fix(dlx): correct parsePackageSpec for scoped packages with versions

Fix bug where parsePackageSpec incorrectly strips the '@' prefix from scoped
packages when they have versions. For example:
- Before: '@coana-tech/cli@~14.12.51' → {name: 'coana-tech/cli', version: '~14.12.51'}
- After: '@coana-tech/cli@~14.12.51' → {name: '@coana-tech/cli', version: '~14.12.51'}

Also refactor external module lazy-loading:
- Extract lazy-loading logic into separate modules (npm-package-arg.ts, pacote.ts, semver.ts)
- Export getNpmPackageArg(), getPacote(), getSemver() functions
- Update dlx-package.ts and versions.ts to use new external modules
- Improves code organization and reusability

This fixes the issue where installing @coana-tech/cli via dlx would fail
with "Package not found: coana-tech/cli".

Author: jdalton

src/dlx-package.ts

@@ -36,7 +36,7 @@ import path from 'node:path'
 import { WIN32 } from './constants/platform'
 import { getPacoteCachePath } from './constants/packages'
 import { generateCacheKey } from './dlx'
-import pacote from './external/pacote'
+import { getPacote } from './external/pacote'
 import { readJsonSync } from './fs'
 import { normalizePath } from './path'
 import { getSocketDlxDir } from './paths'
@@ -118,17 +118,19 @@ function parsePackageSpec(spec: string): {
   // Handle scoped packages (@scope/name@version).
   if (spec.startsWith('@')) {
     const parts = spec.split('@')
+    // parts[0] is empty string (before leading @)
+    // parts[1] is scope/name
+    // parts[2] is version (if present)
     if (parts.length === 3) {
-      // @scope@version -> Invalid, but handle gracefully.
-      return { name: parts[1], version: parts[2] }
+      // @scope/name@version.
+      return { name: `@${parts[1]}`, version: parts[2] }
     }
     if (parts.length === 2) {
       // @scope/name with no version.
       return { name: `@${parts[1]}`, version: undefined }
     }
-    // @scope/name@version.
-    const scopeAndName = `@${parts[1]}`
-    return { name: scopeAndName, version: parts[2] }
+    // Fallback for malformed input.
+    return { name: spec, version: undefined }
   }
 
   // Handle unscoped packages (name@version).
@@ -205,7 +207,7 @@ async function ensurePackageInstalled(
       // Pacote leverages npm cache when available but doesn't require npm CLI.
       const pacoteCachePath = getPacoteCachePath()
       try {
-        await pacote.extract(packageSpec, installedDir, {
+        await getPacote().extract(packageSpec, installedDir, {
           // Use consistent pacote cache path (respects npm cache locations when available).
           cache: pacoteCachePath || path.join(packageDir, '.cache'),
         })

src/external/npm-package-arg.ts

@@ -0,0 +1,20 @@
+/**
+ * Lazy-loaded npm-package-arg module.
+ * Defers require() until first use to reduce startup time.
+ */
+
+let _npmPackageArg: typeof import('npm-package-arg') | undefined
+
+/**
+ * Get the npm-package-arg module, loading it on first access.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export function getNpmPackageArg() {
+  if (_npmPackageArg === undefined) {
+    _npmPackageArg = /*@__PURE__*/ require('./npm-package-arg.js')
+  }
+  return _npmPackageArg as typeof import('npm-package-arg')
+}
+
+// Default export for convenience.
+export default getNpmPackageArg

src/external/pacote.ts

@@ -0,0 +1,20 @@
+/**
+ * Lazy-loaded pacote module.
+ * Defers require() until first use to reduce startup time.
+ */
+
+let _pacote: typeof import('pacote') | undefined
+
+/**
+ * Get the pacote module, loading it on first access.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export function getPacote() {
+  if (_pacote === undefined) {
+    _pacote = /*@__PURE__*/ require('./pacote.js')
+  }
+  return _pacote as typeof import('pacote')
+}
+
+// Default export for convenience.
+export default getPacote

src/external/semver.ts

@@ -0,0 +1,21 @@
+/**
+ * Lazy-loaded semver module.
+ * Defers require() until first use to reduce startup time.
+ * The 'semver' package is browser safe.
+ */
+
+let _semver: typeof import('semver') | undefined
+
+/**
+ * Get the semver module, loading it on first access.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export function getSemver() {
+  if (_semver === undefined) {
+    _semver = /*@__PURE__*/ require('./semver.js')
+  }
+  return _semver as typeof import('semver')
+}
+
+// Default export for convenience.
+export default getSemver

src/versions.ts

@@ -1,12 +1,12 @@
 /** @fileoverview Version comparison and validation utilities for Socket ecosystem. */
 
-import semver from './external/semver'
+import { getSemver } from './external/semver'
 
