@socketsecurity/lib 6.0.6 → 6.0.7

package/dist/events/exit/handler.js

@@ -24,25 +24,24 @@ const require_events_exit_lifecycle = require('./lifecycle.js');
 *   remove()
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function onExit(cb, options) {
 	/* c8 ignore start */
 	if (!require_events_exit__internal.globalProcess) return function remove() {};
 	/* c8 ignore stop */
 	if (typeof cb !== "function") throw new require_primordials_error.TypeErrorCtor("a callback must be provided for exit handler");
-	if (require_events_exit__internal.isLoaded() === false) /* @__PURE__ */ require_events_exit_lifecycle.load();
+	if (require_events_exit__internal.isLoaded() === false) require_events_exit_lifecycle.load();
 	const { alwaysLast } = {
 		__proto__: null,
 		...options
 	};
 	let eventName = "exit";
 	if (alwaysLast) eventName = "afterexit";
-	const emitter = /* @__PURE__ */ require_events_exit__internal.getEmitter();
+	const emitter = require_events_exit__internal.getEmitter();
 	emitter.on(eventName, cb);
 	return function remove() {
 		emitter.removeListener(eventName, cb);
 		/* c8 ignore start */
-		if (!emitter.listeners("exit").length && !emitter.listeners("afterexit").length) /* @__PURE__ */ require_events_exit_lifecycle.unload();
+		if (!emitter.listeners("exit").length && !emitter.listeners("afterexit").length) require_events_exit_lifecycle.unload();
 		/* c8 ignore stop */
 	};
 }

package/dist/events/exit/intercept.js

@@ -14,7 +14,6 @@ const require_events_exit__internal = require('./_internal.js');
 */
 /* c8 ignore start - processEmit + processReallyExit interceptors
 only fire on real process exit/emit; can't be triggered in-test. */
-/*@__NO_SIDE_EFFECTS__*/
 function processEmit(eventName, exitCode, ...args) {
 	if (eventName === "exit") {
 		let actualExitCode = exitCode;
@@ -28,8 +27,8 @@ function processEmit(eventName, exitCode, ...args) {
 			...args
 		]);
 		const numExitCode = typeof actualExitCode === "number" ? actualExitCode : void 0;
-		/* @__PURE__ */ require_events_exit__internal.emit("exit", numExitCode, void 0);
-		/* @__PURE__ */ require_events_exit__internal.emit("afterexit", numExitCode, void 0);
+		require_events_exit__internal.emit("exit", numExitCode, void 0);
+		require_events_exit__internal.emit("afterexit", numExitCode, void 0);
 		return result;
 	}
 	return require_primordials_reflect.ReflectApply(require_events_exit__internal.originalProcessEmit, this, [
@@ -38,12 +37,11 @@ function processEmit(eventName, exitCode, ...args) {
 		...args
 	]);
 }
-/*@__NO_SIDE_EFFECTS__*/
 function processReallyExit(code) {
 	const exitCode = code || 0;
 	if (require_events_exit__internal.globalProcess) require_events_exit__internal.globalProcess.exitCode = exitCode;
-	/* @__PURE__ */ require_events_exit__internal.emit("exit", exitCode, void 0);
-	/* @__PURE__ */ require_events_exit__internal.emit("afterexit", exitCode, void 0);
+	require_events_exit__internal.emit("exit", exitCode, void 0);
+	require_events_exit__internal.emit("afterexit", exitCode, void 0);
 	require_primordials_reflect.ReflectApply(require_events_exit__internal.originalProcessReallyExit, require_events_exit__internal.globalProcess, [exitCode]);
 	throw new require_primordials_error.ErrorCtor("processReallyExit should never return");
 }

