@socketsecurity/lib 6.0.8 → 6.0.9

package/dist/objects/predicates.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_arrays_predicates = require('../arrays/predicates.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_arrays_predicates = require('../arrays/predicates.js');
 
 //#region src/objects/predicates.ts
 /**

package/dist/packages/exports.js

@@ -2,11 +2,11 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_error = require('../primordials/error.js');
-const require_arrays_predicates = require('../arrays/predicates.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_primordials_string = require('../primordials/string.js');
+const require_arrays_predicates = require('../arrays/predicates.js');
 const require_objects_predicates = require('../objects/predicates.js');
 const require_primordials_map_set = require('../primordials/map-set.js');
-const require_primordials_string = require('../primordials/string.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_constants_sentinels = require('../constants/sentinels.js');
 

package/dist/packages/isolation.js

@@ -3,9 +3,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_error = require('../primordials/error.js');
-const require_constants_platform = require('../constants/platform.js');
 const require_primordials_object = require('../primordials/object.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_constants_platform = require('../constants/platform.js');
 const require_paths_conversion = require('../paths/conversion.js');
 const require_paths_predicates = require('../paths/predicates.js');
 const require_node_fs = require('../node/fs.js');

package/dist/packages/manifest.d.ts

@@ -32,3 +32,32 @@ export declare function fetchPackageManifest(pkgNameOrId: string, options?: Paco
  *   ```
  */
 export declare function fetchPackagePackument(pkgNameOrId: string, options?: PacoteOptions): Promise<unknown>;
+/**
+ * Dev/build-only top-level package.json fields not needed at runtime. The
+ * conservative default for {@link trimPublishManifest}; extend per-package via
+ * its `drop` option.
+ */
+export declare const DEFAULT_TRIM_FIELDS: readonly string[];
+export interface TrimPublishManifestOptions {
+    /**
+     * Top-level fields to omit (defaults to {@link DEFAULT_TRIM_FIELDS}).
+     */
+    readonly drop?: readonly string[] | undefined;
+    /**
+     * Fields to KEEP even when listed in `drop` (e.g. a runtime postinstall).
+     */
+    readonly keep?: readonly string[] | undefined;
+}
+/**
+ * Return a shallow copy of `manifest` that omits dev/build-only top-level
+ * fields so a published tarball + its npm metadata stay lean (npm caps total
+ * per-package metadata at 100 MB). The original object is left intact; persist
+ * the result only for the publish, never over the repo's own package.json.
+ *
+ * @example
+ *   ;```typescript
+ *   const lean = trimPublishManifest(pkg) // omits devDependencies + scripts
+ *   const kept = trimPublishManifest(pkg, { keep: ['scripts'] })
+ *   ```
+ */
+export declare function trimPublishManifest(manifest: PackageJson, options?: TrimPublishManifestOptions | undefined): PackageJson;

package/dist/packages/manifest.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
-const require_arrays_predicates = require('../arrays/predicates.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_arrays_predicates = require('../arrays/predicates.js');
 const require_objects_predicates = require('../objects/predicates.js');
 const require_process_abort = require('../process/abort.js');
 const require_constants_socket = require('../constants/socket.js');
@@ -132,8 +132,44 @@ async function fetchPackagePackument(pkgNameOrId, options) {
 		});
 	} catch {}
 }
+/**
+* Dev/build-only top-level package.json fields not needed at runtime. The
+* conservative default for {@link trimPublishManifest}; extend per-package via
+* its `drop` option.
+*/
+const DEFAULT_TRIM_FIELDS = ["devDependencies", "scripts"];
+/**
+* Return a shallow copy of `manifest` that omits dev/build-only top-level
+* fields so a published tarball + its npm metadata stay lean (npm caps total
+* per-package metadata at 100 MB). The original object is left intact; persist
+* the result only for the publish, never over the repo's own package.json.
