@socketsecurity/lib 5.28.0 → 6.0.0

package/dist/dlx/paths.js

@@ -29,43 +29,36 @@ __export(paths_exports, {
 module.exports = __toCommonJS(paths_exports);
 var import_normalize = require("../paths/normalize");
 var import_socket = require("../paths/socket");
-var import_primordials = require("../primordials");
-let _path;
-// @__NO_SIDE_EFFECTS__
-function getPath() {
-  if (_path === void 0) {
-    _path = require("node:path");
-  }
-  return _path;
-}
+var import_string = require("../primordials/string");
+var import_path = require("../node/path");
 function getDlxInstalledPackageDir(packageName) {
-  const path = /* @__PURE__ */ getPath();
+  const path = (0, import_path.getNodePath)();
   return (0, import_normalize.normalizePath)(
     path.join(getDlxPackageNodeModulesDir(packageName), packageName)
   );
 }
 function getDlxPackageDir(packageName) {
-  const path = /* @__PURE__ */ getPath();
+  const path = (0, import_path.getNodePath)();
   return (0, import_normalize.normalizePath)(path.join((0, import_socket.getSocketDlxDir)(), packageName));
 }
 function getDlxPackageJsonPath(packageName) {
-  const path = /* @__PURE__ */ getPath();
+  const path = (0, import_path.getNodePath)();
   return (0, import_normalize.normalizePath)(
     path.join(getDlxInstalledPackageDir(packageName), "package.json")
   );
 }
 function getDlxPackageNodeModulesDir(packageName) {
-  const path = /* @__PURE__ */ getPath();
+  const path = (0, import_path.getNodePath)();
   return (0, import_normalize.normalizePath)(path.join(getDlxPackageDir(packageName), "node_modules"));
 }
 function isInSocketDlx(filePath) {
   if (!filePath) {
     return false;
   }
-  const path = /* @__PURE__ */ getPath();
+  const path = (0, import_path.getNodePath)();
   const dlxDir = (0, import_normalize.normalizePath)((0, import_socket.getSocketDlxDir)());
   const absolutePath = (0, import_normalize.normalizePath)(path.resolve(filePath));
-  return (0, import_primordials.StringPrototypeStartsWith)(absolutePath, `${dlxDir}/`);
+  return (0, import_string.StringPrototypeStartsWith)(absolutePath, `${dlxDir}/`);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/dlx/spec.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @file Parse `package@version` specs into `{name, version}`. Split out of
+ *   `dlx/package.ts` for size hygiene. Uses npm-package-arg for the full
+ *   grammar; falls back to a hand-rolled last-`@` parser when npm-package-arg
+ *   can't handle the input.
+ */
+/**
+ * Parse package spec into name and version using npm-package-arg. Examples: -
+ * 'lodash@4.17.21' → { name: 'lodash', version: '4.17.21' } -
+ * '@scope/pkg@1.0.0' → { name: '@scope/pkg', version: '1.0.0' } - 'lodash' → {
+ * name: 'lodash', version: undefined }
+ *
+ * @example
+ *   ;```typescript
+ *   parsePackageSpec('lodash@4.17.21')
+ *   // { name: 'lodash', version: '4.17.21' }
+ *
+ *   parsePackageSpec('@scope/pkg')
+ *   // { name: '@scope/pkg', version: undefined }
+ *   ```
+ */
+export declare function parsePackageSpec(spec: string): {
+    name: string;
+    version: string | undefined;
+};

package/dist/dlx/spec.js

@@ -0,0 +1,63 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var spec_exports = {};
+__export(spec_exports, {
+  parsePackageSpec: () => parsePackageSpec
+});
+module.exports = __toCommonJS(spec_exports);
+var import_npm_package_arg = __toESM(require("../external/npm-package-arg"));
+var import_string = require("../primordials/string");
+function parsePackageSpec(spec) {
+  try {
+    const parsed = (0, import_npm_package_arg.default)(spec);
+    const version = parsed.type === "tag" ? parsed.fetchSpec : parsed.type === "version" || parsed.type === "range" ? parsed.fetchSpec : void 0;
+    return {
+      name: parsed.name || spec,
+      version
+    };
+  } catch {
+    const atIndex = (0, import_string.StringPrototypeLastIndexOf)(spec, "@");
+    if (atIndex === -1 || atIndex === 0) {
+      return { name: spec, version: void 0 };
+    }
+    const sliced = (0, import_string.StringPrototypeSlice)(spec, atIndex + 1);
+    return {
+      name: (0, import_string.StringPrototypeSlice)(spec, 0, atIndex),
+      // A trailing `@` (e.g. `'pkg@'`) yields an empty slice — normalize
+      // to undefined so downstream "no version" checks behave.
+      version: sliced || void 0
+    };
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parsePackageSpec
+});

