@socketsecurity/lib 6.0.3 → 6.0.5

package/dist/eco/manifest/parse-manifest.js

@@ -1,48 +1,31 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var parse_manifest_exports = {};
-__export(parse_manifest_exports, {
-  jsParseManifest: () => jsParseManifest,
-  parseManifest: () => parseManifest
-});
-module.exports = __toCommonJS(parse_manifest_exports);
-var import_manifest_error = require("./manifest-error");
-var import_parse_package_json = require("../npm/parse-package-json");
-var import_manifest = require("../../smol/manifest");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_smol_manifest = require('../../smol/manifest.js');
+const require_eco_manifest_manifest_error = require('./manifest-error.js');
+const require_eco_npm_parse_package_json = require('../npm/parse-package-json.js');
+
+//#region src/eco/manifest/parse-manifest.ts
+/**
+* @file `parseManifest(content, ecosystem)` — dispatches to the right
+*   per-ecosystem manifest parser. On socket-btm's smol Node binary this routes
+*   to `node:smol-manifest`'s native `parseManifest`; on stock Node it
+*   dispatches to `src/eco/<eco>/parse-manifest.ts` (or `parse-package-json.ts`
+*   for npm). Throws `ManifestError(ERR_UNSUPPORTED)` for ecosystems with no
+*   parser yet (e.g. `'composer'`).
+*/
 function jsParseManifest(content, ecosystem) {
-  switch (ecosystem) {
-    case "npm":
-      return (0, import_parse_package_json.parsePackageJson)(content);
-    default:
-      throw new import_manifest_error.ManifestError(
-        `Unsupported ecosystem: ${ecosystem}`,
-        "ERR_UNSUPPORTED"
-      );
-  }
+	switch (ecosystem) {
+		case "npm": return require_eco_npm_parse_package_json.parsePackageJson(content);
+		default: throw new require_eco_manifest_manifest_error.ManifestError(`Unsupported ecosystem: ${ecosystem}`, "ERR_UNSUPPORTED");
+	}
 }
-const _smol = (0, import_manifest.getSmolManifest)();
+const _smol = /* @__PURE__ */ require_smol_manifest.getSmolManifest();
+/* c8 ignore start - smol-fallback branch is smol Node binary only. */
 const smolParseManifest = _smol ? (content, ecosystem) => _smol.parseManifest(content, ecosystem) : void 0;
+/* c8 ignore stop */
 const parseManifest = smolParseManifest ?? jsParseManifest;
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  jsParseManifest,
-  parseManifest
-});
+
+//#endregion
+exports.jsParseManifest = jsParseManifest;
+exports.parseManifest = parseManifest;

package/dist/eco/manifest/parse.js

@@ -1,52 +1,31 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var parse_exports = {};
-__export(parse_exports, {
-  jsParse: () => jsParse,
-  parse: () => parse
-});
-module.exports = __toCommonJS(parse_exports);
-var import_manifest_error = require("./manifest-error");
-var import_detect_format = require("./detect-format");
-var import_parse_lockfile = require("./parse-lockfile");
-var import_parse_manifest = require("./parse-manifest");
-var import_manifest = require("../../smol/manifest");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_smol_manifest = require('../../smol/manifest.js');
+const require_eco_manifest_detect_format = require('./detect-format.js');
+const require_eco_manifest_manifest_error = require('./manifest-error.js');
+const require_eco_manifest_parse_lockfile = require('./parse-lockfile.js');
+const require_eco_manifest_parse_manifest = require('./parse-manifest.js');
+
+//#region src/eco/manifest/parse.ts
+/**
+* @file `parse(filename, content)` — auto-detects format from filename then
+*   dispatches to `parseManifest` or `parseLockfile`. Throws
+*   `ManifestError(ERR_UNKNOWN_FORMAT)` when the filename doesn't match any
+*   recognized manifest or lockfile basename.
+*/
 function jsParse(filename, content) {
-  const format = (0, import_detect_format.detectFormat)(filename);
-  if (!format) {
-    throw new import_manifest_error.ManifestError(
-      `Unknown file format: ${filename}`,
-      "ERR_UNKNOWN_FORMAT"
-    );
-  }
-  if (format.type === "manifest") {
-    return (0, import_parse_manifest.parseManifest)(content, format.ecosystem);
-  }
-  return (0, import_parse_lockfile.parseLockfile)(content, format.ecosystem, format.format);
+	const format = require_eco_manifest_detect_format.detectFormat(filename);
+	if (!format) throw new require_eco_manifest_manifest_error.ManifestError(`Unknown file format: ${filename}`, "ERR_UNKNOWN_FORMAT");
+	if (format.type === "manifest") return require_eco_manifest_parse_manifest.parseManifest(content, format.ecosystem);
+	return require_eco_manifest_parse_lockfile.parseLockfile(content, format.ecosystem, format.format);
 }
-const _smol = (0, import_manifest.getSmolManifest)();
+const _smol = /* @__PURE__ */ require_smol_manifest.getSmolManifest();
+/* c8 ignore start - smol-fallback branch is smol Node binary only. */
 const smolParse = _smol ? (filename, content) => _smol.parse(filename, content) : void 0;
+/* c8 ignore stop */
 const parse = smolParse ?? jsParse;
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  jsParse,
-  parse
-});
+
+//#endregion
+exports.jsParse = jsParse;
+exports.parse = parse;

