@socketsecurity/lib 5.28.0 → 6.0.1

package/dist/external-tools/sbt/types.js

@@ -0,0 +1,18 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);

package/dist/external-tools/synp/asset-names.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @file Upstream synp package coordinates. npm package only — no per-platform
+ *   binaries — so the asset surface is just the package spec.
+ */
+export interface SynpPackageOptions {
+    /**
+     * Synp release version, e.g. `'1.9.14'`.
+     */
+    version: string;
+}
+/**
+ * Build the npm package spec string for the requested synp version.
+ */
+export declare function getSynpPackageSpec(opts: SynpPackageOptions): string;

package/dist/external-tools/synp/asset-names.js

@@ -0,0 +1,32 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var asset_names_exports = {};
+__export(asset_names_exports, {
+  getSynpPackageSpec: () => getSynpPackageSpec
+});
+module.exports = __toCommonJS(asset_names_exports);
+function getSynpPackageSpec(opts) {
+  return `synp@${opts.version}`;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getSynpPackageSpec
+});

package/dist/external-tools/synp/from-download.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @file `synpFromDownload()` — installs the pinned synp npm package via
+ *   `dlx/package` and returns a `ResolvedSynp` pointing at the resolved bin
+ *   shim.
+ */
+import type { ResolvedSynp } from './types';
+export interface SynpFromDownloadOptions {
+    /**
+     * Synp release version, e.g. `'1.9.14'`.
+     */
+    version: string;
+    /**
+     * Optional SRI integrity (e.g. `sha512-...`). When set, dlx verifies the
+     * downloaded tarball against this hash.
+     */
+    integrity?: string | undefined;
+}
+export declare function synpFromDownload(opts: SynpFromDownloadOptions): Promise<ResolvedSynp>;

package/dist/external-tools/synp/from-download.js

@@ -0,0 +1,44 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var from_download_exports = {};
+__export(from_download_exports, {
+  synpFromDownload: () => synpFromDownload
+});
+module.exports = __toCommonJS(from_download_exports);
+var import_package = require("../../dlx/package");
+var import_asset_names = require("./asset-names");
+async function synpFromDownload(opts) {
+  const { integrity, version } = opts;
+  const packageSpec = (0, import_asset_names.getSynpPackageSpec)({ version });
+  const { binaryPath } = await (0, import_package.downloadPackage)({
+    package: packageSpec,
+    binaryName: "synp",
+    ...integrity ? { hash: integrity } : {}
+  });
+  return {
+    path: binaryPath,
+    source: "download"
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  synpFromDownload
+});

package/dist/external-tools/synp/from-path.d.ts

@@ -0,0 +1,5 @@
+/**
+ * @file `synpFromPath()` — looks for `synp` on the system PATH.
+ */
+import type { ResolvedSynp } from './types';
+export declare function synpFromPath(): Promise<ResolvedSynp | undefined>;

package/dist/external-tools/synp/from-path.js

@@ -0,0 +1,40 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var from_path_exports = {};
+__export(from_path_exports, {
+  synpFromPath: () => synpFromPath
+});
+module.exports = __toCommonJS(from_path_exports);
+var import_which = require("../../bin/which");
+async function synpFromPath() {
+  const onPath = await (0, import_which.which)("synp", { nothrow: true });
+  if (typeof onPath !== "string") {
+    return void 0;
+  }
+  return {
+    path: onPath,
+    source: "path"
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  synpFromPath
+});

package/dist/external-tools/synp/from-vfs.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @file `synpFromVfs()` — extracts synp from the smol binary's VFS. Returns
+ *   `undefined` when the binary doesn't carry a bundled synp.
+ */
+import type { ResolvedSynp } from './types';
+export declare const SYNP_VFS_KEY = "synp";
+export declare function synpFromVfs(): Promise<ResolvedSynp | undefined>;

