@socketsecurity/lib 5.2.1 → 5.4.0

package/dist/releases/socket-btm.d.ts

@@ -1,221 +1,107 @@
 /**
- * Platform type for socket-btm binaries.
+ * @fileoverview Socket-btm release download utilities.
  */
-export type Platform = 'darwin' | 'linux' | 'win32';
+import { type Arch, type Libc, type Platform } from '../constants/platform.js';
+import { type AssetPattern } from './github.js';
+export type { Arch, Libc, Platform };
 /**
- * Architecture type for socket-btm binaries.
- */
-export type Arch = 'arm64' | 'x64';
-/**
- * Linux libc variant.
- */
-export type Libc = 'musl' | 'glibc';
-/**
- * Configuration for downloading socket-btm binary releases.
+ * Configuration for downloading socket-btm generic assets.
  */
-export interface SocketBtmBinaryConfig {
-    /**
-     * Working directory (defaults to process.cwd()).
-     */
+export interface SocketBtmAssetConfig {
+    /** Asset name or pattern on GitHub. */
+    asset: string | AssetPattern;
+    /** @internal Discriminator fields */
+    bin?: never;
+    /** Working directory (defaults to process.cwd()). */
     cwd?: string;
-    /**
-     * Download destination directory.
-     * Can be absolute or relative to cwd.
-     * @default 'build/downloaded' (relative to cwd)
-     *
-     * Inspired by: gh release download --dir
-     */
+    /** Download destination directory. @default 'build/downloaded' */
     downloadDir?: string;
-    /**
-     * Tool/package name for directory structure and release matching.
-     * Similar to: brew install <formula>, cargo install <crate>
-     *
-     * Examples: 'node-smol', 'binject', 'binflate'
-     *
-     * Used for:
-     * - Directory path: {downloadDir}/{tool}/{platformArch}/
-     * - Finding release: Searches for tags starting with '{tool}-'
-     */
-    tool: string;
-    /**
-     * Binary/executable name (without extension).
-     * Similar to: brew formula→binary mapping (postgresql→psql, imagemagick→magick)
-     *
-     * Examples: 'node', 'binject', 'psql', 'magick'
-     *
-     * Used to construct:
-     * - Asset pattern: {bin}-{platform}-{arch}[-musl][.exe]
-     * - Output filename: {bin} or {bin}.exe
-     *
-     * Presence of this field indicates binary download (vs asset download).
-     *
-     * @default tool (e.g., 'binject'→'binject', but 'node-smol'→'node-smol')
-     */
-    bin?: string;
-    /**
-     * Target platform (defaults to current platform).
-     */
-    targetPlatform?: Platform;
-    /**
-     * Target architecture (defaults to current arch).
-     */
-    targetArch?: Arch;
-    /**
-     * Linux libc variant (musl or glibc).
-     * Defaults to musl for Linux for broader compatibility.
-     * Ignored for non-Linux platforms.
-     */
-    libc?: Libc;
-    /**
-     * Specific release tag to download.
-     * Inspired by: gh release download <tag>
-     *
-     * If not provided, downloads the latest release matching '{tool}-*' pattern.
-     *
-     * Examples: 'node-smol-20260105-c47753c', 'binject-20260106-1df5745'
-     */
-    tag?: string;
-    /**
-     * Suppress log messages.
-     * @default false
-     */
+    /** @internal Discriminator fields */
+    libc?: never;
+    /** Output filename. @default resolved asset name */
+    output?: string;
+    /** Suppress log messages. @default false */
     quiet?: boolean;
-    /**
-     * Remove macOS quarantine attribute after download.
-     * Only applies when downloading on macOS for macOS binaries.
-     * @default true
-     */
+    /** Remove macOS quarantine attribute after download. @default false */
     removeMacOSQuarantine?: boolean;
-    // Discriminator: presence of 'asset' means this is NOT a binary config
-    asset?: never;
+    /** Specific release tag to download. */
+    tag?: string;
+    /** @internal Discriminator fields */
+    targetArch?: never;
+    /** @internal Discriminator fields */
+    targetPlatform?: never;
+    /** Tool/package name for directory structure and release matching. */
+    tool: string;
 }
 /**
- * Configuration for downloading socket-btm generic assets.
