@socketsecurity/lib 5.28.0 → 6.0.1

package/dist/eco/npm/pnpm/parse-pnpm-package-id-v6-v9.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @file `parsePnpmPackageIdV6V9(pkgId)` — extracts `{ name, version }` from a
+ *   pnpm v6/v9 package key. Spec forms handled:
+ *
+ *   - `name@version` → unscoped
+ *   - `@scope/name@version` → scoped (last `@` is the splitter)
+ *   - `name@version(peer)` → peer-dep suffix stripped Returns `{ name: pkgId,
+ *     version: '0.0.0' }` for unparseable input.
+ */
+import type { PnpmPackageId } from './parse-pnpm-package-id-v5';
+export declare function parsePnpmPackageIdV6V9(pkgId: string): PnpmPackageId;

package/dist/eco/npm/pnpm/parse-pnpm-package-id-v6-v9.js

@@ -0,0 +1,52 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var parse_pnpm_package_id_v6_v9_exports = {};
+__export(parse_pnpm_package_id_v6_v9_exports, {
+  parsePnpmPackageIdV6V9: () => parsePnpmPackageIdV6V9
+});
+module.exports = __toCommonJS(parse_pnpm_package_id_v6_v9_exports);
+var import_string = require("../../../primordials/string");
+function parsePnpmPackageIdV6V9(pkgId) {
+  const parenIdx = (0, import_string.StringPrototypeIndexOf)(pkgId, "(");
+  const withoutPeerSuffix = parenIdx !== -1 ? (0, import_string.StringPrototypeSlice)(pkgId, 0, parenIdx) : pkgId;
+  if (withoutPeerSuffix[0] === "@") {
+    const lastAtIdx = (0, import_string.StringPrototypeLastIndexOf)(withoutPeerSuffix, "@");
+    if (lastAtIdx > 0) {
+      return {
+        name: (0, import_string.StringPrototypeSlice)(withoutPeerSuffix, 0, lastAtIdx),
+        version: (0, import_string.StringPrototypeSlice)(withoutPeerSuffix, lastAtIdx + 1)
+      };
+    }
+  } else {
+    const atIdx = (0, import_string.StringPrototypeIndexOf)(withoutPeerSuffix, "@");
+    if (atIdx > 0) {
+      return {
+        name: (0, import_string.StringPrototypeSlice)(withoutPeerSuffix, 0, atIdx),
+        version: (0, import_string.StringPrototypeSlice)(withoutPeerSuffix, atIdx + 1)
+      };
+    }
+  }
+  return { name: pkgId, version: "0.0.0" };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parsePnpmPackageIdV6V9
+});

package/dist/eco/npm/script.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @file Cross-tool script runner — picks the right package manager by detecting
+ *   the nearest lockfile and dispatches to its exec function. Falls back to
+ *   running `node --run` directly when no lockfile is found. Lockfile
+ *   precedence (first match wins, walking up from cwd):
+ *
+ *   1. pnpm-lock.yaml → execPnpm(['run', scriptName, ...args])
+ *   2. package-lock.json → execNpm(['run', scriptName, ...args])
+ *   3. yarn.lock → execYarn(['run', scriptName, ...args])
+ *   4. (no lockfile) → node --run scriptName (or `node <npm-cli> run` on older
+ *      Node where `node --run` isn't available) Honors `shell: true` by passing
+ *      through to spawn() unchanged.
+ */
+import type { SpawnOptions } from '../../process/spawn/types';
+export interface ExecScriptOptions extends SpawnOptions {
+    prepost?: boolean | undefined;
+}
+/**
+ * Execute a package.json script using the detected package manager.
+ *
+ * @param scriptName - The package.json script to run.
+ * @param args - Either the script arguments or an options object.
+ * @param options - Spawn options plus `prepost` to force npm-style pre/post
+ *   scripts.
+ *
+ * @returns The spawned `ChildProcess`-like promise from the underlying runner.
+ */
+export declare function execScript(scriptName: string, args?: string[] | readonly string[] | ExecScriptOptions | undefined, options?: ExecScriptOptions | undefined): Promise<{
+    cmd: string;
+    args: string[] | readonly string[];
+    code: number;
+    signal: NodeJS.Signals | null;
+    stdout: string | Buffer<ArrayBufferLike>;
+    stderr: string | Buffer<ArrayBufferLike>;
+}>;

