@socketsecurity/mcp 0.0.16 → 0.0.18

package/hooks/socket-gate/socket-gate.cjs

@@ -0,0 +1,1047 @@
+#!/usr/bin/env node
+"use strict";
+/* Socket gate hook — bundled with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+//#region \0rolldown/runtime.js
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+
+//#endregion
+let node_fs = require("node:fs");
+let node_process = require("node:process");
+let node_url = require("node:url");
+
+//#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/constants/sentinels.js
+var require_sentinels = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+	/**
+	* @file Core primitives and fundamental constants. Holds sentinels,
+	*   unknown/empty tokens, the internals symbol, and a few shared env-var name
+	*   strings. Intentionally kept small - prefer moving constants to a more
+	*   specific `src/constants/*` module when possible.
+	*/
+	const kInternalsSymbol = Symbol("@socketregistry.constants.internals");
+	const LOOP_SENTINEL = 1e6;
+	const UNKNOWN_ERROR = "Unknown error";
+	const UNKNOWN_VALUE = "<unknown>";
+	const EMPTY_FILE = "/* empty */\n";
+	const EMPTY_VALUE = "<value>";
+	const UNDEFINED_TOKEN = void 0;
+	const COLUMN_LIMIT = 80;
+	const V = "v";
+	const NODE_AUTH_TOKEN = "NODE_AUTH_TOKEN";
+	const NODE_ENV = "NODE_ENV";
+	exports.COLUMN_LIMIT = COLUMN_LIMIT;
+	exports.EMPTY_FILE = EMPTY_FILE;
+	exports.EMPTY_VALUE = EMPTY_VALUE;
+	exports.LOOP_SENTINEL = LOOP_SENTINEL;
+	exports.NODE_AUTH_TOKEN = NODE_AUTH_TOKEN;
+	exports.NODE_ENV = NODE_ENV;
+	exports.UNDEFINED_TOKEN = UNDEFINED_TOKEN;
+	exports.UNKNOWN_ERROR = UNKNOWN_ERROR;
+	exports.UNKNOWN_VALUE = UNKNOWN_VALUE;
+	exports.V = V;
+	exports.kInternalsSymbol = kInternalsSymbol;
+}));
+
+//#endregion
+//#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/constants/runtime.js
+var require_runtime = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+	/**
+	* @file Runtime environment detection constants. All checks use only
+	*   `typeof`-safe global probes so this module is safe to import in browser,
+	*   Node.js, Deno, Bun, and bundled contexts alike.
+	*/
+	/**
+	* True when running inside a Node.js process. Detected via
+	* `process.versions.node` — present in Node, absent in browsers and Deno/Bun
+	* which expose a different `process.versions` shape (or no `process` at all).
+	*/
+	const IS_NODE = typeof process !== "undefined" && typeof process.versions !== "undefined" && typeof process.versions.node === "string";
+	/**
+	* True when running in a browser context (window + document both defined).
+	* Note: Chrome extensions have `window` in popup contexts but not in service
+	* workers — check `IS_SERVICE_WORKER` for that case.
+	*/
+	const IS_BROWSER = typeof window !== "undefined" && typeof document !== "undefined";
+	/**
+	* True when running inside a Web Worker / Chrome MV3 service worker. `self` is
+	* defined without `window` in worker contexts.
+	*/
+	const IS_WORKER = typeof self !== "undefined" && typeof window === "undefined" && typeof document === "undefined";
+	exports.IS_BROWSER = IS_BROWSER;
+	exports.IS_NODE = IS_NODE;
+	exports.IS_WORKER = IS_WORKER;
+}));
+
+//#endregion
+//#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/node/module.js
+var require_module = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+	const require_constants_runtime = require_runtime();
+	let cachedModule;
+	function getNodeModule() {
+		if (!require_constants_runtime.IS_NODE) return;
+		return cachedModule ??= /*@__PURE__*/ require("node:module");
+	}
+	/**
+	* Lazy + cached reference to `node:module`'s `isBuiltin(name)`. First call
+	* resolves the binding; subsequent calls dispatch through the cached function
+	* reference. Safe to detach — `isBuiltin` is `this`-free.
+	*
+	* Returns `false` in browser / non-CJS environments where `require` is
+	* undefined — no `node:` modules are built-in there.
+	*
+	* Single source of truth for "is this a Node builtin?" probes across socket-lib
+	* (used by the smol-binding loaders to gate `require('node:smol-*')`).
+	*/
+	let cachedIsBuiltin;
+	function isNodeBuiltin(name) {
+		if (!require_constants_runtime.IS_NODE) return false;
+		return (cachedIsBuiltin ??= getNodeModule().isBuiltin)(name);
+	}
+	exports.getNodeModule = getNodeModule;
+	exports.isNodeBuiltin = isNodeBuiltin;
+}));
+
+//#endregion
+//#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/smol/detect.js
+var require_detect = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+	const require_node_module = require_module();
+	/**
+	* @file Smol detection + lazy-loader for `node:smol-util`. Two
+	*   responsibilities:
+	*
+	*   1. `isSmol()` — memoized boolean detector for socket-btm's smol Node binary.
+	*      Mirrors `isSeaBinary()` from `src/sea.ts`. Probes via
+	*      `node:module.isBuiltin('node:smol-util')` since only the smol binary
+	*      registers any `node:smol-*` builtins.
+	*   2. `getSmolUtil()` — lazy-loader for the `node:smol-util` binding, which
+	*      provides native `uncurryThis` and `applyBind` (single V8 dispatch via
+	*      `args.Data()` + `v8::Function::Call`, skipping the BoundFunction adapter
+	*      + `Function.prototype.call` trampoline that the JS form
+	*      `bind.bind(call)(fn)` hits twice per invocation). ~2x faster on hot
+	*      uncurried-call sites. `getSmolUtil()` returns `undefined` on stock Node
+	*      + non-Node runtimes. Result is cached across calls; the lazy-loader
+	*      follows the same shape as `src/node/fs.ts` etc.
+	*
+	* @see https://github.com/SocketDev/socket-btm — socket-btm builds
+	*   the smol binary that exposes the `node:smol-util` binding.
+	*/
+	/**
+	* Cached smol-binary detection result.
+	*/
+	let isSmolCache;
+	/**
+	* Cached `node:smol-util` binding. `null` = probed and unavailable; `undefined`
+	* = not yet probed. JS truthiness collapses both to "no binding" at the call
+	* site.
+	*/
+	let smolUtilCache;
+	let smolUtilProbed = false;
+	/**
+	* Returns `node:smol-util` when running on the smol Node binary, otherwise
+	* `undefined`. Result is cached across calls.
