@socketsecurity/lib 5.28.0 → 6.0.0

package/dist/eco/cargo/parse-lockfile.js

@@ -0,0 +1,257 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var parse_lockfile_exports = {};
+__export(parse_lockfile_exports, {
+  addToCargoIndex: () => addToCargoIndex,
+  extractCargoDepName: () => extractCargoDepName,
+  freezeCargoEntry: () => freezeCargoEntry,
+  jsParseCargoLock: () => jsParseCargoLock,
+  newCargoEntry: () => newCargoEntry,
+  parseCargoGitSource: () => parseCargoGitSource,
+  parseCargoLock: () => parseCargoLock,
+  parseInlineArray: () => parseInlineArray,
+  stripTomlString: () => stripTomlString,
+  valueAfterEquals: () => valueAfterEquals
+});
+module.exports = __toCommonJS(parse_lockfile_exports);
+var import_array = require("../../primordials/array");
+var import_object = require("../../primordials/object");
+var import_string = require("../../primordials/string");
+function addToCargoIndex(packageIndex, name, idx) {
+  const existing = packageIndex[name];
+  if (existing === void 0) {
+    packageIndex[name] = idx;
+  } else if (typeof existing === "number") {
+    packageIndex[name] = [existing, idx];
+  } else {
+    (0, import_array.ArrayPrototypePush)(existing, idx);
+  }
+}
+function extractCargoDepName(entry) {
+  let s = entry;
+  if (s.length > 0 && (0, import_string.StringPrototypeCharCodeAt)(s, 0) === 34) {
+    s = (0, import_string.StringPrototypeSlice)(s, 1);
+  }
+  if (s.length > 0 && (0, import_string.StringPrototypeCharCodeAt)(s, s.length - 1) === 34) {
+    s = (0, import_string.StringPrototypeSlice)(s, 0, -1);
+  }
+  const spaceIdx = (0, import_string.StringPrototypeIndexOf)(s, " ");
+  if (spaceIdx === -1) {
+    return s;
+  }
+  return (0, import_string.StringPrototypeSlice)(s, 0, spaceIdx);
+}
+function freezeCargoEntry(entry) {
+  const git = entry.source !== void 0 ? parseCargoGitSource(entry.source) : void 0;
+  return (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    name: entry.name,
+    version: entry.version,
+    resolved: entry.source,
+    integrity: entry.checksum,
+    ecosystem: "cargo",
+    depType: "prod",
+    isDev: false,
+    isOptional: false,
+    isPeer: false,
+    isBundled: false,
+    vcsUrl: git?.url,
+    vcsCommit: git?.commit,
+    dependencies: entry.dependencies
+  });
+}
+function jsParseCargoLock(content) {
+  const packages = [];
+  const packageIndex = {
+    __proto__: null
+  };
+  let lockVersion = "1";
+  let currentEntry;
+  let pos = 0;
+  while (pos < content.length) {
+    const eol = (0, import_string.StringPrototypeIndexOf)(content, "\n", pos);
+    const end = eol === -1 ? content.length : eol;
+    const line = (0, import_string.StringPrototypeSlice)(content, pos, end);
+    pos = end + 1;
+    const trimmed = (0, import_string.StringPrototypeTrim)(line);
+    if (trimmed.length === 0 || trimmed[0] === "#") {
+      continue;
+    }
+    if (trimmed[0] === "[") {
+      if (currentEntry && currentEntry.name) {
+        const ref = freezeCargoEntry(currentEntry);
+        (0, import_array.ArrayPrototypePush)(packages, ref);
+        addToCargoIndex(packageIndex, currentEntry.name, packages.length - 1);
+      }
+      if (trimmed === "[[package]]") {
+        currentEntry = newCargoEntry();
+      } else {
+        currentEntry = void 0;
+      }
+      continue;
+    }
+    if (currentEntry) {
+      if (currentEntry.inDependencies) {
+        if ((0, import_string.StringPrototypeIndexOf)(trimmed, "]") !== -1) {
+          currentEntry.inDependencies = false;
+          continue;
+        }
+        const noComma = trimmed[trimmed.length - 1] === "," ? (0, import_string.StringPrototypeSlice)(trimmed, 0, -1) : trimmed;
+        const cleaned = extractCargoDepName(noComma);
+        if (cleaned.length > 0) {
+          (0, import_array.ArrayPrototypePush)(currentEntry.dependencies, cleaned);
+        }
+        continue;
+      }
+      if ((0, import_string.StringPrototypeIndexOf)(trimmed, "name") === 0) {
+        currentEntry.name = stripTomlString(valueAfterEquals(trimmed));
+      } else if ((0, import_string.StringPrototypeIndexOf)(trimmed, "version") === 0) {
+        currentEntry.version = stripTomlString(valueAfterEquals(trimmed));
+      } else if ((0, import_string.StringPrototypeIndexOf)(trimmed, "source") === 0) {
+        currentEntry.source = stripTomlString(valueAfterEquals(trimmed));
