@socketsecurity/lib 6.0.7 → 6.0.9

package/dist/paths/socket.js

@@ -2,33 +2,36 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_node_os = require('../node/os.js');
+const require_constants_platform = require('../constants/platform.js');
+const require_env_home = require('../env/home.js');
+const require_env_xdg = require('../env/xdg.js');
 const require_paths_normalize = require('./normalize.js');
 const require_node_path = require('../node/path.js');
 const require_env_socket = require('../env/socket.js');
-const require_constants_github = require('../constants/github.js');
 const require_constants_socket = require('../constants/socket.js');
-const require_env_home = require('../env/home.js');
 const require_env_windows = require('../env/windows.js');
 const require_paths_dirnames = require('./dirnames.js');
 const require_paths_rewire = require('./rewire.js');
 
 //#region src/paths/socket.ts
 /**
-* @file Path utilities for Socket ecosystem directories. Provides
-*   platform-aware path resolution for Socket tools' shared directory
-*   structure. Directory Structure: ~/.socket/ ├── _cacache/ #
-*   Content-addressable cache for npm packages ├── _dlx/ # DLX installations
-*   (content-addressed by hash) │ ├── <hash>/ # npm package installs
-*   (dlx-package) │ └── <hash>/ # binary downloads (dlx-binary) ├── _socket/ #
-*   Socket CLI app directory ├── _registry/ # Socket Registry app directory └──
-*   _sfw/ # Socket Firewall app directory.
+* @file Path utilities for Socket ecosystem directories. Platform-aware
+*   resolution for the shared ~/.socket/ layout. The `_`-prefixed entries are
+*   Socket-managed DIRS (not apps): `_cacache` content-addressable cache;
+*   `_dlx/<hash>/` name+version binary store (node, jre, python, sfw, …);
+*   `_state/<app>/` version-LESS persistent app state (daemon socket + lock +
+*   OAuth refresh; mirrors pnpm `state-dir` / XDG_STATE_HOME), with
+*   `_state/<app>/run/` for a daemon's socket/lock/pid; `_wheelhouse`
+*   cross-fleet shared bin. Generic per-app dirs (`getSocketAppDir('<name>')`)
+*   nest under the same `_`-prefix.
 */
 /**
 * Get the OS home directory. Can be overridden in tests using
 * setPath('homedir', ...) from paths/rewire.
 */
 function getOsHomeDir() {
-	return require_paths_rewire.getPathValue("homedir", () => require_node_os.getNodeOs().homedir());
+	const os = require_node_os.getNodeOs();
+	return require_paths_rewire.getPathValue("homedir", () => os.homedir());
 }
 /**
 * Get the OS temporary directory. Can be overridden in tests using
@@ -39,7 +42,35 @@ function getOsHomeDir() {
 * setPath('tmpdir', ...) from paths/rewire.
 */
 function getOsTmpDir() {
-	return require_paths_rewire.getPathValue("tmpdir", () => require_node_os.getNodeOs().tmpdir());
+	const os = require_node_os.getNodeOs();
+	return require_paths_rewire.getPathValue("tmpdir", () => os.tmpdir());
+}
+/**
+* Resolve the runtime socket path for a local daemon named `name`. Distinct
+* from getSocketAppRuntimeDir (the persistent ~/.socket/_state/<app>/run/
+* home): the SOCKET endpoint itself belongs in the ephemeral, owner-only XDG
+* runtime dir — correctly permissioned and auto-cleaned on logout — while the
+* downloaded daemon binary + durable token cache live under ~/.socket. The
+* daemon and every client MUST compute the identical path (1 path, 1
+* reference), so this is the single resolver both sides call.
+*
+* Resolution:
+*
+* - Windows: `\\.\pipe\<name>-sock` (named pipe; Unix sockets are unavailable
+*   pre-Win10 1803, same framing/semantics). Returned raw — a pipe path is not
+*   a filesystem path and must not be slash-normalized.
