@socketsecurity/lib 6.0.8 → 6.0.10

package/dist/external-tools/python/uv-install.js

@@ -0,0 +1,165 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_constants_platform = require('../../constants/platform.js');
+const require_process_spawn_child = require('../../process/spawn/child.js');
+const require_paths_socket = require('../../paths/socket.js');
+const require_fs_safe = require('../../fs/safe.js');
+const require_dlx_cache = require('../../dlx/cache.js');
+const require_external_tools_python_pip_install = require('./pip-install.js');
+let node_fs = require("node:fs");
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+
+//#region src/external-tools/python/uv-install.ts
+/**
+* @file Uv project install helpers — the locked-source-of-truth half of the
+*   "uv project + dlx materialize" model.
+*   uv (Astral's Python package manager) drives a uv PROJECT — a directory with
+*   `pyproject.toml` + `uv.lock` (+ optional `[tool.uv] exclude-newer`). The
+*   lock manifests every transitive version, so the project is the most
+*   locked-down, most-version-pinned form a Python tool install can take.
+*   Two entry points, used together:
+*
+*   1. `uvSyncProject` — `uv sync --locked --project <dir>`. Installs the lock's
+*      exact closure into the project's own `.venv` and FAILS if `uv.lock` is
+*      out of date vs `pyproject.toml` (the `--locked` gate). This is the
+*      verification-grade install: it proves the lock resolves.
+*   2. `uvExportMaterialize` — `uv export --locked` → a flat, hash-pinned
+*      requirements list, then `uv pip install --target <dir>` into a
+*      content-addressed dlx dir (no venv → no symlinks / absolute `home=`, so
+*      the result is relocatable + SEA-VFS-embeddable). Mirrors
+*      `downloadPipPackage`'s lock-guarded, idempotent shape. Both take an
+*      explicit `uvBin` (typically `resolveUv().path`) and never mutate a
+*      shared interpreter — the project venv and the dlx target are
+*      self-contained.
+*/
+const MAX_RETRIES = 3;
+const WAIT_TICKS = 30;
+/**
+* Export a uv project's locked closure to a flat requirements list, then
+* `uv pip install --target` it into a content-addressed dlx dir. The dlx dir
+* holds plain files (no venv), so it is relocatable and embeddable in a smol
+* binary's VFS — the bundle-safe analog of `uvSyncProject`'s `.venv`.
+*
+* Lock-guarded + idempotent (reuses `pip-install`'s `isAlreadyInstalled` /
+* `isStaleLock`): a non-empty target dir short-circuits, and concurrent callers
+* serialize on a `.installing` sentinel one level up from the target. Throws on
+* a failed uv command or if the lock can't be acquired after MAX_RETRIES.
+*/
+async function uvExportMaterialize(options, retryCount = 0) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const { projectDir, uvBin } = opts;
+	const targetDir = opts.targetDir ?? uvProjectTargetDir(projectDir);
+	if (retryCount >= MAX_RETRIES) throw new Error(`uvExportMaterialize: could not acquire install lock after ${MAX_RETRIES} retries for ${targetDir}; a peer may be stuck or the lock is stale — remove it and retry`);
+	if (await require_external_tools_python_pip_install.isAlreadyInstalled(targetDir)) return {
+		installed: false,
+		targetDir
+	};
+	const lockDir = node_path.default.dirname(targetDir);
+	await require_fs_safe.safeMkdir(lockDir, { recursive: true });