+	*/
+	function getSmolUtil() {
+		if (!smolUtilProbed) {
+			smolUtilProbed = true;
+			/* c8 ignore start - smol Node binary only. */
+			if (require_node_module.isNodeBuiltin("node:smol-util")) smolUtilCache = require("node:smol-util");
+		}
+		return smolUtilCache;
+	}
+	/**
+	* Detect if the current process is running on socket-btm's smol Node binary.
+	* Memoized on first call.
+	*
+	* Defensive across runtimes: returns `false` on stock Node, browsers (no
+	* `node:module`), Deno / Bun (different module resolution), and worker threads
+	* (each has its own builtin table).
+	*
+	* @example
+	*   ;```ts
+	*   import { isSmol } from '@socketsecurity/lib/smol/detect'
+	*
+	*   if (isSmol()) {
+	*     // running on the smol binary; native fast paths available
+	*   }
+	*   ```
+	*/
+	function isSmol() {
+		if (isSmolCache === void 0) isSmolCache = require_node_module.isNodeBuiltin("node:smol-util");
+		return isSmolCache;
+	}
+	exports.getSmolUtil = getSmolUtil;
+	exports.isSmol = isSmol;
+}));
+
+//#endregion
+//#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/primordials/uncurry.js
+var require_uncurry = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+	/**
+	* @file `uncurryThis` and the cluster of helpers built atop it. Mirrors
+	*   Node.js's internal/per_context/primordials.js. Every other primordials leaf
+	*   depends on `uncurryThis` to expose prototype-method primordials, so this
+	*   file must be import-safe before any of them. Smol fast paths
+	*   (`node:smol-util`) replace the JS forms when running on socket-btm's smol
+	*   Node binary; stock Node and other runtimes fall back to the standard
+	*   `bind.bind(call)` shape. **IMPORTANT**: do not destructure on `globalThis`
+	*   or `Reflect` here. tsgo has a bug that mis-transpiles destructured exports.
+	*   See: https://github.com/SocketDev/socket-packageurl-js/issues/3.
+	*/
+	const smolUtil = require_detect().getSmolUtil();
+	const { apply, bind, call } = Function.prototype;
+	const uncurryThis = smolUtil?.uncurryThis ?? bind.bind(call);
+	const applyBind = smolUtil?.applyBind ?? bind.bind(apply);
+	const applyBoundForSafe = applyBind;
+	const applySafe = smolUtil?.applySafe ?? ((fn) => {
+		const apply2 = applyBoundForSafe(fn);
+		return (self, args) => {
+			try {
+				return apply2(self, args);
+			} catch {
+				return;
+			}
+		};
+	});
+	const bindCallFallback = ((fn, thisArg, ...presetArgs) => Function.prototype.bind.apply(fn, [thisArg, ...presetArgs]));
+	const bindCall = smolUtil?.bindCall ?? bindCallFallback;
+	const weakRefSafe = smolUtil?.weakRefSafe ?? ((target) => {
+		try {
+			return new WeakRef(target);
+		} catch {
+			return;
+		}
+	});
+	exports.applyBind = applyBind;
+	exports.applySafe = applySafe;
+	exports.bindCall = bindCall;
+	exports.uncurryThis = uncurryThis;
+	exports.weakRefSafe = weakRefSafe;
+}));
+
+//#endregion
+//#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/smol/primordial.js
+var require_primordial = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+	const require_node_module = require_module();
+	/**
+	* @file Lazy-loader for socket-btm's `node:smol-primordial` binding.
+	*   `node:smol-primordial` provides V8 Fast API typed implementations of Math.*
+	*   and Number.is* primordials, registered with `CFunction::Make()` so TurboFan
+	*   inlines them directly into JIT- compiled JS callers. Bypasses the
+	*   FunctionCallbackInfo trampoline entirely — ~30-50% gain on hot loops where
+	*   V8 doesn't already auto-inline. Returns `undefined` on stock Node +
+	*   non-Node runtimes. Result is cached across calls.
+	*
+	* @internal — used by `src/primordials.ts` to resolve smol-aware
+	*   Math.* / Number.is* fast paths. Most callers should use the
+	*   standard `primordials` exports, which already route through this
+	*   when smol is present.
+	*
+	* @see https://v8.dev/blog/v8-release-99 — V8 Fast API Calls overview
+	*/
+	let smolPrimordial;
+	let smolPrimordialProbed = false;
+	/**
+	* Returns `node:smol-primordial` when running on the smol Node binary,
+	* otherwise `undefined`. Result is cached across calls.
+	*/
+	function getSmolPrimordial() {
+		if (!smolPrimordialProbed) {
+			smolPrimordialProbed = true;
+			/* c8 ignore start - smol Node binary only. */
+			if (require_node_module.isNodeBuiltin("node:smol-primordial")) smolPrimordial = require("node:smol-primordial");
+		}
+		return smolPrimordial;
+	}
+	exports.getSmolPrimordial = getSmolPrimordial;
+}));
+
+//#endregion
+//#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/primordials/string.js
+var require_string = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+	const require_primordials_uncurry = require_uncurry();
+	/**
+	* @file Safe references to `String` static methods and prototype methods.
+	*   `StringPrototypeCharCodeAt` prefers the smol Fast API binding for ASCII
+	*   inputs (single byte load) and translates the `-1` Fast API sentinel back to
+	*   `NaN` to preserve spec parity. Two-byte strings fall back to the uncurried
+	*   `String.prototype.charCodeAt`.
+	*
+	*   ## Fast API surface — and why it's small
+	*
+	*   Mirrors the design rationale from socket-btm's `primordial_binding.cc`
+	*   (lines 41-72). The smol Fast API exposes exactly one string op
+	*   (`stringCharCodeAt`) because that's the one shape where the C++ trampoline
+	*   genuinely beats V8's existing hot path: a single ASCII byte load, no
+	*   encoding dispatch, no HandleScope, returns a primitive. String **searches**
+	*   (`startsWith` / `endsWith` / `includes` / `indexOf` / `lastIndexOf`) are
+	*   intentionally NOT exposed. V8's existing hot path dispatches on encoding
+	*   and runs native SIMD memcmp — a Fast API binding would add overhead without
+	*   winning. Same for `Map.has` / `Set.has` / `Array.includes`. Fast API also
+	*   has a hard constraint: a fast-path function cannot return a new V8 object —
+	*   only primitives, Local<Value/Object/Array>, or FastOneByteString. That
+	*   rules out anything that produces a new string (`slice`, `substring`,
+	*   `toUpperCase`, `concat`, `repeat`, `padStart`/`padEnd`, formatted-number)
+	*   from ever being a Fast API win on the return path. Net: the current surface
+	*   is approximately the ceiling. Adding more Fast API string ops without a
+	*   flamegraph showing the cost is a regression risk, not a perf win. See
+	*   `socket-btm/packages/node-smol-builder/additions/source-patched/`
+	*   `src/socketsecurity/primordial/primordial_binding.cc:41-72` for the
+	*   canonical design statement.