+* - `$XDG_RUNTIME_DIR/<name>.sock` when XDG_RUNTIME_DIR is set (systemd
+*   `/run/user/<uid>/`).
+* - Else `$TMPDIR/<name>-<uid>.sock` (the `<uid>` suffix avoids collisions when
+*   TMPDIR is shared across users on a multi-tenant box).
+*/
+function getRuntimeSocketPath(name) {
+	if (require_constants_platform.WIN32) return `\\\\.\\pipe\\${name}-sock`;
+	const path = require_node_path.getNodePath();
+	const xdgRuntimeDir = require_env_xdg.getXdgRuntimeDir();
+	if (xdgRuntimeDir) return require_paths_normalize.normalizePath(path.join(xdgRuntimeDir, `${name}.sock`));
+	const { uid } = require_node_os.getNodeOs().userInfo();
+	return require_paths_normalize.normalizePath(path.join(getOsTmpDir(), `${name}-${uid}.sock`));
 }
 /**
 * Get a Socket app cache directory (~/.socket/_<appName>/cache).
@@ -60,81 +91,72 @@ function getSocketAppCacheTtlDir(appName) {
 	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketAppCacheDir(appName), "ttl"));
 }
 /**
-* Get a Socket app directory (~/.socket/_<appName>).
+* Get a Socket app directory (~/.socket/_<appName>). The `_` prefix is applied
+* here; pass the bare app name (e.g. 'socket', 'registry').
 */
 /**
-* Get a Socket app directory (~/.socket/_<appName>).
+* Get a Socket app directory (~/.socket/_<appName>). The `_` prefix is applied
+* here; pass the bare app name (e.g. 'socket', 'registry').
 */
 function getSocketAppDir(appName) {
 	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketUserDir(), `${"_"}${appName}`));
 }
 /**
-* Get the Socket cacache directory (~/.socket/_cacache). Can be overridden with
-* SOCKET_CACACHE_DIR environment variable or via setPath() for testing. Result
-* is cached via getPathValue for performance.
-*
-* Priority order:
-*
-* 1. Test override via setPath('socket-cacache-dir', ...)
-* 2. SOCKET_CACACHE_DIR - Full override of cacache directory
-* 3. Default: $SOCKET_HOME/_cacache or $HOME/.socket/_cacache
+* Get the Socket cacache directory (~/.socket/_cacache). Override precedence:
+* setPath('socket-cacache-dir', …) → SOCKET_CACACHE_DIR env →
+* $SOCKET_HOME/_cacache → $HOME/.socket/_cacache.
 */
 /**
-* Get the Socket cacache directory (~/.socket/_cacache). Can be overridden with
-* SOCKET_CACACHE_DIR environment variable or via setPath() for testing. Result
-* is cached via getPathValue for performance.
-*
-* Priority order:
-*
-* 1. Test override via setPath('socket-cacache-dir', ...)
-* 2. SOCKET_CACACHE_DIR - Full override of cacache directory
-* 3. Default: $SOCKET_HOME/_cacache or $HOME/.socket/_cacache
+* Get an app's runtime directory (~/.socket/_state/<app>/run/) — the home for a
+* daemon's Unix socket + `concurrency.lock` + `<socket>.pid`. Version-less so
+* the socket path is stable across binary upgrades.
 */
-function getSocketCacacheDir() {
-	return require_paths_rewire.getPathValue("socket-cacache-dir", () => {
-		if (require_env_socket.getSocketCacacheDirEnv()) return require_paths_normalize.normalizePath(require_env_socket.getSocketCacacheDirEnv());
-		return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketUserDir(), `${"_"}cacache`));
-	});
+function getSocketAppRuntimeDir(appName) {
+	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketAppStateDir(appName), "run"));
 }
 /**
-* Get the Socket CLI directory (~/.socket/_socket).
