@socketsecurity/lib 6.0.2 → 6.0.4

package/dist/packages/operations.js

@@ -1,275 +1,304 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var operations_exports = {};
-__export(operations_exports, {
-  extractPackage: () => extractPackage,
-  findPackageExtensions: () => findPackageExtensions,
-  getReleaseTag: () => getReleaseTag,
-  packPackage: () => packPackage,
-  pkgNameToSlug: () => pkgNameToSlug,
-  readPackageJson: () => readPackageJson,
-  readPackageJsonSync: () => readPackageJsonSync,
-  resolveGitHubTgzUrl: () => resolveGitHubTgzUrl,
-  resolvePackageName: () => resolvePackageName,
-  resolveRegistryPackageName: () => resolveRegistryPackageName
-});
-module.exports = __toCommonJS(operations_exports);
-var import_packages = require("../constants/packages");
-var import_abort = require("../process/abort");
-var import_socket = require("../constants/socket");
-var import_cacache = __toESM(require("../external/cacache"));
-var import_libnpmpack = __toESM(require("../external/libnpmpack"));
-var import_make_fetch_happen = __toESM(require("../external/make-fetch-happen"));
-var import_npm_package_arg = __toESM(require("../external/npm-package-arg"));
-var import_packageurl_js = require("../external/@socketregistry/packageurl-js");
-var import_pacote = __toESM(require("../external/pacote"));
-var semver = __toESM(require("../external/semver"));
-var import_purl = require("../smol/purl");
-var import_read_json = require("../fs/read-json");
-var import_mutate = require("../objects/mutate");
-var import_predicates = require("../objects/predicates");
-var import_normalize = require("./normalize");
-var import_packages2 = require("../paths/packages");
-var import_specs = require("./specs");
-var import_edit = require("./edit");
-var import_string = require("../primordials/string");
-const abortSignal = (0, import_abort.getAbortSignal)();
-const packageExtensions = (0, import_packages.getPackageExtensions)();
-const packumentCache = (0, import_packages.getPackumentCache)();
-const pacoteCachePath = (0, import_packages.getPacoteCachePath)();
-const fetcher = import_make_fetch_happen.default.defaults({
-  cachePath: pacoteCachePath,
-  // Prefer-offline: Staleness checks for cached data will be bypassed, but
-  // missing data will be requested from the server.
-  // https://github.com/npm/make-fetch-happen?tab=readme-ov-file#--optscache
-  cache: "force-cache"
-});
-// @__NO_SIDE_EFFECTS__
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_primordials_string = require('../primordials/string.js');
+const require_fs_read_json = require('../fs/read-json.js');
+const require_process_abort = require('../process/abort.js');
+const require_objects_predicates = require('../objects/predicates.js');
+const require_objects_mutate = require('../objects/mutate.js');
+const require_constants_socket = require('../constants/socket.js');
+const require_constants_packages = require('../constants/packages.js');
+const require_smol_purl = require('../smol/purl.js');
+const require_packages_normalize = require('./normalize.js');
+const require_paths_packages = require('../paths/packages.js');
+const require_packages_specs = require('./specs.js');
+const require_packages_edit = require('./edit.js');
+let src_external_cacache = require("../external/cacache");
+src_external_cacache = require_runtime.__toESM(src_external_cacache);
+let src_external_semver = require("../external/semver");
+src_external_semver = require_runtime.__toESM(src_external_semver);
+let src_external_pacote = require("../external/pacote");
+src_external_pacote = require_runtime.__toESM(src_external_pacote);
+let src_external_libnpmpack = require("../external/libnpmpack");
+src_external_libnpmpack = require_runtime.__toESM(src_external_libnpmpack);
+let src_external_make_fetch_happen = require("../external/make-fetch-happen");
+src_external_make_fetch_happen = require_runtime.__toESM(src_external_make_fetch_happen);
+let src_external_npm_package_arg = require("../external/npm-package-arg");
+src_external_npm_package_arg = require_runtime.__toESM(src_external_npm_package_arg);
+let src_external__socketregistry_packageurl_js = require("../external/@socketregistry/packageurl-js");
+
+//#region src/packages/operations.ts
+/**
+* @file Package operations including extraction, packing, and I/O.
+*/
+const abortSignal = require_process_abort.getAbortSignal();
+const packageExtensions = /* @__PURE__ */ require_constants_packages.getPackageExtensions();
+const packumentCache = /* @__PURE__ */ require_constants_packages.getPackumentCache();
+const pacoteCachePath = /* @__PURE__ */ require_constants_packages.getPacoteCachePath();
+let _fetcher;
+/**
+* Extract a package to a destination directory.