package/dist/events/exit/lifecycle.js

@@ -11,26 +11,26 @@ const require_events_exit_intercept = require('./intercept.js');
 *   calls `unload()`; keeping them in the same leaf avoids an inter-leaf import
 *   cycle.
 */
-let _sigListeners;
-/*@__NO_SIDE_EFFECTS__*/
+let signalListenerMap;
 function getSignalListeners() {
-	if (_sigListeners === void 0) {
-		_sigListeners = { __proto__: null };
-		const emitter = /* @__PURE__ */ require_events_exit__internal.getEmitter();
-		const sigs = /* @__PURE__ */ require_events_exit__internal.getSignals();
+	if (signalListenerMap === void 0) {
+		signalListenerMap = { __proto__: null };
+		const emitter = require_events_exit__internal.getEmitter();
+		const sigs = require_events_exit__internal.getSignals();
 		/* c8 ignore start - Signal-listener body fires only on real
 		process signals; can't be triggered in-test without subprocess
 		infrastructure. */
-		for (const sig of sigs) _sigListeners[sig] = function listener() {
+		for (const sig of sigs) signalListenerMap[sig] = function listener() {
 			if ((require_events_exit__internal.globalProcess?.listeners(sig) || []).length === emitter.count) {
-				/* @__PURE__ */ require_events_exit__internal.emit("exit", void 0, sig);
-				/* @__PURE__ */ require_events_exit__internal.emit("afterexit", void 0, sig);
+				unload();
+				require_events_exit__internal.emit("exit", void 0, sig);
+				require_events_exit__internal.emit("afterexit", void 0, sig);
 				const killSig = require_events_exit__internal.WIN32 && sig === "SIGHUP" ? "SIGINT" : sig;
 				require_events_exit__internal.globalProcess?.kill(require_events_exit__internal.globalProcess?.pid, killSig);
 			}
 		};
 	}
-	return _sigListeners;
+	return signalListenerMap;
 }
 /**
 * Load signal handlers and hook into process exit events.
@@ -41,18 +41,17 @@ function getSignalListeners() {
 *   // Signal handlers are now active
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function load() {
 	/* c8 ignore next - !globalProcess never fires in Node tests. */
 	if (require_events_exit__internal.isLoaded() || !require_events_exit__internal.globalProcess) return;
 	require_events_exit__internal.setLoaded(true);
 	const proc = require_events_exit__internal.globalProcess;
-	const emitter = /* @__PURE__ */ require_events_exit__internal.getEmitter();
+	const emitter = require_events_exit__internal.getEmitter();
 	/* c8 ignore start */
 	if (emitter.count !== void 0) emitter.count += 1;
 	/* c8 ignore stop */
-	const sigs = /* @__PURE__ */ require_events_exit__internal.getSignals();
-	const sigListeners = /* @__PURE__ */ getSignalListeners();
+	const sigs = require_events_exit__internal.getSignals();
+	const sigListeners = getSignalListeners();
 	require_events_exit__internal.setSignals(sigs.filter((sig) => {
 		try {
 			proc.on(sig, sigListeners[sig]);
@@ -73,14 +72,13 @@ function load() {
 *   // Signal handlers are now removed
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function unload() {
 	/* c8 ignore start */
 	if (!require_events_exit__internal.isLoaded() || !require_events_exit__internal.globalProcess) return;
 	/* c8 ignore stop */
 	require_events_exit__internal.setLoaded(false);
-	const sigs = /* @__PURE__ */ require_events_exit__internal.getSignals();
-	const sigListeners = /* @__PURE__ */ getSignalListeners();
+	const sigs = require_events_exit__internal.getSignals();
+	const sigListeners = getSignalListeners();
 	for (const sig of sigs) try {
 		require_events_exit__internal.globalProcess.removeListener(sig, sigListeners[sig]);
 	} catch {}
@@ -88,7 +86,7 @@ function unload() {
 	/* c8 ignore start */
 	if (require_events_exit__internal.originalProcessReallyExit !== void 0) require_events_exit__internal.globalProcess.reallyExit = require_events_exit__internal.originalProcessReallyExit;
 	/* c8 ignore stop */
-	const emitter = /* @__PURE__ */ require_events_exit__internal.getEmitter();
+	const emitter = require_events_exit__internal.getEmitter();
 	/* c8 ignore start */
 	if (emitter.count !== void 0) emitter.count -= 1;
 	/* c8 ignore stop */

package/dist/events/exit/signals.js

@@ -19,9 +19,8 @@ const require_events_exit__internal = require('./_internal.js');
 *   console.log(sigs) // ['SIGABRT', 'SIGALRM', 'SIGHUP', ...]
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function signals() {
-	return /* @__PURE__ */ require_events_exit__internal.getSignals();
+	return require_events_exit__internal.getSignals();
 }
 
