@socketsecurity/lib 6.0.8 → 6.0.10

package/dist/external-tools/bazel/from-download.d.ts

@@ -20,7 +20,7 @@ export interface BazelFromDownloadOptions {
      */
     version: string;
     /**
-     * Fleet platform-arch token, e.g. `'darwin-arm64'`.
+     * Socket platform-arch token, e.g. `'darwin-arm64'`.
      */
     platformArch: string;
     /**

package/dist/external-tools/bazel/resolve.d.ts

@@ -31,5 +31,8 @@ export interface ResolveBazelOptions {
 }
 export declare function cacheKey(options: ResolveBazelOptions | undefined): string;
 export declare function doResolveBazel(options?: ResolveBazelOptions | undefined): Promise<ResolvedBazel | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetBazelResolution(): void;
 export declare function resolveBazel(options?: ResolveBazelOptions | undefined): Promise<ResolvedBazel | undefined>;

package/dist/external-tools/bazel/resolve.js

@@ -42,6 +42,9 @@ async function doResolveBazel(options) {
 	if (options?.downloadIfMissing) return require_external_tools_bazel_from_download.bazelFromDownload(options.downloadIfMissing);
 }
 /* c8 ignore start - test-only escape hatch. */
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function resetBazelResolution() {
 	resolutionCache.clear();
 }

package/dist/external-tools/cdxgen/asset-names.d.ts

@@ -12,9 +12,9 @@
  *   https://github.com/CycloneDX/cdxgen/releases/download/v<X.Y.Z>/cdxgen-<os>-<arch>[-musl][-slim][.exe]
  *   Reference: https://github.com/CycloneDX/cdxgen/releases. Single source of
  *   truth: the SEA binary IS the install path. The legacy `@cyclonedx/cdxgen`
- *   npm package is not used as a fallback — every platform-arch the fleet
- *   supports has a SEA build, and routing through npm for unsupported targets
- *   would silently use a different distribution (different bundle composition,
+ *   npm package is not used as a fallback — every platform-arch Socket supports
+ *   has a SEA build, and routing through npm for unsupported targets would
+ *   silently use a different distribution (different bundle composition,
  *   different startup cost, different version-pin surface). One install path;
  *   one cached binary.
  */
@@ -36,8 +36,8 @@ export interface CdxgenDownloadOptions {
      */
     version: string;
     /**
-     * Fleet platform-arch token — looked up in the asset map. Returns `undefined`
-     * when no entry exists for the target.
+     * Socket platform-arch token — looked up in the asset map. Returns
+     * `undefined` when no entry exists for the target.
      */
     platformArch: string;
     /**

package/dist/external-tools/cdxgen/asset-names.js

@@ -18,9 +18,9 @@ const require_primordials_object = require('../../primordials/object.js');
 *   https://github.com/CycloneDX/cdxgen/releases/download/v<X.Y.Z>/cdxgen-<os>-<arch>[-musl][-slim][.exe]
 *   Reference: https://github.com/CycloneDX/cdxgen/releases. Single source of
 *   truth: the SEA binary IS the install path. The legacy `@cyclonedx/cdxgen`
-*   npm package is not used as a fallback — every platform-arch the fleet
-*   supports has a SEA build, and routing through npm for unsupported targets
-*   would silently use a different distribution (different bundle composition,
+*   npm package is not used as a fallback — every platform-arch Socket supports
+*   has a SEA build, and routing through npm for unsupported targets would
+*   silently use a different distribution (different bundle composition,
 *   different startup cost, different version-pin surface). One install path;
 *   one cached binary.
 */

package/dist/external-tools/cdxgen/from-download.d.ts

@@ -5,7 +5,7 @@
  *   wrapper) with sidecar `.sha256` files; this helper passes the pinned
  *   integrity through `downloadToolArchive`, then copies the downloaded blob to
  *   `cdxgen[.exe]` and chmods it 0o755. Platforms upstream doesn't ship a SEA
- *   for (none today; the asset map covers all 8 fleet targets) return
+ *   for (none today; the asset map covers all 8 Socket targets) return
  *   `undefined` — callers should fall back to `cdxgenFromNpm()` for those.
  */
 import type { BinaryDownloader } from '../from-download';
@@ -18,7 +18,7 @@ export interface CdxgenFromDownloadOptions {
      */
     version: string;
     /**
-     * Fleet platform-arch token, e.g. `'darwin-arm64'`.
+     * Socket platform-arch token, e.g. `'darwin-arm64'`.
      */
     platformArch: string;
     /**

