@socketsecurity/lib 6.0.8 → 6.0.10

package/dist/packages/validation.js

@@ -2,7 +2,6 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
-const require_primordials_string = require('../primordials/string.js');
 let src_external_validate_npm_package_name = require("../external/validate-npm-package-name");
 src_external_validate_npm_package_name = require_runtime.__toESM(src_external_validate_npm_package_name);
 
@@ -11,18 +10,6 @@ src_external_validate_npm_package_name = require_runtime.__toESM(src_external_va
 * @file Package name validation utilities.
 */
 /**
-* Check if package name is a blessed Socket.dev package.
-*
-* @example
-*   ;```typescript
-*   isBlessedPackageName('@socketregistry/is-number') // true
-*   isBlessedPackageName('lodash') // false
-*   ```
-*/
-function isBlessedPackageName(name) {
-	return typeof name === "string" && (name === "sfw" || name === "socket" || require_primordials_string.StringPrototypeStartsWith(name, "@socketoverride/") || require_primordials_string.StringPrototypeStartsWith(name, "@socketregistry/") || require_primordials_string.StringPrototypeStartsWith(name, "@socketsecurity/"));
-}
-/**
 * Check if a type string represents a registry fetcher type.
 *
 * @example
@@ -48,6 +35,5 @@ function isValidPackageName(name) {
 }
 
 //#endregion
-exports.isBlessedPackageName = isBlessedPackageName;
 exports.isRegistryFetcherType = isRegistryFetcherType;
 exports.isValidPackageName = isValidPackageName;

package/dist/paths/_internal.d.ts

@@ -9,13 +9,7 @@
  *   - `pathLikeToString` — `string | Buffer | URL` → `string`
  */
 import type nodeUrl from 'node:url';
-export declare const CHAR_BACKWARD_SLASH = 92;
-export declare const CHAR_COLON = 58;
-export declare const CHAR_FORWARD_SLASH = 47;
-export declare const CHAR_LOWERCASE_A = 97;
-export declare const CHAR_LOWERCASE_Z = 122;
-export declare const CHAR_UPPERCASE_A = 65;
-export declare const CHAR_UPPERCASE_Z = 90;
+export { CHAR_BACKWARD_SLASH, CHAR_COLON, CHAR_FORWARD_SLASH, CHAR_LOWERCASE_A, CHAR_LOWERCASE_Z, CHAR_UPPERCASE_A, CHAR_UPPERCASE_Z, } from '../constants/encoding';
 export declare const msysDriveRegExp: RegExp;
 export declare const nodeModulesPathRegExp: RegExp;
 export declare const slashRegExp: RegExp;

package/dist/paths/_internal.js

@@ -2,17 +2,11 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_buffer = require('../primordials/buffer.js');
-const require_constants_platform = require('../constants/platform.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_constants_platform = require('../constants/platform.js');
+const require_constants_encoding = require('../constants/encoding.js');
 
 //#region src/paths/_internal.ts
-const CHAR_BACKWARD_SLASH = 92;
-const CHAR_COLON = 58;
-const CHAR_FORWARD_SLASH = 47;
-const CHAR_LOWERCASE_A = 97;
-const CHAR_LOWERCASE_Z = 122;
-const CHAR_UPPERCASE_A = 65;
-const CHAR_UPPERCASE_Z = 90;
 const msysDriveRegExp = /^\/([a-zA-Z])($|\/)/;
 const nodeModulesPathRegExp = /(?:[/\\]|^)node_modules(?:$|[/\\])/;
 const slashRegExp = /[/\\]/;
@@ -72,13 +66,13 @@ function pathLikeToString(pathLike) {
 }
 