+*
+* @example
+*   ;```typescript
+*   await extractPackage('lodash@4.17.21', { dest: '/tmp/lodash' })
+*   ```
+*/
+/* @__NO_SIDE_EFFECTS__ */
 async function extractPackage(pkgNameOrId, options, callback) {
-  let actualCallback = callback;
-  let actualOptions = options;
-  if (arguments.length === 2 && typeof options === "function") {
-    actualCallback = options;
-    actualOptions = void 0;
-  }
-  const { dest, tmpPrefix, ...extractOptions_ } = {
-    __proto__: null,
-    ...actualOptions
-  };
-  const extractOptions = {
-    packumentCache,
-    preferOffline: true,
-    ...extractOptions_
-  };
-  if (typeof dest === "string") {
-    await import_pacote.default.extract(pkgNameOrId, dest, extractOptions);
-    if (typeof actualCallback === "function") {
-      await actualCallback(dest);
-    }
-  } else {
-    await import_cacache.default.tmp.withTmp(
-      pacoteCachePath,
-      { tmpPrefix },
-      async (tmpDirPath) => {
-        await import_pacote.default.extract(pkgNameOrId, tmpDirPath, extractOptions);
-        if (typeof actualCallback === "function") {
-          await actualCallback(tmpDirPath);
-        }
-      }
-    );
-  }
+	let actualCallback = callback;
+	let actualOptions = options;
+	if (arguments.length === 2 && typeof options === "function") {
+		actualCallback = options;
+		actualOptions = void 0;
+	}
+	const { dest, tmpPrefix, ...extractOptions_ } = {
+		__proto__: null,
+		...actualOptions
+	};
+	const extractOptions = {
+		packumentCache,
+		preferOffline: true,
+		...extractOptions_
+	};
+	/* c8 ignore start - External package registry extraction */
+	if (typeof dest === "string") {
+		await src_external_pacote.default.extract(pkgNameOrId, dest, extractOptions);
+		if (typeof actualCallback === "function") await actualCallback(dest);
+	} else await src_external_cacache.default.tmp.withTmp(pacoteCachePath, { tmpPrefix }, async (tmpDirPath) => {
+		await src_external_pacote.default.extract(pkgNameOrId, tmpDirPath, extractOptions);
+		if (typeof actualCallback === "function") await actualCallback(tmpDirPath);
+	});
+	/* c8 ignore stop */
 }
-// @__NO_SIDE_EFFECTS__
+/**
+* Find package extensions for a given package.
+*
+* @example
+*   ;```typescript
+*   const extensions = findPackageExtensions('my-pkg', '1.0.0')
+*   ```
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function findPackageExtensions(pkgName, pkgVer) {
-  let result;
-  for (const entry of packageExtensions) {
-    const selector = String(entry[0]);
-    const ext = entry[1];
-    const lastAtSignIndex = selector.lastIndexOf("@");
-    const name = selector.slice(0, lastAtSignIndex);
-    if (pkgName === name) {
-      const range = selector.slice(lastAtSignIndex + 1);
-      if (semver.satisfies(pkgVer, range)) {
-        if (result === void 0) {
-          result = {};
-        }
-        if (typeof ext === "object" && ext !== null) {
-          (0, import_mutate.merge)(result, ext);
-        }
-      }
-    }
-  }
-  return result;
+	let result;
+	for (const entry of packageExtensions) {
+		const selector = String(entry[0]);
+		const ext = entry[1];
+		const lastAtSignIndex = selector.lastIndexOf("@");
+		if (pkgName === selector.slice(0, lastAtSignIndex)) {
+			const range = selector.slice(lastAtSignIndex + 1);
+			if (src_external_semver.satisfies(pkgVer, range)) {
+				if (result === void 0) result = {};
+				if (typeof ext === "object" && ext !== null) /* @__PURE__ */ require_objects_mutate.merge(result, ext);
+			}
+		}
+	}
+	return result;
+}
+function getFetcher() {
+	if (_fetcher === void 0) _fetcher = src_external_make_fetch_happen.default.defaults({
+		cachePath: pacoteCachePath,
+		cache: "force-cache"
+	});
+	return _fetcher;
 }
-// @__NO_SIDE_EFFECTS__
+/**
+* Get the release tag for a version.