+	const lockFile = node_path.default.join(lockDir, ".installing");
+	try {
+		await node_fs.promises.writeFile(lockFile, node_process.default.pid.toString(), { flag: "wx" });
+	} catch (e) {
+		if (e.code !== "EEXIST") throw e;
+		let stale = false;
+		try {
+			stale = require_external_tools_python_pip_install.isStaleLock(Number.parseInt((await node_fs.promises.readFile(lockFile, "utf8")).trim(), 10));
+		} catch {
+			stale = true;
+		}
+		if (stale) {
+			await require_fs_safe.safeDelete(lockFile, { force: true });
+			return uvExportMaterialize(options, retryCount + 1);
+		}
+		for (let i = 0; i < WAIT_TICKS; i += 1) {
+			await new Promise((resolve) => {
+				setTimeout(resolve, 1e3);
+			});
+			if (await require_external_tools_python_pip_install.isAlreadyInstalled(targetDir)) return {
+				installed: false,
+				targetDir
+			};
+		}
+		return uvExportMaterialize(options, retryCount + 1);
+	}
+	try {
+		await require_fs_safe.safeMkdir(targetDir, { recursive: true });
+		const requirementsPath = node_path.default.join(lockDir, "requirements.locked.txt");
+		await require_process_spawn_child.spawn(uvBin, [
+			"export",
+			"--locked",
+			"--no-emit-project",
+			"--no-dev",
+			"--project",
+			projectDir,
+			"--output-file",
+			requirementsPath
+		], {
+			shell: require_constants_platform.WIN32,
+			stdio: "inherit"
+		});
+		await require_process_spawn_child.spawn(uvBin, [
+			"pip",
+			"install",
+			"--target",
+			targetDir,
+			"--requirement",
+			requirementsPath
+		], {
+			shell: require_constants_platform.WIN32,
+			stdio: "inherit"
+		});
+		await require_fs_safe.safeDelete(requirementsPath, { force: true });
+		if (!await require_external_tools_python_pip_install.isAlreadyInstalled(targetDir)) throw new Error(`uvExportMaterialize: uv pip install --target ${targetDir} reported success but the target is still empty`);
+		return {
+			installed: true,
+			targetDir
+		};
+	} finally {
+		await require_fs_safe.safeDelete(lockFile, { force: true });
+	}
+}
+/**
+* Content-addressed dlx dir for a uv project's materialized closure:
+* `~/.socket/_dlx/<cacheKey(projectDir)>/site-packages`. Keyed on the project
+* dir so each project gets an isolated target; the analog of `pipPackageDir`.
+*/
+function uvProjectTargetDir(projectDir) {
+	return node_path.default.join(require_paths_socket.getSocketDlxDir(), require_dlx_cache.generateCacheKey(projectDir), "site-packages");
+}
+/**
+* Run `uv sync --locked` against a uv project. Installs the lock's exact
+* dependency closure into the project's `.venv`; the `--locked` flag turns a
+* lock-vs-manifest drift into a hard failure (uv exits non-zero) rather than a
+* silent re-resolution — this is what makes it verification-grade. Throws when
+* uv exits non-zero (drift, missing lock, or a resolution failure).
+*/
+async function uvSyncProject(options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const { projectDir, uvBin } = opts;
+	await require_process_spawn_child.spawn(uvBin, [
+		"sync",
+		...opts.locked === false ? [] : ["--locked"],
+		"--project",
+		projectDir
+	], {
+		shell: require_constants_platform.WIN32,
+		stdio: "inherit"
+	});
+}
+
+//#endregion
+exports.uvExportMaterialize = uvExportMaterialize;
+exports.uvProjectTargetDir = uvProjectTargetDir;
+exports.uvSyncProject = uvSyncProject;