package/dist/external-tools/synp/from-vfs.js

@@ -0,0 +1,47 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var from_vfs_exports = {};
+__export(from_vfs_exports, {
+  SYNP_VFS_KEY: () => SYNP_VFS_KEY,
+  synpFromVfs: () => synpFromVfs
+});
+module.exports = __toCommonJS(from_vfs_exports);
+var import_vfs = require("../../smol/vfs");
+const SYNP_VFS_KEY = "synp";
+async function synpFromVfs() {
+  const vfs = (0, import_vfs.getSmolVfs)();
+  if (!vfs) {
+    return void 0;
+  }
+  if (!vfs.has(SYNP_VFS_KEY)) {
+    return void 0;
+  }
+  const realPath = await vfs.extract(SYNP_VFS_KEY);
+  return {
+    path: realPath,
+    source: "vfs"
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SYNP_VFS_KEY,
+  synpFromVfs
+});

package/dist/external-tools/synp/resolve.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @file `resolveSynp()` — synp resolution entry point. Tries each source in
+ *   order:
+ *
+ *   1. VFS — smol binary's embedded synp (if packed)
+ *   2. PATH — `synp` on the system PATH
+ *   3. download — pinned npm package via dlx (only when `downloadIfMissing` is
+ *      passed) Returns `undefined` if all of the enabled sources miss. Memoized
+ *      per option-shape.
+ */
+import type { ResolvedSynp } from './types';
+export interface ResolveSynpOptions {
+    downloadIfMissing?: {
+        version: string;
+        integrity?: string | undefined;
+    } | undefined;
+}
+export declare function cacheKey(opts: ResolveSynpOptions | undefined): string;
+export declare function doResolveSynp(opts?: ResolveSynpOptions | undefined): Promise<ResolvedSynp | undefined>;
+export declare function resetSynpResolution(): void;
+export declare function resolveSynp(opts?: ResolveSynpOptions | undefined): Promise<ResolvedSynp | undefined>;

package/dist/external-tools/synp/resolve.js

@@ -0,0 +1,72 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var resolve_exports = {};
+__export(resolve_exports, {
+  cacheKey: () => cacheKey,
+  doResolveSynp: () => doResolveSynp,
+  resetSynpResolution: () => resetSynpResolution,
+  resolveSynp: () => resolveSynp
+});
+module.exports = __toCommonJS(resolve_exports);
+var import_from_download = require("./from-download");
+var import_from_path = require("./from-path");
+var import_from_vfs = require("./from-vfs");
+const resolutionCache = /* @__PURE__ */ new Map();
+function cacheKey(opts) {
+  if (!opts?.downloadIfMissing) {
+    return "local-only";
+  }
+  const { integrity, version } = opts.downloadIfMissing;
+  return `dl:${version}:${integrity ?? ""}`;
+}
+async function doResolveSynp(opts) {
+  const fromVfs = await (0, import_from_vfs.synpFromVfs)();
+  if (fromVfs) {
+    return fromVfs;
+  }
+  const fromPath = await (0, import_from_path.synpFromPath)();
+  if (fromPath) {
+    return fromPath;
+  }
+  if (opts?.downloadIfMissing) {
+    return (0, import_from_download.synpFromDownload)(opts.downloadIfMissing);
+  }
+  return void 0;
+}
+function resetSynpResolution() {
+  resolutionCache.clear();
+}
+function resolveSynp(opts) {
+  const key = cacheKey(opts);
+  let cached = resolutionCache.get(key);
+  if (!cached) {
+    cached = doResolveSynp(opts);
+    resolutionCache.set(key, cached);
+  }
+  return cached;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  cacheKey,
+  doResolveSynp,
+  resetSynpResolution,
+  resolveSynp
+});

package/dist/external-tools/synp/types.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @file Shared types for synp resolution. synp is a lockfile converter between
+ *   yarn.lock and package-lock.json, distributed as an npm package. socket-cli
+ *   bundles it for cross-package-manager lockfile interop.
+ */
+export type SynpSource = 'download' | 'path' | 'vfs';
+/**
+ * A resolved synp installation.
+ */
+export interface ResolvedSynp {
+    /**
+     * Absolute path to the `synp` executable (the npm package's bin shim).
+     */
+    readonly path: string;
+    /**
+     * Which resolver tier found this.
+     */
+    readonly source: SynpSource;
+}

