@socketsecurity/lib 6.0.3 → 6.0.4

package/dist/external-tools/manifest.js

@@ -1,167 +1,147 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var manifest_exports = {};
-__export(manifest_exports, {
-  getTool: () => getTool,
-  getToolFlavor: () => getToolFlavor,
-  isObject: () => isObject,
-  parseChecksum: () => parseChecksum,
-  parseChecksums: () => parseChecksums,
-  parseToolEntry: () => parseToolEntry,
-  readExternalToolsManifest: () => readExternalToolsManifest,
-  tryParseFlavored: () => tryParseFlavored
-});
-module.exports = __toCommonJS(manifest_exports);
-var import_read_json = require("../fs/read-json");
-var import_integrity = require("../integrity");
-var import_array = require("../primordials/array");
-var import_error = require("../primordials/error");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_error = require('../primordials/error.js');
+const require_integrity = require('../integrity.js');
+const require_primordials_array = require('../primordials/array.js');
+const require_fs_read_json = require('../fs/read-json.js');
+
+//#region src/external-tools/manifest.ts
+/**
+* @file Reader for `external-tools.json` — the fleet manifest describing
+*   downloadable external binaries (sfw, zizmor, etc.) with pinned versions,
+*   per-platform asset names, and integrity hashes. The manifest itself is
+*   hand-maintained in each fleet repo's root (`<repo>/external-tools.json`)
+*   and consumed by the setup-and-install GitHub action. This reader gives
+*   in-process consumers (external- tools resolvers, ad-hoc scripts) the same
+*   typed view without each one re-implementing the JSON-parse + shape check +
+*   integrity-string validation. Shape: { "<tool-name>": { "description":
+*   "human-readable summary", "version": "1.7.2", "release": "asset" |
+*   "tarball" | ..., "repository": "github:owner/repo", "notes": [...],
+*   "checksums": { "<platform-arch>": { "asset": "<asset-filename>",
+*   "integrity": "sha256-base64=" } } } } Some tools have flavor variants (e.g.
+*   sfw's `free` / `enterprise`) that wrap the `{repository, binaryName,
+*   checksums}` triple under a flavor key. Use `getToolFlavor` for those. Some
+*   entries (e.g. `rust`) describe a system tool with a different shape —
+*   they're skipped by `getTool` and fully readable only via the raw
+*   `readManifest` returning unknown.
+*/
+/**
+* Lookup helper — return the plain tool entry for `toolName`, or `undefined` if
+* the manifest doesn't have it or the entry is flavored / other-shape.
+*/
 function getTool(manifest, toolName) {
-  const entry = manifest.tools[toolName];
-  return entry?.kind === "tool" ? entry.entry : void 0;
+	const entry = manifest.tools[toolName];
+	return entry?.kind === "tool" ? entry.entry : void 0;
 }
+/**
+* Lookup helper — return the specific flavor of a flavored tool, or `undefined`
+* if the tool isn't flavored or the flavor doesn't exist.
