@socketsecurity/lib 6.0.8 → 6.0.10

package/dist/paths/socket.js

@@ -2,7 +2,9 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_node_os = require('../node/os.js');
+const require_constants_platform = require('../constants/platform.js');
 const require_env_home = require('../env/home.js');
+const require_env_xdg = require('../env/xdg.js');
 const require_paths_normalize = require('./normalize.js');
 const require_node_path = require('../node/path.js');
 const require_env_socket = require('../env/socket.js');
@@ -19,8 +21,8 @@ const require_paths_rewire = require('./rewire.js');
 *   `_dlx/<hash>/` name+version binary store (node, jre, python, sfw, …);
 *   `_state/<app>/` version-LESS persistent app state (daemon socket + lock +
 *   OAuth refresh; mirrors pnpm `state-dir` / XDG_STATE_HOME), with
-*   `_state/<app>/run/` for a daemon's socket/lock/pid; `_wheelhouse`
-*   cross-fleet shared bin. Generic per-app dirs (`getSocketAppDir('<name>')`)
+*   `_state/<app>/run/` for a daemon's socket/lock/pid; `_wheelhouse` shared
+*   bin across Socket tools. Generic per-app dirs (`getSocketAppDir('<name>')`)
 *   nest under the same `_`-prefix.
 */
 /**
@@ -44,6 +46,33 @@ function getOsTmpDir() {
 	return require_paths_rewire.getPathValue("tmpdir", () => os.tmpdir());
 }
 /**
+* Resolve the runtime socket path for a local daemon named `name`. Distinct
+* from getSocketAppRuntimeDir (the persistent ~/.socket/_state/<app>/run/
+* home): the SOCKET endpoint itself belongs in the ephemeral, owner-only XDG
+* runtime dir — correctly permissioned and auto-cleaned on logout — while the
+* downloaded daemon binary + durable token cache live under ~/.socket. The
+* daemon and every client MUST compute the identical path (1 path, 1
+* reference), so this is the single resolver both sides call.
+*
+* Resolution:
+*
+* - Windows: `\\.\pipe\<name>-sock` (named pipe; Unix sockets are unavailable
+*   pre-Win10 1803, same framing/semantics). Returned raw — a pipe path is not
+*   a filesystem path and must not be slash-normalized.
+* - `$XDG_RUNTIME_DIR/<name>.sock` when XDG_RUNTIME_DIR is set (systemd
+*   `/run/user/<uid>/`).
+* - Else `$TMPDIR/<name>-<uid>.sock` (the `<uid>` suffix avoids collisions when
+*   TMPDIR is shared across users on a multi-tenant box).
+*/
+function getRuntimeSocketPath(name) {
+	if (require_constants_platform.WIN32) return `\\\\.\\pipe\\${name}-sock`;
+	const path = require_node_path.getNodePath();
+	const xdgRuntimeDir = require_env_xdg.getXdgRuntimeDir();
+	if (xdgRuntimeDir) return require_paths_normalize.normalizePath(path.join(xdgRuntimeDir, `${name}.sock`));
+	const { uid } = require_node_os.getNodeOs().userInfo();
+	return require_paths_normalize.normalizePath(path.join(getOsTmpDir(), `${name}-${uid}.sock`));
+}
+/**
 * Get a Socket app cache directory (~/.socket/_<appName>/cache).
 */
 /**
@@ -142,12 +171,54 @@ function getSocketHomePath() {
 	return getSocketUserDir();
 }
 /**
-* Get the Socket state directory (~/.socket/_state) — version-LESS persistent
-* app state (the home for daemon sockets, locks, OAuth refresh, durable caches
-* that survive version bumps; mirrors pnpm `state-dir` / XDG_STATE_HOME).
-* Override precedence: setPath('socket-state-dir', …) → SOCKET_STATE_DIR env →
-* $SOCKET_HOME/_state → $HOME/.socket/_state.
+* Get the Wheelhouse rack directory (~/.socket/_wheelhouse/rack) — the tool
+* STORE. Every `_wheelhouse`-managed CLI tool keeps its real binaries here,
+* racked by name + version as `<rack>/<tool>/<version>/…` (the wheelhouse
+* analog of Homebrew's `Cellar/`). The handles on PATH live in
+* `<wheelhouse>/bin` (getSocketWheelhouseBinDir) and point into the rack.
+* Inherits the `_wheelhouse` override chain (SOCKET_HOME /
+* setPath('socket-wheelhouse-dir')).
 */
+function getSocketRackDir() {
+	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketWheelhouseDir(), "rack"));
+}
+/**
+* Get a racked tool's version directory (~/.socket/_wheelhouse/rack/<tool>/
+* <version>) — the per-tool, per-version home under the rack. The
+* 1-path-1-reference owner of a tool install destination: installers resolve
+* their extract/copy target through this, and the `<wheelhouse>/bin/<tool>`
+* shim points at a binary inside it.
+*/
+function getSocketRackToolDir(options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketRackDir(), opts.tool, opts.version));
+}
+/**
+* Get the Wheelhouse repo-clones directory (~/.socket/_wheelhouse/repo-clones).
+* Sits beside the per-tool dirs (sfw, codedb, janus, bin) under `_wheelhouse`.
+* The home for reference clones of EXTERNAL repos an agent reviews, each as
+* `<org>-<repo>` lowercased + dash-cased (e.g. `justrach-codedb`).
+*
+* Smallest-practical clone form (smallest disk + fastest initial fetch without
+* the treeless tax): git clone --depth=1 --single-branch --filter=blob:none
+* <url> <dest> `--depth=1` truncates history, `--single-branch` skips other