 //#endregion
-exports.CHAR_BACKWARD_SLASH = CHAR_BACKWARD_SLASH;
-exports.CHAR_COLON = CHAR_COLON;
-exports.CHAR_FORWARD_SLASH = CHAR_FORWARD_SLASH;
-exports.CHAR_LOWERCASE_A = CHAR_LOWERCASE_A;
-exports.CHAR_LOWERCASE_Z = CHAR_LOWERCASE_Z;
-exports.CHAR_UPPERCASE_A = CHAR_UPPERCASE_A;
-exports.CHAR_UPPERCASE_Z = CHAR_UPPERCASE_Z;
+exports.CHAR_BACKWARD_SLASH = require_constants_encoding.CHAR_BACKWARD_SLASH;
+exports.CHAR_COLON = require_constants_encoding.CHAR_COLON;
+exports.CHAR_FORWARD_SLASH = require_constants_encoding.CHAR_FORWARD_SLASH;
+exports.CHAR_LOWERCASE_A = require_constants_encoding.CHAR_LOWERCASE_A;
+exports.CHAR_LOWERCASE_Z = require_constants_encoding.CHAR_LOWERCASE_Z;
+exports.CHAR_UPPERCASE_A = require_constants_encoding.CHAR_UPPERCASE_A;
+exports.CHAR_UPPERCASE_Z = require_constants_encoding.CHAR_UPPERCASE_Z;
 exports.getUrl = getUrl;
 exports.msysDriveRegExp = msysDriveRegExp;
 exports.nodeModulesPathRegExp = nodeModulesPathRegExp;

package/dist/paths/conversion.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_constants_platform = require('../constants/platform.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_constants_platform = require('../constants/platform.js');
 const require_paths__internal = require('./_internal.js');
 const require_paths_normalize = require('./normalize.js');
 

package/dist/paths/exts.d.ts

@@ -1,17 +1,47 @@
 /**
  * @file File extension constants.
  */
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const EXT_CJS = ".cjs";
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const EXT_CMD = ".cmd";
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const EXT_CTS = ".cts";
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const EXT_DTS = ".d.ts";
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const EXT_JS = ".js";
 export declare const EXT_JSON = ".json";
 export declare const EXT_LOCK = ".lock";
 export declare const EXT_LOCKB = ".lockb";
 export declare const EXT_MD = ".md";
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const EXT_MJS = ".mjs";
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const EXT_MTS = ".mts";
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const EXT_PS1 = ".ps1";
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const EXT_YAML = ".yaml";
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const EXT_YML = ".yml";

package/dist/paths/exts.js

@@ -6,19 +6,49 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 /**
 * @file File extension constants.
 */
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const EXT_CJS = ".cjs";
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const EXT_CMD = ".cmd";
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const EXT_CTS = ".cts";
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const EXT_DTS = ".d.ts";
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const EXT_JS = ".js";
 const EXT_JSON = ".json";
 const EXT_LOCK = ".lock";
 const EXT_LOCKB = ".lockb";
 const EXT_MD = ".md";
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const EXT_MJS = ".mjs";
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const EXT_MTS = ".mts";
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const EXT_PS1 = ".ps1";
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const EXT_YAML = ".yaml";
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const EXT_YML = ".yml";
 
 //#endregion

package/dist/paths/filenames.d.ts

@@ -4,11 +4,17 @@
 export declare const PACKAGE_JSON = "package.json";
 export declare const TSCONFIG_JSON = "tsconfig.json";
 export declare const LICENSE = "LICENSE";
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const LICENSE_MD = "LICENSE.md";
 export declare const LICENSE_ORIGINAL = "LICENSE.original";
 export declare const README_MD = "README.md";
 export declare const CHANGELOG_MD = "CHANGELOG.md";
 export declare const MANIFEST_JSON = "manifest.json";
 export declare const EXTENSIONS_JSON = "extensions.json";
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const GITIGNORE = ".gitignore";
 export declare const DOT_PACKAGE_LOCK_JSON = ".package-lock.json";

package/dist/paths/filenames.js

@@ -9,12 +9,18 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const PACKAGE_JSON = "package.json";
 const TSCONFIG_JSON = "tsconfig.json";
 const LICENSE = "LICENSE";
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const LICENSE_MD = "LICENSE.md";
 const LICENSE_ORIGINAL = "LICENSE.original";
 const README_MD = "README.md";
 const CHANGELOG_MD = "CHANGELOG.md";
 const MANIFEST_JSON = "manifest.json";
 const EXTENSIONS_JSON = "extensions.json";
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const GITIGNORE = ".gitignore";
 const DOT_PACKAGE_LOCK_JSON = ".package-lock.json";
 

