@socketsecurity/lib 6.0.6 → 6.0.8

package/dist/external-tools/python/resolve.js

@@ -0,0 +1,66 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../../primordials/map-set.js');
+const require_external_tools_python_asset_names = require('./asset-names.js');
+const require_external_tools_python_from_download = require('./from-download.js');
+const require_external_tools_python_from_path = require('./from-path.js');
+
+//#region src/external-tools/python/resolve.ts
+/**
+* @file `resolvePython()` — CPython resolution entry point. Tries each source
+*   in order:
+*
+*   1. PATH — `python3` / `python` on the system PATH.
+*   2. download — python-build-standalone CPython into the DLX cache (only when
+*      `downloadIfMissing` is passed). Returns `undefined` if all enabled
+*      sources miss. Memoized per option-shape so repeated calls in one process
+*      don't re-probe / re-download. NOTE: unlike the JRE / removed-uv
+*      resolvers there is no VFS tier here — a CPython runtime is not embedded
+*      in the smol Node binary. Add a `from-vfs` tier here if that changes.
+*/
+const resolutionCache = new require_primordials_map_set.MapCtor();
+function cacheKey(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
+	const prefer = options?.preferDownload ? "prefer:" : "";
+	if (!options?.downloadIfMissing) return `${prefer}local-only`;
+	const { cacheDir, integrity, tag, version } = options.downloadIfMissing;
+	return `${prefer}dl:${version}:${tag}:${options.downloadIfMissing.arch ?? require_external_tools_python_asset_names.getPythonArch() ?? "unknown"}:${typeof integrity === "string" ? integrity : integrity ? `${integrity.type}:${integrity.value}` : ""}:${cacheDir ?? ""}`;
+}
+async function doResolvePython(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
+	const dl = options?.downloadIfMissing;
+	if (options?.preferDownload && dl) {
+		const fromDownload = await require_external_tools_python_from_download.pythonFromDownload(dl);
+		if (fromDownload) return fromDownload;
+	}
+	const fromPath = await require_external_tools_python_from_path.pythonFromPath();
+	if (fromPath) return fromPath;
+	if (dl) return require_external_tools_python_from_download.pythonFromDownload(dl);
+}
+/* c8 ignore start - test-only escape hatch. */
+function resetPythonResolution() {
+	resolutionCache.clear();
+}
+/* c8 ignore stop */
+function resolvePython(options) {
+	const key = cacheKey(options);
+	let cached = resolutionCache.get(key);
+	if (!cached) {
+		cached = doResolvePython(options);
+		resolutionCache.set(key, cached);
+	}
+	return cached;
+}
+
+//#endregion
+exports.cacheKey = cacheKey;
+exports.doResolvePython = doResolvePython;
+exports.resetPythonResolution = resetPythonResolution;
+exports.resolvePython = resolvePython;

package/dist/external-tools/python/types.d.ts

@@ -0,0 +1,49 @@
+/**
+ * @file Types for the python-build-standalone DLX resolver. A "resolved python"
+ *   is an absolute path to a CPython interpreter plus the tier that found it.
+ */
+import type { ResolvedToolIntegrity } from '../from-download';
+/**
+ * Which resolver tier produced the interpreter.
+ *
+ * - `path` — an interpreter already on PATH (system / pyenv / etc.).
+ * - `download` — a python-build-standalone CPython fetched into the DLX cache.
+ */
+export type PythonSource = 'download' | 'path';
+export interface ResolvedPython {
+    /**
+     * Absolute path to the `python3` (or `python.exe`) executable.
+     */
+    readonly path: string;
+    /**
+     * Which resolver tier found this interpreter.
+     */
+    readonly source: PythonSource;
+    /**
+     * SRI integrity of the downloaded archive. Set only when `source ===
+     * 'download'`; the PATH tier references an interpreter already on disk and
+     * computes no hash. See {@link ResolvedToolIntegrity}.
+     */
+    readonly integrity?: ResolvedToolIntegrity | undefined;
+}
+/**
+ * Pin describing which python-build-standalone build to fetch. The caller
+ * supplies these from its own `external-tools.json` (or `bundle-tools.json`) —
+ * the library does not embed a default version, so each consumer controls its
+ * own pin + soak.
+ */
+export interface PythonBuildPin {
+    /**
+     * CPython version, e.g. `3.11.14`.
+     */
+    readonly version: string;
+    /**
+     * Python-build-standalone release tag, e.g. `20260203`.
+     */
+    readonly tag: string;
+    /**
+     * Optional per-platform integrity (hex SHA-256 or SRI). Keyed by the asset
+     * filename so the resolver can verify the exact tarball it downloads.
+     */
+    readonly integrity?: string | undefined;
+}