+ * Configuration for downloading socket-btm binary releases.
  */
-export interface SocketBtmAssetConfig {
-    /**
-     * Working directory (defaults to process.cwd()).
-     */
+export interface SocketBtmBinaryConfig {
+    /** @internal Discriminator field */
+    asset?: never;
+    /** Binary/executable name (without extension). @default tool */
+    bin?: string;
+    /** Working directory (defaults to process.cwd()). */
     cwd?: string;
-    /**
-     * Download destination directory.
-     * Can be absolute or relative to cwd.
-     * @default 'build/downloaded' (relative to cwd)
-     *
-     * Inspired by: gh release download --dir
-     */
+    /** Download destination directory. @default 'build/downloaded' */
     downloadDir?: string;
-    /**
-     * Tool/package name for directory structure and release matching.
-     *
-     * Examples: 'yoga-layout', 'onnxruntime', 'models'
-     *
-     * Used for:
-     * - Directory path: {downloadDir}/{tool}/assets/
-     * - Finding release: Searches for tags starting with '{tool}-'
-     */
-    tool: string;
-    /**
-     * Asset name pattern on GitHub.
-     * Inspired by: gh release download --pattern
-     *
-     * Examples: 'yoga-sync.mjs', 'ort-wasm-simd.wasm', '*.onnx'
-     *
-     * Presence of this field indicates asset download (vs binary download).
-     */
-    asset: string;
-    /**
-     * Output filename (e.g., 'yoga-sync.mjs').
-     * Inspired by: gh release download --output
-     *
-     * @default asset (uses the asset name as-is)
-     */
-    output?: string;
-    /**
-     * Specific release tag to download.
-     * Inspired by: gh release download <tag>
-     *
-     * If not provided, downloads the latest release matching '{tool}-*' pattern.
-     *
-     * Examples: 'yoga-layout-v20260106-a39285c', 'onnxruntime-v20260106-a39285c'
-     */
-    tag?: string;
-    /**
-     * Suppress log messages.
-     * @default false
-     */
+    /** Linux libc variant. Auto-detected if not specified. */
+    libc?: Libc;
+    /** Suppress log messages. @default false */
     quiet?: boolean;
-    /**
-     * Remove macOS quarantine attribute after download.
-     * @default false (not needed for non-executable assets)
-     */
+    /** Remove macOS quarantine attribute after download. @default true */
     removeMacOSQuarantine?: boolean;
-    // Discriminators: mutually exclusive with binary-specific fields
-    bin?: never;
-    targetPlatform?: never;
-    targetArch?: never;
-    libc?: never;
+    /** Specific release tag to download. */
+    tag?: string;
+    /** Target architecture (defaults to current arch). */
+    targetArch?: Arch;
+    /** Target platform (defaults to current platform). */
+    targetPlatform?: Platform;
+    /** Tool/package name for directory structure and release matching. */
+    tool: string;
 }
 /**
  * Configuration for downloading socket-btm releases (binary or asset).
  */
 export type SocketBtmReleaseConfig = SocketBtmBinaryConfig | SocketBtmAssetConfig;
 /**
- * Download a release from socket-btm.
+ * Detect the libc variant (musl or glibc) on Linux systems.
+ * Returns undefined for non-Linux platforms.
  *
- * Generic function for downloading any socket-btm binary or asset.
- * Handles both platform-specific binaries and generic assets.
+ * @returns 'musl', 'glibc', or undefined (for non-Linux)
+ */
+export declare function detectLibc(): Libc | undefined;
+/**
+ * Download a release from socket-btm.
  *
  * @param config - Download configuration
  * @returns Path to the downloaded file
+ */
+export declare function downloadSocketBtmRelease(config: SocketBtmReleaseConfig): Promise<string>;
+/**
+ * Get asset name for a socket-btm binary.
