refactor(json): replace json-to-ast with @socketsecurity/json wasm

json-to-ast was the JS dep used to parse package.json with location
info for hover/diagnostic ranges. Replaced with the new Rust+WASM
JSON parser (vendored under vendor/json-wasm/, mirroring the
acorn-wasm pattern) — same byte-span surface, smaller wasm, faster
parse.

Adapter changes in parse-externals.ts:
  - jsonToAST(src, { loc: true }) → parseJson(src).root
  - pkg.children / .Property → .members
  - Array.children → .items
  - Literal type+value branches → typed scalar arms
  - loc.start/end (line, column) → byte spans + buildLineTable +
    spanToRange (binary-search line-start lookup)

Bundle: 4.2MB → 4.1MB. Smoke test passes. Drops the json-to-ast +
@types/json-to-ast deps; adds workspace pkg vendor/json-wasm.

Author: jdalton

assets/README.md

@@ -8,21 +8,21 @@ marketplace icon, web page favicon, README banner, …).
 
 ### SVG variants
 
-| File | Layers | Color | viewBox |
-|---|---|---|---|
-| `socket-icon.svg` | 1 (bolt is a cutout) | `currentColor` | `0 0 181.41 240` |
-| `socket-icon-square.svg` | 1 | `currentColor` | `-29.295 0 240 240` |
-| `socket-icon-shield.svg` | 2 (shield + bolt) | shield: `currentColor`, bolt: `#fff` | `0 0 181.41 240` |
-| `socket-icon-shield-square.svg` | 2 | shield: `currentColor`, bolt: `#fff` | `-29.295 0 240 240` |
-| `socket-icon-brand.svg` ★ | 2 | shield: pink→purple gradient, bolt: `#fff` | `0 0 181.41 240` |
-| `socket-icon-brand-square.svg` ★ | 2 | shield: pink→purple gradient, bolt: `#fff` | `-29.295 0 240 240` |
+| File                             | Layers               | Color                                      | viewBox             |
+| -------------------------------- | -------------------- | ------------------------------------------ | ------------------- |
+| `socket-icon.svg`                | 1 (bolt is a cutout) | `currentColor`                             | `0 0 181.41 240`    |
+| `socket-icon-square.svg`         | 1                    | `currentColor`                             | `-29.295 0 240 240` |
+| `socket-icon-shield.svg`         | 2 (shield + bolt)    | shield: `currentColor`, bolt: `#fff`       | `0 0 181.41 240`    |
+| `socket-icon-shield-square.svg`  | 2                    | shield: `currentColor`, bolt: `#fff`       | `-29.295 0 240 240` |
+| `socket-icon-brand.svg` ★        | 2                    | shield: pink→purple gradient, bolt: `#fff` | `0 0 181.41 240`    |
+| `socket-icon-brand-square.svg` ★ | 2                    | shield: pink→purple gradient, bolt: `#fff` | `-29.295 0 240 240` |
 
 ### Wordmark variants (shield + "Socket" text, 840×240 landscape)
 
-| File | Layers | viewBox |
-|---|---|---|
+| File                    | Layers                                              | viewBox       |
+| ----------------------- | --------------------------------------------------- | ------------- |
 | `socket-logo-light.svg` | shield (gradient) + bolt (white) + text (slate-900) | `0 0 840 240` |
-| `socket-logo-dark.svg` | shield (gradient) + bolt (white) + text (slate-50) | `0 0 840 240` |
+| `socket-logo-dark.svg`  | shield (gradient) + bolt (white) + text (slate-50)  | `0 0 840 240` |
 
 "Light" and "dark" refer to the **page background** the wordmark sits
 on — light wordmark has dark text (for use on white/light bg); dark
@@ -33,32 +33,38 @@ color-scheme preference:
 
 ```html
 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="assets/socket-logo-dark-840.png">
-  <source media="(prefers-color-scheme: light)" srcset="assets/socket-logo-light-840.png">
-  <img alt="Socket" width="420" src="assets/socket-logo-light-840.png">
+  <source
+    media="(prefers-color-scheme: dark)"
+    srcset="assets/socket-logo-dark-840.png"
+  />
+  <source
+    media="(prefers-color-scheme: light)"
+    srcset="assets/socket-logo-light-840.png"
+  />
+  <img alt="Socket" width="420" src="assets/socket-logo-light-840.png" />
 </picture>
 ```
 
 ### PNG variants
 
 Brand-square (favicons + marketplace listing):
 
