@socketsecurity/lib 5.27.0 → 6.0.0

package/dist/github.js

@@ -1,448 +0,0 @@
-"use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var github_exports = {};
-__export(github_exports, {
-  GitHubEmptyBodyError: () => GitHubEmptyBodyError,
-  cacheFetchGhsa: () => cacheFetchGhsa,
-  clearRefCache: () => clearRefCache,
-  fetchGhsaDetails: () => fetchGhsaDetails,
-  fetchGitHub: () => fetchGitHub,
-  getGhsaUrl: () => getGhsaUrl,
-  getGitHubToken: () => getGitHubToken,
-  getGitHubTokenFromGitConfig: () => getGitHubTokenFromGitConfig,
-  getGitHubTokenWithFallback: () => getGitHubTokenWithFallback,
-  resolveRefToSha: () => resolveRefToSha
-});
-module.exports = __toCommonJS(github_exports);
-var import_node_process = __toESM(require("node:process"));
-var import_cache_with_ttl = require("./cache-with-ttl");
-var import_github = require("./env/github");
-var import_socket_cli = require("./env/socket-cli");
-var import_errors = require("./errors");
-var import_http_request = require("./http-request");
-var import_primordials = require("./primordials");
-var import_spawn = require("./spawn");
-const GITHUB_API_BASE_URL = "https://api.github.com";
-const GITHUB_GRAPHQL_URL = "https://api.github.com/graphql";
-const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1e3;
-let _githubCache;
-class GitHubEmptyBodyError extends Error {
-  /** HTTP status (always 200 — that's what makes this case insidious). */
-  status;
-  constructor(url) {
-    super(`GitHub API returned HTTP 200 with empty body: ${url}`);
-    this.name = "GitHubEmptyBodyError";
-    this.status = 200;
-  }
-}
-async function fetchRefSha(owner, repo, ref, options) {
-  const fetchOptions = {
-    token: options.token
-  };
-  let sawEmptyBody = false;
-  const note404 = (e) => {
-    if (e instanceof GitHubEmptyBodyError) {
-      sawEmptyBody = true;
-    }
-    return e;
-  };
-  try {
-    const tagUrl = `${GITHUB_API_BASE_URL}/repos/${owner}/${repo}/git/refs/tags/${ref}`;
-    const tagData = await fetchGitHub(tagUrl, fetchOptions);
-    if (tagData.object.type === "tag") {
-      const tagObject = await fetchGitHub(
-        tagData.object.url,
-        fetchOptions
-      );
-      return tagObject.object.sha;
-    }
-    return tagData.object.sha;
-  } catch (e) {
-    note404(e);
-    try {
-      const branchUrl = `${GITHUB_API_BASE_URL}/repos/${owner}/${repo}/git/refs/heads/${ref}`;
-      const branchData = await fetchGitHub(branchUrl, fetchOptions);
-      return branchData.object.sha;
-    } catch (e2) {
-      note404(e2);
-      try {
-        const commitUrl = `${GITHUB_API_BASE_URL}/repos/${owner}/${repo}/commits/${ref}`;
-        const commitData = await fetchGitHub(
-          commitUrl,
-          fetchOptions
-        );
-        return commitData.sha;
-      } catch (e3) {
-        note404(e3);
-        if (sawEmptyBody) {
-          let graphqlSha;
-          let graphqlErr;
-          try {
-            graphqlSha = await fetchRefShaViaGraphQL(
-              owner,
-              repo,
-              ref,
-              fetchOptions
-            );
-          } catch (cause) {
-            graphqlErr = cause;
-          }
-          if (graphqlSha) {
-            return graphqlSha;
-          }
-          if (graphqlErr !== void 0) {
-            throw new import_primordials.ErrorCtor(
-              `Failed to resolve ref "${ref}" for ${owner}/${repo}: both REST and GraphQL backends degraded`,