  *
- * @example
- * ```ts
- * // Binary: node-smol (like: brew install nodejs → node)
- * const nodePath = await downloadSocketBtmRelease({
- *   tool: 'node-smol',
- *   bin: 'node'
- * })
- *
- * // Binary: binject (like: cargo install binject → binject)
- * const binjectPath = await downloadSocketBtmRelease({
- *   tool: 'binject'
- * })
- *
- * // Binary: cross-platform
- * const binflatePath = await downloadSocketBtmRelease({
- *   tool: 'binflate',
- *   targetPlatform: 'linux',
- *   targetArch: 'x64',
- *   libc: 'musl'
- * })
- *
- * // Asset: WASM file
- * const yogaPath = await downloadSocketBtmRelease({
- *   tool: 'yoga-layout',
- *   asset: 'yoga-sync.mjs'
- * })
- *
- * // Asset: with custom output name
- * const ortPath = await downloadSocketBtmRelease({
- *   tool: 'onnxruntime',
- *   asset: 'ort-wasm-simd.wasm',
- *   output: 'ort.wasm'
- * })
+ * @param binaryBaseName - Binary basename (e.g., 'binject', 'node')
+ * @param platform - Target platform
+ * @param arch - Target architecture
+ * @param libc - Linux libc variant (optional)
+ * @returns Asset name (e.g., 'binject-darwin-arm64', 'node-linux-x64-musl')
+ */
+export declare function getBinaryAssetName(binaryBaseName: string, platform: Platform, arch: Arch, libc?: Libc | undefined): string;
+/**
+ * Get binary filename for output.
  *
- * // Custom paths (like: gh release download --dir)
- * await downloadSocketBtmRelease({
- *   tool: 'node-smol',
- *   bin: 'node',
- *   cwd: '/path/to/project',
- *   downloadDir: 'build/cache'
- * })
+ * @param binaryBaseName - Binary basename (e.g., 'node', 'binject')
+ * @param platform - Target platform
+ * @returns Binary filename (e.g., 'node', 'node.exe')
+ */
+export declare function getBinaryName(binaryBaseName: string, platform: Platform): string;
+/**
+ * Get platform-arch identifier for directory structure.
  *
- * // Specific version (like: gh release download <tag>)
- * await downloadSocketBtmRelease({
- *   tool: 'binject',
- *   tag: 'binject-20260106-1df5745'
- * })
- * ```
+ * @param platform - Target platform
+ * @param arch - Target architecture
+ * @param libc - Linux libc variant (optional)
+ * @returns Platform-arch identifier (e.g., 'darwin-arm64', 'linux-x64-musl')
  */
-export declare function downloadSocketBtmRelease(config: SocketBtmReleaseConfig): Promise<string>;
+export declare function getPlatformArch(platform: Platform, arch: Arch, libc?: Libc | undefined): string;

package/dist/releases/socket-btm.js

@@ -1,10 +1,8 @@
 "use strict";
 /* Socket Lib - Built with esbuild */
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -18,54 +16,52 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var socket_btm_exports = {};
 __export(socket_btm_exports, {
-  downloadSocketBtmRelease: () => downloadSocketBtmRelease
+  detectLibc: () => detectLibc,
+  downloadSocketBtmRelease: () => downloadSocketBtmRelease,
+  getBinaryAssetName: () => getBinaryAssetName,
+  getBinaryName: () => getBinaryName,
+  getPlatformArch: () => getPlatformArch
 });
 module.exports = __toCommonJS(socket_btm_exports);
-var import_node_os = __toESM(require("node:os"));
+var import_platform = require("../constants/platform.js");
 var import_github = require("./github.js");
 const ARCH_MAP = {
+  __proto__: null,
   arm64: "arm64",
   x64: "x64"
 };
-function getBinaryAssetName(binaryBaseName, platform, arch, libc) {
-  const mappedArch = ARCH_MAP[arch];
-  if (!mappedArch) {
-    throw new Error(`Unsupported architecture: ${arch}`);
-  }
