@socketsecurity/lib 5.28.0 → 6.0.1

package/dist/eco/manifest/manifest-error.js

@@ -0,0 +1,37 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var manifest_error_exports = {};
+__export(manifest_error_exports, {
+  ManifestError: () => ManifestError
+});
+module.exports = __toCommonJS(manifest_error_exports);
+class ManifestError extends Error {
+  code;
+  constructor(message, code) {
+    super(message);
+    this.name = "ManifestError";
+    this.code = code;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ManifestError
+});

package/dist/eco/manifest/parse-lockfile.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @file `parseLockfile(content, ecosystem, format?)` — dispatches to the right
+ *   per-PM lockfile parser. When `format` is omitted, the content is sniffed
+ *   (npm `lockfileVersion`, yarn `__metadata:` or `yarn lockfile`, pnpm
+ *   `lockfileVersion:`). On socket-btm's smol Node binary this routes to
+ *   `node:smol-manifest`'s native `parseLockfile`; on stock Node it dispatches
+ *   to one of the `src/eco/npm/<pm>/parse-lockfile.ts` leaves. Throws
+ *   `ManifestError(ERR_UNSUPPORTED)` for unrecognized ecosystems, and
+ *   `ManifestError(ERR_UNKNOWN_FORMAT)` when content can't be sniffed.
+ */
+import type { ParsedLockfile } from './types';
+import type { EcosystemString } from '../purl';
+export type LockfileFormat = 'npm' | 'yarn' | 'pnpm' | 'composer' | 'cargo';
+export declare function jsParseLockfile(content: string, ecosystem: EcosystemString, format?: LockfileFormat | undefined): ParsedLockfile;
+export declare function sniffLockfileFormat(content: string): LockfileFormat | undefined;
+export declare const parseLockfile: (content: string, ecosystem: EcosystemString, format?: LockfileFormat | undefined) => ParsedLockfile;

package/dist/eco/manifest/parse-lockfile.js

@@ -0,0 +1,91 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var parse_lockfile_exports = {};
+__export(parse_lockfile_exports, {
+  jsParseLockfile: () => jsParseLockfile,
+  parseLockfile: () => parseLockfile,
+  sniffLockfileFormat: () => sniffLockfileFormat
+});
+module.exports = __toCommonJS(parse_lockfile_exports);
+var import_manifest_error = require("./manifest-error");
+var import_parse_lockfile = require("../cargo/parse-lockfile");
+var import_parse_lockfile2 = require("../npm/npm/parse-lockfile");
+var import_parse_lockfile3 = require("../npm/pnpm/parse-lockfile");
+var import_parse_lockfile4 = require("../npm/yarnpkg/yarn/parse-lockfile");
+var import_string = require("../../primordials/string");
+var import_manifest = require("../../smol/manifest");
+function jsParseLockfile(content, ecosystem, format) {
+  if (ecosystem === "cargo") {
+    return (0, import_parse_lockfile.parseCargoLock)(content);
+  }
+  if (ecosystem !== "npm") {
+    throw new import_manifest_error.ManifestError(
+      `Unsupported ecosystem: ${ecosystem}`,
+      "ERR_UNSUPPORTED"
+    );
+  }
+  const fmt = format ?? sniffLockfileFormat(content);
+  switch (fmt) {
+    case "npm":
+      return (0, import_parse_lockfile2.parsePackageLock)(content);
+    case "yarn":
+      return (0, import_parse_lockfile4.parseYarnLock)(content);
+    case "pnpm":
+      return (0, import_parse_lockfile3.parsePnpmLock)(content);
+    case "cargo":
+      return (0, import_parse_lockfile.parseCargoLock)(content);
+    default:
+      throw new import_manifest_error.ManifestError(
+        "Unable to detect lockfile format",
+        "ERR_UNKNOWN_FORMAT"
+      );
+  }
+}
+function sniffLockfileFormat(content) {
+  if ((0, import_string.StringPrototypeIndexOf)(content, '"lockfileVersion"') !== -1) {
+    return "npm";
+  }
+  if ((0, import_string.StringPrototypeIndexOf)(content, "yarn lockfile") !== -1 || (0, import_string.StringPrototypeIndexOf)(content, "__metadata:") !== -1) {
+    return "yarn";
+  }
+  if ((0, import_string.StringPrototypeIndexOf)(content, "lockfileVersion:") !== -1) {
+    return "pnpm";
+  }
+  return void 0;
+}
+const _smol = (0, import_manifest.getSmolManifest)();
+const parseLockfile = _smol ? (
+  /* c8 ignore start - smol Node binary only. */
+  (content, ecosystem, format) => _smol.parseLockfile(
+    content,
+    ecosystem,
+    format
+  )
+) : (
+  /* c8 ignore stop */
+  jsParseLockfile
+);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  jsParseLockfile,
+  parseLockfile,
+  sniffLockfileFormat
+});