+* refs, and `--filter=blob:none` (a BLOBLESS partial clone) fetches file blobs
+* lazily on first access — so the initial download is tree-metadata only.
+* (Treeless `--filter=tree:0` is smaller still but refetches trees on every
+* walk, which is slow + breaks offline, so it is NOT the default.)
+*
+* Deliberately OUTSIDE `~/projects/` so Socket's sibling-walk tooling (e.g.
+* cascade `--all`) never mistakes a reference clone for a Socket repo
+* checkout. Disposable: a reference cache, not a working tree. Inherits the
+* `_wheelhouse` override chain (SOCKET_HOME /
+* setPath('socket-wheelhouse-dir')).
+*/
+function getSocketRepoClonesDir() {
+	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketWheelhouseDir(), "repo-clones"));
+}
 /**
 * Get the Socket state directory (~/.socket/_state) — version-LESS persistent
 * app state (the home for daemon sockets, locks, OAuth refresh, durable caches
@@ -162,11 +233,6 @@ function getSocketStateDir() {
 	});
 }
 /**
-* Get an app's persistent state directory (~/.socket/_state/<app>/). The
-* `<app>` is a real app (proteus, acorn) nesting its version-less state inside
-* the `_state` infra dir.
-*/
-/**
 * Get the Socket user directory (~/.socket). Override precedence:
 * setPath('socket-user-dir', …) → SOCKET_HOME env → $HOME/.socket →
 * /tmp/.socket (Unix) or %TEMP%.socket (Windows).
@@ -179,24 +245,27 @@ function getSocketUserDir() {
 	});
 }
 /**
-* Get the Socket Wheelhouse directory (~/.socket/_wheelhouse). Shared
-* cross-fleet location for binaries that every fleet member can reach without
-* each one re-downloading and re-extracting per-repo. Tool installers (janus,
-* sfw, etc.) drop their resolved executables under
-* `<wheelhouse>/<tool>/<version>/<platform-arch>/`; consumers add the
-* appropriate `bin/` to PATH or invoke the binary by absolute path. Override
-* precedence: setPath('socket-wheelhouse-dir', …) → $SOCKET_HOME/_wheelhouse →
-* $HOME/.socket/_wheelhouse.
+* Get the Wheelhouse bin directory (~/.socket/_wheelhouse/bin) — the single
+* directory placed on PATH. Holds only flat handles (thin exec shims or
+* symlinks), one per tool, each pointing at a real binary racked under
+* `<wheelhouse>/rack/<tool>/<version>/…` (getSocketRackToolDir). The shim IS
+* the bin, the npm `prefix/bin` / Homebrew `bin/` model: PATH lookup does not
+* recurse, so this dir stays flat (never a `bin/<tool>/` subdir). Inherits the
+* `_wheelhouse` override chain (SOCKET_HOME /
+* setPath('socket-wheelhouse-dir')).
 */
+function getSocketWheelhouseBinDir() {
+	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketWheelhouseDir(), "bin"));
+}
 /**
-* Get the Socket Wheelhouse directory (~/.socket/_wheelhouse). Shared
-* cross-fleet location for binaries that every fleet member can reach without
-* each one re-downloading and re-extracting per-repo. Tool installers (janus,
-* sfw, etc.) drop their resolved executables under
-* `<wheelhouse>/<tool>/<version>/<platform-arch>/`; consumers add the
-* appropriate `bin/` to PATH or invoke the binary by absolute path. Override
-* precedence: setPath('socket-wheelhouse-dir', …) → $SOCKET_HOME/_wheelhouse →
-* $HOME/.socket/_wheelhouse.
+* Get the Socket Wheelhouse directory (~/.socket/_wheelhouse). Shared location,
+* common across Socket repos, for binaries that every Socket repo can reach
+* without each one re-downloading and re-extracting per-repo. Tool installers
+* (janus, sfw, etc.) rack their resolved executables under
+* `<wheelhouse>/rack/<tool>/<version>/…` (getSocketRackToolDir) and expose a
+* handle in `<wheelhouse>/bin` (getSocketWheelhouseBinDir); consumers add that
+* one `bin/` to PATH. Override precedence: setPath('socket-wheelhouse-dir', …)
+* → $SOCKET_HOME/_wheelhouse → $HOME/.socket/_wheelhouse.
 */
 function getSocketWheelhouseDir() {
 	return require_paths_rewire.getPathValue("socket-wheelhouse-dir", () => {
@@ -234,6 +303,7 @@ function getUserHomeDir() {
 //#endregion
 exports.getOsHomeDir = getOsHomeDir;
 exports.getOsTmpDir = getOsTmpDir;
+exports.getRuntimeSocketPath = getRuntimeSocketPath;
 exports.getSocketAppCacheDir = getSocketAppCacheDir;
 exports.getSocketAppCacheTtlDir = getSocketAppCacheTtlDir;
 exports.getSocketAppDir = getSocketAppDir;
@@ -242,7 +312,11 @@ exports.getSocketAppStateDir = getSocketAppStateDir;
 exports.getSocketCacacheDir = getSocketCacacheDir;
 exports.getSocketDlxDir = getSocketDlxDir;
 exports.getSocketHomePath = getSocketHomePath;
+exports.getSocketRackDir = getSocketRackDir;
+exports.getSocketRackToolDir = getSocketRackToolDir;
+exports.getSocketRepoClonesDir = getSocketRepoClonesDir;
 exports.getSocketStateDir = getSocketStateDir;
 exports.getSocketUserDir = getSocketUserDir;
+exports.getSocketWheelhouseBinDir = getSocketWheelhouseBinDir;
 exports.getSocketWheelhouseDir = getSocketWheelhouseDir;
 exports.getUserHomeDir = getUserHomeDir;