package/dist/paths/globs.d.ts

@@ -3,7 +3,13 @@
  */
 export declare const LICENSE_GLOB = "LICEN[CS]E{[.-]*,}";
 export declare const LICENSE_GLOB_RECURSIVE = "**/LICEN[CS]E{[.-]*,}";
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const LICENSE_ORIGINAL_GLOB = "*.original{.*,}";
 export declare const LICENSE_ORIGINAL_GLOB_RECURSIVE = "**/*.original{.*,}";
 export declare const README_GLOB = "README{.*,}";
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const README_GLOB_RECURSIVE = "**/README{.*,}";

package/dist/paths/globs.js

@@ -8,9 +8,15 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 */
 const LICENSE_GLOB = "LICEN[CS]E{[.-]*,}";
 const LICENSE_GLOB_RECURSIVE = "**/LICEN[CS]E{[.-]*,}";
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const LICENSE_ORIGINAL_GLOB = "*.original{.*,}";
 const LICENSE_ORIGINAL_GLOB_RECURSIVE = "**/*.original{.*,}";
 const README_GLOB = "README{.*,}";
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const README_GLOB_RECURSIVE = "**/README{.*,}";
 
 //#endregion

package/dist/paths/normalize.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_constants_platform = require('../constants/platform.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_constants_platform = require('../constants/platform.js');
 const require_strings_search = require('../strings/search.js');
 const require_paths__internal = require('./_internal.js');
 const require_paths_conversion = require('./conversion.js');

package/dist/paths/predicates.js

@@ -1,8 +1,9 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_constants_platform = require('../constants/platform.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_constants_platform = require('../constants/platform.js');
+const require_constants_encoding = require('../constants/encoding.js');
 const require_paths__internal = require('./_internal.js');
 const require_primordials_regexp = require('../primordials/regexp.js');
 

package/dist/paths/resolve.js

@@ -1,6 +1,11 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_string = require('../primordials/string.js');
+const require_constants_platform = require('../constants/platform.js');
+const require_constants_encoding = require('../constants/encoding.js');
+const require_paths_predicates = require('./predicates.js');
+const require_paths_normalize = require('./normalize.js');
 