package/dist/external-tools/sbt/asset-names.d.ts

@@ -28,4 +28,4 @@ export interface SbtDownloadOptions {
  *   // → 'https://github.com/sbt/sbt/releases/download/v1.10.7/sbt-1.10.7.tgz'
  *   ```
  */
-export declare function getSbtDownloadUrl(opts: SbtDownloadOptions): string;
+export declare function getSbtDownloadUrl(options: SbtDownloadOptions): string;

package/dist/external-tools/sbt/asset-names.js

@@ -15,8 +15,11 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 *   // → 'https://github.com/sbt/sbt/releases/download/v1.10.7/sbt-1.10.7.tgz'
 *   ```
 */
-function getSbtDownloadUrl(opts) {
-	const { version } = opts;
+function getSbtDownloadUrl(options) {
+	const { version } = {
+		__proto__: null,
+		...options
+	};
 	return `https://github.com/sbt/sbt/releases/download/v${version}/sbt-${version}.tgz`;
 }
 

package/dist/external-tools/sbt/from-download.d.ts

@@ -41,4 +41,4 @@ export interface SbtFromDownloadOptions {
  *   // → { path: '/.../bin/sbt', isJar: false, source: 'download' }
  *   ```
  */
-export declare function sbtFromDownload(opts: SbtFromDownloadOptions): Promise<ResolvedSbt | undefined>;
+export declare function sbtFromDownload(options: SbtFromDownloadOptions): Promise<ResolvedSbt | undefined>;

package/dist/external-tools/sbt/from-download.js

@@ -29,8 +29,11 @@ node_path = require_runtime.__toESM(node_path);
 *   // → { path: '/.../bin/sbt', isJar: false, source: 'download' }
 *   ```
 */
-async function sbtFromDownload(opts) {
-	const { cacheDir, downloader, integrity, version } = opts;
+async function sbtFromDownload(options) {
+	const { cacheDir, downloader, integrity, version } = {
+		__proto__: null,
+		...options
+	};
 	const url = require_external_tools_sbt_asset_names.getSbtDownloadUrl({ version });
 	const extractedDir = cacheDir ?? node_path.default.join(require_paths_socket.getSocketDlxDir(), "sbt", version);
 	const archive = await require_external_tools_from_download.downloadAndExtractTool({

package/dist/external-tools/sbt/from-vfs.js

@@ -17,7 +17,7 @@ const require_smol_vfs = require('../../smol/vfs.js');
 */
 const SBT_VFS_KEY = "sbt-launch.jar";
 async function sbtFromVfs() {
-	const vfs = /* @__PURE__ */ require_smol_vfs.getSmolVfs();
+	const vfs = require_smol_vfs.getSmolVfs();
 	if (!vfs) return;
 	/* c8 ignore start - smol Node binary only. */
 	if (!vfs.has("sbt-launch.jar")) return;

package/dist/external-tools/sbt/resolve.d.ts

@@ -25,7 +25,7 @@ export interface ResolveSbtOptions {
         downloader?: BinaryDownloader | undefined;
     } | undefined;
 }
-export declare function cacheKey(opts: ResolveSbtOptions | undefined): string;
-export declare function doResolveSbt(opts?: ResolveSbtOptions | undefined): Promise<ResolvedSbt | undefined>;
+export declare function cacheKey(options: ResolveSbtOptions | undefined): string;
+export declare function doResolveSbt(options?: ResolveSbtOptions | undefined): Promise<ResolvedSbt | undefined>;
 export declare function resetSbtResolution(): void;
-export declare function resolveSbt(opts?: ResolveSbtOptions | undefined): Promise<ResolvedSbt | undefined>;
+export declare function resolveSbt(options?: ResolveSbtOptions | undefined): Promise<ResolvedSbt | undefined>;

