@socketsecurity/lib 5.27.0 → 6.0.0

package/dist/external-tools/trivy/resolve.js

@@ -0,0 +1,73 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var resolve_exports = {};
+__export(resolve_exports, {
+  cacheKey: () => cacheKey,
+  doResolveTrivy: () => doResolveTrivy,
+  resetTrivyResolution: () => resetTrivyResolution,
+  resolveTrivy: () => resolveTrivy
+});
+module.exports = __toCommonJS(resolve_exports);
+var import_from_download = require("./from-download");
+var import_from_path = require("./from-path");
+var import_from_vfs = require("./from-vfs");
+const resolutionCache = /* @__PURE__ */ new Map();
+function cacheKey(opts) {
+  if (!opts?.downloadIfMissing) {
+    return "local-only";
+  }
+  const { cacheDir, integrity, platformArch, version } = opts.downloadIfMissing;
+  const integrityKey = typeof integrity === "string" ? integrity : integrity ? `${integrity.type}:${integrity.value}` : "";
+  return `dl:${version}:${platformArch}:${integrityKey}:${cacheDir ?? ""}`;
+}
+async function doResolveTrivy(opts) {
+  const fromVfs = await (0, import_from_vfs.trivyFromVfs)();
+  if (fromVfs) {
+    return fromVfs;
+  }
+  const fromPath = await (0, import_from_path.trivyFromPath)();
+  if (fromPath) {
+    return fromPath;
+  }
+  if (opts?.downloadIfMissing) {
+    return (0, import_from_download.trivyFromDownload)(opts.downloadIfMissing);
+  }
+  return void 0;
+}
+function resetTrivyResolution() {
+  resolutionCache.clear();
+}
+function resolveTrivy(opts) {
+  const key = cacheKey(opts);
+  let cached = resolutionCache.get(key);
+  if (!cached) {
+    cached = doResolveTrivy(opts);
+    resolutionCache.set(key, cached);
+  }
+  return cached;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  cacheKey,
+  doResolveTrivy,
+  resetTrivyResolution,
+  resolveTrivy
+});

package/dist/external-tools/trivy/types.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @file Shared types for Trivy resolution. Trivy is Aqua Security's
+ *   single-binary vulnerability + IaC + SBOM scanner. socket-basics uses it for
+ *   container + filesystem scanning.
+ */
+import type { ResolvedToolIntegrity } from '../from-download';
+export type TrivySource = 'download' | 'path' | 'vfs';
+/**
+ * A resolved Trivy installation.
+ */
+export interface ResolvedTrivy {
+    /**
+     * Absolute path to the `trivy` executable.
+     */
+    readonly path: string;
+    /**
+     * Which resolver tier found this.
+     */
+    readonly source: TrivySource;
+    /**
+     * See {@link ResolvedToolIntegrity}.
+     */
+    readonly integrity?: ResolvedToolIntegrity;
+}

package/dist/external-tools/trivy/types.js

@@ -0,0 +1,18 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);

package/dist/external-tools/trufflehog/asset-names.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @file Upstream TruffleHog release asset-name mapping per `platform-arch`.
+ *   TruffleHog publishes a single tar.gz per platform-arch under
+ *   https://github.com/trufflesecurity/trufflehog/releases/download/v<X.Y.Z>/.
+ *   Asset names follow `trufflehog_<X.Y.Z>_<os>_<arch>.tar.gz`.
+ */
+export interface TrufflehogAssetEntry {
+    /**
+     * Asset-name suffix appended to `trufflehog_<version>_`.
+     */
+    readonly suffix: string;
+}
+export declare const TRUFFLEHOG_ASSET_MAP: Readonly<Record<string, TrufflehogAssetEntry>>;
+export declare function getTrufflehogAssetEntry(platformArch: string): TrufflehogAssetEntry | undefined;
+export interface TrufflehogDownloadOptions {
+    /**
+     * TruffleHog release version, e.g. `'3.93.8'` (no `v` prefix; the helper
+     * prepends it).
+     */
+    version: string;
+    /**
+     * Fleet platform-arch token — looked up in `TRUFFLEHOG_ASSET_MAP`. Returns
+     * `undefined` when no entry exists for the target.
+     */
+    platformArch: string;
+}
+/**
+ * Build the GitHub release-asset download URL for an upstream TruffleHog
+ * binary. Returns `undefined` when no entry exists for the requested
+ * platform-arch.
+ *
+ * Reference: https://github.com/trufflesecurity/trufflehog/releases.
+ */
+export declare function getTrufflehogDownloadUrl(opts: TrufflehogDownloadOptions): string | undefined;

