"use strict";
/* Socket Lib - Built with rolldown */
Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
const require_fs_safe = require('../fs/safe.js');
const require_archives_extract = require('../archives/extract.js');
const require_dlx_binary_download = require('../dlx/binary-download.js');
let node_fs = require("node:fs");

//#region src/external-tools/from-download.ts
/**
* @file Generic "download tier" for external-tools resolvers. The per-tool
*   resolvers (jre, bazel, sbt) each have local-discovery tiers — VFS, env-var
*   pointer, system PATH. This module adds two helpers covering the fourth
*   tier:
*
*   - `downloadToolArchive` — fetch the archive into the dlx cache, return the
*     path + computed integrity. Stops at "bytes on disk."
*   - `downloadAndExtractTool` — chains `downloadToolArchive` into
*     `archives.extractArchive`. Returns the extracted directory path plus the
*     integrity. Idempotent: skips extraction when the output directory already
*     has content. What this does NOT do:
*   - Pick the URL. Adoptium / Bazel-mirror / Maven URL construction is
*     consumer-specific; these helpers take a URL and run with it.
*   - Build a `Resolved*` record. The caller knows the per-tool layout (which
*     subdirectory holds the executable) and constructs the final `ResolvedJre`
*     / `ResolvedBazel` / `ResolvedSbt`. Trust-on-first-use:
*   - First call with no `integrity`: downloads, returns the computed
*     sha512-<base64> in the result. Caller writes it back to
*     `external-tools.json` (or wherever the pin lives).
*   - Subsequent calls with `integrity` set: downloads, verifies against the pin,
*     returns the same value. Customization:
*   - `downloader?` lets tests inject a fake fetch, and gives fleet consumers an
*     escape hatch for alternate cache backends, retry logic, or progress
*     reporters.
*/
/**
* Download an archive (with integrity verification) and extract it into
* `extractedDir`. Idempotent: if `extractedDir` already exists and is
* non-empty, extraction is skipped — the helper still downloads (or cache-hits)
* the archive so the integrity is surfaced consistently.
*
* @example
*   ;```typescript
*   const { extractedDir, integrity } = await downloadAndExtractTool({
*     url: 'https://example.com/jre-21-darwin-arm64.tar.gz',
*     name: 'jre-21-darwin-arm64',
*     extractedDir: '/Users/me/.cache/socket/jre/21/darwin-arm64',
*     extractOptions: { strip: 1 },
*   })
*   // Caller constructs ResolvedJre from extractedDir.
*   ```
*/
async function downloadAndExtractTool(opts) {
	const archive = await downloadToolArchive(opts);
	const { extractOptions, extractedDir } = opts;
	let extracted = false;
	if ((0, node_fs.existsSync)(extractedDir)) {
		if ((await node_fs.promises.readdir(extractedDir)).length === 0) {
			await require_archives_extract.extractArchive(archive.archivePath, extractedDir, extractOptions);
			extracted = true;
		}
	} else {
		await require_fs_safe.safeMkdir(extractedDir);
		await require_archives_extract.extractArchive(archive.archivePath, extractedDir, extractOptions);
		extracted = true;
	}
	return {
		...archive,
		extractedDir,
		extracted
	};
}
/**
* Fetch a tool archive into the dlx cache with optional integrity verification.
* Returns the cached path plus the SRI integrity for trust-on-first-use
* pinning.
*
* @example
*   ;```typescript
*   // First call — no pin yet.
*   const r = await downloadToolArchive({
*     url: 'https://api.adoptium.net/v3/binary/...',
*     name: 'adoptium-jre-21-darwin-arm64',
*   })
*   // Caller writes r.integrity into external-tools.json.
*
*   // Subsequent calls — verified against the pin.
*   const r = await downloadToolArchive({
*     url,
*     name,
*     integrity: pinnedFromManifest,
*   })
*   ```
*/
async function downloadToolArchive(opts) {
	const { downloader, integrity, name, url } = opts;
	const result = await (downloader ?? require_dlx_binary_download.downloadBinary)({
		url,
		name,
		hash: integrity
	});
	return {
		archivePath: result.binaryPath,
		downloaded: result.downloaded,
		integrity: result.integrity,
		source: "download"
	};
}

//#endregion
exports.downloadAndExtractTool = downloadAndExtractTool;
exports.downloadToolArchive = downloadToolArchive;