package/dist/eco/npm/script.js

@@ -0,0 +1,93 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var script_exports = {};
+__export(script_exports, {
+  execScript: () => execScript
+});
+module.exports = __toCommonJS(script_exports);
+var import_node_process = __toESM(require("node:process"));
+var import_agents = require("../../constants/agents");
+var import_node = require("../../constants/node");
+var import_find_up = require("../../fs/find-up");
+var import_inspect = require("../../objects/inspect");
+var import_array = require("../../primordials/array");
+var import_child = require("../../process/spawn/child");
+var import_exec = require("./npm/exec");
+var import_exec2 = require("./pnpm/exec");
+var import_exec3 = require("./yarnpkg/yarn/exec");
+function execScript(scriptName, args, options) {
+  let resolvedOptions;
+  let resolvedArgs;
+  if (!(0, import_array.ArrayIsArray)(args) && args !== null && typeof args === "object") {
+    resolvedOptions = args;
+    resolvedArgs = [];
+  } else {
+    resolvedOptions = options;
+    resolvedArgs = args || [];
+  }
+  const { prepost, ...spawnOptions } = {
+    __proto__: null,
+    ...resolvedOptions
+  };
+  if (spawnOptions.shell === true) {
+    return (0, import_child.spawn)(scriptName, resolvedArgs, spawnOptions);
+  }
+  const useNodeRun = !prepost && (0, import_node.supportsNodeRun)();
+  const cwd = (0, import_inspect.getOwn)(spawnOptions, "cwd") ?? import_node_process.default.cwd();
+  const pnpmLockPath = (0, import_find_up.findUpSync)(import_agents.PNPM_LOCK_YAML, { cwd });
+  if (pnpmLockPath) {
+    return (0, import_exec2.execPnpm)(["run", scriptName, ...resolvedArgs], spawnOptions);
+  }
+  const packageLockPath = (0, import_find_up.findUpSync)(import_agents.PACKAGE_LOCK_JSON, { cwd });
+  if (packageLockPath) {
+    return (0, import_exec.execNpm)(["run", scriptName, ...resolvedArgs], spawnOptions);
+  }
+  const yarnLockPath = (0, import_find_up.findUpSync)(import_agents.YARN_LOCK, { cwd });
+  if (yarnLockPath) {
+    return (0, import_exec3.execYarn)(["run", scriptName, ...resolvedArgs], spawnOptions);
+  }
+  return (0, import_child.spawn)(
+    (0, import_node.getExecPath)(),
+    [
+      ...(0, import_node.getNodeNoWarningsFlags)(),
+      ...useNodeRun ? ["--run"] : [import_agents.NPM_REAL_EXEC_PATH, "run"],
+      scriptName,
+      ...resolvedArgs
+    ],
+    {
+      ...spawnOptions
+    }
+  );
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  execScript
+});

package/dist/eco/npm/vlt/exec.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @file Vlt tool surface. Stub — execVlt is not yet implemented in socket-lib.
+ *   The dir exists so downstream code can import from a stable canonical path;
+ *   populate when first concrete need arrives. vlt lockfile is `vlt-lock.json`.
+ *   Reference: socket-sdxgen/src/parsers/vlt/. vlt does not support overrides,
+ *   so fleet code that needs override support should branch around it (see
+ *   socket-cli/packages/cli/src/commands/optimize/ for the canonical pattern of
+ *   agent-conditional logic).
+ */
+/**
+ * Execute vlt commands. Not yet implemented — throws.
+ *
+ * @internal When implementing, model after eco/npm/npm/exec.ts
+ * (array-based args, Windows shell handling, debug-level filtering).
+ */
+export declare function execVlt(_args: string[], _options?: unknown): never;

package/dist/eco/npm/vlt/exec.js

@@ -0,0 +1,35 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var exec_exports = {};
+__export(exec_exports, {
+  execVlt: () => execVlt
+});
+module.exports = __toCommonJS(exec_exports);
+var import_error = require("../../../primordials/error");
+function execVlt(_args, _options) {
+  throw new import_error.ErrorCtor(
+    "execVlt is not yet implemented in @socketsecurity/lib/eco/npm/vlt. Track at task #58 (socket-lib 6.x: implement execVlt)."
+  );
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  execVlt
+});

