@socketsecurity/lib 5.27.0 → 6.0.0

package/dist/external-tools/jre/resolve.js

@@ -0,0 +1,78 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var resolve_exports = {};
+__export(resolve_exports, {
+  cacheKey: () => cacheKey,
+  doResolveJre: () => doResolveJre,
+  resetJreResolution: () => resetJreResolution,
+  resolveJre: () => resolveJre
+});
+module.exports = __toCommonJS(resolve_exports);
+var import_from_download = require("./from-download");
+var import_from_java_home = require("./from-java-home");
+var import_from_path = require("./from-path");
+var import_from_vfs = require("./from-vfs");
+const resolutionCache = /* @__PURE__ */ new Map();
+function cacheKey(opts) {
+  if (!opts?.downloadIfMissing) {
+    return "local-only";
+  }
+  const { cacheDir, integrity, platformArch, version } = opts.downloadIfMissing;
+  const integrityKey = typeof integrity === "string" ? integrity : integrity ? `${integrity.type}:${integrity.value}` : "";
+  return `dl:${version}:${platformArch}:${integrityKey}:${cacheDir ?? ""}`;
+}
+async function doResolveJre(opts) {
+  const fromVfs = await (0, import_from_vfs.jreFromVfs)();
+  if (fromVfs) {
+    return fromVfs;
+  }
+  const fromJavaHome = (0, import_from_java_home.jreFromJavaHome)();
+  if (fromJavaHome) {
+    return fromJavaHome;
+  }
+  const fromPath = await (0, import_from_path.jreFromPath)();
+  if (fromPath) {
+    return fromPath;
+  }
+  if (opts?.downloadIfMissing) {
+    return (0, import_from_download.jreFromDownload)(opts.downloadIfMissing);
+  }
+  return void 0;
+}
+function resetJreResolution() {
+  resolutionCache.clear();
+}
+function resolveJre(opts) {
+  const key = cacheKey(opts);
+  let cached = resolutionCache.get(key);
+  if (!cached) {
+    cached = doResolveJre(opts);
+    resolutionCache.set(key, cached);
+  }
+  return cached;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  cacheKey,
+  doResolveJre,
+  resetJreResolution,
+  resolveJre
+});

package/dist/external-tools/jre/types.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @file Shared types for JRE resolution. Returned by `resolveJre()` to describe
+ *   a discovered JRE:
+ *
+ *   - `javaPath` — absolute path to the `java` executable
+ *   - `javaHome` — absolute path to the JRE root (parent of `bin/`)
+ *   - `source` — which resolver tier found this JRE Major-version detection is
+ *     intentionally left out of the resolved shape; callers that need it spawn
+ *     `java -version` lazily. Most external-tools callsites (Bazel, SBT) don't
+ *     need it — they assume the JRE is compatible with their launcher.
+ */
+import type { ResolvedToolIntegrity } from '../from-download';
+import type { AdoptiumAssetQuery } from './asset-names';
+export type JreSource = 'download' | 'java-home' | 'path' | 'vfs';
+/**
+ * A resolved JRE installation. Either embedded in the smol binary's VFS,
+ * pointed to by `JAVA_HOME`, or present on PATH.
+ */
+export interface ResolvedJre {
+    readonly javaPath: string;
+    readonly javaHome: string;
+    readonly source: JreSource;
+    /**
+     * See {@link ResolvedToolIntegrity}.
+     */
+    readonly integrity?: ResolvedToolIntegrity;
+}
+export type { AdoptiumAssetQuery };

package/dist/external-tools/jre/types.js

@@ -0,0 +1,18 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);

