@socketsecurity/lib 6.0.9 → 6.0.10

package/dist/paths/globs.js

@@ -8,9 +8,15 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 */
 const LICENSE_GLOB = "LICEN[CS]E{[.-]*,}";
 const LICENSE_GLOB_RECURSIVE = "**/LICEN[CS]E{[.-]*,}";
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const LICENSE_ORIGINAL_GLOB = "*.original{.*,}";
 const LICENSE_ORIGINAL_GLOB_RECURSIVE = "**/*.original{.*,}";
 const README_GLOB = "README{.*,}";
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const README_GLOB_RECURSIVE = "**/README{.*,}";
 
 //#endregion

package/dist/paths/resolve.js

@@ -1,6 +1,11 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_string = require('../primordials/string.js');
+const require_constants_platform = require('../constants/platform.js');
+const require_constants_encoding = require('../constants/encoding.js');
+const require_paths_predicates = require('./predicates.js');
+const require_paths_normalize = require('./normalize.js');
 
 //#region src/paths/resolve.ts
 /**
@@ -39,7 +44,7 @@ function relative(from, to) {
 	const actualTo = resolve(to);
 	if (actualFrom === actualTo) return "";
 	/* c8 ignore start - Windows-only case-insensitive comparison. */
-	if (WIN32) {
+	if (require_constants_platform.WIN32) {
 		if (actualFrom.toLowerCase() === actualTo.toLowerCase()) return "";
 	}
 	/* c8 ignore stop */
@@ -52,32 +57,32 @@ function relative(from, to) {
 	let lastCommonSep = -1;
 	let i = 0;
 	for (; i < length; i += 1) {
-		let fromCode = StringPrototypeCharCodeAt(actualFrom, fromStart + i);
-		let toCode = StringPrototypeCharCodeAt(actualTo, toStart + i);
+		let fromCode = require_primordials_string.StringPrototypeCharCodeAt(actualFrom, fromStart + i);
+		let toCode = require_primordials_string.StringPrototypeCharCodeAt(actualTo, toStart + i);
 		/* c8 ignore start - Windows-only case folding. */
-		if (WIN32) {
-			if (fromCode >= CHAR_UPPERCASE_A && fromCode <= CHAR_UPPERCASE_Z) fromCode += 32;
-			if (toCode >= CHAR_UPPERCASE_A && toCode <= CHAR_UPPERCASE_Z) toCode += 32;
+		if (require_constants_platform.WIN32) {
+			if (fromCode >= 65 && fromCode <= 90) fromCode += 32;
+			if (toCode >= 65 && toCode <= 90) toCode += 32;
 		}
 		/* c8 ignore stop */
 		if (fromCode !== toCode) break;
-		if (isPathSeparator(StringPrototypeCharCodeAt(actualFrom, fromStart + i))) lastCommonSep = i;
+		if (require_paths_predicates.isPathSeparator(require_primordials_string.StringPrototypeCharCodeAt(actualFrom, fromStart + i))) lastCommonSep = i;
 	}
 	/* c8 ignore start */
 	if (i === length) {
 		if (toLen > length) {
-			if (isPathSeparator(StringPrototypeCharCodeAt(actualTo, toStart + i))) return actualTo.slice(toStart + i + 1);
+			if (require_paths_predicates.isPathSeparator(require_primordials_string.StringPrototypeCharCodeAt(actualTo, toStart + i))) return actualTo.slice(toStart + i + 1);
 			if (i === 0) return actualTo.slice(toStart + i);
 		} else if (fromLen > length) {
-			if (isPathSeparator(StringPrototypeCharCodeAt(actualFrom, fromStart + i))) lastCommonSep = i;
+			if (require_paths_predicates.isPathSeparator(require_primordials_string.StringPrototypeCharCodeAt(actualFrom, fromStart + i))) lastCommonSep = i;
 			else if (i === 0) lastCommonSep = 0;
 		}
 	}
 	/* c8 ignore stop */
 	let out = "";
 	for (i = fromStart + lastCommonSep + 1; i <= fromEnd; i += 1) {
-		const code = StringPrototypeCharCodeAt(actualFrom, i);
-		if (i === fromEnd || isPathSeparator(code)) out += out.length === 0 ? ".." : "/..";
+		const code = require_primordials_string.StringPrototypeCharCodeAt(actualFrom, i);
+		if (i === fromEnd || require_paths_predicates.isPathSeparator(code)) out += out.length === 0 ? ".." : "/..";
 	}
 	return out + actualTo.slice(toStart + lastCommonSep);
 }
@@ -103,7 +108,7 @@ function relative(from, to) {
 function relativeResolve(from, to) {
 	const rel = relative(from, to);
 	if (rel === "") return "";
-	return normalizePath(rel);
+	return require_paths_normalize.normalizePath(rel);
 }
 /**
 * Resolve an absolute path from path segments.
@@ -132,11 +137,11 @@ function resolve(...segments) {
 		/* c8 ignore start */
 		if (typeof segment !== "string" || segment.length === 0) continue;
 		resolvedPath = segment + (resolvedPath.length === 0 ? "" : `/${resolvedPath}`);
-		resolvedAbsolute = isAbsolute(segment);
+		resolvedAbsolute = require_paths_predicates.isAbsolute(segment);
 	}
 	if (!resolvedAbsolute) resolvedPath = /* @__PURE__ */ require("node:process").cwd() + (resolvedPath.length === 0 ? "" : `/${resolvedPath}`);
 	/* c8 ignore stop */
-	return normalizePath(resolvedPath);
+	return require_paths_normalize.normalizePath(resolvedPath);
 }
 