+      } else if ((0, import_string.StringPrototypeIndexOf)(trimmed, "checksum") === 0) {
+        currentEntry.checksum = stripTomlString(valueAfterEquals(trimmed));
+      } else if ((0, import_string.StringPrototypeIndexOf)(trimmed, "dependencies") === 0) {
+        const value = valueAfterEquals(trimmed);
+        if ((0, import_string.StringPrototypeIndexOf)(value, "[") !== -1 && (0, import_string.StringPrototypeIndexOf)(value, "]") !== -1) {
+          const raw = parseInlineArray(value);
+          for (let i = 0, { length } = raw; i < length; i++) {
+            (0, import_array.ArrayPrototypePush)(
+              currentEntry.dependencies,
+              extractCargoDepName(raw[i])
+            );
+          }
+        } else {
+          currentEntry.inDependencies = true;
+        }
+      }
+    } else {
+      if ((0, import_string.StringPrototypeIndexOf)(trimmed, "version") === 0) {
+        lockVersion = stripTomlString(valueAfterEquals(trimmed));
+      }
+    }
+  }
+  if (currentEntry && currentEntry.name) {
+    const ref = freezeCargoEntry(currentEntry);
+    (0, import_array.ArrayPrototypePush)(packages, ref);
+    addToCargoIndex(packageIndex, currentEntry.name, packages.length - 1);
+  }
+  return (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    type: "lockfile",
+    lockVersion,
+    ecosystem: "cargo",
+    packages: (0, import_object.ObjectFreeze)(packages),
+    _index: packageIndex
+  });
+}
+function newCargoEntry() {
+  return {
+    name: "",
+    version: "",
+    source: void 0,
+    checksum: void 0,
+    dependencies: [],
+    inDependencies: false
+  };
+}
+function parseCargoGitSource(source) {
+  if ((0, import_string.StringPrototypeIndexOf)(source, "git+") !== 0) {
+    return void 0;
+  }
+  const hashIdx = (0, import_string.StringPrototypeIndexOf)(source, "#");
+  if (hashIdx === -1) {
+    return { url: source, commit: void 0 };
+  }
+  return {
+    url: (0, import_string.StringPrototypeSlice)(source, 0, hashIdx),
+    commit: (0, import_string.StringPrototypeSlice)(source, hashIdx + 1)
+  };
+}
+function parseInlineArray(value) {
+  const start = (0, import_string.StringPrototypeIndexOf)(value, "[");
+  const end = (0, import_string.StringPrototypeIndexOf)(value, "]");
+  if (start === -1 || end === -1 || end <= start) {
+    return [];
+  }
+  const inner = (0, import_string.StringPrototypeTrim)((0, import_string.StringPrototypeSlice)(value, start + 1, end));
+  if (inner.length === 0) {
+    return [];
+  }
+  const result = [];
+  let i = 0;
+  while (i < inner.length) {
+    while (i < inner.length && (inner[i] === " " || inner[i] === "	" || inner[i] === ",")) {
+      i++;
+    }
+    if (i >= inner.length) {
+      break;
+    }
+    if ((0, import_string.StringPrototypeCharCodeAt)(inner, i) === 34) {
+      const closeIdx = (0, import_string.StringPrototypeIndexOf)(inner, '"', i + 1);
+      if (closeIdx === -1) {
+        break;
+      }
+      (0, import_array.ArrayPrototypePush)(result, (0, import_string.StringPrototypeSlice)(inner, i + 1, closeIdx));
+      i = closeIdx + 1;
+    } else {
+      const commaIdx = (0, import_string.StringPrototypeIndexOf)(inner, ",", i);
+      const next = commaIdx === -1 ? inner.length : commaIdx;
+      (0, import_array.ArrayPrototypePush)(
+        result,
+        (0, import_string.StringPrototypeTrim)((0, import_string.StringPrototypeSlice)(inner, i, next))
+      );
+      i = next;
+    }
+  }
+  return result;
+}
+function stripTomlString(value) {
+  let s = (0, import_string.StringPrototypeTrim)(value);
+  if (s.length > 0 && (0, import_string.StringPrototypeCharCodeAt)(s, 0) === 34) {
+    s = (0, import_string.StringPrototypeSlice)(s, 1);
+  }
+  if (s.length > 0 && (0, import_string.StringPrototypeCharCodeAt)(s, s.length - 1) === 34) {
+    s = (0, import_string.StringPrototypeSlice)(s, 0, -1);
+  }
+  return s;
+}
+function valueAfterEquals(line) {
+  const eq = (0, import_string.StringPrototypeIndexOf)(line, "=");
+  if (eq === -1) {
+    return "";
+  }
+  return (0, import_string.StringPrototypeTrim)((0, import_string.StringPrototypeSlice)(line, eq + 1));
+}
+const parseCargoLock = jsParseCargoLock;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  addToCargoIndex,
+  extractCargoDepName,
+  freezeCargoEntry,
+  jsParseCargoLock,
+  newCargoEntry,
+  parseCargoGitSource,
+  parseCargoLock,
+  parseInlineArray,
+  stripTomlString,
+  valueAfterEquals
+});