package/dist/external-tools/cdxgen/from-download.js

@@ -20,7 +20,7 @@ node_path = require_runtime.__toESM(node_path);
 *   wrapper) with sidecar `.sha256` files; this helper passes the pinned
 *   integrity through `downloadToolArchive`, then copies the downloaded blob to
 *   `cdxgen[.exe]` and chmods it 0o755. Platforms upstream doesn't ship a SEA
-*   for (none today; the asset map covers all 8 fleet targets) return
+*   for (none today; the asset map covers all 8 Socket targets) return
 *   `undefined` — callers should fall back to `cdxgenFromNpm()` for those.
 */
 async function cdxgenFromDownload(options) {

package/dist/external-tools/cdxgen/resolve.d.ts

@@ -6,7 +6,7 @@
  *   2. PATH — `cdxgen` on the system PATH
  *   3. download — upstream SEA binary from the GitHub release (slim by default;
  *      pass `variant: 'full'` for the bun+deno-bundled flavor) Single source of
- *      truth: SEA binary only. No npm-package fallback — every fleet
+ *      truth: SEA binary only. No npm-package fallback — every Socket
  *      platform-arch is covered by the SEA matrix, and routing through npm
  *      would split the install surface in two for no benefit. Returns
  *      `undefined` if all of the enabled sources miss. Memoized per
@@ -28,5 +28,8 @@ export interface ResolveCdxgenOptions {
 }
 export declare function cacheKey(options: ResolveCdxgenOptions | undefined): string;
 export declare function doResolveCdxgen(options?: ResolveCdxgenOptions | undefined): Promise<ResolvedCdxgen | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetCdxgenResolution(): void;
 export declare function resolveCdxgen(options?: ResolveCdxgenOptions | undefined): Promise<ResolvedCdxgen | undefined>;

package/dist/external-tools/cdxgen/resolve.js

@@ -15,7 +15,7 @@ const require_external_tools_cdxgen_from_vfs = require('./from-vfs.js');
 *   2. PATH — `cdxgen` on the system PATH
 *   3. download — upstream SEA binary from the GitHub release (slim by default;
 *      pass `variant: 'full'` for the bun+deno-bundled flavor) Single source of
-*      truth: SEA binary only. No npm-package fallback — every fleet
+*      truth: SEA binary only. No npm-package fallback — every Socket
 *      platform-arch is covered by the SEA matrix, and routing through npm
 *      would split the install surface in two for no benefit. Returns
 *      `undefined` if all of the enabled sources miss. Memoized per
@@ -46,6 +46,9 @@ async function doResolveCdxgen(options) {
 	if (options?.downloadIfMissing) return require_external_tools_cdxgen_from_download.cdxgenFromDownload(options.downloadIfMissing);
 }
 /* c8 ignore start - test-only escape hatch. */
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function resetCdxgenResolution() {
 	resolutionCache.clear();
 }

package/dist/external-tools/cdxgen/types.d.ts

@@ -1,7 +1,7 @@
 /**
  * @file Shared types for cdxgen resolution. cdxgen ships per-platform SEA
  *   binaries starting in v12.0.x — that's the single install path. The legacy
- *   `@cyclonedx/cdxgen` npm package is NOT used as a fallback: every fleet
+ *   `@cyclonedx/cdxgen` npm package is NOT used as a fallback: every Socket
  *   platform-arch has a SEA build, and routing through npm for any target would
  *   silently use a different distribution (different bundle composition,
  *   different startup cost). One install path; one cached binary. The future

