<hex>`
+*     for every artifact in the closure) ready to feed back to
+*     `downloadPipPackage` / `pip install --require-hashes`. Engine: `pip
+*     download --dest <scratch> <spec>` downloads the spec + its resolved
+*     closure as wheels/sdists into a scratch dir (no install, no venv), each
+*     file is hashed, then the scratch dir is torn down. This is pip's own
+*     recipe for producing hashed requirements — `pip-tools` is NOT required.
+*     Contrast `resolveNpmPackagePin` (dlx/lockfile): same contract, npm engine
+*     (Arborist lockfile-only + pacote), emits a `package-lock.json`. The pip
+*     side emits a hashed `requirements.txt` because that — not a lockfile — is
+*     what `pip install --require-hashes` consumes. NOTE on the soak window:
+*     `resolveNpmPackagePin` applies a min-release-age cutoff via Arborist's
+*     `before` date. pip has no native release-age gate, so this generator does
+*     NOT enforce one — callers that need a soak must vet the resolved versions
+*     out of band. The spec itself remains the primary pin: `==<version>` (PyPI
+*     is immutable per version) or `@<full-sha>` (git is content-addressed).
+*/
+/**
+* Thrown when `pip download` produces no artifacts or a filename can't be
+* parsed into a name + version.
+*/
+var PipPackagePinError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "PipPackagePinError";
+	}
+};
+/**
+* Normalize a PEP 503 distribution name: lowercase, runs of `_ . -` collapse to
+* a single `-`. Wheel filenames use `_`; requirements/PyPI use `-`.
+*/
+function normalizeDistName(name) {
+	return name.toLowerCase().replace(/[-_.]+/g, "-");
+}
+/**
+* Parse `<name>-<version>` out of a wheel (`name-ver-...whl`) or sdist
+* (`name-ver.tar.gz` / `name-ver.zip`) filename. Returns undefined when the
+* shape isn't recognized.
+*/
+function parseArtifactFilename(file) {
+	if (file.endsWith(".whl")) {
+		const parts = file.slice(0, -4).split("-");
+		if (parts.length < 2) return;
+		return {
+			name: normalizeDistName(parts[0]),
+			version: parts[1]
+		};
+	}
+	const ext = [
+		".tar.gz",
+		".tar.bz2",
+		".zip",
+		".tgz"
+	].find((e) => file.endsWith(e));
+	if (!ext) return;
+	const stem = file.slice(0, -ext.length);
+	const dashIdx = stem.lastIndexOf("-");
+	if (dashIdx <= 0) return;
+	return {
+		name: normalizeDistName(stem.slice(0, dashIdx)),
+		version: stem.slice(dashIdx + 1)
+	};
+}
+/**
+* Generate a vendorable, hash-pinned closure for a pip spec without installing
+* it. Mirrors `resolveNpmPackagePin`. Throws `PipPackagePinError` on an empty
+* download or an unparseable artifact filename.
+*/
+async function resolvePipPackagePin(options) {
+	const { pythonBin, spec } = options;
+	if (typeof spec !== "string" || spec.length === 0) throw new PipPackagePinError("resolvePipPackagePin requires a package spec");