 //#endregion

package/dist/paths/socket.d.ts

@@ -5,8 +5,8 @@
  *   `_dlx/<hash>/` name+version binary store (node, jre, python, sfw, …);
  *   `_state/<app>/` version-LESS persistent app state (daemon socket + lock +
  *   OAuth refresh; mirrors pnpm `state-dir` / XDG_STATE_HOME), with
- *   `_state/<app>/run/` for a daemon's socket/lock/pid; `_wheelhouse`
- *   cross-fleet shared bin. Generic per-app dirs (`getSocketAppDir('<name>')`)
+ *   `_state/<app>/run/` for a daemon's socket/lock/pid; `_wheelhouse` shared
+ *   bin across Socket tools. Generic per-app dirs (`getSocketAppDir('<name>')`)
  *   nest under the same `_`-prefix.
  */
 /**
@@ -154,8 +154,8 @@ export declare function getSocketRackToolDir(options: {
  * (Treeless `--filter=tree:0` is smaller still but refetches trees on every
  * walk, which is slow + breaks offline, so it is NOT the default.)
  *
- * Deliberately OUTSIDE `~/projects/` so the fleet's sibling-walk tooling (e.g.
- * cascade `--all`) never mistakes a reference clone for a fleet member
+ * Deliberately OUTSIDE `~/projects/` so Socket's sibling-walk tooling (e.g.
+ * cascade `--all`) never mistakes a reference clone for a Socket repo
  * checkout. Disposable: a reference cache, not a working tree. Inherits the
  * `_wheelhouse` override chain (SOCKET_HOME /
  * setPath('socket-wheelhouse-dir')).
@@ -187,10 +187,10 @@ export declare function getSocketUserDir(): string;
  */
 export declare function getSocketWheelhouseBinDir(): string;
 /**
- * Get the Socket Wheelhouse directory (~/.socket/_wheelhouse). Shared
- * cross-fleet location for binaries that every fleet member can reach without
- * each one re-downloading and re-extracting per-repo. Tool installers (janus,
- * sfw, etc.) rack their resolved executables under
+ * Get the Socket Wheelhouse directory (~/.socket/_wheelhouse). Shared location,
+ * common across Socket repos, for binaries that every Socket repo can reach
+ * without each one re-downloading and re-extracting per-repo. Tool installers
+ * (janus, sfw, etc.) rack their resolved executables under
  * `<wheelhouse>/rack/<tool>/<version>/…` (getSocketRackToolDir) and expose a
  * handle in `<wheelhouse>/bin` (getSocketWheelhouseBinDir); consumers add that
  * one `bin/` to PATH. Override precedence: setPath('socket-wheelhouse-dir', …)