+* Get the Socket user directory (~/.socket). Override precedence:
+* setPath('socket-user-dir', …) → SOCKET_HOME env → $HOME/.socket →
+* /tmp/.socket (Unix) or %TEMP%.socket (Windows).
 */
 /**
-* Get the Socket CLI directory (~/.socket/_socket).
+* Get an app's persistent state directory (~/.socket/_state/<app>/). The
+* `<app>` is a real app (proteus, acorn) nesting its version-less state inside
+* the `_state` infra dir.
 */
-function getSocketCliDir() {
-	return getSocketAppDir(require_constants_socket.SOCKET_CLI_APP_NAME);
+function getSocketAppStateDir(appName) {
+	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketStateDir(), appName));
 }
 /**
-* Get the Socket DLX directory (~/.socket/_dlx). Can be overridden with
-* SOCKET_DLX_DIR environment variable or via setPath() for testing. Result is
-* cached via getPathValue for performance.
-*
-* Priority order:
-*
-* 1. Test override via setPath('socket-dlx-dir', ...)
-* 2. SOCKET_DLX_DIR - Full override of DLX cache directory
-* 3. SOCKET_HOME/_dlx - Base directory override (inherits from getSocketUserDir)
-* 4. Default: $HOME/.socket/_dlx
-* 5. Fallback: /tmp/.socket/_dlx (Unix) or %TEMP%.socket_dlx (Windows)
+* Get an app's runtime directory (~/.socket/_state/<app>/run/) — the home for a
+* daemon's Unix socket + `concurrency.lock` + `<socket>.pid`. Version-less so
+* the socket path is stable across binary upgrades.
 */
 /**
-* Get the Socket DLX directory (~/.socket/_dlx). Can be overridden with
-* SOCKET_DLX_DIR environment variable or via setPath() for testing. Result is
-* cached via getPathValue for performance.
-*
-* Priority order:
-*
-* 1. Test override via setPath('socket-dlx-dir', ...)
-* 2. SOCKET_DLX_DIR - Full override of DLX cache directory
-* 3. SOCKET_HOME/_dlx - Base directory override (inherits from getSocketUserDir)
-* 4. Default: $HOME/.socket/_dlx
-* 5. Fallback: /tmp/.socket/_dlx (Unix) or %TEMP%.socket_dlx (Windows)
+* Get the Socket cacache directory (~/.socket/_cacache). Override precedence:
+* setPath('socket-cacache-dir', …) → SOCKET_CACACHE_DIR env →
+* $SOCKET_HOME/_cacache → $HOME/.socket/_cacache.
+*/
+function getSocketCacacheDir() {
+	return require_paths_rewire.getPathValue("socket-cacache-dir", () => {
+		if (require_env_socket.getSocketCacacheDirEnv()) return require_paths_normalize.normalizePath(require_env_socket.getSocketCacacheDirEnv());
+		return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketUserDir(), require_constants_socket.SOCKET_DIR.cacache));
+	});
+}
+/**
+* Get the Socket DLX directory (~/.socket/_dlx) — the name+version binary store
+* (node, jre, python, sfw, …). Override precedence: setPath('socket-dlx-dir',
+* …) → SOCKET_DLX_DIR env → $SOCKET_HOME/_dlx → $HOME/.socket/_dlx.
+*/
+/**
+* Get the Socket DLX directory (~/.socket/_dlx) — the name+version binary store
+* (node, jre, python, sfw, …). Override precedence: setPath('socket-dlx-dir',
+* …) → SOCKET_DLX_DIR env → $SOCKET_HOME/_dlx → $HOME/.socket/_dlx.
 */
 function getSocketDlxDir() {
 	return require_paths_rewire.getPathValue("socket-dlx-dir", () => {
 		if (require_env_socket.getSocketDlxDirEnv()) return require_paths_normalize.normalizePath(require_env_socket.getSocketDlxDirEnv());
-		return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketUserDir(), `${"_"}${"dlx"}`));
+		return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketUserDir(), require_constants_socket.SOCKET_DIR.dlx));
 	});
 }
 /**
@@ -149,51 +171,71 @@ function getSocketHomePath() {
 	return getSocketUserDir();
 }
 /**
-* Get the Socket Registry directory (~/.socket/_registry).
