@socketsecurity/lib 0.0.0 → 1.0.0

package/dist/packages/registry.js

@@ -0,0 +1,30 @@
+/* Socket Lib - Built with esbuild */
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var registry_exports = {};
+__export(registry_exports, {
+  SocketRegistry: () => SocketRegistry
+});
+module.exports = __toCommonJS(registry_exports);
+class SocketRegistry {
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SocketRegistry
+});
+//# sourceMappingURL=registry.js.map

package/dist/packages/registry.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/packages/registry.ts"],
+  "sourcesContent": ["/**\n * @fileoverview Socket Registry class implementation.\n */\n\n/**\n * Main Socket Registry class for managing packages.\n */\nexport class SocketRegistry {}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAOO,MAAM,eAAe;AAAC;",
+  "names": []
+}

package/dist/packages/specs.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Extract user and project from GitHub repository URL.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function getRepoUrlDetails(repoUrl?: string): {
+    user: string;
+    project: string;
+};
+/**
+ * Generate GitHub API URL for a tag reference.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function gitHubTagRefUrl(user: string, project: string, tag: string): string;
+/**
+ * Generate GitHub tarball download URL for a commit SHA.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function gitHubTgzUrl(user: string, project: string, sha: string): string;
+/**
+ * Check if a package specifier is a GitHub tarball URL.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function isGitHubTgzSpec(spec: unknown, where?: string): boolean;
+/**
+ * Check if a package specifier is a GitHub URL with committish.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function isGitHubUrlSpec(spec: unknown, where?: string): boolean;

package/dist/packages/specs.js

@@ -0,0 +1,85 @@
+/* Socket Lib - Built with esbuild */
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var specs_exports = {};
+__export(specs_exports, {
+  getRepoUrlDetails: () => getRepoUrlDetails,
+  gitHubTagRefUrl: () => gitHubTagRefUrl,
+  gitHubTgzUrl: () => gitHubTgzUrl,
+  isGitHubTgzSpec: () => isGitHubTgzSpec,
+  isGitHubUrlSpec: () => isGitHubUrlSpec
+});
+module.exports = __toCommonJS(specs_exports);
+var import_objects = require("../objects");
+var import_strings = require("../strings");
+let _npmPackageArg;
+// @__NO_SIDE_EFFECTS__
+function getNpmPackageArg() {
+  if (_npmPackageArg === void 0) {
+    _npmPackageArg = require("../../external/npm-package-arg");
+  }
+  return _npmPackageArg;
+}
+// @__NO_SIDE_EFFECTS__
+function getRepoUrlDetails(repoUrl = "") {
+  const userAndRepo = repoUrl.replace(/^.+github.com\//, "").split("/");
+  const user = userAndRepo[0] || "";
+  const project = userAndRepo.length > 1 ? userAndRepo[1]?.slice(0, -".git".length) || "" : "";
+  return { user, project };
+}
+// @__NO_SIDE_EFFECTS__
+function gitHubTagRefUrl(user, project, tag) {
+  return `https://api.github.com/repos/${user}/${project}/git/ref/tags/${tag}`;
+}
+// @__NO_SIDE_EFFECTS__
+function gitHubTgzUrl(user, project, sha) {
+  return `https://github.com/${user}/${project}/archive/${sha}.tar.gz`;
+}
+// @__NO_SIDE_EFFECTS__
+function isGitHubTgzSpec(spec, where) {
+  let parsedSpec;
+  if ((0, import_objects.isObjectObject)(spec)) {
+    parsedSpec = spec;
+  } else {
+    const npmPackageArg = /* @__PURE__ */ getNpmPackageArg();
+    parsedSpec = npmPackageArg(spec, where);
+  }
+  const typedSpec = parsedSpec;
+  return typedSpec.type === "remote" && !!typedSpec.saveSpec?.endsWith(".tar.gz");
+}
+// @__NO_SIDE_EFFECTS__
+function isGitHubUrlSpec(spec, where) {
+  let parsedSpec;
+  if ((0, import_objects.isObjectObject)(spec)) {
+    parsedSpec = spec;
+  } else {
+    const npmPackageArg = /* @__PURE__ */ getNpmPackageArg();
+    parsedSpec = npmPackageArg(spec, where);
+  }
+  const typedSpec = parsedSpec;
+  return typedSpec.type === "git" && typedSpec.hosted?.domain === "github.com" && (0, import_strings.isNonEmptyString)(typedSpec.gitCommittish);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getRepoUrlDetails,
+  gitHubTagRefUrl,
+  gitHubTgzUrl,
+  isGitHubTgzSpec,
+  isGitHubUrlSpec
+});
+//# sourceMappingURL=specs.js.map