+*
+* @example
+*   ;```typescript
+*   const lean = trimPublishManifest(pkg) // omits devDependencies + scripts
+*   const kept = trimPublishManifest(pkg, { keep: ['scripts'] })
+*   ```
+*/
+function trimPublishManifest(manifest, options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const drop = new Set(opts.drop ?? DEFAULT_TRIM_FIELDS);
+	const keep = new Set(opts.keep ?? []);
+	const source = manifest;
+	const keys = require_primordials_object.ObjectKeys(source);
+	const out = {};
+	for (let i = 0, { length } = keys; i < length; i += 1) {
+		const key = keys[i];
+		if (!drop.has(key) || keep.has(key)) out[key] = source[key];
+	}
+	return out;
+}
 
 //#endregion
+exports.DEFAULT_TRIM_FIELDS = DEFAULT_TRIM_FIELDS;
 exports.createPackageJson = createPackageJson;
 exports.fetchPackageManifest = fetchPackageManifest;
-exports.fetchPackagePackument = fetchPackagePackument;
+exports.fetchPackagePackument = fetchPackagePackument;
+exports.trimPublishManifest = trimPublishManifest;

package/dist/packages/normalize.js

@@ -6,8 +6,8 @@ const require_primordials_object = require('../primordials/object.js');
 const require_primordials_string = require('../primordials/string.js');
 const require_primordials_regexp = require('../primordials/regexp.js');
 const require_primordials_array = require('../primordials/array.js');
-const require_objects_mutate = require('../objects/mutate.js');
 const require_constants_socket = require('../constants/socket.js');
+const require_objects_mutate = require('../objects/mutate.js');
 const require_regexps_escape = require('../regexps/escape.js');
 const require_packages_metadata_extensions = require('./metadata-extensions.js');
 let src_external_normalize_package_data = require("../external/normalize-package-data");

package/dist/packages/provenance.js

@@ -3,10 +3,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_buffer = require('../primordials/buffer.js');
-const require_abort_signal = require('../abort/signal.js');
 const require_primordials_object = require('../primordials/object.js');
-const require_objects_predicates = require('../objects/predicates.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_abort_signal = require('../abort/signal.js');
+const require_objects_predicates = require('../objects/predicates.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_primordials_json = require('../primordials/json.js');
 const require_constants_agents = require('../constants/agents.js');

package/dist/packages/specs.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
-const require_objects_predicates = require('../objects/predicates.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_objects_predicates = require('../objects/predicates.js');
 const require_strings_predicates = require('../strings/predicates.js');
 const require_constants_socket = require('../constants/socket.js');
 const require_smol_purl = require('../smol/purl.js');

package/dist/paths/_internal.d.ts

@@ -9,13 +9,7 @@
  *   - `pathLikeToString` — `string | Buffer | URL` → `string`
  */
 import type nodeUrl from 'node:url';
-export declare const CHAR_BACKWARD_SLASH = 92;
-export declare const CHAR_COLON = 58;
-export declare const CHAR_FORWARD_SLASH = 47;
-export declare const CHAR_LOWERCASE_A = 97;
-export declare const CHAR_LOWERCASE_Z = 122;
-export declare const CHAR_UPPERCASE_A = 65;
-export declare const CHAR_UPPERCASE_Z = 90;
+export { CHAR_BACKWARD_SLASH, CHAR_COLON, CHAR_FORWARD_SLASH, CHAR_LOWERCASE_A, CHAR_LOWERCASE_Z, CHAR_UPPERCASE_A, CHAR_UPPERCASE_Z, } from '../constants/encoding';
 export declare const msysDriveRegExp: RegExp;
 export declare const nodeModulesPathRegExp: RegExp;
 export declare const slashRegExp: RegExp;

package/dist/paths/_internal.js

@@ -2,17 +2,11 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_buffer = require('../primordials/buffer.js');
-const require_constants_platform = require('../constants/platform.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_constants_platform = require('../constants/platform.js');
+const require_constants_encoding = require('../constants/encoding.js');
 
 //#region src/paths/_internal.ts
-const CHAR_BACKWARD_SLASH = 92;
-const CHAR_COLON = 58;
-const CHAR_FORWARD_SLASH = 47;
-const CHAR_LOWERCASE_A = 97;