package/dist/eco/manifest/parse-manifest.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @file `parseManifest(content, ecosystem)` — dispatches to the right
+ *   per-ecosystem manifest parser. On socket-btm's smol Node binary this routes
+ *   to `node:smol-manifest`'s native `parseManifest`; on stock Node it
+ *   dispatches to `src/eco/<eco>/parse-manifest.ts` (or `parse-package-json.ts`
+ *   for npm). Throws `ManifestError(ERR_UNSUPPORTED)` for ecosystems with no
+ *   parser yet (e.g. `'composer'`).
+ */
+import type { ParsedManifest } from './types';
+import type { EcosystemString } from '../purl';
+export declare function jsParseManifest(content: string, ecosystem: EcosystemString): ParsedManifest;
+export declare const parseManifest: (content: string, ecosystem: EcosystemString) => ParsedManifest;

package/dist/eco/manifest/parse-manifest.js

@@ -0,0 +1,48 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var parse_manifest_exports = {};
+__export(parse_manifest_exports, {
+  jsParseManifest: () => jsParseManifest,
+  parseManifest: () => parseManifest
+});
+module.exports = __toCommonJS(parse_manifest_exports);
+var import_manifest_error = require("./manifest-error");
+var import_parse_package_json = require("../npm/parse-package-json");
+var import_manifest = require("../../smol/manifest");
+function jsParseManifest(content, ecosystem) {
+  switch (ecosystem) {
+    case "npm":
+      return (0, import_parse_package_json.parsePackageJson)(content);
+    default:
+      throw new import_manifest_error.ManifestError(
+        `Unsupported ecosystem: ${ecosystem}`,
+        "ERR_UNSUPPORTED"
+      );
+  }
+}
+const _smol = (0, import_manifest.getSmolManifest)();
+const smolParseManifest = _smol ? (content, ecosystem) => _smol.parseManifest(content, ecosystem) : void 0;
+const parseManifest = smolParseManifest ?? jsParseManifest;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  jsParseManifest,
+  parseManifest
+});

package/dist/eco/manifest/parse.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @file `parse(filename, content)` — auto-detects format from filename then
+ *   dispatches to `parseManifest` or `parseLockfile`. Throws
+ *   `ManifestError(ERR_UNKNOWN_FORMAT)` when the filename doesn't match any
+ *   recognized manifest or lockfile basename.
+ */
+import type { ParsedLockfile, ParsedManifest } from './types';
+export declare function jsParse(filename: string, content: string): ParsedManifest | ParsedLockfile;
+export declare const parse: (filename: string, content: string) => ParsedManifest | ParsedLockfile;

package/dist/eco/manifest/parse.js

@@ -0,0 +1,52 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var parse_exports = {};
+__export(parse_exports, {
+  jsParse: () => jsParse,
+  parse: () => parse
+});
+module.exports = __toCommonJS(parse_exports);
+var import_manifest_error = require("./manifest-error");
+var import_detect_format = require("./detect-format");
+var import_parse_lockfile = require("./parse-lockfile");
+var import_parse_manifest = require("./parse-manifest");
+var import_manifest = require("../../smol/manifest");
+function jsParse(filename, content) {
+  const format = (0, import_detect_format.detectFormat)(filename);
+  if (!format) {
+    throw new import_manifest_error.ManifestError(
+      `Unknown file format: ${filename}`,
+      "ERR_UNKNOWN_FORMAT"
+    );
+  }
+  if (format.type === "manifest") {
+    return (0, import_parse_manifest.parseManifest)(content, format.ecosystem);
+  }
+  return (0, import_parse_lockfile.parseLockfile)(content, format.ecosystem, format.format);
+}
+const _smol = (0, import_manifest.getSmolManifest)();
+const smolParse = _smol ? (filename, content) => _smol.parse(filename, content) : void 0;
+const parse = smolParse ?? jsParse;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  jsParse,
+  parse
+});