package/dist/external-tools/sbt/resolve.d.ts

@@ -27,5 +27,8 @@ export interface ResolveSbtOptions {
 }
 export declare function cacheKey(options: ResolveSbtOptions | undefined): string;
 export declare function doResolveSbt(options?: ResolveSbtOptions | undefined): Promise<ResolvedSbt | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetSbtResolution(): void;
 export declare function resolveSbt(options?: ResolveSbtOptions | undefined): Promise<ResolvedSbt | undefined>;

package/dist/external-tools/sbt/resolve.js

@@ -42,6 +42,9 @@ async function doResolveSbt(options) {
 	if (fromPath) return fromPath;
 	if (options?.downloadIfMissing) return require_external_tools_sbt_from_download.sbtFromDownload(options.downloadIfMissing);
 }
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 /* c8 ignore start - test-only escape hatch. */
 function resetSbtResolution() {
 	resolutionCache.clear();

package/dist/external-tools/skillspector/from-uv.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @file `skillspectorFromUv()` — locked-uv-project tier of SkillSpector
+ *   resolution. Given a uv project dir (a `pyproject.toml` + `uv.lock` that pin
+ *   the upstream git SHA + its full transitive closure) and a resolved `uv`
+ *   binary, runs `uv sync --locked` to install that exact closure into the
+ *   project's `.venv` and returns the `skillspector` entry point. This is the
+ *   most locked-down tier — every dependency version is manifested in uv.lock,
+ *   and `--locked` hard-fails on lock drift (vs. `from-dlx`'s pip-from-git-SHA
+ *   venv, which re-resolves the closure freshly). Returns `undefined` when:
+ *
+ *   - No project dir / uv binary is supplied (the caller didn't opt in).
+ *   - The project files are absent, or `uv sync --locked` fails (lock drift, no
+ *     network, missing Python). Idempotent: a second call hits the synced venv
+ *     (`uv sync` is a no-op when the venv already matches the lock).
+ */
+import type { ResolvedSkillSpector } from './types';
+export interface SkillSpectorFromUvOptions {
+    /**
+     * Absolute path to the `uv` executable (typically `resolveUv().path`).
+     */
+    readonly uvBin: string;
+    /**
+     * Absolute path to the SkillSpector uv project dir (holds `pyproject.toml` +
+     * `uv.lock`). Socket ships this under
+     * `setup-security-tools/skillspector/`.
+     */
+    readonly projectDir: string;
+}
+export declare function skillspectorFromUv(options: SkillSpectorFromUvOptions): Promise<ResolvedSkillSpector | undefined>;
+export declare function venvEntryPoint(projectDir: string): string;

package/dist/external-tools/skillspector/from-uv.js

@@ -0,0 +1,56 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_external_tools_python_uv_install = require('../python/uv-install.js');
+let node_fs = require("node:fs");
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+
+//#region src/external-tools/skillspector/from-uv.ts
+/**
+* @file `skillspectorFromUv()` — locked-uv-project tier of SkillSpector
+*   resolution. Given a uv project dir (a `pyproject.toml` + `uv.lock` that pin
+*   the upstream git SHA + its full transitive closure) and a resolved `uv`
+*   binary, runs `uv sync --locked` to install that exact closure into the
+*   project's `.venv` and returns the `skillspector` entry point. This is the
+*   most locked-down tier — every dependency version is manifested in uv.lock,
+*   and `--locked` hard-fails on lock drift (vs. `from-dlx`'s pip-from-git-SHA
+*   venv, which re-resolves the closure freshly). Returns `undefined` when:
+*
+*   - No project dir / uv binary is supplied (the caller didn't opt in).
+*   - The project files are absent, or `uv sync --locked` fails (lock drift, no
+*     network, missing Python). Idempotent: a second call hits the synced venv
+*     (`uv sync` is a no-op when the venv already matches the lock).
+*/
+async function skillspectorFromUv(options) {
+	const { projectDir, uvBin } = {
+		__proto__: null,
+		...options
+	};
+	if (!projectDir || !uvBin) return;
+	if (!(0, node_fs.existsSync)(node_path.default.join(projectDir, "pyproject.toml")) || !(0, node_fs.existsSync)(node_path.default.join(projectDir, "uv.lock"))) return;
+	try {
+		await require_external_tools_python_uv_install.uvSyncProject({
+			projectDir,
+			uvBin
+		});
+	} catch {
+		return;
+	}
+	const entry = venvEntryPoint(projectDir);
+	if (!(0, node_fs.existsSync)(entry)) return;
+	return {
+		path: entry,
+		source: "uv"
+	};
+}
+function venvEntryPoint(projectDir) {
+	return node_process.default.platform === "win32" ? node_path.default.join(projectDir, ".venv", "Scripts", "skillspector.exe") : node_path.default.join(projectDir, ".venv", "bin", "skillspector");
+}
+
+//#endregion
+exports.skillspectorFromUv = skillspectorFromUv;
+exports.venvEntryPoint = venvEntryPoint;