-const CHAR_LOWERCASE_Z = 122;
-const CHAR_UPPERCASE_A = 65;
-const CHAR_UPPERCASE_Z = 90;
 const msysDriveRegExp = /^\/([a-zA-Z])($|\/)/;
 const nodeModulesPathRegExp = /(?:[/\\]|^)node_modules(?:$|[/\\])/;
 const slashRegExp = /[/\\]/;
@@ -72,13 +66,13 @@ function pathLikeToString(pathLike) {
 }
 
 //#endregion
-exports.CHAR_BACKWARD_SLASH = CHAR_BACKWARD_SLASH;
-exports.CHAR_COLON = CHAR_COLON;
-exports.CHAR_FORWARD_SLASH = CHAR_FORWARD_SLASH;
-exports.CHAR_LOWERCASE_A = CHAR_LOWERCASE_A;
-exports.CHAR_LOWERCASE_Z = CHAR_LOWERCASE_Z;
-exports.CHAR_UPPERCASE_A = CHAR_UPPERCASE_A;
-exports.CHAR_UPPERCASE_Z = CHAR_UPPERCASE_Z;
+exports.CHAR_BACKWARD_SLASH = require_constants_encoding.CHAR_BACKWARD_SLASH;
+exports.CHAR_COLON = require_constants_encoding.CHAR_COLON;
+exports.CHAR_FORWARD_SLASH = require_constants_encoding.CHAR_FORWARD_SLASH;
+exports.CHAR_LOWERCASE_A = require_constants_encoding.CHAR_LOWERCASE_A;
+exports.CHAR_LOWERCASE_Z = require_constants_encoding.CHAR_LOWERCASE_Z;
+exports.CHAR_UPPERCASE_A = require_constants_encoding.CHAR_UPPERCASE_A;
+exports.CHAR_UPPERCASE_Z = require_constants_encoding.CHAR_UPPERCASE_Z;
 exports.getUrl = getUrl;
 exports.msysDriveRegExp = msysDriveRegExp;
 exports.nodeModulesPathRegExp = nodeModulesPathRegExp;

package/dist/paths/conversion.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_constants_platform = require('../constants/platform.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_constants_platform = require('../constants/platform.js');
 const require_paths__internal = require('./_internal.js');
 const require_paths_normalize = require('./normalize.js');
 

package/dist/paths/normalize.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_constants_platform = require('../constants/platform.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_constants_platform = require('../constants/platform.js');
 const require_strings_search = require('../strings/search.js');
 const require_paths__internal = require('./_internal.js');
 const require_paths_conversion = require('./conversion.js');

package/dist/paths/predicates.js

@@ -1,8 +1,9 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_constants_platform = require('../constants/platform.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_constants_platform = require('../constants/platform.js');
+const require_constants_encoding = require('../constants/encoding.js');
 const require_paths__internal = require('./_internal.js');
 const require_primordials_regexp = require('../primordials/regexp.js');
 

package/dist/paths/socket.d.ts

@@ -23,6 +23,26 @@ export declare function getOsHomeDir(): string;
  * setPath('tmpdir', ...) from paths/rewire.
  */
 export declare function getOsTmpDir(): string;
+/**
+ * Resolve the runtime socket path for a local daemon named `name`. Distinct
+ * from getSocketAppRuntimeDir (the persistent ~/.socket/_state/<app>/run/
+ * home): the SOCKET endpoint itself belongs in the ephemeral, owner-only XDG
+ * runtime dir — correctly permissioned and auto-cleaned on logout — while the
+ * downloaded daemon binary + durable token cache live under ~/.socket. The
+ * daemon and every client MUST compute the identical path (1 path, 1
+ * reference), so this is the single resolver both sides call.
+ *
+ * Resolution:
+ *
+ * - Windows: `\\.\pipe\<name>-sock` (named pipe; Unix sockets are unavailable
+ *   pre-Win10 1803, same framing/semantics). Returned raw — a pipe path is not
+ *   a filesystem path and must not be slash-normalized.
+ * - `$XDG_RUNTIME_DIR/<name>.sock` when XDG_RUNTIME_DIR is set (systemd
+ *   `/run/user/<uid>/`).
+ * - Else `$TMPDIR/<name>-<uid>.sock` (the `<uid>` suffix avoids collisions when
+ *   TMPDIR is shared across users on a multi-tenant box).
+ */
+export declare function getRuntimeSocketPath(name: string): string;
 /**
  * Get a Socket app cache directory (~/.socket/_<appName>/cache).
  */
@@ -100,12 +120,47 @@ export declare function getSocketDlxDir(): string;
  */
 export declare function getSocketHomePath(): string;
 /**
- * Get the Socket state directory (~/.socket/_state) — version-LESS persistent
- * app state (the home for daemon sockets, locks, OAuth refresh, durable caches
- * that survive version bumps; mirrors pnpm `state-dir` / XDG_STATE_HOME).