+	*/
+	const smolPrimordial = require_primordial().getSmolPrimordial();
+	const StringCtor = String;
+	const StringFromCharCode = String.fromCharCode;
+	const StringFromCodePoint = String.fromCodePoint;
+	const StringRaw = String.raw;
+	const StringPrototypeAt = require_primordials_uncurry.uncurryThis(String.prototype.at);
+	const StringPrototypeCharAt = require_primordials_uncurry.uncurryThis(String.prototype.charAt);
+	const smolCharCodeAt = smolPrimordial?.stringCharCodeAt;
+	/* c8 ignore start - smol Node fast path unreachable on stock Node test runner */
+	const StringPrototypeCharCodeAt = smolCharCodeAt ? (s, i) => {
+		const code = smolCharCodeAt(s, i);
+		return code === -1 ? NaN : code;
+	} : require_primordials_uncurry.uncurryThis(String.prototype.charCodeAt);
+	/* c8 ignore stop */
+	const StringPrototypeCodePointAt = require_primordials_uncurry.uncurryThis(String.prototype.codePointAt);
+	const StringPrototypeConcat = require_primordials_uncurry.uncurryThis(String.prototype.concat);
+	const StringPrototypeEndsWith = require_primordials_uncurry.uncurryThis(String.prototype.endsWith);
+	const StringPrototypeIncludes = require_primordials_uncurry.uncurryThis(String.prototype.includes);
+	const StringPrototypeIndexOf = require_primordials_uncurry.uncurryThis(String.prototype.indexOf);
+	const StringPrototypeIsWellFormed = smolPrimordial?.stringIsWellFormed ?? require_primordials_uncurry.uncurryThis(String.prototype.isWellFormed);
+	const StringPrototypeLastIndexOf = require_primordials_uncurry.uncurryThis(String.prototype.lastIndexOf);
+	const StringPrototypeLocaleCompare = require_primordials_uncurry.uncurryThis(String.prototype.localeCompare);
+	const StringPrototypeMatch = require_primordials_uncurry.uncurryThis(String.prototype.match);
+	const StringPrototypeMatchAll = require_primordials_uncurry.uncurryThis(String.prototype.matchAll);
+	const StringPrototypeNormalize = require_primordials_uncurry.uncurryThis(String.prototype.normalize);
+	const StringPrototypePadEnd = require_primordials_uncurry.uncurryThis(String.prototype.padEnd);
+	const StringPrototypePadStart = require_primordials_uncurry.uncurryThis(String.prototype.padStart);
+	const StringPrototypeRepeat = require_primordials_uncurry.uncurryThis(String.prototype.repeat);
+	const StringPrototypeReplace = require_primordials_uncurry.uncurryThis(String.prototype.replace);
+	const StringPrototypeReplaceAll = require_primordials_uncurry.uncurryThis(String.prototype.replaceAll);
+	const StringPrototypeSearch = require_primordials_uncurry.uncurryThis(String.prototype.search);
+	const StringPrototypeSlice = require_primordials_uncurry.uncurryThis(String.prototype.slice);
+	const StringPrototypeSplit = require_primordials_uncurry.uncurryThis(String.prototype.split);
+	const StringPrototypeStartsWith = require_primordials_uncurry.uncurryThis(String.prototype.startsWith);
+	const StringPrototypeSubstring = require_primordials_uncurry.uncurryThis(String.prototype.substring);
+	const StringPrototypeToLocaleLowerCase = require_primordials_uncurry.uncurryThis(String.prototype.toLocaleLowerCase);
+	const StringPrototypeToLocaleUpperCase = require_primordials_uncurry.uncurryThis(String.prototype.toLocaleUpperCase);
+	const StringPrototypeToLowerCase = require_primordials_uncurry.uncurryThis(String.prototype.toLowerCase);
+	const StringPrototypeToString = require_primordials_uncurry.uncurryThis(String.prototype.toString);
+	const StringPrototypeToUpperCase = require_primordials_uncurry.uncurryThis(String.prototype.toUpperCase);
+	const StringPrototypeToWellFormed = require_primordials_uncurry.uncurryThis(String.prototype.toWellFormed);
+	const StringPrototypeTrim = require_primordials_uncurry.uncurryThis(String.prototype.trim);
+	const StringPrototypeTrimEnd = require_primordials_uncurry.uncurryThis(String.prototype.trimEnd);
+	const StringPrototypeTrimStart = require_primordials_uncurry.uncurryThis(String.prototype.trimStart);
+	const StringPrototypeValueOf = require_primordials_uncurry.uncurryThis(String.prototype.valueOf);
+	exports.StringCtor = StringCtor;
+	exports.StringFromCharCode = StringFromCharCode;
+	exports.StringFromCodePoint = StringFromCodePoint;
+	exports.StringPrototypeAt = StringPrototypeAt;
+	exports.StringPrototypeCharAt = StringPrototypeCharAt;
+	exports.StringPrototypeCharCodeAt = StringPrototypeCharCodeAt;
+	exports.StringPrototypeCodePointAt = StringPrototypeCodePointAt;
+	exports.StringPrototypeConcat = StringPrototypeConcat;
+	exports.StringPrototypeEndsWith = StringPrototypeEndsWith;
+	exports.StringPrototypeIncludes = StringPrototypeIncludes;
+	exports.StringPrototypeIndexOf = StringPrototypeIndexOf;
+	exports.StringPrototypeIsWellFormed = StringPrototypeIsWellFormed;
+	exports.StringPrototypeLastIndexOf = StringPrototypeLastIndexOf;
+	exports.StringPrototypeLocaleCompare = StringPrototypeLocaleCompare;
+	exports.StringPrototypeMatch = StringPrototypeMatch;
+	exports.StringPrototypeMatchAll = StringPrototypeMatchAll;
+	exports.StringPrototypeNormalize = StringPrototypeNormalize;
+	exports.StringPrototypePadEnd = StringPrototypePadEnd;
+	exports.StringPrototypePadStart = StringPrototypePadStart;
+	exports.StringPrototypeRepeat = StringPrototypeRepeat;
+	exports.StringPrototypeReplace = StringPrototypeReplace;
+	exports.StringPrototypeReplaceAll = StringPrototypeReplaceAll;
+	exports.StringPrototypeSearch = StringPrototypeSearch;
+	exports.StringPrototypeSlice = StringPrototypeSlice;
+	exports.StringPrototypeSplit = StringPrototypeSplit;
+	exports.StringPrototypeStartsWith = StringPrototypeStartsWith;
+	exports.StringPrototypeSubstring = StringPrototypeSubstring;
+	exports.StringPrototypeToLocaleLowerCase = StringPrototypeToLocaleLowerCase;
+	exports.StringPrototypeToLocaleUpperCase = StringPrototypeToLocaleUpperCase;
+	exports.StringPrototypeToLowerCase = StringPrototypeToLowerCase;
+	exports.StringPrototypeToString = StringPrototypeToString;
+	exports.StringPrototypeToUpperCase = StringPrototypeToUpperCase;
+	exports.StringPrototypeToWellFormed = StringPrototypeToWellFormed;
+	exports.StringPrototypeTrim = StringPrototypeTrim;
+	exports.StringPrototypeTrimEnd = StringPrototypeTrimEnd;
+	exports.StringPrototypeTrimStart = StringPrototypeTrimStart;
+	exports.StringPrototypeValueOf = StringPrototypeValueOf;
+	exports.StringRaw = StringRaw;
+}));
+
+//#endregion
+//#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/primordials/object.js
+var require_object = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+	const require_primordials_uncurry = require_uncurry();
+	/**
+	* @file Safe references to `Object` static methods and prototype methods. Annex
+	*   B legacy accessor methods (`__defineGetter__`, `__lookupGetter__`, etc.)