package/dist/perf/metrics.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_primordials_math = require('../primordials/math.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_primordials_math = require('../primordials/math.js');
 const require_debug_output = require('../debug/output.js');
 const require_perf__internal = require('./_internal.js');
 

package/dist/perf/report.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_primordials_math = require('../primordials/math.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_primordials_math = require('../primordials/math.js');
 const require_debug_output = require('../debug/output.js');
 const require_perf__internal = require('./_internal.js');
 const require_perf_enabled = require('./enabled.js');
@@ -43,7 +43,8 @@ function generatePerformanceReport() {
 	let report = "\n╔═══════════════════════════════════════════════╗\n";
 	report += "║         Performance Report                    ║\n";
 	report += "╚═══════════════════════════════════════════════╝\n\n";
-	for (const operation of operations) {
+	for (let i = 0, { length } = operations; i < length; i += 1) {
+		const operation = operations[i];
 		const stats = summary[operation];
 		report += `${operation}:\n`;
 		report += `  Calls: ${stats.count}\n`;
@@ -72,7 +73,8 @@ function printPerformanceSummary() {
 	const summary = require_perf_metrics.getPerformanceSummary();
 	const operations = require_primordials_object.ObjectKeys(summary).toSorted();
 	require_debug_output.debugLog("[perf]\n=== Performance Summary ===");
-	for (const operation of operations) {
+	for (let i = 0, { length } = operations; i < length; i += 1) {
+		const operation = operations[i];
 		const stats = summary[operation];
 		require_debug_output.debugLog(`[perf] ${operation}: ${stats.count} calls, avg ${stats.avg}ms (min ${stats.min}ms, max ${stats.max}ms, total ${stats.total}ms)`);
 	}

