registry / @metaobjectsdev/cli / 0.14.2

@metaobjectsdev/cli@0.14.2

CLI for MetaObjects: scaffold, codegen, migrate, and drift-detection commands.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 59 file(s), 373 KB of source, external domains: metaobjects.com

Source & flagged code

2 flagged

dist/src/lib/load-metaobjects-config.jsView file

Lines 1-37javascript

1import { existsSync } from "node:fs";

2import { createRequire } from "node:module";

3import { resolve } from "node:path";

4import { fileURLToPath } from "node:url";

5import { createJiti } from "jiti";

6const CONFIG_FILE = "metaobjects.config.ts";

7// Resolve @metaobjectsdev/codegen-ts from the CLI's own node_modules so that

8// metaobjects.config.ts (which lives in the user's project) can import it even

9// when the user's project has no direct dependency on the package.

10//

11// When compiled: import.meta.url is dist/src/lib/load-metaobjects-config.js — four

12// levels up (past lib/, src/, dist/) reaches the CLI package root (packages/cli/).

13// When run as TS source (e.g. bun test): import.meta.url is src/lib/load-metaobjects-config.ts

14// — three levels up (past lib/, src/) reaches the package root.

15const _thisFile = fileURLToPath(import.meta.url);

16const _isCompiled = _thisFile.includes("/dist/");

17const _cliDir = resolve(_thisFile, _isCompiled ? "../../../.." : "../../..");

18const _require = createRequire(import.meta.url);

19// Fallback layout for each codegen specifier (relative to _cliDir), used only

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/lib/load-metaobjects-config.jsView on unpkg · L17

20// when standard module resolution can't locate it. Compiled output lives in

21// dist/; un-compiled runs (bun test, `meta` from the workspace) use src/ so the

22// CLI never depends on a stale, unrebuilt dist/.

23//

24// @metaobjectsdev/cli is this package itself, so it resolves directly from

25// _cliDir rather than through node_modules (which would be a non-existent

26// self-referential symlink).

27const CLI_PKG_PATHS = {

28 "@metaobjectsdev/codegen-ts": {

29 dist: "node_modules/@metaobjectsdev/codegen-ts/dist/index.js",

30 src: "node_modules/@metaobjectsdev/codegen-ts/src/index.ts",

31 },

32 // Consumer configs that ship custom MetaDataTypeProviders import the type

33 // primitives (TypeId, MetaField, TYPE_* …) from here. Aliased to the CLI's

34 // own copy so the user's project needn't declare it as a direct dependency.

35 "@metaobjectsdev/metadata": {

36 dist: "node_modules/@metaobjectsdev/metadata/dist/index.js",

37 src: "node_modules/@metaobjectsdev/metadata/src/index.ts",

src/commands/migrate.tsView file

Lines 26-66typescript

26 BlockedChangesError,

27 renderD1,

28 writeMigrationD1,

29 introspectD1,

30 applyPending,

31 rollbackTo,

32 findWranglerConfig,

33 parseWranglerConfig,

34 resolveD1Binding,

35 type AmbiguousChange,

36 type AmbiguousResolution

Source & flagged code

2 flagged · loading source

dist/src/lib/load-metaobjects-config.jsView file

17const _cliDir = resolve(_thisFile, _isCompiled ? "../../../.." : "../../.."); L18: const _require = createRequire(import.meta.url); L19: // Fallback layout for each codegen specifier (relative to _cliDir), used only

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/lib/load-metaobjects-config.jsView on unpkg · L17

src/commands/migrate.tsView file

46package = @metaobjectsdev/cli; repositoryIdentity = metaobjects; dependency = @metaobjectsdev/codegen-ts L46: } from "../lib/wrangler.js"; L47: import { buildProjectionViews } from "@metaobjectsdev/codegen-ts"; L48: import { tokensToAllowOptions, describeChange } from "../lib/allow.js";

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/commands/migrate.tsView on unpkg · L46

Findings

1 High4 Medium4 Low

HighCopied Package Dependency Bridgesrc/commands/migrate.ts

MediumDynamic Requiredist/src/lib/load-metaobjects-config.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/src/lib/load-metaobjects-config.jsView file

Lines 1-37javascript

1import { existsSync } from "node:fs";

2import { createRequire } from "node:module";

3import { resolve } from "node:path";

4import { fileURLToPath } from "node:url";

5import { createJiti } from "jiti";

6const CONFIG_FILE = "metaobjects.config.ts";

7// Resolve @metaobjectsdev/codegen-ts from the CLI's own node_modules so that

8// metaobjects.config.ts (which lives in the user's project) can import it even

9// when the user's project has no direct dependency on the package.

10//

11// When compiled: import.meta.url is dist/src/lib/load-metaobjects-config.js — four

12// levels up (past lib/, src/, dist/) reaches the CLI package root (packages/cli/).

13// When run as TS source (e.g. bun test): import.meta.url is src/lib/load-metaobjects-config.ts

14// — three levels up (past lib/, src/) reaches the package root.

15const _thisFile = fileURLToPath(import.meta.url);

16const _isCompiled = _thisFile.includes("/dist/");

17const _cliDir = resolve(_thisFile, _isCompiled ? "../../../.." : "../../..");

18const _require = createRequire(import.meta.url);

19// Fallback layout for each codegen specifier (relative to _cliDir), used only

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/lib/load-metaobjects-config.jsView on unpkg · L17

20// when standard module resolution can't locate it. Compiled output lives in

21// dist/; un-compiled runs (bun test, `meta` from the workspace) use src/ so the

22// CLI never depends on a stale, unrebuilt dist/.

23//

24// @metaobjectsdev/cli is this package itself, so it resolves directly from

25// _cliDir rather than through node_modules (which would be a non-existent

26// self-referential symlink).

27const CLI_PKG_PATHS = {

28 "@metaobjectsdev/codegen-ts": {

29 dist: "node_modules/@metaobjectsdev/codegen-ts/dist/index.js",

30 src: "node_modules/@metaobjectsdev/codegen-ts/src/index.ts",

31 },

32 // Consumer configs that ship custom MetaDataTypeProviders import the type

33 // primitives (TypeId, MetaField, TYPE_* …) from here. Aliased to the CLI's

34 // own copy so the user's project needn't declare it as a direct dependency.

35 "@metaobjectsdev/metadata": {

36 dist: "node_modules/@metaobjectsdev/metadata/dist/index.js",

37 src: "node_modules/@metaobjectsdev/metadata/src/index.ts",

src/commands/migrate.tsView file

Lines 26-66typescript

26 BlockedChangesError,

27 renderD1,

28 writeMigrationD1,

29 introspectD1,

30 applyPending,

31 rollbackTo,

32 findWranglerConfig,

33 parseWranglerConfig,

34 resolveD1Binding,

35 type AmbiguousChange,

36 type AmbiguousResolution