+*/
 function getToolFlavor(manifest, toolName, flavor) {
-  const entry = manifest.tools[toolName];
-  if (entry?.kind !== "flavored") {
-    return void 0;
-  }
-  return entry.entry.flavors[flavor];
+	const entry = manifest.tools[toolName];
+	if (entry?.kind !== "flavored") return;
+	return entry.entry.flavors[flavor];
 }
 function isObject(value) {
-  return typeof value === "object" && value !== null && !(0, import_array.ArrayIsArray)(value);
+	return typeof value === "object" && value !== null && !require_primordials_array.ArrayIsArray(value);
 }
 function parseChecksum(raw, toolName, platformKey) {
-  if (!isObject(raw)) {
-    throw new import_error.ErrorCtor(
-      `external-tools.json: tool '${toolName}' checksum entry '${platformKey}' must be an object, got: ${typeof raw}`
-    );
-  }
-  const r = raw;
-  if (typeof r.asset !== "string" || r.asset.length === 0) {
-    throw new import_error.ErrorCtor(
-      `external-tools.json: tool '${toolName}' platform '${platformKey}' is missing a non-empty 'asset' string`
-    );
-  }
-  if (typeof r.integrity !== "string" || !(0, import_integrity.isIntegrityString)(r.integrity)) {
-    throw new import_error.ErrorCtor(
-      `external-tools.json: tool '${toolName}' platform '${platformKey}' has an invalid 'integrity' (expected SRI sha512 or sha256 form): ${r.integrity}`
-    );
-  }
-  return { asset: r.asset, integrity: r.integrity };
+	if (!isObject(raw)) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' checksum entry '${platformKey}' must be an object, got: ${typeof raw}`);
+	const r = raw;
+	if (typeof r.asset !== "string" || r.asset.length === 0) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' platform '${platformKey}' is missing a non-empty 'asset' string`);
+	if (typeof r.integrity !== "string" || !require_integrity.isIntegrityString(r.integrity)) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' platform '${platformKey}' has an invalid 'integrity' (expected SRI sha512 or sha256 form): ${r.integrity}`);
+	return {
+		asset: r.asset,
+		integrity: r.integrity
+	};
 }
 function parseChecksums(raw, toolName) {
-  if (!isObject(raw)) {
-    throw new import_error.ErrorCtor(
-      `external-tools.json: tool '${toolName}' is missing a 'checksums' object`
-    );
-  }
-  const out = {};
-  for (const platformKey of Object.keys(raw)) {
-    out[platformKey] = parseChecksum(raw[platformKey], toolName, platformKey);
-  }
-  return out;
+	if (!isObject(raw)) throw new require_primordials_error.ErrorCtor(`external-tools.json: tool '${toolName}' is missing a 'checksums' object`);
+	const out = {};
+	for (const platformKey of Object.keys(raw)) out[platformKey] = parseChecksum(raw[platformKey], toolName, platformKey);
+	return out;
 }
 function parseToolEntry(raw, toolName) {
-  if (!isObject(raw)) {
-    return { kind: "other", raw };
-  }
-  const r = raw;
-  if (isObject(r.checksums)) {
-    if (typeof r.description !== "string" || typeof r.version !== "string" || typeof r.release !== "string" || typeof r.repository !== "string") {
-      return { kind: "other", raw };
-    }
-    return {
-      kind: "tool",
-      entry: {
-        description: r.description,
-        version: r.version,
-        release: r.release,
-        repository: r.repository,
-        binaryName: typeof r.binaryName === "string" ? r.binaryName : void 0,
-        notes: (0, import_array.ArrayIsArray)(r.notes) ? r.notes : void 0,
-        checksums: parseChecksums(r.checksums, toolName)
-      }
-    };
-  }
-  const flavored = tryParseFlavored(raw, toolName);
-  if (flavored) {
-    return { kind: "flavored", entry: flavored };
-  }
-  return { kind: "other", raw };
+	if (!isObject(raw)) return {
+		kind: "other",
+		raw
+	};
+	const r = raw;
+	if (isObject(r.checksums)) {
+		if (typeof r.description !== "string" || typeof r.version !== "string" || typeof r.release !== "string" || typeof r.repository !== "string") return {
+			kind: "other",
+			raw
+		};
+		return {
+			kind: "tool",
+			entry: {
+				description: r.description,
+				version: r.version,
+				release: r.release,
+				repository: r.repository,
+				binaryName: typeof r.binaryName === "string" ? r.binaryName : void 0,
+				notes: require_primordials_array.ArrayIsArray(r.notes) ? r.notes : void 0,
+				checksums: parseChecksums(r.checksums, toolName)
+			}
+		};
+	}
+	const flavored = tryParseFlavored(raw, toolName);
+	if (flavored) return {
+		kind: "flavored",
+		entry: flavored
+	};
+	return {
+		kind: "other",
+		raw
+	};
 }
+/**
+* Read an `external-tools.json` file from disk and return the parsed manifest.
+* Throws on malformed JSON or invalid integrity strings; unknown-shape entries
+* (rust components, future variants) come back as `{kind: 'other', raw}` so
+* callers can handle them out-of-band without blocking the manifest read.