package/dist/external-tools/manifest.d.ts

@@ -0,0 +1,105 @@
+/**
+ * @file Reader for `external-tools.json` — the fleet manifest describing
+ *   downloadable external binaries (sfw, zizmor, etc.) with pinned versions,
+ *   per-platform asset names, and integrity hashes. The manifest itself is
+ *   hand-maintained in each fleet repo's root (`<repo>/external-tools.json`)
+ *   and consumed by the setup-and-install GitHub action. This reader gives
+ *   in-process consumers (external- tools resolvers, ad-hoc scripts) the same
+ *   typed view without each one re-implementing the JSON-parse + shape check +
+ *   integrity-string validation. Shape: { "<tool-name>": { "description":
+ *   "human-readable summary", "version": "1.7.2", "release": "asset" |
+ *   "tarball" | ..., "repository": "github:owner/repo", "notes": [...],
+ *   "checksums": { "<platform-arch>": { "asset": "<asset-filename>",
+ *   "integrity": "sha256-base64=" } } } } Some tools have flavor variants (e.g.
+ *   sfw's `free` / `enterprise`) that wrap the `{repository, binaryName,
+ *   checksums}` triple under a flavor key. Use `getToolFlavor` for those. Some
+ *   entries (e.g. `rust`) describe a system tool with a different shape —
+ *   they're skipped by `getTool` and fully readable only via the raw
+ *   `readManifest` returning unknown.
+ */
+/**
+ * Lookup helper — return the plain tool entry for `toolName`, or `undefined` if
+ * the manifest doesn't have it or the entry is flavored / other-shape.
+ */
+export declare function getTool(manifest: Manifest, toolName: string): ToolEntry | undefined;
+/**
+ * Lookup helper — return the specific flavor of a flavored tool, or `undefined`
+ * if the tool isn't flavored or the flavor doesn't exist.
+ */
+export declare function getToolFlavor(manifest: Manifest, toolName: string, flavor: string): ToolFlavor | undefined;
+/**
+ * Per-platform asset record: which filename to fetch from the release, plus the
+ * integrity hash to verify against.
+ */
+export interface ToolChecksum {
+    /**
+     * Asset filename on the GitHub release page.
+     */
+    asset: string;
+    /**
+     * SRI integrity string, e.g. `sha256-<base64>=`. Validated on read.
+     */
+    integrity: string;
+}
+/**
+ * A downloadable-binary tool entry. `checksums` is keyed by the fleet's
+ * platform-arch token (`darwin-arm64`, `linux-x64-musl`, `win-x64`, etc. — same
+ * vocabulary as `getPlatformArch`).
+ */
+export interface ToolEntry {
+    description: string;
+    version: string;
+    release: string;
+    repository: string;
+    binaryName?: string | undefined;
+    notes?: readonly string[] | undefined;
+    checksums: Readonly<Record<string, ToolChecksum>>;
+}
+/**
+ * A flavored tool entry — sfw is the canonical example, with `free` and
+ * `enterprise` variants sharing the same outer `description` / `version` /
+ * `release` but each carrying its own `{repository, binaryName, checksums}`.
+ */
+export interface FlavoredToolEntry {
+    description: string;
+    version: string;
+    release: string;
+    notes?: readonly string[] | undefined;
+    flavors: Readonly<Record<string, ToolFlavor>>;
+}
+export interface ToolFlavor {
+    repository: string;
+    binaryName?: string | undefined;
+    checksums: Readonly<Record<string, ToolChecksum>>;
+}
+/**
+ * Parsed manifest. `tools` is a flat map; the values are unions because some
+ * tools are plain (`ToolEntry`) and some are flavored (`FlavoredToolEntry`).
+ * Unknown shapes (rust's `components` entry, future variants) come back as `{
+ * kind: 'other'; raw: unknown }` so callers can opt in to handle them.
+ */
+export interface Manifest {
+    tools: Readonly<Record<string, ManifestEntry>>;
+}
+export type ManifestEntry = {
+    kind: 'tool';
+    entry: ToolEntry;
+} | {
+    kind: 'flavored';
+    entry: FlavoredToolEntry;
+} | {
+    kind: 'other';
+    raw: unknown;
+};
+export declare function isObject(value: unknown): value is Record<string, unknown>;
+export declare function parseChecksum(raw: unknown, toolName: string, platformKey: string): ToolChecksum;
+export declare function parseChecksums(raw: unknown, toolName: string): Record<string, ToolChecksum>;
+export declare function parseToolEntry(raw: unknown, toolName: string): ManifestEntry;
+/**
+ * Read an `external-tools.json` file from disk and return the parsed manifest.
+ * Throws on malformed JSON or invalid integrity strings; unknown-shape entries
+ * (rust components, future variants) come back as `{kind: 'other', raw}` so
+ * callers can handle them out-of-band without blocking the manifest read.
+ */
+export declare function readExternalToolsManifest(filepath: string): Promise<Manifest>;
+export declare function tryParseFlavored(raw: Record<string, unknown>, toolName: string): FlavoredToolEntry | undefined;