package/dist/external-tools/from-download.d.ts

@@ -20,7 +20,7 @@
  *     `external-tools.json` (or wherever the pin lives).
  *   - Subsequent calls with `integrity` set: downloads, verifies against the pin,
  *     returns the same value. Customization:
- *   - `downloader?` lets tests inject a fake fetch, and gives fleet consumers an
+ *   - `downloader?` lets tests inject a fake fetch, and gives Socket consumers an
  *     escape hatch for alternate cache backends, retry logic, or progress
  *     reporters.
  */
@@ -112,7 +112,7 @@ export interface DownloadedArchive {
  * Optional downloader injection. Default: `dlx/binary-download.downloadBinary`.
  * Replace when: - Writing unit tests that need a fake fetch (no network). -
  * Wiring an alternate cache backend or progress reporter. - Adding
- * fleet-specific instrumentation (metrics, retry).
+ * tool-specific instrumentation (metrics, retry).
  */
 export type BinaryDownloader = typeof downloadBinary;
 export interface DownloadOptions {

package/dist/external-tools/from-download.js

@@ -29,7 +29,7 @@ let node_fs = require("node:fs");
 *     `external-tools.json` (or wherever the pin lives).
 *   - Subsequent calls with `integrity` set: downloads, verifies against the pin,
 *     returns the same value. Customization:
-*   - `downloader?` lets tests inject a fake fetch, and gives fleet consumers an
+*   - `downloader?` lets tests inject a fake fetch, and gives Socket consumers an
 *     escape hatch for alternate cache backends, retry logic, or progress
 *     reporters.
 */

package/dist/external-tools/janus/asset-names.d.ts

@@ -21,6 +21,9 @@ export declare const JANUS_ASSET_MAP: Readonly<Record<string, JanusAssetEntry>>;
  * rather than letting the URL builder silently return undefined.
  */
 export declare const JANUS_SUPPORTED_PLATFORM_ARCHES: readonly string[];
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function getJanusAssetEntry(platformArch: string): JanusAssetEntry | undefined;
 export interface JanusDownloadOptions {
     /**
@@ -29,7 +32,7 @@ export interface JanusDownloadOptions {
      */
     version: string;
     /**
-     * Fleet platform-arch token — looked up in `JANUS_ASSET_MAP`. Returns
+     * Socket platform-arch token — looked up in `JANUS_ASSET_MAP`. Returns
      * `undefined` for any platform-arch janus doesn't ship a build for.
      */
     platformArch: string;

package/dist/external-tools/janus/asset-names.js

@@ -27,6 +27,9 @@ const JANUS_ASSET_MAP = require_primordials_object.ObjectFreeze({
 * rather than letting the URL builder silently return undefined.
 */
 const JANUS_SUPPORTED_PLATFORM_ARCHES = require_primordials_object.ObjectFreeze(require_primordials_object.ObjectKeys(JANUS_ASSET_MAP));
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function getJanusAssetEntry(platformArch) {
 	return JANUS_ASSET_MAP[platformArch];
 }

package/dist/external-tools/janus/from-download.d.ts

@@ -4,8 +4,8 @@
  *   archives containing a bare `janus` binary at the archive root (no nested
  *   directory). Defaults install under the shared wheelhouse dir
  *   (`~/.socket/_wheelhouse/janus/<version>/<platform-arch>/`) rather than the
- *   per-process dlx cache, so multiple fleet consumers reuse the same extracted
- *   binary.
+ *   per-process dlx cache, so multiple Socket consumers reuse the same
+ *   extracted binary.
  */
 import type { BinaryDownloader } from '../from-download';
 import type { HashSpec } from '../../integrity';
@@ -17,7 +17,7 @@ export interface JanusFromDownloadOptions {
     /**
      * Override the install directory. By default the binary lands in
      * `<getSocketWheelhouseDir()>/janus/<version>/<platformArch>/` — a shared
-     * cross-fleet location so multiple Socket tools resolve the same binary
+     * shared location so multiple Socket tools resolve the same binary
      * without per-process duplication.
      */
     cacheDir?: string | undefined;