package/dist/eco/npm/yarnpkg/yarn/exec.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @file Execute Yarn Classic (v1.x) commands with optimized flags and security
+ *   defaults. SECURITY: Array-based arguments prevent command injection. NOTE:
+ *   This is the canonical home of the cross-yarn execYarn. Yarn Berry (v2-v4)
+ *   and ZPM (v6+) currently delegate to this implementation — that's
+ *   load-bearing in the dir layout: when version-specific behavior diverges
+ *   (e.g. Berry's `--immutable` replacing Classic's `--frozen-lockfile`), the
+ *   override lands in the version's own eco/npm/yarn-{berry,zpm}/exec.ts file,
+ *   and yarn-classic stays here.
+ */
+import type { SpawnOptions } from '../../../../process/spawn/types';
+/**
+ * Execute yarn commands with optimized flags and settings.
+ *
+ * @example
+ *   ;```typescript
+ *   await execYarn(['install'])
+ *   await execYarn(['add', 'lodash'], { cwd: '/tmp/project' })
+ *   ```
+ */
+export declare function execYarn(args: string[], options?: SpawnOptions | undefined): Promise<{
+    cmd: string;
+    args: string[] | readonly string[];
+    code: number;
+    signal: NodeJS.Signals | null;
+    stdout: string | Buffer<ArrayBufferLike>;
+    stderr: string | Buffer<ArrayBufferLike>;
+}>;

package/dist/eco/npm/yarnpkg/yarn/exec.js

@@ -0,0 +1,63 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var exec_exports = {};
+__export(exec_exports, {
+  execYarn: () => execYarn
+});
+module.exports = __toCommonJS(exec_exports);
+var import_exec = require("../../../../bin/exec");
+var import_namespace = require("../../../../debug/namespace");
+var import_array = require("../../../../primordials/array");
+var import_flags = require("../../npm/flags");
+var import_flags2 = require("../../pnpm/flags");
+var import_map_set = require("../../../../primordials/map-set");
+const yarnInstallLikeCommands = new import_map_set.SetCtor([
+  "add",
+  "import",
+  "install",
+  "link",
+  "remove",
+  "unlink",
+  "upgrade"
+]);
+function execYarn(args, options) {
+  const useDebug = (0, import_namespace.isDebug)();
+  const terminatorPos = (0, import_array.ArrayPrototypeIndexOf)(args, "--");
+  const yarnArgs = (terminatorPos === -1 ? args : (0, import_array.ArrayPrototypeSlice)(args, 0, terminatorPos)).filter((a) => !(0, import_flags.isNpmProgressFlag)(a));
+  const otherArgs = terminatorPos === -1 ? [] : (0, import_array.ArrayPrototypeSlice)(args, terminatorPos);
+  const firstArg = yarnArgs[0];
+  const supportsIgnoreScripts = firstArg ? yarnInstallLikeCommands.has(firstArg) : false;
+  const logLevelArgs = useDebug || yarnArgs.some(import_flags.isNpmLoglevelFlag) ? [] : ["--silent"];
+  const hasIgnoreScriptsFlag = yarnArgs.some(import_flags2.isPnpmIgnoreScriptsFlag);
+  const ignoreScriptsArgs = !supportsIgnoreScripts || hasIgnoreScriptsFlag ? [] : ["--ignore-scripts"];
+  return (0, import_exec.execBin)(
+    "yarn",
+    [...logLevelArgs, ...ignoreScriptsArgs, ...yarnArgs, ...otherArgs],
+    {
+      __proto__: null,
+      ...options
+    }
+  );
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  execYarn
+});

package/dist/eco/npm/yarnpkg/yarn/lockfile-format.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @file Format descriptor for `yarn.lock` — yarn's lockfile (Classic v1 + Berry
+ *   v6 share the filename; the parser auto-discriminates on `__metadata:`
+ *   presence). Returned by `src/eco/manifest/detect-format.ts` when a filename
+ *   matches `yarn.lock`.
+ */
+import type { FormatDescriptor } from '../../../manifest/types';
+export declare const YARN_LOCK_FORMAT: FormatDescriptor;
+export declare const YARN_LOCK_FILENAME = "yarn.lock";

package/dist/eco/npm/yarnpkg/yarn/lockfile-format.js

@@ -0,0 +1,39 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var lockfile_format_exports = {};
+__export(lockfile_format_exports, {
+  YARN_LOCK_FILENAME: () => YARN_LOCK_FILENAME,
+  YARN_LOCK_FORMAT: () => YARN_LOCK_FORMAT
+});
+module.exports = __toCommonJS(lockfile_format_exports);
+var import_object = require("../../../../primordials/object");
+const YARN_LOCK_FORMAT = (0, import_object.ObjectFreeze)({
+  __proto__: null,
+  ecosystem: "npm",
+  format: "yarn",
+  type: "lockfile"
+});
+const YARN_LOCK_FILENAME = "yarn.lock";
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  YARN_LOCK_FILENAME,
+  YARN_LOCK_FORMAT
+});