package/dist/paths/socket.js

@@ -21,8 +21,8 @@ const require_paths_rewire = require('./rewire.js');
 *   `_dlx/<hash>/` name+version binary store (node, jre, python, sfw, …);
 *   `_state/<app>/` version-LESS persistent app state (daemon socket + lock +
 *   OAuth refresh; mirrors pnpm `state-dir` / XDG_STATE_HOME), with
-*   `_state/<app>/run/` for a daemon's socket/lock/pid; `_wheelhouse`
-*   cross-fleet shared bin. Generic per-app dirs (`getSocketAppDir('<name>')`)
+*   `_state/<app>/run/` for a daemon's socket/lock/pid; `_wheelhouse` shared
+*   bin across Socket tools. Generic per-app dirs (`getSocketAppDir('<name>')`)
 *   nest under the same `_`-prefix.
 */
 /**
@@ -210,8 +210,8 @@ function getSocketRackToolDir(options) {
 * (Treeless `--filter=tree:0` is smaller still but refetches trees on every
 * walk, which is slow + breaks offline, so it is NOT the default.)
 *
-* Deliberately OUTSIDE `~/projects/` so the fleet's sibling-walk tooling (e.g.
-* cascade `--all`) never mistakes a reference clone for a fleet member
+* Deliberately OUTSIDE `~/projects/` so Socket's sibling-walk tooling (e.g.
+* cascade `--all`) never mistakes a reference clone for a Socket repo
 * checkout. Disposable: a reference cache, not a working tree. Inherits the
 * `_wheelhouse` override chain (SOCKET_HOME /
 * setPath('socket-wheelhouse-dir')).
@@ -258,10 +258,10 @@ function getSocketWheelhouseBinDir() {
 	return require_paths_normalize.normalizePath(require_node_path.getNodePath().join(getSocketWheelhouseDir(), "bin"));
 }
 /**
-* Get the Socket Wheelhouse directory (~/.socket/_wheelhouse). Shared
-* cross-fleet location for binaries that every fleet member can reach without
-* each one re-downloading and re-extracting per-repo. Tool installers (janus,
-* sfw, etc.) rack their resolved executables under
+* Get the Socket Wheelhouse directory (~/.socket/_wheelhouse). Shared location,
+* common across Socket repos, for binaries that every Socket repo can reach
+* without each one re-downloading and re-extracting per-repo. Tool installers
+* (janus, sfw, etc.) rack their resolved executables under
 * `<wheelhouse>/rack/<tool>/<version>/…` (getSocketRackToolDir) and expose a
 * handle in `<wheelhouse>/bin` (getSocketWheelhouseBinDir); consumers add that
 * one `bin/` to PATH. Override precedence: setPath('socket-wheelhouse-dir', …)

package/dist/perf/report.js

@@ -43,7 +43,8 @@ function generatePerformanceReport() {
 	let report = "\n╔═══════════════════════════════════════════════╗\n";
 	report += "║         Performance Report                    ║\n";
 	report += "╚═══════════════════════════════════════════════╝\n\n";
-	for (const operation of operations) {
+	for (let i = 0, { length } = operations; i < length; i += 1) {
+		const operation = operations[i];
 		const stats = summary[operation];
 		report += `${operation}:\n`;
 		report += `  Calls: ${stats.count}\n`;
@@ -72,7 +73,8 @@ function printPerformanceSummary() {
 	const summary = require_perf_metrics.getPerformanceSummary();
 	const operations = require_primordials_object.ObjectKeys(summary).toSorted();
 	require_debug_output.debugLog("[perf]\n=== Performance Summary ===");
-	for (const operation of operations) {
+	for (let i = 0, { length } = operations; i < length; i += 1) {
+		const operation = operations[i];
 		const stats = summary[operation];
 		require_debug_output.debugLog(`[perf] ${operation}: ${stats.count} calls, avg ${stats.avg}ms (min ${stats.min}ms, max ${stats.max}ms, total ${stats.total}ms)`);
 	}

package/dist/pkg-ext/data.js

@@ -1,9 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
 let src_external__yarnpkg_extensions = require("../external/@yarnpkg/extensions");
-src_external__yarnpkg_extensions = require_runtime.__toESM(src_external__yarnpkg_extensions);
 