package/dist/dlx/types.d.ts

@@ -0,0 +1,142 @@
+/**
+ * @file Public option / result interfaces for dlx package operations. Split out
+ *   of `dlx/package.ts` so consumers can import these types without pulling in
+ *   the implementation.
+ *
+ *   - `DownloadPackageResult` — what `downloadPackage` returns
+ *   - `EnsurePackageInstallOptions` — shared install-pinning options
+ *   - `DlxPackageOptions` — full options for `dlxPackage` / `downloadPackage`
+ *   - `DlxPackageResult` — what `dlxPackage` returns
+ */
+import type { HashSpec } from '../integrity';
+import type { LockfileSpec } from './lockfile';
+import type { spawn } from '../spawn/spawn';
+import type { SpawnOptions } from '../spawn/types';
+export interface DownloadPackageResult {
+    /**
+     * Path to the installed package directory.
+     */
+    packageDir: string;
+    /**
+     * Path to the binary.
+     */
+    binaryPath: string;
+    /**
+     * Whether the package was newly installed.
+     */
+    installed: boolean;
+}
+/**
+ * Shared install-pinning options used by both {@link DlxPackageOptions} and the
+ * lower-level `ensurePackageInstalled`.
+ */
+export interface EnsurePackageInstallOptions {
+    /**
+     * Expected hash of the top-level package tarball. Accepts either: - A bare
+     * sha512 SRI string (sniffed as integrity). - A bare sha256 hex string
+     * (sniffed as checksum). - An explicit `{ type: 'integrity' | 'checksum',
+     * value }` object.
+     */
+    hash?: HashSpec | undefined;
+    /**
+     * Override the install root passed to Arborist. By default, the install root
+     * is `~/.socket/_dlx/<cacheKey>/` (or `SOCKET_DLX_DIR/<cacheKey>/`) — keyed
+     * by spec so multiple specs share a parent dir without colliding. When
+     * `installRoot` is set, the install root is the value verbatim — no cacheKey
+     * subdirectory.
+     *
+     * In both cases the package itself lands at
+     * `<installRoot>/node_modules/<packageName>/` with transitive deps as
+     * siblings under the same `node_modules/` directory. That layout is a fixed
+     * property of Arborist; this option only controls the parent.
+     *
+     * That means **the caller is responsible for keeping per-spec installs
+     * separated** — calling twice with the same `installRoot` but different specs
+     * (e.g. `ink@7` and `ink@8`) overwrites the earlier install. Either pass a
+     * different `installRoot` per spec or pass `force: true` to accept the
+     * overwrite.
+     *
+     * Pass a sentinel name (e.g. `_dlx`, `_pkg`, `vendor`) — never one that ends
+     * in `node_modules`, since that turns the install root into something
+     * parent-walking resolvers, IDE indexers, and pnpm hoisting will mistake for
+     * a workspace `node_modules/`.
+     *
+     * Use cases:
+     *
+     * - Build pipelines that want the install gitignored alongside their own
+     *   outputs and walkable by tools that resolve through `node_modules` (e.g.
+     *   esbuild's `nodePaths`).
+     * - Tests that need a deterministic, easily-cleaned install path.
+     */
+    installRoot?: string | undefined;
+    /**
+     * Vendored `package-lock.json` to drive a reproducible install. Accepts a
+     * filesystem path (sniffed) or raw JSON content (sniffed via leading `{`), or
+     * an explicit `{ type: 'path' | 'content', value }` object.
+     *
+     * When provided, the lockfile is written into the install dir before Arborist
+     * runs and a hardened `.npmrc` is placed alongside it.
+     */
+    lockfile?: LockfileSpec | undefined;
+}
+export interface DlxPackageOptions extends EnsurePackageInstallOptions {
+    /**
+     * Package to install (e.g., '@cyclonedx/cdxgen@10.0.0'). Aligns with npx
+     * --package flag.
+     */
+    package: string;
+    /**
+     * Binary name to execute (optional - auto-detected in most cases).
+     *
+     * Auto-detection logic: 1. If package has only one binary, uses it
+     * automatically 2. Tries user-provided binaryName 3. Tries last segment of
+     * package name (e.g., 'cli' from '@socketsecurity/cli') 4. Falls back to
+     * first binary.
+     *
+     * Only needed when package has multiple binaries and auto-detection fails.
+     *
+     * @example
+     *   // Auto-detected (single binary)
+     *   { package: '@socketsecurity/cli' }  // Finds 'socket' binary automatically
+     *
+     *   // Explicit (multiple binaries)
+     *   { package: 'some-tool', binaryName: 'specific-tool' }
+     */
+    binaryName?: string | undefined;
+    /**
+     * Force reinstallation even if package exists. Aligns with npx --yes/-y flag
+     * behavior.
+     */
+    force?: boolean | undefined;
+    /**
+     * Skip confirmation prompts (auto-approve). Aligns with npx --yes/-y flag.
+     */
+    yes?: boolean | undefined;
+    /**
+     * Suppress output (quiet mode). Aligns with npx --quiet/-q and pnpm
+     * --silent/-s flags.
+     */
+    quiet?: boolean | undefined;
+    /**
+     * Additional spawn options for the execution.
+     */
+    spawnOptions?: SpawnOptions | undefined;
+}
+export interface DlxPackageResult {
+    /**
+     * Path to the installed package directory.
+     */
+    packageDir: string;
+    /**
+     * Path to the binary that was executed.
+     */
+    binaryPath: string;
+    /**
+     * Whether the package was newly installed.
+     */
+    installed: boolean;
+    /**
+     * The spawn promise for the running process.
+     */
+    spawnPromise: ReturnType<typeof spawn>;
+}