-*/
-/**
-* Get the Socket Registry directory (~/.socket/_registry).
+* Get the Wheelhouse rack directory (~/.socket/_wheelhouse/rack) — the tool
+* STORE. Every `_wheelhouse`-managed CLI tool keeps its real binaries here,
+* racked by name + version as `<rack>/<tool>/<version>/…` (the wheelhouse
+* analog of Homebrew's `Cellar/`). The handles on PATH live in
+* `<wheelhouse>/bin` (getSocketWheelhouseBinDir) and point into the rack.
+* Inherits the `_wheelhouse` override chain (SOCKET_HOME /
+* setPath('socket-wheelhouse-dir')).
 */
-function getSocketRegistryDir() {
-	return getSocketAppDir(require_constants_socket.SOCKET_REGISTRY_APP_NAME);
+function getSocketRackDir() {
+	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketWheelhouseDir(), "rack"));
 }
 /**
-* Get the Socket Registry GitHub cache directory
-* (~/.socket/_registry/cache/ttl/github).
+* Get a racked tool's version directory (~/.socket/_wheelhouse/rack/<tool>/
+* <version>) — the per-tool, per-version home under the rack. The
+* 1-path-1-reference owner of a tool install destination: installers resolve
+* their extract/copy target through this, and the `<wheelhouse>/bin/<tool>`
+* shim points at a binary inside it.
 */
-/**
-* Get the Socket Registry GitHub cache directory
-* (~/.socket/_registry/cache/ttl/github).
-*/
-function getSocketRegistryGithubCacheDir() {
-	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketAppCacheTtlDir(require_constants_socket.SOCKET_REGISTRY_APP_NAME), require_constants_github.CACHE_GITHUB_DIR));
+function getSocketRackToolDir(options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketRackDir(), opts.tool, opts.version));
 }
 /**
-* Get the Socket Wheelhouse directory (~/.socket/_wheelhouse). Shared
-* cross-fleet location for binaries that every fleet member can reach without
-* each one re-downloading and re-extracting per-repo. Tool installers (janus,
-* sfw, etc.) drop their resolved executables under
-* `<wheelhouse>/<tool>/<version>/<platform-arch>/`; consumers add the
-* appropriate `bin/` to PATH or invoke the binary by absolute path.
+* Get the Wheelhouse repo-clones directory (~/.socket/_wheelhouse/repo-clones).
+* Sits beside the per-tool dirs (sfw, codedb, janus, bin) under `_wheelhouse`.
+* The home for reference clones of EXTERNAL repos an agent reviews, each as
+* `<org>-<repo>` lowercased + dash-cased (e.g. `justrach-codedb`).
 *
-* Priority order:
+* Smallest-practical clone form (smallest disk + fastest initial fetch without
+* the treeless tax): git clone --depth=1 --single-branch --filter=blob:none
+* <url> <dest> `--depth=1` truncates history, `--single-branch` skips other
+* refs, and `--filter=blob:none` (a BLOBLESS partial clone) fetches file blobs
+* lazily on first access — so the initial download is tree-metadata only.
+* (Treeless `--filter=tree:0` is smaller still but refetches trees on every
+* walk, which is slow + breaks offline, so it is NOT the default.)
 *
-* 1. Test override via setPath('socket-wheelhouse-dir', ...)
-* 2. SOCKET_HOME/_wheelhouse - Base directory override (inherits from
-*    getSocketUserDir)
-* 3. Default: $HOME/.socket/_wheelhouse
+* Deliberately OUTSIDE `~/projects/` so the fleet's sibling-walk tooling (e.g.
