@socketsecurity/cli 1.1.151 → 1.1.153

package/dist/types/utils/github-errors.d.mts

@@ -0,0 +1,51 @@
+import type { ApiFetchInit } from './api.mts';
+import type { CResult } from '../types.mts';
+// Canonical `message` values returned for blocking conditions. Exported so
+// the scan loop can short-circuit on them without matching free-form strings.
+export declare const GITHUB_ERR_ABUSE_DETECTION = "GitHub abuse detection triggered";
+export declare const GITHUB_ERR_AUTH_FAILED = "GitHub authentication failed";
+export declare const GITHUB_ERR_RATE_LIMIT = "GitHub rate limit exceeded";
+/**
+ * Whether a CResult `message` is one of the blocking GitHub conditions
+ * (rate limit / abuse detection / auth) that should stop a multi-repo scan.
+ */
+export declare function isGitHubBlockingError(message: string): boolean;
+/**
+ * Seconds to wait before a rate-limited request could succeed, derived from
+ * the `Retry-After` header (seconds) or the `x-ratelimit-reset` header (an
+ * epoch-seconds timestamp). Returns undefined when neither is usable.
+ */
+export declare function getRateLimitWaitSeconds(headers: Headers): number | undefined;
+/**
+ * Classify a GitHub API response as a blocking error (rate limit / abuse
+ * detection / auth). Returns undefined when the response is not one of those
+ * conditions, so the caller can continue its normal parsing (including its
+ * own handling of 404s, empty repos, etc.).
+ */
+export declare function classifyGitHubResponse(status: number, headers: Headers, bodyText: string, context: string): CResult<never> | undefined;
+/**
+ * Perform a GitHub REST request through `apiFetch`, detecting rate-limit /
+ * auth / abuse-detection responses up front and applying bounded retries.
+ *
+ * On success returns the response together with its already-read body text
+ * (the body stream can only be consumed once). On a blocking or exhausted
+ * transient failure returns a typed CResult error. Non-blocking non-2xx
+ * responses (e.g. 404, or GitHub's "empty repository" 200) are returned as
+ * successes so the caller keeps its existing body-parsing logic.
+ *
+ * Retry policy:
+ * - Rate limit / abuse: wait once for the reset window, but only when it is
+ *   short (<= CHEAP_RATE_LIMIT_WAIT_MAX_SECONDS); otherwise surface the error
+ *   immediately. Long primary-limit resets are not worth blocking on.
+ * - Auth: never retried.
+ * - 5xx / network: capped exponential backoff, MAX_TRANSIENT_ATTEMPTS total.
+ */
+export declare function githubApiRequest(url: string, init: ApiFetchInit, context: string, 
+// Injectable request implementation. Defaults to the real `apiFetch`;
+// tests pass a fake so the retry/backoff logic can be exercised without
+// touching the network.
+fetchImpl?: (url: string, init: ApiFetchInit) => Promise<Response>): Promise<CResult<{
+    response: Response;
+    bodyText: string;
+}>>;
+//# sourceMappingURL=github-errors.d.mts.map

package/dist/types/utils/github-errors.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-errors.d.mts","sourceRoot":"","sources":["../../../src/utils/github-errors.mts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAkB3C,2EAA2E;AAC3E,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B,qCAAqC,CAAA;AAC5E,eAAO,MAAM,sBAAsB,iCAAiC,CAAA;AACpE,eAAO,MAAM,qBAAqB,+BAA+B,CAAA;AAWjE;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAgB5E;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,CA6D5B;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM;AACf,sEAAsE;AACtE,wEAAwE;AACxE,wBAAwB;AACxB,SAAS,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAY,GAC3E,OAAO,CAAC,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAoF5D"}

package/dist/types/utils/socket-json.d.mts

@@ -28,35 +28,55 @@ export interface SocketJson {
                 verbose?: boolean | undefined;
             };
             gradle?: {
+                // Root-only: gates auto-detection for socket manifest auto/gradle.
+                // Cascaded (any level): also skips that build root in
+                // dynamic-sbom-inference specifically.
                 disabled?: boolean | undefined;
-                bin?: string | undefined;
-                excludeConfigs?: string | undefined;
-                includeConfigs?: string | undefined;
+                // A field set to null explicitly clears an inherited cascade value
+                // (widens back to the tool default) instead of restating it.