+*/
 async function readExternalToolsManifest(filepath) {
-  const raw = await (0, import_read_json.readJson)(filepath);
-  if (!isObject(raw)) {
-    throw new import_error.ErrorCtor(
-      `external-tools.json: expected top-level object, got: ${typeof raw}`
-    );
-  }
-  const tools = {};
-  for (const toolName of Object.keys(raw)) {
-    if (toolName.startsWith("$")) {
-      continue;
-    }
-    tools[toolName] = parseToolEntry(raw[toolName], toolName);
-  }
-  return { tools };
+	const raw = await /* @__PURE__ */ require_fs_read_json.readJson(filepath);
+	if (!isObject(raw)) throw new require_primordials_error.ErrorCtor(`external-tools.json: expected top-level object, got: ${typeof raw}`);
+	const tools = {};
+	for (const toolName of Object.keys(raw)) {
+		if (toolName.startsWith("$")) continue;
+		tools[toolName] = parseToolEntry(raw[toolName], toolName);
+	}
+	return { tools };
 }
 function tryParseFlavored(raw, toolName) {
-  const flavors = {};
-  for (const key of Object.keys(raw)) {
-    const value = raw[key];
-    if (!isObject(value)) {
-      continue;
-    }
-    const rf = value;
-    if (!isObject(rf.checksums)) {
-      continue;
-    }
-    if (typeof rf.repository !== "string") {
-      continue;
-    }
-    flavors[key] = {
-      repository: rf.repository,
-      binaryName: typeof rf.binaryName === "string" ? rf.binaryName : void 0,
-      checksums: parseChecksums(rf.checksums, `${toolName}.${key}`)
-    };
-  }
-  if (Object.keys(flavors).length === 0) {
-    return void 0;
-  }
-  return {
-    description: String(raw["description"] ?? ""),
-    version: String(raw["version"] ?? ""),
-    release: String(raw["release"] ?? ""),
-    notes: (0, import_array.ArrayIsArray)(raw["notes"]) ? raw["notes"] : void 0,
-    flavors
-  };
+	const flavors = {};
+	for (const key of Object.keys(raw)) {
+		const value = raw[key];
+		if (!isObject(value)) continue;
+		const rf = value;
+		if (!isObject(rf.checksums)) continue;
+		if (typeof rf.repository !== "string") continue;
+		flavors[key] = {
+			repository: rf.repository,
+			binaryName: typeof rf.binaryName === "string" ? rf.binaryName : void 0,
+			checksums: parseChecksums(rf.checksums, `${toolName}.${key}`)
+		};
+	}
+	if (Object.keys(flavors).length === 0) return;
+	return {
+		description: String(raw["description"] ?? ""),
+		version: String(raw["version"] ?? ""),
+		release: String(raw["release"] ?? ""),
+		notes: require_primordials_array.ArrayIsArray(raw["notes"]) ? raw["notes"] : void 0,
+		flavors
+	};
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  getTool,
-  getToolFlavor,
-  isObject,
-  parseChecksum,
-  parseChecksums,
-  parseToolEntry,
-  readExternalToolsManifest,
-  tryParseFlavored
-});
+
+//#endregion
+exports.getTool = getTool;
+exports.getToolFlavor = getToolFlavor;
+exports.isObject = isObject;
+exports.parseChecksum = parseChecksum;
+exports.parseChecksums = parseChecksums;
+exports.parseToolEntry = parseToolEntry;
+exports.readExternalToolsManifest = readExternalToolsManifest;
+exports.tryParseFlavored = tryParseFlavored;

package/dist/external-tools/opengrep/asset-names.js

@@ -1,78 +1,66 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var asset_names_exports = {};
-__export(asset_names_exports, {
-  OPENGREP_ASSET_MAP: () => OPENGREP_ASSET_MAP,
-  getOpengrepAssetEntry: () => getOpengrepAssetEntry,
-  getOpengrepDownloadUrl: () => getOpengrepDownloadUrl
-});
-module.exports = __toCommonJS(asset_names_exports);
-var import_object = require("../../primordials/object");
-const OPENGREP_ASSET_MAP = (0, import_object.ObjectFreeze)({
-  __proto__: null,
-  "darwin-arm64": (0, import_object.ObjectFreeze)({
-    __proto__: null,
-    asset: "opengrep_osx_arm64",
-    isArchive: false,
-    binaryInArchive: void 0
-  }),
-  "darwin-x64": (0, import_object.ObjectFreeze)({
-    __proto__: null,
-    asset: "opengrep_osx_x86",
-    isArchive: false,
-    binaryInArchive: void 0
-  }),
-  "linux-arm64": (0, import_object.ObjectFreeze)({
-    __proto__: null,
-    asset: "opengrep_manylinux_aarch64",
-    isArchive: false,
-    binaryInArchive: void 0
-  }),
-  "linux-x64": (0, import_object.ObjectFreeze)({