package/dist/packages/specs.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/packages/specs.ts"],
+  "sourcesContent": ["/**\n * @fileoverview Package spec parsing and GitHub URL utilities.\n */\n\nimport { isObjectObject } from '../objects'\nimport { isNonEmptyString } from '../strings'\n\nlet _npmPackageArg: typeof import('npm-package-arg') | undefined\n/**\n * Get the npm-package-arg module.\n */\n/*@__NO_SIDE_EFFECTS__*/\nfunction getNpmPackageArg() {\n  if (_npmPackageArg === undefined) {\n    _npmPackageArg = /*@__PURE__*/ require('../../external/npm-package-arg')\n  }\n  return _npmPackageArg as typeof import('npm-package-arg')\n}\n\n/**\n * Extract user and project from GitHub repository URL.\n */\n/*@__NO_SIDE_EFFECTS__*/\nexport function getRepoUrlDetails(repoUrl: string = ''): {\n  user: string\n  project: string\n} {\n  const userAndRepo = repoUrl.replace(/^.+github.com\\//, '').split('/')\n  const user = userAndRepo[0] || ''\n  const project =\n    userAndRepo.length > 1 ? userAndRepo[1]?.slice(0, -'.git'.length) || '' : ''\n  return { user, project }\n}\n\n/**\n * Generate GitHub API URL for a tag reference.\n */\n/*@__NO_SIDE_EFFECTS__*/\nexport function gitHubTagRefUrl(\n  user: string,\n  project: string,\n  tag: string,\n): string {\n  return `https://api.github.com/repos/${user}/${project}/git/ref/tags/${tag}`\n}\n\n/**\n * Generate GitHub tarball download URL for a commit SHA.\n */\n/*@__NO_SIDE_EFFECTS__*/\nexport function gitHubTgzUrl(\n  user: string,\n  project: string,\n  sha: string,\n): string {\n  return `https://github.com/${user}/${project}/archive/${sha}.tar.gz`\n}\n\n/**\n * Check if a package specifier is a GitHub tarball URL.\n */\n/*@__NO_SIDE_EFFECTS__*/\nexport function isGitHubTgzSpec(spec: unknown, where?: string): boolean {\n  let parsedSpec: unknown\n  if (isObjectObject(spec)) {\n    parsedSpec = spec\n  } else {\n    const npmPackageArg = getNpmPackageArg()\n    parsedSpec = npmPackageArg(spec as string, where)\n  }\n  const typedSpec = parsedSpec as { type?: string; saveSpec?: string }\n  return (\n    typedSpec.type === 'remote' && !!typedSpec.saveSpec?.endsWith('.tar.gz')\n  )\n}\n\n/**\n * Check if a package specifier is a GitHub URL with committish.\n */\n/*@__NO_SIDE_EFFECTS__*/\nexport function isGitHubUrlSpec(spec: unknown, where?: string): boolean {\n  let parsedSpec: unknown\n  if (isObjectObject(spec)) {\n    parsedSpec = spec\n  } else {\n    const npmPackageArg = getNpmPackageArg()\n    parsedSpec = npmPackageArg(spec as string, where)\n  }\n  const typedSpec = parsedSpec as {\n    gitCommittish?: string\n    hosted?: { domain?: string }\n    type?: string\n  }\n  return (\n    typedSpec.type === 'git' &&\n    typedSpec.hosted?.domain === 'github.com' &&\n    isNonEmptyString(typedSpec.gitCommittish)\n  )\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,qBAA+B;AAC/B,qBAAiC;AAEjC,IAAI;AAAA;AAKJ,SAAS,mBAAmB;AAC1B,MAAI,mBAAmB,QAAW;AAChC,qBAA+B,QAAQ,gCAAgC;AAAA,EACzE;AACA,SAAO;AACT;AAAA;AAMO,SAAS,kBAAkB,UAAkB,IAGlD;AACA,QAAM,cAAc,QAAQ,QAAQ,mBAAmB,EAAE,EAAE,MAAM,GAAG;AACpE,QAAM,OAAO,YAAY,CAAC,KAAK;AAC/B,QAAM,UACJ,YAAY,SAAS,IAAI,YAAY,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,MAAM,KAAK,KAAK;AAC5E,SAAO,EAAE,MAAM,QAAQ;AACzB;AAAA;AAMO,SAAS,gBACd,MACA,SACA,KACQ;AACR,SAAO,gCAAgC,IAAI,IAAI,OAAO,iBAAiB,GAAG;AAC5E;AAAA;AAMO,SAAS,aACd,MACA,SACA,KACQ;AACR,SAAO,sBAAsB,IAAI,IAAI,OAAO,YAAY,GAAG;AAC7D;AAAA;AAMO,SAAS,gBAAgB,MAAe,OAAyB;AACtE,MAAI;AACJ,UAAI,+BAAe,IAAI,GAAG;AACxB,iBAAa;AAAA,EACf,OAAO;AACL,UAAM,gBAAgB,iCAAiB;AACvC,iBAAa,cAAc,MAAgB,KAAK;AAAA,EAClD;AACA,QAAM,YAAY;AAClB,SACE,UAAU,SAAS,YAAY,CAAC,CAAC,UAAU,UAAU,SAAS,SAAS;AAE3E;AAAA;AAMO,SAAS,gBAAgB,MAAe,OAAyB;AACtE,MAAI;AACJ,UAAI,+BAAe,IAAI,GAAG;AACxB,iBAAa;AAAA,EACf,OAAO;AACL,UAAM,gBAAgB,iCAAiB;AACvC,iBAAa,cAAc,MAAgB,KAAK;AAAA,EAClD;AACA,QAAM,YAAY;AAKlB,SACE,UAAU,SAAS,SACnB,UAAU,QAAQ,WAAW,oBAC7B,iCAAiB,UAAU,aAAa;AAE5C;",
+  "names": []
+}