-| File | Use |
-|---|---|
-| `socket-icon-brand-16.png` | Favicon (small) |
-| `socket-icon-brand-32.png` | Favicon (standard) |
-| `socket-icon-brand-64.png` | README badges, GitHub social previews |
-| `socket-icon-brand-128.png` | Docs, OG cards |
-| `socket-icon-brand-256.png` | VSCode marketplace listing |
-| `socket-icon-brand-512.png` | High-DPI, hero images, press kit |
+| File                        | Use                                   |
+| --------------------------- | ------------------------------------- |
+| `socket-icon-brand-16.png`  | Favicon (small)                       |
+| `socket-icon-brand-32.png`  | Favicon (standard)                    |
+| `socket-icon-brand-64.png`  | README badges, GitHub social previews |
+| `socket-icon-brand-128.png` | Docs, OG cards                        |
+| `socket-icon-brand-256.png` | VSCode marketplace listing            |
+| `socket-icon-brand-512.png` | High-DPI, hero images, press kit      |
 
 Wordmark (README hero banners, in light/dark pairs):
 
-| File | Width | Use |
-|---|---|---|
-| `socket-logo-{light,dark}-420.png`  | 420×120 | README hero (1× display) |
-| `socket-logo-{light,dark}-840.png`  | 840×240 | README hero (2× / Retina) |
-| `socket-logo-{light,dark}-1680.png` | 1680×480 | Press kit, hero images |
+| File                                | Width    | Use                       |
+| ----------------------------------- | -------- | ------------------------- |
+| `socket-logo-{light,dark}-420.png`  | 420×120  | README hero (1× display)  |
+| `socket-logo-{light,dark}-840.png`  | 840×240  | README hero (2× / Retina) |
+| `socket-logo-{light,dark}-1680.png` | 1680×480 | Press kit, hero images    |
 
 ## Variant semantics
 

package.json

@@ -118,12 +118,11 @@
     "@vscode/python-extension": "1.0.6",
     "acorn-wasm": "workspace:*",
     "ini": "6.0.0",
-    "json-to-ast": "2.1.0",
+    "json-wasm": "workspace:*",
     "toml-eslint-parser": "1.0.3"
   },
   "devDependencies": {
     "@types/ini": "4.1.1",
-    "@types/json-to-ast": "2.1.4",
     "@types/node": "catalog:",
     "@types/vscode": "1.118.0",
     "@typescript/native-preview": "7.0.0-dev.20260415.1",

pnpm-lock.yaml

@@ -5,12 +5,14 @@
 # Register .claude/hooks/* as workspace packages so taze (run via
 # `pnpm run update`) sees and bumps their package.json manifests
 # alongside the root. Keeps hook deps in lockstep with the parent.
-# vendor/acorn-wasm is registered too so the bundle imports it as a
-# package by name (acorn-wasm) rather than via a brittle relative
-# `.mts` path that tsc/tsgo refuse without allowImportingTsExtensions.
+# vendor/acorn-wasm + vendor/json-wasm are registered too so the
+# bundle imports them as packages by name rather than via brittle
+# relative `.mts` paths that tsc/tsgo refuse without
+# allowImportingTsExtensions.
 packages:
   - .claude/hooks/*
   - vendor/acorn-wasm
+  - vendor/json-wasm
 
 # Catalog entries shared across hook workspaces. Pinning them here
 # keeps the entire hook tree in lockstep with the parent without each

pnpm-workspace.yaml

@@ -184,7 +184,8 @@ function loadManifestTree(rootManifestPath: string): {
   for (const rel of includes) {
     const subPath = path.resolve(baseDir, rel)
     const sub = readManifest(subPath)
-    const area = sub.area ?? path.basename(rel, '.json').replace(/^lockstep-/, '')
+    const area =
+      sub.area ?? path.basename(rel, '.json').replace(/^lockstep-/, '')
     areas.push({ area, manifest: sub })
   }
 

scripts/lockstep.mts

@@ -23,7 +23,11 @@ const rootDir = path.resolve(__dirname, '..')
 // Schema lives in `.config/` next to the per-repo
 // `.config/socket-repo-template.json` it describes — the marker's
 // `$schema` ref is `./socket-repo-template-schema.json`.
-const outPath = path.join(rootDir, '.config', 'socket-repo-template-schema.json')
+const outPath = path.join(
+  rootDir,
+  '.config',
+  'socket-repo-template-schema.json',
+)
 
 const enriched = {
   $schema: 'https://json-schema.org/draft/2020-12/schema',