@socketsecurity/lib 6.0.2 → 6.0.4

package/dist/smol/purl.js

@@ -1,42 +1,39 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var purl_exports = {};
-__export(purl_exports, {
-  getSmolPurl: () => getSmolPurl
-});
-module.exports = __toCommonJS(purl_exports);
-var import_module = require("../node/module");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_node_module = require('../node/module.js');
+
+//#region src/smol/purl.ts
+/**
+* @file Lazy-loader for socket-btm's `node:smol-purl` binding. `node:smol-purl`
+*   is a C++-accelerated PURL (Package URL) parser exposed by socket-btm's smol
+*   Node binary. It parses, builds, and validates PURL strings using
+*   primordial-cached string ops, with a 10 000-entry result cache. Returns
+*   `undefined` on stock Node + non-Node runtimes. Result is cached across
+*   calls. Callers fall back to the JS `@socketregistry/packageurl-js` import
+*   on the undefined path.
+*
+* @internal — used by `src/packages/operations.ts` to resolve the
+*   `pkg:npm/<name>` parse on `resolveRegistryPackageName`. Most
+*   callers should keep using `PackageURL` from
+*   `external/@socketregistry/packageurl-js` directly; this loader
+*   only matters where the hot path warrants the native acceleration.
+*/
 let _smolPurl;
 let _smolPurlProbed = false;
-// @__NO_SIDE_EFFECTS__
+/**
+* Returns `node:smol-purl` when running on the smol Node binary, otherwise
+* `undefined`. Result is cached across calls.
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function getSmolPurl() {
-  if (!_smolPurlProbed) {
-    _smolPurlProbed = true;
-    if ((0, import_module.isNodeBuiltin)("node:smol-purl")) {
-      _smolPurl = require("node:smol-purl");
-    }
-  }
-  return _smolPurl;
+	if (!_smolPurlProbed) {
+		_smolPurlProbed = true;
+		/* c8 ignore start - smol Node binary only. */
+		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-purl")) _smolPurl = require("node:smol-purl");
+	}
+	return _smolPurl;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  getSmolPurl
-});
+
+//#endregion
+exports.getSmolPurl = getSmolPurl;

package/dist/smol/versions.js

@@ -1,42 +1,36 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var versions_exports = {};
-__export(versions_exports, {
-  getSmolVersions: () => getSmolVersions
-});
-module.exports = __toCommonJS(versions_exports);
-var import_module = require("../node/module");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_node_module = require('../node/module.js');
+
+//#region src/smol/versions.ts
+/**
+* @file Lazy-loader for socket-btm's `node:smol-versions`. `node:smol-versions`
+*   is the multi-ecosystem version helper exposed by socket-btm's smol Node
+*   binary. It supports npm/maven/pypi/nuget/ gem version comparison + range
+*   satisfies with internal C++ acceleration on the npm hot path. Returns
+*   `undefined` on stock Node + non-Node runtimes. Result is cached across
+*   calls.
+*
+* @internal — used by `src/versions.ts` to resolve smol-aware version
+*   ops. Most callers should use the standard `versions` exports,
+*   which already route through this when smol is present.
+*/
 let _smolVersions;
 let _smolVersionsProbed = false;
-// @__NO_SIDE_EFFECTS__
+/**
+* Returns `node:smol-versions` when running on the smol Node binary, otherwise
+* `undefined`. Result is cached across calls.
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function getSmolVersions() {
-  if (!_smolVersionsProbed) {
-    _smolVersionsProbed = true;
-    if ((0, import_module.isNodeBuiltin)("node:smol-versions")) {
-      _smolVersions = require("node:smol-versions");
-    }
-  }
-  return _smolVersions;
+	if (!_smolVersionsProbed) {
+		_smolVersionsProbed = true;
+		/* c8 ignore start - smol Node binary only. */
+		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-versions")) _smolVersions = require("node:smol-versions");
+	}
+	return _smolVersions;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  getSmolVersions
-});
+
+//#endregion
+exports.getSmolVersions = getSmolVersions;