+	const scratch = options.scratchDir ?? node_path.default.join(node_os.default.tmpdir(), `socket-lib-pip-pin-${node_process.default.pid}-${Date.now()}`);
+	await require_fs_safe.safeMkdir(scratch, { recursive: true });
+	try {
+		await require_process_spawn_child.spawn(pythonBin, [
+			"-m",
+			"pip",
+			"download",
+			"--no-input",
+			"--quiet",
+			"--dest",
+			scratch,
+			spec
+		], {
+			shell: require_constants_platform.WIN32,
+			stdio: "inherit"
+		});
+		const files = (await node_fs.promises.readdir(scratch)).filter((f) => f.endsWith(".whl") || f.endsWith(".tar.gz") || f.endsWith(".tar.bz2") || f.endsWith(".zip") || f.endsWith(".tgz"));
+		if (!files.length) throw new PipPackagePinError(`resolvePipPackagePin: pip download ${spec} produced no artifacts in ${scratch}`);
+		const artifacts = [];
+		const targetName = normalizeDistName(specDistName(spec));
+		let top;
+		for (const file of files.toSorted()) {
+			const hash = require_integrity.computeHashes(await node_fs.promises.readFile(node_path.default.join(scratch, file)));
+			const parsed = parseArtifactFilename(file);
+			if (!parsed) throw new PipPackagePinError(`resolvePipPackagePin: could not parse name/version from artifact ${file}`);
+			artifacts.push({
+				checksum: hash.checksum,
+				file,
+				name: parsed.name,
+				version: parsed.version
+			});
+			if (!top && parsed.name === targetName) top = {
+				hash,
+				name: parsed.name,
+				version: parsed.version
+			};
+		}
+		if (!top) {
+			const first = artifacts[0];
+			top = {
+				hash: require_integrity.computeHashes(await node_fs.promises.readFile(node_path.default.join(scratch, first.file))),
+				name: first.name,
+				version: first.version
+			};
+		}
+		const requirements = artifacts.map((a) => `${a.name}==${a.version} --hash=sha256:${a.checksum}`).join("\n") + "\n";
+		return {
+			artifacts,
+			hash: top.hash,
+			name: top.name,
+			requirements,
+			version: top.version
+		};
+	} finally {
+		try {
+			await require_fs_safe.safeDelete(scratch, { force: true });
+		} catch {}
+	}
+}
+/**
+* Best-effort distribution name from a pip spec for matching the top-level
+* artifact: strips a `==`/`>=`/etc. version and a `git+...#egg=<name>`
+* fragment. Falls back to the raw spec when neither is present.
+*/
+function specDistName(spec) {
+	const eggIdx = spec.indexOf("#egg=");
+	if (eggIdx !== -1) return spec.slice(eggIdx + 5);
+	const match = /^([A-Za-z0-9._-]+)\s*(?:@|[=<>!~]=?)/.exec(spec);
+	return match ? match[1] : spec;
+}
+
+//#endregion
+exports.PipPackagePinError = PipPackagePinError;
+exports.normalizeDistName = normalizeDistName;
+exports.parseArtifactFilename = parseArtifactFilename;
+exports.resolvePipPackagePin = resolvePipPackagePin;
+exports.specDistName = specDistName;