package/dist/packages/validation.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Check if package name is a blessed Socket.dev package.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function isBlessedPackageName(name: unknown): boolean;
+/**
+ * Check if a type string represents a registry fetcher type.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function isRegistryFetcherType(type: string): boolean;
+/**
+ * Check if a package name is valid according to npm naming rules.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function isValidPackageName(name: string): boolean;

package/dist/packages/validation.js

@@ -0,0 +1,53 @@
+/* Socket Lib - Built with esbuild */
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var validation_exports = {};
+__export(validation_exports, {
+  isBlessedPackageName: () => isBlessedPackageName,
+  isRegistryFetcherType: () => isRegistryFetcherType,
+  isValidPackageName: () => isValidPackageName
+});
+module.exports = __toCommonJS(validation_exports);
+let _validateNpmPackageName;
+// @__NO_SIDE_EFFECTS__
+function getValidateNpmPackageName() {
+  if (_validateNpmPackageName === void 0) {
+    _validateNpmPackageName = require("../../external/validate-npm-package-name");
+  }
+  return _validateNpmPackageName;
+}
+// @__NO_SIDE_EFFECTS__
+function isBlessedPackageName(name) {
+  return typeof name === "string" && (name === "sfw" || name === "socket" || name.startsWith("@socketoverride/") || name.startsWith("@socketregistry/") || name.startsWith("@socketsecurity/"));
+}
+// @__NO_SIDE_EFFECTS__
+function isRegistryFetcherType(type) {
+  return type === "alias" || type === "range" || type === "tag" || type === "version";
+}
+// @__NO_SIDE_EFFECTS__
+function isValidPackageName(name) {
+  const validateNpmPackageName = /* @__PURE__ */ getValidateNpmPackageName();
+  return validateNpmPackageName(name).validForOldPackages;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  isBlessedPackageName,
+  isRegistryFetcherType,
+  isValidPackageName
+});
+//# sourceMappingURL=validation.js.map

package/dist/packages/validation.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/packages/validation.ts"],
+  "sourcesContent": ["/**\n * @fileoverview Package name validation utilities.\n */\n\nlet _validateNpmPackageName:\n  | typeof import('validate-npm-package-name')\n  | undefined\n/**\n * Get the validate-npm-package-name module.\n */\n/*@__NO_SIDE_EFFECTS__*/\nfunction getValidateNpmPackageName() {\n  if (_validateNpmPackageName === undefined) {\n    _validateNpmPackageName =\n      /*@__PURE__*/ require('../../external/validate-npm-package-name')\n  }\n  return _validateNpmPackageName as typeof import('validate-npm-package-name')\n}\n\n/**\n * Check if package name is a blessed Socket.dev package.\n */\n/*@__NO_SIDE_EFFECTS__*/\nexport function isBlessedPackageName(name: unknown): boolean {\n  return (\n    typeof name === 'string' &&\n    (name === 'sfw' ||\n      name === 'socket' ||\n      name.startsWith('@socketoverride/') ||\n      name.startsWith('@socketregistry/') ||\n      name.startsWith('@socketsecurity/'))\n  )\n}\n\n/**\n * Check if a type string represents a registry fetcher type.\n */\n/*@__NO_SIDE_EFFECTS__*/\nexport function isRegistryFetcherType(type: string): boolean {\n  // RegistryFetcher spec.type check based on:\n  // https://github.com/npm/pacote/blob/v19.0.0/lib/fetcher.js#L467-L488\n  return (\n    type === 'alias' || type === 'range' || type === 'tag' || type === 'version'\n  )\n}\n\n/**\n * Check if a package name is valid according to npm naming rules.\n */\n/*@__NO_SIDE_EFFECTS__*/\nexport function isValidPackageName(name: string): boolean {\n  const validateNpmPackageName = getValidateNpmPackageName()\n  return validateNpmPackageName(name).validForOldPackages\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,IAAI;AAAA;AAOJ,SAAS,4BAA4B;AACnC,MAAI,4BAA4B,QAAW;AACzC,8BACgB,QAAQ,0CAA0C;AAAA,EACpE;AACA,SAAO;AACT;AAAA;AAMO,SAAS,qBAAqB,MAAwB;AAC3D,SACE,OAAO,SAAS,aACf,SAAS,SACR,SAAS,YACT,KAAK,WAAW,kBAAkB,KAClC,KAAK,WAAW,kBAAkB,KAClC,KAAK,WAAW,kBAAkB;AAExC;AAAA;AAMO,SAAS,sBAAsB,MAAuB;AAG3D,SACE,SAAS,WAAW,SAAS,WAAW,SAAS,SAAS,SAAS;AAEvE;AAAA;AAMO,SAAS,mBAAmB,MAAuB;AACxD,QAAM,yBAAyB,0CAA0B;AACzD,SAAO,uBAAuB,IAAI,EAAE;AACtC;",
+  "names": []
+}