package/dist/eco/manifest/analyze-lockfile.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @file `analyzeLockfile(lockfile)` — returns a `LockfileStats` summary (counts
+ *   by dep type, total packages, per-ecosystem breakdown). `maxDepth` +
+ *   `avgDepth` are reported as 0 — the JS-side `ParsedLockfile` shape doesn't
+ *   preserve a dep-tree, only the flat package list. Matches socket-btm's smol
+ *   behavior exactly.
+ */
+import type { LockfileStats, ParsedLockfile } from './types';
+export declare function jsAnalyzeLockfile(lockfile: ParsedLockfile): LockfileStats;
+export declare const analyzeLockfile: (lockfile: ParsedLockfile) => LockfileStats;

package/dist/eco/manifest/analyze-lockfile.js

@@ -0,0 +1,67 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var analyze_lockfile_exports = {};
+__export(analyze_lockfile_exports, {
+  analyzeLockfile: () => analyzeLockfile,
+  jsAnalyzeLockfile: () => jsAnalyzeLockfile
+});
+module.exports = __toCommonJS(analyze_lockfile_exports);
+var import_object = require("../../primordials/object");
+var import_manifest = require("../../smol/manifest");
+function jsAnalyzeLockfile(lockfile) {
+  let prodDeps = 0;
+  let devDeps = 0;
+  let optionalDeps = 0;
+  const pkgs = lockfile.packages;
+  for (let i = 0, { length } = pkgs; i < length; i++) {
+    switch (pkgs[i].depType) {
+      case "prod":
+        prodDeps++;
+        break;
+      case "dev":
+        devDeps++;
+        break;
+      case "optional":
+        optionalDeps++;
+        break;
+    }
+  }
+  return (0, import_object.ObjectFreeze)({
+    __proto__: null,
+    totalPackages: pkgs.length,
+    prodDeps,
+    devDeps,
+    optionalDeps,
+    byEcosystem: (0, import_object.ObjectFreeze)({
+      __proto__: null,
+      [lockfile.ecosystem]: pkgs.length
+    }),
+    maxDepth: 0,
+    avgDepth: 0
+  });
+}
+const _smol = (0, import_manifest.getSmolManifest)();
+const analyzeLockfile = _smol ? _smol.analyzeLockfile : jsAnalyzeLockfile;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  analyzeLockfile,
+  jsAnalyzeLockfile
+});