package/dist/eco/manifest/types.js

@@ -1,18 +1,2 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var types_exports = {};
-module.exports = __toCommonJS(types_exports);
+/* Socket Lib - Built with rolldown */

package/dist/eco/npm/bun/exec.js

@@ -1,35 +1,26 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var exec_exports = {};
-__export(exec_exports, {
-  execBun: () => execBun
-});
-module.exports = __toCommonJS(exec_exports);
-var import_error = require("../../../primordials/error");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_error = require('../../../primordials/error.js');
+
+//#region src/eco/npm/bun/exec.ts
+/**
+* @file Bun tool surface. Stub — execBun is not yet implemented in socket-lib.
+*   The dir exists so downstream code (e.g. socket-cli's optimize command) can
+*   import from a stable canonical path; populate when first concrete need
+*   arrives. Bun lockfile is `bun.lock` (text, modern) or `bun.lockb` (binary,
+*   legacy). Min version supported by socket-cli is 1.1.39 (text-based
+*   lockfile). Reference: socket-sdxgen/src/parsers/bun/.
+*/
+/**
+* Execute Bun commands. Not yet implemented — throws.
+*
+* @internal When implementing, model after eco/npm/npm/exec.ts
+* (array-based args, Windows shell handling, debug-level filtering).
+*/
 function execBun(_args, _options) {
-  throw new import_error.ErrorCtor(
-    "execBun is not yet implemented in @socketsecurity/lib/eco/npm/bun. Track at task #57 (socket-lib 6.x: implement execBun)."
-  );
+	throw new require_primordials_error.ErrorCtor("execBun is not yet implemented in @socketsecurity/lib/eco/npm/bun. Track at task #57 (socket-lib 6.x: implement execBun).");
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  execBun
-});
+
+//#endregion
+exports.execBun = execBun;

package/dist/eco/npm/manifest-format.js

@@ -1,38 +1,24 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var manifest_format_exports = {};
-__export(manifest_format_exports, {
-  PACKAGE_JSON_FILENAME: () => PACKAGE_JSON_FILENAME,
-  PACKAGE_JSON_FORMAT: () => PACKAGE_JSON_FORMAT
-});
-module.exports = __toCommonJS(manifest_format_exports);
-var import_object = require("../../primordials/object");
-const PACKAGE_JSON_FORMAT = (0, import_object.ObjectFreeze)({
-  __proto__: null,
-  ecosystem: "npm",
-  type: "manifest"
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_object = require('../../primordials/object.js');
+
+//#region src/eco/npm/manifest-format.ts
+/**
+* @file Format descriptor for `package.json` — the manifest shape shared across
+*   the entire npm-family ecosystem (npm, pnpm, yarn, bun, vlt). Per-PM
+*   lockfile descriptors live next to their parsers under
+*   `src/eco/npm/<pm>/lockfile-format.ts`. Returned by
+*   `src/eco/manifest/detect-format.ts` when a filename matches
+*   `package.json`.
+*/
+const PACKAGE_JSON_FORMAT = require_primordials_object.ObjectFreeze({
+	__proto__: null,
+	ecosystem: "npm",
+	type: "manifest"
 });
 const PACKAGE_JSON_FILENAME = "package.json";
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  PACKAGE_JSON_FILENAME,
-  PACKAGE_JSON_FORMAT
-});
+
+//#endregion
+exports.PACKAGE_JSON_FILENAME = PACKAGE_JSON_FILENAME;
+exports.PACKAGE_JSON_FORMAT = PACKAGE_JSON_FORMAT;