+* cascade `--all`) never mistakes a reference clone for a fleet member
+* checkout. Disposable: a reference cache, not a working tree. Inherits the
+* `_wheelhouse` override chain (SOCKET_HOME /
+* setPath('socket-wheelhouse-dir')).
 */
+function getSocketRepoClonesDir() {
+	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketWheelhouseDir(), "repo-clones"));
+}
 /**
-* Get the Socket user directory (~/.socket). Can be overridden with SOCKET_HOME
-* environment variable or via setPath() for testing. Result is cached via
-* getPathValue for performance.
-*
-* Priority order:
-*
-* 1. Test override via setPath('socket-user-dir', ...)
-* 2. SOCKET_HOME - Base directory override
-* 3. Default: $HOME/.socket
-* 4. Fallback: /tmp/.socket (Unix) or %TEMP%.socket (Windows)
+* Get the Socket state directory (~/.socket/_state) — version-LESS persistent
+* app state (the home for daemon sockets, locks, OAuth refresh, durable caches
+* that survive version bumps; mirrors pnpm `state-dir` / XDG_STATE_HOME).
+* Override precedence: setPath('socket-state-dir', …) → SOCKET_STATE_DIR env →
+* $SOCKET_HOME/_state → $HOME/.socket/_state.
+*/
+function getSocketStateDir() {
+	return require_paths_rewire.getPathValue("socket-state-dir", () => {
+		if (require_env_socket.getSocketStateDirEnv()) return require_paths_normalize.normalizePath(require_env_socket.getSocketStateDirEnv());
+		return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketUserDir(), require_constants_socket.SOCKET_DIR.state));
+	});
+}
+/**
+* Get the Socket user directory (~/.socket). Override precedence:
+* setPath('socket-user-dir', …) → SOCKET_HOME env → $HOME/.socket →
+* /tmp/.socket (Unix) or %TEMP%.socket (Windows).
 */
 function getSocketUserDir() {
 	return require_paths_rewire.getPathValue("socket-user-dir", () => {
@@ -203,52 +245,46 @@ function getSocketUserDir() {
 	});
 }
 /**
-* Get the user's home directory. Uses environment variables directly to support
-* test mocking. Falls back to temporary directory if home is not available.
-*
-* Priority order: 1. HOME environment variable (Unix) 2. USERPROFILE
-* environment variable (Windows) 3. getNodeOs().homedir() 4. Fallback:
-* getNodeOs().tmpdir() (rarely used, for restricted environments)
+* Get the Wheelhouse bin directory (~/.socket/_wheelhouse/bin) — the single
+* directory placed on PATH. Holds only flat handles (thin exec shims or
+* symlinks), one per tool, each pointing at a real binary racked under
+* `<wheelhouse>/rack/<tool>/<version>/…` (getSocketRackToolDir). The shim IS
+* the bin, the npm `prefix/bin` / Homebrew `bin/` model: PATH lookup does not
+* recurse, so this dir stays flat (never a `bin/<tool>/` subdir). Inherits the
+* `_wheelhouse` override chain (SOCKET_HOME /
+* setPath('socket-wheelhouse-dir')).
 */
+function getSocketWheelhouseBinDir() {
+	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketWheelhouseDir(), "bin"));
+}
 /**
 * Get the Socket Wheelhouse directory (~/.socket/_wheelhouse). Shared
 * cross-fleet location for binaries that every fleet member can reach without
 * each one re-downloading and re-extracting per-repo. Tool installers (janus,
-* sfw, etc.) drop their resolved executables under
-* `<wheelhouse>/<tool>/<version>/<platform-arch>/`; consumers add the
-* appropriate `bin/` to PATH or invoke the binary by absolute path.
-*
-* Priority order:
-*
-* 1. Test override via setPath('socket-wheelhouse-dir', ...)