+                bin?: string | undefined | null;
+                excludeConfigs?: string | undefined | null;
+                includeConfigs?: string | undefined | null;
                 facts?: boolean | undefined;
-                gradleOpts?: string | undefined;
+                gradleOpts?: string | undefined | null;
                 ignoreUnresolved?: boolean | undefined;
+                // JDK path; sets JAVA_HOME for this ecosystem's build tool. Supports
+                // $VAR/${VAR} expansion against the CLI's own environment.
+                javaHome?: string | undefined | null;
                 verbose?: boolean | undefined;
             };
             maven?: {
+                // Root-only: gates auto-detection for socket manifest auto/maven.
+                // Cascaded (any level): also skips that build root in
+                // dynamic-sbom-inference specifically.
                 disabled?: boolean | undefined;
-                bin?: string | undefined;
-                excludeConfigs?: string | undefined;
-                includeConfigs?: string | undefined;
+                bin?: string | undefined | null;
+                excludeConfigs?: string | undefined | null;
+                includeConfigs?: string | undefined | null;
                 ignoreUnresolved?: boolean | undefined;
-                mavenOpts?: string | undefined;
+                // JDK path; sets JAVA_HOME for this ecosystem's build tool. Supports
+                // $VAR/${VAR} expansion against the CLI's own environment.
+                javaHome?: string | undefined | null;
+                mavenOpts?: string | undefined | null;
                 verbose?: boolean | undefined;
             };
             sbt?: {
+                // Root-only: gates auto-detection for socket manifest auto/scala.
+                // Cascaded (any level): also skips that build root in
+                // dynamic-sbom-inference specifically.
                 disabled?: boolean | undefined;
-                infile?: string | undefined;
+                infile?: string | undefined | null;
                 stdin?: boolean | undefined;
-                bin?: string | undefined;
-                excludeConfigs?: string | undefined;
-                includeConfigs?: string | undefined;
+                bin?: string | undefined | null;
+                excludeConfigs?: string | undefined | null;
+                includeConfigs?: string | undefined | null;
                 facts?: boolean | undefined;
                 ignoreUnresolved?: boolean | undefined;
-                outfile?: string | undefined;
-                sbtOpts?: string | undefined;
+                // JDK path; sets JAVA_HOME for this ecosystem's build tool. Supports
+                // $VAR/${VAR} expansion against the CLI's own environment.
+                javaHome?: string | undefined | null;
+                outfile?: string | undefined | null;
+                sbtOpts?: string | undefined | null;
                 stdout?: boolean | undefined;
                 verbose?: boolean | undefined;
             };
@@ -81,6 +101,10 @@ export interface SocketJson {
 export declare function readOrDefaultSocketJson(cwd: string): SocketJson;
 export declare function findSocketJsonUp(cwd: string): Promise<string | undefined>;
 export declare function readOrDefaultSocketJsonUp(cwd: string): Promise<SocketJson>;
+// Cascades `defaults.manifest.*` from `rootSockJson` down to `dir`: each
+// ancestor's own socket.json, between `dir` and `boundaryDir` (exclusive),
+// merges in, nearest-to-`dir` winning field by field.
+export declare function readSocketJsonCascade(dir: string, boundaryDir: string, rootSockJson: SocketJson): SocketJson;
 export declare function getDefaultSocketJson(): SocketJson;
 export declare function readSocketJson(cwd: string, defaultOnError?: boolean): Promise<CResult<SocketJson>>;
 export declare function readSocketJsonSync(cwd: string, defaultOnError?: boolean): CResult<SocketJson>;

package/dist/types/utils/socket-json.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"socket-json.d.mts","sourceRoot":"","sources":["../../../src/utils/socket-json.mts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,MAAM,WAAW,UAAU;IACzB,+BAA+B,EAAE,MAAM,CAAA;IACvC,+BAA+B,EAAE,MAAM,CAAA;IACvC,+BAA+B,EAAE,MAAM,CAAA;IACvC,+BAA+B,EAAE,MAAM,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IAEf,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE;YACT,KAAK,CAAC,EAAE;gBACN,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC/B,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACpC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACxB,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC9B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACxB,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACnC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;aAC9B,CAAA;YACD,KAAK,CAAC,EAAE;gBACN,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC5B,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC3B,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC3B,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;aAC9B,CAAA;YACD,MAAM,CAAC,EAAE;gBACP,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC9B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACxB,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACnC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACnC,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC/B,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBACtC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;aAC9B,CAAA;YACD,KAAK,CAAC,EAAE;gBACN,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC9B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACxB,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACnC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACnC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBACtC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC9B,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;aAC9B,CAAA;YACD,GAAG,CAAC,EAAE;gBACJ,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC3B,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC3B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACxB,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACnC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACnC,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC3B,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBACtC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC5B,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC5B,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;aAC9B,CAAA;SACF,CAAA;QACD,IAAI,CAAC,EAAE;YACL,MAAM,CAAC,EAAE;gBACP,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAClC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACzB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;aAC/B,CAAA;YACD,MAAM,CAAC,EAAE;gBACP,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBACzB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACjC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;aAC3B,CAAA;SACF,CAAA;KACF,CAAA;CACF;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAM/D;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7B;AAED,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,wBAAgB,oBAAoB,IAAI,UAAU,CAUjD;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,cAAc,UAAQ,GACrB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAwD9B;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,cAAc,UAAQ,GACrB,OAAO,CAAC,UAAU,CAAC,CAuDrB;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,UAAU,GACnB,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAmB7B"}
+{"version":3,"file":"socket-json.d.mts","sourceRoot":"","sources":["../../../src/utils/socket-json.mts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,MAAM,WAAW,UAAU;IACzB,+BAA+B,EAAE,MAAM,CAAA;IACvC,+BAA+B,EAAE,MAAM,CAAA;IACvC,+BAA+B,EAAE,MAAM,CAAA;IACvC,+BAA+B,EAAE,MAAM,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IAEf,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE;YACT,KAAK,CAAC,EAAE;gBACN,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC/B,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACpC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACxB,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC9B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACxB,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACnC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;aAC9B,CAAA;YACD,KAAK,CAAC,EAAE;gBACN,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC5B,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC3B,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC3B,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;aAC9B,CAAA;YACD,MAAM,CAAC,EAAE;gBACP,mEAAmE;gBACnE,sDAAsD;gBACtD,uCAAuC;gBACvC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC9B,mEAAmE;gBACnE,6DAA6D;gBAC7D,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBAC1C,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBACtC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBACtC,qEAAqE;gBACrE,2DAA2D;gBAC3D,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBACpC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;aAC9B,CAAA;YACD,KAAK,CAAC,EAAE;gBACN,kEAAkE;gBAClE,sDAAsD;gBACtD,uCAAuC;gBACvC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC9B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBAC1C,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBACtC,qEAAqE;gBACrE,2DAA2D;gBAC3D,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBACpC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBACrC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;aAC9B,CAAA;YACD,GAAG,CAAC,EAAE;gBACJ,kEAAkE;gBAClE,sDAAsD;gBACtD,uCAAuC;gBACvC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBAClC,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC3B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBAC1C,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC3B,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBACtC,qEAAqE;gBACrE,2DAA2D;gBAC3D,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBACpC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBACnC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;gBACnC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC5B,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;aAC9B,CAAA;SACF,CAAA;QACD,IAAI,CAAC,EAAE;YACL,MAAM,CAAC,EAAE;gBACP,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAClC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACzB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;aAC/B,CAAA;YACD,MAAM,CAAC,EAAE;gBACP,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;gBACzB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBACjC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;gBAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;aAC3B,CAAA;SACF,CAAA;KACF,CAAA;CACF;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAM/D;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7B;AAED,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,UAAU,CAAC,CAQrB;AAyCD,yEAAyE;AACzE,2EAA2E;AAC3E,sDAAsD;AACtD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,UAAU,GACvB,UAAU,CAoBZ;AAED,wBAAgB,oBAAoB,IAAI,UAAU,CAUjD;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,cAAc,UAAQ,GACrB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAwD9B;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,cAAc,UAAQ,GACrB,OAAO,CAAC,UAAU,CAAC,CAuDrB;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,UAAU,GACnB,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAmB7B"}

package/dist/utils.js

@@ -23,12 +23,12 @@ var require$$11 = require('node:zlib');
 var fs$1 = require('../external/@socketsecurity/registry/lib/fs');
 var require$$1 = require('node:module');
 var os = require('node:os');
-var require$$13 = require('node:https');
-var web = require('node:stream/web');
 var url = require('../external/@socketsecurity/registry/lib/url');
 var agent = require('../external/@socketsecurity/registry/lib/agent');
 var bin = require('../external/@socketsecurity/registry/lib/bin');
 var packages = require('../external/@socketsecurity/registry/lib/packages');
+var require$$13 = require('node:https');
+var web = require('node:stream/web');
 var require$$0$1 = require('node:url');
 var globs = require('../external/@socketsecurity/registry/lib/globs');
 var streams = require('../external/@socketsecurity/registry/lib/streams');
@@ -5897,6 +5897,82 @@ async function readOrDefaultSocketJsonUp(cwd) {
   }
   return getDefaultSocketJson();
 }
+
+// Shallow-merges `defaults.manifest.<ecosystem>` per ecosystem: fields set in
+// `override` win, others fall through to `base`. Only this section cascades;
+// everything else in `defaults` comes from `base` only.