package/dist/eco/manifest/types.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @file Shared types for manifest + lockfile parsing. These types are the
+ *   contract every parser in `src/eco/<pm>/parse-*` and every consumer of
+ *   `src/eco/manifest/*` agrees on. The smol binding (`src/smol/manifest.ts`)
+ *   re-exports the same shapes from its own surface so the smol-vs-JS swap is
+ *   invisible to callers. Shapes are intentionally `readonly` end-to-end —
+ *   parsers freeze their output with `Object.freeze({ __proto__: null, … })` to
+ *   match the smol implementation, and consumers must not mutate.
+ */
+export type { DepType, FormatDescriptor, LockfileStats, ManifestDep, ManifestErrorLike, PackageRef, ParsedLockfile, ParsedManifest, SupportedFiles, } from '../../smol/manifest';

package/dist/eco/manifest/types.js

@@ -0,0 +1,18 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);

package/dist/eco/npm/bun/exec.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @file Bun tool surface. Stub — execBun is not yet implemented in socket-lib.
+ *   The dir exists so downstream code (e.g. socket-cli's optimize command) can
+ *   import from a stable canonical path; populate when first concrete need
+ *   arrives. Bun lockfile is `bun.lock` (text, modern) or `bun.lockb` (binary,
+ *   legacy). Min version supported by socket-cli is 1.1.39 (text-based
+ *   lockfile). Reference: socket-sdxgen/src/parsers/bun/.
+ */
+/**
+ * Execute Bun commands. Not yet implemented — throws.
+ *
+ * @internal When implementing, model after eco/npm/npm/exec.ts
+ * (array-based args, Windows shell handling, debug-level filtering).
+ */
+export declare function execBun(_args: string[], _options?: unknown): never;

package/dist/eco/npm/bun/exec.js

@@ -0,0 +1,35 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var exec_exports = {};
+__export(exec_exports, {
+  execBun: () => execBun
+});
+module.exports = __toCommonJS(exec_exports);
+var import_error = require("../../../primordials/error");
+function execBun(_args, _options) {
+  throw new import_error.ErrorCtor(
+    "execBun is not yet implemented in @socketsecurity/lib/eco/npm/bun. Track at task #57 (socket-lib 6.x: implement execBun)."
+  );
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  execBun
+});

package/dist/eco/npm/manifest-format.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @file Format descriptor for `package.json` — the manifest shape shared across
+ *   the entire npm-family ecosystem (npm, pnpm, yarn, bun, vlt). Per-PM
+ *   lockfile descriptors live next to their parsers under
+ *   `src/eco/npm/<pm>/lockfile-format.ts`. Returned by
+ *   `src/eco/manifest/detect-format.ts` when a filename matches
+ *   `package.json`.
+ */
+import type { FormatDescriptor } from '../manifest/types';
+export declare const PACKAGE_JSON_FORMAT: FormatDescriptor;
+export declare const PACKAGE_JSON_FILENAME = "package.json";

package/dist/eco/npm/manifest-format.js

@@ -0,0 +1,38 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var manifest_format_exports = {};
+__export(manifest_format_exports, {
+  PACKAGE_JSON_FILENAME: () => PACKAGE_JSON_FILENAME,
+  PACKAGE_JSON_FORMAT: () => PACKAGE_JSON_FORMAT
+});
+module.exports = __toCommonJS(manifest_format_exports);
+var import_object = require("../../primordials/object");
+const PACKAGE_JSON_FORMAT = (0, import_object.ObjectFreeze)({
+  __proto__: null,
+  ecosystem: "npm",
+  type: "manifest"
+});
+const PACKAGE_JSON_FILENAME = "package.json";
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PACKAGE_JSON_FILENAME,
+  PACKAGE_JSON_FORMAT
+});

