chore: bump @ts-bridge/cli to v0.6.4 and drop unused shims

[cryptodev-2s]

Top of stack #315, on #319.

Dep	From	To
@ts-bridge/cli	^0.1.2	^0.6.4
@ts-bridge/shims	^0.1.1	removed

Output diff

This builds the published artifacts, so dist/ was diffed rather than just checked for a zero exit. 216 files before and after, none added or removed, and only two changed:

versions.mjs switches from a default import plus destructuring to direct named imports:

- import $semver from "semver";
- const { gt: gtSemver, ... } = $semver;
+ import { gt as gtSemver, ... } from "semver";

semver is CJS, so this now leans on Node's cjs-module-lexer resolving those names.

logging.mjs gains an $importDefault helper honouring __esModule when importing debug, which is more correct than the old plain default import.

Why that needed checking by hand

The semver change cannot be caught by the test suite: tests run against src/ through ts-jest and never touch dist/. If the lexer failed to resolve a name, it would surface as a runtime SyntaxError for consumers, not a test failure.

So both entry points were imported directly from the built output, in ESM and CJS, on every Node version we support:

Node	ESM	CJS
18.20.6	pass	pass
20.20.2	pass	pass
22.22.1	pass	pass
24.20.0	pass	pass

Dropping shims

@ts-bridge/shims was never referenced by src/ or by the build output, and core does not carry it. Removing it produces a byte identical dist/.

---

Note

Medium Risk
Published dist/ interop for CJS dependencies changes with the new ts-bridge emitter; runtime breakage would affect package consumers rather than CI tests alone.

Overview
Upgrades the build dev dependency @ts-bridge/cli from ^0.1.2 to ^0.6.4 and removes unused @ts-bridge/shims. The lockfile picks up the CLI’s new transitive deps (@ts-bridge/resolver, cjs-module-lexer) and drops resolve.exports.

Rebuilding with the newer CLI slightly changes published ESM in dist/ (same file set): versions.mjs now uses named imports from CJS semver via Node’s module lexer, and logging.mjs uses an interop helper for debug that respects __esModule. Those paths aren’t covered by tests that run against src/, so runtime import checks on supported Node versions were used to validate ESM/CJS entry points.

^{Reviewed by Cursor Bugbot for commit 361c13c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​ts-bridge/​cli@​0.1.2 ⏵ 0.6.4	+5		+2

View full report

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm cjs-module-lexer is 66.0% likely to have a medium risk anomaly Notes: This module is a WebAssembly-backed parser wrapper that extracts export/re-export identifiers from a source string. The most significant security issue is that it calls (0, eval) on substrings derived from the input whenever they begin with quotes, creating a potential arbitrary code execution risk if an attacker can influence the parsed source. It also throws errors that embed excerpts/line context from the input, which may leak source content into logs or consuming applications. No clear indicators of network exfiltration or system-level malware behavior are visible in this JS wrapper alone, but the eval usage warrants strong scrutiny and sandboxing or removal of dynamic evaluation. Confidence: 0.66 Severity: 0.65 From: package.json → npm/@ts-bridge/cli@0.6.4 → npm/cjs-module-lexer@1.4.3 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cjs-module-lexer@1.4.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report