package/dist/pkg-ext/data.js

@@ -1,9 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
 let src_external__yarnpkg_extensions = require("../external/@yarnpkg/extensions");
-src_external__yarnpkg_extensions = require_runtime.__toESM(src_external__yarnpkg_extensions);
 
 //#region src/pkg-ext/data.ts
 /**

package/dist/primordials/globals.d.ts

@@ -9,7 +9,7 @@
 export declare const BigIntCtor: BigIntConstructor;
 export declare const BooleanCtor: BooleanConstructor;
 export declare const ProxyCtor: ProxyConstructor;
-export declare const SharedArrayBufferCtor: SharedArrayBufferConstructor;
+export declare const SharedArrayBufferCtor: SharedArrayBufferConstructor | undefined;
 export declare const InfinityValue: number;
 export declare const NaNValue: number;
 declare const capturedGlobalThis: typeof globalThis;

package/dist/primordials/globals.js

@@ -14,7 +14,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const BigIntCtor = BigInt;
 const BooleanCtor = Boolean;
 const ProxyCtor = Proxy;
-const SharedArrayBufferCtor = SharedArrayBuffer;
+const SharedArrayBufferCtor = typeof SharedArrayBuffer === "undefined" ? void 0 : SharedArrayBuffer;
 const InfinityValue = Infinity;
 const NaNValue = NaN;
 const capturedGlobalThis = globalThis;

package/dist/primordials/headers.d.ts

@@ -1,10 +1,22 @@
 /**
  * @file Safe references to the Fetch `Headers` constructor and its
- *   `Headers.prototype` methods. `Headers` is a global on Node 22+ (the fleet
+ *   `Headers.prototype` methods. `Headers` is a global on Node 22+ (Socket's
  *   floor), captured unguarded like `URL` / `URLSearchParams`.
  */
+/**
+ * @unused No internal or Socket consumers.
+ */
 export declare const HeadersCtor: typeof Headers;
 export declare const HeadersPrototypeForEach: (self: unknown, callbackfn: (value: string, key: string, parent: Headers) => void, thisArg?: any) => void;
+/**
+ * @unused No internal or Socket consumers.
+ */
 export declare const HeadersPrototypeGet: (self: unknown, name: string) => string | null;
+/**
+ * @unused No internal or Socket consumers.
+ */
 export declare const HeadersPrototypeHas: (self: unknown, name: string) => boolean;
+/**
+ * @unused No internal or Socket consumers.
+ */
 export declare const HeadersPrototypeSet: (self: unknown, name: string, value: string) => void;

package/dist/primordials/headers.js

@@ -6,13 +6,25 @@ const require_primordials_uncurry = require('./uncurry.js');
 //#region src/primordials/headers.ts
 /**
 * @file Safe references to the Fetch `Headers` constructor and its
-*   `Headers.prototype` methods. `Headers` is a global on Node 22+ (the fleet
+*   `Headers.prototype` methods. `Headers` is a global on Node 22+ (Socket's
 *   floor), captured unguarded like `URL` / `URLSearchParams`.
 */
+/**
+* @unused No internal or Socket consumers.
+*/
 const HeadersCtor = Headers;
 const HeadersPrototypeForEach = require_primordials_uncurry.uncurryThis(Headers.prototype.forEach);
+/**
+* @unused No internal or Socket consumers.
+*/
 const HeadersPrototypeGet = require_primordials_uncurry.uncurryThis(Headers.prototype.get);
+/**
+* @unused No internal or Socket consumers.
+*/
 const HeadersPrototypeHas = require_primordials_uncurry.uncurryThis(Headers.prototype.has);
+/**
+* @unused No internal or Socket consumers.
+*/
 const HeadersPrototypeSet = require_primordials_uncurry.uncurryThis(Headers.prototype.set);
 