package/dist/external-tools/skillspector/resolve.d.ts

@@ -5,9 +5,13 @@
  *   1. VFS — smol binary's embedded skillspector (if packed)
  *   2. PATH — `which skillspector` (pipx-installed binaries land here too; the
  *      source field distinguishes `'pipx'` vs `'path'`)
- *   3. DLX-venv — `~/.socket/_dlx/skillspector/<sha>/` with the pinned SHA Returns
+ *   3. UV-project — `uv sync --locked` against a uv project (the most locked-down
+ *      tier; every transitive version pinned in uv.lock). Only runs when
+ *      `uvProjectDir` + `uvBin` are supplied.
+ *   4. DLX-venv — `~/.socket/_dlx/skillspector/<sha>/` with the pinned SHA (the
+ *      pip-from-git-SHA fallback when no uv project is available). Returns
  *      `undefined` when all enabled sources miss. Memoized per
- *      sha+cacheDir+localOnly tuple.
+ *      sha+cacheDir+uvProjectDir+localOnly tuple.
  */
 import type { ResolvedSkillSpector } from './types';
 export interface ResolveSkillSpectorOptions {
@@ -17,9 +21,20 @@ export interface ResolveSkillSpectorOptions {
      */
     readonly sha?: string | undefined;
     /**
-     * Tier-3 cache override. Defaults to `~/.socket/_dlx/skillspector/<sha>`.
+     * DLX cache override. Defaults to `~/.socket/_dlx/skillspector/<sha>`.
      */
     readonly cacheDir?: string | undefined;
+    /**
+     * UV-project tier: absolute path to a uv project dir (a `pyproject.toml` +
+     * `uv.lock` pinning the SHA + its closure). When set together with `uvBin`,
+     * the locked-uv tier runs ahead of the DLX-venv tier.
+     */
+    readonly uvProjectDir?: string | undefined;
+    /**
+     * UV-project tier: absolute path to the `uv` executable
+     * (typically `resolveUv().path`). Required to run the locked-uv tier.
+     */
+    readonly uvBin?: string | undefined;
     /**
      * When true, only the VFS + PATH tiers run. Use for check-mode invocations
      * that want to fail-fast if the tool isn't already installed.

package/dist/external-tools/skillspector/resolve.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_map_set = require('../../primordials/map-set.js');
 const require_external_tools_skillspector_from_dlx = require('./from-dlx.js');
 const require_external_tools_skillspector_from_path = require('./from-path.js');
+const require_external_tools_skillspector_from_uv = require('./from-uv.js');
 const require_external_tools_skillspector_from_vfs = require('./from-vfs.js');
 
 //#region src/external-tools/skillspector/resolve.ts
@@ -14,20 +15,24 @@ const require_external_tools_skillspector_from_vfs = require('./from-vfs.js');
 *   1. VFS — smol binary's embedded skillspector (if packed)
 *   2. PATH — `which skillspector` (pipx-installed binaries land here too; the
 *      source field distinguishes `'pipx'` vs `'path'`)
-*   3. DLX-venv — `~/.socket/_dlx/skillspector/<sha>/` with the pinned SHA Returns
+*   3. UV-project — `uv sync --locked` against a uv project (the most locked-down
+*      tier; every transitive version pinned in uv.lock). Only runs when
+*      `uvProjectDir` + `uvBin` are supplied.
+*   4. DLX-venv — `~/.socket/_dlx/skillspector/<sha>/` with the pinned SHA (the
+*      pip-from-git-SHA fallback when no uv project is available). Returns
 *      `undefined` when all enabled sources miss. Memoized per
-*      sha+cacheDir+localOnly tuple.
+*      sha+cacheDir+uvProjectDir+localOnly tuple.
 */
 const resolutionCache = new require_primordials_map_set.MapCtor();
 function cacheKey(options) {
-	options = {
+	const opts = {
 		__proto__: null,
 		...options
 	};
-	return `${options.sha ?? ""}|${options.cacheDir ?? ""}|${options.localOnly ? "local" : "full"}`;
+	return `${opts.sha ?? ""}|${opts.cacheDir ?? ""}|${opts.uvProjectDir ?? ""}|${opts.localOnly ? "local" : "full"}`;
 }
 async function doResolveSkillSpector(options) {
-	options = {
+	const opts = {
 		__proto__: null,
 		...options
 	};
@@ -37,10 +42,18 @@ async function doResolveSkillSpector(options) {
 	/* c8 ignore stop */
 	const fromPath = await require_external_tools_skillspector_from_path.skillspectorFromPath();
 	if (fromPath) return fromPath;
-	if (options.localOnly || !options.sha) return;
+	if (opts.localOnly) return;
+	if (opts.uvProjectDir && opts.uvBin) {
+		const fromUv = await require_external_tools_skillspector_from_uv.skillspectorFromUv({
+			projectDir: opts.uvProjectDir,
+			uvBin: opts.uvBin
+		});
+		if (fromUv) return fromUv;
+	}
+	if (!opts.sha) return;
 	return require_external_tools_skillspector_from_dlx.skillspectorFromDlx({
-		sha: options.sha,
-		cacheDir: options.cacheDir
+		sha: opts.sha,
+		cacheDir: opts.cacheDir
 	});
 }
 /**