package/dist/external-tools/sbt/resolve.js

@@ -20,30 +20,38 @@ const require_external_tools_sbt_from_vfs = require('./from-vfs.js');
 *      Memoized per option-shape.
 */
 const resolutionCache = new require_primordials_map_set.MapCtor();
-function cacheKey(opts) {
-	if (!opts?.downloadIfMissing) return "local-only";
-	const { cacheDir, integrity, version } = opts.downloadIfMissing;
+function cacheKey(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
+	if (!options?.downloadIfMissing) return "local-only";
+	const { cacheDir, integrity, version } = options.downloadIfMissing;
 	return `dl:${version}:${typeof integrity === "string" ? integrity : integrity ? `${integrity.type}:${integrity.value}` : ""}:${cacheDir ?? ""}`;
 }
-async function doResolveSbt(opts) {
+async function doResolveSbt(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const fromVfs = await require_external_tools_sbt_from_vfs.sbtFromVfs();
 	/* c8 ignore start - smol Node binary only. */
 	if (fromVfs) return fromVfs;
 	/* c8 ignore stop */
 	const fromPath = await require_external_tools_sbt_from_path.sbtFromPath();
 	if (fromPath) return fromPath;
-	if (opts?.downloadIfMissing) return require_external_tools_sbt_from_download.sbtFromDownload(opts.downloadIfMissing);
+	if (options?.downloadIfMissing) return require_external_tools_sbt_from_download.sbtFromDownload(options.downloadIfMissing);
 }
 /* c8 ignore start - test-only escape hatch. */
 function resetSbtResolution() {
 	resolutionCache.clear();
 }
 /* c8 ignore stop */
-function resolveSbt(opts) {
-	const key = cacheKey(opts);
+function resolveSbt(options) {
+	const key = cacheKey(options);
 	let cached = resolutionCache.get(key);
 	if (!cached) {
-		cached = doResolveSbt(opts);
+		cached = doResolveSbt(options);
 		resolutionCache.set(key, cached);
 	}
 	return cached;

package/dist/external-tools/sbt/types.d.ts

@@ -28,5 +28,5 @@ export interface ResolvedSbt {
     /**
      * See {@link ResolvedToolIntegrity}.
      */
-    readonly integrity?: ResolvedToolIntegrity;
+    readonly integrity?: ResolvedToolIntegrity | undefined;
 }

package/dist/external-tools/skillspector/from-dlx.d.ts

@@ -21,4 +21,4 @@ export interface SkillSpectorFromDlxOptions {
      */
     readonly cacheDir?: string | undefined;
 }
-export declare function skillspectorFromDlx(opts: SkillSpectorFromDlxOptions): Promise<ResolvedSkillSpector | undefined>;
+export declare function skillspectorFromDlx(options: SkillSpectorFromDlxOptions): Promise<ResolvedSkillSpector | undefined>;

package/dist/external-tools/skillspector/from-dlx.js

@@ -18,10 +18,17 @@ node_path = require_runtime.__toESM(node_path);
 *     venv when its `skillspector` entry-point already exists.
 */
 const UPSTREAM_REPO = "https://github.com/NVIDIA/skillspector.git";
-async function skillspectorFromDlx(opts) {
-	const { sha } = opts;
+async function skillspectorFromDlx(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
+	const { sha } = {
+		__proto__: null,
+		...options
+	};
 	if (!sha) return;
-	const cacheDir = opts.cacheDir ?? node_path.default.join(require_paths_socket.getSocketDlxDir(), "skillspector", sha);
+	const cacheDir = options.cacheDir ?? node_path.default.join(require_paths_socket.getSocketDlxDir(), "skillspector", sha);
 	const installSpec = `git+${UPSTREAM_REPO}@${sha}`;
 	try {
 		return {

package/dist/external-tools/skillspector/from-path.js

@@ -1,10 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_paths_normalize = require('../../paths/normalize.js');
 const require_bin_which = require('../../bin/which.js');
-let node_path = require("node:path");
-node_path = require_runtime.__toESM(node_path);
 