+function mergeManifestDefaults(base, override) {
+  const overrideManifest = override.defaults?.manifest;
+  if (!overrideManifest) {
+    return base;
+  }
+  const baseManifest = base.defaults?.manifest;
+  const mergedManifest = {
+    ...baseManifest
+  };
+  if (overrideManifest.bazel) {
+    mergedManifest.bazel = {
+      ...baseManifest?.bazel,
+      ...overrideManifest.bazel
+    };
+  }
+  if (overrideManifest.conda) {
+    mergedManifest.conda = {
+      ...baseManifest?.conda,
+      ...overrideManifest.conda
+    };
+  }
+  if (overrideManifest.gradle) {
+    mergedManifest.gradle = {
+      ...baseManifest?.gradle,
+      ...overrideManifest.gradle
+    };
+  }
+  if (overrideManifest.maven) {
+    mergedManifest.maven = {
+      ...baseManifest?.maven,
+      ...overrideManifest.maven
+    };
+  }
+  if (overrideManifest.sbt) {
+    mergedManifest.sbt = {
+      ...baseManifest?.sbt,
+      ...overrideManifest.sbt
+    };
+  }
+  return {
+    ...base,
+    defaults: {
+      ...base.defaults,
+      manifest: mergedManifest
+    }
+  };
+}
+
+// Cascades `defaults.manifest.*` from `rootSockJson` down to `dir`: each
+// ancestor's own socket.json, between `dir` and `boundaryDir` (exclusive),
+// merges in, nearest-to-`dir` winning field by field.
+function readSocketJsonCascade(dir, boundaryDir, rootSockJson) {
+  const boundary = path.resolve(boundaryDir);
+  let current = path.resolve(dir);
+  // Farthest-from-dir first, so the merge loop below applies overrides in
+  // increasing precedence and the nearest-to-dir file wins last.
+  const ancestorsFarToNear = [];
+  while (current !== boundary) {
+    if (fs.existsSync(path.join(current, constants.SOCKET_JSON))) {
+      const jsonCResult = readSocketJsonSync(current, true);
+      if (jsonCResult.ok) {
+        ancestorsFarToNear.unshift(jsonCResult.data);
+      }
+    }
+    const parent = path.dirname(current);
+    if (parent === current) {
+      break;
+    }
+    current = parent;
+  }
+  return ancestorsFarToNear.reduce(mergeManifestDefaults, rootSockJson);
+}
 function getDefaultSocketJson() {
   return {
     ' _____         _       _     ': `Local config file for Socket CLI tool ( ${constants.SOCKET_WEBSITE_URL}/npm/package/${constants.SOCKET_JSON.replace('.json', '')} ), to work with ${constants.SOCKET_WEBSITE_URL}`,
@@ -7330,6 +7406,228 @@ async function detectAndValidatePackageEnvironment(cwd, options) {
   };
 }
 
+/**
+ * GitHub API error detection for the raw-fetch `socket scan github` flow.
+ *
+ * The `socket scan github` command talks to the GitHub REST API directly
+ * through `apiFetch` (see utils/api.mts) rather than Octokit. That path used
+ * to read every response body and JSON-parse it without ever inspecting the
+ * HTTP status, so a rate-limit response (`403` with `x-ratelimit-remaining: 0`,
+ * `429`, or a secondary-limit body) was misread as "repo has no default
+ * branch / no manifests" and the run reported a silent success.
+ *
+ * This module centralizes:
+ * - Classifying a GitHub response as a blocking error (rate limit / abuse
+ *   detection / auth) with a clear, actionable message.
+ * - A bounded-retry request wrapper that respects `Retry-After` /
+ *   `x-ratelimit-reset` for short reset windows and retries transient 5xx /
+ *   network failures with capped exponential backoff.