package/dist/eco/npm/npm/exec.js

@@ -1,64 +1,54 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var exec_exports = {};
-__export(exec_exports, {
-  execNpm: () => execNpm
-});
-module.exports = __toCommonJS(exec_exports);
-var import_agents = require("../../../constants/agents");
-var import_platform = require("../../../constants/platform");
-var import_namespace = require("../../../debug/namespace");
-var import_array = require("../../../primordials/array");
-var import_child = require("../../../process/spawn/child");
-var import_flags = require("./flags");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_constants_platform = require('../../../constants/platform.js');
+const require_primordials_array = require('../../../primordials/array.js');
+const require_debug_namespace = require('../../../debug/namespace.js');
+const require_process_spawn_child = require('../../../process/spawn/child.js');
+const require_constants_agents = require('../../../constants/agents.js');
+const require_eco_npm_npm_flags = require('./flags.js');
+
+//#region src/eco/npm/npm/exec.ts
+/**
+* @file Execute npm commands with optimized flags and security defaults.
+*   SECURITY: Array-based arguments prevent command injection. All elements in
+*   the args array are properly escaped by Node.js when passed to spawn().
+*   NOTE: We don't apply hardening flags to npm because:
+*
+*   1. npm is a trusted system tool installed with Node.js.
+*   2. npm requires full system access (filesystem, network, child processes).
+*   3. Hardening flags would prevent npm from functioning even with --allow-*
+*      grants.
+*   4. The permission model is intended for untrusted user code, not package
+*      managers.
+*/
+/**
+* Execute npm commands with optimized flags and settings.
+*
+* @example
+*   ;```typescript
+*   await execNpm(['install', '--save', 'lodash'])
+*   await execNpm(['run', 'build'], { cwd: '/tmp/project' })
+*   ```
+*/
 function execNpm(args, options) {
-  const useDebug = (0, import_namespace.isDebug)();
-  const terminatorPos = (0, import_array.ArrayPrototypeIndexOf)(args, "--");
-  const npmArgs = (terminatorPos === -1 ? args : (0, import_array.ArrayPrototypeSlice)(args, 0, terminatorPos)).filter(
-    (a) => !(0, import_flags.isNpmAuditFlag)(a) && !(0, import_flags.isNpmFundFlag)(a) && !(0, import_flags.isNpmProgressFlag)(a)
-  );
-  const otherArgs = terminatorPos === -1 ? [] : (0, import_array.ArrayPrototypeSlice)(args, terminatorPos);
-  const logLevelArgs = useDebug || npmArgs.some(import_flags.isNpmLoglevelFlag) ? [] : ["--loglevel", "warn"];
-  return (0, import_child.spawn)(
-    import_agents.NPM_BIN_PATH,
-    [
-      // Even with `--loglevel=error`, npm still runs through 'audit'/'fund'
-      // codepaths unless --no-audit / --no-fund are passed explicitly.
-      "--no-audit",
-      "--no-fund",
-      // Avoid input being swallowed by the spinner in recent npm versions.
-      "--no-progress",
-      ...logLevelArgs,
-      ...npmArgs,
-      ...otherArgs
-    ],
-    {
-      __proto__: null,
-      // npm on Windows is a .cmd file that requires a shell.
-      shell: import_platform.WIN32,
-      ...options
-    }
-  );
+	const useDebug = /* @__PURE__ */ require_debug_namespace.isDebug();
+	const terminatorPos = require_primordials_array.ArrayPrototypeIndexOf(args, "--");
+	const npmArgs = (terminatorPos === -1 ? args : require_primordials_array.ArrayPrototypeSlice(args, 0, terminatorPos)).filter((a) => !/* @__PURE__ */ require_eco_npm_npm_flags.isNpmAuditFlag(a) && !/* @__PURE__ */ require_eco_npm_npm_flags.isNpmFundFlag(a) && !/* @__PURE__ */ require_eco_npm_npm_flags.isNpmProgressFlag(a));
+	const otherArgs = terminatorPos === -1 ? [] : require_primordials_array.ArrayPrototypeSlice(args, terminatorPos);
+	return require_process_spawn_child.spawn(require_constants_agents.NPM_BIN_PATH, [
+		"--no-audit",
+		"--no-fund",
+		"--no-progress",
+		...useDebug || npmArgs.some(require_eco_npm_npm_flags.isNpmLoglevelFlag) ? [] : ["--loglevel", "warn"],
+		...npmArgs,
+		...otherArgs
+	], {
+		__proto__: null,
+		shell: require_constants_platform.WIN32,
+		...options
+	});
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  execNpm
-});
+
+//#endregion
+exports.execNpm = execNpm;