-              { cause: graphqlErr }
-            );
-          }
-        }
-        throw new import_primordials.ErrorCtor(
-          `Failed to resolve ref "${ref}" for ${owner}/${repo}: ${(0, import_errors.errorMessage)(e3)}`
-        );
-      }
-    }
-  }
-}
-async function fetchRefShaViaGraphQL(owner, repo, ref, options) {
-  const token = options.token || getGitHubToken();
-  const headers = {
-    Accept: "application/vnd.github.v3+json",
-    "Content-Type": "application/json",
-    "User-Agent": "socket-registry-github-client",
-    ...options.headers
-  };
-  if (token) {
-    headers["Authorization"] = `Bearer ${token}`;
-  }
-  const query = `query($owner: String!, $repo: String!, $tag: String!, $branch: String!, $oid: GitObjectID!) {
-    repository(owner: $owner, name: $repo) {
-      tagRef: ref(qualifiedName: $tag) {
-        target {
-          __typename
-          ... on Tag { target { oid } }
-          ... on Commit { oid }
-        }
-      }
-      branchRef: ref(qualifiedName: $branch) {
-        target { oid }
-      }
-      commit: object(oid: $oid) {
-        __typename
-        ... on Commit { oid }
-      }
-    }
-  }`;
-  const looksLikeSha = /^[a-f0-9]{40}$/i.test(ref);
-  const oidArg = looksLikeSha ? ref : "0000000000000000000000000000000000000000";
-  const response = await (0, import_http_request.httpRequest)(GITHUB_GRAPHQL_URL, {
-    body: (0, import_primordials.JSONStringify)({
-      query,
-      variables: {
-        branch: `refs/heads/${ref}`,
-        oid: oidArg,
-        owner,
-        repo,
-        tag: `refs/tags/${ref}`
-      }
-    }),
-    headers,
-    method: "POST"
-  });
-  if (!response.ok || response.body.byteLength === 0) {
-    return void 0;
-  }
-  let parsed;
-  try {
-    parsed = (0, import_primordials.JSONParse)(response.body.toString("utf8"));
-  } catch {
-    return void 0;
-  }
-  const repoData = parsed.data?.repository;
-  if (!repoData) {
-    return void 0;
-  }
-  const tagTarget = repoData.tagRef?.target;
-  if (tagTarget) {
-    if (tagTarget.__typename === "Tag") {
-      return tagTarget.target?.oid ?? void 0;
-    }
-    if (tagTarget.__typename === "Commit") {
-      return tagTarget.oid ?? void 0;
-    }
-  }
-  const branchOid = repoData.branchRef?.target?.oid;
-  if (branchOid) {
-    return branchOid;
-  }
-  if (repoData.commit?.__typename === "Commit" && repoData.commit.oid) {
-    return repoData.commit.oid;
-  }
-  return void 0;
-}
-function getGithubCache() {
-  if (_githubCache === void 0) {
-    _githubCache = (0, import_cache_with_ttl.createTtlCache)({
-      memoize: true,
-      prefix: "github-refs",
-      ttl: DEFAULT_CACHE_TTL_MS
-    });
-  }
-  return _githubCache;
-}
-async function cacheFetchGhsa(ghsaId, options) {
-  const cache = getGithubCache();
-  const key = `ghsa:${ghsaId}`;
-  if (import_node_process.default.env["DISABLE_GITHUB_CACHE"]) {
-    return await fetchGhsaDetails(ghsaId, options);
-  }
-  return await cache.getOrFetch(key, async () => {
-    return await fetchGhsaDetails(ghsaId, options);
-  });
-}
-async function clearRefCache() {
-  if (_githubCache) {
-    await _githubCache.clear({ memoOnly: true });
-  }
-}
-async function fetchGhsaDetails(ghsaId, options) {
-  const url = `https://api.github.com/advisories/${ghsaId}`;
-  try {
-    const data = await fetchGitHub(url, options);
-    return {