 //#region src/external-tools/skillspector/from-path.ts
 /**
@@ -13,11 +11,11 @@ node_path = require_runtime.__toESM(node_path);
 *   directory (the dev's `pipx install skillspector` path); reports `source:
 *   'path'` otherwise (a one-off binary on PATH).
 */
-const PIPX_PATH_SEGMENT_RE = /pipx[/\\]venvs[/\\]/;
+const PIPX_PATH_SEGMENT_RE = /pipx\/venvs\//;
 async function skillspectorFromPath() {
 	const resolved = await require_bin_which.which("skillspector", { nothrow: true });
 	if (typeof resolved !== "string") return;
-	const normalized = node_path.default.normalize(resolved);
+	const normalized = require_paths_normalize.normalizePath(resolved);
 	if (PIPX_PATH_SEGMENT_RE.test(normalized)) return {
 		path: normalized,
 		source: "pipx"

package/dist/external-tools/skillspector/from-vfs.js

@@ -11,7 +11,7 @@ const require_smol_vfs = require('../../smol/vfs.js');
 */
 const SKILLSPECTOR_VFS_KEY = "skillspector";
 async function skillspectorFromVfs() {
-	const vfs = /* @__PURE__ */ require_smol_vfs.getSmolVfs();
+	const vfs = require_smol_vfs.getSmolVfs();
 	if (!vfs) return;
 	/* c8 ignore start - smol Node binary only. */
 	if (!vfs.has("skillspector")) return;

package/dist/external-tools/skillspector/resolve.d.ts

@@ -26,8 +26,8 @@ export interface ResolveSkillSpectorOptions {
      */
     readonly localOnly?: boolean | undefined;
 }
-export declare function cacheKey(opts: ResolveSkillSpectorOptions): string;
-export declare function doResolveSkillSpector(opts: ResolveSkillSpectorOptions): Promise<ResolvedSkillSpector | undefined>;
+export declare function cacheKey(options: ResolveSkillSpectorOptions): string;
+export declare function doResolveSkillSpector(options: ResolveSkillSpectorOptions): Promise<ResolvedSkillSpector | undefined>;
 /**
  * Memoizing wrapper around {@link doResolveSkillSpector}.
  */

package/dist/external-tools/skillspector/resolve.js

@@ -19,20 +19,28 @@ const require_external_tools_skillspector_from_vfs = require('./from-vfs.js');
 *      sha+cacheDir+localOnly tuple.
 */
 const resolutionCache = new require_primordials_map_set.MapCtor();
-function cacheKey(opts) {
-	return `${opts.sha ?? ""}|${opts.cacheDir ?? ""}|${opts.localOnly ? "local" : "full"}`;
+function cacheKey(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
+	return `${options.sha ?? ""}|${options.cacheDir ?? ""}|${options.localOnly ? "local" : "full"}`;
 }
-async function doResolveSkillSpector(opts) {
+async function doResolveSkillSpector(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const fromVfs = await require_external_tools_skillspector_from_vfs.skillspectorFromVfs();
 	/* c8 ignore start - smol Node binary only. */
 	if (fromVfs) return fromVfs;
 	/* c8 ignore stop */
 	const fromPath = await require_external_tools_skillspector_from_path.skillspectorFromPath();
 	if (fromPath) return fromPath;
-	if (opts.localOnly || !opts.sha) return;
+	if (options.localOnly || !options.sha) return;
 	return require_external_tools_skillspector_from_dlx.skillspectorFromDlx({
-		sha: opts.sha,
-		cacheDir: opts.cacheDir
+		sha: options.sha,
+		cacheDir: options.cacheDir
 	});
 }
 /**

package/dist/external-tools/synp/asset-names.d.ts

@@ -11,4 +11,4 @@ export interface SynpPackageOptions {
 /**
  * Build the npm package spec string for the requested synp version.
  */
-export declare function getSynpPackageSpec(opts: SynpPackageOptions): string;
+export declare function getSynpPackageSpec(options: SynpPackageOptions): string;

package/dist/external-tools/synp/asset-names.js

@@ -6,8 +6,12 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 /**
 * Build the npm package spec string for the requested synp version.
 */
-function getSynpPackageSpec(opts) {
-	return `synp@${opts.version}`;
+function getSynpPackageSpec(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
+	return `synp@${options.version}`;
 }
 