-  const muslSuffix = platform === "linux" && libc === "musl" ? "-musl" : "";
-  const ext = platform === "win32" ? ".exe" : "";
-  if (platform === "darwin") {
-    return `${binaryBaseName}-darwin-${mappedArch}${ext}`;
-  }
-  if (platform === "linux") {
-    return `${binaryBaseName}-linux-${mappedArch}${muslSuffix}${ext}`;
-  }
-  if (platform === "win32") {
-    return `${binaryBaseName}-win-${mappedArch}${ext}`;
+let _fs;
+// @__NO_SIDE_EFFECTS__
+function getFs() {
+  if (_fs === void 0) {
+    _fs = require("fs");
   }
-  throw new Error(`Unsupported platform: ${platform}`);
+  return _fs;
 }
-function getPlatformArch(platform, arch, libc) {
-  const mappedArch = ARCH_MAP[arch];
-  if (!mappedArch) {
-    throw new Error(`Unsupported architecture: ${arch}`);
+function detectLibc() {
+  if ((0, import_platform.getPlatform)() !== "linux") {
+    return void 0;
+  }
+  try {
+    const fs = /* @__PURE__ */ getFs();
+    const muslPaths = [
+      "/lib/ld-musl-x86_64.so.1",
+      "/lib/ld-musl-aarch64.so.1",
+      "/usr/lib/ld-musl-x86_64.so.1",
+      "/usr/lib/ld-musl-aarch64.so.1"
+    ];
+    for (const path of muslPaths) {
+      if (fs.existsSync(path)) {
+        return "musl";
+      }
+    }
+    return "glibc";
+  } catch {
+    return "glibc";
   }
-  const muslSuffix = platform === "linux" && libc === "musl" ? "-musl" : "";
-  return `${platform}-${mappedArch}${muslSuffix}`;
-}
-function getBinaryName(binaryBaseName, platform) {
-  return platform === "win32" ? `${binaryBaseName}.exe` : binaryBaseName;
 }
 async function downloadSocketBtmRelease(config) {
   const { cwd, downloadDir, quiet = false, tag, tool } = config;
@@ -77,7 +73,38 @@ async function downloadSocketBtmRelease(config) {
       output,
       removeMacOSQuarantine = false
     } = config;
-    const outputName = output || asset;
+    let resolvedAsset;
+    let resolvedTag = tag;
+    const isExactMatch = typeof asset === "string" && !asset.includes("*");
+    if (isExactMatch) {
+      resolvedAsset = asset;
+    } else {
+      if (tag) {
+        throw new Error(
+          "Cannot use asset pattern with explicit tag. Either provide exact asset name or omit tag."
+        );
+      }
+      resolvedTag = await (0, import_github.getLatestRelease)(toolPrefix, import_github.SOCKET_BTM_REPO, {
+        assetPattern: asset,
+        quiet
+      });
+      if (!resolvedTag) {
+        throw new Error(`No ${tool} release with matching asset pattern found`);
+      }
+      const assetUrl = await (0, import_github.getReleaseAssetUrl)(
+        resolvedTag,
+        asset,
+        import_github.SOCKET_BTM_REPO,
+        {
+          quiet
+        }
+      );
+      if (!assetUrl) {
+        throw new Error(`No matching asset found in release ${resolvedTag}`);
+      }
+      resolvedAsset = assetUrl.split("/").pop() || asset.toString();
+    }
+    const outputName = output || resolvedAsset;
     const platformArch = "assets";
     downloadConfig = {
       owner: import_github.SOCKET_BTM_REPO.owner,
@@ -87,27 +114,29 @@ async function downloadSocketBtmRelease(config) {
       toolName: tool,
       platformArch,
       binaryName: outputName,
-      assetName: asset,
+      assetName: resolvedAsset,
       toolPrefix,
-      tag,
+      tag: resolvedTag,
       quiet,
       removeMacOSQuarantine
     };
   } else {
     const {
       bin,
-      libc,
+      libc = detectLibc(),
       removeMacOSQuarantine = true,
-      targetArch,
-      targetPlatform
+      targetArch = (0, import_platform.getArch)(),