package/dist/external-tools/python/pip-install.d.ts

@@ -0,0 +1,75 @@
+/**
+ * @file `downloadPipPackage()` — the Python mirror of `dlx/package.ts`'s
+ *   `downloadNpmPackage()`. Installs a pip spec into a content-addressed dlx
+ *   directory (`pip install --target <dir>`), leaving the interpreter pristine:
+ *   the package + its deps land in
+ *   `~/.socket/_dlx/<cacheKey(spec)>/site-packages`, the exact analog of how
+ *   `downloadNpmPackage` installs npm deps into
+ *   `<dlxDir>/<hash>/node_modules/`. This is the bundle-safe / SEA-VFS-safe
+ *   model:
+ *
+ *   - No venv → no symlinks, no `pyvenv.cfg` with an absolute `home=`.
+ *   - The target dir is plain files → embeddable in a SEA's VFS, relocatable at
+ *     runtime.
+ *   - One shared Python serves N isolated package dirs (true per-tool isolation
+ *     without a venv) — exactly the `node_modules`-per-cacheKey shape. Run the
+ *     installed tool with the package dir on `PYTHONPATH`: spawn(pythonBin,
+ *     ['-m', '<module>', ...args], { env: { ...process.env, PYTHONPATH:
+ *     packageDir } }) `spec` is a PyPI pin (`<pkg>==<version>`) or a git-SHA
+ *     pin (`git+https://…@<sha>`). A TOCTOU lock guards concurrent installs; an
+ *     existing non-empty package dir makes the call idempotent. Contrast
+ *     `createPipVenv` (external-tools/from-pip-venv): venv with a
+ *     `bin/<entryPoint>` — convenient but symlink + absolute-`home`-dependent,
+ *     so DLX-only and NOT bundleable.
+ */
+/**
+ * Install `spec` into a content-addressed dlx dir via `pip install --target`.
+ * Lock-guarded + idempotent. Throws on a failed pip install or if the lock
+ * can't be acquired after MAX_RETRIES. Mirrors `downloadNpmPackage`.
+ */
+export declare function downloadPipPackage(options: DownloadPipPackageOptions, retryCount?: number): Promise<DownloadPipPackageResult>;
+export declare function isAlreadyInstalled(packageDir: string): Promise<boolean>;
+export declare function isStaleLock(pid: number): boolean;
+export interface DownloadPipPackageOptions {
+    /**
+     * Optional sha256 hash (`sha256:<hex>` or bare `<hex>`) of the top-level
+     * artifact, the Python analog of `downloadNpmPackage`'s `hash`. When set, pip
+     * runs with `--require-hashes` and `--hash=sha256:<hex>`, which fails closed
+     * unless EVERY resolved artifact (the spec and its full dependency closure)
+     * carries a matching hash — so it only fits specs pip can hash-verify (a
+     * pinned `==<version>` or a direct wheel/sdist URL) with a hash-pinned
+     * closure. Omit it and rely on the immutable spec as the pin: `==<version>`
+     * (PyPI is immutable per version) or `@<full-sha>` (git is
+     * content-addressed).
+     */
+    readonly hash?: string | undefined;
+    /**
+     * Absolute path to the Python interpreter used to run pip (and later the
+     * tool). The interpreter is NOT modified — packages go to the dlx package
+     * dir. Typically from `resolvePython()`.
+     */
+    readonly pythonBin: string;
+    /**
+     * Pip install spec: `<pkg>==<version>` (PyPI exact pin) or
+     * `git+https://<url>@<sha>` (git-SHA pin).
+     */
+    readonly spec: string;
+}
+export interface DownloadPipPackageResult {
+    /**
+     * `true` when this call ran pip; `false` when an existing install was reused.
+     */
+    readonly installed: boolean;
+    /**
+     * Directory the package was installed into. Put this on `PYTHONPATH` to run
+     * the tool: `python -m <module>`. The Python analog of
+     * `DownloadNpmPackageResult.packageDir`.
+     */
+    readonly packageDir: string;
+}
+/**
+ * Content-addressed install dir for a spec:
+ * `~/.socket/_dlx/<cacheKey>/site-packages`. The Python analog of
+ * `downloadNpmPackage`'s `<hash>/node_modules`.
+ */
+export declare function pipPackageDir(spec: string): string;

