@socketsecurity/lib 5.25.1 → 5.26.1

package/dist/process-lock.js

@@ -28,6 +28,7 @@ var import_fs = require("./fs");
 var import_logger = require("./logger");
 var import_promises = require("./promises");
 var import_signal_exit = require("./signal-exit");
+var import_primordials = require("./primordials");
 let _fs;
 // @__NO_SIDE_EFFECTS__
 function getFs() {
@@ -46,8 +47,8 @@ function getPath() {
 }
 const logger = (0, import_logger.getDefaultLogger)();
 class ProcessLockManager {
-  activeLocks = /* @__PURE__ */ new Set();
-  touchTimers = /* @__PURE__ */ new Map();
+  activeLocks = new import_primordials.SetCtor();
+  touchTimers = new import_primordials.MapCtor();
   exitHandlerRegistered = false;
   /**
    * Ensure process exit handler is registered for cleanup.
@@ -84,7 +85,7 @@ class ProcessLockManager {
     try {
       const fs = /* @__PURE__ */ getFs();
       if (fs.existsSync(lockPath)) {
-        const now = Date.now() / 1e3;
+        const now = (0, import_primordials.DateNow)() / 1e3;
         fs.utimesSync(lockPath, now, now);
       }
     } catch (e) {
@@ -135,7 +136,7 @@ class ProcessLockManager {
       if (!stats) {
         return false;
       }
-      return Date.now() - stats.mtime.getTime() > staleMs;
+      return (0, import_primordials.DateNow)() - stats.mtime.getTime() > staleMs;
     } catch {
       return false;
     }
@@ -195,29 +196,29 @@ class ProcessLockManager {
           const code = e.code;
           if (code === "EEXIST") {
             if (this.isStale(lockPath, staleMs)) {
-              throw new Error(`Stale lock detected: ${lockPath}`);
+              throw new import_primordials.ErrorCtor(`Stale lock detected: ${lockPath}`);
             }
-            throw new Error(`Lock already exists: ${lockPath}`);
+            throw new import_primordials.ErrorCtor(`Lock already exists: ${lockPath}`);
           }
           if (code === "EACCES" || code === "EPERM") {
-            throw new Error(
+            throw new import_primordials.ErrorCtor(
               `Permission denied creating lock: ${lockPath}. Check directory permissions or run with appropriate access.`,
               { cause: e }
             );
           }
           if (code === "EROFS") {
-            throw new Error(
+            throw new import_primordials.ErrorCtor(
               `Cannot create lock on read-only filesystem: ${lockPath}`,
               { cause: e }
             );
           }
           if (code === "ENOTDIR") {
-            const lastSlashIndex = Math.max(
+            const lastSlashIndex = (0, import_primordials.MathMax)(
               lockPath.lastIndexOf("/"),
               lockPath.lastIndexOf("\\")
             );
             const parentDir = lastSlashIndex === -1 ? "." : lockPath.slice(0, lastSlashIndex);
-            throw new Error(
+            throw new import_primordials.ErrorCtor(
               `Cannot create lock directory: ${lockPath}
 A path component is a file when it should be a directory.
 Parent path: ${parentDir}
@@ -229,12 +230,12 @@ To resolve:
             );
           }
           if (code === "ENOENT") {
-            const lastSlashIndex = Math.max(
+            const lastSlashIndex = (0, import_primordials.MathMax)(
               lockPath.lastIndexOf("/"),
               lockPath.lastIndexOf("\\")
             );
             const parentDir = lastSlashIndex === -1 ? "." : lockPath.slice(0, lastSlashIndex);
-            throw new Error(
+            throw new import_primordials.ErrorCtor(
               `Cannot create lock directory: ${lockPath}
 Parent directory does not exist: ${parentDir}
 To resolve:
@@ -244,7 +245,7 @@ To resolve:
               { cause: e }
             );
           }
-          throw new Error(`Failed to acquire lock: ${lockPath}`, {
+          throw new import_primordials.ErrorCtor(`Failed to acquire lock: ${lockPath}`, {
             cause: e
           });
         }

package/dist/promise-queue.js

@@ -23,6 +23,7 @@ __export(promise_queue_exports, {
   PromiseQueue: () => PromiseQueue
 });
 module.exports = __toCommonJS(promise_queue_exports);
+var import_primordials = require("./primordials");
 class PromiseQueue {
   queue = [];
   running = 0;
@@ -41,7 +42,7 @@ class PromiseQueue {
     this.maxConcurrency = maxConcurrency;
     this.maxQueueLength = maxQueueLength;
     if (maxConcurrency < 1) {
-      throw new Error("maxConcurrency must be at least 1");
+      throw new import_primordials.ErrorCtor("maxConcurrency must be at least 1");
     }
   }
   /**
@@ -51,9 +52,9 @@ class PromiseQueue {
    * with "Task dropped: queue length exceeded" if the queue is full.