- * Override precedence: setPath('socket-state-dir', …) → SOCKET_STATE_DIR env →
- * $SOCKET_HOME/_state → $HOME/.socket/_state.
+ * Get the Wheelhouse rack directory (~/.socket/_wheelhouse/rack) — the tool
+ * STORE. Every `_wheelhouse`-managed CLI tool keeps its real binaries here,
+ * racked by name + version as `<rack>/<tool>/<version>/…` (the wheelhouse
+ * analog of Homebrew's `Cellar/`). The handles on PATH live in
+ * `<wheelhouse>/bin` (getSocketWheelhouseBinDir) and point into the rack.
+ * Inherits the `_wheelhouse` override chain (SOCKET_HOME /
+ * setPath('socket-wheelhouse-dir')).
+ */
+export declare function getSocketRackDir(): string;
+/**
+ * Get a racked tool's version directory (~/.socket/_wheelhouse/rack/<tool>/
+ * <version>) — the per-tool, per-version home under the rack. The
+ * 1-path-1-reference owner of a tool install destination: installers resolve
+ * their extract/copy target through this, and the `<wheelhouse>/bin/<tool>`
+ * shim points at a binary inside it.
+ */
+export declare function getSocketRackToolDir(options: {
+    tool: string;
+    version: string;
+}): string;
+/**
+ * Get the Wheelhouse repo-clones directory (~/.socket/_wheelhouse/repo-clones).
+ * Sits beside the per-tool dirs (sfw, codedb, janus, bin) under `_wheelhouse`.
+ * The home for reference clones of EXTERNAL repos an agent reviews, each as
+ * `<org>-<repo>` lowercased + dash-cased (e.g. `justrach-codedb`).
+ *
+ * Smallest-practical clone form (smallest disk + fastest initial fetch without
+ * the treeless tax): git clone --depth=1 --single-branch --filter=blob:none
+ * <url> <dest> `--depth=1` truncates history, `--single-branch` skips other
+ * refs, and `--filter=blob:none` (a BLOBLESS partial clone) fetches file blobs
+ * lazily on first access — so the initial download is tree-metadata only.
+ * (Treeless `--filter=tree:0` is smaller still but refetches trees on every
+ * walk, which is slow + breaks offline, so it is NOT the default.)
+ *
+ * Deliberately OUTSIDE `~/projects/` so the fleet's sibling-walk tooling (e.g.
+ * cascade `--all`) never mistakes a reference clone for a fleet member
+ * checkout. Disposable: a reference cache, not a working tree. Inherits the
+ * `_wheelhouse` override chain (SOCKET_HOME /
+ * setPath('socket-wheelhouse-dir')).
  */
+export declare function getSocketRepoClonesDir(): string;
 /**
  * Get the Socket state directory (~/.socket/_state) — version-LESS persistent
  * app state (the home for daemon sockets, locks, OAuth refresh, durable caches
@@ -114,11 +169,6 @@ export declare function getSocketHomePath(): string;
  * $SOCKET_HOME/_state → $HOME/.socket/_state.
  */
 export declare function getSocketStateDir(): string;
-/**
- * Get an app's persistent state directory (~/.socket/_state/<app>/). The
- * `<app>` is a real app (proteus, acorn) nesting its version-less state inside
- * the `_state` infra dir.
- */
 /**
  * Get the Socket user directory (~/.socket). Override precedence:
  * setPath('socket-user-dir', …) → SOCKET_HOME env → $HOME/.socket →
@@ -126,24 +176,25 @@ export declare function getSocketStateDir(): string;
  */
 export declare function getSocketUserDir(): string;
 /**
- * Get the Socket Wheelhouse directory (~/.socket/_wheelhouse). Shared
- * cross-fleet location for binaries that every fleet member can reach without
- * each one re-downloading and re-extracting per-repo. Tool installers (janus,
- * sfw, etc.) drop their resolved executables under
- * `<wheelhouse>/<tool>/<version>/<platform-arch>/`; consumers add the
- * appropriate `bin/` to PATH or invoke the binary by absolute path. Override
- * precedence: setPath('socket-wheelhouse-dir', …) → $SOCKET_HOME/_wheelhouse →
- * $HOME/.socket/_wheelhouse.