 //#region src/paths/resolve.ts
 /**
@@ -39,7 +44,7 @@ function relative(from, to) {
 	const actualTo = resolve(to);
 	if (actualFrom === actualTo) return "";
 	/* c8 ignore start - Windows-only case-insensitive comparison. */
-	if (WIN32) {
+	if (require_constants_platform.WIN32) {
 		if (actualFrom.toLowerCase() === actualTo.toLowerCase()) return "";
 	}
 	/* c8 ignore stop */
@@ -52,32 +57,32 @@ function relative(from, to) {
 	let lastCommonSep = -1;
 	let i = 0;
 	for (; i < length; i += 1) {
-		let fromCode = StringPrototypeCharCodeAt(actualFrom, fromStart + i);
-		let toCode = StringPrototypeCharCodeAt(actualTo, toStart + i);
+		let fromCode = require_primordials_string.StringPrototypeCharCodeAt(actualFrom, fromStart + i);
+		let toCode = require_primordials_string.StringPrototypeCharCodeAt(actualTo, toStart + i);
 		/* c8 ignore start - Windows-only case folding. */
-		if (WIN32) {
-			if (fromCode >= CHAR_UPPERCASE_A && fromCode <= CHAR_UPPERCASE_Z) fromCode += 32;
-			if (toCode >= CHAR_UPPERCASE_A && toCode <= CHAR_UPPERCASE_Z) toCode += 32;
+		if (require_constants_platform.WIN32) {
+			if (fromCode >= 65 && fromCode <= 90) fromCode += 32;
+			if (toCode >= 65 && toCode <= 90) toCode += 32;
 		}
 		/* c8 ignore stop */
 		if (fromCode !== toCode) break;
-		if (isPathSeparator(StringPrototypeCharCodeAt(actualFrom, fromStart + i))) lastCommonSep = i;
+		if (require_paths_predicates.isPathSeparator(require_primordials_string.StringPrototypeCharCodeAt(actualFrom, fromStart + i))) lastCommonSep = i;
 	}
 	/* c8 ignore start */
 	if (i === length) {
 		if (toLen > length) {
-			if (isPathSeparator(StringPrototypeCharCodeAt(actualTo, toStart + i))) return actualTo.slice(toStart + i + 1);
+			if (require_paths_predicates.isPathSeparator(require_primordials_string.StringPrototypeCharCodeAt(actualTo, toStart + i))) return actualTo.slice(toStart + i + 1);
 			if (i === 0) return actualTo.slice(toStart + i);
 		} else if (fromLen > length) {
-			if (isPathSeparator(StringPrototypeCharCodeAt(actualFrom, fromStart + i))) lastCommonSep = i;
+			if (require_paths_predicates.isPathSeparator(require_primordials_string.StringPrototypeCharCodeAt(actualFrom, fromStart + i))) lastCommonSep = i;
 			else if (i === 0) lastCommonSep = 0;
 		}
 	}
 	/* c8 ignore stop */
 	let out = "";
 	for (i = fromStart + lastCommonSep + 1; i <= fromEnd; i += 1) {
-		const code = StringPrototypeCharCodeAt(actualFrom, i);
-		if (i === fromEnd || isPathSeparator(code)) out += out.length === 0 ? ".." : "/..";
+		const code = require_primordials_string.StringPrototypeCharCodeAt(actualFrom, i);
+		if (i === fromEnd || require_paths_predicates.isPathSeparator(code)) out += out.length === 0 ? ".." : "/..";
 	}
 	return out + actualTo.slice(toStart + lastCommonSep);
 }
@@ -103,7 +108,7 @@ function relative(from, to) {
 function relativeResolve(from, to) {
 	const rel = relative(from, to);
 	if (rel === "") return "";
-	return normalizePath(rel);
+	return require_paths_normalize.normalizePath(rel);
 }
 /**
 * Resolve an absolute path from path segments.
@@ -132,11 +137,11 @@ function resolve(...segments) {
 		/* c8 ignore start */
 		if (typeof segment !== "string" || segment.length === 0) continue;
 		resolvedPath = segment + (resolvedPath.length === 0 ? "" : `/${resolvedPath}`);
-		resolvedAbsolute = isAbsolute(segment);
+		resolvedAbsolute = require_paths_predicates.isAbsolute(segment);
 	}
 	if (!resolvedAbsolute) resolvedPath = /* @__PURE__ */ require("node:process").cwd() + (resolvedPath.length === 0 ? "" : `/${resolvedPath}`);
 	/* c8 ignore stop */
-	return normalizePath(resolvedPath);
+	return require_paths_normalize.normalizePath(resolvedPath);
 }
 