package/dist/packages.d.ts

@@ -0,0 +1,154 @@
+/**
+ * @fileoverview Package registry management with Socket.dev specific utilities.
+ * Provides npm package analysis, dependency resolution, and registry operations.
+ */
+import type { CategoryString } from '#types';
+import { getEditablePackageJsonClass, pkgJsonToEditable, toEditablePackageJson, toEditablePackageJsonSync } from './packages/editable';
+import { findTypesForSubpath, getExportFilePaths, getSubpaths, isConditionalExports, isSubpathExports, resolvePackageJsonEntryExports } from './packages/exports';
+import { isolatePackage } from './packages/isolation';
+import { collectIncompatibleLicenses, collectLicenseWarnings, createAstNode, createBinaryOperationNode, createLicenseNode, parseSpdxExp, resolvePackageLicenses, visitLicenses } from './packages/licenses';
+import { createPackageJson, fetchPackageManifest, fetchPackagePackument } from './packages/manifest';
+import { normalizePackageJson, resolveEscapedScope, resolveOriginalPackageName, unescapeScope } from './packages/normalize';
+import { extractPackage, findPackageExtensions, getReleaseTag, packPackage, readPackageJson, readPackageJsonSync, resolveGitHubTgzUrl, resolvePackageName, resolveRegistryPackageName } from './packages/operations';
+import { resolvePackageJsonDirname, resolvePackageJsonPath } from './packages/paths';
+import { fetchPackageProvenance, getProvenanceDetails } from './packages/provenance';
+import { getRepoUrlDetails, gitHubTagRefUrl, gitHubTgzUrl, isGitHubTgzSpec, isGitHubUrlSpec } from './packages/specs';
+import { isBlessedPackageName, isRegistryFetcherType, isValidPackageName } from './packages/validation';
+// Type for package.json exports field.
+type PackageExports = {
+    [path: string]: unknown;
+};
+// Re-export the EditablePackageJson instance type for convenient access
+export type EditablePackageJson = import('./packages/editable').EditablePackageJsonInstance;
+/**
+ * Extended PackageJson type based on NPMCliPackageJson.Content with Socket-specific additions.
+ * @extends NPMCliPackageJson.Content (from @npmcli/package-json)
+ * @property socket - Optional Socket.dev specific configuration
+ */
+export type PackageJson = {
+    // Core npm fields
+    [key: string]: unknown;
+    name?: string | undefined;
+    version?: string | undefined;
+    description?: string | undefined;
+    main?: string | undefined;
+    module?: string | undefined;
+    types?: string | undefined;
+    typings?: string | undefined;
+    bin?: string | Record<string, string> | undefined;
+    // Author and contributors
+    author?: string | {
+        name?: string;
+        email?: string;
+        url?: string;
+    } | undefined;
+    contributors?: Array<string | {
+        name?: string;
+        email?: string;
+        url?: string;
+    }> | undefined;
+    maintainers?: Array<string | {
+        name?: string;
+        email?: string;
+        url?: string;
+    }> | undefined;
+    // Repository and URLs
+    repository?: string | {
+        type?: string;
+        url?: string;
+        directory?: string;
+    } | undefined;
+    homepage?: string | undefined;
+    bugs?: string | {
+        url?: string;
+        email?: string;
+    } | undefined;
+    // License
+    license?: string | undefined;
+    licenses?: Array<{
+        type?: string;
+        url?: string;
+    }> | undefined;
+    // Scripts
+    scripts?: Record<string, string> | undefined;
+    // Dependencies
+    dependencies?: Record<string, string> | undefined;
+    devDependencies?: Record<string, string> | undefined;
+    peerDependencies?: Record<string, string> | undefined;
+    optionalDependencies?: Record<string, string> | undefined;
+    bundledDependencies?: string[] | undefined;
+    bundleDependencies?: string[] | undefined;
+    // Package managers specific
+    overrides?: Record<string, string> | undefined;
+    resolutions?: Record<string, string> | undefined;
+    pnpm?: Record<string, unknown> | undefined;
+    // Module system
+    exports?: PackageExports | string | string[] | undefined;
+    imports?: Record<string, unknown> | undefined;
+    type?: 'module' | 'commonjs' | undefined;
+    // Publishing
+    private?: boolean | undefined;
+    publishConfig?: Record<string, unknown> | undefined;
+    files?: string[] | undefined;
+    // Engines and OS
+    engines?: Record<string, string> | undefined;
+    os?: string[] | undefined;
+    cpu?: string[] | undefined;
+    // Package manager
+    packageManager?: string | undefined;
+    // Workspaces
+    workspaces?: string[] | {
+        packages?: string[];
+    } | undefined;
+    // Socket.dev specific
+    socket?: {
+        categories?: CategoryString | CategoryString[];
+        interop?: string | string[];
+        [key: string]: unknown;
+    } | undefined;
+};
+export type SaveOptions = {
+    ignoreWhitespace?: boolean | undefined;
+    sort?: boolean | undefined;
+};
+export type EditablePackageJsonOptions = {
+    normalize?: boolean | undefined;
+    path?: string | undefined;
+    preserve?: string[] | readonly string[] | undefined;
+    create?: boolean | undefined;
+    data?: PackageJson | undefined;
+};
+export type ExtractOptions = {
+    dest?: string | undefined;
+    tmpPrefix?: string | undefined;
+    signal?: AbortSignal | undefined;
+    packumentCache?: Map<string, unknown> | undefined;
+    preferOffline?: boolean | undefined;
+};
+export type NormalizeOptions = {
+    preserve?: string[] | readonly string[] | undefined;
+};
+export type ReadPackageJsonOptions = NormalizeOptions & {
+    editable?: boolean | undefined;
+    normalize?: boolean | undefined;
+    throws?: boolean | undefined;
+};
+export type ProvenanceOptions = {
+    signal?: AbortSignal | undefined;
+    timeout?: number | undefined;
+};
+export type LicenseNode = {
+    license: string;
+    exception?: string | undefined;
+    inFile?: string | undefined;
+    plus?: boolean | undefined;
+};
+export type PacoteOptions = {
+    signal?: AbortSignal | undefined;
+    packumentCache?: Map<string, unknown> | undefined;
+    preferOffline?: boolean | undefined;
+    fullMetadata?: boolean | undefined;
+};
+export type { IsolatePackageOptions, IsolatePackageResult, } from './packages/isolation';
+export type { InternalAstNode, InternalBinaryOperationNode, InternalLicenseNode, LicenseVisitor, SpdxAstNode, SpdxBinaryOperationNode, SpdxLicenseNode, } from './packages/licenses';
+export { collectIncompatibleLicenses, collectLicenseWarnings, createAstNode, createBinaryOperationNode, createLicenseNode, createPackageJson, extractPackage, fetchPackageManifest, fetchPackagePackument, fetchPackageProvenance, findPackageExtensions, findTypesForSubpath, getEditablePackageJsonClass, getExportFilePaths, getProvenanceDetails, getReleaseTag, getRepoUrlDetails, getSubpaths, gitHubTagRefUrl, gitHubTgzUrl, isBlessedPackageName, isConditionalExports, isGitHubTgzSpec, isGitHubUrlSpec, isolatePackage, isRegistryFetcherType, isSubpathExports, isValidPackageName, normalizePackageJson, packPackage, parseSpdxExp, pkgJsonToEditable, readPackageJson, readPackageJsonSync, resolveEscapedScope, resolveGitHubTgzUrl, resolveOriginalPackageName, resolvePackageName, resolvePackageJsonDirname, resolvePackageJsonPath, resolvePackageJsonEntryExports, resolvePackageLicenses, resolveRegistryPackageName, toEditablePackageJson, toEditablePackageJsonSync, unescapeScope, visitLicenses, };