package/dist/external-tools/skillspector/types.d.ts

@@ -3,7 +3,7 @@
  *   third-party-skill scanner (sibling to AgentShield); pinned to a git SHA
  *   because upstream has no PyPI release or GH tags as of 2026-06-01.
  */
-export type SkillSpectorSource = 'vfs' | 'pipx' | 'path' | 'dlx';
+export type SkillSpectorSource = 'vfs' | 'pipx' | 'path' | 'uv' | 'dlx';
 /**
  * A resolved SkillSpector installation.
  */
@@ -18,6 +18,8 @@ export interface ResolvedSkillSpector {
      * - 'vfs' — extracted from the SEA binary's VFS
      * - 'pipx' — `which skillspector` returned a pipx-installed venv binary
      * - 'path' — `which skillspector` returned a non-pipx binary on PATH
+     * - 'uv' — `uv sync --locked` against a uv project's .venv (the most
+     *   locked-down tier; every transitive version pinned in uv.lock)
      * - 'dlx' — created a venv under ~/.socket/_dlx/skillspector/<sha>/
      */
     readonly source: SkillSpectorSource;

package/dist/external-tools/synp/resolve.d.ts

@@ -17,5 +17,8 @@ export interface ResolveSynpOptions {
 }
 export declare function cacheKey(options: ResolveSynpOptions | undefined): string;
 export declare function doResolveSynp(options?: ResolveSynpOptions | undefined): Promise<ResolvedSynp | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetSynpResolution(): void;
 export declare function resolveSynp(options?: ResolveSynpOptions | undefined): Promise<ResolvedSynp | undefined>;

package/dist/external-tools/synp/resolve.js

@@ -40,6 +40,9 @@ async function doResolveSynp(options) {
 	if (fromPath) return fromPath;
 	if (options?.downloadIfMissing) return require_external_tools_synp_from_download.synpFromDownload(options.downloadIfMissing);
 }
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 /* c8 ignore start - test-only escape hatch. */
 function resetSynpResolution() {
 	resolutionCache.clear();

package/dist/external-tools/trivy/asset-names.d.ts

@@ -21,7 +21,7 @@ export interface TrivyDownloadOptions {
      */
     version: string;
     /**
-     * Fleet platform-arch token — looked up in `TRIVY_ASSET_MAP`.
+     * Socket platform-arch token — looked up in `TRIVY_ASSET_MAP`.
      */
     platformArch: string;
 }

package/dist/external-tools/trivy/resolve.d.ts

@@ -22,5 +22,8 @@ export interface ResolveTrivyOptions {
 }
 export declare function cacheKey(options: ResolveTrivyOptions | undefined): string;
 export declare function doResolveTrivy(options?: ResolveTrivyOptions | undefined): Promise<ResolvedTrivy | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetTrivyResolution(): void;
 export declare function resolveTrivy(options?: ResolveTrivyOptions | undefined): Promise<ResolvedTrivy | undefined>;