-    __proto__: null,
-    asset: "opengrep_manylinux_x86",
-    isArchive: false,
-    binaryInArchive: void 0
-  }),
-  "win-x64": (0, import_object.ObjectFreeze)({
-    __proto__: null,
-    asset: "opengrep-core_windows_x86.zip",
-    isArchive: true,
-    binaryInArchive: "opengrep-core.exe"
-  })
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_object = require('../../primordials/object.js');
+
+//#region src/external-tools/opengrep/asset-names.ts
+/**
+* @file Upstream OpenGrep release asset-name mapping per `platform-arch`.
+*   OpenGrep publishes raw binaries (no archive wrapper) for macOS and Linux,
+*   and a zipped binary (`opengrep-core_windows_x86.zip` containing
+*   `opengrep-core.exe`) for Windows. The `isArchive` flag tells the download
+*   helper whether to extract or copy as-is.
+*/
+const OPENGREP_ASSET_MAP = require_primordials_object.ObjectFreeze({
+	__proto__: null,
+	"darwin-arm64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		asset: "opengrep_osx_arm64",
+		isArchive: false,
+		binaryInArchive: void 0
+	}),
+	"darwin-x64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		asset: "opengrep_osx_x86",
+		isArchive: false,
+		binaryInArchive: void 0
+	}),
+	"linux-arm64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		asset: "opengrep_manylinux_aarch64",
+		isArchive: false,
+		binaryInArchive: void 0
+	}),
+	"linux-x64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		asset: "opengrep_manylinux_x86",
+		isArchive: false,
+		binaryInArchive: void 0
+	}),
+	"win-x64": require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		asset: "opengrep-core_windows_x86.zip",
+		isArchive: true,
+		binaryInArchive: "opengrep-core.exe"
+	})
 });
 function getOpengrepAssetEntry(platformArch) {
-  return OPENGREP_ASSET_MAP[platformArch];
+	return OPENGREP_ASSET_MAP[platformArch];
 }
+/**
+* Build the GitHub release-asset download URL for an upstream OpenGrep binary.
+* Returns `undefined` when no entry exists for the requested platform-arch.
+*
+* Reference: https://github.com/opengrep/opengrep/releases.
+*/
 function getOpengrepDownloadUrl(opts) {
-  const { platformArch, version } = opts;
-  const entry = OPENGREP_ASSET_MAP[platformArch];
-  if (!entry) {
-    return void 0;
-  }
-  return `https://github.com/opengrep/opengrep/releases/download/v${version}/` + entry.asset;
+	const { platformArch, version } = opts;
+	const entry = OPENGREP_ASSET_MAP[platformArch];
+	if (!entry) return;
+	return `https://github.com/opengrep/opengrep/releases/download/v${version}/` + entry.asset;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  OPENGREP_ASSET_MAP,
-  getOpengrepAssetEntry,
-  getOpengrepDownloadUrl
-});
+
+//#endregion
+exports.OPENGREP_ASSET_MAP = OPENGREP_ASSET_MAP;
+exports.getOpengrepAssetEntry = getOpengrepAssetEntry;
+exports.getOpengrepDownloadUrl = getOpengrepDownloadUrl;

package/dist/external-tools/opengrep/from-download.js

@@ -1,83 +1,61 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var from_download_exports = {};
-__export(from_download_exports, {
-  opengrepFromDownload: () => opengrepFromDownload
-});
-module.exports = __toCommonJS(from_download_exports);
-var import_node_path = __toESM(require("node:path"));
-var import_node_fs = require("node:fs");
-var import_socket = require("../../paths/socket");
-var import_safe = require("../../fs/safe");
-var import_from_download = require("../from-download");
-var import_asset_names = require("./asset-names");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_paths_socket = require('../../paths/socket.js');
+const require_fs_safe = require('../../fs/safe.js');
+const require_external_tools_from_download = require('../from-download.js');
+const require_external_tools_opengrep_asset_names = require('./asset-names.js');
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+
+//#region src/external-tools/opengrep/from-download.ts
+/**
+* @file `opengrepFromDownload()` — fetches upstream OpenGrep and returns a
+*   `ResolvedOpengrep` pointing at the cached binary. macOS/Linux assets are
+*   bare binaries (no extraction); Windows ships a zip. The asset-map's
+*   `isArchive` flag drives extraction vs. copy.