package/dist/smol/vfs.js

@@ -1,43 +1,51 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var vfs_exports = {};
-__export(vfs_exports, {
-  getSmolVfs: () => getSmolVfs
-});
-module.exports = __toCommonJS(vfs_exports);
-var import_module = require("../node/module");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_node_module = require('../node/module.js');
+
+//#region src/smol/vfs.ts
+/**
+* @file Lazy-loader for socket-btm's `node:smol-vfs`. Targets the
+*   **post-alignment** shape that mirrors upstream `node:vfs` (PR
+*   nodejs/node#61478). socket-btm's runtime is being patched in lockstep with
+*   this lib to match. Alignment summary vs. upstream `node:vfs`:
+*
+*   - `node:smol-vfs` exports a single `getSmolVfs()` accessor that returns a
+*     `SmolVirtualFileSystem` instance pre-mounted at the SEA prefix (default
+*     `/sea`).
+*   - `vfs.mounted` (boolean), `vfs.mountPoint` (string | null) — instance
+*     getters matching upstream.
+*   - `vfs.extract(suffix)` — socket-btm-specific addition that returns a real-fs
+*     path to an embedded asset. Upstream `node:vfs` doesn't have this — you'd
+*     work via the patched `fs` namespace after `mount()`. We need real-fs
+*     paths to spawn binaries (Bazel, SBT launcher, JRE's `bin/java`), so btm
+*     carries this as a non-upstream extension.
+*   - No `NODE_VFS_PREFIX` env-var override anywhere; prefix is set at build time
+*     and immutable at runtime. Returns `undefined` on stock Node, non-Node
+*     runtimes, and on socket-btm binaries that haven't yet shipped the aligned
+*     binding. Result is cached across calls. Callers fall back to PATH lookup
+*     (or out-of-band downloads in socket-cli's case) when this is missing.
+*/
 let _smolVfs;
 let _smolVfsProbed = false;
-// @__NO_SIDE_EFFECTS__
+/**
+* Returns the pre-mounted SEA `SmolVirtualFileSystem` instance when running on
+* a smol Node binary with an embedded SEA payload; otherwise `undefined`.
+* Result is cached across calls.
+*
+* This is the only accessor external-tools resolvers need — the `node:smol-vfs`
+* binding-module loader is collapsed into this function so callers don't deal
+* with two indirection levels.
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function getSmolVfs() {
-  if (!_smolVfsProbed) {
-    _smolVfsProbed = true;
-    if ((0, import_module.isNodeBuiltin)("node:smol-vfs")) {
-      const binding = require("node:smol-vfs");
-      _smolVfs = binding.getSmolVfs();
-    }
-  }
-  return _smolVfs;
+	if (!_smolVfsProbed) {
+		_smolVfsProbed = true;
+		/* c8 ignore start - smol Node binary only. */
+		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-vfs")) _smolVfs = require("node:smol-vfs").getSmolVfs();
+	}
+	return _smolVfs;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  getSmolVfs
-});
+
+//#endregion
+exports.getSmolVfs = getSmolVfs;

package/dist/sorts/_internal.js

@@ -1,47 +1,21 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var internal_exports = {};
-__export(internal_exports, {
-  getFastSort: () => getFastSort,
-  getSemver: () => getSemver
-});
-module.exports = __toCommonJS(internal_exports);
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+//#region src/sorts/_internal.ts
 let _fastSort;
 let _semver;
-// @__NO_SIDE_EFFECTS__
+/* @__NO_SIDE_EFFECTS__ */
 function getFastSort() {
-  if (_fastSort === void 0) {
-    _fastSort = require("../external/fast-sort.js");
-  }
-  return _fastSort;
+	if (_fastSort === void 0) _fastSort = /* @__PURE__ */ require("../external/fast-sort.js");
+	return _fastSort;
 }
-// @__NO_SIDE_EFFECTS__
+/* @__NO_SIDE_EFFECTS__ */
 function getSemver() {
-  if (_semver === void 0) {
-    _semver = require("../external/semver.js");
-  }
-  return _semver;
+	if (_semver === void 0) _semver = /* @__PURE__ */ require("../external/semver.js");
+	return _semver;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  getFastSort,
-  getSemver
-});
+
+//#endregion
+exports.getFastSort = getFastSort;
+exports.getSemver = getSemver;