 //#endregion

package/dist/primordials/process.d.ts

@@ -7,7 +7,7 @@
  *   the method reference instead (`process.cwd.bind(process)`) would freeze it
  *   and break that test seam, so we deliberately keep the late call. Consumers
  *   read cwd / platform / env / argv through these instead of touching
- *   `process` directly; enforced fleet-wide by
+ *   `process` directly; enforced Socket-wide by
  *   `socket/prefer-process-primordial`. This is the `process` leaf of the
  *   node-module primordials: where `node/fs` / `node/path` lazy-load a `node:`
  *   module behind a function, this captures the always-present `process` global

package/dist/primordials/process.js

@@ -12,7 +12,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 *   the method reference instead (`process.cwd.bind(process)`) would freeze it
 *   and break that test seam, so we deliberately keep the late call. Consumers
 *   read cwd / platform / env / argv through these instead of touching
-*   `process` directly; enforced fleet-wide by
+*   `process` directly; enforced Socket-wide by
 *   `socket/prefer-process-primordial`. This is the `process` leaf of the
 *   node-module primordials: where `node/fs` / `node/path` lazy-load a `node:`
 *   module behind a function, this captures the always-present `process` global

package/dist/primordials/url.d.ts

@@ -4,10 +4,28 @@
  */
 export declare const URLCtor: typeof URL;
 export declare const URLSearchParamsCtor: typeof URLSearchParams;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const URLSearchParamsPrototypeAppend: (self: unknown, name: string, value: string) => void;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const URLSearchParamsPrototypeDelete: (self: unknown, name: string, value?: string | undefined) => void;
 export declare const URLSearchParamsPrototypeForEach: (self: unknown, callbackfn: (value: string, key: string, parent: URLSearchParams) => void, thisArg?: any) => void;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const URLSearchParamsPrototypeGet: (self: unknown, name: string) => string | null;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const URLSearchParamsPrototypeGetAll: (self: unknown, name: string) => string[];
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const URLSearchParamsPrototypeHas: (self: unknown, name: string, value?: string | undefined) => boolean;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const URLSearchParamsPrototypeSet: (self: unknown, name: string, value: string) => void;

package/dist/primordials/url.js

@@ -10,12 +10,30 @@ const require_primordials_uncurry = require('./uncurry.js');
 */
 const URLCtor = URL;
 const URLSearchParamsCtor = URLSearchParams;
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const URLSearchParamsPrototypeAppend = require_primordials_uncurry.uncurryThis(URLSearchParams.prototype.append);
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const URLSearchParamsPrototypeDelete = require_primordials_uncurry.uncurryThis(URLSearchParams.prototype.delete);
 const URLSearchParamsPrototypeForEach = require_primordials_uncurry.uncurryThis(URLSearchParams.prototype.forEach);
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const URLSearchParamsPrototypeGet = require_primordials_uncurry.uncurryThis(URLSearchParams.prototype.get);
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const URLSearchParamsPrototypeGetAll = require_primordials_uncurry.uncurryThis(URLSearchParams.prototype.getAll);
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const URLSearchParamsPrototypeHas = require_primordials_uncurry.uncurryThis(URLSearchParams.prototype.has);
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const URLSearchParamsPrototypeSet = require_primordials_uncurry.uncurryThis(URLSearchParams.prototype.set);
 