package/dist/external-tools/trivy/resolve.js

@@ -40,6 +40,9 @@ async function doResolveTrivy(options) {
 	if (fromPath) return fromPath;
 	if (options?.downloadIfMissing) return require_external_tools_trivy_from_download.trivyFromDownload(options.downloadIfMissing);
 }
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 /* c8 ignore start - test-only escape hatch. */
 function resetTrivyResolution() {
 	resolutionCache.clear();

package/dist/external-tools/trufflehog/asset-names.d.ts

@@ -11,6 +11,9 @@ export interface TrufflehogAssetEntry {
     readonly suffix: string;
 }
 export declare const TRUFFLEHOG_ASSET_MAP: Readonly<Record<string, TrufflehogAssetEntry>>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function getTrufflehogAssetEntry(platformArch: string): TrufflehogAssetEntry | undefined;
 export interface TrufflehogDownloadOptions {
     /**
@@ -19,7 +22,7 @@ export interface TrufflehogDownloadOptions {
      */
     version: string;
     /**
-     * Fleet platform-arch token — looked up in `TRUFFLEHOG_ASSET_MAP`. Returns
+     * Socket platform-arch token — looked up in `TRUFFLEHOG_ASSET_MAP`. Returns
      * `undefined` when no entry exists for the target.
      */
     platformArch: string;

package/dist/external-tools/trufflehog/asset-names.js

@@ -37,6 +37,9 @@ const TRUFFLEHOG_ASSET_MAP = require_primordials_object.ObjectFreeze({
 		suffix: "windows_amd64.tar.gz"
 	})
 });
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function getTrufflehogAssetEntry(platformArch) {
 	return TRUFFLEHOG_ASSET_MAP[platformArch];
 }

package/dist/external-tools/trufflehog/from-download.d.ts

@@ -16,7 +16,7 @@ export interface TrufflehogFromDownloadOptions {
      */
     version: string;
     /**
-     * Fleet platform-arch token, e.g. `'darwin-arm64'`.
+     * Socket platform-arch token, e.g. `'darwin-arm64'`.
      */
     platformArch: string;
     /**

package/dist/external-tools/trufflehog/resolve.d.ts

@@ -26,5 +26,8 @@ export interface ResolveTrufflehogOptions {
 }
 export declare function cacheKey(options: ResolveTrufflehogOptions | undefined): string;
 export declare function doResolveTrufflehog(options?: ResolveTrufflehogOptions | undefined): Promise<ResolvedTrufflehog | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function resetTrufflehogResolution(): void;
 export declare function resolveTrufflehog(options?: ResolveTrufflehogOptions | undefined): Promise<ResolvedTrufflehog | undefined>;

package/dist/external-tools/trufflehog/resolve.js

@@ -40,6 +40,9 @@ async function doResolveTrufflehog(options) {
 	if (fromPath) return fromPath;
 	if (options?.downloadIfMissing) return require_external_tools_trufflehog_from_download.trufflehogFromDownload(options.downloadIfMissing);
 }
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 /* c8 ignore start - test-only escape hatch. */
 function resetTrufflehogResolution() {
 	resolutionCache.clear();

package/dist/external-tools/uv/asset-names.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @file Upstream uv release asset-name mapping per `platform-arch`. uv
+ *   publishes per-platform archives under
+ *   https://github.com/astral-sh/uv/releases/download/<X.Y.Z>/. The release tag
+ *   is the bare semver (no `v` prefix), unlike most upstream projects. Each
+ *   archive wraps the binary one directory deep (`uv-<triple>/uv[.exe]`), so
+ *   callers should pass `strip: 1` to the extractor — or, equivalently, look up
+ *   the binary inside the archive's stem directory.
+ */
+export interface UvAssetEntry {
+    /**
+     * Full asset filename (no version interpolation — uv asset names are
+     * version-free).
+     */
+    readonly asset: string;
+}
+export declare const UV_ASSET_MAP: Readonly<Record<string, UvAssetEntry>>;
+export declare function getUvAssetEntry(platformArch: string): UvAssetEntry | undefined;
+export interface UvDownloadOptions {
+    /**
+     * Uv release version, e.g. `'0.10.11'` (no `v` prefix — astral-sh/uv tags
+     * releases as bare semver).
+     */
+    version: string;
+    /**
+     * Socket platform-arch token — looked up in `UV_ASSET_MAP`.
+     */
+    platformArch: string;
+}
+/**
+ * Build the GitHub release-asset download URL for an upstream uv binary.
+ * Returns `undefined` when no entry exists for the requested platform-arch.
+ *
+ * Reference: https://github.com/astral-sh/uv/releases.
+ */
+export declare function getUvDownloadUrl(options: UvDownloadOptions): string | undefined;