package/dist/external-tools/python/pip-install.js

@@ -0,0 +1,139 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_constants_platform = require('../../constants/platform.js');
+const require_process_spawn_child = require('../../process/spawn/child.js');
+const require_paths_socket = require('../../paths/socket.js');
+const require_fs_safe = require('../../fs/safe.js');
+const require_dlx_cache = require('../../dlx/cache.js');
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+
+//#region src/external-tools/python/pip-install.ts
+/**
+* @file `downloadPipPackage()` — the Python mirror of `dlx/package.ts`'s
+*   `downloadNpmPackage()`. Installs a pip spec into a content-addressed dlx
+*   directory (`pip install --target <dir>`), leaving the interpreter pristine:
+*   the package + its deps land in
+*   `~/.socket/_dlx/<cacheKey(spec)>/site-packages`, the exact analog of how
+*   `downloadNpmPackage` installs npm deps into
+*   `<dlxDir>/<hash>/node_modules/`. This is the bundle-safe / SEA-VFS-safe
+*   model:
+*
+*   - No venv → no symlinks, no `pyvenv.cfg` with an absolute `home=`.
+*   - The target dir is plain files → embeddable in a SEA's VFS, relocatable at
+*     runtime.
+*   - One shared Python serves N isolated package dirs (true per-tool isolation
+*     without a venv) — exactly the `node_modules`-per-cacheKey shape. Run the
+*     installed tool with the package dir on `PYTHONPATH`: spawn(pythonBin,
+*     ['-m', '<module>', ...args], { env: { ...process.env, PYTHONPATH:
+*     packageDir } }) `spec` is a PyPI pin (`<pkg>==<version>`) or a git-SHA
+*     pin (`git+https://…@<sha>`). A TOCTOU lock guards concurrent installs; an
+*     existing non-empty package dir makes the call idempotent. Contrast
+*     `createPipVenv` (external-tools/from-pip-venv): venv with a
+*     `bin/<entryPoint>` — convenient but symlink + absolute-`home`-dependent,
+*     so DLX-only and NOT bundleable.
+*/
+const MAX_RETRIES = 3;
+const WAIT_TICKS = 30;
+/**
+* Install `spec` into a content-addressed dlx dir via `pip install --target`.
+* Lock-guarded + idempotent. Throws on a failed pip install or if the lock
+* can't be acquired after MAX_RETRIES. Mirrors `downloadNpmPackage`.
+*/
+async function downloadPipPackage(options, retryCount = 0) {
+	const { hash, pythonBin, spec } = options;
+	const packageDir = pipPackageDir(spec);
+	if (retryCount >= MAX_RETRIES) throw new Error(`downloadPipPackage: could not acquire install lock after ${MAX_RETRIES} retries for ${packageDir}; a peer may be stuck or the lock is stale — remove it and retry`);
+	if (await isAlreadyInstalled(packageDir)) return {
+		installed: false,
+		packageDir
+	};
+	const lockDir = node_path.default.dirname(packageDir);
+	await require_fs_safe.safeMkdir(lockDir, { recursive: true });
+	const lockFile = node_path.default.join(lockDir, ".installing");
+	try {
+		await node_fs.promises.writeFile(lockFile, node_process.default.pid.toString(), { flag: "wx" });
+	} catch (e) {
+		if (e.code !== "EEXIST") throw e;
+		let stale = false;
+		try {
+			stale = isStaleLock(Number.parseInt((await node_fs.promises.readFile(lockFile, "utf8")).trim(), 10));
+		} catch {
+			stale = true;
+		}
+		if (stale) {
+			await require_fs_safe.safeDelete(lockFile, { force: true });
+			return downloadPipPackage(options, retryCount + 1);
+		}
+		for (let i = 0; i < WAIT_TICKS; i += 1) {
+			await new Promise((resolve) => {
+				setTimeout(resolve, 1e3);
+			});
+			if (await isAlreadyInstalled(packageDir)) return {
+				installed: false,
+				packageDir
+			};
+		}
+		return downloadPipPackage(options, retryCount + 1);
+	}
+	try {
+		await require_fs_safe.safeMkdir(packageDir, { recursive: true });
+		const normalizedHash = hash ? hash.startsWith("sha256:") ? hash : `sha256:${hash}` : void 0;
+		await require_process_spawn_child.spawn(pythonBin, [
+			"-m",
+			"pip",
+			"install",
+			"--no-input",
+			"--quiet",
+			"--target",
+			packageDir,
+			...normalizedHash ? ["--require-hashes", `--hash=${normalizedHash}`] : [],
+			spec
+		], {
+			shell: require_constants_platform.WIN32,
+			stdio: "inherit"
+		});
+		if (!await isAlreadyInstalled(packageDir)) throw new Error(`downloadPipPackage: pip install --target ${packageDir} ${spec} reported success but the target is still empty`);
+		return {
+			installed: true,
+			packageDir
+		};
+	} finally {
+		await require_fs_safe.safeDelete(lockFile, { force: true });
+	}
+}
+async function isAlreadyInstalled(packageDir) {
+	try {
+		return (await node_fs.promises.readdir(packageDir)).length > 0;
+	} catch {
+		return false;
+	}
+}
+function isStaleLock(pid) {
+	if (Number.isNaN(pid) || pid <= 0) return true;
+	try {
+		node_process.default.kill(pid, 0);
+		return false;
+	} catch (e) {
+		return e.code !== "EPERM";
+	}
+}
+/**
+* Content-addressed install dir for a spec:
+* `~/.socket/_dlx/<cacheKey>/site-packages`. The Python analog of
+* `downloadNpmPackage`'s `<hash>/node_modules`.
+*/
+function pipPackageDir(spec) {
+	return node_path.default.join(require_paths_socket.getSocketDlxDir(), require_dlx_cache.generateCacheKey(spec), "site-packages");
+}
+
+//#endregion
+exports.downloadPipPackage = downloadPipPackage;
+exports.isAlreadyInstalled = isAlreadyInstalled;
+exports.isStaleLock = isStaleLock;
+exports.pipPackageDir = pipPackageDir;