package/dist/external-tools/synp/types.js

@@ -0,0 +1,18 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);

package/dist/external-tools/trivy/asset-names.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @file Upstream Trivy release asset-name mapping per `platform-arch`. Trivy
+ *   publishes per-platform archives under
+ *   https://github.com/aquasecurity/trivy/releases/download/v<X.Y.Z>/. Asset
+ *   names follow `trivy_<X.Y.Z>_<OS>-<Arch>.{tar.gz,zip}` where `<OS>` is
+ *   `macOS` / `Linux` / `windows` (capitalization matters) and `<Arch>` is
+ *   `ARM64` / `64bit`.
+ */
+export interface TrivyAssetEntry {
+    /**
+     * Asset-name suffix appended to `trivy_<version>_`.
+     */
+    readonly suffix: string;
+}
+export declare const TRIVY_ASSET_MAP: Readonly<Record<string, TrivyAssetEntry>>;
+export declare function getTrivyAssetEntry(platformArch: string): TrivyAssetEntry | undefined;
+export interface TrivyDownloadOptions {
+    /**
+     * Trivy release version, e.g. `'0.69.3'` (no `v` prefix; the helper prepends
+     * it for the release tag).
+     */
+    version: string;
+    /**
+     * Fleet platform-arch token — looked up in `TRIVY_ASSET_MAP`.
+     */
+    platformArch: string;
+}
+/**
+ * Build the GitHub release-asset download URL for an upstream Trivy binary.
+ * Returns `undefined` when no entry exists for the requested platform-arch.
+ *
+ * Reference: https://github.com/aquasecurity/trivy/releases.
+ */
+export declare function getTrivyDownloadUrl(opts: TrivyDownloadOptions): string | undefined;

package/dist/external-tools/trivy/asset-names.js

@@ -0,0 +1,68 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var asset_names_exports = {};
+__export(asset_names_exports, {
+  TRIVY_ASSET_MAP: () => TRIVY_ASSET_MAP,
+  getTrivyAssetEntry: () => getTrivyAssetEntry,
+  getTrivyDownloadUrl: () => getTrivyDownloadUrl
+});
+module.exports = __toCommonJS(asset_names_exports);
+var import_object = require("../../primordials/object");
+const TRIVY_ASSET_MAP = (0, import_object.ObjectFreeze)({
+  __proto__: null,
+  "darwin-arm64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "macOS-ARM64.tar.gz"
+  }),
+  "darwin-x64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "macOS-64bit.tar.gz"
+  }),
+  "linux-arm64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "Linux-ARM64.tar.gz"
+  }),
+  "linux-x64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "Linux-64bit.tar.gz"
+  }),
+  "win-x64": (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    suffix: "windows-64bit.zip"
+  })
+});
+function getTrivyAssetEntry(platformArch) {
+  return TRIVY_ASSET_MAP[platformArch];
+}
+function getTrivyDownloadUrl(opts) {
+  const { platformArch, version } = opts;
+  const entry = TRIVY_ASSET_MAP[platformArch];
+  if (!entry) {
+    return void 0;
+  }
+  return `https://github.com/aquasecurity/trivy/releases/download/v${version}/trivy_${version}_${entry.suffix}`;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  TRIVY_ASSET_MAP,
+  getTrivyAssetEntry,
+  getTrivyDownloadUrl
+});

package/dist/external-tools/trivy/from-download.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @file `trivyFromDownload()` — fetches upstream Trivy and returns a
+ *   `ResolvedTrivy` pointing at the extracted binary. macOS/Linux ship tar.gz,
+ *   Windows ships zip; `downloadAndExtractTool` auto-detects the format from
+ *   the archive name.
+ */
+import type { BinaryDownloader } from '../from-download';
+import type { HashSpec } from '../../integrity';
+import type { ResolvedTrivy } from './types';
+export interface TrivyFromDownloadOptions {
+    version: string;
+    platformArch: string;
+    integrity?: HashSpec | undefined;
+    cacheDir?: string | undefined;
+    downloader?: BinaryDownloader | undefined;
+}
+export declare function trivyFromDownload(opts: TrivyFromDownloadOptions): Promise<ResolvedTrivy | undefined>;

