@socketsecurity/lib 6.0.3 → 6.0.5

package/dist/external-tools/bazel/resolve.js

@@ -1,68 +1,54 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var resolve_exports = {};
-__export(resolve_exports, {
-  cacheKey: () => cacheKey,
-  doResolveBazel: () => doResolveBazel,
-  resetBazelResolution: () => resetBazelResolution,
-  resolveBazel: () => resolveBazel
-});
-module.exports = __toCommonJS(resolve_exports);
-var import_from_download = require("./from-download");
-var import_from_path = require("./from-path");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_external_tools_bazel_from_download = require('./from-download.js');
+const require_external_tools_bazel_from_path = require('./from-path.js');
+
+//#region src/external-tools/bazel/resolve.ts
+/**
+* @file `resolveBazel()` — Bazel resolution entry point. Tries each source in
+*   order:
+*
+*   1. PATH — `bazelisk` (preferred) or `bazel` on the system PATH
+*   2. download — upstream GitHub release binary (only when `downloadIfMissing` is
+*      passed) No VFS tier: Bazel's version comes from the project's
+*      `.bazelversion`, not from a global pin, so a smol-bundled Bazel would
+*      always be the wrong version for any project that pinned a different one.
+*      Every Bazel use must go through the project-specific download path.
+*      Returns `undefined` if all of the enabled sources miss. Memoized per
+*      option-shape: calls with identical options return the same cached
+*      promise. Calling without `downloadIfMissing` and then with
+*      `downloadIfMissing` produces two distinct cache entries so the second
+*      call can fall through to the download tier.
+*/
 const resolutionCache = /* @__PURE__ */ new Map();
 function cacheKey(opts) {
-  if (!opts?.downloadIfMissing) {
-    return "local-only";
-  }
-  const { integrity, platformArch, version } = opts.downloadIfMissing;
-  const integrityKey = typeof integrity === "string" ? integrity : integrity ? `${integrity.type}:${integrity.value}` : "";
-  return `dl:${version}:${platformArch}:${integrityKey}`;
+	if (!opts?.downloadIfMissing) return "local-only";
+	const { integrity, platformArch, version } = opts.downloadIfMissing;
+	return `dl:${version}:${platformArch}:${typeof integrity === "string" ? integrity : integrity ? `${integrity.type}:${integrity.value}` : ""}`;
 }
 async function doResolveBazel(opts) {
-  const fromPath = await (0, import_from_path.bazelFromPath)();
-  if (fromPath) {
-    return fromPath;
-  }
-  if (opts?.downloadIfMissing) {
-    return (0, import_from_download.bazelFromDownload)(opts.downloadIfMissing);
-  }
-  return void 0;
+	const fromPath = await require_external_tools_bazel_from_path.bazelFromPath();
+	if (fromPath) return fromPath;
+	if (opts?.downloadIfMissing) return require_external_tools_bazel_from_download.bazelFromDownload(opts.downloadIfMissing);
 }
+/* c8 ignore start - test-only escape hatch. */
 function resetBazelResolution() {
-  resolutionCache.clear();
+	resolutionCache.clear();
 }
+/* c8 ignore stop */
 function resolveBazel(opts) {
-  const key = cacheKey(opts);
-  let cached = resolutionCache.get(key);
-  if (!cached) {
-    cached = doResolveBazel(opts);
-    resolutionCache.set(key, cached);
-  }
-  return cached;
+	const key = cacheKey(opts);
+	let cached = resolutionCache.get(key);
+	if (!cached) {
+		cached = doResolveBazel(opts);
+		resolutionCache.set(key, cached);
+	}
+	return cached;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  cacheKey,
-  doResolveBazel,
-  resetBazelResolution,
-  resolveBazel
-});
+
+//#endregion
+exports.cacheKey = cacheKey;
+exports.doResolveBazel = doResolveBazel;
+exports.resetBazelResolution = resetBazelResolution;
+exports.resolveBazel = resolveBazel;

package/dist/external-tools/bazel/types.js

@@ -1,18 +1,2 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var types_exports = {};
-module.exports = __toCommonJS(types_exports);
+/* Socket Lib - Built with rolldown */