 //#endregion

package/dist/paths/socket.d.ts

@@ -5,8 +5,8 @@
  *   `_dlx/<hash>/` name+version binary store (node, jre, python, sfw, …);
  *   `_state/<app>/` version-LESS persistent app state (daemon socket + lock +
  *   OAuth refresh; mirrors pnpm `state-dir` / XDG_STATE_HOME), with
- *   `_state/<app>/run/` for a daemon's socket/lock/pid; `_wheelhouse`
- *   cross-fleet shared bin. Generic per-app dirs (`getSocketAppDir('<name>')`)
+ *   `_state/<app>/run/` for a daemon's socket/lock/pid; `_wheelhouse` shared
+ *   bin across Socket tools. Generic per-app dirs (`getSocketAppDir('<name>')`)
  *   nest under the same `_`-prefix.
  */
 /**
@@ -23,6 +23,26 @@ export declare function getOsHomeDir(): string;
  * setPath('tmpdir', ...) from paths/rewire.
  */
 export declare function getOsTmpDir(): string;
+/**
+ * Resolve the runtime socket path for a local daemon named `name`. Distinct
+ * from getSocketAppRuntimeDir (the persistent ~/.socket/_state/<app>/run/
+ * home): the SOCKET endpoint itself belongs in the ephemeral, owner-only XDG
+ * runtime dir — correctly permissioned and auto-cleaned on logout — while the
+ * downloaded daemon binary + durable token cache live under ~/.socket. The
+ * daemon and every client MUST compute the identical path (1 path, 1
+ * reference), so this is the single resolver both sides call.
+ *
+ * Resolution:
+ *
+ * - Windows: `\\.\pipe\<name>-sock` (named pipe; Unix sockets are unavailable
+ *   pre-Win10 1803, same framing/semantics). Returned raw — a pipe path is not
+ *   a filesystem path and must not be slash-normalized.
+ * - `$XDG_RUNTIME_DIR/<name>.sock` when XDG_RUNTIME_DIR is set (systemd
+ *   `/run/user/<uid>/`).
+ * - Else `$TMPDIR/<name>-<uid>.sock` (the `<uid>` suffix avoids collisions when
+ *   TMPDIR is shared across users on a multi-tenant box).
+ */
+export declare function getRuntimeSocketPath(name: string): string;
 /**
  * Get a Socket app cache directory (~/.socket/_<appName>/cache).
  */
@@ -100,12 +120,47 @@ export declare function getSocketDlxDir(): string;
  */
 export declare function getSocketHomePath(): string;
 /**
- * Get the Socket state directory (~/.socket/_state) — version-LESS persistent
- * app state (the home for daemon sockets, locks, OAuth refresh, durable caches
- * that survive version bumps; mirrors pnpm `state-dir` / XDG_STATE_HOME).
- * Override precedence: setPath('socket-state-dir', …) → SOCKET_STATE_DIR env →
- * $SOCKET_HOME/_state → $HOME/.socket/_state.
+ * Get the Wheelhouse rack directory (~/.socket/_wheelhouse/rack) — the tool
+ * STORE. Every `_wheelhouse`-managed CLI tool keeps its real binaries here,
+ * racked by name + version as `<rack>/<tool>/<version>/…` (the wheelhouse
+ * analog of Homebrew's `Cellar/`). The handles on PATH live in
+ * `<wheelhouse>/bin` (getSocketWheelhouseBinDir) and point into the rack.
+ * Inherits the `_wheelhouse` override chain (SOCKET_HOME /
+ * setPath('socket-wheelhouse-dir')).
+ */
+export declare function getSocketRackDir(): string;
+/**
+ * Get a racked tool's version directory (~/.socket/_wheelhouse/rack/<tool>/
+ * <version>) — the per-tool, per-version home under the rack. The
+ * 1-path-1-reference owner of a tool install destination: installers resolve
+ * their extract/copy target through this, and the `<wheelhouse>/bin/<tool>`
+ * shim points at a binary inside it.
+ */
+export declare function getSocketRackToolDir(options: {
+    tool: string;
+    version: string;
+}): string;
+/**
+ * Get the Wheelhouse repo-clones directory (~/.socket/_wheelhouse/repo-clones).
+ * Sits beside the per-tool dirs (sfw, codedb, janus, bin) under `_wheelhouse`.
+ * The home for reference clones of EXTERNAL repos an agent reviews, each as
+ * `<org>-<repo>` lowercased + dash-cased (e.g. `justrach-codedb`).
+ *
+ * Smallest-practical clone form (smallest disk + fastest initial fetch without
+ * the treeless tax): git clone --depth=1 --single-branch --filter=blob:none