package/dist/external-tools/trivy/from-download.js

@@ -0,0 +1,67 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var from_download_exports = {};
+__export(from_download_exports, {
+  trivyFromDownload: () => trivyFromDownload
+});
+module.exports = __toCommonJS(from_download_exports);
+var import_node_path = __toESM(require("node:path"));
+var import_node_process = __toESM(require("node:process"));
+var import_socket = require("../../paths/socket");
+var import_from_download = require("../from-download");
+var import_asset_names = require("./asset-names");
+async function trivyFromDownload(opts) {
+  const { cacheDir, downloader, integrity, platformArch, version } = opts;
+  const url = (0, import_asset_names.getTrivyDownloadUrl)({ version, platformArch });
+  if (!url) {
+    return void 0;
+  }
+  const entry = (0, import_asset_names.getTrivyAssetEntry)(platformArch);
+  const archiveExt = entry?.suffix.endsWith(".zip") ? ".zip" : ".tar.gz";
+  const extractedDir = cacheDir ?? import_node_path.default.join((0, import_socket.getSocketDlxDir)(), "trivy", version, platformArch);
+  const archive = await (0, import_from_download.downloadAndExtractTool)({
+    url,
+    name: `trivy-${version}-${platformArch}${archiveExt}`,
+    integrity,
+    extractedDir,
+    downloader
+  });
+  const binary = import_node_process.default.platform === "win32" ? "trivy.exe" : "trivy";
+  return {
+    path: import_node_path.default.join(extractedDir, binary),
+    source: "download",
+    integrity: archive.integrity
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  trivyFromDownload
+});

package/dist/external-tools/trivy/from-path.d.ts

@@ -0,0 +1,5 @@
+/**
+ * @file `trivyFromPath()` — looks for `trivy` on the system PATH.
+ */
+import type { ResolvedTrivy } from './types';
+export declare function trivyFromPath(): Promise<ResolvedTrivy | undefined>;

package/dist/external-tools/trivy/from-path.js

@@ -0,0 +1,40 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var from_path_exports = {};
+__export(from_path_exports, {
+  trivyFromPath: () => trivyFromPath
+});
+module.exports = __toCommonJS(from_path_exports);
+var import_which = require("../../bin/which");
+async function trivyFromPath() {
+  const onPath = await (0, import_which.which)("trivy", { nothrow: true });
+  if (typeof onPath !== "string") {
+    return void 0;
+  }
+  return {
+    path: onPath,
+    source: "path"
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  trivyFromPath
+});

package/dist/external-tools/trivy/from-vfs.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @file `trivyFromVfs()` — extracts the Trivy binary from the smol binary's
+ *   VFS. Returns `undefined` when the binary doesn't have Trivy bundled.
+ */
+import type { ResolvedTrivy } from './types';
+export declare const TRIVY_VFS_KEY = "trivy";
+export declare function trivyFromVfs(): Promise<ResolvedTrivy | undefined>;

package/dist/external-tools/trivy/from-vfs.js

@@ -0,0 +1,47 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var from_vfs_exports = {};
+__export(from_vfs_exports, {
+  TRIVY_VFS_KEY: () => TRIVY_VFS_KEY,
+  trivyFromVfs: () => trivyFromVfs
+});
+module.exports = __toCommonJS(from_vfs_exports);
+var import_vfs = require("../../smol/vfs");
+const TRIVY_VFS_KEY = "trivy";
+async function trivyFromVfs() {
+  const vfs = (0, import_vfs.getSmolVfs)();
+  if (!vfs) {
+    return void 0;
+  }
+  if (!vfs.has(TRIVY_VFS_KEY)) {
+    return void 0;
+  }
+  const realPath = await vfs.extract(TRIVY_VFS_KEY);
+  return {
+    path: realPath,
+    source: "vfs"
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  TRIVY_VFS_KEY,
+  trivyFromVfs
+});