+*
+* @example
+*   ;```typescript
+*   getReleaseTag('lodash@latest') // 'latest'
+*   getReleaseTag('@scope/pkg@beta') // 'beta'
+*   getReleaseTag('lodash') // ''
+*   ```
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function getReleaseTag(spec) {
-  if (!spec) {
-    return "";
-  }
-  let atIndex = -1;
-  if ((0, import_string.StringPrototypeStartsWith)(spec, "@")) {
-    atIndex = (0, import_string.StringPrototypeIndexOf)(spec, "@", 1);
-  } else {
-    atIndex = (0, import_string.StringPrototypeIndexOf)(spec, "@");
-  }
-  if (atIndex !== -1) {
-    return (0, import_string.StringPrototypeSlice)(spec, atIndex + 1);
-  }
-  return "";
+	if (!spec) return "";
+	let atIndex = -1;
+	if (require_primordials_string.StringPrototypeStartsWith(spec, "@")) atIndex = require_primordials_string.StringPrototypeIndexOf(spec, "@", 1);
+	else atIndex = require_primordials_string.StringPrototypeIndexOf(spec, "@");
+	if (atIndex !== -1) return require_primordials_string.StringPrototypeSlice(spec, atIndex + 1);
+	return "";
 }
-// @__NO_SIDE_EFFECTS__
+/**
+* Pack a package tarball using pacote.
+*
+* @example
+*   ;```typescript
+*   const tarball = await packPackage('lodash@4.17.21')
+*   ```
+*/
+/* @__NO_SIDE_EFFECTS__ */
 async function packPackage(spec, options) {
-  return await (0, import_libnpmpack.default)(spec, {
-    __proto__: null,
-    signal: abortSignal,
-    ...options,
-    packumentCache,
-    preferOffline: true
-  });
+	/* c8 ignore start - External package registry packing */
+	return await (0, src_external_libnpmpack.default)(spec, {
+		__proto__: null,
+		signal: abortSignal,
+		...options,
+		packumentCache,
+		preferOffline: true
+	});
+	/* c8 ignore stop */
 }
-// @__NO_SIDE_EFFECTS__
+/**
+* Slugify an npm package name into a hyphenated identifier suitable for
+* User-Agent tokens, log namespaces, file paths, and other contexts where `@`
+* and `/` are not welcome.
+*
+* @example
+*   ;```typescript
+*   pkgNameToSlug('@socketsecurity/lib') // 'socketsecurity-lib'
+*   pkgNameToSlug('@cyclonedx/cdxgen') // 'cyclonedx-cdxgen'
+*   pkgNameToSlug('lodash') // 'lodash'
+*   ```
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function pkgNameToSlug(pkgName) {
-  return pkgName.charCodeAt(0) === 64 ? `${pkgName.slice(1).replace("/", "-")}` : pkgName;
+	return pkgName.charCodeAt(0) === 64 ? `${pkgName.slice(1).replace("/", "-")}` : pkgName;
 }
-// @__NO_SIDE_EFFECTS__
+/**
+* Read and parse a package.json file asynchronously.
+*
+* @example
+*   ;```typescript
+*   const pkgJson = await readPackageJson('/tmp/my-project')
+*   console.log(pkgJson?.name)
+*   ```
+*/
+/* @__NO_SIDE_EFFECTS__ */
 async function readPackageJson(filepath, options) {
-  const { editable, normalize, throws, ...normalizeOptions } = {
-    __proto__: null,
-    ...options
-  };
-  const pkgJson = await (0, import_read_json.readJson)((0, import_packages2.resolvePackageJsonPath)(filepath), {
-    throws
-  });
-  if (pkgJson) {
-    if (editable) {
-      return await (0, import_edit.toEditablePackageJson)(pkgJson, {
-        path: filepath,
-        normalize,
-        ...normalizeOptions
-      });
-    }
-    return normalize ? (0, import_normalize.normalizePackageJson)(pkgJson, normalizeOptions) : pkgJson;
-  }
-  return void 0;
+	const { editable, normalize, throws, ...normalizeOptions } = {
+		__proto__: null,
+		...options
+	};
+	const pkgJson = await /* @__PURE__ */ require_fs_read_json.readJson(/* @__PURE__ */ require_paths_packages.resolvePackageJsonPath(filepath), { throws });
+	if (pkgJson) {
+		if (editable) return await /* @__PURE__ */ require_packages_edit.toEditablePackageJson(pkgJson, {
+			path: filepath,
+			normalize,
+			...normalizeOptions
+		});
+		return normalize ? /* @__PURE__ */ require_packages_normalize.normalizePackageJson(pkgJson, normalizeOptions) : pkgJson;
+	}
 }
-// @__NO_SIDE_EFFECTS__
+/**
+* Read and parse package.json from a file path synchronously.