package/dist/external-tools/trufflehog/asset-names.js

@@ -0,0 +1,72 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var asset_names_exports = {};
+__export(asset_names_exports, {
+  TRUFFLEHOG_ASSET_MAP: () => TRUFFLEHOG_ASSET_MAP,
+  getTrufflehogAssetEntry: () => getTrufflehogAssetEntry,
+  getTrufflehogDownloadUrl: () => getTrufflehogDownloadUrl
+});
+module.exports = __toCommonJS(asset_names_exports);
+var import_object = require("../../primordials/object");
+const TRUFFLEHOG_ASSET_MAP = (0, import_object.ObjectFreeze)({
+  __proto__: null,
+  "darwin-arm64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "darwin_arm64.tar.gz"
+  }),
+  "darwin-x64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "darwin_amd64.tar.gz"
+  }),
+  "linux-arm64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "linux_arm64.tar.gz"
+  }),
+  "linux-x64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "linux_amd64.tar.gz"
+  }),
+  "win-arm64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "windows_arm64.tar.gz"
+  }),
+  "win-x64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "windows_amd64.tar.gz"
+  })
+});
+function getTrufflehogAssetEntry(platformArch) {
+  return TRUFFLEHOG_ASSET_MAP[platformArch];
+}
+function getTrufflehogDownloadUrl(opts) {
+  const { platformArch, version } = opts;
+  const entry = TRUFFLEHOG_ASSET_MAP[platformArch];
+  if (!entry) {
+    return void 0;
+  }
+  return `https://github.com/trufflesecurity/trufflehog/releases/download/v${version}/trufflehog_${version}_${entry.suffix}`;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  TRUFFLEHOG_ASSET_MAP,
+  getTrufflehogAssetEntry,
+  getTrufflehogDownloadUrl
+});

package/dist/external-tools/trufflehog/from-download.d.ts

@@ -0,0 +1,37 @@
+/**
+ * @file `trufflehogFromDownload()` — fetches upstream TruffleHog and returns a
+ *   `ResolvedTrufflehog` pointing at the extracted binary. TruffleHog ships as
+ *   tar.gz archives per platform; the helper extracts and locates the
+ *   `trufflehog` (or `trufflehog.exe`) executable. Idempotent: re-running with
+ *   the same `{version, platformArch}` after a successful first run is a cache
+ *   check, no network. Trust-on-first-use: pass `integrity` from
+ *   `external-tools.json` when available.
+ */
+import type { BinaryDownloader } from '../from-download';
+import type { HashSpec } from '../../integrity';
+import type { ResolvedTrufflehog } from './types';
+export interface TrufflehogFromDownloadOptions {
+    /**
+     * TruffleHog release version, e.g. `'3.93.8'`.
+     */
+    version: string;
+    /**
+     * Fleet platform-arch token, e.g. `'darwin-arm64'`.
+     */
+    platformArch: string;
+    /**
+     * Optional pinned integrity from `external-tools.json`.
+     */
+    integrity?: HashSpec | undefined;
+    /**
+     * Override the cache directory. By default the binary extracts into
+     * `<getSocketDlxDir()>/trufflehog/<version>/<platformArch>/`.
+     */
+    cacheDir?: string | undefined;
+    /**
+     * Inject a custom downloader. Forwarded to the underlying
+     * `downloadAndExtractTool`. Defaults to dlx.
+     */
+    downloader?: BinaryDownloader | undefined;
+}
+export declare function trufflehogFromDownload(opts: TrufflehogFromDownloadOptions): Promise<ResolvedTrufflehog | undefined>;

package/dist/external-tools/trufflehog/from-download.js

@@ -0,0 +1,65 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var from_download_exports = {};
+__export(from_download_exports, {
+  trufflehogFromDownload: () => trufflehogFromDownload
+});
+module.exports = __toCommonJS(from_download_exports);
+var import_node_path = __toESM(require("node:path"));
+var import_node_process = __toESM(require("node:process"));
+var import_socket = require("../../paths/socket");
+var import_from_download = require("../from-download");
+var import_asset_names = require("./asset-names");
+async function trufflehogFromDownload(opts) {
+  const { cacheDir, downloader, integrity, platformArch, version } = opts;
+  const url = (0, import_asset_names.getTrufflehogDownloadUrl)({ version, platformArch });
+  if (!url) {
+    return void 0;
+  }
+  const extractedDir = cacheDir ?? import_node_path.default.join((0, import_socket.getSocketDlxDir)(), "trufflehog", version, platformArch);
+  const archive = await (0, import_from_download.downloadAndExtractTool)({
+    url,
+    name: `trufflehog-${version}-${platformArch}.tar.gz`,
+    integrity,
+    extractedDir,
+    downloader
+  });
+  const binary = import_node_process.default.platform === "win32" ? "trufflehog.exe" : "trufflehog";
+  return {
+    path: import_node_path.default.join(extractedDir, binary),
+    source: "download",
+    integrity: archive.integrity
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  trufflehogFromDownload
+});