-      ghsaId: data.ghsa_id,
-      summary: data.summary,
-      details: data.details,
-      severity: data.severity,
-      aliases: data.aliases || [],
-      publishedAt: data.published_at,
-      updatedAt: data.updated_at,
-      withdrawnAt: data.withdrawn_at,
-      references: data.references || [],
-      vulnerabilities: data.vulnerabilities || [],
-      cvss: data.cvss,
-      cwes: data.cwes || []
-    };
-  } catch (e) {
-    if (e instanceof GitHubEmptyBodyError) {
-      try {
-        return await fetchGhsaDetailsViaGraphQL(ghsaId, options);
-      } catch (cause) {
-        throw new import_primordials.ErrorCtor(
-          `Failed to fetch advisory ${ghsaId}: both REST and GraphQL backends degraded`,
-          { cause }
-        );
-      }
-    }
-    throw e;
-  }
-}
-async function fetchGhsaDetailsViaGraphQL(ghsaId, options) {
-  const opts = { __proto__: null, ...options };
-  const token = opts.token || getGitHubToken();
-  const headers = {
-    Accept: "application/vnd.github.v3+json",
-    "Content-Type": "application/json",
-    "User-Agent": "socket-registry-github-client",
-    ...opts.headers
-  };
-  if (token) {
-    headers["Authorization"] = `Bearer ${token}`;
-  }
-  const query = `query($ghsaId: String!) {
-    securityAdvisory(ghsaId: $ghsaId) {
-      ghsaId
-      summary
-      description
-      severity
-      publishedAt
-      updatedAt
-      withdrawnAt
-      cvss { score vectorString }
-      cwes(first: 50) { nodes { cweId name description } }
-      references { url }
-      vulnerabilities(first: 100) {
-        nodes {
-          package { ecosystem name }
-          vulnerableVersionRange
-          firstPatchedVersion { identifier }
-        }
-      }
-      identifiers { type value }
-    }
-  }`;
-  const response = await (0, import_http_request.httpRequest)(GITHUB_GRAPHQL_URL, {
-    body: (0, import_primordials.JSONStringify)({ query, variables: { ghsaId } }),
-    headers,
-    method: "POST"
-  });
-  if (!response.ok) {
-    throw new import_primordials.ErrorCtor(
-      `GitHub GraphQL API error ${response.status}: ${response.statusText}`
-    );
-  }
-  if (response.body.byteLength === 0) {
-    throw new GitHubEmptyBodyError(GITHUB_GRAPHQL_URL);
-  }
-  let parsed;
-  try {
-    parsed = (0, import_primordials.JSONParse)(response.body.toString("utf8"));
-  } catch (cause) {
-    throw new import_primordials.ErrorCtor(
-      `Failed to parse GitHub GraphQL response for advisory ${ghsaId}`,
-      { cause }
-    );
-  }
-  if (parsed.errors?.length) {
-    throw new import_primordials.ErrorCtor(
-      `GraphQL securityAdvisory(${ghsaId}) returned errors: ${parsed.errors.map((e) => e.message).join("; ")}`
-    );
-  }
-  const adv = parsed.data?.securityAdvisory;
-  if (!adv) {
-    throw new import_primordials.ErrorCtor(`GHSA ${ghsaId} not found`);
-  }
-  return {
-    ghsaId: adv.ghsaId,
-    summary: adv.summary,
-    details: adv.description,
-    // REST returns severity lowercase ("moderate"); GraphQL uppercases
-    // ("MODERATE"). Normalize so callers can compare against a single
-    // canonical form regardless of which transport ran.
-    severity: adv.severity.toLowerCase(),
-    // REST `aliases` is the list of non-GHSA identifiers (CVE ids,
-    // typically). GraphQL `identifiers` includes the advisory's own
-    // GHSA id alongside CVE ids; filter it out to match REST shape.