package/dist/external-tools/janus/from-download.js

@@ -16,8 +16,8 @@ node_path = require_runtime.__toESM(node_path);
 *   archives containing a bare `janus` binary at the archive root (no nested
 *   directory). Defaults install under the shared wheelhouse dir
 *   (`~/.socket/_wheelhouse/janus/<version>/<platform-arch>/`) rather than the
-*   per-process dlx cache, so multiple fleet consumers reuse the same extracted
-*   binary.
+*   per-process dlx cache, so multiple Socket consumers reuse the same
+*   extracted binary.
 */
 async function janusFromDownload(options) {
 	const { cacheDir, downloader, integrity, platformArch, version } = {

package/dist/external-tools/janus/resolve.d.ts

@@ -24,5 +24,8 @@ export interface ResolveJanusOptions {
 }
 export declare function cacheKey(options: ResolveJanusOptions | undefined): string;
 export declare function doResolveJanus(options?: ResolveJanusOptions | undefined): Promise<ResolvedJanus | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetJanusResolution(): void;
 export declare function resolveJanus(options?: ResolveJanusOptions | undefined): Promise<ResolvedJanus | undefined>;

package/dist/external-tools/janus/resolve.js

@@ -43,6 +43,9 @@ async function doResolveJanus(options) {
 	if (options?.downloadIfMissing) return require_external_tools_janus_from_download.janusFromDownload(options.downloadIfMissing);
 }
 /* c8 ignore start - test-only escape hatch. */
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function resetJanusResolution() {
 	resolutionCache.clear();
 }

package/dist/external-tools/jre/asset-names.d.ts

@@ -34,7 +34,7 @@ export interface AdoptiumDownloadOptions {
      */
     version: number;
     /**
-     * Fleet platform-arch token — same vocabulary as `getPlatformArch` output.
+     * Socket platform-arch token — same vocabulary as `getPlatformArch` output.
      * Looked up in `ADOPTIUM_QUERY_MAP`; returns `undefined` when Adoptium
      * doesn't publish a build for that target (e.g. `win-arm64` for older
      * majors).
@@ -87,5 +87,7 @@ export declare function getAdoptiumDownloadUrl(options: AdoptiumDownloadOptions)
 /**
  * Returns the Adoptium query parameters for a given platform-arch, or
  * `undefined` if no Adoptium build exists for that target.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function getAdoptiumQuery(platformArch: string): AdoptiumAssetQuery | undefined;

package/dist/external-tools/jre/asset-names.js

@@ -107,6 +107,8 @@ function getAdoptiumDownloadUrl(options) {
 /**
 * Returns the Adoptium query parameters for a given platform-arch, or
 * `undefined` if no Adoptium build exists for that target.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function getAdoptiumQuery(platformArch) {
 	return ADOPTIUM_QUERY_MAP[platformArch];

package/dist/external-tools/jre/detect-platform-arch.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../../_virtual/_rolldown/runtime.js');
-const require_constants_platform = require('../../constants/platform.js');
 const require_primordials_object = require('../../primordials/object.js');
+const require_constants_platform = require('../../constants/platform.js');
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
 

package/dist/external-tools/jre/from-download.d.ts

@@ -26,7 +26,7 @@ export interface JreFromDownloadOptions {
      */
     version: number;
     /**
-     * Fleet platform-arch token, e.g. `'darwin-arm64'`.
+     * Socket platform-arch token, e.g. `'darwin-arm64'`.
      */
     platformArch: string;
     /**