package/dist/external-tools/manifest.js

@@ -0,0 +1,167 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var manifest_exports = {};
+__export(manifest_exports, {
+  getTool: () => getTool,
+  getToolFlavor: () => getToolFlavor,
+  isObject: () => isObject,
+  parseChecksum: () => parseChecksum,
+  parseChecksums: () => parseChecksums,
+  parseToolEntry: () => parseToolEntry,
+  readExternalToolsManifest: () => readExternalToolsManifest,
+  tryParseFlavored: () => tryParseFlavored
+});
+module.exports = __toCommonJS(manifest_exports);
+var import_read_json = require("../fs/read-json");
+var import_integrity = require("../integrity");
+var import_array = require("../primordials/array");
+var import_error = require("../primordials/error");
+function getTool(manifest, toolName) {
+  const entry = manifest.tools[toolName];
+  return entry?.kind === "tool" ? entry.entry : void 0;
+}
+function getToolFlavor(manifest, toolName, flavor) {
+  const entry = manifest.tools[toolName];
+  if (entry?.kind !== "flavored") {
+    return void 0;
+  }
+  return entry.entry.flavors[flavor];
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !(0, import_array.ArrayIsArray)(value);
+}
+function parseChecksum(raw, toolName, platformKey) {
+  if (!isObject(raw)) {
+    throw new import_error.ErrorCtor(
+      `external-tools.json: tool '${toolName}' checksum entry '${platformKey}' must be an object, got: ${typeof raw}`
+    );
+  }
+  const r = raw;
+  if (typeof r.asset !== "string" || r.asset.length === 0) {
+    throw new import_error.ErrorCtor(
+      `external-tools.json: tool '${toolName}' platform '${platformKey}' is missing a non-empty 'asset' string`
+    );
+  }
+  if (typeof r.integrity !== "string" || !(0, import_integrity.isIntegrityString)(r.integrity)) {
+    throw new import_error.ErrorCtor(
+      `external-tools.json: tool '${toolName}' platform '${platformKey}' has an invalid 'integrity' (expected SRI sha512 or sha256 form): ${r.integrity}`
+    );
+  }
+  return { asset: r.asset, integrity: r.integrity };
+}
+function parseChecksums(raw, toolName) {
+  if (!isObject(raw)) {
+    throw new import_error.ErrorCtor(
+      `external-tools.json: tool '${toolName}' is missing a 'checksums' object`
+    );
+  }
+  const out = {};
+  for (const platformKey of Object.keys(raw)) {
+    out[platformKey] = parseChecksum(raw[platformKey], toolName, platformKey);
+  }
+  return out;
+}
+function parseToolEntry(raw, toolName) {
+  if (!isObject(raw)) {
+    return { kind: "other", raw };
+  }
+  const r = raw;
+  if (isObject(r.checksums)) {
+    if (typeof r.description !== "string" || typeof r.version !== "string" || typeof r.release !== "string" || typeof r.repository !== "string") {
+      return { kind: "other", raw };
+    }
+    return {
+      kind: "tool",
+      entry: {
+        description: r.description,
+        version: r.version,
+        release: r.release,
+        repository: r.repository,
+        binaryName: typeof r.binaryName === "string" ? r.binaryName : void 0,
+        notes: (0, import_array.ArrayIsArray)(r.notes) ? r.notes : void 0,
+        checksums: parseChecksums(r.checksums, toolName)
+      }
+    };
+  }
+  const flavored = tryParseFlavored(raw, toolName);
+  if (flavored) {
+    return { kind: "flavored", entry: flavored };
+  }
+  return { kind: "other", raw };
+}
+async function readExternalToolsManifest(filepath) {
+  const raw = await (0, import_read_json.readJson)(filepath);
+  if (!isObject(raw)) {
+    throw new import_error.ErrorCtor(
+      `external-tools.json: expected top-level object, got: ${typeof raw}`
+    );
+  }
+  const tools = {};
+  for (const toolName of Object.keys(raw)) {
+    if (toolName.startsWith("$")) {
+      continue;
+    }
+    tools[toolName] = parseToolEntry(raw[toolName], toolName);
+  }
+  return { tools };
+}
+function tryParseFlavored(raw, toolName) {
+  const flavors = {};
+  for (const key of Object.keys(raw)) {
+    const value = raw[key];
+    if (!isObject(value)) {
+      continue;
+    }
+    const rf = value;
+    if (!isObject(rf.checksums)) {
+      continue;
+    }
+    if (typeof rf.repository !== "string") {
+      continue;
+    }
+    flavors[key] = {
+      repository: rf.repository,
+      binaryName: typeof rf.binaryName === "string" ? rf.binaryName : void 0,
+      checksums: parseChecksums(rf.checksums, `${toolName}.${key}`)
+    };
+  }
+  if (Object.keys(flavors).length === 0) {
+    return void 0;
+  }
+  return {
+    description: String(raw["description"] ?? ""),
+    version: String(raw["version"] ?? ""),
+    release: String(raw["release"] ?? ""),
+    notes: (0, import_array.ArrayIsArray)(raw["notes"]) ? raw["notes"] : void 0,
+    flavors
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getTool,
+  getToolFlavor,
+  isObject,
+  parseChecksum,
+  parseChecksums,
+  parseToolEntry,
+  readExternalToolsManifest,
+  tryParseFlavored
+});