package/dist/packages.js

@@ -0,0 +1,131 @@
+/* Socket Lib - Built with esbuild */
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var packages_exports = {};
+__export(packages_exports, {
+  collectIncompatibleLicenses: () => import_licenses.collectIncompatibleLicenses,
+  collectLicenseWarnings: () => import_licenses.collectLicenseWarnings,
+  createAstNode: () => import_licenses.createAstNode,
+  createBinaryOperationNode: () => import_licenses.createBinaryOperationNode,
+  createLicenseNode: () => import_licenses.createLicenseNode,
+  createPackageJson: () => import_manifest.createPackageJson,
+  extractPackage: () => import_operations.extractPackage,
+  fetchPackageManifest: () => import_manifest.fetchPackageManifest,
+  fetchPackagePackument: () => import_manifest.fetchPackagePackument,
+  fetchPackageProvenance: () => import_provenance.fetchPackageProvenance,
+  findPackageExtensions: () => import_operations.findPackageExtensions,
+  findTypesForSubpath: () => import_exports.findTypesForSubpath,
+  getEditablePackageJsonClass: () => import_editable.getEditablePackageJsonClass,
+  getExportFilePaths: () => import_exports.getExportFilePaths,
+  getProvenanceDetails: () => import_provenance.getProvenanceDetails,
+  getReleaseTag: () => import_operations.getReleaseTag,
+  getRepoUrlDetails: () => import_specs.getRepoUrlDetails,
+  getSubpaths: () => import_exports.getSubpaths,
+  gitHubTagRefUrl: () => import_specs.gitHubTagRefUrl,
+  gitHubTgzUrl: () => import_specs.gitHubTgzUrl,
+  isBlessedPackageName: () => import_validation.isBlessedPackageName,
+  isConditionalExports: () => import_exports.isConditionalExports,
+  isGitHubTgzSpec: () => import_specs.isGitHubTgzSpec,
+  isGitHubUrlSpec: () => import_specs.isGitHubUrlSpec,
+  isRegistryFetcherType: () => import_validation.isRegistryFetcherType,
+  isSubpathExports: () => import_exports.isSubpathExports,
+  isValidPackageName: () => import_validation.isValidPackageName,
+  isolatePackage: () => import_isolation.isolatePackage,
+  normalizePackageJson: () => import_normalize.normalizePackageJson,
+  packPackage: () => import_operations.packPackage,
+  parseSpdxExp: () => import_licenses.parseSpdxExp,
+  pkgJsonToEditable: () => import_editable.pkgJsonToEditable,
+  readPackageJson: () => import_operations.readPackageJson,
+  readPackageJsonSync: () => import_operations.readPackageJsonSync,
+  resolveEscapedScope: () => import_normalize.resolveEscapedScope,
+  resolveGitHubTgzUrl: () => import_operations.resolveGitHubTgzUrl,
+  resolveOriginalPackageName: () => import_normalize.resolveOriginalPackageName,
+  resolvePackageJsonDirname: () => import_paths.resolvePackageJsonDirname,
+  resolvePackageJsonEntryExports: () => import_exports.resolvePackageJsonEntryExports,
+  resolvePackageJsonPath: () => import_paths.resolvePackageJsonPath,
+  resolvePackageLicenses: () => import_licenses.resolvePackageLicenses,
+  resolvePackageName: () => import_operations.resolvePackageName,
+  resolveRegistryPackageName: () => import_operations.resolveRegistryPackageName,
+  toEditablePackageJson: () => import_editable.toEditablePackageJson,
+  toEditablePackageJsonSync: () => import_editable.toEditablePackageJsonSync,
+  unescapeScope: () => import_normalize.unescapeScope,
+  visitLicenses: () => import_licenses.visitLicenses
+});
+module.exports = __toCommonJS(packages_exports);
+var import_editable = require("./packages/editable");
+var import_exports = require("./packages/exports");
+var import_isolation = require("./packages/isolation");
+var import_licenses = require("./packages/licenses");
+var import_manifest = require("./packages/manifest");
+var import_normalize = require("./packages/normalize");
+var import_operations = require("./packages/operations");
+var import_paths = require("./packages/paths");
+var import_provenance = require("./packages/provenance");
+var import_specs = require("./packages/specs");
+var import_validation = require("./packages/validation");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  collectIncompatibleLicenses,
+  collectLicenseWarnings,
+  createAstNode,
+  createBinaryOperationNode,
+  createLicenseNode,
+  createPackageJson,
+  extractPackage,
+  fetchPackageManifest,
+  fetchPackagePackument,
+  fetchPackageProvenance,
+  findPackageExtensions,
+  findTypesForSubpath,
+  getEditablePackageJsonClass,
+  getExportFilePaths,
+  getProvenanceDetails,
+  getReleaseTag,
+  getRepoUrlDetails,
+  getSubpaths,
+  gitHubTagRefUrl,
+  gitHubTgzUrl,
+  isBlessedPackageName,
+  isConditionalExports,
+  isGitHubTgzSpec,
+  isGitHubUrlSpec,
+  isRegistryFetcherType,
+  isSubpathExports,
+  isValidPackageName,
+  isolatePackage,
+  normalizePackageJson,
+  packPackage,
+  parseSpdxExp,
+  pkgJsonToEditable,
+  readPackageJson,
+  readPackageJsonSync,
+  resolveEscapedScope,
+  resolveGitHubTgzUrl,
+  resolveOriginalPackageName,
+  resolvePackageJsonDirname,
+  resolvePackageJsonEntryExports,
+  resolvePackageJsonPath,
+  resolvePackageLicenses,
+  resolvePackageName,
+  resolveRegistryPackageName,
+  toEditablePackageJson,
+  toEditablePackageJsonSync,
+  unescapeScope,
+  visitLicenses
+});
+//# sourceMappingURL=packages.js.map