 //#endregion

package/dist/events/exit/types.d.ts

@@ -4,18 +4,19 @@
  *   emitter, emitted-signal map, and listener map. Pure types, no runtime side
  *   effects.
  */
+import type { EventEmitter } from 'node:events';
 export type EmittedSignals = {
     [signal: string]: boolean;
 };
-export type SignalExitEmitter = import('node:events').EventEmitter & {
-    count?: number;
-    emitted?: EmittedSignals;
-    infinite?: boolean;
+export type SignalExitEmitter = EventEmitter & {
+    count?: number | undefined;
+    emitted?: EmittedSignals | undefined;
+    infinite?: boolean | undefined;
 };
 export type SignalListener = () => void;
 export type SignalListenerMap = {
     [signal: string]: SignalListener;
 };
 export interface OnExitOptions {
-    alwaysLast?: boolean;
+    alwaysLast?: boolean | undefined;
 }

package/dist/external/@npmcli/package-json.js

@@ -2388,7 +2388,7 @@ var require_commonjs$5 = /* @__PURE__ */ __commonJSMin(((exports) => {
 }));
 
 //#endregion
-//#region node_modules/.pnpm/brace-expansion@5.0.5/node_modules/brace-expansion/dist/commonjs/index.js
+//#region node_modules/.pnpm/brace-expansion@5.0.6/node_modules/brace-expansion/dist/commonjs/index.js
 var require_commonjs$4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.EXPANSION_MAX = void 0;
@@ -2504,7 +2504,7 @@ var require_commonjs$4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 				}
 				const pad = n.some(isPadded);
 				N = [];
-				for (let i = x; test(i, y); i += incr) {
+				for (let i = x; test(i, y) && N.length < max; i += incr) {
 					let c;
 					if (isAlphaSequence) {
 						c = String.fromCharCode(i);

package/dist/external/npm-pack.js

@@ -2432,7 +2432,7 @@ var require_commonjs$8 = /* @__PURE__ */ __commonJSMin(((exports) => {
 }));
 
 //#endregion
-//#region node_modules/.pnpm/brace-expansion@5.0.5/node_modules/brace-expansion/dist/commonjs/index.js
+//#region node_modules/.pnpm/brace-expansion@5.0.6/node_modules/brace-expansion/dist/commonjs/index.js
 var require_commonjs$7 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.EXPANSION_MAX = void 0;
@@ -2548,7 +2548,7 @@ var require_commonjs$7 = /* @__PURE__ */ __commonJSMin(((exports) => {
 				}
 				const pad = n.some(isPadded);
 				N = [];
-				for (let i = x; test(i, y); i += incr) {
+				for (let i = x; test(i, y) && N.length < max; i += incr) {
 					let c;
 					if (isAlphaSequence) {
 						c = String.fromCharCode(i);

package/dist/external-tools/bazel/read-bazel-version-file.js

@@ -23,7 +23,7 @@ const BAZEL_VERSION_FILE = ".bazelversion";
 async function readBazelVersionFile(startDir) {
 	let current = node_path.default.resolve(startDir);
 	while (true) {
-		const content = await /* @__PURE__ */ require_fs_read_file.safeReadFile(node_path.default.join(current, BAZEL_VERSION_FILE), { encoding: "utf8" });
+		const content = await require_fs_read_file.safeReadFile(node_path.default.join(current, BAZEL_VERSION_FILE), { encoding: "utf8" });
 		if (content !== void 0) {
 			const hashIdx = require_primordials_string.StringPrototypeIndexOf(content, "#");
 			const version = require_primordials_string.StringPrototypeTrim(hashIdx === -1 ? content : require_primordials_string.StringPrototypeSlice(content, 0, hashIdx));

package/dist/external-tools/bazel/types.d.ts

@@ -18,5 +18,5 @@ export interface ResolvedBazel {
     /**
      * See {@link ResolvedToolIntegrity}.
      */
-    readonly integrity?: ResolvedToolIntegrity;
+    readonly integrity?: ResolvedToolIntegrity | undefined;
 }

package/dist/external-tools/cdxgen/from-vfs.js

@@ -10,7 +10,7 @@ const require_smol_vfs = require('../../smol/vfs.js');
 */
 const CDXGEN_VFS_KEY = "cdxgen";
 async function cdxgenFromVfs() {
-	const vfs = /* @__PURE__ */ require_smol_vfs.getSmolVfs();
+	const vfs = require_smol_vfs.getSmolVfs();
 	if (!vfs) return;
 	/* c8 ignore start - smol Node binary only. */
 	if (!vfs.has("cdxgen")) return;

