chore: bump @ts-bridge/cli to v0.6.4 and drop unused shims

[cryptodev-2s]

Top of stack #315, on #319.

Dep	From	To
@ts-bridge/cli	^0.1.2	^0.6.4
@ts-bridge/shims	^0.1.1	removed

Output diff

This builds the published artifacts, so dist/ was diffed rather than just checked for a zero exit. 216 files before and after, none added or removed, and only two changed:

versions.mjs switches from a default import plus destructuring to direct named imports:

- import $semver from "semver";
- const { gt: gtSemver, ... } = $semver;
+ import { gt as gtSemver, ... } from "semver";

semver is CJS, so this now leans on Node's cjs-module-lexer resolving those names.

logging.mjs gains an $importDefault helper honouring __esModule when importing debug, which is more correct than the old plain default import.

Why that needed checking by hand

The semver change cannot be caught by the test suite: tests run against src/ through ts-jest and never touch dist/. If the lexer failed to resolve a name, it would surface as a runtime SyntaxError for consumers, not a test failure.

So both entry points were imported directly from the built output, in ESM and CJS, on every Node version we support:

Node	ESM	CJS
18.20.6	pass	pass
20.20.2	pass	pass
22.22.1	pass	pass
24.20.0	pass	pass

Dropping shims

@ts-bridge/shims was never referenced by src/ or by the build output, and core does not carry it. Removing it produces a byte identical dist/.

---

Note

Medium Risk
Build-tool upgrade can change published dist/ ESM/CJS interop at runtime without failing existing unit tests.

Overview
Upgrades the ts-bridge build dev dependency from ^0.1.2 to ^0.6.4 and drops @ts-bridge/shims, which was not referenced by source or scripts. The lockfile picks up the new CLI stack (@ts-bridge/resolver, cjs-module-lexer) and drops resolve.exports.

The newer CLI emits slightly different dist/ interop for CommonJS dependencies (e.g. named imports from semver, safer default imports for debug via __esModule). That behavior is not exercised by Jest against src/, so reviewers should treat a clean rebuild and smoke imports of built entry points as the main validation signal alongside this dependency bump.

^{Reviewed by Cursor Bugbot for commit a78473f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​ts-bridge/​cli@​0.1.2 ⏵ 0.6.4	+5		+2

View full report

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm cjs-module-lexer is 66.0% likely to have a medium risk anomaly Notes: This module is a WebAssembly-backed parser wrapper that extracts export/re-export identifiers from a source string. The most significant security issue is that it calls (0, eval) on substrings derived from the input whenever they begin with quotes, creating a potential arbitrary code execution risk if an attacker can influence the parsed source. It also throws errors that embed excerpts/line context from the input, which may leak source content into logs or consuming applications. No clear indicators of network exfiltration or system-level malware behavior are visible in this JS wrapper alone, but the eval usage warrants strong scrutiny and sandboxing or removal of dynamic evaluation. Confidence: 0.66 Severity: 0.65 From: package.json → npm/@ts-bridge/cli@0.6.4 → npm/cjs-module-lexer@1.4.3 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cjs-module-lexer@1.4.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[Mrtenz]

We don't use ts-bridge anymore in core. Do we still need to do this here?