package/dist/eco/npm/yarnpkg/yarn/parse-lockfile.d.ts

@@ -0,0 +1,61 @@
+/**
+ * @file `parseYarnLock(content)` — parses a `yarn.lock` (Classic v1 or Berry
+ *   v6) into a `ParsedLockfile`. On socket-btm's smol Node binary this routes
+ *   to `node:smol-manifest`'s native `parseLockfile(content, 'npm', 'yarn')`;
+ *   on stock Node it runs the line-scanning JS impl below. Both Classic + Berry
+ *   share the same outer shape (top-level block with `name@spec:` header +
+ *   indented properties). Berry is detected via the presence of `__metadata:`
+ *   and additionally honors `linkType: soft` (workspace links are skipped) and
+ *   `dependenciesMeta:` blocks (which can mark deps optional). The parser is
+ *   forgiving — unknown lines are ignored, missing versions skip the entry. It
+ *   never throws. Source material (in lock-step order, newest → oldest):
+ *
+ *   1. **C++ native parser** in socket-btm/node-smol-builder:
+ *      additions/source-patched/src/socketsecurity/manifest/parser_yarn.cc Same
+ *      algorithm, same fixes — keep the two in lock-step.
+ *   2. **socket-sdxgen** — algorithm oracle:
+ *      socket-sdxgen/src/parsers/yarn-classic/yarn-lock-v1.mts
+ *      socket-sdxgen/src/parsers/yarn-berry/yarn-lock-v2.mts sdxgen uses
+ *      `@yarnpkg/parsers.parseSyml`; this TS port + the C++ port both use a
+ *      line walker (yarn's syml-as-it-uses-it is a strict subset).
+ *   3. **cdxgen** (pinned v11.11.0):
+ *      https://github.com/CycloneDX/cdxgen/blob/v11.11.0/lib/parsers/js.js
+ *      (parseYarnLock)
+ *   4. **yarn format docs**: classic (v1):
+ *      https://github.com/yarnpkg/yarn/blob/master/src/lockfile/parse.js berry
+ *      (v2+): https://yarnpkg.com/configuration/yarnrc#lockfileVersion
+ *      protocols: https://yarnpkg.com/protocol/ Bug fixes implemented here (and
+ *      in the native parser):
+ *
+ *   - Fix 4 `dependenciesMeta` block consume-only. Earlier impls were doing two
+ *     wrong things at once: (a) synthesizing phantom PackageRefs for children,
+ *     and (b) flipping the PARENT's `isOptional` based on any child's
+ *     `optional: true` flag — inverted semantics. The fix consumes the block
+ *     for position only; metadata flags refer to a child's relationship from
+ *     the parent's view, never the parent itself. Regression fixtures live
+ *     under socket-btm's test/fixtures/ sdxgen-bug-regressions/ — every shipped
+ *     fix has a matching fixture directory there.
+ */
+import type { ParsedLockfile } from '../../../manifest/types';
+export interface YarnEntryState {
+    name: string;
+    version: string | undefined;
+    resolved: string | undefined;
+    integrity: string | undefined;
+    checksum: string | undefined;
+    dependencies: string[];
+    isOptional: boolean;
+    linkType: string | undefined;
+}
+type PackageIndex = Record<string, number | number[]>;
+export declare function addToYarnIndex(packageIndex: PackageIndex, name: string, idx: number): void;
+export declare function consumeDependenciesMeta(content: string, startPos: number, _entry: YarnEntryState): number;
+export declare function consumeDependencyList(content: string, startPos: number, deps: string[]): number;
+export declare function consumeEntryProperties(content: string, startPos: number, entry: YarnEntryState): number;
+export declare function jsParseYarnLock(content: string): ParsedLockfile;
+export declare function newEntry(name: string): YarnEntryState;
+export declare function skipIndentedBlock(content: string, startPos: number): number;
+export declare function stripQuotes(s: string): string;
+export declare function valueAfterKey(line: string, keyLen: number): string;
+export declare const parseYarnLock: (content: string) => ParsedLockfile;
+export {};