    */
   async add(fn) {
-    return await new Promise((resolve, reject) => {
+    return await new import_primordials.PromiseCtor((resolve, reject) => {
       if (this.maxQueueLength !== void 0 && this.queue.length >= this.maxQueueLength) {
-        reject(new Error("Task dropped: queue length exceeded"));
+        reject(new import_primordials.ErrorCtor("Task dropped: queue length exceeded"));
         return;
       }
       const task = { fn, resolve, reject };
@@ -71,10 +72,17 @@ class PromiseQueue {
       return;
     }
     this.running++;
-    Promise.resolve().then(() => task.fn()).then(task.resolve).catch(task.reject).finally(() => {
-      this.running--;
-      this.runNext();
-    });
+    (async () => {
+      try {
+        const result = await task.fn();
+        task.resolve(result);
+      } catch (err) {
+        task.reject(err);
+      } finally {
+        this.running--;
+        this.runNext();
+      }
+    })();
   }
   notifyIdleIfNeeded() {
     if (this.running === 0 && this.queue.length === 0) {
@@ -91,7 +99,7 @@ class PromiseQueue {
     if (this.running === 0 && this.queue.length === 0) {
       return;
     }
-    return await new Promise((resolve) => {
+    return await new import_primordials.PromiseCtor((resolve) => {
       this.idleResolvers.push(resolve);
     });
   }
@@ -114,7 +122,7 @@ class PromiseQueue {
     const pending = this.queue;
     this.queue = [];
     for (const task of pending) {
-      task.reject(new Error("Task cancelled: queue cleared"));
+      task.reject(new import_primordials.ErrorCtor("Task cancelled: queue cleared"));
     }
     this.notifyIdleIfNeeded();
   }

package/dist/promises.d.ts

@@ -460,12 +460,13 @@ export interface PromiseWithResolvers<T> {
  * handles as first-class values, per
  * [ECMA-262 §27.2.4.9](https://tc39.es/ecma262/#sec-promise.withResolvers).
  *
- * Bound to native `Promise.withResolvers` when available (Node 20.12+ /
- * 21+ / 22+; V8 ≥ 12.0); otherwise falls back to a spec-equivalent
- * `new Promise(executor)` implementation that captures the handles via
- * closure. The returned object always has own data properties `promise`,
- * `resolve`, `reject` on `Object.prototype` — writable, enumerable, and
- * configurable — matching the spec's `CreateDataPropertyOrThrow` steps.
+ * Uses the `PromiseWithResolvers` primordial (already bound) when
+ * available (Node 20.12+ / 21+ / 22+; V8 ≥ 12.0); otherwise falls back
+ * to a spec-equivalent `new Promise(executor)` that captures the
+ * handles via closure. The returned object always has own data
+ * properties `promise`, `resolve`, `reject` on `Object.prototype` —
+ * writable, enumerable, and configurable — matching the spec's
+ * `CreateDataPropertyOrThrow` steps.
  *
  * Use this instead of the manual
  * `let resolve; const p = new Promise(r => { resolve = r })` dance for
@@ -481,3 +482,25 @@ export interface PromiseWithResolvers<T> {
  * ```
  */
 export declare const withResolvers: <T>() => PromiseWithResolvers<T>;
+/**
+ * Drain an async iterable into an array, per
+ * [TC39 Array.fromAsync](https://tc39.es/proposal-array-from-async/).
+ *
+ * Uses the `ArrayFromAsync` primordial (already bound) when available
+ * (Node 22+; V8 ≥ 12.0); otherwise falls back to a `for await…of` +
+ * push loop.
+ *
+ * Use this instead of the manual
+ * `const out = []; for await (const x of iter) out.push(x); return out`
+ * dance when collecting an async iterator's values.
+ *
+ * Like the native, this only handles the unary form (no `mapFn` /
+ * `thisArg` overload).
+ *
+ * @example
+ * ```typescript
+ * import { glob } from 'node:fs/promises'
+ * const files = await fromAsync(glob('**\/*.ts', { cwd: '/tmp/proj' }))
+ * ```
+ */
+export declare const fromAsync: <T>(source: AsyncIterable<T> | Iterable<T | PromiseLike<T>>) => Promise<T[]>;

package/dist/promises.js

@@ -20,6 +20,7 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var promises_exports = {};
 __export(promises_exports, {
+  fromAsync: () => fromAsync,
   normalizeIterationOptions: () => normalizeIterationOptions,
   normalizeRetryOptions: () => normalizeRetryOptions,
   pEach: () => pEach,
@@ -34,6 +35,7 @@ module.exports = __toCommonJS(promises_exports);
 var import_arrays = require("./arrays");
 var import_core = require("./constants/core");
 var import_process = require("./constants/process");
+var import_primordials = require("./primordials");
 const abortSignal = (0, import_process.getAbortSignal)();
 let _timers;
 // @__NO_SIDE_EFFECTS__
@@ -54,7 +56,7 @@ function normalizeIterationOptions(options) {
     // AbortSignal used to support cancellation.