+	*   are exposed alongside the canonical static methods — implementations exist
+	*   in V8, SpiderMonkey, and JavaScriptCore even though the spec calls them
+	*   "normative optional".
+	*/
+	const ObjectCtor = Object;
+	const ObjectAssign = Object.assign;
+	const ObjectCreate = Object.create;
+	const ObjectDefineProperties = Object.defineProperties;
+	const ObjectDefineProperty = Object.defineProperty;
+	const ObjectEntries = Object.entries;
+	const ObjectFreeze = Object.freeze;
+	const ObjectFromEntries = Object.fromEntries;
+	const ObjectGetOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
+	const ObjectGetOwnPropertyDescriptors = Object.getOwnPropertyDescriptors;
+	const ObjectGetOwnPropertyNames = Object.getOwnPropertyNames;
+	const ObjectGetOwnPropertySymbols = Object.getOwnPropertySymbols;
+	const ObjectGetPrototypeOf = Object.getPrototypeOf;
+	const ObjectHasOwn = Object.hasOwn;
+	const ObjectIs = Object.is;
+	const ObjectIsExtensible = Object.isExtensible;
+	const ObjectIsFrozen = Object.isFrozen;
+	const ObjectIsSealed = Object.isSealed;
+	const ObjectKeys = Object.keys;
+	const ObjectPreventExtensions = Object.preventExtensions;
+	const ObjectSeal = Object.seal;
+	const ObjectSetPrototypeOf = Object.setPrototypeOf;
+	const ObjectValues = Object.values;
+	const ObjectPrototype = Object.prototype;
+	const ObjectPrototypeHasOwnProperty = require_primordials_uncurry.uncurryThis(Object.prototype.hasOwnProperty);
+	const ObjectPrototypeIsPrototypeOf = require_primordials_uncurry.uncurryThis(Object.prototype.isPrototypeOf);
+	const ObjectPrototypePropertyIsEnumerable = require_primordials_uncurry.uncurryThis(Object.prototype.propertyIsEnumerable);
+	const ObjectPrototypeToString = require_primordials_uncurry.uncurryThis(Object.prototype.toString);
+	const ObjectPrototypeValueOf = require_primordials_uncurry.uncurryThis(Object.prototype.valueOf);
+	const objectProto = Object.prototype;
+	const ObjectPrototypeDefineGetter = require_primordials_uncurry.uncurryThis(objectProto.__defineGetter__);
+	const ObjectPrototypeDefineSetter = require_primordials_uncurry.uncurryThis(objectProto.__defineSetter__);
+	const ObjectPrototypeLookupGetter = require_primordials_uncurry.uncurryThis(objectProto.__lookupGetter__);
+	const ObjectPrototypeLookupSetter = require_primordials_uncurry.uncurryThis(objectProto.__lookupSetter__);
+	exports.ObjectAssign = ObjectAssign;
+	exports.ObjectCreate = ObjectCreate;
+	exports.ObjectCtor = ObjectCtor;
+	exports.ObjectDefineProperties = ObjectDefineProperties;
+	exports.ObjectDefineProperty = ObjectDefineProperty;
+	exports.ObjectEntries = ObjectEntries;
+	exports.ObjectFreeze = ObjectFreeze;
+	exports.ObjectFromEntries = ObjectFromEntries;
+	exports.ObjectGetOwnPropertyDescriptor = ObjectGetOwnPropertyDescriptor;
+	exports.ObjectGetOwnPropertyDescriptors = ObjectGetOwnPropertyDescriptors;
+	exports.ObjectGetOwnPropertyNames = ObjectGetOwnPropertyNames;
+	exports.ObjectGetOwnPropertySymbols = ObjectGetOwnPropertySymbols;
+	exports.ObjectGetPrototypeOf = ObjectGetPrototypeOf;
+	exports.ObjectHasOwn = ObjectHasOwn;
+	exports.ObjectIs = ObjectIs;
+	exports.ObjectIsExtensible = ObjectIsExtensible;
+	exports.ObjectIsFrozen = ObjectIsFrozen;
+	exports.ObjectIsSealed = ObjectIsSealed;
+	exports.ObjectKeys = ObjectKeys;
+	exports.ObjectPreventExtensions = ObjectPreventExtensions;
+	exports.ObjectPrototype = ObjectPrototype;
+	exports.ObjectPrototypeDefineGetter = ObjectPrototypeDefineGetter;
+	exports.ObjectPrototypeDefineSetter = ObjectPrototypeDefineSetter;
+	exports.ObjectPrototypeHasOwnProperty = ObjectPrototypeHasOwnProperty;
+	exports.ObjectPrototypeIsPrototypeOf = ObjectPrototypeIsPrototypeOf;
+	exports.ObjectPrototypeLookupGetter = ObjectPrototypeLookupGetter;
+	exports.ObjectPrototypeLookupSetter = ObjectPrototypeLookupSetter;
+	exports.ObjectPrototypePropertyIsEnumerable = ObjectPrototypePropertyIsEnumerable;
+	exports.ObjectPrototypeToString = ObjectPrototypeToString;
+	exports.ObjectPrototypeValueOf = ObjectPrototypeValueOf;
+	exports.ObjectSeal = ObjectSeal;
+	exports.ObjectSetPrototypeOf = ObjectSetPrototypeOf;
+	exports.ObjectValues = ObjectValues;
+}));
+
+//#endregion
+//#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/errors/predicates.js
+var require_predicates = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+	const require_primordials_string = require_string();
+	const require_primordials_object = require_object();
+	/**
+	* @file Error type-guard predicates — `isError` (with the `isErrorBuiltin` /
+	*   `isErrorShim` building blocks) and the libuv errno-code narrower
+	*   `isErrnoException`. Both are cross-realm-safe (they use `[[ErrorData]]`
+	*   slot semantics rather than `instanceof Error`).