package/dist/external-tools/cdxgen/asset-names.js

@@ -1,79 +1,72 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var asset_names_exports = {};
-__export(asset_names_exports, {
-  CDXGEN_FULL_ASSET_MAP: () => CDXGEN_FULL_ASSET_MAP,
-  CDXGEN_SLIM_ASSET_MAP: () => CDXGEN_SLIM_ASSET_MAP,
-  buildCdxgenAssetName: () => buildCdxgenAssetName,
-  getCdxgenAssetEntry: () => getCdxgenAssetEntry,
-  getCdxgenDownloadUrl: () => getCdxgenDownloadUrl,
-  makeCdxgenEntry: () => makeCdxgenEntry,
-  makeCdxgenPlatformMap: () => makeCdxgenPlatformMap
-});
-module.exports = __toCommonJS(asset_names_exports);
-var import_object = require("../../primordials/object");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_object = require('../../primordials/object.js');
+
+//#region src/external-tools/cdxgen/asset-names.ts
+/**
+* @file Upstream cdxgen release asset-name mapping per `platform-arch`. cdxgen
+*   ships per-platform SEA binaries starting in v12.0.x — bare executables, no
+*   archive wrapper, with companion `.sha256` sidecars. Each platform has both
+*   a "full" variant (bundles bun + deno runtimes for those project types) and
+*   a "slim" variant (no bundled runtimes; relies on the host having them when
+*   needed). We ship the slim variants by default: socket-lib consumers run
+*   cdxgen for npm/pip/maven/etc. SBOM generation where the bundled runtimes
+*   aren't on the hot path, and the slim binary is ~3× smaller. Consumers that
+*   need full (bun/deno project scanning) can override by passing `variant:
+*   'full'`. Asset URLs:
+*   https://github.com/CycloneDX/cdxgen/releases/download/v<X.Y.Z>/cdxgen-<os>-<arch>[-musl][-slim][.exe]
+*   Reference: https://github.com/CycloneDX/cdxgen/releases. Single source of
+*   truth: the SEA binary IS the install path. The legacy `@cyclonedx/cdxgen`
+*   npm package is not used as a fallback — every platform-arch the fleet
+*   supports has a SEA build, and routing through npm for unsupported targets
+*   would silently use a different distribution (different bundle composition,
+*   different startup cost, different version-pin surface). One install path;
+*   one cached binary.
+*/
 function buildCdxgenAssetName(baseTriple, variant, ext) {
-  const slim = variant === "slim" ? "-slim" : "";
-  return `cdxgen-${baseTriple}${slim}${ext}`;
+	return `cdxgen-${baseTriple}${variant === "slim" ? "-slim" : ""}${ext}`;
 }
 function getCdxgenAssetEntry(platformArch, variant = "slim") {
-  const map = variant === "full" ? CDXGEN_FULL_ASSET_MAP : CDXGEN_SLIM_ASSET_MAP;
-  return map[platformArch];
+	return (variant === "full" ? CDXGEN_FULL_ASSET_MAP : CDXGEN_SLIM_ASSET_MAP)[platformArch];
 }
+/**
+* Build the GitHub release-asset download URL for an upstream cdxgen binary.
+* Returns `undefined` when no entry exists for the requested platform-arch.
+*/
 function getCdxgenDownloadUrl(opts) {
-  const { platformArch, variant = "slim", version } = opts;
-  const entry = getCdxgenAssetEntry(platformArch, variant);
-  if (!entry) {
-    return void 0;
-  }
-  return `https://github.com/CycloneDX/cdxgen/releases/download/v${version}/` + entry.asset;
+	const { platformArch, variant = "slim", version } = opts;
+	const entry = getCdxgenAssetEntry(platformArch, variant);
+	if (!entry) return;
+	return `https://github.com/CycloneDX/cdxgen/releases/download/v${version}/` + entry.asset;
 }
 function makeCdxgenEntry(baseTriple, variant, ext = "") {
-  return (0, import_object.ObjectFreeze)({
-    __proto__: null,
-    asset: buildCdxgenAssetName(baseTriple, variant, ext)
-  });
+	return require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		asset: buildCdxgenAssetName(baseTriple, variant, ext)
+	});
 }
 function makeCdxgenPlatformMap(variant) {
-  return (0, import_object.ObjectFreeze)({
-    __proto__: null,
-    "darwin-arm64": makeCdxgenEntry("darwin-arm64", variant),
-    "darwin-x64": makeCdxgenEntry("darwin-amd64", variant),
-    "linux-arm64": makeCdxgenEntry("linux-arm64", variant),
-    "linux-arm64-musl": makeCdxgenEntry("linux-arm64-musl", variant),
-    "linux-x64": makeCdxgenEntry("linux-amd64", variant),
-    "linux-x64-musl": makeCdxgenEntry("linux-amd64-musl", variant),
-    "win-arm64": makeCdxgenEntry("windows-arm64", variant, ".exe"),
-    "win-x64": makeCdxgenEntry("windows-amd64", variant, ".exe")
-  });
+	return require_primordials_object.ObjectFreeze({
+		__proto__: null,
+		"darwin-arm64": makeCdxgenEntry("darwin-arm64", variant),
+		"darwin-x64": makeCdxgenEntry("darwin-amd64", variant),
+		"linux-arm64": makeCdxgenEntry("linux-arm64", variant),
+		"linux-arm64-musl": makeCdxgenEntry("linux-arm64-musl", variant),
+		"linux-x64": makeCdxgenEntry("linux-amd64", variant),
+		"linux-x64-musl": makeCdxgenEntry("linux-amd64-musl", variant),
+		"win-arm64": makeCdxgenEntry("windows-arm64", variant, ".exe"),
+		"win-x64": makeCdxgenEntry("windows-amd64", variant, ".exe")
+	});
 }
 const CDXGEN_SLIM_ASSET_MAP = makeCdxgenPlatformMap("slim");
 const CDXGEN_FULL_ASSET_MAP = makeCdxgenPlatformMap("full");
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  CDXGEN_FULL_ASSET_MAP,
-  CDXGEN_SLIM_ASSET_MAP,
-  buildCdxgenAssetName,
-  getCdxgenAssetEntry,
-  getCdxgenDownloadUrl,
-  makeCdxgenEntry,
-  makeCdxgenPlatformMap
-});
+
+//#endregion
+exports.CDXGEN_FULL_ASSET_MAP = CDXGEN_FULL_ASSET_MAP;
+exports.CDXGEN_SLIM_ASSET_MAP = CDXGEN_SLIM_ASSET_MAP;
+exports.buildCdxgenAssetName = buildCdxgenAssetName;
+exports.getCdxgenAssetEntry = getCdxgenAssetEntry;
+exports.getCdxgenDownloadUrl = getCdxgenDownloadUrl;
+exports.makeCdxgenEntry = makeCdxgenEntry;
+exports.makeCdxgenPlatformMap = makeCdxgenPlatformMap;