package/dist/dlx/types.js

@@ -0,0 +1,18 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);

package/dist/eco/cargo/lockfile-format.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @file Format descriptor for `Cargo.lock` — Rust's Cargo-managed lockfile.
+ *   Returned by `src/eco/manifest/detect-format.ts` when a filename matches
+ *   `Cargo.lock`.
+ */
+import type { FormatDescriptor } from '../manifest/types';
+export declare const CARGO_LOCK_FORMAT: FormatDescriptor;
+export declare const CARGO_LOCK_FILENAME = "Cargo.lock";

package/dist/eco/cargo/lockfile-format.js

@@ -0,0 +1,39 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var lockfile_format_exports = {};
+__export(lockfile_format_exports, {
+  CARGO_LOCK_FILENAME: () => CARGO_LOCK_FILENAME,
+  CARGO_LOCK_FORMAT: () => CARGO_LOCK_FORMAT
+});
+module.exports = __toCommonJS(lockfile_format_exports);
+var import_object = require("../../primordials/object");
+const CARGO_LOCK_FORMAT = (0, import_object.ObjectFreeze)({
+  __proto__: null,
+  ecosystem: "cargo",
+  format: "cargo",
+  type: "lockfile"
+});
+const CARGO_LOCK_FILENAME = "Cargo.lock";
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CARGO_LOCK_FILENAME,
+  CARGO_LOCK_FORMAT
+});

package/dist/eco/cargo/manifest-format.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @file Format descriptor for `Cargo.toml` — Rust's package manifest. Currently
+ *   only used for `detectFormat` recognition; no parser is wired yet.
+ */
+import type { FormatDescriptor } from '../manifest/types';
+export declare const CARGO_TOML_FORMAT: FormatDescriptor;
+export declare const CARGO_TOML_FILENAME = "Cargo.toml";

package/dist/eco/cargo/manifest-format.js

@@ -0,0 +1,38 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var manifest_format_exports = {};
+__export(manifest_format_exports, {
+  CARGO_TOML_FILENAME: () => CARGO_TOML_FILENAME,
+  CARGO_TOML_FORMAT: () => CARGO_TOML_FORMAT
+});
+module.exports = __toCommonJS(manifest_format_exports);
+var import_object = require("../../primordials/object");
+const CARGO_TOML_FORMAT = (0, import_object.ObjectFreeze)({
+  __proto__: null,
+  ecosystem: "cargo",
+  type: "manifest"
+});
+const CARGO_TOML_FILENAME = "Cargo.toml";
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CARGO_TOML_FILENAME,
+  CARGO_TOML_FORMAT
+});