+ * Get the Wheelhouse bin directory (~/.socket/_wheelhouse/bin) — the single
+ * directory placed on PATH. Holds only flat handles (thin exec shims or
+ * symlinks), one per tool, each pointing at a real binary racked under
+ * `<wheelhouse>/rack/<tool>/<version>/…` (getSocketRackToolDir). The shim IS
+ * the bin, the npm `prefix/bin` / Homebrew `bin/` model: PATH lookup does not
+ * recurse, so this dir stays flat (never a `bin/<tool>/` subdir). Inherits the
+ * `_wheelhouse` override chain (SOCKET_HOME /
+ * setPath('socket-wheelhouse-dir')).
  */
+export declare function getSocketWheelhouseBinDir(): string;
 /**
  * Get the Socket Wheelhouse directory (~/.socket/_wheelhouse). Shared
  * cross-fleet location for binaries that every fleet member can reach without
  * each one re-downloading and re-extracting per-repo. Tool installers (janus,
- * sfw, etc.) drop their resolved executables under
- * `<wheelhouse>/<tool>/<version>/<platform-arch>/`; consumers add the
- * appropriate `bin/` to PATH or invoke the binary by absolute path. Override
- * precedence: setPath('socket-wheelhouse-dir', …) → $SOCKET_HOME/_wheelhouse →
- * $HOME/.socket/_wheelhouse.
+ * sfw, etc.) rack their resolved executables under
+ * `<wheelhouse>/rack/<tool>/<version>/…` (getSocketRackToolDir) and expose a
+ * handle in `<wheelhouse>/bin` (getSocketWheelhouseBinDir); consumers add that
+ * one `bin/` to PATH. Override precedence: setPath('socket-wheelhouse-dir', …)
+ * → $SOCKET_HOME/_wheelhouse → $HOME/.socket/_wheelhouse.
  */
 export declare function getSocketWheelhouseDir(): string;
 /**

package/dist/paths/socket.js

@@ -2,7 +2,9 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_node_os = require('../node/os.js');
+const require_constants_platform = require('../constants/platform.js');
 const require_env_home = require('../env/home.js');
+const require_env_xdg = require('../env/xdg.js');
 const require_paths_normalize = require('./normalize.js');
 const require_node_path = require('../node/path.js');
 const require_env_socket = require('../env/socket.js');
@@ -44,6 +46,33 @@ function getOsTmpDir() {
 	return require_paths_rewire.getPathValue("tmpdir", () => os.tmpdir());
 }
 /**
+* Resolve the runtime socket path for a local daemon named `name`. Distinct
+* from getSocketAppRuntimeDir (the persistent ~/.socket/_state/<app>/run/
+* home): the SOCKET endpoint itself belongs in the ephemeral, owner-only XDG
+* runtime dir — correctly permissioned and auto-cleaned on logout — while the
+* downloaded daemon binary + durable token cache live under ~/.socket. The
+* daemon and every client MUST compute the identical path (1 path, 1
+* reference), so this is the single resolver both sides call.
+*
+* Resolution:
+*
+* - Windows: `\\.\pipe\<name>-sock` (named pipe; Unix sockets are unavailable
+*   pre-Win10 1803, same framing/semantics). Returned raw — a pipe path is not
+*   a filesystem path and must not be slash-normalized.
+* - `$XDG_RUNTIME_DIR/<name>.sock` when XDG_RUNTIME_DIR is set (systemd
+*   `/run/user/<uid>/`).
+* - Else `$TMPDIR/<name>-<uid>.sock` (the `<uid>` suffix avoids collisions when
+*   TMPDIR is shared across users on a multi-tenant box).
+*/
+function getRuntimeSocketPath(name) {
+	if (require_constants_platform.WIN32) return `\\\\.\\pipe\\${name}-sock`;
+	const path = require_node_path.getNodePath();
+	const xdgRuntimeDir = require_env_xdg.getXdgRuntimeDir();
+	if (xdgRuntimeDir) return require_paths_normalize.normalizePath(path.join(xdgRuntimeDir, `${name}.sock`));
+	const { uid } = require_node_os.getNodeOs().userInfo();
+	return require_paths_normalize.normalizePath(path.join(getOsTmpDir(), `${name}-${uid}.sock`));
+}
+/**
 * Get a Socket app cache directory (~/.socket/_<appName>/cache).
