@socketsecurity/lib 5.28.0 → 6.0.1

package/dist/releases/github-archives.js

@@ -24,38 +24,23 @@ __export(github_archives_exports, {
   downloadAndExtractZip: () => downloadAndExtractZip
 });
 module.exports = __toCommonJS(github_archives_exports);
-var import_archives = require("../archives");
-var import_fs = require("../fs");
-var import_logger = require("../logger");
-var import_primordials = require("../primordials");
+var import_detect = require("../archives/detect");
+var import_extract = require("../archives/extract");
+var import_safe = require("../fs/safe");
+var import_default = require("../logger/default");
+var import_error = require("../primordials/error");
 var import_github_downloads = require("./github-downloads");
-const logger = (0, import_logger.getDefaultLogger)();
-let _fs;
-let _path;
-// @__NO_SIDE_EFFECTS__
-function getFs() {
-  if (_fs === void 0) {
-    _fs = require("node:fs");
-  }
-  return _fs;
-}
-// @__NO_SIDE_EFFECTS__
-function getPath() {
-  if (_path === void 0) {
-    _path = require("node:path");
-  }
-  return _path;
-}
-async function downloadAndExtractArchive(tag, assetPattern, outputDir, repoConfig, options = {}) {
+var import_path = require("../node/path");
+const logger = (0, import_default.getDefaultLogger)();
+async function downloadAndExtractArchive(tag, assetPattern, outputDir, repoConfig, options = { __proto__: null }) {
   const { cleanup = true, format, quiet = false, strip } = options;
-  const path = /* @__PURE__ */ getPath();
-  const fs = /* @__PURE__ */ getFs();
-  await (0, import_fs.safeMkdir)(outputDir);
+  const path = (0, import_path.getNodePath)();
+  await (0, import_safe.safeMkdir)(outputDir);
   let ext = ".archive";
   if (format) {
     ext = format === "tar.gz" ? ".tar.gz" : `.${format}`;
   } else if (typeof assetPattern === "string") {
-    const detectedFormat = (0, import_archives.detectArchiveFormat)(assetPattern);
+    const detectedFormat = (0, import_detect.detectArchiveFormat)(assetPattern);
     if (detectedFormat) {
       ext = detectedFormat === "tar.gz" ? ".tar.gz" : `.${detectedFormat}`;
     }
@@ -71,16 +56,16 @@ async function downloadAndExtractArchive(tag, assetPattern, outputDir, repoConfi
     logger.info(`Extracting archive to ${outputDir}...`);
   }
   try {
-    await (0, import_archives.extractArchive)(archivePath, outputDir, { quiet, strip });
+    await (0, import_extract.extractArchive)(archivePath, outputDir, { quiet, strip });
     if (!quiet) {
       logger.info(`Extracted archive contents to ${outputDir}`);
     }
   } catch (cause) {
-    throw new import_primordials.ErrorCtor(`Failed to extract archive: ${archivePath}`, { cause });
+    throw new import_error.ErrorCtor(`Failed to extract archive: ${archivePath}`, { cause });
   } finally {
     if (cleanup) {
       try {
-        await fs.promises.unlink(archivePath);
+        await (0, import_safe.safeDelete)(archivePath);
         if (!quiet) {
           logger.info("Cleaned up temporary archive file");
         }
@@ -93,11 +78,12 @@ async function downloadAndExtractArchive(tag, assetPattern, outputDir, repoConfi
   }
   return outputDir;
 }
-async function downloadAndExtractZip(tag, assetPattern, outputDir, repoConfig, options = {}) {
+async function downloadAndExtractZip(tag, assetPattern, outputDir, repoConfig, options = {
+  __proto__: null
+}) {
   const { cleanup = true, quiet = false } = options;
-  const path = /* @__PURE__ */ getPath();
-  const fs = /* @__PURE__ */ getFs();
-  await (0, import_fs.safeMkdir)(outputDir);
+  const path = (0, import_path.getNodePath)();
+  await (0, import_safe.safeMkdir)(outputDir);
   const zipPath = path.join(outputDir, "__temp_download__.zip");
   if (!quiet) {
     logger.info(`Downloading zip asset from release ${tag}...`);
@@ -107,16 +93,16 @@ async function downloadAndExtractZip(tag, assetPattern, outputDir, repoConfig, o
     logger.info(`Extracting zip to ${outputDir}...`);
   }
   try {
-    await (0, import_archives.extractArchive)(zipPath, outputDir, { quiet });
+    await (0, import_extract.extractArchive)(zipPath, outputDir, { quiet });
     if (!quiet) {
       logger.info(`Extracted zip contents to ${outputDir}`);
     }
   } catch (cause) {
-    throw new import_primordials.ErrorCtor(`Failed to extract zip file: ${zipPath}`, { cause });
+    throw new import_error.ErrorCtor(`Failed to extract zip file: ${zipPath}`, { cause });
   } finally {
     if (cleanup) {
       try {
-        await fs.promises.unlink(zipPath);
+        await (0, import_safe.safeDelete)(zipPath);
         if (!quiet) {
           logger.info("Cleaned up temporary zip file");
         }

