Fix tsgo destructuring bug in all lib files

jdalton · jdalton · commit c0b1d9ab3d1b · 2025-09-30T00:23:24.000-04:00
Replace destructuring from global objects with direct property access to work around tsgo transpilation bug that causes runtime errors. References: SocketDev/socket-packageurl-js#3
diff --git a/registry/src/lib/constants/ENV.ts b/registry/src/lib/constants/ENV.ts
@@ -1,7 +1,12 @@
 import { envAsBoolean, envAsString } from '../env.js'
 import WIN32 from './WIN32'
 
-const { freeze: ObjectFreeze, hasOwn: ObjectHasOwn } = Object
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ObjectFreeze = Object.freeze
+const ObjectHasOwn = Object.hasOwn
 const { env } = process
 
 const DEBUG = envAsString(env['DEBUG'])
diff --git a/registry/src/lib/constants/NODE_HARDEN_FLAGS.ts b/registry/src/lib/constants/NODE_HARDEN_FLAGS.ts
@@ -1,6 +1,10 @@
 import WIN32 from './WIN32'
 
-const { freeze: ObjectFreeze } = Object
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ObjectFreeze = Object.freeze
 
 export default ObjectFreeze(
   // Harden Node security.
diff --git a/registry/src/lib/constants/NODE_NO_WARNINGS_FLAGS.ts b/registry/src/lib/constants/NODE_NO_WARNINGS_FLAGS.ts
@@ -1,6 +1,10 @@
 import SUPPORTS_NODE_DISABLE_WARNING_FLAG from './SUPPORTS_NODE_DISABLE_WARNING_FLAG'
 
-const { freeze: ObjectFreeze } = Object
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ObjectFreeze = Object.freeze
 
 export default ObjectFreeze(
   SUPPORTS_NODE_DISABLE_WARNING_FLAG
diff --git a/registry/src/lib/constants/ipc-promise.ts b/registry/src/lib/constants/ipc-promise.ts
@@ -3,7 +3,12 @@ import handler from './ipc-handler'
 import ipcObject from './ipc-object'
 import target from './ipc-target'
 
-const { assign: ObjectAssign, freeze: ObjectFreeze } = Object
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ObjectAssign = Object.assign
+const ObjectFreeze = Object.freeze
 
 export default new Promise(
   // The Promise executor is immediately executed.
diff --git a/registry/src/lib/constants/maintained-node-versions.ts b/registry/src/lib/constants/maintained-node-versions.ts
@@ -1,7 +1,11 @@
 import browsersList from '../../external/browserslist'
 import semver from '../../external/semver'
 
-const { freeze: ObjectFreeze } = Object
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ObjectFreeze = Object.freeze
 
 // Under the hood browserlist uses the node-releases package which is out of date:
 // https://github.com/chicoxyzzy/node-releases/issues/37
diff --git a/registry/src/lib/constants/node-debug-flags.ts b/registry/src/lib/constants/node-debug-flags.ts
@@ -1,6 +1,10 @@
 import ENV from './ENV'
 
-const { freeze: ObjectFreeze } = Object
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ObjectFreeze = Object.freeze
 
 export default ObjectFreeze(
   ENV.SOCKET_CLI_DEBUG ? ['--trace-uncaught', '--trace-warnings'] : [],
diff --git a/registry/src/lib/constants/package-extensions.ts b/registry/src/lib/constants/package-extensions.ts
@@ -1,4 +1,8 @@
-const { freeze: ObjectFreeze } = Object
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ObjectFreeze = Object.freeze
 
 const yarnPkgExtensions: { packageExtensions: any[] } =
   /*@__PURE__*/ require('../../external/@yarnpkg/extensions')
diff --git a/registry/src/lib/constants/package-manager-cache-names.ts b/registry/src/lib/constants/package-manager-cache-names.ts
@@ -1,4 +1,8 @@
-const { freeze: ObjectFreeze } = Object
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ObjectFreeze = Object.freeze
 
 // Package manager cache directory names.
 // These are the standard directory names used by each package manager
diff --git a/registry/src/lib/debug.ts b/registry/src/lib/debug.ts
@@ -3,7 +3,11 @@
  * Provides Socket CLI specific debug functionality and logging formatters.
  */
 
-const { apply: ReflectApply } = Reflect
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ReflectApply = Reflect.apply
 
 const { hasOwn } = /*@__PURE__*/ require('./objects')
 const { applyLinePrefix } = /*@__PURE__*/ require('./strings')
diff --git a/registry/src/lib/env.ts b/registry/src/lib/env.ts
@@ -4,7 +4,12 @@
  */
 
 const NumberCtor = Number
-const { isFinite: NumberIsFinite, parseInt: NumberParseInt } = NumberCtor
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const NumberIsFinite = Number.isFinite
+const NumberParseInt = Number.parseInt
 const StringCtor = String
 
 /**
diff --git a/registry/src/lib/fs.ts b/registry/src/lib/fs.ts
@@ -107,8 +107,16 @@ export interface WriteJsonOptions extends WriteOptions {
   spaces?: number | string | undefined
 }
 
-const { isArray: ArrayIsArray } = Array
-const { freeze: ObjectFreeze } = Object
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ArrayIsArray = Array.isArray
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ObjectFreeze = Object.freeze
 
 const defaultRemoveOptions = ObjectFreeze({
   __proto__: null,
diff --git a/registry/src/lib/globs.ts b/registry/src/lib/globs.ts
@@ -3,7 +3,11 @@
  * Provides file filtering and glob matcher functions for npm-like behavior.
  */
 
-const { freeze: ObjectFreeze } = Object
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ObjectFreeze = Object.freeze
 