 //#endregion

package/dist/process/spawn/child.js

@@ -37,14 +37,12 @@ node_process = require_runtime.__toESM(node_process);
 *   - https://nodejs.org/api/child_process.html#child_processspawncommand-args-options
 *   - https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html
 */
-const abortSignal = require_process_abort.getAbortSignal();
-const spinner = require_spinner_default.getDefaultSpinner();
 function spawn(cmd, args, options, extra) {
-	const { spinner: optionsSpinner = spinner, stripAnsi: shouldStripAnsi = true, ...rawSpawnOptions } = {
+	const { spinner: optionsSpinner, stripAnsi: shouldStripAnsi = true, ...rawSpawnOptions } = {
 		__proto__: null,
 		...options
 	};
-	const spinnerInstance = optionsSpinner;
+	const spinnerInstance = optionsSpinner ?? require_spinner_default.getDefaultSpinner();
 	const spawnOptions = {
 		__proto__: null,
 		...rawSpawnOptions
@@ -89,7 +87,7 @@ function spawn(cmd, args, options, extra) {
 		__proto__: null,
 		cwd: typeof spawnOptions.cwd === "string" ? spawnOptions.cwd : void 0,
 		env: envToUse,
-		signal: abortSignal,
+		signal: require_process_abort.getAbortSignal(),
 		stdio: spawnOptions.stdio,
 		stdioString,
 		shell: spawnOptions.shell,

package/dist/promises/_internal.d.ts

@@ -4,7 +4,7 @@
  *   prefix excludes from public exports.
  */
 import type timersPromises from 'node:timers/promises';
-export declare const abortSignal: AbortSignal;
+export { getAbortSignal } from '../process/abort';
 /**
  * Get the timers/promises module. Lazy `require` (not a top-level import) to
  * avoid Webpack bundling issues.

package/dist/promises/_internal.js

@@ -5,7 +5,6 @@ const require_constants_runtime = require('../constants/runtime.js');
 const require_process_abort = require('../process/abort.js');
 
 //#region src/promises/_internal.ts
-const abortSignal = require_process_abort.getAbortSignal();
 /**
 * Get the timers/promises module. Lazy `require` (not a top-level import) to
 * avoid Webpack bundling issues.
@@ -26,5 +25,5 @@ function getTimers() {
 }
 
 //#endregion
-exports.abortSignal = abortSignal;
+exports.getAbortSignal = require_process_abort.getAbortSignal;
 exports.getTimers = getTimers;

package/dist/promises/options.js

@@ -2,7 +2,7 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_math = require('../primordials/math.js');
-const require_promises__internal = require('./_internal.js');
+const require_process_abort = require('../process/abort.js');
 
 //#region src/promises/options.ts
 /**
@@ -34,7 +34,7 @@ const require_promises__internal = require('./_internal.js');
 * @returns Normalized options with concurrency, retries, and signal
 */
 function normalizeIterationOptions(options) {
-	const { concurrency = 1, retries, signal = require_promises__internal.abortSignal } = {
+	const { concurrency = 1, retries, signal = require_process_abort.getAbortSignal() } = {
 		__proto__: null,
 		...typeof options === "number" ? { concurrency: options } : options
 	};
@@ -70,7 +70,7 @@ function normalizeIterationOptions(options) {
 * @returns Normalized retry options with all properties set
 */
 function normalizeRetryOptions(options) {
-	const { args = [], backoffFactor = 2, baseDelayMs = 200, jitter = true, maxDelayMs = 1e4, onRetry, onRetryCancelOnFalse = false, onRetryRethrow = false, retries = 0, signal = require_promises__internal.abortSignal } = resolveRetryOptions(options);
+	const { args = [], backoffFactor = 2, baseDelayMs = 200, jitter = true, maxDelayMs = 1e4, onRetry, onRetryCancelOnFalse = false, onRetryRethrow = false, retries = 0, signal = require_process_abort.getAbortSignal() } = resolveRetryOptions(options);
 	return {
 		args,
 		backoffFactor,

package/dist/regexps/spec.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_primordials_map_set = require('../primordials/map-set.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_primordials_map_set = require('../primordials/map-set.js');
 const require_regexps_hex = require('./hex.js');
 