package/dist/eco/cargo/parse-lockfile.d.ts

@@ -0,0 +1,84 @@
+/**
+ * @file `parseCargoLock(content)` — parses a Rust `Cargo.lock` (v1/v2/v3/v4)
+ *   into a `ParsedLockfile`. Cargo.lock uses a constrained TOML dialect: a
+ *   top-level `version = N` scalar plus repeating `[[package]]` array-of-table
+ *   entries. We line-scan it instead of pulling in a full TOML parser — the
+ *   spec for the lockfile is stable and small (`name`, `version`, `source`,
+ *   `checksum`, `dependencies = [ ... ]`), and a hand-rolled scanner is ~100×
+ *   cheaper than dragging in `@iarna/toml` for one use case. `dependencies`
+ *   entries come in two forms (cargo strips redundant versions when they're
+ *   unambiguous):
+ *
+ *   - `"name 1.2.3"` — name + space-separated version
+ *   - `"name"` — name only (when only one version of that crate is in the graph)
+ *   - `"name 1.2.3 (registry+…)"` — name + version + source spec
+ *     `parseGitUrl`-style detection here treats `source = "git+…"` as the git
+ *     VCS source, with `#<rev>` as the commit pin. The parser is forgiving —
+ *     unknown keys ignored, missing fields default to empty. It never throws.
+ *     Source material (in lock-step order, newest → oldest):
+ *
+ *   1. **C++ native parser** in socket-btm/node-smol-builder:
+ *      additions/source-patched/src/socketsecurity/manifest/parser_cargo.cc
+ *      Same algorithm — keep the two in lock-step.
+ *   2. **socket-sdxgen** — algorithm oracle, broader coverage:
+ *      socket-sdxgen/src/parsers/cargo/index.mts (851 lines)
+ *   3. **cdxgen** (pinned v11.11.0):
+ *      https://github.com/CycloneDX/cdxgen/blob/v11.11.0/lib/parsers/rust.js
+ *      (parseCargoLock)
+ *   4. **Cargo's own lockfile encoder** — the source of truth for the format we're
+ *      parsing:
+ *      https://github.com/rust-lang/cargo/blob/master/src/cargo/core/resolver/encode.rs
+ *      Lockfile format docs:
+ *      https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
+ *      https://doc.rust-lang.org/cargo/reference/resolver.html#lockfile-format
+ *      Regression guard:
+ *
+ *   - `[[patch.unused]]` blocks must NOT materialize as PackageRefs. Only
+ *     `[[package]]` opens an entry; any other section header (including
+ *     `[[patch.unused]]`, `[metadata]`, `[patch.crates-io]`, …) closes the
+ *     current entry to undefined. See the fixture under socket-btm's
+ *     test/fixtures/sdxgen-bug-regressions/ cargo-patch-unused-no-leak/.
+ */
+import type { PackageRef, ParsedLockfile } from '../manifest/types';
+type PackageIndex = Record<string, number | number[]>;
+export interface CargoEntryState {
+    name: string;
+    version: string;
+    source: string | undefined;
+    checksum: string | undefined;
+    dependencies: string[];
+    inDependencies: boolean;
+}
+export declare function addToCargoIndex(packageIndex: PackageIndex, name: string, idx: number): void;
+/**
+ * Strip Cargo's `name version (source)` dependency entry down to just the crate
+ * name. The version/source are advisory for cycle-breaking and not part of
+ * `PackageRef.dependencies` (which is a flat list of names, matching the
+ * npm/yarn/pnpm convention).
+ */
+export declare function extractCargoDepName(entry: string): string;
+export declare function freezeCargoEntry(entry: CargoEntryState): PackageRef;
+export declare function jsParseCargoLock(content: string): ParsedLockfile;
+export declare function newCargoEntry(): CargoEntryState;
+export declare function parseCargoGitSource(source: string): {
+    url: string;
+    commit: string | undefined;
+} | undefined;
+/**
+ * Parse a TOML array of strings on a single line: `dependencies = [ "foo 1.0",
+ * "bar 2.0" ]`. Returns the strings as raw entries (each callsite runs
+ * `extractCargoDepName`).
+ */
+export declare function parseInlineArray(value: string): string[];
+/**
+ * Strip outer double-quotes from a TOML string value.
+ */
+export declare function stripTomlString(value: string): string;
+/**
+ * Read the value half of a `key = value` TOML line. Returns the raw value text
+ * (no quote stripping); callers run `stripTomlString` if they want the inner
+ * string.
+ */
+export declare function valueAfterEquals(line: string): string;
+export declare const parseCargoLock: (content: string) => ParsedLockfile;
+export {};