package/dist/eco/manifest/detect-format.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @file `detectFormat(filename)` — maps a filename (or path) to its
+ *   `FormatDescriptor` (ecosystem + manifest/lockfile + lockfile format), or
+ *   returns `undefined` if nothing matched. On socket-btm's smol Node binary
+ *   this routes to `node:smol-manifest`'s native `detectFormat`; on stock Node
+ *   it does a basename switch over the format descriptors exported by each
+ *   PM-specific dir under `src/eco/<eco>/<pm>/`. The two paths return
+ *   byte-equivalent shapes so the swap is invisible. `supportedFiles` is
+ *   exported alongside for callers that want to enumerate the recognized
+ *   filenames (e.g. for file-globbing).
+ */
+import type { FormatDescriptor, SupportedFiles } from './types';
+export declare function jsDetectFormat(filename: string): FormatDescriptor | undefined;
+export declare const detectFormat: (filename: string) => FormatDescriptor | undefined;
+export declare const supportedFiles: SupportedFiles;

package/dist/eco/manifest/detect-format.js

@@ -0,0 +1,98 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var detect_format_exports = {};
+__export(detect_format_exports, {
+  detectFormat: () => detectFormat,
+  jsDetectFormat: () => jsDetectFormat,
+  supportedFiles: () => supportedFiles
+});
+module.exports = __toCommonJS(detect_format_exports);
+var import_lockfile_format = require("../cargo/lockfile-format");
+var import_manifest_format = require("../cargo/manifest-format");
+var import_manifest_format2 = require("../npm/manifest-format");
+var import_lockfile_format2 = require("../npm/npm/lockfile-format");
+var import_lockfile_format3 = require("../npm/pnpm/lockfile-format");
+var import_lockfile_format4 = require("../npm/yarnpkg/yarn/lockfile-format");
+var import_object = require("../../primordials/object");
+var import_manifest = require("../../smol/manifest");
+var import_string = require("../../primordials/string");
+const COMPOSER_JSON_FORMAT = (0, import_object.ObjectFreeze)({
+  __proto__: null,
+  ecosystem: "composer",
+  type: "manifest"
+});
+const COMPOSER_LOCK_FORMAT = (0, import_object.ObjectFreeze)({
+  __proto__: null,
+  ecosystem: "composer",
+  format: "composer",
+  type: "lockfile"
+});
+const MANIFEST_NAMES = (0, import_object.ObjectFreeze)([
+  import_manifest_format2.PACKAGE_JSON_FILENAME,
+  import_manifest_format.CARGO_TOML_FILENAME,
+  "composer.json"
+]);
+const LOCKFILE_NAMES = (0, import_object.ObjectFreeze)([
+  ...import_lockfile_format2.PACKAGE_LOCK_FILENAMES,
+  import_lockfile_format4.YARN_LOCK_FILENAME,
+  import_lockfile_format3.PNPM_LOCK_FILENAME,
+  import_lockfile_format.CARGO_LOCK_FILENAME,
+  "composer.lock"
+]);
+const _jsSupportedFiles = (0, import_object.ObjectFreeze)({
+  __proto__: null,
+  manifests: MANIFEST_NAMES,
+  lockfiles: LOCKFILE_NAMES
+});
+function jsDetectFormat(filename) {
+  const lastSlash = (0, import_string.StringPrototypeLastIndexOf)(filename, "/");
+  const basename = lastSlash === -1 ? filename : (0, import_string.StringPrototypeSlice)(filename, lastSlash + 1);
+  switch (basename) {
+    case import_manifest_format2.PACKAGE_JSON_FILENAME:
+      return import_manifest_format2.PACKAGE_JSON_FORMAT;
+    case import_manifest_format.CARGO_TOML_FILENAME:
+      return import_manifest_format.CARGO_TOML_FORMAT;
+    case "composer.json":
+      return COMPOSER_JSON_FORMAT;
+    case "package-lock.json":
+    case "npm-shrinkwrap.json":
+      return import_lockfile_format2.PACKAGE_LOCK_FORMAT;
+    case import_lockfile_format4.YARN_LOCK_FILENAME:
+      return import_lockfile_format4.YARN_LOCK_FORMAT;
+    case import_lockfile_format3.PNPM_LOCK_FILENAME:
+      return import_lockfile_format3.PNPM_LOCK_FORMAT;
+    case import_lockfile_format.CARGO_LOCK_FILENAME:
+      return import_lockfile_format.CARGO_LOCK_FORMAT;
+    case "composer.lock":
+      return COMPOSER_LOCK_FORMAT;
+    default:
+      return void 0;
+  }
+}
+const _smol = (0, import_manifest.getSmolManifest)();
+const detectFormat = _smol?.detectFormat ?? jsDetectFormat;
+const supportedFiles = _smol?.supportedFiles ?? _jsSupportedFiles;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  detectFormat,
+  jsDetectFormat,
+  supportedFiles
+});