+      targetPlatform = (0, import_platform.getPlatform)()
     } = config;
     const baseName = bin || tool;
-    const platform = targetPlatform || import_node_os.default.platform();
-    const arch = targetArch || import_node_os.default.arch();
-    const libcType = libc || (platform === "linux" ? "musl" : void 0);
-    const assetName = getBinaryAssetName(baseName, platform, arch, libcType);
-    const platformArch = getPlatformArch(platform, arch, libcType);
-    const binaryName = getBinaryName(baseName, platform);
+    const assetName = getBinaryAssetName(
+      baseName,
+      targetPlatform,
+      targetArch,
+      libc
+    );
+    const platformArch = getPlatformArch(targetPlatform, targetArch, libc);
+    const binaryName = getBinaryName(baseName, targetPlatform);
     downloadConfig = {
       owner: import_github.SOCKET_BTM_REPO.owner,
       repo: import_github.SOCKET_BTM_REPO.repo,
@@ -125,7 +154,40 @@ async function downloadSocketBtmRelease(config) {
   }
   return await (0, import_github.downloadGitHubRelease)(downloadConfig);
 }
+function getBinaryAssetName(binaryBaseName, platform, arch, libc) {
+  const mappedArch = ARCH_MAP[arch];
+  if (!mappedArch) {
+    throw new Error(`Unsupported architecture: ${arch}`);
+  }
+  const muslSuffix = platform === "linux" && libc === "musl" ? "-musl" : "";
+  const ext = platform === "win32" ? ".exe" : "";
+  if (platform === "darwin") {
+    return `${binaryBaseName}-darwin-${mappedArch}${ext}`;
+  }
+  if (platform === "linux") {
+    return `${binaryBaseName}-linux-${mappedArch}${muslSuffix}${ext}`;
+  }
+  if (platform === "win32") {
+    return `${binaryBaseName}-win-${mappedArch}${ext}`;
+  }
+  throw new Error(`Unsupported platform: ${platform}`);
+}
+function getBinaryName(binaryBaseName, platform) {
+  return platform === "win32" ? `${binaryBaseName}.exe` : binaryBaseName;
+}
+function getPlatformArch(platform, arch, libc) {
+  const mappedArch = ARCH_MAP[arch];
+  if (!mappedArch) {
+    throw new Error(`Unsupported architecture: ${arch}`);
+  }
+  const muslSuffix = platform === "linux" && libc === "musl" ? "-musl" : "";
+  return `${platform}-${mappedArch}${muslSuffix}`;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  downloadSocketBtmRelease
+  detectLibc,
+  downloadSocketBtmRelease,
+  getBinaryAssetName,
+  getBinaryName,
+  getPlatformArch
 });

package/dist/signal-exit.js

@@ -35,7 +35,7 @@ let _events;
 // @__NO_SIDE_EFFECTS__
 function getEvents() {
   if (_events === void 0) {
-    _events = require("node:events");
+    _events = require("events");
   }
   return _events;
 }

package/dist/spawn.js

@@ -37,13 +37,20 @@ __export(spawn_exports, {
 module.exports = __toCommonJS(spawn_exports);
 var import_process = require("./constants/process");
 var import_promise_spawn = __toESM(require("./external/@npmcli/promise-spawn"));
-var import_node_path = __toESM(require("node:path"));
 var import_arrays = require("./arrays");
 var import_bin = require("./bin");
 var import_normalize = require("./paths/normalize");
 var import_objects = require("./objects");
 var import_spinner = require("./spinner");
 var import_strings = require("./strings");
+let _path;
+// @__NO_SIDE_EFFECTS__
+function getPath() {
+  if (_path === void 0) {
+    _path = require("path");
+  }
+  return _path;
+}
 const abortSignal = (0, import_process.getAbortSignal)();
 const spinner = (0, import_spinner.getDefaultSpinner)();
 const windowsScriptExtRegExp = /\.(?:cmd|bat|ps1)$/i;
@@ -51,7 +58,7 @@ let _child_process;
 // @__NO_SIDE_EFFECTS__