package/dist/packages.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/packages.ts"],
+  "sourcesContent": ["/**\n * @fileoverview Package registry management with Socket.dev specific utilities.\n * Provides npm package analysis, dependency resolution, and registry operations.\n */\n\nimport type { CategoryString } from '#types'\n\nimport {\n  getEditablePackageJsonClass,\n  pkgJsonToEditable,\n  toEditablePackageJson,\n  toEditablePackageJsonSync,\n} from './packages/editable'\nimport {\n  findTypesForSubpath,\n  getExportFilePaths,\n  getSubpaths,\n  isConditionalExports,\n  isSubpathExports,\n  resolvePackageJsonEntryExports,\n} from './packages/exports'\nimport { isolatePackage } from './packages/isolation'\nimport {\n  collectIncompatibleLicenses,\n  collectLicenseWarnings,\n  createAstNode,\n  createBinaryOperationNode,\n  createLicenseNode,\n  parseSpdxExp,\n  resolvePackageLicenses,\n  visitLicenses,\n} from './packages/licenses'\nimport {\n  createPackageJson,\n  fetchPackageManifest,\n  fetchPackagePackument,\n} from './packages/manifest'\nimport {\n  normalizePackageJson,\n  resolveEscapedScope,\n  resolveOriginalPackageName,\n  unescapeScope,\n} from './packages/normalize'\nimport {\n  extractPackage,\n  findPackageExtensions,\n  getReleaseTag,\n  packPackage,\n  readPackageJson,\n  readPackageJsonSync,\n  resolveGitHubTgzUrl,\n  resolvePackageName,\n  resolveRegistryPackageName,\n} from './packages/operations'\nimport {\n  resolvePackageJsonDirname,\n  resolvePackageJsonPath,\n} from './packages/paths'\nimport {\n  fetchPackageProvenance,\n  getProvenanceDetails,\n} from './packages/provenance'\nimport {\n  getRepoUrlDetails,\n  gitHubTagRefUrl,\n  gitHubTgzUrl,\n  isGitHubTgzSpec,\n  isGitHubUrlSpec,\n} from './packages/specs'\nimport {\n  isBlessedPackageName,\n  isRegistryFetcherType,\n  isValidPackageName,\n} from './packages/validation'\n\n// Type for package.json exports field.\ntype PackageExports = {\n  [path: string]: unknown\n}\n\n// Re-export the EditablePackageJson instance type for convenient access\nexport type EditablePackageJson =\n  import('./packages/editable').EditablePackageJsonInstance\n\n/**\n * Extended PackageJson type based on NPMCliPackageJson.Content with Socket-specific additions.\n * @extends NPMCliPackageJson.Content (from @npmcli/package-json)\n * @property socket - Optional Socket.dev specific configuration\n */\nexport type PackageJson = {\n  // Core npm fields\n  [key: string]: unknown\n  name?: string | undefined\n  version?: string | undefined\n  description?: string | undefined\n  main?: string | undefined\n  module?: string | undefined\n  types?: string | undefined\n  typings?: string | undefined\n  bin?: string | Record<string, string> | undefined\n\n  // Author and contributors\n  author?: string | { name?: string; email?: string; url?: string } | undefined\n  contributors?:\n    | Array<string | { name?: string; email?: string; url?: string }>\n    | undefined\n  maintainers?:\n    | Array<string | { name?: string; email?: string; url?: string }>\n    | undefined\n\n  // Repository and URLs\n  repository?:\n    | string\n    | { type?: string; url?: string; directory?: string }\n    | undefined\n  homepage?: string | undefined\n  bugs?: string | { url?: string; email?: string } | undefined\n\n  // License\n  license?: string | undefined\n  licenses?: Array<{ type?: string; url?: string }> | undefined\n\n  // Scripts\n  scripts?: Record<string, string> | undefined\n\n  // Dependencies\n  dependencies?: Record<string, string> | undefined\n  devDependencies?: Record<string, string> | undefined\n  peerDependencies?: Record<string, string> | undefined\n  optionalDependencies?: Record<string, string> | undefined\n  bundledDependencies?: string[] | undefined\n  bundleDependencies?: string[] | undefined\n\n  // Package managers specific\n  