-* 2. SOCKET_HOME/_wheelhouse - Base directory override (inherits from
-*    getSocketUserDir)
-* 3. Default: $HOME/.socket/_wheelhouse
+* sfw, etc.) rack their resolved executables under
+* `<wheelhouse>/rack/<tool>/<version>/…` (getSocketRackToolDir) and expose a
+* handle in `<wheelhouse>/bin` (getSocketWheelhouseBinDir); consumers add that
+* one `bin/` to PATH. Override precedence: setPath('socket-wheelhouse-dir', …)
+* → $SOCKET_HOME/_wheelhouse → $HOME/.socket/_wheelhouse.
 */
 function getSocketWheelhouseDir() {
 	return require_paths_rewire.getPathValue("socket-wheelhouse-dir", () => {
-		return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketUserDir(), `${"_"}${require_constants_socket.SOCKET_WHEELHOUSE_APP_NAME}`));
+		return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketUserDir(), require_constants_socket.SOCKET_DIR.wheelhouse));
 	});
 }
 /**
-* Get the Socket user directory (~/.socket). Can be overridden with SOCKET_HOME
-* environment variable or via setPath() for testing. Result is cached via
-* getPathValue for performance.
-*
-* Priority order:
+* Get the user's home directory. Uses environment variables directly to support
+* test mocking. Falls back to temporary directory if home is not available.
 *
-* 1. Test override via setPath('socket-user-dir', ...)
-* 2. SOCKET_HOME - Base directory override
-* 3. Default: $HOME/.socket
-* 4. Fallback: /tmp/.socket (Unix) or %TEMP%.socket (Windows)
+* Priority order: 1. HOME (Unix) 2. USERPROFILE (Windows) 3.
+* getNodeOs().homedir() 4. Fallback: getNodeOs().tmpdir() (restricted envs).
 */
 /**
 * Get the user's home directory. Uses environment variables directly to support
 * test mocking. Falls back to temporary directory if home is not available.
 *
-* Priority order: 1. HOME environment variable (Unix) 2. USERPROFILE
-* environment variable (Windows) 3. getNodeOs().homedir() 4. Fallback:
-* getNodeOs().tmpdir() (rarely used, for restricted environments)
+* Priority order: 1. HOME (Unix) 2. USERPROFILE (Windows) 3.
+* getNodeOs().homedir() 4. Fallback: getNodeOs().tmpdir() (restricted envs).
 */
 function getUserHomeDir() {
 	const home = require_env_home.getHome();
@@ -267,15 +303,20 @@ function getUserHomeDir() {
 //#endregion
 exports.getOsHomeDir = getOsHomeDir;
 exports.getOsTmpDir = getOsTmpDir;
+exports.getRuntimeSocketPath = getRuntimeSocketPath;
 exports.getSocketAppCacheDir = getSocketAppCacheDir;
 exports.getSocketAppCacheTtlDir = getSocketAppCacheTtlDir;
 exports.getSocketAppDir = getSocketAppDir;
+exports.getSocketAppRuntimeDir = getSocketAppRuntimeDir;
+exports.getSocketAppStateDir = getSocketAppStateDir;
 exports.getSocketCacacheDir = getSocketCacacheDir;
-exports.getSocketCliDir = getSocketCliDir;
 exports.getSocketDlxDir = getSocketDlxDir;
 exports.getSocketHomePath = getSocketHomePath;
-exports.getSocketRegistryDir = getSocketRegistryDir;
-exports.getSocketRegistryGithubCacheDir = getSocketRegistryGithubCacheDir;
+exports.getSocketRackDir = getSocketRackDir;
+exports.getSocketRackToolDir = getSocketRackToolDir;
+exports.getSocketRepoClonesDir = getSocketRepoClonesDir;
+exports.getSocketStateDir = getSocketStateDir;
 exports.getSocketUserDir = getSocketUserDir;
+exports.getSocketWheelhouseBinDir = getSocketWheelhouseBinDir;
 exports.getSocketWheelhouseDir = getSocketWheelhouseDir;
 exports.getUserHomeDir = getUserHomeDir;

package/dist/perf/metrics.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_primordials_math = require('../primordials/math.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_primordials_math = require('../primordials/math.js');
 const require_debug_output = require('../debug/output.js');
 const require_perf__internal = require('./_internal.js');
 