 function getChildProcess() {
   if (_child_process === void 0) {
-    _child_process = require("node:child_process");
+    _child_process = require("child_process");
   }
   return _child_process;
 }
@@ -102,7 +109,7 @@ function spawn(cmd, args, options, extra) {
   }
   const WIN32 = process.platform === "win32";
   if (WIN32 && shell && windowsScriptExtRegExp.test(actualCmd)) {
-    actualCmd = import_node_path.default.basename(actualCmd, import_node_path.default.extname(actualCmd));
+    actualCmd = (/* @__PURE__ */ getPath()).basename(actualCmd, (/* @__PURE__ */ getPath()).extname(actualCmd));
   }
   const wasSpinning = !!spinnerInstance?.isSpinning;
   const shouldStopSpinner = wasSpinning && !/* @__PURE__ */ isStdioType(stdio, "ignore") && !/* @__PURE__ */ isStdioType(stdio, "pipe");
@@ -181,7 +188,7 @@ function spawnSync(cmd, args, options) {
   const shell = (0, import_objects.getOwn)(options, "shell");
   const WIN32 = process.platform === "win32";
   if (WIN32 && shell && windowsScriptExtRegExp.test(actualCmd)) {
-    actualCmd = import_node_path.default.basename(actualCmd, import_node_path.default.extname(actualCmd));
+    actualCmd = (/* @__PURE__ */ getPath()).basename(actualCmd, (/* @__PURE__ */ getPath()).extname(actualCmd));
   }
   const { stripAnsi: shouldStripAnsi = true, ...rawSpawnOptions } = {
     __proto__: null,

package/dist/stdio/mask.d.ts

@@ -1,24 +1,4 @@
-/**
- * @fileoverview Interactive output masking utilities for CLI tools.
- * Provides output control with keyboard toggling (ctrl+o).
- *
- * ANSI Escape Sequences Used:
- * - '\r': Carriage return - moves cursor to beginning of current line.
- * - '\x1b[K' or '\x1b[0K': CSI K (erase line) - clear from cursor to end of line.
- * - '\x1b[2K': CSI 2K - erase entire line.
- * - '\x1b[1A': CSI A - move cursor up 1 line.
- *
- * Terminal Control:
- * - Raw mode (setRawMode(true)): Captures keypresses immediately without buffering.
- * - TTY detection: Ensures terminal manipulation only occurs in interactive terminals.
- *
- * Key Features:
- * - Output buffering: Stores up to 1000 lines when masked to prevent memory issues.
- * - Graceful cleanup: Always restores terminal to normal mode on exit/error.
- * - Visual feedback: Uses spinner to indicate process is running when output is masked.
- */
 import type { ChildProcess, SpawnOptions } from 'child_process';
-import readline from 'readline';
 export interface OutputMaskOptions {
     /**
      * Current working directory for spawned process.
@@ -120,7 +100,11 @@ export declare function createOutputMask(options?: OutputMaskOptions): OutputMas
  * - ctrl+c: Cancel the running process.
  * The handler manipulates terminal state using ANSI escape sequences.
  */
-export declare function createKeyboardHandler(mask: OutputMask, child: ChildProcess, options?: OutputMaskOptions): (_str: string, key: readline.Key) => void;
+type ReadlineKey = {
+    ctrl?: boolean;
+    name?: string;
+};
+export declare function createKeyboardHandler(mask: OutputMask, child: ChildProcess, options?: OutputMaskOptions): (_str: string, key: ReadlineKey) => void;
 /**
  * Attach output masking to a child process.
  * Returns a promise that resolves with the exit code.
@@ -138,3 +122,4 @@ export declare function attachOutputMask(child: ChildProcess, options?: OutputMa
  * stdin is inherited, stdout and stderr are piped for masking control.
  */
 export declare function runWithMask(command: string, args?: string[], options?: OutputMaskOptions & SpawnOptions): Promise<number>;
+export {};