-    aliases: adv.identifiers?.filter((i) => i.type !== "GHSA").map((i) => i.value) ?? [],
-    publishedAt: adv.publishedAt,
-    updatedAt: adv.updatedAt,
-    withdrawnAt: adv.withdrawnAt ?? "",
-    references: adv.references ?? [],
-    vulnerabilities: adv.vulnerabilities?.nodes ?? [],
-    cvss: adv.cvss ?? null,
-    cwes: adv.cwes?.nodes ?? []
-  };
-}
-async function fetchGitHub(url, options) {
-  const opts = { __proto__: null, ...options };
-  const token = opts.token || getGitHubToken();
-  const headers = {
-    Accept: "application/vnd.github.v3+json",
-    "User-Agent": "socket-registry-github-client",
-    ...opts.headers
-  };
-  if (token) {
-    headers["Authorization"] = `Bearer ${token}`;
-  }
-  const response = await (0, import_http_request.httpRequest)(url, { headers });
-  if (!response.ok) {
-    if (response.status === 403) {
-      const rateLimit = response.headers["x-ratelimit-remaining"];
-      const rateLimitStr = typeof rateLimit === "string" ? rateLimit : rateLimit?.[0];
-      if (rateLimitStr === "0") {
-        const resetTime = response.headers["x-ratelimit-reset"];
-        const resetTimeStr = typeof resetTime === "string" ? resetTime : resetTime?.[0];
-        const resetDate = resetTimeStr ? new import_primordials.DateCtor(Number(resetTimeStr) * 1e3) : void 0;
-        const error = new import_primordials.ErrorCtor(
-          `GitHub API rate limit exceeded${resetDate ? `. Resets at ${resetDate.toLocaleString()}` : ""}. Use GITHUB_TOKEN environment variable to increase rate limit.`
-        );
-        error.status = 403;
-        error.resetTime = resetDate;
-        throw error;
-      }
-    }
-    throw new import_primordials.ErrorCtor(
-      `GitHub API error ${response.status}: ${response.statusText}`
-    );
-  }
-  if (response.body.byteLength === 0) {
-    throw new GitHubEmptyBodyError(url);
-  }
-  try {
-    return (0, import_primordials.JSONParse)(response.body.toString("utf8"));
-  } catch (e) {
-    throw new import_primordials.ErrorCtor(
-      `Failed to parse GitHub API response: ${(0, import_errors.errorMessage)(e)}
-URL: ${url}
-Response may be malformed or incomplete.`,
-      { cause: e }
-    );
-  }
-}
-function getGhsaUrl(ghsaId) {
-  return `https://github.com/advisories/${ghsaId}`;
-}
-function getGitHubToken() {
-  return (0, import_github.getGithubToken)() || (0, import_github.getGhToken)() || (0, import_socket_cli.getSocketCliGithubToken)() || void 0;
-}
-async function getGitHubTokenFromGitConfig(options) {
-  try {
-    const result = await (0, import_spawn.spawn)("git", ["config", "github.token"], {
-      ...options,
-      stdio: "pipe"
-    });
-    if (result.code === 0 && result.stdout) {
-      return result.stdout.toString().trim();
-    }
-  } catch {
-  }
-  return void 0;
-}
-async function getGitHubTokenWithFallback() {
-  return getGitHubToken() || await getGitHubTokenFromGitConfig();
-}
-async function resolveRefToSha(owner, repo, ref, options) {
-  const opts = {
-    __proto__: null,
-    ...options
-  };
-  const cacheKey = `${owner}/${repo}@${ref}`;
-  if (import_node_process.default.env["DISABLE_GITHUB_CACHE"]) {
-    return await fetchRefSha(owner, repo, ref, opts);
-  }
-  const cache = getGithubCache();
-  return await cache.getOrFetch(cacheKey, async () => {
-    return await fetchRefSha(owner, repo, ref, opts);
-  });
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  GitHubEmptyBodyError,
-  cacheFetchGhsa,
-  clearRefCache,
-  fetchGhsaDetails,
-  fetchGitHub,
-  getGhsaUrl,
-  getGitHubToken,
-  getGitHubTokenFromGitConfig,
-  getGitHubTokenWithFallback,
-  resolveRefToSha
-});

package/dist/globs.d.ts

@@ -1,119 +0,0 @@
-/**
- * @fileoverview Glob pattern matching utilities with default ignore patterns.
- * Provides file filtering and glob matcher functions for npm-like behavior.