overrides?: Record<string, string> | undefined\n  resolutions?: Record<string, string> | undefined\n  pnpm?: Record<string, unknown> | undefined\n\n  // Module system\n  exports?: PackageExports | string | string[] | undefined\n  imports?: Record<string, unknown> | undefined\n  type?: 'module' | 'commonjs' | undefined\n\n  // Publishing\n  private?: boolean | undefined\n  publishConfig?: Record<string, unknown> | undefined\n  files?: string[] | undefined\n\n  // Engines and OS\n  engines?: Record<string, string> | undefined\n  os?: string[] | undefined\n  cpu?: string[] | undefined\n\n  // Package manager\n  packageManager?: string | undefined\n\n  // Workspaces\n  workspaces?: string[] | { packages?: string[] } | undefined\n\n  // Socket.dev specific\n  socket?:\n    | {\n        categories?: CategoryString | CategoryString[]\n        interop?: string | string[]\n        [key: string]: unknown\n      }\n    | undefined\n}\n\nexport type SaveOptions = {\n  ignoreWhitespace?: boolean | undefined\n  sort?: boolean | undefined\n}\n\nexport type EditablePackageJsonOptions = {\n  normalize?: boolean | undefined\n  path?: string | undefined\n  preserve?: string[] | readonly string[] | undefined\n  create?: boolean | undefined\n  data?: PackageJson | undefined\n}\n\nexport type ExtractOptions = {\n  dest?: string | undefined\n  tmpPrefix?: string | undefined\n  signal?: AbortSignal | undefined\n  packumentCache?: Map<string, unknown> | undefined\n  preferOffline?: boolean | undefined\n}\n\nexport type NormalizeOptions = {\n  preserve?: string[] | readonly string[] | undefined\n}\n\nexport type ReadPackageJsonOptions = NormalizeOptions & {\n  editable?: boolean | undefined\n  normalize?: boolean | undefined\n  throws?: boolean | undefined\n}\n\nexport type ProvenanceOptions = {\n  signal?: AbortSignal | undefined\n  timeout?: number | undefined\n}\n\nexport type LicenseNode = {\n  license: string\n  exception?: string | undefined\n  inFile?: string | undefined\n  plus?: boolean | undefined\n}\n\nexport type PacoteOptions = {\n  signal?: AbortSignal | undefined\n  packumentCache?: Map<string, unknown> | undefined\n  preferOffline?: boolean | undefined\n  fullMetadata?: boolean | undefined\n}\n\nexport type {\n  IsolatePackageOptions,\n  IsolatePackageResult,\n} from './packages/isolation'\n\nexport type {\n  InternalAstNode,\n  InternalBinaryOperationNode,\n  InternalLicenseNode,\n  LicenseVisitor,\n  SpdxAstNode,\n  SpdxBinaryOperationNode,\n  SpdxLicenseNode,\n} from './packages/licenses'\n\nexport {\n  collectIncompatibleLicenses,\n  collectLicenseWarnings,\n  createAstNode,\n  createBinaryOperationNode,\n  createLicenseNode,\n  createPackageJson,\n  extractPackage,\n  fetchPackageManifest,\n  fetchPackagePackument,\n  fetchPackageProvenance,\n  findPackageExtensions,\n  findTypesForSubpath,\n  getEditablePackageJsonClass,\n  getExportFilePaths,\n  getProvenanceDetails,\n  getReleaseTag,\n  getRepoUrlDetails,\n  getSubpaths,\n  gitHubTagRefUrl,\n  gitHubTgzUrl,\n  isBlessedPackageName,\n  isConditionalExports,\n  isGitHubTgzSpec,\n  isGitHubUrlSpec,\n  isolatePackage,\n  isRegistryFetcherType,\n  isSubpathExports,\n  isValidPackageName,\n  normalizePackageJson,\n  packPackage,\n  parseSpdxExp,\n  pkgJsonToEditable,\n  readPackageJson,\n  readPackageJsonSync,\n  resolveEscapedScope,\n  resolveGitHubTgzUrl,\n  resolveOriginalPackageName,\n  resolvePackageName,\n  resolvePackageJsonDirname,\n  resolvePackageJsonPath,\n  resolvePackageJsonEntryExports,\n  resolvePackageLicenses,\n  resolveRegistryPackageName,\n  toEditablePackageJson,\n  toEditablePackageJsonSync,\n  unescapeScope,\n  visitLicenses,\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,sBAKO;AACP,qBAOO;AACP,uBAA+B;AAC/B,sBASO;AACP,sBAIO;AACP,uBAKO;AACP,wBAUO;AACP,mBAGO;AACP,wBAGO;AACP,mBAMO;AACP,wBAIO;",
+  "names": []
+}