package/dist/external-tools/trufflehog/from-path.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @file `trufflehogFromPath()` — looks for `trufflehog` on the system PATH via
+ *   socket-lib's `which`. Returns the resolved-shape object if found; otherwise
+ *   `undefined`.
+ */
+import type { ResolvedTrufflehog } from './types';
+export declare function trufflehogFromPath(): Promise<ResolvedTrufflehog | undefined>;

package/dist/external-tools/trufflehog/from-path.js

@@ -0,0 +1,40 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var from_path_exports = {};
+__export(from_path_exports, {
+  trufflehogFromPath: () => trufflehogFromPath
+});
+module.exports = __toCommonJS(from_path_exports);
+var import_which = require("../../bin/which");
+async function trufflehogFromPath() {
+  const onPath = await (0, import_which.which)("trufflehog", { nothrow: true });
+  if (typeof onPath !== "string") {
+    return void 0;
+  }
+  return {
+    path: onPath,
+    source: "path"
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  trufflehogFromPath
+});

package/dist/external-tools/trufflehog/from-vfs.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @file `trufflehogFromVfs()` — extracts the TruffleHog binary from the smol
+ *   binary's VFS. Returns `undefined` when the binary doesn't have TruffleHog
+ *   bundled.
+ */
+import type { ResolvedTrufflehog } from './types';
+/**
+ * Relative VFS key for the bundled TruffleHog binary.
+ */
+export declare const TRUFFLEHOG_VFS_KEY = "trufflehog";
+export declare function trufflehogFromVfs(): Promise<ResolvedTrufflehog | undefined>;

package/dist/external-tools/trufflehog/from-vfs.js

@@ -0,0 +1,47 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var from_vfs_exports = {};
+__export(from_vfs_exports, {
+  TRUFFLEHOG_VFS_KEY: () => TRUFFLEHOG_VFS_KEY,
+  trufflehogFromVfs: () => trufflehogFromVfs
+});
+module.exports = __toCommonJS(from_vfs_exports);
+var import_vfs = require("../../smol/vfs");
+const TRUFFLEHOG_VFS_KEY = "trufflehog";
+async function trufflehogFromVfs() {
+  const vfs = (0, import_vfs.getSmolVfs)();
+  if (!vfs) {
+    return void 0;
+  }
+  if (!vfs.has(TRUFFLEHOG_VFS_KEY)) {
+    return void 0;
+  }
+  const realPath = await vfs.extract(TRUFFLEHOG_VFS_KEY);
+  return {
+    path: realPath,
+    source: "vfs"
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  TRUFFLEHOG_VFS_KEY,
+  trufflehogFromVfs
+});

package/dist/external-tools/trufflehog/resolve.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @file `resolveTrufflehog()` — TruffleHog resolution entry point. Tries each
+ *   source in order:
+ *
+ *   1. VFS — smol binary's embedded TruffleHog (if packed)
+ *   2. PATH — `trufflehog` on the system PATH
+ *   3. download — upstream GitHub release tar.gz (only when `downloadIfMissing` is
+ *      passed) Returns `undefined` if all of the enabled sources miss. Memoized
+ *      per option-shape; same caching semantics as `resolveJre()`.
+ */
+import type { BinaryDownloader } from '../from-download';
+import type { HashSpec } from '../../integrity';
+import type { ResolvedTrufflehog } from './types';
+export interface ResolveTrufflehogOptions {
+    /**
+     * When set, the resolver falls through to a GitHub release download after the
+     * local-discovery tiers miss. Omit to keep the resolver read-only.
+     */
+    downloadIfMissing?: {
+        version: string;
+        platformArch: string;
+        integrity?: HashSpec | undefined;
+        cacheDir?: string | undefined;
+        downloader?: BinaryDownloader | undefined;
+    } | undefined;
+}
+export declare function cacheKey(opts: ResolveTrufflehogOptions | undefined): string;
+export declare function doResolveTrufflehog(opts?: ResolveTrufflehogOptions | undefined): Promise<ResolvedTrufflehog | undefined>;
+export declare function resetTrufflehogResolution(): void;
+export declare function resolveTrufflehog(opts?: ResolveTrufflehogOptions | undefined): Promise<ResolvedTrufflehog | undefined>;