 */
 /**
@@ -142,12 +171,54 @@ function getSocketHomePath() {
 	return getSocketUserDir();
 }
 /**
-* Get the Socket state directory (~/.socket/_state) — version-LESS persistent
-* app state (the home for daemon sockets, locks, OAuth refresh, durable caches
-* that survive version bumps; mirrors pnpm `state-dir` / XDG_STATE_HOME).
-* Override precedence: setPath('socket-state-dir', …) → SOCKET_STATE_DIR env →
-* $SOCKET_HOME/_state → $HOME/.socket/_state.
+* Get the Wheelhouse rack directory (~/.socket/_wheelhouse/rack) — the tool
+* STORE. Every `_wheelhouse`-managed CLI tool keeps its real binaries here,
+* racked by name + version as `<rack>/<tool>/<version>/…` (the wheelhouse
+* analog of Homebrew's `Cellar/`). The handles on PATH live in
+* `<wheelhouse>/bin` (getSocketWheelhouseBinDir) and point into the rack.
+* Inherits the `_wheelhouse` override chain (SOCKET_HOME /
+* setPath('socket-wheelhouse-dir')).
+*/
+function getSocketRackDir() {
+	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketWheelhouseDir(), "rack"));
+}
+/**
+* Get a racked tool's version directory (~/.socket/_wheelhouse/rack/<tool>/
+* <version>) — the per-tool, per-version home under the rack. The
+* 1-path-1-reference owner of a tool install destination: installers resolve
+* their extract/copy target through this, and the `<wheelhouse>/bin/<tool>`
+* shim points at a binary inside it.
+*/
+function getSocketRackToolDir(options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketRackDir(), opts.tool, opts.version));
+}
+/**
+* Get the Wheelhouse repo-clones directory (~/.socket/_wheelhouse/repo-clones).
+* Sits beside the per-tool dirs (sfw, codedb, janus, bin) under `_wheelhouse`.
+* The home for reference clones of EXTERNAL repos an agent reviews, each as
+* `<org>-<repo>` lowercased + dash-cased (e.g. `justrach-codedb`).
+*
+* Smallest-practical clone form (smallest disk + fastest initial fetch without
+* the treeless tax): git clone --depth=1 --single-branch --filter=blob:none
+* <url> <dest> `--depth=1` truncates history, `--single-branch` skips other
+* refs, and `--filter=blob:none` (a BLOBLESS partial clone) fetches file blobs
+* lazily on first access — so the initial download is tree-metadata only.
+* (Treeless `--filter=tree:0` is smaller still but refetches trees on every
+* walk, which is slow + breaks offline, so it is NOT the default.)
+*
+* Deliberately OUTSIDE `~/projects/` so the fleet's sibling-walk tooling (e.g.
+* cascade `--all`) never mistakes a reference clone for a fleet member
+* checkout. Disposable: a reference cache, not a working tree. Inherits the
+* `_wheelhouse` override chain (SOCKET_HOME /
+* setPath('socket-wheelhouse-dir')).
 */
+function getSocketRepoClonesDir() {
+	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketWheelhouseDir(), "repo-clones"));
+}
 /**
 * Get the Socket state directory (~/.socket/_state) — version-LESS persistent
 * app state (the home for daemon sockets, locks, OAuth refresh, durable caches
@@ -162,11 +233,6 @@ function getSocketStateDir() {
 	});
 }
 /**
-* Get an app's persistent state directory (~/.socket/_state/<app>/). The
-* `<app>` is a real app (proteus, acorn) nesting its version-less state inside
-* the `_state` infra dir.
-*/
-/**
 * Get the Socket user directory (~/.socket). Override precedence:
 * setPath('socket-user-dir', …) → SOCKET_HOME env → $HOME/.socket →
 * /tmp/.socket (Unix) or %TEMP%.socket (Windows).
@@ -179,24 +245,27 @@ function getSocketUserDir() {
 	});
 }
 /**
-* Get the Socket Wheelhouse directory (~/.socket/_wheelhouse). Shared
-* cross-fleet location for binaries that every fleet member can reach without
-* each one re-downloading and re-extracting per-repo. Tool installers (janus,
-* sfw, etc.) drop their resolved executables under
-* `<wheelhouse>/<tool>/<version>/<platform-arch>/`; consumers add the
-* appropriate `bin/` to PATH or invoke the binary by absolute path. Override
-* precedence: setPath('socket-wheelhouse-dir', …) → $SOCKET_HOME/_wheelhouse →
-* $HOME/.socket/_wheelhouse.