+ */
+
+// GitHub returns 429 for some secondary rate limits; there is no shared
+// constant for it in constants.mts, so define it locally.
+const HTTP_STATUS_TOO_MANY_REQUESTS = 429;
+
+// Retry at most this many times for transient (5xx / network) failures,
+// counting the initial attempt.
+const MAX_TRANSIENT_ATTEMPTS = 3;
+
+// Cap for exponential backoff between transient retries.
+const MAX_BACKOFF_MS = 10_000;
+
+// Only wait-and-retry a rate-limited response when the reset window is at
+// most this many seconds. The usual primary-limit reset is up to an hour
+// away, which is not worth blocking a CLI run on — those surface immediately.
+const CHEAP_RATE_LIMIT_WAIT_MAX_SECONDS = 30;
+
+// Canonical `message` values returned for blocking conditions. Exported so
+// the scan loop can short-circuit on them without matching free-form strings.
+const GITHUB_ERR_ABUSE_DETECTION = 'GitHub abuse detection triggered';
+const GITHUB_ERR_AUTH_FAILED = 'GitHub authentication failed';
+const GITHUB_ERR_RATE_LIMIT = 'GitHub rate limit exceeded';
+
+// A blocking error means every subsequent repo will fail for the same
+// reason, so the scan loop should stop and surface it rather than silently
+// reporting "0 manifests".
+const BLOCKING_ERROR_MESSAGES = new Set([GITHUB_ERR_ABUSE_DETECTION, GITHUB_ERR_AUTH_FAILED, GITHUB_ERR_RATE_LIMIT]);
+
+/**
+ * Whether a CResult `message` is one of the blocking GitHub conditions
+ * (rate limit / abuse detection / auth) that should stop a multi-repo scan.
+ */
+function isGitHubBlockingError(message) {
+  return BLOCKING_ERROR_MESSAGES.has(message);
+}
+
+/**
+ * Seconds to wait before a rate-limited request could succeed, derived from
+ * the `Retry-After` header (seconds) or the `x-ratelimit-reset` header (an
+ * epoch-seconds timestamp). Returns undefined when neither is usable.
+ */
+function getRateLimitWaitSeconds(headers) {
+  const retryAfter = headers.get('retry-after');
+  if (retryAfter) {
+    const seconds = Number.parseInt(retryAfter, 10);
+    if (Number.isFinite(seconds) && seconds >= 0) {
+      return seconds;
+    }
+  }
+  const reset = headers.get('x-ratelimit-reset');
+  if (reset) {
+    const resetEpochSeconds = Number.parseInt(reset, 10);
+    if (Number.isFinite(resetEpochSeconds)) {
+      return Math.max(0, resetEpochSeconds - Math.floor(Date.now() / 1000));
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Classify a GitHub API response as a blocking error (rate limit / abuse
+ * detection / auth). Returns undefined when the response is not one of those
+ * conditions, so the caller can continue its normal parsing (including its
+ * own handling of 404s, empty repos, etc.).
+ */
+function classifyGitHubResponse(status, headers, bodyText, context) {
+  const lowerBody = bodyText.toLowerCase();
+
+  // Secondary / abuse rate limit. Check first since it is more specific than
+  // the standard rate limit and shares the 403 status.
+  if (status === constants.HTTP_STATUS_FORBIDDEN && (lowerBody.includes('secondary rate limit') || lowerBody.includes('abuse detection'))) {
+    return {
+      ok: false,
+      message: GITHUB_ERR_ABUSE_DETECTION,
+      cause: `GitHub abuse detection triggered while ${context}. ` + 'This happens when too many requests are made in a short period. ' + 'Wait a minute before retrying, and reduce the number of repos ' + 'scanned at once.'
+    };
+  }
+
+  // Standard rate limit: 429, or 403 with the quota exhausted
+  // (x-ratelimit-remaining: 0) or a rate-limit message in the body.
+  const remaining = headers.get('x-ratelimit-remaining');
+  if (status === HTTP_STATUS_TOO_MANY_REQUESTS || status === constants.HTTP_STATUS_FORBIDDEN && (remaining === '0' || lowerBody.includes('rate limit'))) {
+    const waitSeconds = getRateLimitWaitSeconds(headers);
+    const resetHint = waitSeconds === undefined ? 'Try again in a few minutes.' : `Try again in ${waitSeconds} second${waitSeconds === 1 ? '' : 's'}.`;
+    return {
+      ok: false,
+      message: GITHUB_ERR_RATE_LIMIT,
+      cause: `GitHub API rate limit exceeded on the supplied token while ${context}. ` + `${resetHint} ` + 'Authenticated requests get a far higher rate limit than ' + 'unauthenticated ones — set a valid GITHUB_TOKEN (or pass ' + '--github-token) if you have not already.'