package/dist/path.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Check if a path contains node_modules directory.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function isNodeModules(pathLike: string | Buffer | URL): boolean;
+/**
+ * Check if a path is absolute.
+ *
+ * An absolute path is one that specifies a location from the root of the file system.
+ * This function handles both POSIX and Windows path formats.
+ *
+ * POSIX absolute paths:
+ * - Start with forward slash '/'
+ * - Examples: '/home/user', '/usr/bin/node'
+ *
+ * Windows absolute paths (3 types):
+ * 1. Drive-letter paths: Start with drive letter + colon + separator
+ *    - Format: [A-Za-z]:[\\/]
+ *    - Examples: 'C:\Windows', 'D:/data', 'c:\Program Files'
+ *    - Reference: https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file#file-and-directory-names
+ *
+ * 2. UNC paths: Start with double backslash (handled by backslash check)
+ *    - Format: \\server\share
+ *    - Examples: '\\server\share\file', '\\?\C:\path'
+ *    - Reference: https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file#unc-names
+ *
+ * 3. Device paths: Start with backslash
+ *    - Examples: '\Windows', '\\.\device'
+ *    - Note: Single backslash paths are relative to current drive
+ *
+ * Examples:
+ * - isAbsolute('/home/user') → true (POSIX)
+ * - isAbsolute('C:\\Windows') → true (Windows drive letter)
+ * - isAbsolute('\\server\\share') → true (Windows UNC)
+ * - isAbsolute('../relative') → false
+ * - isAbsolute('relative/path') → false
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function isAbsolute(pathLike: string | Buffer | URL): boolean;
+/**
+ * Check if a value is a valid file path (absolute or relative).
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function isPath(pathLike: string | Buffer | URL): boolean;
+/**
+ * Check if a path is relative.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function isRelative(pathLike: string | Buffer | URL): boolean;
+/**
+ * Normalize a path by converting backslashes to forward slashes and collapsing segments.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function normalizePath(pathLike: string | Buffer | URL): string;
+/**
+ * Convert a path-like value to a string.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function pathLikeToString(pathLike: string | Buffer | URL | null | undefined): string;
+/**
+ * Split a path into an array of segments.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function splitPath(pathLike: string | Buffer | URL): string[];
+/**
+ * Remove leading ./ or ../ from a path.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function trimLeadingDotSlash(pathLike: string | Buffer | URL): string;
+/**
+ * Get the relative path from one path to another.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function relativeResolve(from: string, to: string): string;