fix(environment): lazy-load bun lockfile parser

Changed @socketregistry/hyrious__bun.lockb import from module-load time
to runtime lazy-loading. The parser is now only loaded when actually
parsing a bun.lockb file, not when the module loads.

This prevents MODULE_NOT_FOUND errors in environments where the parser
isn't needed (e.g., when using npm/pnpm/yarn lockfiles).

Fixes issue where socketbin packages failed to run because the bun
lockfile parser was unnecessarily required at module load time.

Author: jdalton

packages/cli/src/utils/ecosystem/environment.mts

@@ -32,11 +32,20 @@ import browserslist from 'browserslist'
 import semver from 'semver'
 
 const require = createRequire(import.meta.url)
-// Type definition is incorrect - exports object with parse method, not namespace.
-const { parse: parseBunLockb } =
-  require('@socketregistry/hyrious__bun.lockb/index.cjs') as {
-    parse: (buf: Uint8Array | ArrayBuffer) => string
+
+// Lazy-load Bun lockfile parser only when needed.
+let parseBunLockb: ((buf: Uint8Array | ArrayBuffer) => string) | undefined
+
+function getParseBunLockb() {
+  if (!parseBunLockb) {
+    // Type definition is incorrect - exports object with parse method, not namespace.
+    const parser = require('@socketregistry/hyrious__bun.lockb/index.cjs') as {
+      parse: (buf: Uint8Array | ArrayBuffer) => string
+    }
+    parseBunLockb = parser.parse
   }
+  return parseBunLockb
+}
 
 import { whichBin } from '@socketsecurity/lib/bin'
 import {
@@ -211,7 +220,7 @@ const readLockFileByAgent: Map<Agent, ReadLockFile> = (() => {
             const lockBuffer = await binaryReader(lockPath)
             if (lockBuffer) {
               try {
-                return parseBunLockb(lockBuffer)
+                return getParseBunLockb()(lockBuffer)
               } catch {}
             }
             // To print a Yarn lockfile to your console without writing it to disk