package/dist/perf/report.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_primordials_math = require('../primordials/math.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_primordials_math = require('../primordials/math.js');
 const require_debug_output = require('../debug/output.js');
 const require_perf__internal = require('./_internal.js');
 const require_perf_enabled = require('./enabled.js');

package/dist/primordials/process.d.ts

@@ -0,0 +1,88 @@
+/**
+ * @file Safe call-through accessors for the `process` global's methods and
+ *   value reads. The `process` object reference is captured once at module load
+ *   (immune to a later `globalThis.process = …` reassignment), but each method
+ *   is CALLED at access time off that captured object — so `vi.spyOn(process,
+ *   'cwd')`, which mutates the same captured object, still intercepts. Binding
+ *   the method reference instead (`process.cwd.bind(process)`) would freeze it
+ *   and break that test seam, so we deliberately keep the late call. Consumers
+ *   read cwd / platform / env / argv through these instead of touching
+ *   `process` directly; enforced fleet-wide by
+ *   `socket/prefer-process-primordial`. This is the `process` leaf of the
+ *   node-module primordials: where `node/fs` / `node/path` lazy-load a `node:`
+ *   module behind a function, this captures the always-present `process` global
+ *   and routes its hot reads through one tamper-resistant surface.
+ */
+/**
+ * The CPU architecture token (`'x64'` / `'arm64'` / …).
+ */
+export declare function processArch(): string;
+/**
+ * The argv array (`[execPath, scriptPath, ...args]`).
+ *
+ * @example
+ *   ;```typescript
+ *   const entry = processArgv()[1]
+ *   ```
+ */
+export declare function processArgv(): string[];
+/**
+ * The current working directory. Call-through to the captured process's `cwd` —
+ * late-bound so test spies still intercept.
+ *
+ * @example
+ *   ;```typescript
+ *   const dir = processCwd()
+ *   ```
+ */
+export declare function processCwd(): string;
+/**
+ * Emit a process warning. Call-through so a test spy on `process.emitWarning`
+ * still intercepts.
+ */
+export declare function processEmitWarning(...args: Parameters<NodeJS.Process['emitWarning']>): void;
+/**
+ * The process environment object. Returns the live `process.env` off the
+ * captured process (call-through, so a test that swaps `process.env` is seen).
+ *
+ * @example
+ *   ;```typescript
+ *   const token = processEnv()['SOCKET_API_TOKEN']
+ *   ```
+ */
+export declare function processEnv(): NodeJS.ProcessEnv;
+/**
+ * The absolute path to the Node executable (`process.execPath`).
+ */
+export declare function processExecPath(): string;
+/**
+ * Schedule a callback on the next tick. Call-through (late-bound).
+ */
+export declare function processNextTick(...args: Parameters<NodeJS.Process['nextTick']>): void;
+/**
+ * The process id.
+ */
+export declare function processPid(): number;
+/**
+ * The OS platform token (`'darwin'` / `'linux'` / `'win32'` / …).
+ *
+ * @example
+ *   ;```typescript
+ *   if (processPlatform() === 'win32') { … }
+ *   ```
+ */
+export declare function processPlatform(): NodeJS.Platform;
+/**
+ * The standard error stream. Returned off the captured process so a test that
+ * spies on `process.stderr.write` still intercepts.
+ */
+export declare function processStderr(): NodeJS.WriteStream;
+/**
+ * The standard output stream. Returned off the captured process so a test that
+ * spies on `process.stdout.write` still intercepts.
+ */
+export declare function processStdout(): NodeJS.WriteStream;
+/**
+ * The Node version string (`process.version`, e.g. `'v26.2.0'`).
+ */
+export declare function processVersion(): string;