 //#region src/regexps/spec.ts

package/dist/releases/socket-btm-binary-naming.js

@@ -25,6 +25,17 @@ const ARCH_MAP = {
 	x64: "x64"
 };
 /**
+* Windows platform token per binary family. The node-smol pipeline names its
+* Windows assets with the RELEASE platform token (`node-win-x64.exe`), while
+* the binject/binflate/boringssl families keep `process.platform` verbatim
+* (`binject-win32-x64.exe`). Published releases are immutable, so this table
+* encodes the split rather than pretending one style exists.
+*/
+const WIN_TOKEN_BY_BASENAME = {
+	__proto__: null,
+	node: "win"
+};
+/**
 * Get asset name for a socket-btm binary.
 *
 * @example
@@ -47,7 +58,7 @@ function getBinaryAssetName(binaryBaseName, platform, arch, libc) {
 	const ext = platform === "win32" ? ".exe" : "";
 	if (platform === "darwin") return `${binaryBaseName}-darwin-${mappedArch}${ext}`;
 	if (platform === "linux") return `${binaryBaseName}-linux-${mappedArch}${muslSuffix}${ext}`;
-	if (platform === "win32") return `${binaryBaseName}-win32-${mappedArch}${ext}`;
+	if (platform === "win32") return `${binaryBaseName}-${WIN_TOKEN_BY_BASENAME[binaryBaseName] ?? "win32"}-${mappedArch}${ext}`;
 	throw new require_primordials_error.ErrorCtor(`Unsupported platform: ${platform}`);
 }
 /**

package/dist/schema/validate.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_error = require('../primordials/error.js');
-const require_primordials_number = require('../primordials/number.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_primordials_number = require('../primordials/number.js');
 const require_primordials_array = require('../primordials/array.js');
 
 //#region src/schema/validate.ts

package/dist/secrets/_internal.d.ts

@@ -2,7 +2,7 @@
  * @file Private internals for `secrets/` — process-scoped read cache for the
  *   keychain backend. Underscore-prefixed and skipped by the export generator
  *   (`dist/**\/_*` ignore pattern in
- *   `scripts/post-build/make-package-exports.mts`) so this module is NOT part
+ *   `scripts/fleet/make-package-exports.mts`) so this module is NOT part
  *   of the public API surface. Imported by `./keychain.ts`. Every `readSecret`
  *   call shells out to the OS credential CLI (`security`, `secret-tool`,
  *   PowerShell). On macOS, the first read of a given entry by a new binary path

package/dist/secrets/_internal.js

@@ -8,7 +8,7 @@ const require_primordials_map_set = require('../primordials/map-set.js');
 * @file Private internals for `secrets/` — process-scoped read cache for the
 *   keychain backend. Underscore-prefixed and skipped by the export generator
 *   (`dist/**\/_*` ignore pattern in
-*   `scripts/post-build/make-package-exports.mts`) so this module is NOT part
+*   `scripts/fleet/make-package-exports.mts`) so this module is NOT part
 *   of the public API surface. Imported by `./keychain.ts`. Every `readSecret`
 *   call shells out to the OS credential CLI (`security`, `secret-tool`,
 *   PowerShell). On macOS, the first read of a given entry by a new binary path

package/dist/secrets/broker.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @file Proteus broker client. Asks the running proteus credential daemon for a
+ *   secret over its local Unix socket (Windows named pipe later), so a
+ *   biometric-gated read happens inside the daemon and the value is vended to
+ *   this process in memory rather than sitting in an env var. This is the layer
+ *   `ai/credentials.mts` documents as slotting between the env check and the
+ *   keychain read in `secrets/find.ts` `resolve()`.
+ *   The broker is OPTIONAL and self-gating: when the daemon isn't running (no
+ *   socket file), `requestFromBroker` returns `undefined` immediately and the
+ *   caller falls through to the keychain. It never throws — a broker miss is a
+ *   fall-through, not an error. The daemon binary itself is built by socket-btm
+ *   (`packages/proteus-builder`); download-and-start is a later layer, so today
+ *   this only talks to an already-running daemon.
+ */
+export interface BrokerRequestOptions {
+    /**
+     * The keychain service scope (e.g. `socketsecurity`).
+     */
+    readonly service: string;
+    /**
+     * The account within the service (e.g. `ANTHROPIC_API_KEY`).
+     */
+    readonly account: string;
+}
+export interface BrokerResponse {
+    readonly ok?: boolean | undefined;
+    readonly value?: string | undefined;
+}
+/**
+ * Ask the proteus daemon for a credential. Returns the value on success, or
+ * `undefined` when the daemon isn't running, doesn't hold it, or the biometric
+ * prompt was declined. Never throws: a miss falls through to the next resolver
+ * layer (the keychain).
+ */
+export declare function requestFromBroker({ account, service, }: BrokerRequestOptions): Promise<string | undefined>;