+	*/
+	/**
+	* Reference to the native ES2025 `Error.isError` when the running engine ships
+	* it, otherwise `undefined`. Exposed separately so tests and callers can detect
+	* the fast-path without re-probing.
+	*/
+	const isErrorBuiltin = Error.isError;
+	/**
+	* Narrow a caught value to a Node.js `ErrnoException` — an Error with a `.code`
+	* string set by libuv/syscall failures (e.g. `'ENOENT'`, `'EACCES'`, `'EBUSY'`,
+	* `'EPERM'`). Cross-realm safe (builds on {@link isError}), and checks that
+	* `code` is a string so a merely branded Error without a real errno code
+	* returns `false`.
+	*
+	* @example
+	*   try {
+	*     await fsPromises.readFile(path)
+	*   } catch (e) {
+	*     if (isErrnoException(e) && e.code === 'ENOENT') {
+	*       // … retry, or return default …
+	*     } else {
+	*       throw e
+	*     }
+	*   }
+	*/
+	function isErrnoException(value) {
+		if (!isError(value)) return false;
+		const code = value.code;
+		if (typeof code !== "string" || code.length === 0) return false;
+		const first = require_primordials_string.StringPrototypeCharCodeAt(code, 0);
+		return first >= 65 && first <= 90;
+	}
+	/**
+	* `Error.isError` fallback shim — the in-language approximation used when the
+	* native ES2025 method isn't available.
+	*
+	* Exported separately so test suites on engines that ship the native method can
+	* still exercise the shim branch directly. Consumers should prefer
+	* {@link isError}, which picks the native method when present.
+	*/
+	function isErrorShim(value) {
+		if (value === null || typeof value !== "object") return false;
+		return require_primordials_object.ObjectPrototypeToString(value) === "[object Error]";
+	}
+	/**
+	* Prefer the native ES2025 `Error.isError` when available (exact
+	* `[[ErrorData]]` slot check, cross-realm-safe); fall back to
+	* {@link isErrorShim} otherwise.
+	*/
+	const isError = isErrorBuiltin ?? isErrorShim;
+	exports.isErrnoException = isErrnoException;
+	exports.isError = isError;
+	exports.isErrorBuiltin = isErrorBuiltin;
+	exports.isErrorShim = isErrorShim;
+}));
+
+//#endregion
+//#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/primordials/map-set.js
+var require_map_set = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+	const require_primordials_uncurry = require_uncurry();
+	/**
+	* @file Safe references to `Map`, `Set`, `WeakMap`, `WeakSet`, and `WeakRef`.
+	*   Constructors plus uncurried prototype methods. `WeakRef` exposes only its
+	*   constructor — there's a separate `weakRefSafe` wrapper in `./uncurry` for
+	*   the throws-on-non-Object case.
+	*/
+	const MapCtor = Map;
+	const SetCtor = Set;
+	const WeakMapCtor = WeakMap;
+	const WeakRefCtor = WeakRef;
+	const WeakSetCtor = WeakSet;
+	const MapPrototypeClear = require_primordials_uncurry.uncurryThis(Map.prototype.clear);
+	const MapPrototypeDelete = require_primordials_uncurry.uncurryThis(Map.prototype.delete);
+	const MapPrototypeEntries = require_primordials_uncurry.uncurryThis(Map.prototype.entries);
+	const MapPrototypeForEach = require_primordials_uncurry.uncurryThis(Map.prototype.forEach);
+	const MapPrototypeGet = require_primordials_uncurry.uncurryThis(Map.prototype.get);
+	const MapPrototypeGetOrInsert = require_primordials_uncurry.uncurryThis(Map.prototype.getOrInsert);
+	const MapPrototypeGetOrInsertComputed = require_primordials_uncurry.uncurryThis(Map.prototype.getOrInsertComputed);
+	const MapPrototypeHas = require_primordials_uncurry.uncurryThis(Map.prototype.has);
+	const MapPrototypeKeys = require_primordials_uncurry.uncurryThis(Map.prototype.keys);
+	const MapPrototypeSet = require_primordials_uncurry.uncurryThis(Map.prototype.set);
+	const MapPrototypeValues = require_primordials_uncurry.uncurryThis(Map.prototype.values);
+	const SetPrototypeAdd = require_primordials_uncurry.uncurryThis(Set.prototype.add);
+	const SetPrototypeClear = require_primordials_uncurry.uncurryThis(Set.prototype.clear);
+	const SetPrototypeDelete = require_primordials_uncurry.uncurryThis(Set.prototype.delete);
+	const SetPrototypeDifference = require_primordials_uncurry.uncurryThis(Set.prototype.difference);
+	const SetPrototypeEntries = require_primordials_uncurry.uncurryThis(Set.prototype.entries);
+	const SetPrototypeForEach = require_primordials_uncurry.uncurryThis(Set.prototype.forEach);
+	const SetPrototypeHas = require_primordials_uncurry.uncurryThis(Set.prototype.has);
+	const SetPrototypeIntersection = require_primordials_uncurry.uncurryThis(Set.prototype.intersection);
+	const SetPrototypeIsDisjointFrom = require_primordials_uncurry.uncurryThis(Set.prototype.isDisjointFrom);
+	const SetPrototypeIsSubsetOf = require_primordials_uncurry.uncurryThis(Set.prototype.isSubsetOf);
+	const SetPrototypeIsSupersetOf = require_primordials_uncurry.uncurryThis(Set.prototype.isSupersetOf);
+	const SetPrototypeKeys = require_primordials_uncurry.uncurryThis(Set.prototype.keys);
+	const SetPrototypeSymmetricDifference = require_primordials_uncurry.uncurryThis(Set.prototype.symmetricDifference);
+	const SetPrototypeUnion = require_primordials_uncurry.uncurryThis(Set.prototype.union);
+	const SetPrototypeValues = require_primordials_uncurry.uncurryThis(Set.prototype.values);