 //#endregion

package/dist/external-tools/synp/from-download.d.ts

@@ -15,4 +15,4 @@ export interface SynpFromDownloadOptions {
      */
     integrity?: string | undefined;
 }
-export declare function synpFromDownload(opts: SynpFromDownloadOptions): Promise<ResolvedSynp>;
+export declare function synpFromDownload(options: SynpFromDownloadOptions): Promise<ResolvedSynp>;

package/dist/external-tools/synp/from-download.js

@@ -10,10 +10,13 @@ const require_external_tools_synp_asset_names = require('./asset-names.js');
 *   `dlx/package` and returns a `ResolvedSynp` pointing at the resolved bin
 *   shim.
 */
-async function synpFromDownload(opts) {
-	const { integrity, version } = opts;
-	const { binaryPath } = await require_dlx_package.downloadPackage({
-		package: require_external_tools_synp_asset_names.getSynpPackageSpec({ version }),
+async function synpFromDownload(options) {
+	const { integrity, version } = {
+		__proto__: null,
+		...options
+	};
+	const { binaryPath } = await require_dlx_package.downloadNpmPackage({
+		spec: require_external_tools_synp_asset_names.getSynpPackageSpec({ version }),
 		binaryName: "synp",
 		...integrity ? { hash: integrity } : {}
 	});

package/dist/external-tools/synp/from-vfs.js

@@ -10,7 +10,7 @@ const require_smol_vfs = require('../../smol/vfs.js');
 */
 const SYNP_VFS_KEY = "synp";
 async function synpFromVfs() {
-	const vfs = /* @__PURE__ */ require_smol_vfs.getSmolVfs();
+	const vfs = require_smol_vfs.getSmolVfs();
 	if (!vfs) return;
 	/* c8 ignore start - smol Node binary only. */
 	if (!vfs.has("synp")) return;

package/dist/external-tools/synp/resolve.d.ts

@@ -15,7 +15,7 @@ export interface ResolveSynpOptions {
         integrity?: string | undefined;
     } | undefined;
 }
-export declare function cacheKey(opts: ResolveSynpOptions | undefined): string;
-export declare function doResolveSynp(opts?: ResolveSynpOptions | undefined): Promise<ResolvedSynp | undefined>;
+export declare function cacheKey(options: ResolveSynpOptions | undefined): string;
+export declare function doResolveSynp(options?: ResolveSynpOptions | undefined): Promise<ResolvedSynp | undefined>;
 export declare function resetSynpResolution(): void;
-export declare function resolveSynp(opts?: ResolveSynpOptions | undefined): Promise<ResolvedSynp | undefined>;
+export declare function resolveSynp(options?: ResolveSynpOptions | undefined): Promise<ResolvedSynp | undefined>;

package/dist/external-tools/synp/resolve.js

@@ -18,30 +18,38 @@ const require_external_tools_synp_from_vfs = require('./from-vfs.js');
 *      per option-shape.
 */
 const resolutionCache = new require_primordials_map_set.MapCtor();
-function cacheKey(opts) {
-	if (!opts?.downloadIfMissing) return "local-only";
-	const { integrity, version } = opts.downloadIfMissing;
+function cacheKey(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
+	if (!options?.downloadIfMissing) return "local-only";
+	const { integrity, version } = options.downloadIfMissing;
 	return `dl:${version}:${integrity ?? ""}`;
 }
-async function doResolveSynp(opts) {
+async function doResolveSynp(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const fromVfs = await require_external_tools_synp_from_vfs.synpFromVfs();
 	/* c8 ignore start - smol Node binary only. */
 	if (fromVfs) return fromVfs;
 	/* c8 ignore stop */
 	const fromPath = await require_external_tools_synp_from_path.synpFromPath();
 	if (fromPath) return fromPath;
-	if (opts?.downloadIfMissing) return require_external_tools_synp_from_download.synpFromDownload(opts.downloadIfMissing);
+	if (options?.downloadIfMissing) return require_external_tools_synp_from_download.synpFromDownload(options.downloadIfMissing);
 }
 /* c8 ignore start - test-only escape hatch. */
 function resetSynpResolution() {
 	resolutionCache.clear();
 }
 /* c8 ignore stop */
-function resolveSynp(opts) {
-	const key = cacheKey(opts);
+function resolveSynp(options) {
+	const key = cacheKey(options);
 	let cached = resolutionCache.get(key);
 	if (!cached) {
-		cached = doResolveSynp(opts);
+		cached = doResolveSynp(options);
 		resolutionCache.set(key, cached);
 	}
 	return cached;