+ * <url> <dest> `--depth=1` truncates history, `--single-branch` skips other
+ * refs, and `--filter=blob:none` (a BLOBLESS partial clone) fetches file blobs
+ * lazily on first access — so the initial download is tree-metadata only.
+ * (Treeless `--filter=tree:0` is smaller still but refetches trees on every
+ * walk, which is slow + breaks offline, so it is NOT the default.)
+ *
+ * Deliberately OUTSIDE `~/projects/` so Socket's sibling-walk tooling (e.g.
+ * cascade `--all`) never mistakes a reference clone for a Socket repo
+ * checkout. Disposable: a reference cache, not a working tree. Inherits the
+ * `_wheelhouse` override chain (SOCKET_HOME /
+ * setPath('socket-wheelhouse-dir')).
  */
+export declare function getSocketRepoClonesDir(): string;
 /**
  * Get the Socket state directory (~/.socket/_state) — version-LESS persistent
  * app state (the home for daemon sockets, locks, OAuth refresh, durable caches
@@ -114,11 +169,6 @@ export declare function getSocketHomePath(): string;
  * $SOCKET_HOME/_state → $HOME/.socket/_state.
  */
 export declare function getSocketStateDir(): string;
-/**
- * Get an app's persistent state directory (~/.socket/_state/<app>/). The
- * `<app>` is a real app (proteus, acorn) nesting its version-less state inside
- * the `_state` infra dir.
- */
 /**
  * Get the Socket user directory (~/.socket). Override precedence:
  * setPath('socket-user-dir', …) → SOCKET_HOME env → $HOME/.socket →
@@ -126,24 +176,25 @@ export declare function getSocketStateDir(): string;
  */
 export declare function getSocketUserDir(): string;
 /**
- * Get the Socket Wheelhouse directory (~/.socket/_wheelhouse). Shared
- * cross-fleet location for binaries that every fleet member can reach without
- * each one re-downloading and re-extracting per-repo. Tool installers (janus,
- * sfw, etc.) drop their resolved executables under
- * `<wheelhouse>/<tool>/<version>/<platform-arch>/`; consumers add the
- * appropriate `bin/` to PATH or invoke the binary by absolute path. Override
- * precedence: setPath('socket-wheelhouse-dir', …) → $SOCKET_HOME/_wheelhouse →
- * $HOME/.socket/_wheelhouse.
- */
-/**
- * Get the Socket Wheelhouse directory (~/.socket/_wheelhouse). Shared
- * cross-fleet location for binaries that every fleet member can reach without
- * each one re-downloading and re-extracting per-repo. Tool installers (janus,
- * sfw, etc.) drop their resolved executables under
- * `<wheelhouse>/<tool>/<version>/<platform-arch>/`; consumers add the
- * appropriate `bin/` to PATH or invoke the binary by absolute path. Override
- * precedence: setPath('socket-wheelhouse-dir', …) → $SOCKET_HOME/_wheelhouse →
- * $HOME/.socket/_wheelhouse.
+ * Get the Wheelhouse bin directory (~/.socket/_wheelhouse/bin) — the single
+ * directory placed on PATH. Holds only flat handles (thin exec shims or
+ * symlinks), one per tool, each pointing at a real binary racked under
+ * `<wheelhouse>/rack/<tool>/<version>/…` (getSocketRackToolDir). The shim IS
+ * the bin, the npm `prefix/bin` / Homebrew `bin/` model: PATH lookup does not
+ * recurse, so this dir stays flat (never a `bin/<tool>/` subdir). Inherits the
+ * `_wheelhouse` override chain (SOCKET_HOME /
+ * setPath('socket-wheelhouse-dir')).
+ */
+export declare function getSocketWheelhouseBinDir(): string;
+/**
+ * Get the Socket Wheelhouse directory (~/.socket/_wheelhouse). Shared location,
+ * common across Socket repos, for binaries that every Socket repo can reach
+ * without each one re-downloading and re-extracting per-repo. Tool installers
+ * (janus, sfw, etc.) rack their resolved executables under
+ * `<wheelhouse>/rack/<tool>/<version>/…` (getSocketRackToolDir) and expose a
+ * handle in `<wheelhouse>/bin` (getSocketWheelhouseBinDir); consumers add that
+ * one `bin/` to PATH. Override precedence: setPath('socket-wheelhouse-dir', …)
+ * → $SOCKET_HOME/_wheelhouse → $HOME/.socket/_wheelhouse.
  */
 export declare function getSocketWheelhouseDir(): string;
 /**