package/dist/releases/github-asset-url.d.ts

@@ -0,0 +1,72 @@
+/**
+ * @file Per-release asset-URL discovery for GitHub releases. Split out of
+ *   `releases/github-api.ts` for size hygiene. Holds the "fetch this specific
+ *   tag's downloadable asset URL" path (REST with GraphQL fallback for ES-index
+ *   incidents):
+ *
+ *   - `fetchReleaseAssetsViaGraphQL` — GraphQL fallback when REST's per-tag
+ *     endpoint returns 200 + empty body
+ *   - `getReleaseAssetUrl` — REST per-tag lookup + pattern matcher + GraphQL
+ *     fallback The list-all-releases path lives in `./github-listing`.
+ */
+import type { AssetPattern, RepoConfig } from './github-types';
+/**
+ * Fetch the assets of a single release identified by tag via GraphQL.
+ *
+ * Why this exists: `getReleaseAssetUrl` uses REST `/releases/tags/:tag` to look
+ * up a single release and find a downloadable asset. During GitHub incidents
+ * that endpoint can return 200 + empty body the same way the listing endpoint
+ * does (the per-tag lookup joins against the same listing index for asset
+ * discovery). This helper hits GraphQL `repository.release(tagName)` which uses
+ * a different backend.
+ *
+ * Field shape diff we normalize: GraphQL returns REST equivalent
+ * `releaseAssets.nodes[].downloadUrl` `assets[].browser_download_url`
+ *
+ * Same URL, different field name and one extra connection-wrapper level. The
+ * mapping at the bottom converts so the asset-matcher in `getReleaseAssetUrl`
+ * can run unchanged.
+ *
+ * Return contract:
+ *
+ * - Array of assets (REST shape) when the release exists.
+ * - `undefined` when the release with that tag genuinely doesn't exist (GraphQL
+ *   returned `release: null` over the wire — we translate that to undefined per
+ *   the codebase convention). The caller throws a clean "tag not found" error
+ *   in that case.
+ * - Throws on transport errors (non-OK HTTP, GraphQL errors[], or even the
+ *   GraphQL backend ALSO returning empty body — at that point both transports
+ *   are degraded and we want the pRetry wrapper to back off and retry).
+ */
+export declare function fetchReleaseAssetsViaGraphQL(owner: string, repo: string, tag: string): Promise<Array<{
+    name: string;
+    browser_download_url: string;
+}> | undefined>;
+/**
+ * Get download URL for a specific release asset. Supports pattern matching for
+ * dynamic asset discovery.
+ *
+ * @example
+ *   ;```typescript
+ *   const url = await getReleaseAssetUrl('v1.0.0', 'tool-linux-x64', {
+ *     owner: 'SocketDev',
+ *     repo: 'socket-btm',
+ *   })
+ *   ```
+ *
+ * @param tag - Release tag name.
+ * @param assetPattern - Asset name or pattern (glob string, prefix/suffix
+ *   object, or RegExp)
+ * @param repoConfig - Repository configuration (owner/repo)
+ * @param options - Additional options.
+ * @param options.nothrow - If true, return undefined instead of throwing when
+ *   both REST and GraphQL backends are degraded. Default: false.
+ *
+ * @returns Browser download URL for the asset, or undefined when not found.
+ *
+ * @throws {Error} If both REST and GraphQL backends are degraded and nothrow is
+ *   false.
+ */
+export declare function getReleaseAssetUrl(tag: string, assetPattern: string | AssetPattern, repoConfig: RepoConfig, options?: {
+    nothrow?: boolean;
+}): Promise<string | undefined>;