     signal = abortSignal
   } = { __proto__: null, ...opts };
-  const normalizedConcurrency = Math.max(1, concurrency);
+  const normalizedConcurrency = (0, import_primordials.MathMax)(1, concurrency);
   const retryOpts = /* @__PURE__ */ resolveRetryOptions(retries);
   return {
     __proto__: null,
@@ -111,7 +113,7 @@ async function pEach(array, callbackFn, options) {
     if (signal?.aborted) {
       return;
     }
-    await Promise.allSettled(
+    await (0, import_primordials.PromiseAllSettled)(
       chunk.map(
         (item) => /* @__PURE__ */ pRetry((...args) => callbackFn(args[0]), {
           ...retries,
@@ -158,7 +160,7 @@ async function pFilterChunk(chunks, callbackFn, options) {
       filteredChunks[i] = [];
     } else {
       const chunk = chunks[i];
-      const settled = await Promise.allSettled(
+      const settled = await (0, import_primordials.PromiseAllSettled)(
         chunk.map(
           (value) => /* @__PURE__ */ pRetry((...args) => callbackFn(args[0]), {
             ...retryOpts,
@@ -211,9 +213,9 @@ async function pRetry(callbackFn, options) {
       }
       let waitTime = delay;
       if (jitter) {
-        waitTime += Math.floor(Math.random() * delay);
+        waitTime += (0, import_primordials.MathFloor)((0, import_primordials.MathRandom)() * delay);
       }
-      waitTime = Math.min(waitTime, maxDelayMs);
+      waitTime = (0, import_primordials.MathMin)(waitTime, maxDelayMs);
       if (typeof onRetry === "function") {
         try {
           const result = onRetry(retries - attempts, e, waitTime);
@@ -221,7 +223,7 @@ async function pRetry(callbackFn, options) {
             break;
           }
           if (typeof result === "number" && result >= 0) {
-            waitTime = Math.min(result, maxDelayMs);
+            waitTime = (0, import_primordials.MathMin)(result, maxDelayMs);
           }
         } catch (e2) {
           if (onRetryRethrow) {
@@ -237,7 +239,7 @@ async function pRetry(callbackFn, options) {
       if (signal?.aborted) {
         return void 0;
       }
-      delay = Math.min(delay * backoffFactor, maxDelayMs);
+      delay = (0, import_primordials.MathMin)(delay * backoffFactor, maxDelayMs);
     }
   }
   if (error !== import_core.UNDEFINED_TOKEN) {
@@ -259,23 +261,25 @@ function resolveRetryOptions(options) {
   }
   return options ? { ...defaults, ...options } : defaults;
 }
-const maybeNativeWithResolvers = Promise.withResolvers;
-const withResolvers = typeof maybeNativeWithResolvers === "function" ? (
-  // Bind so callers who destructure the export don't lose `this`.
-  maybeNativeWithResolvers.bind(
-    Promise
-  )
-) : () => {
+const withResolvers = import_primordials.PromiseWithResolvers !== void 0 ? import_primordials.PromiseWithResolvers : () => {
   let resolve;
   let reject;
-  const promise = new Promise((res, rej) => {
+  const promise = new import_primordials.PromiseCtor((res, rej) => {
     resolve = res;
     reject = rej;
   });
   return { promise, resolve, reject };
 };
+const fromAsync = import_primordials.ArrayFromAsync !== void 0 ? import_primordials.ArrayFromAsync : async (source) => {
+  const out = [];
+  for await (const item of source) {
+    out.push(item);
+  }
+  return out;
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  fromAsync,
   normalizeIterationOptions,
   normalizeRetryOptions,
   pEach,

package/dist/regexps.js

@@ -23,17 +23,18 @@ __export(regexps_exports, {
   escapeRegExp: () => escapeRegExp
 });
 module.exports = __toCommonJS(regexps_exports);
-const SYNTAX_CHARACTERS = new Set("^$\\.*+?()[]{}|/");
-const CONTROL_ESCAPES = /* @__PURE__ */ new Map([
+var import_primordials = require("./primordials");
+const SYNTAX_CHARACTERS = new import_primordials.SetCtor("^$\\.*+?()[]{}|/");
+const CONTROL_ESCAPES = new import_primordials.MapCtor([
   [9, "\\t"],
   [10, "\\n"],
   [11, "\\v"],
   [12, "\\f"],
   [13, "\\r"]
 ]);
-const OTHER_PUNCTUATORS = new Set(",-=<>#&!%:;@~'`\"");