package/dist/eco/npm/npm/exec.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @file Execute npm commands with optimized flags and security defaults.
+ *   SECURITY: Array-based arguments prevent command injection. All elements in
+ *   the args array are properly escaped by Node.js when passed to spawn().
+ *   NOTE: We don't apply hardening flags to npm because:
+ *
+ *   1. npm is a trusted system tool installed with Node.js.
+ *   2. npm requires full system access (filesystem, network, child processes).
+ *   3. Hardening flags would prevent npm from functioning even with --allow-*
+ *      grants.
+ *   4. The permission model is intended for untrusted user code, not package
+ *      managers.
+ */
+import type { SpawnOptions } from '../../../process/spawn/types';
+/**
+ * Execute npm commands with optimized flags and settings.
+ *
+ * @example
+ *   ;```typescript
+ *   await execNpm(['install', '--save', 'lodash'])
+ *   await execNpm(['run', 'build'], { cwd: '/tmp/project' })
+ *   ```
+ */
+export declare function execNpm(args: string[], options?: SpawnOptions | undefined): import("../../../process/spawn/types").SpawnResult;

package/dist/eco/npm/npm/exec.js

@@ -0,0 +1,64 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var exec_exports = {};
+__export(exec_exports, {
+  execNpm: () => execNpm
+});
+module.exports = __toCommonJS(exec_exports);
+var import_agents = require("../../../constants/agents");
+var import_platform = require("../../../constants/platform");
+var import_namespace = require("../../../debug/namespace");
+var import_array = require("../../../primordials/array");
+var import_child = require("../../../process/spawn/child");
+var import_flags = require("./flags");
+function execNpm(args, options) {
+  const useDebug = (0, import_namespace.isDebug)();
+  const terminatorPos = (0, import_array.ArrayPrototypeIndexOf)(args, "--");
+  const npmArgs = (terminatorPos === -1 ? args : (0, import_array.ArrayPrototypeSlice)(args, 0, terminatorPos)).filter(
+    (a) => !(0, import_flags.isNpmAuditFlag)(a) && !(0, import_flags.isNpmFundFlag)(a) && !(0, import_flags.isNpmProgressFlag)(a)
+  );
+  const otherArgs = terminatorPos === -1 ? [] : (0, import_array.ArrayPrototypeSlice)(args, terminatorPos);
+  const logLevelArgs = useDebug || npmArgs.some(import_flags.isNpmLoglevelFlag) ? [] : ["--loglevel", "warn"];
+  return (0, import_child.spawn)(
+    import_agents.NPM_BIN_PATH,
+    [
+      // Even with `--loglevel=error`, npm still runs through 'audit'/'fund'
+      // codepaths unless --no-audit / --no-fund are passed explicitly.
+      "--no-audit",
+      "--no-fund",
+      // Avoid input being swallowed by the spinner in recent npm versions.
+      "--no-progress",
+      ...logLevelArgs,
+      ...npmArgs,
+      ...otherArgs
+    ],
+    {
+      __proto__: null,
+      // npm on Windows is a .cmd file that requires a shell.
+      shell: import_platform.WIN32,
+      ...options
+    }
+  );
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  execNpm
+});

package/dist/eco/npm/npm/extract-package-name-from-path.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @file `extractPackageNameFromPath(pkgPath)` — given an npm v2/v3 lockfile
+ *   entry key like `node_modules/a/node_modules/b`, returns the final package
+ *   name (`b`), preserving scoped-package boundaries (`@scope/name` stays
+ *   joined). Windows-generated lockfiles may use `\\` separators; the impl
+ *   normalizes first so both forms are handled. Behavior matches socket-btm's
+ *   smol-manifest internal `extractPackageNameFromPath`.
+ */
+export declare function extractPackageNameFromPath(pkgPath: string): string;