package/dist/external-tools/opengrep/asset-names.d.ts

@@ -0,0 +1,44 @@
+/**
+ * @file Upstream OpenGrep release asset-name mapping per `platform-arch`.
+ *   OpenGrep publishes raw binaries (no archive wrapper) for macOS and Linux,
+ *   and a zipped binary (`opengrep-core_windows_x86.zip` containing
+ *   `opengrep-core.exe`) for Windows. The `isArchive` flag tells the download
+ *   helper whether to extract or copy as-is.
+ */
+export interface OpengrepAssetEntry {
+    /**
+     * Full asset filename (no version interpolation — OpenGrep keeps asset names
+     * version-free).
+     */
+    readonly asset: string;
+    /**
+     * `true` when the asset is a zip that must be extracted; `false` when the
+     * asset IS the binary (just copy + chmod).
+     */
+    readonly isArchive: boolean;
+    /**
+     * For archive assets, the path inside the zip to the binary. Undefined for
+     * bare-binary assets.
+     */
+    readonly binaryInArchive: string | undefined;
+}
+export declare const OPENGREP_ASSET_MAP: Readonly<Record<string, OpengrepAssetEntry>>;
+export declare function getOpengrepAssetEntry(platformArch: string): OpengrepAssetEntry | undefined;
+export interface OpengrepDownloadOptions {
+    /**
+     * OpenGrep release version, e.g. `'1.16.5'` (no `v` prefix; the helper
+     * prepends it for the release tag).
+     */
+    version: string;
+    /**
+     * Fleet platform-arch token — looked up in `OPENGREP_ASSET_MAP`.
+     */
+    platformArch: string;
+}
+/**
+ * Build the GitHub release-asset download URL for an upstream OpenGrep binary.
+ * Returns `undefined` when no entry exists for the requested platform-arch.
+ *
+ * Reference: https://github.com/opengrep/opengrep/releases.
+ */
+export declare function getOpengrepDownloadUrl(opts: OpengrepDownloadOptions): string | undefined;

package/dist/external-tools/opengrep/asset-names.js

@@ -0,0 +1,78 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var asset_names_exports = {};
+__export(asset_names_exports, {
+  OPENGREP_ASSET_MAP: () => OPENGREP_ASSET_MAP,
+  getOpengrepAssetEntry: () => getOpengrepAssetEntry,
+  getOpengrepDownloadUrl: () => getOpengrepDownloadUrl
+});
+module.exports = __toCommonJS(asset_names_exports);
+var import_object = require("../../primordials/object");
+const OPENGREP_ASSET_MAP = (0, import_object.ObjectFreeze)({
+  __proto__: null,
+  "darwin-arm64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    asset: "opengrep_osx_arm64",
+    isArchive: false,
+    binaryInArchive: void 0
+  }),
+  "darwin-x64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    asset: "opengrep_osx_x86",
+    isArchive: false,
+    binaryInArchive: void 0
+  }),
+  "linux-arm64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    asset: "opengrep_manylinux_aarch64",
+    isArchive: false,
+    binaryInArchive: void 0
+  }),
+  "linux-x64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    asset: "opengrep_manylinux_x86",
+    isArchive: false,
+    binaryInArchive: void 0
+  }),
+  "win-x64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    asset: "opengrep-core_windows_x86.zip",
+    isArchive: true,
+    binaryInArchive: "opengrep-core.exe"
+  })
+});
+function getOpengrepAssetEntry(platformArch) {
+  return OPENGREP_ASSET_MAP[platformArch];
+}
+function getOpengrepDownloadUrl(opts) {
+  const { platformArch, version } = opts;
+  const entry = OPENGREP_ASSET_MAP[platformArch];
+  if (!entry) {
+    return void 0;
+  }
+  return `https://github.com/opengrep/opengrep/releases/download/v${version}/` + entry.asset;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OPENGREP_ASSET_MAP,
+  getOpengrepAssetEntry,
+  getOpengrepDownloadUrl
+});