- */
-type Pattern = string;
-interface FastGlobOptions {
-    absolute?: boolean;
-    baseNameMatch?: boolean;
-    braceExpansion?: boolean;
-    caseSensitiveMatch?: boolean;
-    concurrency?: number;
-    cwd?: string;
-    deep?: number;
-    dot?: boolean;
-    extglob?: boolean;
-    followSymbolicLinks?: boolean;
-    fs?: unknown;
-    globstar?: boolean;
-    ignore?: string[];
-    ignoreFiles?: string[];
-    markDirectories?: boolean;
-    objectMode?: boolean;
-    onlyDirectories?: boolean;
-    onlyFiles?: boolean;
-    stats?: boolean;
-    suppressErrors?: boolean;
-    throwErrorOnBrokenSymbolicLink?: boolean;
-    unique?: boolean;
-}
-export interface GlobOptions extends FastGlobOptions {
-    ignoreOriginals?: boolean;
-    recursive?: boolean;
-}
-export type { Pattern, FastGlobOptions };
-/**
- * Resolve `path.matchesGlob` (or `undefined` if the runtime predates
- * it). Probes once and caches the result for every subsequent call.
- *
- * Used by `getGlobMatcher`'s narrow fast-path — see the conditions
- * spelled out at the call site. Exported for unit tests.
- *
- * @internal
- */
-export declare function getMatchesGlob(): ((p: string, pattern: string) => boolean) | undefined;
-export declare const defaultIgnore: readonly string[];
-/**
- * Return a glob-matcher function, memoized by pattern + options.
- *
- * The returned function is a fast synchronous predicate built on picomatch.
- * Results are memoized — calling `getGlobMatcher(['*.ts'])` a thousand times
- * in a loop returns the same compiled matcher each time, so callers do not
- * need to hoist it themselves.
- *
- * The cache is LRU with a cap of 100 entries. Cache keys fold together the
- * (sorted) pattern list and (sorted) option set, so arguments that differ
- * only in ordering share a matcher.
- *
- * Default options: `dot: true`, `nocase: true`. Patterns starting with `!`
- * become ignore patterns.
- *
- * @example
- * ```typescript
- * const isMatch = getGlobMatcher('*.ts')
- * isMatch('index.ts')  // true
- * isMatch('index.js')  // false
- *
- * // With negation
- * const isSource = getGlobMatcher(['src/**', '!**\/*.test.ts'])
- * ```
- */
-export declare function getGlobMatcher(glob: Pattern | Pattern[], options?: {
-    dot?: boolean;
-    nocase?: boolean;
-    ignore?: string[];
-}): (path: string) => boolean;
-/**
- * Asynchronously find files matching glob patterns.
- * Wrapper around fast-glob.
- *
- * @example
- * ```typescript
- * const files = await glob('src/*.ts', { cwd: '/tmp/project' })
- * console.log(files) // ['src/index.ts', 'src/utils.ts']
- * ```
- */
-/**
- * Whether the caller's option bag is fully expressible with
- * `node:fs.glob` (`cwd` + `exclude`). Any other option means we must
- * fall back to fast-glob, which exposes the wider surface.
- *
- * Exported for unit tests; not part of the public API.
- *
- * @internal
- */
-export declare function canUseNodeFsGlob(options: FastGlobOptions | undefined): boolean;
-export declare function glob(patterns: Pattern | Pattern[], options?: FastGlobOptions): Promise<string[]>;
-/**
- * Create a stream of license file paths matching glob patterns.
- *
- * @example
- * ```typescript
- * const stream = globStreamLicenses('/tmp/my-package')
- * for await (const licensePath of stream) {
- *   console.log(licensePath)
- * }
- * ```
- */
-export declare function globStreamLicenses(dirname: string, options?: GlobOptions): NodeJS.ReadableStream;
-/**
- * Synchronously find files matching glob patterns.
- * Wrapper around fast-glob.sync.
- *
- * @example
- * ```typescript
- * const files = globSync('*.json', { cwd: '/tmp/project' })
- * console.log(files) // ['package.json', 'tsconfig.json']
- * ```
- */
-export declare function globSync(patterns: Pattern | Pattern[], options?: FastGlobOptions): string[];