 //#region src/pkg-ext/data.ts
 /**

package/dist/primordials/globals.d.ts

@@ -9,7 +9,7 @@
 export declare const BigIntCtor: BigIntConstructor;
 export declare const BooleanCtor: BooleanConstructor;
 export declare const ProxyCtor: ProxyConstructor;
-export declare const SharedArrayBufferCtor: SharedArrayBufferConstructor;
+export declare const SharedArrayBufferCtor: SharedArrayBufferConstructor | undefined;
 export declare const InfinityValue: number;
 export declare const NaNValue: number;
 declare const capturedGlobalThis: typeof globalThis;

package/dist/primordials/globals.js

@@ -14,7 +14,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const BigIntCtor = BigInt;
 const BooleanCtor = Boolean;
 const ProxyCtor = Proxy;
-const SharedArrayBufferCtor = SharedArrayBuffer;
+const SharedArrayBufferCtor = typeof SharedArrayBuffer === "undefined" ? void 0 : SharedArrayBuffer;
 const InfinityValue = Infinity;
 const NaNValue = NaN;
 const capturedGlobalThis = globalThis;

package/dist/primordials/headers.d.ts

@@ -1,10 +1,22 @@
 /**
  * @file Safe references to the Fetch `Headers` constructor and its
- *   `Headers.prototype` methods. `Headers` is a global on Node 22+ (the fleet
+ *   `Headers.prototype` methods. `Headers` is a global on Node 22+ (Socket's
  *   floor), captured unguarded like `URL` / `URLSearchParams`.
  */
+/**
+ * @unused No internal or Socket consumers.
+ */
 export declare const HeadersCtor: typeof Headers;
 export declare const HeadersPrototypeForEach: (self: unknown, callbackfn: (value: string, key: string, parent: Headers) => void, thisArg?: any) => void;
+/**
+ * @unused No internal or Socket consumers.
+ */
 export declare const HeadersPrototypeGet: (self: unknown, name: string) => string | null;
+/**
+ * @unused No internal or Socket consumers.
+ */
 export declare const HeadersPrototypeHas: (self: unknown, name: string) => boolean;
+/**
+ * @unused No internal or Socket consumers.
+ */
 export declare const HeadersPrototypeSet: (self: unknown, name: string, value: string) => void;

package/dist/primordials/headers.js

@@ -6,13 +6,25 @@ const require_primordials_uncurry = require('./uncurry.js');
 //#region src/primordials/headers.ts
 /**
 * @file Safe references to the Fetch `Headers` constructor and its
-*   `Headers.prototype` methods. `Headers` is a global on Node 22+ (the fleet
+*   `Headers.prototype` methods. `Headers` is a global on Node 22+ (Socket's
 *   floor), captured unguarded like `URL` / `URLSearchParams`.
 */
+/**
+* @unused No internal or Socket consumers.
+*/
 const HeadersCtor = Headers;
 const HeadersPrototypeForEach = require_primordials_uncurry.uncurryThis(Headers.prototype.forEach);
+/**
+* @unused No internal or Socket consumers.
+*/
 const HeadersPrototypeGet = require_primordials_uncurry.uncurryThis(Headers.prototype.get);
+/**
+* @unused No internal or Socket consumers.
+*/
 const HeadersPrototypeHas = require_primordials_uncurry.uncurryThis(Headers.prototype.has);
+/**
+* @unused No internal or Socket consumers.
+*/
 const HeadersPrototypeSet = require_primordials_uncurry.uncurryThis(Headers.prototype.set);
 