package/dist/external-tools/cdxgen/types.d.ts

@@ -29,5 +29,5 @@ export interface ResolvedCdxgen {
     /**
      * See {@link ResolvedToolIntegrity}.
      */
-    readonly integrity?: ResolvedToolIntegrity;
+    readonly integrity?: ResolvedToolIntegrity | undefined;
 }

package/dist/external-tools/from-download.d.ts

@@ -68,7 +68,7 @@ export interface DownloadAndExtractOptions extends DownloadOptions {
  *   const { extractedDir, integrity } = await downloadAndExtractTool({
  *     url: 'https://example.com/jre-21-darwin-arm64.tar.gz',
  *     name: 'jre-21-darwin-arm64',
- *     extractedDir: '/Users/me/.cache/socket/jre/21/darwin-arm64',
+ *     extractedDir: '/Users/<user>/.cache/socket/jre/21/darwin-arm64',
  *     extractOptions: { strip: 1 },
  *   })
  *   // Caller constructs ResolvedJre from extractedDir.

package/dist/external-tools/from-download.js

@@ -44,7 +44,7 @@ let node_fs = require("node:fs");
 *   const { extractedDir, integrity } = await downloadAndExtractTool({
 *     url: 'https://example.com/jre-21-darwin-arm64.tar.gz',
 *     name: 'jre-21-darwin-arm64',
-*     extractedDir: '/Users/me/.cache/socket/jre/21/darwin-arm64',
+*     extractedDir: '/Users/<user>/.cache/socket/jre/21/darwin-arm64',
 *     extractOptions: { strip: 1 },
 *   })
 *   // Caller constructs ResolvedJre from extractedDir.

package/dist/external-tools/janus/from-vfs.js

@@ -10,7 +10,7 @@ const require_smol_vfs = require('../../smol/vfs.js');
 */
 const JANUS_VFS_KEY = "janus";
 async function janusFromVfs() {
-	const vfs = /* @__PURE__ */ require_smol_vfs.getSmolVfs();
+	const vfs = require_smol_vfs.getSmolVfs();
 	if (!vfs) return;
 	/* c8 ignore start - smol Node binary only. */
 	if (!vfs.has("janus")) return;

package/dist/external-tools/janus/types.d.ts

@@ -20,5 +20,5 @@ export interface ResolvedJanus {
     /**
      * See {@link ResolvedToolIntegrity}.
      */
-    readonly integrity?: ResolvedToolIntegrity;
+    readonly integrity?: ResolvedToolIntegrity | undefined;
 }

package/dist/external-tools/jre/detect-platform-arch.d.ts

@@ -1,8 +1,12 @@
 /**
- * @file `getCurrentPlatformArch()` — resolves the current machine to a
- *   `platform-arch` string suitable for the Adoptium asset-name map. Wraps
- *   `getPlatformArch` from `src/releases/socket-btm` so external-tools modules
- *   don't need to know about releases' platform/arch typing. Returns
- *   `undefined` on unsupported platform/arch combos.
+ * @file `getJreArch()` — resolves the current machine to a `platform-arch`
+ *   string suitable for the Adoptium `ADOPTIUM_QUERY_MAP` keys (e.g.
+ *   `darwin-arm64`, `linux-x64-musl`, `win-x64`). Self-contained: owns the
+ *   Adoptium vocabulary end to end (Node's `win32` → `win`, an Alpine `-musl`
+ *   suffix on Linux) rather than reusing the shared `getPlatformArch` /
+ *   `detectLibc` — Adoptium ships a distinct `alpine-linux` channel, so the JRE
+ *   key set differs from both the release-binary naming and
+ *   python-build-standalone (see `getPythonArch`). Returns `undefined` on an
+ *   unsupported platform/arch.
  */
-export declare function getCurrentPlatformArch(): string | undefined;
+export declare function getJreArch(): string | undefined;

package/dist/external-tools/jre/detect-platform-arch.js

@@ -2,27 +2,42 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../../_virtual/_rolldown/runtime.js');
-const require_releases_socket_btm = require('../../releases/socket-btm.js');
+const require_constants_platform = require('../../constants/platform.js');
+const require_primordials_object = require('../../primordials/object.js');
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
 