 /**
  * Coerce a version string to valid semver format.
  */
 export function coerceVersion(version: string): string | undefined {
-  const coerced = semver.coerce(version)
+  const coerced = getSemver().coerce(version)
   return coerced?.version
 }
 
@@ -19,7 +19,7 @@ export function compareVersions(
   v2: string,
 ): -1 | 0 | 1 | undefined {
   try {
-    return semver.compare(v1, v2)
+    return getSemver().compare(v1, v2)
   } catch {
     return undefined
   }
@@ -29,30 +29,30 @@ export function compareVersions(
  * Get all versions from an array that satisfy a semver range.
  */
 export function filterVersions(versions: string[], range: string): string[] {
-  return versions.filter(v => semver.satisfies(v, range))
+  return versions.filter(v => getSemver().satisfies(v, range))
 }
 
 /**
  * Get the major version number from a version string.
  */
 export function getMajorVersion(version: string): number | undefined {
-  const parsed = semver.parse(version)
+  const parsed = getSemver().parse(version)
   return parsed?.major
 }
 
 /**
  * Get the minor version number from a version string.
  */
 export function getMinorVersion(version: string): number | undefined {
-  const parsed = semver.parse(version)
+  const parsed = getSemver().parse(version)
   return parsed?.minor
 }
 
 /**
  * Get the patch version number from a version string.
  */
 export function getPatchVersion(version: string): number | undefined {
-  const parsed = semver.parse(version)
+  const parsed = getSemver().parse(version)
   return parsed?.patch
 }
 
@@ -71,21 +71,21 @@ export function incrementVersion(
     | 'prerelease',
   identifier?: string | undefined,
 ): string | undefined {
-  return semver.inc(version, release, identifier) || undefined
+  return getSemver().inc(version, release, identifier) || undefined
 }
 
 /**
  * Check if version1 equals version2.
  */
 export function isEqual(version1: string, version2: string): boolean {
-  return semver.eq(version1, version2)
+  return getSemver().eq(version1, version2)
 }
 
 /**
  * Check if version1 is greater than version2.
  */
 export function isGreaterThan(version1: string, version2: string): boolean {
-  return semver.gt(version1, version2)
+  return getSemver().gt(version1, version2)
 }
 
 /**
@@ -95,42 +95,42 @@ export function isGreaterThanOrEqual(
   version1: string,
   version2: string,
 ): boolean {
-  return semver.gte(version1, version2)
+  return getSemver().gte(version1, version2)
 }
 
 /**
  * Check if version1 is less than version2.
  */
 export function isLessThan(version1: string, version2: string): boolean {
-  return semver.lt(version1, version2)
+  return getSemver().lt(version1, version2)
 }
 
 /**
  * Check if version1 is less than or equal to version2.
  */
 export function isLessThanOrEqual(version1: string, version2: string): boolean {
-  return semver.lte(version1, version2)
+  return getSemver().lte(version1, version2)
 }
 
 /**
  * Validate if a string is a valid semantic version.
  */
 export function isValidVersion(version: string): boolean {
-  return semver.valid(version) !== null
+  return getSemver().valid(version) !== null
 }
 
 /**
  * Get the highest version from an array of versions.
  */
 export function maxVersion(versions: string[]): string | undefined {
-  return semver.maxSatisfying(versions, '*') || undefined
+  return getSemver().maxSatisfying(versions, '*') || undefined
 }
 
 /**
  * Get the lowest version from an array of versions.
  */
 export function minVersion(versions: string[]): string | undefined {
-  return semver.minSatisfying(versions, '*') || undefined
+  return getSemver().minSatisfying(versions, '*') || undefined
 }
 
 /**
@@ -145,7 +145,7 @@ export function parseVersion(version: string):
       build: readonly string[]
     }
   | undefined {
-  const parsed = semver.parse(version)
+  const parsed = getSemver().parse(version)
   if (!parsed) {
     return undefined
   }
@@ -162,21 +162,21 @@ export function parseVersion(version: string):
  * Check if a version satisfies a semver range.
  */
 export function satisfiesVersion(version: string, range: string): boolean {
-  return semver.satisfies(version, range)
+  return getSemver().satisfies(version, range)
 }
 
 /**
  * Sort versions in ascending order.
  */
 export function sortVersions(versions: string[]): string[] {
-  return semver.sort([...versions])
+  return getSemver().sort([...versions])
 }
 
 /**
  * Sort versions in descending order.
  */
 export function sortVersionsDesc(versions: string[]): string[] {
-  return semver.rsort([...versions])
+  return getSemver().rsort([...versions])
 }
 
 /**
@@ -195,7 +195,7 @@ export function versionDiff(
   | 'prerelease'
   | undefined {
   try {
-    return semver.diff(version1, version2) || undefined
+    return getSemver().diff(version1, version2) || undefined
   } catch {
     return undefined
   }