+	const WeakMapPrototypeDelete = require_primordials_uncurry.uncurryThis(WeakMap.prototype.delete);
+	const WeakMapPrototypeGet = require_primordials_uncurry.uncurryThis(WeakMap.prototype.get);
+	const WeakMapPrototypeGetOrInsert = require_primordials_uncurry.uncurryThis(WeakMap.prototype.getOrInsert);
+	const WeakMapPrototypeGetOrInsertComputed = require_primordials_uncurry.uncurryThis(WeakMap.prototype.getOrInsertComputed);
+	const WeakMapPrototypeHas = require_primordials_uncurry.uncurryThis(WeakMap.prototype.has);
+	const WeakMapPrototypeSet = require_primordials_uncurry.uncurryThis(WeakMap.prototype.set);
+	const WeakSetPrototypeAdd = require_primordials_uncurry.uncurryThis(WeakSet.prototype.add);
+	const WeakSetPrototypeDelete = require_primordials_uncurry.uncurryThis(WeakSet.prototype.delete);
+	const WeakSetPrototypeHas = require_primordials_uncurry.uncurryThis(WeakSet.prototype.has);
+	exports.MapCtor = MapCtor;
+	exports.MapPrototypeClear = MapPrototypeClear;
+	exports.MapPrototypeDelete = MapPrototypeDelete;
+	exports.MapPrototypeEntries = MapPrototypeEntries;
+	exports.MapPrototypeForEach = MapPrototypeForEach;
+	exports.MapPrototypeGet = MapPrototypeGet;
+	exports.MapPrototypeGetOrInsert = MapPrototypeGetOrInsert;
+	exports.MapPrototypeGetOrInsertComputed = MapPrototypeGetOrInsertComputed;
+	exports.MapPrototypeHas = MapPrototypeHas;
+	exports.MapPrototypeKeys = MapPrototypeKeys;
+	exports.MapPrototypeSet = MapPrototypeSet;
+	exports.MapPrototypeValues = MapPrototypeValues;
+	exports.SetCtor = SetCtor;
+	exports.SetPrototypeAdd = SetPrototypeAdd;
+	exports.SetPrototypeClear = SetPrototypeClear;
+	exports.SetPrototypeDelete = SetPrototypeDelete;
+	exports.SetPrototypeDifference = SetPrototypeDifference;
+	exports.SetPrototypeEntries = SetPrototypeEntries;
+	exports.SetPrototypeForEach = SetPrototypeForEach;
+	exports.SetPrototypeHas = SetPrototypeHas;
+	exports.SetPrototypeIntersection = SetPrototypeIntersection;
+	exports.SetPrototypeIsDisjointFrom = SetPrototypeIsDisjointFrom;
+	exports.SetPrototypeIsSubsetOf = SetPrototypeIsSubsetOf;
+	exports.SetPrototypeIsSupersetOf = SetPrototypeIsSupersetOf;
+	exports.SetPrototypeKeys = SetPrototypeKeys;
+	exports.SetPrototypeSymmetricDifference = SetPrototypeSymmetricDifference;
+	exports.SetPrototypeUnion = SetPrototypeUnion;
+	exports.SetPrototypeValues = SetPrototypeValues;
+	exports.WeakMapCtor = WeakMapCtor;
+	exports.WeakMapPrototypeDelete = WeakMapPrototypeDelete;
+	exports.WeakMapPrototypeGet = WeakMapPrototypeGet;
+	exports.WeakMapPrototypeGetOrInsert = WeakMapPrototypeGetOrInsert;
+	exports.WeakMapPrototypeGetOrInsertComputed = WeakMapPrototypeGetOrInsertComputed;
+	exports.WeakMapPrototypeHas = WeakMapPrototypeHas;
+	exports.WeakMapPrototypeSet = WeakMapPrototypeSet;
+	exports.WeakRefCtor = WeakRefCtor;
+	exports.WeakSetCtor = WeakSetCtor;
+	exports.WeakSetPrototypeAdd = WeakSetPrototypeAdd;
+	exports.WeakSetPrototypeDelete = WeakSetPrototypeDelete;
+	exports.WeakSetPrototypeHas = WeakSetPrototypeHas;
+}));
+
+//#endregion
+//#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/external/pony-cause.js
+var require_pony_cause$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const { SetCtor: _p_SetCtor } = require_map_set();
+	var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+	var require_error_with_cause = /* @__PURE__ */ __commonJSMin(((exports$1, module$1) => {
+		module$1.exports = { ErrorWithCause: class ErrorWithCause extends Error {
+			/**
+			* @param {string} message
+			* @param {{ cause?: T }} options
+			*/
+			constructor(message, { cause } = {}) {
+				super(message);
+				/** @type {string} */
+				this.name = ErrorWithCause.name;
+				if (cause)
+ /** @type {T} */
+				this.cause = cause;
+				/** @type {string} */
+				this.message = message;
+			}
+		} };
+	}));
+	var require_helpers = /* @__PURE__ */ __commonJSMin(((exports$2, module$2) => {
+		const isError = typeof Error.isError === "function" ? Error.isError : (v) => v !== null && typeof v === "object" && Object.prototype.toString.call(v) === "[object Error]";
+		/**
+		* @template {Error} T
+		* @param {unknown} err
+		* @param {new(...args: any[]) => T} reference
+		* @returns {T|undefined}
+		*/
+		const findCauseByReference = (err, reference) => {
+			if (!err || !reference) return;
+			if (!isError(err)) return;
+			if (!(reference.prototype instanceof Error) && reference !== Error) return;
+			/**
+			* Ensures we don't go circular
+			*
+			* @type {Set<Error>}
+			*/
+			const seen = /* @__PURE__ */ new _p_SetCtor();
+			/** @type {Error|undefined} */
+			let currentErr = err;
+			while (currentErr && !seen.has(currentErr)) {
+				seen.add(currentErr);
+				if (currentErr instanceof reference) return currentErr;
+				currentErr = getErrorCause(currentErr);
+			}
+		};
+		/**
+		* @param {Error|{ cause?: unknown|(()=>err)}} err
+		* @returns {Error|undefined}
+		*/
+		const getErrorCause = (err) => {
+			if (!err || typeof err !== "object" || !("cause" in err)) return;
+			if (typeof err.cause === "function") {
+				const causeResult = err.cause();
+				return isError(causeResult) ? causeResult : void 0;
+			} else return isError(err.cause) ? err.cause : void 0;
