Add TypeScript schema library to npm wrapper#35
Conversation
Add pared-down TypeScript library to npm/socket-patch/ for use by depscan. Includes schema validation (zod), git-compatible hashing, manifest operations, recovery, and package-json postinstall helpers. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
On Windows, `Path::strip_prefix` + `to_string_lossy()` produces backslashes in the relative path, which get embedded in the PURL (e.g., `pkg:golang/github.com\\gin-gonic\\gin@v1.9.1`). Replace backslashes with forward slashes to produce correct PURLs on all platforms. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Move operational code (constants, hashing, manifest operations, recovery, postinstall detection) back to depscan. Only the Zod schema and its tests remain in the npm wrapper package. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Summary
npm/socket-patch/for use by depscan./schema,./hash,./constants,./manifest/operations,./manifest/recovery,./package-json)Context
The socket-patch codebase was rewritten in Rust (v1.6.3), but depscan still needs the TypeScript schema/utility library for server-side operations (manifest parsing, blob hashing, postinstall injection). This PR adds just the library code to the npm wrapper package — no CLI code, crawlers, or repo manipulation.
Test plan
tsccompiles without errorsnode --test dist/**/*.test.js— all 7 schema tests pass🤖 Generated with Claude Code