package/dist/external-tools/cdxgen/from-download.js

@@ -1,83 +1,55 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var from_download_exports = {};
-__export(from_download_exports, {
-  cdxgenFromDownload: () => cdxgenFromDownload
-});
-module.exports = __toCommonJS(from_download_exports);
-var import_node_fs = require("node:fs");
-var import_node_path = __toESM(require("node:path"));
-var import_node_process = __toESM(require("node:process"));
-var import_safe = require("../../fs/safe");
-var import_socket = require("../../paths/socket");
-var import_from_download = require("../from-download");
-var import_asset_names = require("./asset-names");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_paths_socket = require('../../paths/socket.js');
+const require_fs_safe = require('../../fs/safe.js');
+const require_external_tools_from_download = require('../from-download.js');
+const require_external_tools_cdxgen_asset_names = require('./asset-names.js');
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+
+//#region src/external-tools/cdxgen/from-download.ts
+/**
+* @file `cdxgenFromDownload()` — fetches the upstream cdxgen SEA binary (slim
+*   by default) and returns a `ResolvedCdxgen` pointing at the cached
+*   executable. cdxgen ships bare-binary assets per platform (no archive
+*   wrapper) with sidecar `.sha256` files; this helper passes the pinned
+*   integrity through `downloadToolArchive`, then copies the downloaded blob to
+*   `cdxgen[.exe]` and chmods it 0o755. Platforms upstream doesn't ship a SEA
+*   for (none today; the asset map covers all 8 fleet targets) return
+*   `undefined` — callers should fall back to `cdxgenFromNpm()` for those.
+*/
 async function cdxgenFromDownload(opts) {
-  const {
-    cacheDir,
-    downloader,
-    integrity,
-    platformArch,
-    variant = "slim",
-    version
-  } = opts;
-  const url = (0, import_asset_names.getCdxgenDownloadUrl)({ platformArch, variant, version });
-  const entry = (0, import_asset_names.getCdxgenAssetEntry)(platformArch, variant);
-  if (!url || !entry) {
-    return void 0;
-  }
-  const archive = await (0, import_from_download.downloadToolArchive)({
-    url,
-    name: `cdxgen-${version}-${platformArch}-${variant}-${entry.asset}`,
-    integrity,
-    downloader
-  });
-  const targetDir = cacheDir ?? import_node_path.default.join(
-    (0, import_socket.getSocketDlxDir)(),
-    "cdxgen",
-    version,
-    `${platformArch}-${variant}`
-  );
-  await (0, import_safe.safeMkdir)(targetDir);
-  const ext = import_node_process.default.platform === "win32" ? ".exe" : "";
-  const finalPath = import_node_path.default.join(targetDir, `cdxgen${ext}`);
-  await import_node_fs.promises.copyFile(archive.archivePath, finalPath);
-  await import_node_fs.promises.chmod(finalPath, 493);
-  return {
-    path: finalPath,
-    source: "download",
-    integrity: archive.integrity
-  };
+	const { cacheDir, downloader, integrity, platformArch, variant = "slim", version } = opts;
+	const url = require_external_tools_cdxgen_asset_names.getCdxgenDownloadUrl({
+		platformArch,
+		variant,
+		version
+	});
+	const entry = require_external_tools_cdxgen_asset_names.getCdxgenAssetEntry(platformArch, variant);
+	if (!url || !entry) return;
+	const archive = await require_external_tools_from_download.downloadToolArchive({
+		url,
+		name: `cdxgen-${version}-${platformArch}-${variant}-${entry.asset}`,
+		integrity,
+		downloader
+	});
+	const targetDir = cacheDir ?? node_path.default.join(require_paths_socket.getSocketDlxDir(), "cdxgen", version, `${platformArch}-${variant}`);
+	await require_fs_safe.safeMkdir(targetDir);
+	const ext = node_process.default.platform === "win32" ? ".exe" : "";
+	const finalPath = node_path.default.join(targetDir, `cdxgen${ext}`);
+	await node_fs.promises.copyFile(archive.archivePath, finalPath);
+	await node_fs.promises.chmod(finalPath, 493);
+	return {
+		path: finalPath,
+		source: "download",
+		integrity: archive.integrity
+	};
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  cdxgenFromDownload
-});
+
+//#endregion
+exports.cdxgenFromDownload = cdxgenFromDownload;