 //#region src/external-tools/jre/detect-platform-arch.ts
 /**
-* @file `getCurrentPlatformArch()` — resolves the current machine to a
-*   `platform-arch` string suitable for the Adoptium asset-name map. Wraps
-*   `getPlatformArch` from `src/releases/socket-btm` so external-tools modules
-*   don't need to know about releases' platform/arch typing. Returns
-*   `undefined` on unsupported platform/arch combos.
+* @file `getJreArch()` — resolves the current machine to a `platform-arch`
+*   string suitable for the Adoptium `ADOPTIUM_QUERY_MAP` keys (e.g.
+*   `darwin-arm64`, `linux-x64-musl`, `win-x64`). Self-contained: owns the
+*   Adoptium vocabulary end to end (Node's `win32` → `win`, an Alpine `-musl`
+*   suffix on Linux) rather than reusing the shared `getPlatformArch` /
+*   `detectLibc` — Adoptium ships a distinct `alpine-linux` channel, so the JRE
+*   key set differs from both the release-binary naming and
+*   python-build-standalone (see `getPythonArch`). Returns `undefined` on an
+*   unsupported platform/arch.
 */
-function getCurrentPlatformArch() {
-	/* c8 ignore start - depends on process.platform/arch. */
-	try {
-		return require_releases_socket_btm.getPlatformArch(node_process.default.platform, node_process.default.arch, require_releases_socket_btm.detectLibc());
-	} catch {
-		return;
-	}
+const NODE_PLATFORM_TO_JRE = require_primordials_object.ObjectFreeze({
+	__proto__: null,
+	darwin: "darwin",
+	linux: "linux",
+	win32: "win"
+});
+const NODE_ARCH_TO_JRE = require_primordials_object.ObjectFreeze({
+	__proto__: null,
+	arm64: "arm64",
+	x64: "x64"
+});
+function getJreArch() {
+	/* c8 ignore start - depends on process.platform/arch + libc probe. */
+	const platform = NODE_PLATFORM_TO_JRE[node_process.default.platform];
+	const arch = NODE_ARCH_TO_JRE[node_process.default.arch];
+	if (!platform || !arch) return;
+	return `${platform}-${arch}${platform === "linux" && require_constants_platform.getLibc() === "musl" ? "-musl" : ""}`;
 	/* c8 ignore stop */
 }
 
 //#endregion
-exports.getCurrentPlatformArch = getCurrentPlatformArch;
+exports.getJreArch = getJreArch;

package/dist/external-tools/jre/from-vfs.js

@@ -25,7 +25,7 @@ node_process = require_runtime.__toESM(node_process);
 */
 const JRE_VFS_KEY = "jre";
 async function jreFromVfs() {
-	const vfs = /* @__PURE__ */ require_smol_vfs.getSmolVfs();
+	const vfs = require_smol_vfs.getSmolVfs();
 	if (!vfs) return;
 	/* c8 ignore start - smol Node binary only. */
 	if (!vfs.has("jre")) return;

package/dist/external-tools/jre/types.d.ts

@@ -23,6 +23,6 @@ export interface ResolvedJre {
     /**
      * See {@link ResolvedToolIntegrity}.
      */
-    readonly integrity?: ResolvedToolIntegrity;
+    readonly integrity?: ResolvedToolIntegrity | undefined;
 }
 export type { AdoptiumAssetQuery };