+		};
+		/**
+		* Internal method that keeps a track of which error we have already added, to avoid circular recursion
+		*
+		* @private
+		* @param {Error} err
+		* @param {Set<Error>} seen
+		* @returns {string}
+		*/
+		const _stackWithCauses = (err, seen) => {
+			if (!isError(err)) return "";
+			const stack = err.stack || "";
+			if (seen.has(err)) return stack + "\ncauses have become circular...";
+			const cause = getErrorCause(err);
+			if (cause) {
+				seen.add(err);
+				return stack + "\ncaused by: " + _stackWithCauses(cause, seen);
+			} else return stack;
+		};
+		/**
+		* @param {Error} err
+		* @returns {string}
+		*/
+		const stackWithCauses = (err) => _stackWithCauses(err, /* @__PURE__ */ new Set());
+		/**
+		* Internal method that keeps a track of which error we have already added, to avoid circular recursion
+		*
+		* @private
+		* @param {Error} err
+		* @param {Set<Error>} seen
+		* @param {boolean} [skip]
+		* @returns {string}
+		*/
+		const _messageWithCauses = (err, seen, skip) => {
+			if (!isError(err)) return "";
+			const message = skip ? "" : err.message || "";
+			if (seen.has(err)) return message + ": ...";
+			const cause = getErrorCause(err);
+			if (cause) {
+				seen.add(err);
+				const skipIfVErrorStyleCause = "cause" in err && typeof err.cause === "function";
+				return message + (skipIfVErrorStyleCause ? "" : ": ") + _messageWithCauses(cause, seen, skipIfVErrorStyleCause);
+			} else return message;
+		};
+		/**
+		* @param {Error} err
+		* @returns {string}
+		*/
+		const messageWithCauses = (err) => _messageWithCauses(err, /* @__PURE__ */ new Set());
+		module$2.exports = {
+			findCauseByReference,
+			getErrorCause,
+			stackWithCauses,
+			messageWithCauses
+		};
+	}));
+	var require_pony_cause = /* @__PURE__ */ __commonJSMin(((exports$3, module$3) => {
+		const { ErrorWithCause } = require_error_with_cause();
+		const { findCauseByReference, getErrorCause, messageWithCauses, stackWithCauses } = require_helpers();
+		module$3.exports = {
+			ErrorWithCause,
+			findCauseByReference,
+			getErrorCause,
+			stackWithCauses,
+			messageWithCauses
+		};
+	}));
+	module.exports = require_pony_cause();
+}));
+
+//#endregion
+//#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/errors/message.js
+var require_message = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+	const require_constants_sentinels = require_sentinels();
+	const require_errors_predicates = require_predicates();
+	let src_external_pony_cause = require_pony_cause$1();
+	/**
+	* @file Human-readable error-message extractor. `errorMessage` walks the
+	*   `cause` chain via pony-cause's `messageWithCauses` for Errors and falls
+	*   back to the shared `UNKNOWN_ERROR` sentinel for everything else.
+	*   `messageWithCauses` and `UNKNOWN_ERROR` are re-exported for callers that
+	*   need them directly.
+	*/
+	/**
+	* Extract a human-readable message from any caught value.
+	*
+	* Walks the `cause` chain for Errors (via {@link messageWithCauses}); coerces
+	* primitives and objects to string; returns {@link UNKNOWN_ERROR} for `null`,
+	* `undefined`, empty strings, `[object Object]`, or Errors with no message.
+	*
+	* @example
+	*   try {
+	*     await readConfig(path)
+	*   } catch (e) {
+	*     throw new ErrorCtor(`Failed to read ${path}: ${errorMessage(e)}`, {
+	*       cause: e,
+	*     })
+	*   }
+	*/
+	function errorMessage(value) {
+		if (require_errors_predicates.isError(value)) return (0, src_external_pony_cause.messageWithCauses)(value) || "Unknown error";
+		if (value === null || value === void 0) return require_constants_sentinels.UNKNOWN_ERROR;
+		const s = String(value);
+		if (s === "" || s === "[object Object]") return require_constants_sentinels.UNKNOWN_ERROR;
+		return s;
+	}
+	exports.UNKNOWN_ERROR = require_constants_sentinels.UNKNOWN_ERROR;
+	exports.errorMessage = errorMessage;
+	exports.messageWithCauses = src_external_pony_cause.messageWithCauses;
+}));
+
+//#endregion
+//#region hooks/socket-gate/index.mts
+/**
+* Socket-gate — Claude Code PreToolUse hook (source for the bundled
+* socket-gate.cjs).
+*
+* Intercepts package install commands across npm, PyPI, Cargo, RubyGems, Go,
+* and NuGet, and checks the target package against the public Socket MCP
+* server. Blocks installs when the supply chain score is below 20 (known
+* malware, typosquats, high-risk supply chain signals).
+*
+* No API key, no CLI, no registration beyond copying the bundled directory.
+*
+* Setup (see README.md):
+*
+* 1. Copy the whole hooks/socket-gate/ directory to ~/.claude/hooks/ (from a
+*    published @socketsecurity/mcp install, or build it here with `pnpm run
+*    build`).
+* 2. Point a PreToolUse Bash hook at ~/.claude/hooks/socket-gate/socket-gate.cjs
+*    in ~/.claude/settings.json.
+*
+* This source imports @socketsecurity/lib-stable; rolldown inlines it into the
+* bundled socket-gate.cjs so the copied-out hook stays self-contained (a Claude
+* Code hook has no package.json and no node_modules — it can only run what is
+* physically present in the file).
+*
+* Fails open on network, parse, and timeout errors so a Socket outage does not
+* block legitimate work.