package/dist/external-tools/opengrep/from-download.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @file `opengrepFromDownload()` — fetches upstream OpenGrep and returns a
+ *   `ResolvedOpengrep` pointing at the cached binary. macOS/Linux assets are
+ *   bare binaries (no extraction); Windows ships a zip. The asset-map's
+ *   `isArchive` flag drives extraction vs. copy.
+ */
+import type { BinaryDownloader } from '../from-download';
+import type { HashSpec } from '../../integrity';
+import type { ResolvedOpengrep } from './types';
+export interface OpengrepFromDownloadOptions {
+    version: string;
+    platformArch: string;
+    integrity?: HashSpec | undefined;
+    cacheDir?: string | undefined;
+    downloader?: BinaryDownloader | undefined;
+}
+export declare function opengrepFromDownload(opts: OpengrepFromDownloadOptions): Promise<ResolvedOpengrep | undefined>;

package/dist/external-tools/opengrep/from-download.js

@@ -0,0 +1,83 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var from_download_exports = {};
+__export(from_download_exports, {
+  opengrepFromDownload: () => opengrepFromDownload
+});
+module.exports = __toCommonJS(from_download_exports);
+var import_node_path = __toESM(require("node:path"));
+var import_node_fs = require("node:fs");
+var import_socket = require("../../paths/socket");
+var import_safe = require("../../fs/safe");
+var import_from_download = require("../from-download");
+var import_asset_names = require("./asset-names");
+async function opengrepFromDownload(opts) {
+  const { cacheDir, downloader, integrity, platformArch, version } = opts;
+  const url = (0, import_asset_names.getOpengrepDownloadUrl)({ version, platformArch });
+  const entry = (0, import_asset_names.getOpengrepAssetEntry)(platformArch);
+  if (!url || !entry) {
+    return void 0;
+  }
+  const targetDir = cacheDir ?? import_node_path.default.join((0, import_socket.getSocketDlxDir)(), "opengrep", version, platformArch);
+  if (entry.isArchive) {
+    const archive2 = await (0, import_from_download.downloadAndExtractTool)({
+      url,
+      name: `opengrep-${version}-${platformArch}-${entry.asset}`,
+      integrity,
+      extractedDir: targetDir,
+      downloader
+    });
+    return {
+      path: import_node_path.default.join(targetDir, entry.binaryInArchive),
+      source: "download",
+      integrity: archive2.integrity
+    };
+  }
+  const archive = await (0, import_from_download.downloadToolArchive)({
+    url,
+    name: `opengrep-${version}-${platformArch}-${entry.asset}`,
+    integrity,
+    downloader
+  });
+  await (0, import_safe.safeMkdir)(targetDir);
+  const finalPath = import_node_path.default.join(targetDir, "opengrep");
+  await import_node_fs.promises.copyFile(archive.archivePath, finalPath);
+  await import_node_fs.promises.chmod(finalPath, 493);
+  return {
+    path: finalPath,
+    source: "download",
+    integrity: archive.integrity
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  opengrepFromDownload
+});

package/dist/external-tools/opengrep/from-path.d.ts

@@ -0,0 +1,5 @@
+/**
+ * @file `opengrepFromPath()` — looks for `opengrep` on the system PATH.
+ */
+import type { ResolvedOpengrep } from './types';
+export declare function opengrepFromPath(): Promise<ResolvedOpengrep | undefined>;

package/dist/external-tools/opengrep/from-path.js

@@ -0,0 +1,40 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var from_path_exports = {};
+__export(from_path_exports, {
+  opengrepFromPath: () => opengrepFromPath
+});
+module.exports = __toCommonJS(from_path_exports);
+var import_which = require("../../bin/which");
+async function opengrepFromPath() {
+  const onPath = await (0, import_which.which)("opengrep", { nothrow: true });
+  if (typeof onPath !== "string") {
+    return void 0;
+  }
+  return {
+    path: onPath,
+    source: "path"
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  opengrepFromPath
+});

package/dist/external-tools/opengrep/from-vfs.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @file `opengrepFromVfs()` — extracts the OpenGrep binary from the smol
+ *   binary's VFS. Returns `undefined` when the binary doesn't have OpenGrep
+ *   bundled.
+ */
+import type { ResolvedOpengrep } from './types';
+export declare const OPENGREP_VFS_KEY = "opengrep";
+export declare function opengrepFromVfs(): Promise<ResolvedOpengrep | undefined>;