package/dist/eco/npm/npm/extract-package-name-from-path.js

@@ -0,0 +1,54 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var extract_package_name_from_path_exports = {};
+__export(extract_package_name_from_path_exports, {
+  extractPackageNameFromPath: () => extractPackageNameFromPath
+});
+module.exports = __toCommonJS(extract_package_name_from_path_exports);
+var import_string = require("../../../primordials/string");
+const NODE_MODULES_PREFIX = "node_modules/";
+function extractPackageNameFromPath(pkgPath) {
+  const normalized = (0, import_string.StringPrototypeReplaceAll)(pkgPath, "\\", "/");
+  const lastNmIdx = (0, import_string.StringPrototypeLastIndexOf)(normalized, NODE_MODULES_PREFIX);
+  if (lastNmIdx === -1) {
+    return normalized;
+  }
+  const withoutPrefix = (0, import_string.StringPrototypeSlice)(
+    normalized,
+    lastNmIdx + NODE_MODULES_PREFIX.length
+  );
+  if (withoutPrefix[0] === "@") {
+    const parts = (0, import_string.StringPrototypeSplit)(withoutPrefix, "/");
+    if (parts.length < 2) {
+      return withoutPrefix;
+    }
+    return `${parts[0]}/${parts[1]}`;
+  }
+  const firstSlash = (0, import_string.StringPrototypeIndexOf)(withoutPrefix, "/");
+  if (firstSlash === -1) {
+    return withoutPrefix;
+  }
+  return (0, import_string.StringPrototypeSlice)(withoutPrefix, 0, firstSlash);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  extractPackageNameFromPath
+});

package/dist/eco/npm/npm/flags.d.ts

@@ -0,0 +1,62 @@
+/**
+ * @file Npm CLI flag predicates. Each predicate identifies whether a single
+ *   argv entry matches a specific npm flag family. They're side-effect-free
+ *   pure functions marked `@__NO_SIDE_EFFECTS__` so bundlers can tree-shake
+ *   unused predicates out of consumer bundles.
+ */
+/**
+ * Check if a command argument is an npm audit flag.
+ *
+ * @example
+ *   ;```typescript
+ *   isNpmAuditFlag('--no-audit') // true
+ *   isNpmAuditFlag('--audit') // true
+ *   isNpmAuditFlag('--save') // false
+ *   ```
+ */
+export declare function isNpmAuditFlag(cmdArg: string): boolean;
+/**
+ * Check if a command argument is an npm fund flag.
+ *
+ * @example
+ *   ;```typescript
+ *   isNpmFundFlag('--no-fund') // true
+ *   isNpmFundFlag('--fund') // true
+ *   isNpmFundFlag('--save') // false
+ *   ```
+ */
+export declare function isNpmFundFlag(cmdArg: string): boolean;
+/**
+ * Check if a command argument is an npm loglevel flag.
+ *
+ * @example
+ *   ;```typescript
+ *   isNpmLoglevelFlag('--loglevel') // true
+ *   isNpmLoglevelFlag('--silent') // true
+ *   isNpmLoglevelFlag('-s') // true
+ *   isNpmLoglevelFlag('--save') // false
+ *   ```
+ */
+export declare function isNpmLoglevelFlag(cmdArg: string): boolean;
+/**
+ * Check if a command argument is an npm node-options flag.
+ *
+ * @example
+ *   ;```typescript
+ *   isNpmNodeOptionsFlag('--node-options') // true
+ *   isNpmNodeOptionsFlag('--node-options=--max-old-space-size=4096') // true
+ *   isNpmNodeOptionsFlag('--save') // false
+ *   ```
+ */
+export declare function isNpmNodeOptionsFlag(cmdArg: string): boolean;
+/**
+ * Check if a command argument is an npm progress flag.
+ *
+ * @example
+ *   ;```typescript
+ *   isNpmProgressFlag('--no-progress') // true
+ *   isNpmProgressFlag('--progress') // true
+ *   isNpmProgressFlag('--save') // false
+ *   ```
+ */
+export declare function isNpmProgressFlag(cmdArg: string): boolean;