package/dist/external-tools/manifest.d.ts

@@ -1,8 +1,8 @@
 /**
- * @file Reader for `external-tools.json` — the fleet manifest describing
+ * @file Reader for `external-tools.json` — the Socket manifest describing
  *   downloadable external binaries (sfw, zizmor, etc.) with pinned versions,
  *   per-platform asset names, and integrity hashes. The manifest itself is
- *   hand-maintained in each fleet repo's root (`<repo>/external-tools.json`)
+ *   hand-maintained in each Socket repo's root (`<repo>/external-tools.json`)
  *   and consumed by the setup-and-install GitHub action. This reader gives
  *   in-process consumers (external- tools resolvers, ad-hoc scripts) the same
  *   typed view without each one re-implementing the JSON-parse + shape check +
@@ -42,7 +42,7 @@ export interface ToolChecksum {
     integrity: string;
 }
 /**
- * A downloadable-binary tool entry. `platforms` is keyed by the fleet's
+ * A downloadable-binary tool entry. `platforms` is keyed by Socket's
  * platform-arch token (`darwin-arm64`, `linux-x64-musl`, `win-x64`, etc. — same
  * vocabulary as `getPlatformArch`).
  */
@@ -118,6 +118,8 @@ export declare function parseToolEntry(raw: unknown, toolName: string): Manifest
  * Throws on malformed JSON or invalid integrity strings; unknown-shape entries
  * (rust components, future variants) come back as `{kind: 'other', raw}` so
  * callers can handle them out-of-band without blocking the manifest read.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function readExternalToolsManifest(filepath: string): Promise<Manifest>;
 export declare function tryParseFlavored(raw: Record<string, unknown>, toolName: string): FlavoredToolEntry | undefined;

package/dist/external-tools/manifest.js

@@ -2,18 +2,18 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_error = require('../primordials/error.js');
-const require_integrity = require('../integrity.js');
 const require_primordials_object = require('../primordials/object.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_integrity = require('../integrity.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_fs_read_json = require('../fs/read-json.js');
 
 //#region src/external-tools/manifest.ts
 /**
-* @file Reader for `external-tools.json` — the fleet manifest describing
+* @file Reader for `external-tools.json` — the Socket manifest describing
 *   downloadable external binaries (sfw, zizmor, etc.) with pinned versions,
 *   per-platform asset names, and integrity hashes. The manifest itself is
-*   hand-maintained in each fleet repo's root (`<repo>/external-tools.json`)
+*   hand-maintained in each Socket repo's root (`<repo>/external-tools.json`)
 *   and consumed by the setup-and-install GitHub action. This reader gives
 *   in-process consumers (external- tools resolvers, ad-hoc scripts) the same
 *   typed view without each one re-implementing the JSON-parse + shape check +
@@ -103,6 +103,8 @@ function parseToolEntry(raw, toolName) {
 * Throws on malformed JSON or invalid integrity strings; unknown-shape entries
 * (rust components, future variants) come back as `{kind: 'other', raw}` so
 * callers can handle them out-of-band without blocking the manifest read.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 async function readExternalToolsManifest(filepath) {
 	const raw = await require_fs_read_json.readJson(filepath);

package/dist/external-tools/opengrep/asset-names.d.ts

@@ -31,7 +31,7 @@ export interface OpengrepDownloadOptions {
      */
     version: string;
     /**
-     * Fleet platform-arch token — looked up in `OPENGREP_ASSET_MAP`.
+     * Socket platform-arch token — looked up in `OPENGREP_ASSET_MAP`.
      */
     platformArch: string;
 }

package/dist/external-tools/opengrep/resolve.d.ts

@@ -22,5 +22,8 @@ export interface ResolveOpengrepOptions {
 }
 export declare function cacheKey(options: ResolveOpengrepOptions | undefined): string;
 export declare function doResolveOpengrep(options?: ResolveOpengrepOptions | undefined): Promise<ResolvedOpengrep | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetOpengrepResolution(): void;
 export declare function resolveOpengrep(options?: ResolveOpengrepOptions | undefined): Promise<ResolvedOpengrep | undefined>;

package/dist/external-tools/opengrep/resolve.js

@@ -41,6 +41,9 @@ async function doResolveOpengrep(options) {
 	if (options?.downloadIfMissing) return require_external_tools_opengrep_from_download.opengrepFromDownload(options.downloadIfMissing);
 }
 /* c8 ignore start - test-only escape hatch. */
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function resetOpengrepResolution() {
 	resolutionCache.clear();
 }

package/dist/external-tools/python/asset-names.d.ts

@@ -7,11 +7,13 @@
  *   extracted one directory deep (`python/bin/python3`).
  */
 /**
- * Python-build-standalone default pin — the fleet-canonical CPython build,
+ * Python-build-standalone default pin — the Socket-canonical CPython build,
  * matching socket-cli's `bundle-tools.json`. Consumers that don't pass their
  * own pin resolve against this. Bump it like any dependency (soak-aware), in
  * lockstep with socket-cli (drift-watch). The `checksums` map is keyed by asset
  * filename so the download tier verifies the exact tarball per platform.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare const DEFAULT_PYTHON_PIN: Readonly<{
     __proto__: null;

package/dist/external-tools/python/asset-names.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../../_virtual/_rolldown/runtime.js');
-const require_constants_platform = require('../../constants/platform.js');
 const require_primordials_object = require('../../primordials/object.js');
+const require_constants_platform = require('../../constants/platform.js');
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
 
