constants.rs

/// The project-relative state directory every socket-patch file lives under
/// (manifest, blob/archive stores, the vendor and hosted ledgers, the apply
/// lock). Empty-directory prunes climb up to — never past — this level.
pub const SOCKET_DIR: &str = ".socket";

/// Default path for the patch manifest file relative to the project root.
pub const DEFAULT_PATCH_MANIFEST_PATH: &str = ".socket/manifest.json";

/// Default public patch API URL for free patches (no auth required).
pub const DEFAULT_PATCH_API_PROXY_URL: &str = "https://patches-api.socket.dev";

/// Default Socket API URL for authenticated access.
pub const DEFAULT_SOCKET_API_URL: &str = "https://api.socket.dev";

/// User-Agent header value for API requests.
///
/// The version segment is derived from the crate version at compile time so it
/// tracks the published release instead of drifting from a hardcoded literal.
/// Server-side analytics and any minimum-version gating rely on this reporting
/// the real version.
pub(crate) const USER_AGENT: &str = concat!("SocketPatchCLI/", env!("CARGO_PKG_VERSION"));

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn user_agent_reports_real_crate_version() {
        // USER_AGENT must carry the actual compiled crate version, never a
        // hardcoded one.
        let expected = format!("SocketPatchCLI/{}", env!("CARGO_PKG_VERSION"));
        assert_eq!(USER_AGENT, expected);
        assert!(USER_AGENT.starts_with("SocketPatchCLI/"));
        assert!(
            !USER_AGENT.ends_with("/1.0"),
            "USER_AGENT must not be stuck at the stale 1.0 version"
        );
        // The version segment must be non-empty.
        let version = USER_AGENT.trim_start_matches("SocketPatchCLI/");
        assert!(!version.is_empty(), "version segment must not be empty");
    }

    #[test]
    fn api_urls_are_https_without_trailing_slash() {
        for url in [DEFAULT_PATCH_API_PROXY_URL, DEFAULT_SOCKET_API_URL] {
            assert!(url.starts_with("https://"), "{url} must use https");
            assert!(
                !url.ends_with('/'),
                "{url} must not end with a trailing slash"
            );
        }
        // The proxy and authenticated API are distinct hosts; swapping them
        // would silently send authed traffic to the public proxy (or vice versa).
        assert_ne!(DEFAULT_PATCH_API_PROXY_URL, DEFAULT_SOCKET_API_URL);
        assert_eq!(
            DEFAULT_PATCH_API_PROXY_URL,
            "https://patches-api.socket.dev"
        );
        assert_eq!(DEFAULT_SOCKET_API_URL, "https://api.socket.dev");
    }

    #[test]
    fn manifest_path_is_under_dot_socket() {
        assert_eq!(DEFAULT_PATCH_MANIFEST_PATH, ".socket/manifest.json");
    }
}

/// The npm-family package managers' shared file names. Which subsystem
/// accepts which of them (the intentionally divergent subsets: binary locks
/// have a native byte reader, `pnpm-lock.yml` is only a pnpm marker) is
/// one flag on one row of [`crate::formats::registry()`].
pub mod npm_family {
    /// Yarn Plug'n'Play loader files — any one present means "packages are
    /// not on disk" (crawler must refuse; vendor probe refuses). Yarn 3+
    /// emits `.pnp.cjs`, Yarn 2.x emitted `.pnp.js`, newer installs may add
    /// the ESM `.pnp.loader.mjs`.
    pub const PNP_MARKERS: [&str; 3] = [".pnp.cjs", ".pnp.js", ".pnp.loader.mjs"];

    /// Rush monorepos keep the single pnpm source-of-truth lock here,
    /// relative to the repo root (no root package.json/lock pair).
    pub const RUSH_COMMON_LOCK_REL: &str = "common/config/rush/pnpm-lock.yaml";

    /// The npm locks, in npm's own preference order (the shrinkwrap wins
    /// for npm <= 11).
    pub const NPM_LOCKS: [&str; 2] = ["npm-shrinkwrap.json", "package-lock.json"];
    /// The root pnpm lock (pnpm >= 3, every `lockfileVersion`).
    pub const PNPM_LOCK: &str = "pnpm-lock.yaml";
    /// pnpm 1 / 2's lock (`shrinkwrapVersion: 3`), renamed by pnpm 3.
    pub const PNPM_SHRINKWRAP_LEGACY: &str = "shrinkwrap.yaml";
    /// Rush's per-subspace lock dir
    /// (`common/config/subspaces/<name>/pnpm-lock.yaml`).
    pub const RUSH_SUBSPACES_DIR: &str = "common/config/subspaces";
    /// Bun's text lock (bun >= 1.1.39's default).
    pub const BUN_LOCK: &str = "bun.lock";
    /// Bun's binary lock.
    pub const BUN_LOCKB: &str = "bun.lockb";
    /// vlt's committed lock (the root one only; a nested lock is its own
    /// project).
    pub const VLT_LOCK: &str = "vlt-lock.json";
    /// vlt's project config, read-only for every mode.
    pub const VLT_CONFIG: &str = "vlt.json";
    /// vlt's hidden lock, the installed graph vlt trusts without re-checking.
    pub const VLT_HIDDEN_LOCK_REL: &str = "node_modules/.vlt-lock.json";
    /// vlt's per-project package store, one `<DepID>/` entry per node.
    pub const VLT_STORE_DIR: &str = "node_modules/.vlt";
    /// Workspace globs of vlt <= 0.0.0-12 (`{"packages": ...}`).
    pub const VLT_LEGACY_WORKSPACES: &str = "vlt-workspaces.json";
}