package/dist/external-tools/python/resolve.d.ts

@@ -0,0 +1,42 @@
+/**
+ * @file `resolvePython()` — CPython resolution entry point. Tries each source
+ *   in order:
+ *
+ *   1. PATH — `python3` / `python` on the system PATH.
+ *   2. download — python-build-standalone CPython into the DLX cache (only when
+ *      `downloadIfMissing` is passed). Returns `undefined` if all enabled
+ *      sources miss. Memoized per option-shape so repeated calls in one process
+ *      don't re-probe / re-download. NOTE: unlike the JRE / removed-uv
+ *      resolvers there is no VFS tier here — a CPython runtime is not embedded
+ *      in the smol Node binary. Add a `from-vfs` tier here if that changes.
+ */
+import type { BinaryDownloader } from '../from-download';
+import type { HashSpec } from '../../integrity';
+import type { ResolvedPython } from './types';
+export interface ResolvePythonOptions {
+    /**
+     * Prefer a downloaded python-build-standalone over a PATH interpreter. Use
+     * when you need an exact, reproducible CPython (the host `python3` may be the
+     * wrong version). Default false: PATH wins when present.
+     */
+    preferDownload?: boolean | undefined;
+    /**
+     * When set, fall back to downloading python-build-standalone if no PATH
+     * interpreter is found (or always, with `preferDownload`).
+     */
+    downloadIfMissing?: {
+        version: string;
+        tag: string;
+        /**
+         * Omit to auto-detect the current host via {@link getPythonArch}.
+         */
+        arch?: string | undefined;
+        integrity?: HashSpec | undefined;
+        cacheDir?: string | undefined;
+        downloader?: BinaryDownloader | undefined;
+    } | undefined;
+}
+export declare function cacheKey(opts: ResolvePythonOptions | undefined): string;
+export declare function doResolvePython(opts?: ResolvePythonOptions | undefined): Promise<ResolvedPython | undefined>;
+export declare function resetPythonResolution(): void;
+export declare function resolvePython(opts?: ResolvePythonOptions | undefined): Promise<ResolvedPython | undefined>;

package/dist/external-tools/python/resolve.js

@@ -0,0 +1,58 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../../primordials/map-set.js');
+const require_external_tools_python_asset_names = require('./asset-names.js');
+const require_external_tools_python_from_download = require('./from-download.js');
+const require_external_tools_python_from_path = require('./from-path.js');
+
+//#region src/external-tools/python/resolve.ts
+/**
+* @file `resolvePython()` — CPython resolution entry point. Tries each source
+*   in order:
+*
+*   1. PATH — `python3` / `python` on the system PATH.
+*   2. download — python-build-standalone CPython into the DLX cache (only when
+*      `downloadIfMissing` is passed). Returns `undefined` if all enabled
+*      sources miss. Memoized per option-shape so repeated calls in one process
+*      don't re-probe / re-download. NOTE: unlike the JRE / removed-uv
+*      resolvers there is no VFS tier here — a CPython runtime is not embedded
+*      in the smol Node binary. Add a `from-vfs` tier here if that changes.
+*/
+const resolutionCache = new require_primordials_map_set.MapCtor();
+function cacheKey(opts) {
+	const prefer = opts?.preferDownload ? "prefer:" : "";
+	if (!opts?.downloadIfMissing) return `${prefer}local-only`;
+	const { cacheDir, integrity, tag, version } = opts.downloadIfMissing;
+	return `${prefer}dl:${version}:${tag}:${opts.downloadIfMissing.arch ?? require_external_tools_python_asset_names.getPythonArch() ?? "unknown"}:${typeof integrity === "string" ? integrity : integrity ? `${integrity.type}:${integrity.value}` : ""}:${cacheDir ?? ""}`;
+}
+async function doResolvePython(opts) {
+	const dl = opts?.downloadIfMissing;
+	if (opts?.preferDownload && dl) {
+		const fromDownload = await require_external_tools_python_from_download.pythonFromDownload(dl);
+		if (fromDownload) return fromDownload;
+	}
+	const fromPath = await require_external_tools_python_from_path.pythonFromPath();
+	if (fromPath) return fromPath;
+	if (dl) return require_external_tools_python_from_download.pythonFromDownload(dl);
+}
+/* c8 ignore start - test-only escape hatch. */
+function resetPythonResolution() {
+	resolutionCache.clear();
+}
+/* c8 ignore stop */
+function resolvePython(opts) {
+	const key = cacheKey(opts);
+	let cached = resolutionCache.get(key);
+	if (!cached) {
+		cached = doResolvePython(opts);
+		resolutionCache.set(key, cached);
+	}
+	return cached;
+}
+
+//#endregion
+exports.cacheKey = cacheKey;
+exports.doResolvePython = doResolvePython;
+exports.resetPythonResolution = resetPythonResolution;
+exports.resolvePython = resolvePython;