package/dist/eco/manifest/find-packages.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @file `findPackages(lockfile, pattern)` — returns all `PackageRef`s whose
+ *   name matches the regex/string pattern. Pattern length is capped at 256
+ *   chars to bound ReDoS amplification against large lockfiles. Both string and
+ *   RegExp inputs are hardened via `hardenRegExp` (where available) — matches
+ *   socket-btm's smol behavior. Throws:
+ *
+ *   - `TypeError` — pattern is not a string or RegExp
+ *   - `RangeError` — pattern exceeds FIND_PACKAGES_PATTERN_MAX_LEN
+ */
+import type { PackageRef, ParsedLockfile } from './types';
+export declare const FIND_PACKAGES_PATTERN_MAX_LEN = 256;
+export declare function jsFindPackages(lockfile: ParsedLockfile, pattern: string | RegExp): readonly PackageRef[];
+export declare const findPackages: (lockfile: ParsedLockfile, pattern: string | RegExp) => readonly PackageRef[];

package/dist/eco/manifest/find-packages.js

@@ -0,0 +1,69 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var find_packages_exports = {};
+__export(find_packages_exports, {
+  FIND_PACKAGES_PATTERN_MAX_LEN: () => FIND_PACKAGES_PATTERN_MAX_LEN,
+  findPackages: () => findPackages,
+  jsFindPackages: () => jsFindPackages
+});
+module.exports = __toCommonJS(find_packages_exports);
+var import_error = require("../../primordials/error");
+var import_regexp = require("../../primordials/regexp");
+var import_manifest = require("../../smol/manifest");
+const FIND_PACKAGES_PATTERN_MAX_LEN = 256;
+function jsFindPackages(lockfile, pattern) {
+  let regex;
+  if (pattern instanceof import_regexp.RegExpCtor) {
+    if (pattern.source.length > FIND_PACKAGES_PATTERN_MAX_LEN) {
+      throw new import_error.RangeErrorCtor(
+        `pattern exceeds maximum length (${FIND_PACKAGES_PATTERN_MAX_LEN})`
+      );
+    }
+    regex = pattern;
+  } else {
+    if (typeof pattern !== "string") {
+      throw new import_error.TypeErrorCtor("pattern must be a string or RegExp");
+    }
+    if (pattern.length > FIND_PACKAGES_PATTERN_MAX_LEN) {
+      throw new import_error.RangeErrorCtor(
+        `pattern exceeds maximum length (${FIND_PACKAGES_PATTERN_MAX_LEN})`
+      );
+    }
+    regex = new import_regexp.RegExpCtor(pattern);
+  }
+  const result = [];
+  const pkgs = lockfile.packages;
+  for (let i = 0, { length } = pkgs; i < length; i++) {
+    const pkg = pkgs[i];
+    if ((0, import_regexp.RegExpPrototypeTest)(regex, pkg.name)) {
+      result[result.length] = pkg;
+    }
+  }
+  return result;
+}
+const _smol = (0, import_manifest.getSmolManifest)();
+const findPackages = _smol ? _smol.findPackages : jsFindPackages;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  FIND_PACKAGES_PATTERN_MAX_LEN,
+  findPackages,
+  jsFindPackages
+});