package/dist/external-tools/trivy/asset-names.d.ts

@@ -31,4 +31,4 @@ export interface TrivyDownloadOptions {
  *
  * Reference: https://github.com/aquasecurity/trivy/releases.
  */
-export declare function getTrivyDownloadUrl(opts: TrivyDownloadOptions): string | undefined;
+export declare function getTrivyDownloadUrl(options: TrivyDownloadOptions): string | undefined;

package/dist/external-tools/trivy/asset-names.js

@@ -44,8 +44,11 @@ function getTrivyAssetEntry(platformArch) {
 *
 * Reference: https://github.com/aquasecurity/trivy/releases.
 */
-function getTrivyDownloadUrl(opts) {
-	const { platformArch, version } = opts;
+function getTrivyDownloadUrl(options) {
+	const { platformArch, version } = {
+		__proto__: null,
+		...options
+	};
 	const entry = TRIVY_ASSET_MAP[platformArch];
 	if (!entry) return;
 	return `https://github.com/aquasecurity/trivy/releases/download/v${version}/trivy_${version}_${entry.suffix}`;

package/dist/external-tools/trivy/from-download.d.ts

@@ -14,4 +14,4 @@ export interface TrivyFromDownloadOptions {
     cacheDir?: string | undefined;
     downloader?: BinaryDownloader | undefined;
 }
-export declare function trivyFromDownload(opts: TrivyFromDownloadOptions): Promise<ResolvedTrivy | undefined>;
+export declare function trivyFromDownload(options: TrivyFromDownloadOptions): Promise<ResolvedTrivy | undefined>;

package/dist/external-tools/trivy/from-download.js

@@ -5,10 +5,10 @@ const require_runtime = require('../../_virtual/_rolldown/runtime.js');
 const require_paths_socket = require('../../paths/socket.js');
 const require_external_tools_from_download = require('../from-download.js');
 const require_external_tools_trivy_asset_names = require('./asset-names.js');
-let node_path = require("node:path");
-node_path = require_runtime.__toESM(node_path);
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
 
 //#region src/external-tools/trivy/from-download.ts
 /**
@@ -17,8 +17,11 @@ node_process = require_runtime.__toESM(node_process);
 *   Windows ships zip; `downloadAndExtractTool` auto-detects the format from
 *   the archive name.
 */
-async function trivyFromDownload(opts) {
-	const { cacheDir, downloader, integrity, platformArch, version } = opts;
+async function trivyFromDownload(options) {
+	const { cacheDir, downloader, integrity, platformArch, version } = {
+		__proto__: null,
+		...options
+	};
 	const url = require_external_tools_trivy_asset_names.getTrivyDownloadUrl({
 		version,
 		platformArch

package/dist/external-tools/trivy/from-vfs.js

@@ -10,7 +10,7 @@ const require_smol_vfs = require('../../smol/vfs.js');
 */
 const TRIVY_VFS_KEY = "trivy";
 async function trivyFromVfs() {
-	const vfs = /* @__PURE__ */ require_smol_vfs.getSmolVfs();
+	const vfs = require_smol_vfs.getSmolVfs();
 	if (!vfs) return;
 	/* c8 ignore start - smol Node binary only. */
 	if (!vfs.has("trivy")) return;

package/dist/external-tools/trivy/resolve.d.ts

@@ -20,7 +20,7 @@ export interface ResolveTrivyOptions {
         downloader?: BinaryDownloader | undefined;
     } | undefined;
 }
-export declare function cacheKey(opts: ResolveTrivyOptions | undefined): string;
-export declare function doResolveTrivy(opts?: ResolveTrivyOptions | undefined): Promise<ResolvedTrivy | undefined>;
+export declare function cacheKey(options: ResolveTrivyOptions | undefined): string;
+export declare function doResolveTrivy(options?: ResolveTrivyOptions | undefined): Promise<ResolvedTrivy | undefined>;
 export declare function resetTrivyResolution(): void;
-export declare function resolveTrivy(opts?: ResolveTrivyOptions | undefined): Promise<ResolvedTrivy | undefined>;
+export declare function resolveTrivy(options?: ResolveTrivyOptions | undefined): Promise<ResolvedTrivy | undefined>;