 //#endregion

package/dist/primordials/process.d.ts

@@ -7,7 +7,7 @@
  *   the method reference instead (`process.cwd.bind(process)`) would freeze it
  *   and break that test seam, so we deliberately keep the late call. Consumers
  *   read cwd / platform / env / argv through these instead of touching
- *   `process` directly; enforced fleet-wide by
+ *   `process` directly; enforced Socket-wide by
  *   `socket/prefer-process-primordial`. This is the `process` leaf of the
  *   node-module primordials: where `node/fs` / `node/path` lazy-load a `node:`
  *   module behind a function, this captures the always-present `process` global

package/dist/primordials/process.js

@@ -12,7 +12,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 *   the method reference instead (`process.cwd.bind(process)`) would freeze it
 *   and break that test seam, so we deliberately keep the late call. Consumers
 *   read cwd / platform / env / argv through these instead of touching
-*   `process` directly; enforced fleet-wide by
+*   `process` directly; enforced Socket-wide by
 *   `socket/prefer-process-primordial`. This is the `process` leaf of the
 *   node-module primordials: where `node/fs` / `node/path` lazy-load a `node:`
 *   module behind a function, this captures the always-present `process` global

package/dist/primordials/url.d.ts

@@ -4,10 +4,28 @@
  */
 export declare const URLCtor: typeof URL;
 export declare const URLSearchParamsCtor: typeof URLSearchParams;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const URLSearchParamsPrototypeAppend: (self: unknown, name: string, value: string) => void;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const URLSearchParamsPrototypeDelete: (self: unknown, name: string, value?: string | undefined) => void;
 export declare const URLSearchParamsPrototypeForEach: (self: unknown, callbackfn: (value: string, key: string, parent: URLSearchParams) => void, thisArg?: any) => void;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const URLSearchParamsPrototypeGet: (self: unknown, name: string) => string | null;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const URLSearchParamsPrototypeGetAll: (self: unknown, name: string) => string[];
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const URLSearchParamsPrototypeHas: (self: unknown, name: string, value?: string | undefined) => boolean;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare const URLSearchParamsPrototypeSet: (self: unknown, name: string, value: string) => void;

package/dist/primordials/url.js

@@ -10,12 +10,30 @@ const require_primordials_uncurry = require('./uncurry.js');
 */
 const URLCtor = URL;
 const URLSearchParamsCtor = URLSearchParams;
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const URLSearchParamsPrototypeAppend = require_primordials_uncurry.uncurryThis(URLSearchParams.prototype.append);
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const URLSearchParamsPrototypeDelete = require_primordials_uncurry.uncurryThis(URLSearchParams.prototype.delete);
 const URLSearchParamsPrototypeForEach = require_primordials_uncurry.uncurryThis(URLSearchParams.prototype.forEach);
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const URLSearchParamsPrototypeGet = require_primordials_uncurry.uncurryThis(URLSearchParams.prototype.get);
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const URLSearchParamsPrototypeGetAll = require_primordials_uncurry.uncurryThis(URLSearchParams.prototype.getAll);
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const URLSearchParamsPrototypeHas = require_primordials_uncurry.uncurryThis(URLSearchParams.prototype.has);
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 const URLSearchParamsPrototypeSet = require_primordials_uncurry.uncurryThis(URLSearchParams.prototype.set);
 
 //#endregion

package/dist/process/spawn/child.js

@@ -37,14 +37,12 @@ node_process = require_runtime.__toESM(node_process);
 *   - https://nodejs.org/api/child_process.html#child_processspawncommand-args-options
 *   - https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html
 */
-const abortSignal = require_process_abort.getAbortSignal();
-const spinner = require_spinner_default.getDefaultSpinner();
 function spawn(cmd, args, options, extra) {
-	const { spinner: optionsSpinner = spinner, stripAnsi: shouldStripAnsi = true, ...rawSpawnOptions } = {
+	const { spinner: optionsSpinner, stripAnsi: shouldStripAnsi = true, ...rawSpawnOptions } = {
 		__proto__: null,
 		...options
 	};
-	const spinnerInstance = optionsSpinner;
+	const spinnerInstance = optionsSpinner ?? require_spinner_default.getDefaultSpinner();
 	const spawnOptions = {
 		__proto__: null,
 		...rawSpawnOptions
@@ -89,7 +87,7 @@ function spawn(cmd, args, options, extra) {
 		__proto__: null,
 		cwd: typeof spawnOptions.cwd === "string" ? spawnOptions.cwd : void 0,
 		env: envToUse,
-		signal: abortSignal,
+		signal: require_process_abort.getAbortSignal(),
 		stdio: spawnOptions.stdio,
 		stdioString,
 		shell: spawnOptions.shell,