package/dist/eco/npm/npm/extract-package-name-from-path.js

@@ -1,54 +1,32 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var extract_package_name_from_path_exports = {};
-__export(extract_package_name_from_path_exports, {
-  extractPackageNameFromPath: () => extractPackageNameFromPath
-});
-module.exports = __toCommonJS(extract_package_name_from_path_exports);
-var import_string = require("../../../primordials/string");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_string = require('../../../primordials/string.js');
+
+//#region src/eco/npm/npm/extract-package-name-from-path.ts
+/**
+* @file `extractPackageNameFromPath(pkgPath)` — given an npm v2/v3 lockfile
+*   entry key like `node_modules/a/node_modules/b`, returns the final package
+*   name (`b`), preserving scoped-package boundaries (`@scope/name` stays
+*   joined). Windows-generated lockfiles may use `\\` separators; the impl
+*   normalizes first so both forms are handled. Behavior matches socket-btm's
+*   smol-manifest internal `extractPackageNameFromPath`.
+*/
 const NODE_MODULES_PREFIX = "node_modules/";
 function extractPackageNameFromPath(pkgPath) {
-  const normalized = (0, import_string.StringPrototypeReplaceAll)(pkgPath, "\\", "/");
-  const lastNmIdx = (0, import_string.StringPrototypeLastIndexOf)(normalized, NODE_MODULES_PREFIX);
-  if (lastNmIdx === -1) {
-    return normalized;
-  }
-  const withoutPrefix = (0, import_string.StringPrototypeSlice)(
-    normalized,
-    lastNmIdx + NODE_MODULES_PREFIX.length
-  );
-  if (withoutPrefix[0] === "@") {
-    const parts = (0, import_string.StringPrototypeSplit)(withoutPrefix, "/");
-    if (parts.length < 2) {
-      return withoutPrefix;
-    }
-    return `${parts[0]}/${parts[1]}`;
-  }
-  const firstSlash = (0, import_string.StringPrototypeIndexOf)(withoutPrefix, "/");
-  if (firstSlash === -1) {
-    return withoutPrefix;
-  }
-  return (0, import_string.StringPrototypeSlice)(withoutPrefix, 0, firstSlash);
+	const normalized = require_primordials_string.StringPrototypeReplaceAll(pkgPath, "\\", "/");
+	const lastNmIdx = require_primordials_string.StringPrototypeLastIndexOf(normalized, NODE_MODULES_PREFIX);
+	if (lastNmIdx === -1) return normalized;
+	const withoutPrefix = require_primordials_string.StringPrototypeSlice(normalized, lastNmIdx + 13);
+	if (withoutPrefix[0] === "@") {
+		const parts = require_primordials_string.StringPrototypeSplit(withoutPrefix, "/");
+		if (parts.length < 2) return withoutPrefix;
+		return `${parts[0]}/${parts[1]}`;
+	}
+	const firstSlash = require_primordials_string.StringPrototypeIndexOf(withoutPrefix, "/");
+	if (firstSlash === -1) return withoutPrefix;
+	return require_primordials_string.StringPrototypeSlice(withoutPrefix, 0, firstSlash);
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  extractPackageNameFromPath
-});
+
+//#endregion
+exports.extractPackageNameFromPath = extractPackageNameFromPath;