+* Get the Wheelhouse bin directory (~/.socket/_wheelhouse/bin) — the single
+* directory placed on PATH. Holds only flat handles (thin exec shims or
+* symlinks), one per tool, each pointing at a real binary racked under
+* `<wheelhouse>/rack/<tool>/<version>/…` (getSocketRackToolDir). The shim IS
+* the bin, the npm `prefix/bin` / Homebrew `bin/` model: PATH lookup does not
+* recurse, so this dir stays flat (never a `bin/<tool>/` subdir). Inherits the
+* `_wheelhouse` override chain (SOCKET_HOME /
+* setPath('socket-wheelhouse-dir')).
 */
+function getSocketWheelhouseBinDir() {
+	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketWheelhouseDir(), "bin"));
+}
 /**
 * Get the Socket Wheelhouse directory (~/.socket/_wheelhouse). Shared
 * cross-fleet location for binaries that every fleet member can reach without
 * each one re-downloading and re-extracting per-repo. Tool installers (janus,
-* sfw, etc.) drop their resolved executables under
-* `<wheelhouse>/<tool>/<version>/<platform-arch>/`; consumers add the
-* appropriate `bin/` to PATH or invoke the binary by absolute path. Override
-* precedence: setPath('socket-wheelhouse-dir', …) → $SOCKET_HOME/_wheelhouse →
-* $HOME/.socket/_wheelhouse.
+* sfw, etc.) rack their resolved executables under
+* `<wheelhouse>/rack/<tool>/<version>/…` (getSocketRackToolDir) and expose a
+* handle in `<wheelhouse>/bin` (getSocketWheelhouseBinDir); consumers add that
+* one `bin/` to PATH. Override precedence: setPath('socket-wheelhouse-dir', …)
+* → $SOCKET_HOME/_wheelhouse → $HOME/.socket/_wheelhouse.
 */
 function getSocketWheelhouseDir() {
 	return require_paths_rewire.getPathValue("socket-wheelhouse-dir", () => {
@@ -234,6 +303,7 @@ function getUserHomeDir() {
 //#endregion
 exports.getOsHomeDir = getOsHomeDir;
 exports.getOsTmpDir = getOsTmpDir;
+exports.getRuntimeSocketPath = getRuntimeSocketPath;
 exports.getSocketAppCacheDir = getSocketAppCacheDir;
 exports.getSocketAppCacheTtlDir = getSocketAppCacheTtlDir;
 exports.getSocketAppDir = getSocketAppDir;
@@ -242,7 +312,11 @@ exports.getSocketAppStateDir = getSocketAppStateDir;
 exports.getSocketCacacheDir = getSocketCacacheDir;
 exports.getSocketDlxDir = getSocketDlxDir;
 exports.getSocketHomePath = getSocketHomePath;
+exports.getSocketRackDir = getSocketRackDir;
+exports.getSocketRackToolDir = getSocketRackToolDir;
+exports.getSocketRepoClonesDir = getSocketRepoClonesDir;
 exports.getSocketStateDir = getSocketStateDir;
 exports.getSocketUserDir = getSocketUserDir;
+exports.getSocketWheelhouseBinDir = getSocketWheelhouseBinDir;
 exports.getSocketWheelhouseDir = getSocketWheelhouseDir;
 exports.getUserHomeDir = getUserHomeDir;

package/dist/perf/metrics.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_primordials_math = require('../primordials/math.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_primordials_math = require('../primordials/math.js');
 const require_debug_output = require('../debug/output.js');
 const require_perf__internal = require('./_internal.js');
 

package/dist/perf/report.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_primordials_math = require('../primordials/math.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_primordials_math = require('../primordials/math.js');
 const require_debug_output = require('../debug/output.js');
 const require_perf__internal = require('./_internal.js');
 const require_perf_enabled = require('./enabled.js');

package/dist/regexps/spec.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_primordials_map_set = require('../primordials/map-set.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_primordials_map_set = require('../primordials/map-set.js');
 const require_regexps_hex = require('./hex.js');
 
 //#region src/regexps/spec.ts

package/dist/schema/validate.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_error = require('../primordials/error.js');
-const require_primordials_number = require('../primordials/number.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_primordials_number = require('../primordials/number.js');
 const require_primordials_array = require('../primordials/array.js');
 
 //#region src/schema/validate.ts