package/dist/releases/github-asset-url.js

@@ -0,0 +1,167 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var github_asset_url_exports = {};
+__export(github_asset_url_exports, {
+  fetchReleaseAssetsViaGraphQL: () => fetchReleaseAssetsViaGraphQL,
+  getReleaseAssetUrl: () => getReleaseAssetUrl
+});
+module.exports = __toCommonJS(github_asset_url_exports);
+var import_request = require("../http-request/request");
+var import_retry = require("../promises/retry");
+var import_array = require("../primordials/array");
+var import_error = require("../primordials/error");
+var import_json = require("../primordials/json");
+var import_object = require("../primordials/object");
+var import_github_assets = require("./github-assets");
+var import_github_auth = require("./github-auth");
+const RETRY_CONFIG = (0, import_object.ObjectFreeze)({
+  __proto__: null,
+  // Exponential backoff: delay doubles with each retry (5s, 10s, 20s).
+  backoffFactor: 2,
+  // Initial delay before first retry.
+  baseDelayMs: 5e3,
+  // Maximum number of retry attempts (excluding initial request).
+  retries: 2
+});
+async function fetchReleaseAssetsViaGraphQL(owner, repo, tag) {
+  const response = await (0, import_request.httpRequest)("https://api.github.com/graphql", {
+    body: (0, import_json.JSONStringify)({
+      query: `query($owner: String!, $repo: String!, $tag: String!) {
+        repository(owner: $owner, name: $repo) {
+          release(tagName: $tag) {
+            tagName
+            releaseAssets(first: 100) { nodes { name downloadUrl } }
+          }
+        }
+      }`,
+      variables: { owner, repo, tag }
+    }),
+    headers: { ...(0, import_github_auth.getAuthHeaders)(), "Content-Type": "application/json" },
+    method: "POST"
+  });
+  if (!response.ok) {
+    throw new import_error.ErrorCtor(
+      `Failed to fetch ${owner}/${repo} release ${tag} (GraphQL): ${response.status} ${response.statusText}`
+    );
+  }
+  if (response.body.byteLength === 0) {
+    throw new import_error.ErrorCtor(
+      `Failed to fetch ${owner}/${repo} release ${tag}: GraphQL returned empty body`
+    );
+  }
+  let parsed;
+  try {
+    parsed = (0, import_json.JSONParse)(response.body.toString("utf8"));
+  } catch (cause) {
+    throw new import_error.ErrorCtor(
+      `Failed to parse ${owner}/${repo} release ${tag} response (GraphQL)`,
+      { cause }
+    );
+  }
+  if (parsed.errors?.length) {
+    throw new import_error.ErrorCtor(
+      `GraphQL repository.release(${owner}/${repo}, ${tag}) returned errors: ${parsed.errors.map((e) => e.message).join("; ")}`
+    );
+  }
+  const release = parsed.data?.repository?.release;
+  if (!release) {
+    return void 0;
+  }
+  return (release.releaseAssets?.nodes ?? []).map((n) => ({
+    browser_download_url: n.downloadUrl,
+    name: n.name
+  }));
+}
+async function getReleaseAssetUrl(tag, assetPattern, repoConfig, options = {}) {
+  const { nothrow = false } = options;
+  const { owner, repo } = repoConfig;
+  const isMatch = typeof assetPattern === "string" && !assetPattern.includes("*") && !assetPattern.includes("{") ? (input) => input === assetPattern : (0, import_github_assets.createAssetMatcher)(assetPattern);
+  const assets = await (0, import_retry.pRetry)(async () => {
+    const response = await (0, import_request.httpRequest)(
+      `https://api.github.com/repos/${owner}/${repo}/releases/tags/${tag}`,
+      {
+        headers: (0, import_github_auth.getAuthHeaders)()
+      }
+    );
+    if (!response.ok) {
+      throw new import_error.ErrorCtor(
+        `Failed to fetch ${owner}/${repo} release ${tag}: ${response.status}`
+      );
+    }
+    let assets2;
+    if (response.body.byteLength === 0) {
+      let fallbackAssets;
+      try {
+        fallbackAssets = await fetchReleaseAssetsViaGraphQL(owner, repo, tag);
+      } catch (cause) {
+        if (nothrow) {
+          return void 0;
+        }
+        throw new import_error.ErrorCtor(
+          `Failed to fetch ${owner}/${repo} release ${tag}: both REST and GraphQL backends degraded`,
+          { cause }
+        );
+      }
+      if (fallbackAssets === void 0) {
+        if (nothrow) {
+          return void 0;
+        }
+        throw new import_error.ErrorCtor(`Release ${tag} not found in ${owner}/${repo}`);
+      }
+      assets2 = fallbackAssets;
+    } else {
+      let release;
+      try {
+        release = (0, import_json.JSONParse)(response.body.toString("utf8"));
+      } catch (cause) {
+        throw new import_error.ErrorCtor(
+          `Failed to parse ${owner}/${repo} release ${tag} response`,
+          { cause }
+        );
+      }
+      if (!(0, import_array.ArrayIsArray)(release.assets)) {
+        throw new import_error.ErrorCtor(`Release ${tag} has no assets in ${owner}/${repo}`);
+      }
+      assets2 = release.assets;
+    }
+    return assets2;
+  }, RETRY_CONFIG);
+  if (!assets) {
+    if (nothrow) {
+      return void 0;
+    }
+    throw new import_error.ErrorCtor(`Release ${tag} not found in ${owner}/${repo}`);
+  }
+  const asset = assets.find((a) => isMatch(a.name));
+  if (!asset) {
+    if (nothrow) {
+      return void 0;
+    }
+    const patternDesc = typeof assetPattern === "string" ? assetPattern : "matching pattern";
+    throw new import_error.ErrorCtor(`Asset ${patternDesc} not found in release ${tag}`);
+  }
+  return asset.browser_download_url;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  fetchReleaseAssetsViaGraphQL,
+  getReleaseAssetUrl
+});