package/dist/external-tools/python/types.d.ts

@@ -0,0 +1,49 @@
+/**
+ * @file Types for the python-build-standalone DLX resolver. A "resolved python"
+ *   is an absolute path to a CPython interpreter plus the tier that found it.
+ */
+import type { ResolvedToolIntegrity } from '../from-download';
+/**
+ * Which resolver tier produced the interpreter.
+ *
+ * - `path` — an interpreter already on PATH (system / pyenv / etc.).
+ * - `download` — a python-build-standalone CPython fetched into the DLX cache.
+ */
+export type PythonSource = 'download' | 'path';
+export interface ResolvedPython {
+    /**
+     * Absolute path to the `python3` (or `python.exe`) executable.
+     */
+    readonly path: string;
+    /**
+     * Which resolver tier found this interpreter.
+     */
+    readonly source: PythonSource;
+    /**
+     * SRI integrity of the downloaded archive. Set only when `source ===
+     * 'download'`; the PATH tier references an interpreter already on disk and
+     * computes no hash. See {@link ResolvedToolIntegrity}.
+     */
+    readonly integrity?: ResolvedToolIntegrity | undefined;
+}
+/**
+ * Pin describing which python-build-standalone build to fetch. The caller
+ * supplies these from its own `external-tools.json` (or `bundle-tools.json`) —
+ * the library does not embed a default version, so each consumer controls its
+ * own pin + soak.
+ */
+export interface PythonBuildPin {
+    /**
+     * CPython version, e.g. `3.11.14`.
+     */
+    readonly version: string;
+    /**
+     * Python-build-standalone release tag, e.g. `20260203`.
+     */
+    readonly tag: string;
+    /**
+     * Optional per-platform integrity (hex SHA-256 or SRI). Keyed by the asset
+     * filename so the resolver can verify the exact tarball it downloads.
+     */
+    readonly integrity?: string | undefined;
+}

package/dist/external-tools/sbt/from-vfs.js

@@ -17,7 +17,7 @@ const require_smol_vfs = require('../../smol/vfs.js');
 */
 const SBT_VFS_KEY = "sbt-launch.jar";
 async function sbtFromVfs() {
-	const vfs = /* @__PURE__ */ require_smol_vfs.getSmolVfs();
+	const vfs = require_smol_vfs.getSmolVfs();
 	if (!vfs) return;
 	/* c8 ignore start - smol Node binary only. */
 	if (!vfs.has("sbt-launch.jar")) return;

package/dist/external-tools/sbt/resolve.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../../primordials/map-set.js');
 const require_external_tools_sbt_from_download = require('./from-download.js');
 const require_external_tools_sbt_from_path = require('./from-path.js');
 const require_external_tools_sbt_from_vfs = require('./from-vfs.js');
@@ -18,7 +19,7 @@ const require_external_tools_sbt_from_vfs = require('./from-vfs.js');
 *      download-sourced SBT is the `sbt` script, which finds its own JRE.
 *      Memoized per option-shape.
 */
-const resolutionCache = /* @__PURE__ */ new Map();
+const resolutionCache = new require_primordials_map_set.MapCtor();
 function cacheKey(opts) {
 	if (!opts?.downloadIfMissing) return "local-only";
 	const { cacheDir, integrity, version } = opts.downloadIfMissing;