package/dist/promises/_internal.d.ts

@@ -4,7 +4,7 @@
  *   prefix excludes from public exports.
  */
 import type timersPromises from 'node:timers/promises';
-export declare const abortSignal: AbortSignal;
+export { getAbortSignal } from '../process/abort';
 /**
  * Get the timers/promises module. Lazy `require` (not a top-level import) to
  * avoid Webpack bundling issues.

package/dist/promises/_internal.js

@@ -5,7 +5,6 @@ const require_constants_runtime = require('../constants/runtime.js');
 const require_process_abort = require('../process/abort.js');
 
 //#region src/promises/_internal.ts
-const abortSignal = require_process_abort.getAbortSignal();
 /**
 * Get the timers/promises module. Lazy `require` (not a top-level import) to
 * avoid Webpack bundling issues.
@@ -26,5 +25,5 @@ function getTimers() {
 }
 
 //#endregion
-exports.abortSignal = abortSignal;
+exports.getAbortSignal = require_process_abort.getAbortSignal;
 exports.getTimers = getTimers;

package/dist/promises/options.js

@@ -2,7 +2,7 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_math = require('../primordials/math.js');
-const require_promises__internal = require('./_internal.js');
+const require_process_abort = require('../process/abort.js');
 
 //#region src/promises/options.ts
 /**
@@ -34,7 +34,7 @@ const require_promises__internal = require('./_internal.js');
 * @returns Normalized options with concurrency, retries, and signal
 */
 function normalizeIterationOptions(options) {
-	const { concurrency = 1, retries, signal = require_promises__internal.abortSignal } = {
+	const { concurrency = 1, retries, signal = require_process_abort.getAbortSignal() } = {
 		__proto__: null,
 		...typeof options === "number" ? { concurrency: options } : options
 	};
@@ -70,7 +70,7 @@ function normalizeIterationOptions(options) {
 * @returns Normalized retry options with all properties set
 */
 function normalizeRetryOptions(options) {
-	const { args = [], backoffFactor = 2, baseDelayMs = 200, jitter = true, maxDelayMs = 1e4, onRetry, onRetryCancelOnFalse = false, onRetryRethrow = false, retries = 0, signal = require_promises__internal.abortSignal } = resolveRetryOptions(options);
+	const { args = [], backoffFactor = 2, baseDelayMs = 200, jitter = true, maxDelayMs = 1e4, onRetry, onRetryCancelOnFalse = false, onRetryRethrow = false, retries = 0, signal = require_process_abort.getAbortSignal() } = resolveRetryOptions(options);
 	return {
 		args,
 		backoffFactor,

package/dist/releases/socket-btm-binary-naming.js

@@ -25,6 +25,17 @@ const ARCH_MAP = {
 	x64: "x64"
 };
 /**
+* Windows platform token per binary family. The node-smol pipeline names its
+* Windows assets with the RELEASE platform token (`node-win-x64.exe`), while
+* the binject/binflate/boringssl families keep `process.platform` verbatim
+* (`binject-win32-x64.exe`). Published releases are immutable, so this table
+* encodes the split rather than pretending one style exists.
+*/
+const WIN_TOKEN_BY_BASENAME = {
+	__proto__: null,
+	node: "win"
+};
+/**
 * Get asset name for a socket-btm binary.
 *
 * @example
@@ -47,7 +58,7 @@ function getBinaryAssetName(binaryBaseName, platform, arch, libc) {
 	const ext = platform === "win32" ? ".exe" : "";
 	if (platform === "darwin") return `${binaryBaseName}-darwin-${mappedArch}${ext}`;
 	if (platform === "linux") return `${binaryBaseName}-linux-${mappedArch}${muslSuffix}${ext}`;
-	if (platform === "win32") return `${binaryBaseName}-win32-${mappedArch}${ext}`;
+	if (platform === "win32") return `${binaryBaseName}-${WIN_TOKEN_BY_BASENAME[binaryBaseName] ?? "win32"}-${mappedArch}${ext}`;
 	throw new require_primordials_error.ErrorCtor(`Unsupported platform: ${platform}`);
 }
 /**