+    };
+  }
+
+  // Authentication failure. The token is invalid/expired or lacks scopes;
+  // retrying with the same token will not help.
+  if (status === constants.HTTP_STATUS_UNAUTHORIZED) {
+    return {
+      ok: false,
+      message: GITHUB_ERR_AUTH_FAILED,
+      cause: `GitHub authentication failed while ${context}. ` + 'The token may be invalid, expired, or missing required scopes ' + '(read access to repository contents). Provide a valid GITHUB_TOKEN ' + '(or pass --github-token) and retry.'
+    };
+  }
+  return undefined;
+}
+function backoffMs(attempt) {
+  return Math.min(1000 * 2 ** (attempt - 1), MAX_BACKOFF_MS);
+}
+function sleep(ms) {
+  return new Promise(resolve => {
+    setTimeout(resolve, ms);
+  });
+}
+
+/**
+ * Perform a GitHub REST request through `apiFetch`, detecting rate-limit /
+ * auth / abuse-detection responses up front and applying bounded retries.
+ *
+ * On success returns the response together with its already-read body text
+ * (the body stream can only be consumed once). On a blocking or exhausted
+ * transient failure returns a typed CResult error. Non-blocking non-2xx
+ * responses (e.g. 404, or GitHub's "empty repository" 200) are returned as
+ * successes so the caller keeps its existing body-parsing logic.
+ *
+ * Retry policy:
+ * - Rate limit / abuse: wait once for the reset window, but only when it is
+ *   short (<= CHEAP_RATE_LIMIT_WAIT_MAX_SECONDS); otherwise surface the error
+ *   immediately. Long primary-limit resets are not worth blocking on.
+ * - Auth: never retried.
+ * - 5xx / network: capped exponential backoff, MAX_TRANSIENT_ATTEMPTS total.
+ */
+async function githubApiRequest(url, init, context,
+// Injectable request implementation. Defaults to the real `apiFetch`;
+// tests pass a fake so the retry/backoff logic can be exercised without
+// touching the network.
+fetchImpl = apiFetch) {
+  const method = init.method || 'GET';
+  let rateLimitWaitUsed = false;
+  for (let attempt = 1;; attempt += 1) {
+    debugApiRequest(method, url);
+    let response;
+    try {
+      // eslint-disable-next-line no-await-in-loop
+      response = await fetchImpl(url, init);
+      debugApiResponse(method, url, response.status);
+    } catch (e) {
+      debugApiResponse(method, url, undefined, e);
+      // Network-level failure (DNS, connection reset, timeout). Retry a few
+      // times with bounded backoff before giving up.
+      if (attempt < MAX_TRANSIENT_ATTEMPTS) {
+        debug$2.debugFn('notice', `retry: network error while ${context}`, attempt);
+        // eslint-disable-next-line no-await-in-loop
+        await sleep(backoffMs(attempt));
+        continue;
+      }
+      return {
+        ok: false,
+        message: 'Network error connecting to GitHub',
+        cause: formatErrorWithDetail(`Network error while ${context}`, e)
+      };
+    }
+
+    // eslint-disable-next-line no-await-in-loop
+    const bodyText = await response.text();
+    const blocking = classifyGitHubResponse(response.status, response.headers, bodyText, context);
+    if (blocking) {
+      // Auth failures never succeed on retry.
+      if (blocking.message === GITHUB_ERR_AUTH_FAILED) {
+        return blocking;
+      }
+      // Rate limit / abuse: retry once, but only when the reset window is
+      // short enough to be worth waiting on.
+      const waitSeconds = getRateLimitWaitSeconds(response.headers);
+      if (!rateLimitWaitUsed && waitSeconds !== undefined && waitSeconds <= CHEAP_RATE_LIMIT_WAIT_MAX_SECONDS) {
+        rateLimitWaitUsed = true;
+        logger.logger.info(`GitHub rate limit hit while ${context}; waiting ${waitSeconds}s before one retry...`);
+        // Add a second of slack so we retry just past the reset boundary.