package/dist/external-tools/manifest.d.ts

@@ -9,10 +9,10 @@
  *   integrity-string validation. Shape: { "<tool-name>": { "description":
  *   "human-readable summary", "version": "1.7.2", "release": "asset" |
  *   "tarball" | ..., "repository": "github:owner/repo", "notes": [...],
- *   "checksums": { "<platform-arch>": { "asset": "<asset-filename>",
+ *   "platforms": { "<platform-arch>": { "asset": "<asset-filename>",
  *   "integrity": "sha256-base64=" } } } } Some tools have flavor variants (e.g.
  *   sfw's `free` / `enterprise`) that wrap the `{repository, binaryName,
- *   checksums}` triple under a flavor key. Use `getToolFlavor` for those. Some
+ *   platforms}` triple under a flavor key. Use `getToolFlavor` for those. Some
  *   entries (e.g. `rust`) describe a system tool with a different shape —
  *   they're skipped by `getTool` and fully readable only via the raw
  *   `readManifest` returning unknown.
@@ -42,7 +42,7 @@ export interface ToolChecksum {
     integrity: string;
 }
 /**
- * A downloadable-binary tool entry. `checksums` is keyed by the fleet's
+ * A downloadable-binary tool entry. `platforms` is keyed by the fleet's
  * platform-arch token (`darwin-arm64`, `linux-x64-musl`, `win-x64`, etc. — same
  * vocabulary as `getPlatformArch`).
  */
@@ -53,12 +53,12 @@ export interface ToolEntry {
     repository: string;
     binaryName?: string | undefined;
     notes?: readonly string[] | undefined;
-    checksums: Readonly<Record<string, ToolChecksum>>;
+    platforms: Readonly<Record<string, ToolChecksum>>;
 }
 /**
  * A flavored tool entry — sfw is the canonical example, with `free` and
  * `enterprise` variants sharing the same outer `description` / `version` /
- * `release` but each carrying its own `{repository, binaryName, checksums}`.
+ * `release` but each carrying its own `{repository, binaryName, platforms}`.
  */
 export interface FlavoredToolEntry {
     description: string;
@@ -70,7 +70,7 @@ export interface FlavoredToolEntry {
 export interface ToolFlavor {
     repository: string;
     binaryName?: string | undefined;
-    checksums: Readonly<Record<string, ToolChecksum>>;
+    platforms: Readonly<Record<string, ToolChecksum>>;
 }
 /**
  * Parsed manifest. `tools` is a flat map; the values are unions because some
@@ -93,7 +93,7 @@ export type ManifestEntry = {
 };
 export declare function isObject(value: unknown): value is Record<string, unknown>;
 export declare function parseChecksum(raw: unknown, toolName: string, platformKey: string): ToolChecksum;
-export declare function parseChecksums(raw: unknown, toolName: string): Record<string, ToolChecksum>;
+export declare function parsePlatforms(raw: unknown, toolName: string): Record<string, ToolChecksum>;
 export declare function parseToolEntry(raw: unknown, toolName: string): ManifestEntry;
 /**
  * Read an `external-tools.json` file from disk and return the parsed manifest.