package/dist/secrets/_internal.d.ts

@@ -2,7 +2,7 @@
  * @file Private internals for `secrets/` — process-scoped read cache for the
  *   keychain backend. Underscore-prefixed and skipped by the export generator
  *   (`dist/**\/_*` ignore pattern in
- *   `scripts/post-build/make-package-exports.mts`) so this module is NOT part
+ *   `scripts/fleet/make-package-exports.mts`) so this module is NOT part
  *   of the public API surface. Imported by `./keychain.ts`. Every `readSecret`
  *   call shells out to the OS credential CLI (`security`, `secret-tool`,
  *   PowerShell). On macOS, the first read of a given entry by a new binary path

package/dist/secrets/_internal.js

@@ -8,7 +8,7 @@ const require_primordials_map_set = require('../primordials/map-set.js');
 * @file Private internals for `secrets/` — process-scoped read cache for the
 *   keychain backend. Underscore-prefixed and skipped by the export generator
 *   (`dist/**\/_*` ignore pattern in
-*   `scripts/post-build/make-package-exports.mts`) so this module is NOT part
+*   `scripts/fleet/make-package-exports.mts`) so this module is NOT part
 *   of the public API surface. Imported by `./keychain.ts`. Every `readSecret`
 *   call shells out to the OS credential CLI (`security`, `secret-tool`,
 *   PowerShell). On macOS, the first read of a given entry by a new binary path

package/dist/secrets/find.d.ts

@@ -1,8 +1,8 @@
 /**
- * @file Resolve a secret from the canonical fleet precedence order: process env
+ * @file Resolve a secret from the canonical Socket precedence order: process env
  *   → OS keychain. Returns the value + the source it came from so the caller
  *   can log which slot won. Why a helper instead of inlining: every consumer of
- *   the fleet's Socket API token does the same dance — check
+ *   the Socket API token does the same dance — check
  *   `process.env.SOCKET_API_TOKEN`, fall back to a legacy env-var alias, fall
  *   back to `readSecret({...})` from the keychain. Tools drift on the exact
  *   order and on which aliases they consider. This helper centralizes the

package/dist/secrets/find.js

@@ -6,10 +6,10 @@ const require_secrets_keychain = require('./keychain.js');
 
 //#region src/secrets/find.ts
 /**
-* @file Resolve a secret from the canonical fleet precedence order: process env
+* @file Resolve a secret from the canonical Socket precedence order: process env
 *   → OS keychain. Returns the value + the source it came from so the caller
 *   can log which slot won. Why a helper instead of inlining: every consumer of
-*   the fleet's Socket API token does the same dance — check
+*   the Socket API token does the same dance — check
 *   `process.env.SOCKET_API_TOKEN`, fall back to a legacy env-var alias, fall
 *   back to `readSecret({...})` from the keychain. Tools drift on the exact
 *   order and on which aliases they consider. This helper centralizes the

package/dist/secrets/keychain.d.ts

@@ -42,6 +42,9 @@ export interface DeleteFromSlotsOptions {
     accounts: readonly string[];
 }
 export declare function deleteSecretFromSlots({ service, accounts, }: DeleteFromSlotsOptions): Promise<SecretDeleteResult[]>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function deleteSecretFromSlotsSync({ service, accounts, }: DeleteFromSlotsOptions): SecretDeleteResult[];
 export declare function deleteSecretSync({ service, account, }: DeleteOptions): 'removed' | 'absent';
 export type { BackendAvailability, SecretDeleteResult, SecretWriteResult, } from './types';
@@ -50,7 +53,7 @@ export type Platform = 'darwin' | 'linux' | 'win32' | 'other';
 /**
  * Resolve the current OS to one of our four backend categories.
  *
- * Exported only because the fleet's `export-top-level-functions` lint rule
+ * Exported only because Socket's `export-top-level-functions` lint rule
  * requires top-level functions to be exported for testability. Not part of the
  * public `secrets/keychain` API surface — consumers should call `readSecret` /
  * `writeSecret` / `getBackendAvailability` instead, which handle the dispatch
@@ -90,6 +93,9 @@ export declare function readSecretFromSlots({ service, accounts, }: ReadFromSlot
     value: string;
     account: string;
 } | undefined>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function readSecretFromSlotsSync({ service, accounts, }: ReadFromSlotsOptions): {
     value: string;
     account: string;
@@ -135,4 +141,7 @@ export interface WriteToSlotsOptions {
  * the next successful write cleans up).
  */
 export declare function writeSecretToSlots({ service, accounts, value, label, }: WriteToSlotsOptions): Promise<SecretWriteResult[]>;
+/**
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
+ */
 export declare function writeSecretToSlotsSync({ service, accounts, value, label, }: WriteToSlotsOptions): SecretWriteResult[];