@@ -40,11 +40,13 @@ const NODE_ARCH_TO_PY = require_primordials_object.ObjectFreeze({
 });
 const RELEASE_BASE = "https://github.com/astral-sh/python-build-standalone/releases/download";
 /**
-* Python-build-standalone default pin — the fleet-canonical CPython build,
+* Python-build-standalone default pin — the Socket-canonical CPython build,
 * matching socket-cli's `bundle-tools.json`. Consumers that don't pass their
 * own pin resolve against this. Bump it like any dependency (soak-aware), in
 * lockstep with socket-cli (drift-watch). The `checksums` map is keyed by asset
 * filename so the download tier verifies the exact tarball per platform.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 const DEFAULT_PYTHON_PIN = require_primordials_object.ObjectFreeze({
 	__proto__: null,
@@ -99,9 +101,11 @@ function pythonAsset(options) {
 	const arch = options.arch ?? getPythonArch();
 	const triple = arch ? PLATFORM_TRIPLES[arch] : void 0;
 	if (!triple) return;
+	const assetName = `cpython-${version}+${tag}-${triple}-install_only.tar.gz`;
+	const encodedVersion = `${version}%2B${tag}`;
 	return {
-		assetName: `cpython-${version}+${tag}-${triple}-install_only.tar.gz`,
-		url: `${RELEASE_BASE}/${tag}/cpython-${`${version}%2B${tag}`}-${triple}-install_only.tar.gz`
+		assetName,
+		url: `${RELEASE_BASE}/${tag}/cpython-${encodedVersion}-${triple}-install_only.tar.gz`
 	};
 }
 

package/dist/external-tools/python/pin.js

@@ -118,7 +118,9 @@ async function resolvePipPackagePin(options) {
 		const artifacts = [];
 		const targetName = normalizeDistName(specDistName(spec));
 		let top;
-		for (const file of files.toSorted()) {
+		const sortedFiles = files.toSorted();
+		for (let i = 0, { length } = sortedFiles; i < length; i += 1) {
+			const file = sortedFiles[i];
 			const hash = require_integrity.computeHashes(await node_fs.promises.readFile(node_path.default.join(scratch, file)));
 			const parsed = parseArtifactFilename(file);
 			if (!parsed) throw new PipPackagePinError(`resolvePipPackagePin: could not parse name/version from artifact ${file}`);

package/dist/external-tools/python/resolve.d.ts

@@ -38,5 +38,8 @@ export interface ResolvePythonOptions {
 }
 export declare function cacheKey(options: ResolvePythonOptions | undefined): string;
 export declare function doResolvePython(options?: ResolvePythonOptions | undefined): Promise<ResolvedPython | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetPythonResolution(): void;
 export declare function resolvePython(options?: ResolvePythonOptions | undefined): Promise<ResolvedPython | undefined>;

package/dist/external-tools/python/resolve.js

@@ -45,6 +45,9 @@ async function doResolvePython(options) {
 	if (dl) return require_external_tools_python_from_download.pythonFromDownload(dl);
 }
 /* c8 ignore start - test-only escape hatch. */
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function resetPythonResolution() {
 	resolutionCache.clear();
 }