package/dist/external-tools/sbt/types.d.ts

@@ -28,5 +28,5 @@ export interface ResolvedSbt {
     /**
      * See {@link ResolvedToolIntegrity}.
      */
-    readonly integrity?: ResolvedToolIntegrity;
+    readonly integrity?: ResolvedToolIntegrity | undefined;
 }

package/dist/external-tools/skillspector/from-dlx.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @file `skillspectorFromDlx()` — DLX-venv tier of SkillSpector resolution.
+ *   Creates a single-purpose venv under `~/.socket/_dlx/skillspector/<sha>/`
+ *   and pip-installs the pinned git SHA. Returns `undefined` when:
+ *
+ *   - No Python interpreter is on PATH (host lacks Python 3.12+).
+ *   - The venv-create or pip-install command fails. Idempotent: hits the cached
+ *     venv when its `skillspector` entry-point already exists.
+ */
+import type { ResolvedSkillSpector } from './types';
+export interface SkillSpectorFromDlxOptions {
+    /**
+     * Pinned upstream SHA. Combined with the canonical NVIDIA/skillspector repo
+     * URL to form the pip-install spec
+     * `git+https://github.com/NVIDIA/skillspector.git@<sha>`.
+     */
+    readonly sha: string;
+    /**
+     * Cache directory override. Defaults to `getSocketDlxDir() +
+     * 'skillspector/<sha>'`. Tests pass a tmpdir.
+     */
+    readonly cacheDir?: string | undefined;
+}
+export declare function skillspectorFromDlx(opts: SkillSpectorFromDlxOptions): Promise<ResolvedSkillSpector | undefined>;

package/dist/external-tools/skillspector/from-dlx.js

@@ -0,0 +1,41 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_paths_socket = require('../../paths/socket.js');
+const require_external_tools_from_pip_venv = require('../from-pip-venv.js');
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+
+//#region src/external-tools/skillspector/from-dlx.ts
+/**
+* @file `skillspectorFromDlx()` — DLX-venv tier of SkillSpector resolution.
+*   Creates a single-purpose venv under `~/.socket/_dlx/skillspector/<sha>/`
+*   and pip-installs the pinned git SHA. Returns `undefined` when:
+*
+*   - No Python interpreter is on PATH (host lacks Python 3.12+).
+*   - The venv-create or pip-install command fails. Idempotent: hits the cached
+*     venv when its `skillspector` entry-point already exists.
+*/
+const UPSTREAM_REPO = "https://github.com/NVIDIA/skillspector.git";
+async function skillspectorFromDlx(opts) {
+	const { sha } = opts;
+	if (!sha) return;
+	const cacheDir = opts.cacheDir ?? node_path.default.join(require_paths_socket.getSocketDlxDir(), "skillspector", sha);
+	const installSpec = `git+${UPSTREAM_REPO}@${sha}`;
+	try {
+		return {
+			path: (await require_external_tools_from_pip_venv.createPipVenv({
+				cacheDir,
+				entryPoint: "skillspector",
+				installSpec
+			})).entryPointPath,
+			source: "dlx"
+		};
+	} catch {
+		return;
+	}
+}
+
+//#endregion
+exports.skillspectorFromDlx = skillspectorFromDlx;

package/dist/external-tools/skillspector/from-path.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @file `skillspectorFromPath()` — `which skillspector` lookup. Reports
+ *   `source: 'pipx'` when the resolved path lives under a `pipx/venvs/`
+ *   directory (the dev's `pipx install skillspector` path); reports `source:
+ *   'path'` otherwise (a one-off binary on PATH).
+ */
+import type { ResolvedSkillSpector } from './types';
+export declare function skillspectorFromPath(): Promise<ResolvedSkillSpector | undefined>;