+*
+* @example
+*   ;```typescript
+*   const pkgJson = readPackageJsonSync('/tmp/my-project')
+*   console.log(pkgJson?.name)
+*   ```
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function readPackageJsonSync(filepath, options) {
-  const { editable, normalize, throws, ...normalizeOptions } = {
-    __proto__: null,
-    ...options
-  };
-  const pkgJson = (0, import_read_json.readJsonSync)((0, import_packages2.resolvePackageJsonPath)(filepath), { throws });
-  if (pkgJson) {
-    if (editable) {
-      return (0, import_edit.toEditablePackageJsonSync)(pkgJson, {
-        path: filepath,
-        normalize,
-        ...normalizeOptions
-      });
-    }
-    return normalize ? (0, import_normalize.normalizePackageJson)(pkgJson, normalizeOptions) : pkgJson;
-  }
-  return void 0;
+	const { editable, normalize, throws, ...normalizeOptions } = {
+		__proto__: null,
+		...options
+	};
+	const pkgJson = /* @__PURE__ */ require_fs_read_json.readJsonSync(/* @__PURE__ */ require_paths_packages.resolvePackageJsonPath(filepath), { throws });
+	if (pkgJson) {
+		if (editable) return /* @__PURE__ */ require_packages_edit.toEditablePackageJsonSync(pkgJson, {
+			path: filepath,
+			normalize,
+			...normalizeOptions
+		});
+		return normalize ? /* @__PURE__ */ require_packages_normalize.normalizePackageJson(pkgJson, normalizeOptions) : pkgJson;
+	}
 }
-// @__NO_SIDE_EFFECTS__
+/**
+* Resolve GitHub tarball URL for a package specifier.
+*
+* @example
+*   ;```typescript
+*   const url = await resolveGitHubTgzUrl('my-pkg@1.0.0', '/tmp/my-project')
+*   ```
+*/
+/* @__NO_SIDE_EFFECTS__ */
 async function resolveGitHubTgzUrl(pkgNameOrId, where) {
-  const whereIsPkgJson = (0, import_predicates.isPlainObject)(where);
-  const pkgJson = whereIsPkgJson ? where : await /* @__PURE__ */ readPackageJson(where, { normalize: true });
-  if (!pkgJson) {
-    return "";
-  }
-  const { version } = pkgJson;
-  const parsedSpec = (0, import_npm_package_arg.default)(
-    pkgNameOrId,
-    whereIsPkgJson ? void 0 : where
-  );
-  const isTarballUrl = (0, import_specs.isGitHubTgzSpec)(parsedSpec);
-  if (isTarballUrl) {
-    return parsedSpec.saveSpec || "";
-  }
-  const isGitHubUrl = (0, import_specs.isGitHubUrlSpec)(parsedSpec);
-  const repository = pkgJson.repository;
-  const { project, user } = (isGitHubUrl ? parsedSpec.hosted : (0, import_specs.getRepoUrlDetails)(repository?.url)) || { project: "", user: "" };
-  if (user && project) {
-    let apiUrl = "";
-    if (isGitHubUrl) {
-      apiUrl = (0, import_specs.gitHubTagRefUrl)(user, project, parsedSpec.gitCommittish || "");
-    } else {
-      const versionStr = version;
-      apiUrl = (0, import_specs.gitHubTagRefUrl)(user, project, `v${versionStr}`);
-      if (!(await fetcher(apiUrl, { method: "head" })).ok) {
-        apiUrl = (0, import_specs.gitHubTagRefUrl)(user, project, versionStr);
-        if (!(await fetcher(apiUrl, { method: "head" })).ok) {
-          apiUrl = "";
-        }
-      }
-    }
-    if (apiUrl) {
-      const resp = await fetcher(apiUrl);
-      let json;
-      try {
-        json = await resp.json();
-      } catch {
-        json = void 0;
-      }
-      const sha = json?.object?.sha;
-      if (sha) {
-        return (0, import_specs.gitHubTgzUrl)(user, project, sha);
-      }
-    }
-  }
-  return "";
+	const whereIsPkgJson = /* @__PURE__ */ require_objects_predicates.isPlainObject(where);
+	const pkgJson = whereIsPkgJson ? where : await /* @__PURE__ */ readPackageJson(where, { normalize: true });
+	if (!pkgJson) return "";
+	const { version } = pkgJson;
+	const parsedSpec = (0, src_external_npm_package_arg.default)(pkgNameOrId, whereIsPkgJson ? void 0 : where);