package/dist/external-tools/python/uv-install.d.ts

@@ -0,0 +1,89 @@
+/**
+ * @file Uv project install helpers — the locked-source-of-truth half of the
+ *   "uv project + dlx materialize" model.
+ *   uv (Astral's Python package manager) drives a uv PROJECT — a directory with
+ *   `pyproject.toml` + `uv.lock` (+ optional `[tool.uv] exclude-newer`). The
+ *   lock manifests every transitive version, so the project is the most
+ *   locked-down, most-version-pinned form a Python tool install can take.
+ *   Two entry points, used together:
+ *
+ *   1. `uvSyncProject` — `uv sync --locked --project <dir>`. Installs the lock's
+ *      exact closure into the project's own `.venv` and FAILS if `uv.lock` is
+ *      out of date vs `pyproject.toml` (the `--locked` gate). This is the
+ *      verification-grade install: it proves the lock resolves.
+ *   2. `uvExportMaterialize` — `uv export --locked` → a flat, hash-pinned
+ *      requirements list, then `uv pip install --target <dir>` into a
+ *      content-addressed dlx dir (no venv → no symlinks / absolute `home=`, so
+ *      the result is relocatable + SEA-VFS-embeddable). Mirrors
+ *      `downloadPipPackage`'s lock-guarded, idempotent shape. Both take an
+ *      explicit `uvBin` (typically `resolveUv().path`) and never mutate a
+ *      shared interpreter — the project venv and the dlx target are
+ *      self-contained.
+ */
+/**
+ * Export a uv project's locked closure to a flat requirements list, then
+ * `uv pip install --target` it into a content-addressed dlx dir. The dlx dir
+ * holds plain files (no venv), so it is relocatable and embeddable in a smol
+ * binary's VFS — the bundle-safe analog of `uvSyncProject`'s `.venv`.
+ *
+ * Lock-guarded + idempotent (reuses `pip-install`'s `isAlreadyInstalled` /
+ * `isStaleLock`): a non-empty target dir short-circuits, and concurrent callers
+ * serialize on a `.installing` sentinel one level up from the target. Throws on
+ * a failed uv command or if the lock can't be acquired after MAX_RETRIES.
+ */
+export declare function uvExportMaterialize(options: UvExportMaterializeOptions, retryCount?: number): Promise<UvExportMaterializeResult>;
+/**
+ * Content-addressed dlx dir for a uv project's materialized closure:
+ * `~/.socket/_dlx/<cacheKey(projectDir)>/site-packages`. Keyed on the project
+ * dir so each project gets an isolated target; the analog of `pipPackageDir`.
+ */
+export declare function uvProjectTargetDir(projectDir: string): string;
+/**
+ * Run `uv sync --locked` against a uv project. Installs the lock's exact
+ * dependency closure into the project's `.venv`; the `--locked` flag turns a
+ * lock-vs-manifest drift into a hard failure (uv exits non-zero) rather than a
+ * silent re-resolution — this is what makes it verification-grade. Throws when
+ * uv exits non-zero (drift, missing lock, or a resolution failure).
+ */
+export declare function uvSyncProject(options: UvSyncProjectOptions): Promise<void>;
+export interface UvSyncProjectOptions {
+    /**
+     * Absolute path to the `uv` executable (typically `resolveUv().path`).
+     */
+    readonly uvBin: string;
+    /**
+     * Absolute path to the uv project dir (holds `pyproject.toml` + `uv.lock`).
+     */
+    readonly projectDir: string;
+    /**
+     * Default true — pass `--locked` so a lock-vs-manifest drift fails hard.
+     * Set false ONLY to bootstrap/refresh a lock (never in a verify path).
+     */
+    readonly locked?: boolean | undefined;
+}
+export interface UvExportMaterializeOptions {
+    /**
+     * Absolute path to the `uv` executable.
+     */
+    readonly uvBin: string;
+    /**
+     * Absolute path to the uv project dir to export from.
+     */
+    readonly projectDir: string;
+    /**
+     * Override the content-addressed target dir. Defaults to
+     * `uvProjectTargetDir(projectDir)`.
+     */
+    readonly targetDir?: string | undefined;
+}
+export interface UvExportMaterializeResult {
+    /**
+     * `true` when this call ran uv; `false` when an existing install was reused.
+     */
+    readonly installed: boolean;
+    /**
+     * Directory the closure was installed into. Put this on `PYTHONPATH` to run
+     * the tool: `python -m <module>`.
+     */
+    readonly targetDir: string;
+}