package/dist/eco/manifest/get-package-versions.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @file `getPackageVersions(lockfile, name)` — returns all `PackageRef`s that
+ *   match the given name in a `ParsedLockfile`. Returns an empty array when no
+ *   match exists.
+ */
+import type { PackageRef, ParsedLockfile } from './types';
+export declare function jsGetPackageVersions(lockfile: ParsedLockfile, name: string): readonly PackageRef[];
+export declare const getPackageVersions: (lockfile: ParsedLockfile, name: string) => readonly PackageRef[];

package/dist/eco/manifest/get-package-versions.js

@@ -0,0 +1,52 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var get_package_versions_exports = {};
+__export(get_package_versions_exports, {
+  getPackageVersions: () => getPackageVersions,
+  jsGetPackageVersions: () => jsGetPackageVersions
+});
+module.exports = __toCommonJS(get_package_versions_exports);
+var import_manifest = require("../../smol/manifest");
+function jsGetPackageVersions(lockfile, name) {
+  const idx = lockfile._index[name];
+  if (idx === void 0) {
+    return [];
+  }
+  if (typeof idx === "number") {
+    const pkg = lockfile.packages[idx];
+    return pkg ? [pkg] : [];
+  }
+  const result = [];
+  for (let i = 0, { length } = idx; i < length; i++) {
+    const pkg = lockfile.packages[idx[i]];
+    if (pkg) {
+      result[result.length] = pkg;
+    }
+  }
+  return result;
+}
+const _smol = (0, import_manifest.getSmolManifest)();
+const getPackageVersions = _smol ? _smol.getPackageVersions : jsGetPackageVersions;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getPackageVersions,
+  jsGetPackageVersions
+});

package/dist/eco/manifest/get-package.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @file `getPackage(lockfile, name)` — O(1) lookup of the first matching
+ *   `PackageRef` by name in a `ParsedLockfile`. Returns `undefined` when no
+ *   match exists. For multi-version names (where `_index[name]` is an array of
+ *   indices), returns the first occurrence. Use `getPackageVersions` to get all
+ *   of them.
+ */
+import type { PackageRef, ParsedLockfile } from './types';
+export declare function jsGetPackage(lockfile: ParsedLockfile, name: string): PackageRef | undefined;
+export declare const getPackage: (lockfile: ParsedLockfile, name: string) => PackageRef | undefined;

package/dist/eco/manifest/get-package.js

@@ -0,0 +1,44 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var get_package_exports = {};
+__export(get_package_exports, {
+  getPackage: () => getPackage,
+  jsGetPackage: () => jsGetPackage
+});
+module.exports = __toCommonJS(get_package_exports);
+var import_manifest = require("../../smol/manifest");
+function jsGetPackage(lockfile, name) {
+  const idx = lockfile._index[name];
+  if (idx === void 0) {
+    return void 0;
+  }
+  if (typeof idx === "number") {
+    return lockfile.packages[idx];
+  }
+  return lockfile.packages[idx[0]];
+}
+const _smol = (0, import_manifest.getSmolManifest)();
+const getPackage = _smol ? _smol.getPackage : jsGetPackage;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getPackage,
+  jsGetPackage
+});

package/dist/eco/manifest/manifest-error.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @file `ManifestError` — the error class every parser in
+ *   `src/eco/<pm>/parse-*` and every dispatcher in `src/eco/manifest/*` throws
+ *   on invalid / unsupported input. Shape matches socket-btm's smol-manifest
+ *   `ManifestError` so the smol-vs-JS swap is invisible to consumers
+ *   (`instanceof ManifestError` works on both paths because each impl exposes
+ *   its own constructor — consumers should match on `error.name ===
+ *   'ManifestError'` for cross-impl identification). Codes:
+ *
+ *   - `ERR_INVALID_JSON` — JSON.parse failure
+ *   - `ERR_UNKNOWN_FORMAT` — filename or content didn't match a parser
+ *   - `ERR_UNSUPPORTED` — ecosystem not yet implemented
+ */
+export type ManifestErrorCode = 'ERR_INVALID_JSON' | 'ERR_UNKNOWN_FORMAT' | 'ERR_UNSUPPORTED';
+export declare class ManifestError extends Error {
+    readonly code: ManifestErrorCode;
+    constructor(message: string, code: ManifestErrorCode);
+}