+        // eslint-disable-next-line no-await-in-loop
+        await sleep((waitSeconds + 1) * 1000);
+        continue;
+      }
+      return blocking;
+    }
+
+    // Transient server errors: retry with bounded backoff, then surface.
+    if (response.status >= constants.HTTP_STATUS_INTERNAL_SERVER_ERROR) {
+      if (attempt < MAX_TRANSIENT_ATTEMPTS) {
+        debug$2.debugFn('notice', `retry: GitHub ${response.status} while ${context}`, attempt);
+        // eslint-disable-next-line no-await-in-loop
+        await sleep(backoffMs(attempt));
+        continue;
+      }
+      return {
+        ok: false,
+        message: 'GitHub server error',
+        cause: `GitHub server error (${response.status}) while ${context}. ` + 'GitHub may be experiencing issues; try again shortly.'
+      };
+    }
+    return {
+      ok: true,
+      data: {
+        response,
+        bodyText
+      }
+    };
+  }
+}
+
 // Check the public npm registry for a newer socket release.
 async function runSelfUpdateCheck() {
   await vendor.updater({
@@ -8424,6 +8722,7 @@ exports.apiFetch = apiFetch;
 exports.cacheFetch = cacheFetch;
 exports.captureException = captureException;
 exports.checkCommandInput = checkCommandInput;
+exports.classifyGitHubResponse = classifyGitHubResponse;
 exports.cmdFlagValueToArray = cmdFlagValueToArray;
 exports.cmdFlagsToString = cmdFlagsToString;
 exports.cmdPrefixMessage = cmdPrefixMessage;
@@ -8460,6 +8759,7 @@ exports.getDefaultOrgSlug = getDefaultOrgSlug;
 exports.getEcosystemChoicesForMeow = getEcosystemChoicesForMeow;
 exports.getEnterpriseOrgs = getEnterpriseOrgs;
 exports.getErrorCause = getErrorCause;
+exports.getErrorMessageOr = getErrorMessageOr;
 exports.getFlagApiRequirementsOutput = getFlagApiRequirementsOutput;
 exports.getFlagListOutput = getFlagListOutput;
 exports.getMajor = getMajor;
@@ -8490,6 +8790,8 @@ exports.gitPushBranch = gitPushBranch;
 exports.gitRemoteBranchExists = gitRemoteBranchExists;
 exports.gitResetAndClean = gitResetAndClean;
 exports.gitUnstagedModifiedFiles = gitUnstagedModifiedFiles;
+exports.githubApiRequest = githubApiRequest;
+exports.globWithGitIgnore = globWithGitIgnore;
 exports.globWorkspace = globWorkspace;
 exports.handleApiCall = handleApiCall;
 exports.handleApiCallNoSpinner = handleApiCallNoSpinner;
@@ -8502,6 +8804,7 @@ exports.installPnpmLinks = installPnpmLinks;
 exports.installYarnLinks = installYarnLinks;
 exports.isAddCommand = isAddCommand;
 exports.isConfigFromFlag = isConfigFromFlag;
+exports.isGitHubBlockingError = isGitHubBlockingError;
 exports.isHelpFlag = isHelpFlag;
 exports.isPnpmLockfileScanCommand = isPnpmLockfileScanCommand;
 exports.isReportSupportedFile = isReportSupportedFile;
@@ -8526,6 +8829,7 @@ exports.queryApiSafeTextWithStatus = queryApiSafeTextWithStatus;
 exports.readOrDefaultSocketJson = readOrDefaultSocketJson;
 exports.readOrDefaultSocketJsonUp = readOrDefaultSocketJsonUp;
 exports.readPnpmLockfile = readPnpmLockfile;
+exports.readSocketJsonCascade = readSocketJsonCascade;
 exports.readSocketJsonSync = readSocketJsonSync;
 exports.runAgentInstall = runAgentInstall;
 exports.runSelfUpdateCheck = runSelfUpdateCheck;
@@ -8556,5 +8860,5 @@ exports.walkNestedMap = walkNestedMap;
 exports.webLink = webLink;
 exports.withTmpDir = withTmpDir;
 exports.writeSocketJson = writeSocketJson;
-//# debugId=42fc0b13-4cfc-491d-a46f-94274b113cbc
+//# debugId=588541a6-eef9-410e-a3c6-6f594e50db6b
 //# sourceMappingURL=utils.js.map