+	if (/* @__PURE__ */ require_packages_specs.isGitHubTgzSpec(parsedSpec)) return parsedSpec.saveSpec || "";
+	const isGitHubUrl = /* @__PURE__ */ require_packages_specs.isGitHubUrlSpec(parsedSpec);
+	const repository = pkgJson.repository;
+	const { project, user } = (isGitHubUrl ? parsedSpec.hosted : /* @__PURE__ */ require_packages_specs.getRepoUrlDetails(repository?.url)) || {
+		project: "",
+		user: ""
+	};
+	/* c8 ignore start - External GitHub API calls */
+	if (user && project) {
+		const fetcher = getFetcher();
+		let apiUrl = "";
+		if (isGitHubUrl) apiUrl = /* @__PURE__ */ require_packages_specs.gitHubTagRefUrl(user, project, parsedSpec.gitCommittish || "");
+		else {
+			const versionStr = version;
+			apiUrl = /* @__PURE__ */ require_packages_specs.gitHubTagRefUrl(user, project, `v${versionStr}`);
+			if (!(await fetcher(apiUrl, { method: "head" })).ok) {
+				apiUrl = /* @__PURE__ */ require_packages_specs.gitHubTagRefUrl(user, project, versionStr);
+				if (!(await fetcher(apiUrl, { method: "head" })).ok) apiUrl = "";
+			}
+		}
+		if (apiUrl) {
+			const resp = await fetcher(apiUrl);
+			let json;
+			try {
+				json = await resp.json();
+			} catch {
+				json = void 0;
+			}
+			const sha = json?.object?.sha;
+			if (sha) return /* @__PURE__ */ require_packages_specs.gitHubTgzUrl(user, project, sha);
+		}
+	}
+	/* c8 ignore stop */
+	return "";
 }
-// @__NO_SIDE_EFFECTS__
+/**
+* Resolve full package name from a PURL object with custom delimiter.
+*
+* @example
+*   ;```typescript
+*   resolvePackageName({ name: 'core', namespace: '@babel' }) // '@babel/core'
+*   resolvePackageName({ name: 'lodash' }) // 'lodash'
+*   ```
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function resolvePackageName(purlObj, delimiter = "/") {
-  const { name, namespace } = purlObj;
-  return `${namespace ? `${namespace}${delimiter}` : ""}${name}`;
+	const { name, namespace } = purlObj;
+	return `${namespace ? `${namespace}${delimiter}` : ""}${name}`;
 }
-// @__NO_SIDE_EFFECTS__
+/**
+* Convert npm package name to Socket registry format with delimiter.
+*
+* @example
+*   ;```typescript
+*   resolveRegistryPackageName('@babel/core') // 'babel__core'
+*   resolveRegistryPackageName('lodash') // 'lodash'
+*   ```
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function resolveRegistryPackageName(pkgName) {
-  const input = `pkg:npm/${pkgName}`;
-  const smolPurl = (0, import_purl.getSmolPurl)();
-  const purlObj = smolPurl ? smolPurl.parse(input) : import_packageurl_js.PackageURL.fromString(input);
-  return purlObj.namespace ? `${purlObj.namespace.slice(1)}${import_socket.REGISTRY_SCOPE_DELIMITER}${purlObj.name}` : pkgName;
+	const input = `pkg:npm/${pkgName}`;
+	const smolPurl = /* @__PURE__ */ require_smol_purl.getSmolPurl();
+	const purlObj = smolPurl ? smolPurl.parse(input) : src_external__socketregistry_packageurl_js.PackageURL.fromString(input);
+	return purlObj.namespace ? `${purlObj.namespace.slice(1)}${"__"}${purlObj.name}` : pkgName;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  extractPackage,
-  findPackageExtensions,
-  getReleaseTag,
-  packPackage,
-  pkgNameToSlug,
-  readPackageJson,
-  readPackageJsonSync,
-  resolveGitHubTgzUrl,
-  resolvePackageName,
-  resolveRegistryPackageName
-});
+
+//#endregion
+exports.extractPackage = extractPackage;
+exports.findPackageExtensions = findPackageExtensions;
+exports.getFetcher = getFetcher;
+exports.getReleaseTag = getReleaseTag;
+exports.packPackage = packPackage;
+exports.pkgNameToSlug = pkgNameToSlug;
+exports.readPackageJson = readPackageJson;
+exports.readPackageJsonSync = readPackageJsonSync;
+exports.resolveGitHubTgzUrl = resolveGitHubTgzUrl;
+exports.resolvePackageName = resolvePackageName;
+exports.resolveRegistryPackageName = resolveRegistryPackageName;