package/dist/external-tools/trufflehog/resolve.js

@@ -0,0 +1,73 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var resolve_exports = {};
+__export(resolve_exports, {
+  cacheKey: () => cacheKey,
+  doResolveTrufflehog: () => doResolveTrufflehog,
+  resetTrufflehogResolution: () => resetTrufflehogResolution,
+  resolveTrufflehog: () => resolveTrufflehog
+});
+module.exports = __toCommonJS(resolve_exports);
+var import_from_download = require("./from-download");
+var import_from_path = require("./from-path");
+var import_from_vfs = require("./from-vfs");
+const resolutionCache = /* @__PURE__ */ new Map();
+function cacheKey(opts) {
+  if (!opts?.downloadIfMissing) {
+    return "local-only";
+  }
+  const { cacheDir, integrity, platformArch, version } = opts.downloadIfMissing;
+  const integrityKey = typeof integrity === "string" ? integrity : integrity ? `${integrity.type}:${integrity.value}` : "";
+  return `dl:${version}:${platformArch}:${integrityKey}:${cacheDir ?? ""}`;
+}
+async function doResolveTrufflehog(opts) {
+  const fromVfs = await (0, import_from_vfs.trufflehogFromVfs)();
+  if (fromVfs) {
+    return fromVfs;
+  }
+  const fromPath = await (0, import_from_path.trufflehogFromPath)();
+  if (fromPath) {
+    return fromPath;
+  }
+  if (opts?.downloadIfMissing) {
+    return (0, import_from_download.trufflehogFromDownload)(opts.downloadIfMissing);
+  }
+  return void 0;
+}
+function resetTrufflehogResolution() {
+  resolutionCache.clear();
+}
+function resolveTrufflehog(opts) {
+  const key = cacheKey(opts);
+  let cached = resolutionCache.get(key);
+  if (!cached) {
+    cached = doResolveTrufflehog(opts);
+    resolutionCache.set(key, cached);
+  }
+  return cached;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  cacheKey,
+  doResolveTrufflehog,
+  resetTrufflehogResolution,
+  resolveTrufflehog
+});

package/dist/external-tools/trufflehog/types.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @file Shared types for TruffleHog resolution. TruffleHog is a single-binary
+ *   secrets scanner from TruffleSecurity. socket-basics uses it for the SAST
+ *   secrets-scan workflow; other Socket tooling can reach for it via
+ *   `resolveTrufflehog()`.
+ */
+import type { ResolvedToolIntegrity } from '../from-download';
+export type TrufflehogSource = 'download' | 'path' | 'vfs';
+/**
+ * A resolved TruffleHog installation.
+ */
+export interface ResolvedTrufflehog {
+    /**
+     * Absolute path to the `trufflehog` executable.
+     */
+    readonly path: string;
+    /**
+     * Which resolver tier found this.
+     */
+    readonly source: TrufflehogSource;
+    /**
+     * See {@link ResolvedToolIntegrity}.
+     */
+    readonly integrity?: ResolvedToolIntegrity;
+}

package/dist/external-tools/trufflehog/types.js

@@ -0,0 +1,18 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);

package/dist/external-tools/uv/asset-names.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @file Upstream uv release asset-name mapping per `platform-arch`. uv
+ *   publishes per-platform archives under
+ *   https://github.com/astral-sh/uv/releases/download/<X.Y.Z>/. The release tag
+ *   is the bare semver (no `v` prefix), unlike most upstream projects. Each
+ *   archive wraps the binary one directory deep (`uv-<triple>/uv[.exe]`), so
+ *   callers should pass `strip: 1` to the extractor — or, equivalently, look up
+ *   the binary inside the archive's stem directory.
+ */
+export interface UvAssetEntry {
+    /**
+     * Full asset filename (no version interpolation — uv asset names are
+     * version-free).
+     */
+    readonly asset: string;
+}
+export declare const UV_ASSET_MAP: Readonly<Record<string, UvAssetEntry>>;
+export declare function getUvAssetEntry(platformArch: string): UvAssetEntry | undefined;
+export interface UvDownloadOptions {
+    /**
+     * Uv release version, e.g. `'0.10.11'` (no `v` prefix — astral-sh/uv tags
+     * releases as bare semver).
+     */
+    version: string;
+    /**
+     * Fleet platform-arch token — looked up in `UV_ASSET_MAP`.
+     */
+    platformArch: string;
+}
+/**
+ * Build the GitHub release-asset download URL for an upstream uv binary.
+ * Returns `undefined` when no entry exists for the requested platform-arch.
+ *
+ * Reference: https://github.com/astral-sh/uv/releases.
+ */
+export declare function getUvDownloadUrl(opts: UvDownloadOptions): string | undefined;