package/dist/external-tools/uv/asset-names.js

@@ -0,0 +1,73 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_object = require('../../primordials/object.js');
+
+//#region src/external-tools/uv/asset-names.ts
+/**
+* @file Upstream uv release asset-name mapping per `platform-arch`. uv
+*   publishes per-platform archives under
+*   https://github.com/astral-sh/uv/releases/download/<X.Y.Z>/. The release tag
+*   is the bare semver (no `v` prefix), unlike most upstream projects. Each
+*   archive wraps the binary one directory deep (`uv-<triple>/uv[.exe]`), so
+*   callers should pass `strip: 1` to the extractor — or, equivalently, look up
+*   the binary inside the archive's stem directory.
+*/
+const UV_ASSET_MAP = require_primordials_object.ObjectFreeze({
+	__proto__: null,
+	"darwin-arm64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		asset: "uv-aarch64-apple-darwin.tar.gz"
+	}),
+	"darwin-x64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		asset: "uv-x86_64-apple-darwin.tar.gz"
+	}),
+	"linux-arm64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		asset: "uv-aarch64-unknown-linux-gnu.tar.gz"
+	}),
+	"linux-arm64-musl": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		asset: "uv-aarch64-unknown-linux-musl.tar.gz"
+	}),
+	"linux-x64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		asset: "uv-x86_64-unknown-linux-gnu.tar.gz"
+	}),
+	"linux-x64-musl": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		asset: "uv-x86_64-unknown-linux-musl.tar.gz"
+	}),
+	"win-arm64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		asset: "uv-aarch64-pc-windows-msvc.zip"
+	}),
+	"win-x64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		asset: "uv-x86_64-pc-windows-msvc.zip"
+	})
+});
+function getUvAssetEntry(platformArch) {
+	return UV_ASSET_MAP[platformArch];
+}
+/**
+* Build the GitHub release-asset download URL for an upstream uv binary.
+* Returns `undefined` when no entry exists for the requested platform-arch.
+*
+* Reference: https://github.com/astral-sh/uv/releases.
+*/
+function getUvDownloadUrl(options) {
+	const { platformArch, version } = {
+		__proto__: null,
+		...options
+	};
+	const entry = UV_ASSET_MAP[platformArch];
+	if (!entry) return;
+	return `https://github.com/astral-sh/uv/releases/download/${version}/` + entry.asset;
+}
+
+//#endregion
+exports.UV_ASSET_MAP = UV_ASSET_MAP;
+exports.getUvAssetEntry = getUvAssetEntry;
+exports.getUvDownloadUrl = getUvDownloadUrl;

package/dist/external-tools/uv/from-download.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @file `uvFromDownload()` — fetches upstream uv and returns a `ResolvedUv`
+ *   pointing at the extracted binary. uv tarballs wrap the binary in a
+ *   `<asset-stem>/` directory; the extractor strips that level so the binary
+ *   sits at the cache-dir root.
+ */
+import type { BinaryDownloader } from '../from-download';
+import type { HashSpec } from '../../integrity';
+import type { ResolvedUv } from './types';
+export interface UvFromDownloadOptions {
+    version: string;
+    platformArch: string;
+    integrity?: HashSpec | undefined;
+    cacheDir?: string | undefined;
+    downloader?: BinaryDownloader | undefined;
+}
+export declare function uvFromDownload(options: UvFromDownloadOptions): Promise<ResolvedUv | undefined>;