package/dist/external-tools/cdxgen/from-path.js

@@ -1,40 +1,22 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var from_path_exports = {};
-__export(from_path_exports, {
-  cdxgenFromPath: () => cdxgenFromPath
-});
-module.exports = __toCommonJS(from_path_exports);
-var import_which = require("../../bin/which");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_bin_which = require('../../bin/which.js');
+
+//#region src/external-tools/cdxgen/from-path.ts
+/**
+* @file `cdxgenFromPath()` — looks for `cdxgen` on the system PATH.
+*/
 async function cdxgenFromPath() {
-  const onPath = await (0, import_which.which)("cdxgen", { nothrow: true });
-  if (typeof onPath !== "string") {
-    return void 0;
-  }
-  return {
-    path: onPath,
-    source: "path"
-  };
+	const onPath = await require_bin_which.which("cdxgen", { nothrow: true });
+	/* c8 ignore start - reached only when cdxgen is NOT on PATH. */
+	if (typeof onPath !== "string") return;
+	/* c8 ignore stop */
+	return {
+		path: onPath,
+		source: "path"
+	};
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  cdxgenFromPath
-});
+
+//#endregion
+exports.cdxgenFromPath = cdxgenFromPath;

package/dist/external-tools/cdxgen/from-vfs.js

@@ -1,47 +1,26 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var from_vfs_exports = {};
-__export(from_vfs_exports, {
-  CDXGEN_VFS_KEY: () => CDXGEN_VFS_KEY,
-  cdxgenFromVfs: () => cdxgenFromVfs
-});
-module.exports = __toCommonJS(from_vfs_exports);
-var import_vfs = require("../../smol/vfs");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_smol_vfs = require('../../smol/vfs.js');
+
+//#region src/external-tools/cdxgen/from-vfs.ts
+/**
+* @file `cdxgenFromVfs()` — extracts cdxgen from the smol binary's VFS. Returns
+*   `undefined` when the binary doesn't carry a bundled cdxgen.
+*/
 const CDXGEN_VFS_KEY = "cdxgen";
 async function cdxgenFromVfs() {
-  const vfs = (0, import_vfs.getSmolVfs)();
-  if (!vfs) {
-    return void 0;
-  }
-  if (!vfs.has(CDXGEN_VFS_KEY)) {
-    return void 0;
-  }
-  const realPath = await vfs.extract(CDXGEN_VFS_KEY);
-  return {
-    path: realPath,
-    source: "vfs"
-  };
+	const vfs = /* @__PURE__ */ require_smol_vfs.getSmolVfs();
+	if (!vfs) return;
+	/* c8 ignore start - smol Node binary only. */
+	if (!vfs.has("cdxgen")) return;
+	return {
+		path: await vfs.extract(CDXGEN_VFS_KEY),
+		source: "vfs"
+	};
+	/* c8 ignore stop */
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  CDXGEN_VFS_KEY,
-  cdxgenFromVfs
-});
+
+//#endregion
+exports.CDXGEN_VFS_KEY = CDXGEN_VFS_KEY;
+exports.cdxgenFromVfs = cdxgenFromVfs;