package/dist/secrets/keychain.js

@@ -77,6 +77,9 @@ async function deleteSecretFromSlots({ service, accounts }) {
 	}
 	return results;
 }
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function deleteSecretFromSlotsSync({ service, accounts }) {
 	const results = [];
 	for (const account of accounts) {
@@ -111,7 +114,7 @@ function deleteSecretSync({ service, account }) {
 /**
 * Resolve the current OS to one of our four backend categories.
 *
-* Exported only because the fleet's `export-top-level-functions` lint rule
+* Exported only because Socket's `export-top-level-functions` lint rule
 * requires top-level functions to be exported for testability. Not part of the
 * public `secrets/keychain` API surface — consumers should call `readSecret` /
 * `writeSecret` / `getBackendAvailability` instead, which handle the dispatch
@@ -190,6 +193,9 @@ async function readSecretFromSlots({ service, accounts }) {
 		};
 	}
 }
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function readSecretFromSlotsSync({ service, accounts }) {
 	for (const account of accounts) {
 		const value = readSecretSync({
@@ -302,6 +308,9 @@ async function writeSecretToSlots({ service, accounts, value, label }) {
 	}
 	return results;
 }
+/**
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
 function writeSecretToSlotsSync({ service, accounts, value, label }) {
 	const results = [];
 	for (const account of accounts) {

package/dist/secrets/socket-api-token.d.ts

@@ -1,6 +1,6 @@
 /**
  * @file Convenience helper for reading the Socket API token from the canonical
- *   env → keychain precedence order. Centralizes two constants every fleet
+ *   env → keychain precedence order. Centralizes two constants every Socket
  *   consumer would otherwise hard-code: the keychain service name
  *   (`socketsecurity`) and the env-var + account fallback list
  *   (`SOCKET_API_TOKEN` canonical, `SOCKET_API_KEY` legacy alias). Consumers

package/dist/secrets/socket-api-token.js

@@ -6,7 +6,7 @@ const require_secrets_find = require('./find.js');
 //#region src/secrets/socket-api-token.ts
 /**
 * @file Convenience helper for reading the Socket API token from the canonical
-*   env → keychain precedence order. Centralizes two constants every fleet
+*   env → keychain precedence order. Centralizes two constants every Socket
 *   consumer would otherwise hard-code: the keychain service name
 *   (`socketsecurity`) and the env-var + account fallback list
 *   (`SOCKET_API_TOKEN` canonical, `SOCKET_API_KEY` legacy alias). Consumers

package/dist/secrets/types.d.ts

@@ -1,5 +1,5 @@
 /**
- * @file Public type surface for `secrets/*`. Secrets in the fleet are stored
+ * @file Public type surface for `secrets/*`. Secrets in Socket tools are stored
  *   under the OS's native credential store keyed by `{ service, account }`:
  *
  *   - macOS: Keychain generic-password items (service = `-s`, account = `-a`

package/dist/smol/http.d.ts

@@ -56,5 +56,7 @@ export interface SmolHttpBinding {
 /**
  * Returns `node:smol-http` when running on the smol Node binary, otherwise
  * `undefined`. Result is cached across calls.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function getSmolHttp(): SmolHttpBinding | undefined;