package/dist/external-tools/trivy/resolve.js

@@ -18,30 +18,38 @@ const require_external_tools_trivy_from_vfs = require('./from-vfs.js');
 *      Memoized per option-shape.
 */
 const resolutionCache = new require_primordials_map_set.MapCtor();
-function cacheKey(opts) {
-	if (!opts?.downloadIfMissing) return "local-only";
-	const { cacheDir, integrity, platformArch, version } = opts.downloadIfMissing;
+function cacheKey(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
+	if (!options?.downloadIfMissing) return "local-only";
+	const { cacheDir, integrity, platformArch, version } = options.downloadIfMissing;
 	return `dl:${version}:${platformArch}:${typeof integrity === "string" ? integrity : integrity ? `${integrity.type}:${integrity.value}` : ""}:${cacheDir ?? ""}`;
 }
-async function doResolveTrivy(opts) {
+async function doResolveTrivy(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const fromVfs = await require_external_tools_trivy_from_vfs.trivyFromVfs();
 	/* c8 ignore start - smol Node binary only. */
 	if (fromVfs) return fromVfs;
 	/* c8 ignore stop */
 	const fromPath = await require_external_tools_trivy_from_path.trivyFromPath();
 	if (fromPath) return fromPath;
-	if (opts?.downloadIfMissing) return require_external_tools_trivy_from_download.trivyFromDownload(opts.downloadIfMissing);
+	if (options?.downloadIfMissing) return require_external_tools_trivy_from_download.trivyFromDownload(options.downloadIfMissing);
 }
 /* c8 ignore start - test-only escape hatch. */
 function resetTrivyResolution() {
 	resolutionCache.clear();
 }
 /* c8 ignore stop */
-function resolveTrivy(opts) {
-	const key = cacheKey(opts);
+function resolveTrivy(options) {
+	const key = cacheKey(options);
 	let cached = resolutionCache.get(key);
 	if (!cached) {
-		cached = doResolveTrivy(opts);
+		cached = doResolveTrivy(options);
 		resolutionCache.set(key, cached);
 	}
 	return cached;

package/dist/external-tools/trivy/types.d.ts

@@ -20,5 +20,5 @@ export interface ResolvedTrivy {
     /**
      * See {@link ResolvedToolIntegrity}.
      */
-    readonly integrity?: ResolvedToolIntegrity;
+    readonly integrity?: ResolvedToolIntegrity | undefined;
 }

package/dist/external-tools/trufflehog/asset-names.d.ts

@@ -31,4 +31,4 @@ export interface TrufflehogDownloadOptions {
  *
  * Reference: https://github.com/trufflesecurity/trufflehog/releases.
  */
-export declare function getTrufflehogDownloadUrl(opts: TrufflehogDownloadOptions): string | undefined;
+export declare function getTrufflehogDownloadUrl(options: TrufflehogDownloadOptions): string | undefined;

package/dist/external-tools/trufflehog/asset-names.js

@@ -47,8 +47,11 @@ function getTrufflehogAssetEntry(platformArch) {
 *
 * Reference: https://github.com/trufflesecurity/trufflehog/releases.
 */
-function getTrufflehogDownloadUrl(opts) {
-	const { platformArch, version } = opts;
+function getTrufflehogDownloadUrl(options) {
+	const { platformArch, version } = {
+		__proto__: null,
+		...options
+	};
 	const entry = TRUFFLEHOG_ASSET_MAP[platformArch];
 	if (!entry) return;
 	return `https://github.com/trufflesecurity/trufflehog/releases/download/v${version}/trufflehog_${version}_${entry.suffix}`;

package/dist/external-tools/trufflehog/from-download.d.ts

@@ -34,4 +34,4 @@ export interface TrufflehogFromDownloadOptions {
      */
     downloader?: BinaryDownloader | undefined;
 }
-export declare function trufflehogFromDownload(opts: TrufflehogFromDownloadOptions): Promise<ResolvedTrufflehog | undefined>;
+export declare function trufflehogFromDownload(options: TrufflehogFromDownloadOptions): Promise<ResolvedTrufflehog | undefined>;