package/dist/external-tools/manifest.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_error = require('../primordials/error.js');
-const require_primordials_string = require('../primordials/string.js');
 const require_integrity = require('../integrity.js');
+const require_primordials_string = require('../primordials/string.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_primordials_object = require('../primordials/object.js');
 const require_fs_read_json = require('../fs/read-json.js');
@@ -20,10 +20,10 @@ const require_fs_read_json = require('../fs/read-json.js');
 *   integrity-string validation. Shape: { "<tool-name>": { "description":
 *   "human-readable summary", "version": "1.7.2", "release": "asset" |
 *   "tarball" | ..., "repository": "github:owner/repo", "notes": [...],
-*   "checksums": { "<platform-arch>": { "asset": "<asset-filename>",
+*   "platforms": { "<platform-arch>": { "asset": "<asset-filename>",
 *   "integrity": "sha256-base64=" } } } } Some tools have flavor variants (e.g.
 *   sfw's `free` / `enterprise`) that wrap the `{repository, binaryName,
-*   checksums}` triple under a flavor key. Use `getToolFlavor` for those. Some
+*   platforms}` triple under a flavor key. Use `getToolFlavor` for those. Some
 *   entries (e.g. `rust`) describe a system tool with a different shape —
 *   they're skipped by `getTool` and fully readable only via the raw
 *   `readManifest` returning unknown.
@@ -52,14 +52,14 @@ function parseChecksum(raw, toolName, platformKey) {
 	if (!isObject(raw)) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' checksum entry '${platformKey}' must be an object, got: ${typeof raw}`);
 	const r = raw;
 	if (typeof r.asset !== "string" || r.asset.length === 0) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' platform '${platformKey}' is missing a non-empty 'asset' string`);
-	if (typeof r.integrity !== "string" || !require_integrity.isIntegrityString(r.integrity)) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' platform '${platformKey}' has an invalid 'integrity' (expected SRI sha512 or sha256 form): ${r.integrity}`);
+	if (typeof r.integrity !== "string" || !require_integrity.isIntegrity(r.integrity)) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' platform '${platformKey}' has an invalid 'integrity' (expected SRI sha512 or sha256 form): ${r.integrity}`);
 	return {
 		asset: r.asset,
 		integrity: r.integrity
 	};
 }
-function parseChecksums(raw, toolName) {
-	if (!isObject(raw)) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' is missing a 'checksums' object`);
+function parsePlatforms(raw, toolName) {
+	if (!isObject(raw)) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' is missing a 'platforms' object`);
 	const out = {};
 	for (const platformKey of require_primordials_object.ObjectKeys(raw)) out[platformKey] = parseChecksum(raw[platformKey], toolName, platformKey);
 	return out;
@@ -70,7 +70,7 @@ function parseToolEntry(raw, toolName) {
 		raw
 	};
 	const r = raw;
-	if (isObject(r.checksums)) {
+	if (isObject(r.platforms)) {
 		if (typeof r.description !== "string" || typeof r.version !== "string" || typeof r.release !== "string" || typeof r.repository !== "string") return {
 			kind: "other",
 			raw
@@ -84,7 +84,7 @@ function parseToolEntry(raw, toolName) {
 				repository: r.repository,
 				binaryName: typeof r.binaryName === "string" ? r.binaryName : void 0,
 				notes: require_primordials_array.ArrayIsArray(r.notes) ? r.notes : void 0,
-				checksums: parseChecksums(r.checksums, toolName)
+				platforms: parsePlatforms(r.platforms, toolName)
 			}
 		};
 	}
@@ -105,7 +105,7 @@ function parseToolEntry(raw, toolName) {
 * callers can handle them out-of-band without blocking the manifest read.
 */
 async function readExternalToolsManifest(filepath) {
-	const raw = await /* @__PURE__ */ require_fs_read_json.readJson(filepath);
+	const raw = await require_fs_read_json.readJson(filepath);
 	if (!isObject(raw)) throw new require_primordials_error.ErrorCtor(`external-tools.json: expected top-level object, got: ${typeof raw}`);
 	const tools = {};
 	for (const toolName of require_primordials_object.ObjectKeys(raw)) {
@@ -120,12 +120,12 @@ function tryParseFlavored(raw, toolName) {
 		const value = raw[key];
 		if (!isObject(value)) continue;
 		const rf = value;
-		if (!isObject(rf.checksums)) continue;
+		if (!isObject(rf.platforms)) continue;
 		if (typeof rf.repository !== "string") continue;
 		flavors[key] = {
 			repository: rf.repository,
 			binaryName: typeof rf.binaryName === "string" ? rf.binaryName : void 0,
-			checksums: parseChecksums(rf.checksums, `${toolName}.${key}`)
+			platforms: parsePlatforms(rf.platforms, `${toolName}.${key}`)
 		};
 	}
 	if (require_primordials_object.ObjectKeys(flavors).length === 0) return;
@@ -143,7 +143,7 @@ exports.getTool = getTool;
 exports.getToolFlavor = getToolFlavor;
 exports.isObject = isObject;
 exports.parseChecksum = parseChecksum;
-exports.parseChecksums = parseChecksums;
+exports.parsePlatforms = parsePlatforms;
 exports.parseToolEntry = parseToolEntry;
 exports.readExternalToolsManifest = readExternalToolsManifest;
 exports.tryParseFlavored = tryParseFlavored;

package/dist/external-tools/opengrep/from-vfs.js

@@ -11,7 +11,7 @@ const require_smol_vfs = require('../../smol/vfs.js');
 */
 const OPENGREP_VFS_KEY = "opengrep";
 async function opengrepFromVfs() {
-	const vfs = /* @__PURE__ */ require_smol_vfs.getSmolVfs();
+	const vfs = require_smol_vfs.getSmolVfs();
 	if (!vfs) return;
 	/* c8 ignore start - smol Node binary only. */
 	if (!vfs.has("opengrep")) return;

package/dist/external-tools/opengrep/types.d.ts

@@ -20,5 +20,5 @@ export interface ResolvedOpengrep {
     /**
      * See {@link ResolvedToolIntegrity}.
      */
-    readonly integrity?: ResolvedToolIntegrity;
+    readonly integrity?: ResolvedToolIntegrity | undefined;
 }