+*/
+var import_message = require_message();
+const MCP_URL = "https://mcp.socket.dev/";
+const SUPPLY_CHAIN_THRESHOLD = 20;
+const REQUEST_TIMEOUT_MS = 1e4;
+const INSTALL_PATTERNS = [
+	{
+		ecosystem: "npm",
+		pattern: /\bnpm\s+(?:add|i|install)\s+([^\s-][^\s]*)/i
+	},
+	{
+		ecosystem: "npm",
+		pattern: /\byarn\s+add\s+([^\s-][^\s]*)/i
+	},
+	{
+		ecosystem: "npm",
+		pattern: /\bpnpm\s+add\s+([^\s-][^\s]*)/i
+	},
+	{
+		ecosystem: "npm",
+		pattern: /\bbun\s+add\s+([^\s-][^\s]*)/i
+	},
+	{
+		ecosystem: "pypi",
+		pattern: /(?:\bpython3?\s+-m\s+)?\bpip3?\s+install\s+([^\s-][^\s]*)/i
+	},
+	{
+		ecosystem: "pypi",
+		pattern: /\buv\s+add\s+([^\s-][^\s]*)/i
+	},
+	{
+		ecosystem: "pypi",
+		pattern: /\buv\s+pip\s+install\s+([^\s-][^\s]*)/i
+	},
+	{
+		ecosystem: "pypi",
+		pattern: /\bpoetry\s+add\s+([^\s-][^\s]*)/i
+	},
+	{
+		ecosystem: "pypi",
+		pattern: /\bpipenv\s+install\s+([^\s-][^\s]*)/i
+	},
+	{
+		ecosystem: "cargo",
+		pattern: /\bcargo\s+(?:add|install)\s+([^\s-][^\s]*)/i
+	},
+	{
+		ecosystem: "gem",
+		pattern: /\bgem\s+install\s+([^\s-][^\s]*)/i
+	},
+	{
+		ecosystem: "gem",
+		pattern: /\bbundle\s+add\s+([^\s-][^\s]*)/i
+	},
+	{
+		ecosystem: "golang",
+		pattern: /\bgo\s+(?:get|install)\s+([^\s-][^\s]*)/i
+	},
+	{
+		ecosystem: "nuget",
+		pattern: /\bdotnet\s+add\s+package\s+([^\s-][^\s]*)/i
+	},
+	{
+		ecosystem: "nuget",
+		pattern: /\bnuget\s+install\s+([^\s-][^\s]*)/i
+	}
+];
+async function checkPackage(ecosystem, packageName, fetchImpl = fetch) {
+	const signal = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+	const commonHeaders = {
+		"Content-Type": "application/json",
+		Accept: "application/json, text/event-stream"
+	};
+	const initRes = await fetchImpl(MCP_URL, {
+		method: "POST",
+		headers: commonHeaders,
+		body: JSON.stringify({
+			jsonrpc: "2.0",
+			id: 1,
+			method: "initialize",
+			params: {
+				protocolVersion: "2024-11-05",
+				capabilities: {},
+				clientInfo: {
+					name: "socket-gate",
+					version: "1.0"
+				}
+			}
+		}),
+		signal
+	});
+	if (!initRes.ok) throw new Error(`Socket MCP initialize returned ${initRes.status}`);
+	const sessionId = initRes.headers.get("mcp-session-id");
+	if (!sessionId) throw new Error("Socket MCP did not return a session id");
+	await initRes.text();
+	const callRes = await fetchImpl(MCP_URL, {
+		method: "POST",
+		headers: {
+			...commonHeaders,
+			"Mcp-Session-Id": sessionId
+		},
+		body: JSON.stringify({
+			jsonrpc: "2.0",
+			id: 2,
+			method: "tools/call",
+			params: {
+				name: "depscore",
+				arguments: { packages: [{
+					ecosystem,
+					depname: packageName
+				}] }
+			}
+		}),
+		signal
+	});
+	if (!callRes.ok) throw new Error(`Socket MCP depscore returned ${callRes.status}`);
+	const payload = await callRes.json();
+	if (payload.result?.isError) throw new Error("Socket MCP reported a tool error (package likely not found)");
+	const score = parseSupplyChainScore(payload.result?.content?.[0]?.text ?? "");
+	if (score === void 0) throw new Error("Could not parse supplyChain score from MCP response");
+	if (score < SUPPLY_CHAIN_THRESHOLD) return {
+		decision: "deny",
+		reason: `Socket blocked "${packageName}" (${ecosystem}): supply chain score is ${score} (threshold ${SUPPLY_CHAIN_THRESHOLD}).\n\nReview: https://socket.dev/${ecosystem}/package/${packageName}`
+	};
+	return {
+		decision: "allow",
+		reason: ""
+	};
+}
+function extractPackage(command) {
+	for (const { ecosystem, pattern } of INSTALL_PATTERNS) {
+		const match = command.match(pattern);
+		if (match?.[1]) {
+			const name = stripVersion(match[1], ecosystem);
+			if (!name) continue;
+			return {
+				ecosystem,
+				name
+			};
+		}
+	}
+}
+function outputAllow() {
+	const payload = JSON.stringify({ hookSpecificOutput: {
+		hookEventName: "PreToolUse",
+		permissionDecision: "allow"
+	} });
+	process.stdout.write(payload);
+}
+function outputDeny(reason) {
+	const payload = JSON.stringify({ hookSpecificOutput: {
+		hookEventName: "PreToolUse",
+		permissionDecision: "deny",
+		permissionDecisionReason: reason
+	} });
+	process.stdout.write(payload);
+}
+function parseSupplyChainScore(text) {
+	const match = text.match(/supplyChain:\s*(\d+(?:\.\d+)?)/i);
+	return match ? Number(match[1]) : void 0;
+}
+function stripVersion(pkg, ecosystem) {
+	switch (ecosystem) {
+		case "npm": return pkg.replace(/@[\d^~].*/u, "").replace(/@latest$/u, "");
+		case "pypi": return pkg.split(/[=<>!~[]/)[0] ?? pkg;
+		case "cargo":
+		case "golang":
+		case "nuget": return pkg.replace(/@.*$/u, "");
+		default: return pkg;
+	}
+}
+async function main() {
+	let raw;
+	try {
+		raw = (0, node_fs.readFileSync)(0, "utf-8");
+	} catch {
+		outputAllow();
+		return;
+	}
+	if (!raw.trim()) {
+		outputAllow();
+		return;
+	}
+	let input;
+	try {
+		input = JSON.parse(raw);
+	} catch {
+		outputAllow();
+		return;
+	}
+	if (input.tool_name !== "Bash") {
+		outputAllow();
+		return;
+	}
+	const command = typeof input.tool_input === "string" ? input.tool_input : input.tool_input?.["command"] || "";
+	if (!command) {
+		outputAllow();
+		return;
+	}
+	const target = extractPackage(command);
+	if (!target) {
+		outputAllow();
+		return;
+	}
+	try {
+		const result = await checkPackage(target.ecosystem, target.name);
+		if (result.decision === "deny") outputDeny(result.reason);
+		else outputAllow();
+	} catch (e) {
+		const errLine = `socket-gate: check failed for ${target.ecosystem}/${target.name}, failing open: ${(0, import_message.errorMessage)(e)}\n`;
+		process.stderr.write(errLine);
+		outputAllow();
+	}
+}
+if (node_process.argv[1] !== void 0 && (0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href) === node_process.argv[1]) main().catch(() => {
+	outputAllow();
+});
+
+//#endregion
+exports.checkPackage = checkPackage;
+exports.extractPackage = extractPackage;
+exports.outputAllow = outputAllow;
+exports.outputDeny = outputDeny;
+exports.parseSupplyChainScore = parseSupplyChainScore;
+exports.stripVersion = stripVersion;