 // Type definitions
 type Pattern = string
diff --git a/registry/src/lib/json.ts b/registry/src/lib/json.ts
@@ -23,7 +23,11 @@ export interface JsonParseOptions {
   throws?: boolean
 }
 
-const { parse: JSONParse } = JSON
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const JSONParse = JSON.parse
 
 /**
  * Check if a value is a Buffer instance.
diff --git a/registry/src/lib/logger.ts b/registry/src/lib/logger.ts
@@ -26,8 +26,18 @@ interface Task {
 export type { LogSymbols, LoggerMethods, Task }
 
 const globalConsole = console
-const { assign: ObjectAssign, freeze: ObjectFreeze } = Object
-const { apply: ReflectApply, construct: ReflectConstruct } = Reflect
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ObjectAssign = Object.assign
+const ObjectFreeze = Object.freeze
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ReflectApply = Reflect.apply
+const ReflectConstruct = Reflect.construct
 
 const { applyLinePrefix, isBlankString } = /*@__PURE__*/ require('./strings')
 
diff --git a/registry/src/lib/objects.ts b/registry/src/lib/objects.ts
@@ -32,23 +32,37 @@ type SortedObject<T> = {
 
 export type { GetterDefObj, LazyGetterStats, ConstantsObjectOptions, Remap }
 
-const { isArray: ArrayIsArray } = Array
-const {
-  defineProperties: ObjectDefineProperties,
-  defineProperty: ObjectDefineProperty,
-  freeze: ObjectFreeze,
-  fromEntries: ObjectFromEntries,
-  getOwnPropertyDescriptors: ObjectGetOwnPropertyDescriptors,
-  getOwnPropertyNames: ObjectGetOwnPropertyNames,
-  getPrototypeOf: ObjectGetPrototypeOf,
-  hasOwn: ObjectHasOwn,
-  keys: ObjectKeys,
-  prototype: ObjectPrototype,
-  setPrototypeOf: ObjectSetPrototypeOf,
-} = Object
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ArrayIsArray = Array.isArray
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ObjectDefineProperties = Object.defineProperties
+const ObjectDefineProperty = Object.defineProperty
+const ObjectFreeze = Object.freeze
+const ObjectFromEntries = Object.fromEntries
+const ObjectGetOwnPropertyDescriptors = Object.getOwnPropertyDescriptors
+const ObjectGetOwnPropertyNames = Object.getOwnPropertyNames
+const ObjectGetPrototypeOf = Object.getPrototypeOf
+const ObjectHasOwn = Object.hasOwn
+const ObjectKeys = Object.keys
+const ObjectPrototype = Object.prototype
+const ObjectSetPrototypeOf = Object.setPrototypeOf
 // @ts-expect-error - __defineGetter__ exists but not in type definitions.
-const { __defineGetter__ } = Object.prototype
-const { ownKeys: ReflectOwnKeys } = Reflect
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const __defineGetter__ = Object.prototype.__defineGetter__
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ReflectOwnKeys = Reflect.ownKeys
 
 /**
  * Create a lazy getter function that memoizes its result.
diff --git a/registry/src/lib/packages.ts b/registry/src/lib/packages.ts
@@ -74,8 +74,16 @@ export type PacoteOptions = {
   fullMetadata?: boolean | undefined
 }
 
-const { isArray: ArrayIsArray } = Array
-const { hasOwn: ObjectHasOwn } = Object
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ArrayIsArray = Array.isArray
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ObjectHasOwn = Object.hasOwn
 
 const LOOP_SENTINEL = /*@__PURE__*/ require('./constants/LOOP_SENTINEL').default
 const NPM_REGISTRY_URL =
diff --git a/registry/src/lib/signal-exit.ts b/registry/src/lib/signal-exit.ts
@@ -29,7 +29,11 @@
 // state from which it is not safe to try and enter JS
 // listeners.
 
-const { apply: ReflectApply } = Reflect
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ReflectApply = Reflect.apply
 const globalProcess = globalThis.process as
   | (NodeJS.Process & {
       __signal_exit_emitter__?: any
diff --git a/registry/src/lib/spawn.ts b/registry/src/lib/spawn.ts
@@ -6,8 +6,16 @@
 // Define BufferEncoding type for TypeScript compatibility.
 type BufferEncoding = globalThis.BufferEncoding
 
-const { isArray: ArrayIsArray } = Array
-const { hasOwn: ObjectHasOwn } = Object
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ArrayIsArray = Array.isArray
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ObjectHasOwn = Object.hasOwn
 
 const { getOwn } = /*@__PURE__*/ require('./objects')
 const { stripAnsi } = /*@__PURE__*/ require('./strings')
diff --git a/registry/src/lib/spinner.ts b/registry/src/lib/spinner.ts
@@ -5,7 +5,11 @@
 
 import type { Writable } from 'node:stream'
 
-const { hasOwn: ObjectHasOwn } = Object
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const ObjectHasOwn = Object.hasOwn
 
 export type Color =
   | 'black'
diff --git a/registry/src/lib/strings.ts b/registry/src/lib/strings.ts
@@ -9,7 +9,11 @@ export type BlankString = string & { [BlankStringBrand]: true }
 declare const EmptyStringBrand: unique symbol
 export type EmptyString = string & { [EmptyStringBrand]: true }
 
-const { fromCharCode } = String
+// IMPORTANT: Do not use destructuring here - use direct assignment instead.
+// tsgo has a bug that incorrectly transpiles destructured exports, resulting in
+// `exports.SomeName = void 0;` which causes runtime errors.
+// See: https://github.com/SocketDev/socket-packageurl-js/issues/3
+const fromCharCode = String.fromCharCode
 
 // Inlined ansi-regex:
 // https://socket.dev/npm/package/ansi-regexp/overview/6.2.2