package/dist/external-tools/python/asset-names.d.ts

@@ -0,0 +1,76 @@
+/**
+ * @file Python-build-standalone release asset mapping. Astral publishes
+ *   per-platform CPython archives under
+ *   https://github.com/astral-sh/python-build-standalone/releases/download/<tag>/.
+ *   Asset name shape: `cpython-<version>+<tag>-<triple>-install_only.tar.gz`.
+ *   The `install_only` flavor is a relocatable runtime (no build artifacts),
+ *   extracted one directory deep (`python/bin/python3`).
+ */
+/**
+ * Python-build-standalone default pin — the fleet-canonical CPython build,
+ * matching socket-cli's `bundle-tools.json`. Consumers that don't pass their
+ * own pin resolve against this. Bump it like any dependency (soak-aware), in
+ * lockstep with socket-cli (drift-watch). The `checksums` map is keyed by asset
+ * filename so the download tier verifies the exact tarball per platform.
+ */
+export declare const DEFAULT_PYTHON_PIN: Readonly<{
+    __proto__: null;
+    version: "3.11.14";
+    tag: "20260203";
+    checksums: Readonly<{
+        __proto__: null;
+        'cpython-3.11.14+20260203-aarch64-apple-darwin-install_only.tar.gz': "63e3352fefd3b6494f73f46f51c6581c57a7e0d98775e6e00229d14a67ec3ce9";
+        'cpython-3.11.14+20260203-aarch64-pc-windows-msvc-install_only.tar.gz': "cb7828c131a005da367f7dba3a561bed91619452de870e531ee03344b2ac346f";
+        'cpython-3.11.14+20260203-aarch64-unknown-linux-gnu-install_only.tar.gz': "7341a5a0acd65f2c7c7a228d8bafa6561d220ffed26293d6a02c15ae2ee86af5";
+        'cpython-3.11.14+20260203-aarch64-unknown-linux-musl-install_only.tar.gz': "f0e5988c108187b12eb4d53cbac33a499a8e38e1693104432e1faabbab14c664";
+        'cpython-3.11.14+20260203-x86_64-apple-darwin-install_only.tar.gz': "f3b63051a9b1ffb4f663d928ebaec4311435cb67f3bdfa5634953df93397f25e";
+        'cpython-3.11.14+20260203-x86_64-pc-windows-msvc-install_only.tar.gz': "d220beff465bdc97bf5874be8ffbf07278e5bdf9a064cab932b5d93b542e3e86";
+        'cpython-3.11.14+20260203-x86_64-unknown-linux-gnu-install_only.tar.gz': "67abde21b6e074b58c0f738f0c4802b23827a7d49707dcaf3ed4dadf572f3f37";
+        'cpython-3.11.14+20260203-x86_64-unknown-linux-musl-install_only.tar.gz': "290de5199a9647d4de4adcf13a79a7c59f060357853bf41fd6d1a69b4b5fd00c";
+    }>;
+}>;
+/**
+ * Resolve the current host to a python-build-standalone `platform-arch` key (a
+ * `PLATFORM_TRIPLES` key, e.g. `darwin-arm64`, `linux-x64-musl`, `win-x64`).
+ * Owns the python-build-standalone vocabulary end to end: Node's `win32`
+ * becomes `win`, and an Alpine host gets a `-musl` suffix so it resolves to the
+ * real musl triple (upstream ships both gnu and musl Linux builds). Returns
+ * `undefined` when the host platform/arch has no upstream prebuilt.
+ *
+ * Separate from `getJreArch` (jre/Adoptium vocabulary) and from the shared
+ * `getPlatformArch` — neither matches python-build-standalone's key set.
+ */
+export declare function getPythonArch(): string | undefined;
+export interface PythonAssetOptions {
+    /**
+     * CPython version, e.g. `3.11.14`.
+     */
+    readonly version: string;
+    /**
+     * Python-build-standalone release tag, e.g. `20260203`.
+     */
+    readonly tag: string;
+    /**
+     * Target `platform-arch`, e.g. `darwin-arm64`. Omit to auto-detect the
+     * current host via {@link getPythonArch}; pass an explicit value to resolve
+     * the asset for a different target (e.g. cross-platform packaging).
+     */
+    readonly arch?: string | undefined;
+}
+export interface PythonAsset {
+    /**
+     * Full asset filename:
+     * `cpython-<version>+<tag>-<triple>-install_only.tar.gz`.
+     */
+    readonly assetName: string;
+    /**
+     * Absolute download URL for the asset (with `+` percent-encoded as `%2B`).
+     */
+    readonly url: string;
+}
+/**
+ * Resolve the python-build-standalone download for a version + tag + platform.
+ * Returns the asset filename and URL, or `undefined` when the platform-arch has
+ * no upstream prebuilt.
+ */
+export declare function pythonAsset(opts: PythonAssetOptions): PythonAsset | undefined;