+*/
 async function opengrepFromDownload(opts) {
-  const { cacheDir, downloader, integrity, platformArch, version } = opts;
-  const url = (0, import_asset_names.getOpengrepDownloadUrl)({ version, platformArch });
-  const entry = (0, import_asset_names.getOpengrepAssetEntry)(platformArch);
-  if (!url || !entry) {
-    return void 0;
-  }
-  const targetDir = cacheDir ?? import_node_path.default.join((0, import_socket.getSocketDlxDir)(), "opengrep", version, platformArch);
-  if (entry.isArchive) {
-    const archive2 = await (0, import_from_download.downloadAndExtractTool)({
-      url,
-      name: `opengrep-${version}-${platformArch}-${entry.asset}`,
-      integrity,
-      extractedDir: targetDir,
-      downloader
-    });
-    return {
-      path: import_node_path.default.join(targetDir, entry.binaryInArchive),
-      source: "download",
-      integrity: archive2.integrity
-    };
-  }
-  const archive = await (0, import_from_download.downloadToolArchive)({
-    url,
-    name: `opengrep-${version}-${platformArch}-${entry.asset}`,
-    integrity,
-    downloader
-  });
-  await (0, import_safe.safeMkdir)(targetDir);
-  const finalPath = import_node_path.default.join(targetDir, "opengrep");
-  await import_node_fs.promises.copyFile(archive.archivePath, finalPath);
-  await import_node_fs.promises.chmod(finalPath, 493);
-  return {
-    path: finalPath,
-    source: "download",
-    integrity: archive.integrity
-  };
+	const { cacheDir, downloader, integrity, platformArch, version } = opts;
+	const url = require_external_tools_opengrep_asset_names.getOpengrepDownloadUrl({
+		version,
+		platformArch
+	});
+	const entry = require_external_tools_opengrep_asset_names.getOpengrepAssetEntry(platformArch);
+	if (!url || !entry) return;
+	const targetDir = cacheDir ?? node_path.default.join(require_paths_socket.getSocketDlxDir(), "opengrep", version, platformArch);
+	if (entry.isArchive) {
+		const archive = await require_external_tools_from_download.downloadAndExtractTool({
+			url,
+			name: `opengrep-${version}-${platformArch}-${entry.asset}`,
+			integrity,
+			extractedDir: targetDir,
+			downloader
+		});
+		return {
+			path: node_path.default.join(targetDir, entry.binaryInArchive),
+			source: "download",
+			integrity: archive.integrity
+		};
+	}
+	const archive = await require_external_tools_from_download.downloadToolArchive({
+		url,
+		name: `opengrep-${version}-${platformArch}-${entry.asset}`,
+		integrity,
+		downloader
+	});
+	await require_fs_safe.safeMkdir(targetDir);
+	const finalPath = node_path.default.join(targetDir, "opengrep");
+	await node_fs.promises.copyFile(archive.archivePath, finalPath);
+	await node_fs.promises.chmod(finalPath, 493);
+	return {
+		path: finalPath,
+		source: "download",
+		integrity: archive.integrity
+	};
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  opengrepFromDownload
-});
+
+//#endregion
+exports.opengrepFromDownload = opengrepFromDownload;