package/dist/sorts/natural.js

@@ -1,74 +1,67 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var natural_exports = {};
-__export(natural_exports, {
-  localeCompare: () => localeCompare,
-  naturalCompare: () => naturalCompare,
-  naturalSorter: () => naturalSorter
-});
-module.exports = __toCommonJS(natural_exports);
-var import_internal = require("./_internal");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_sorts__internal = require('./_internal.js');
+
+//#region src/sorts/natural.ts
+/**
+* @file Locale-aware + numeric-aware comparison via `Intl.Collator`, plus the
+*   `naturalSorter` helper that wires the fast-sort engine to the natural
+*   comparator. Collator instances are lazy-created and cached because `new
+*   Intl.Collator()` is 10-14ms in Node — too expensive to call
+*   per-comparison.
+*/
 let _localeCompare;
 let _naturalCompare;
 let _naturalSorter;
-// @__NO_SIDE_EFFECTS__
+/**
+* Compare two strings using locale-aware comparison.
+*
+* @example
+*   ;```typescript
+*   localeCompare('a', 'b') // -1
+*   localeCompare('b', 'a') // 1
+*   localeCompare('a', 'a') // 0
+*   ```
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function localeCompare(x, y) {
-  if (_localeCompare === void 0) {
-    _localeCompare = new Intl.Collator().compare;
-  }
-  return _localeCompare(x, y);
+	if (_localeCompare === void 0) _localeCompare = new Intl.Collator().compare;
+	return _localeCompare(x, y);
 }
-// @__NO_SIDE_EFFECTS__
+/**
+* Compare two strings using natural sorting (numeric-aware, case-insensitive).
+*
+* @example
+*   ;```typescript
+*   naturalCompare('file2', 'file10') // negative (file2 before file10)
+*   naturalCompare('img10', 'img2') // positive (img10 after img2)
+*   ```
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function naturalCompare(x, y) {
-  if (_naturalCompare === void 0) {
-    _naturalCompare = new Intl.Collator(
-      // The `undefined` locale means it uses the default locale of the user's
-      // environment.
-      void 0,
-      {
-        // Enables numeric sorting: numbers in strings are compared by value,
-        // e.g. 'file2' comes before 'file10' as numbers and not 'file10' before
-        // 'file2' as plain text.
-        numeric: true,
-        // Makes the comparison case-insensitive and ignores diacritics, e.g.
-        // 'a', 'A', and 'á' are treated as equivalent.
-        sensitivity: "base"
-      }
-    ).compare;
-  }
-  return _naturalCompare(x, y);
+	if (_naturalCompare === void 0) _naturalCompare = new Intl.Collator(void 0, {
+		numeric: true,
+		sensitivity: "base"
+	}).compare;
+	return _naturalCompare(x, y);
 }
-// @__NO_SIDE_EFFECTS__
+/**
+* Sort an array using natural comparison.
+*
+* @example
+*   ;```typescript
+*   naturalSorter(['file10', 'file2', 'file1']).asc()
+*   // ['file1', 'file2', 'file10']
+*   ```
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function naturalSorter(arrayToSort) {
-  if (_naturalSorter === void 0) {
-    const fastSort = (0, import_internal.getFastSort)();
-    _naturalSorter = fastSort.createNewSortInstance({
-      comparer: naturalCompare
-    });
-  }
-  return _naturalSorter(arrayToSort);
+	if (_naturalSorter === void 0) _naturalSorter = (/* @__PURE__ */ require_sorts__internal.getFastSort()).createNewSortInstance({ comparer: naturalCompare });
+	return _naturalSorter(arrayToSort);
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  localeCompare,
-  naturalCompare,
-  naturalSorter
-});
+
+//#endregion
+exports.localeCompare = localeCompare;
+exports.naturalCompare = naturalCompare;
+exports.naturalSorter = naturalSorter;

package/dist/sorts/semver.js

@@ -1,46 +1,36 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var semver_exports = {};
-__export(semver_exports, {
-  compareSemver: () => compareSemver
-});
-module.exports = __toCommonJS(semver_exports);
-var import_internal = require("./_internal");
-// @__NO_SIDE_EFFECTS__
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_sorts__internal = require('./_internal.js');
+
+//#region src/sorts/semver.ts
+/**
+* @file Semver-aware string comparison. Wraps the vendored `external/semver`
+*   accessor so callers don't have to thread the lazy-load themselves.
+*/
+/**
+* Compare semantic versions.
+*
+* @example
+*   ;```typescript
+*   compareSemver('1.0.0', '2.0.0') // -1
+*   compareSemver('2.0.0', '1.0.0') // 1
+*   compareSemver('1.0.0', '1.0.0') // 0
+*   ```
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function compareSemver(a, b) {
-  const semver = (0, import_internal.getSemver)();
-  const validA = semver.valid(a);
-  const validB = semver.valid(b);
-  if (!validA && !validB) {
-    return 0;
-  }
-  if (!validA) {
-    return -1;
-  }
-  if (!validB) {
-    return 1;
-  }
-  return semver.compare(a, b);
+	/* c8 ignore start */
+	const semver = /* @__PURE__ */ require_sorts__internal.getSemver();
+	const validA = semver.valid(a);
+	/* c8 ignore stop */
+	const validB = semver.valid(b);
+	if (!validA && !validB) return 0;
+	if (!validA) return -1;
+	if (!validB) return 1;
+	/* c8 ignore next - External semver call */
+	return semver.compare(a, b);
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  compareSemver
-});
+
+//#endregion
+exports.compareSemver = compareSemver;

package/dist/sorts/strings.js

@@ -1,33 +1,27 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var strings_exports = {};
-__export(strings_exports, {
-  compareStr: () => compareStr
-});
-module.exports = __toCommonJS(strings_exports);
-// @__NO_SIDE_EFFECTS__
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+//#region src/sorts/strings.ts
+/**
+* @file Plain string comparison. The straight-ASCII three-way compare, no
+*   locale/numeric awareness — use `localeCompare` / `naturalCompare` from the
+*   sibling files when those matter.
+*/
+/**
+* Simple string comparison.
+*
+* @example
+*   ;```typescript
+*   compareStr('a', 'b') // -1
+*   compareStr('b', 'a') // 1
+*   compareStr('a', 'a') // 0
+*   ```
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function compareStr(a, b) {
-  return a < b ? -1 : a > b ? 1 : 0;
+	return a < b ? -1 : a > b ? 1 : 0;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  compareStr
-});
+
+//#endregion
+exports.compareStr = compareStr;

package/dist/sorts/types.js

@@ -1,18 +1,2 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var types_exports = {};
-module.exports = __toCommonJS(types_exports);
+/* Socket Lib - Built with rolldown */