+const OTHER_PUNCTUATORS = new import_primordials.SetCtor(",-=<>#&!%:;@~'`\"");
 function isSpecHexEscapeCp(cp) {
-  if (OTHER_PUNCTUATORS.has(String.fromCodePoint(cp))) {
+  if (OTHER_PUNCTUATORS.has((0, import_primordials.StringFromCodePoint)(cp))) {
     return true;
   }
   if (cp === 10 || cp === 13 || cp === 8232 || cp === 8233) {
@@ -48,16 +49,16 @@ function isSpecHexEscapeCp(cp) {
   return false;
 }
 function hex2(n) {
-  return n.toString(16).padStart(2, "0");
+  return (0, import_primordials.NumberPrototypeToString)(n, 16).padStart(2, "0");
 }
 function hex4(n) {
-  return n.toString(16).padStart(4, "0");
+  return (0, import_primordials.NumberPrototypeToString)(n, 16).padStart(4, "0");
 }
 function escapeRegExpFallback(str) {
   let out = "";
   let isFirst = true;
   for (const char of str) {
-    const cp = char.codePointAt(0);
+    const cp = (0, import_primordials.StringPrototypeCodePointAt)(char, 0);
     if (isFirst && (cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122)) {
       out += "\\x" + hex2(cp);
     } else if (SYNTAX_CHARACTERS.has(char)) {
@@ -71,7 +72,7 @@ function escapeRegExpFallback(str) {
           out += "\\x" + hex2(cp);
         } else {
           for (let i = 0; i < char.length; i++) {
-            out += "\\u" + hex4(char.charCodeAt(i));
+            out += "\\u" + hex4((0, import_primordials.StringPrototypeCharCodeAt)(char, i));
           }
         }
       } else {

package/dist/releases/github-api.d.ts

@@ -0,0 +1,56 @@
+/**
+ * @fileoverview GitHub release listing + asset-URL discovery.
+ *
+ * REST is the canonical path; we fall back to GraphQL when GitHub's
+ * Elasticsearch listing index is degraded (200 OK + empty body). Both
+ * transports normalize to the same internal `ReleaseRow` shape so the
+ * filtering pipeline doesn't care which transport produced the data.
+ */
+import type { AssetPattern, RepoConfig } from './github-types';
+/**
+ * Get latest release tag matching a tool prefix.
+ * Optionally filter by releases containing a matching asset.
+ *
+ * @param toolPrefix - Tool name prefix to search for (e.g., 'node-smol-')
+ * @param repoConfig - Repository configuration (owner/repo)
+ * @param options - Additional options
+ * @param options.assetPattern - Optional pattern to filter releases by matching asset
+ * @param options.nothrow - If true, return undefined instead of throwing when both REST and GraphQL backends are degraded. Default: false.
+ * @returns Latest release tag or undefined if not found
+ * @throws {Error} If both REST and GraphQL backends are degraded and nothrow is false.
+ *
+ * @example
+ * ```typescript
+ * const tag = await getLatestRelease('lief-', {
+ *   owner: 'SocketDev', repo: 'socket-btm',
+ * })
+ * console.log(tag) // 'lief-2025-01-15-abc1234'
+ * ```
+ */
+export declare function getLatestRelease(toolPrefix: string, repoConfig: RepoConfig, options?: {
+    assetPattern?: AssetPattern;
+    nothrow?: boolean;
+}): Promise<string | undefined>;
+/**
+ * Get download URL for a specific release asset.
+ * Supports pattern matching for dynamic asset discovery.
+ *
+ * @param tag - Release tag name
+ * @param assetPattern - Asset name or pattern (glob string, prefix/suffix object, or RegExp)
+ * @param repoConfig - Repository configuration (owner/repo)
+ * @param options - Additional options
+ * @param options.nothrow - If true, return undefined instead of throwing when both REST and GraphQL backends are degraded. Default: false.
+ * @returns Browser download URL for the asset, or undefined when not found.
+ * @throws {Error} If both REST and GraphQL backends are degraded and nothrow is false.
+ *
+ * @example
+ * ```typescript
+ * const url = await getReleaseAssetUrl(
+ *   'v1.0.0', 'tool-linux-x64',
+ *   { owner: 'SocketDev', repo: 'socket-btm' },
+ * )
+ * ```
+ */
+export declare function getReleaseAssetUrl(tag: string, assetPattern: string | AssetPattern, repoConfig: RepoConfig, options?: {
+    nothrow?: boolean;
+}): Promise<string | undefined>;