package/dist/releases/github-assets.d.ts

@@ -1,19 +1,21 @@
 /**
- * @fileoverview Asset matching helpers for GitHub releases.
+ * @file Asset matching helpers for GitHub releases.
  */
 /**
- * Create a matcher function for a pattern using picomatch for glob patterns
- * or simple prefix/suffix matching for object patterns.
- *
- * @param pattern - Pattern to match (string glob, prefix/suffix object, or RegExp)
- * @returns Function that tests if a string matches the pattern
+ * Create a matcher function for a pattern using picomatch for glob patterns or
+ * simple prefix/suffix matching for object patterns.
  *
  * @example
- * ```typescript
- * const isMatch = createAssetMatcher('tool-*-linux-x64')
- * isMatch('tool-v1.0-linux-x64')  // true
- * isMatch('tool-v1.0-darwin-arm64')  // false
- * ```
+ *   ;```typescript
+ *   const isMatch = createAssetMatcher('tool-*-linux-x64')
+ *   isMatch('tool-v1.0-linux-x64') // true
+ *   isMatch('tool-v1.0-darwin-arm64') // false
+ *   ```
+ *
+ * @param pattern - Pattern to match (string glob, prefix/suffix object, or
+ *   RegExp)
+ *
+ * @returns Function that tests if a string matches the pattern
  */
 export declare function createAssetMatcher(pattern: string | {
     prefix: string;

package/dist/releases/github-assets.js

@@ -34,7 +34,7 @@ __export(github_assets_exports, {
 });
 module.exports = __toCommonJS(github_assets_exports);
 var import_picomatch = __toESM(require("../external/picomatch"));
-var import_primordials = require("../primordials");
+var import_string = require("../primordials/string");
 function createAssetMatcher(pattern) {
   if (typeof pattern === "string") {
     const isMatch = (0, import_picomatch.default)(pattern);
@@ -44,7 +44,7 @@ function createAssetMatcher(pattern) {
     return (input) => pattern.test(input);
   }
   const { prefix, suffix } = pattern;
-  return (input) => (0, import_primordials.StringPrototypeStartsWith)(input, prefix) && (0, import_primordials.StringPrototypeEndsWith)(input, suffix);
+  return (input) => (0, import_string.StringPrototypeStartsWith)(input, prefix) && (0, import_string.StringPrototypeEndsWith)(input, suffix);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/releases/github-auth.d.ts

@@ -1,16 +1,16 @@
 /**
- * @fileoverview GitHub API authentication header helpers.
+ * @file GitHub API authentication header helpers.
  */
 /**
- * Get GitHub authentication headers if token is available.
- * Checks GH_TOKEN or GITHUB_TOKEN environment variables.
- *
- * @returns Headers object with Authorization header if token exists.
+ * Get GitHub authentication headers if token is available. Checks GH_TOKEN or
+ * GITHUB_TOKEN environment variables.
  *
  * @example
- * ```typescript
- * const headers = getAuthHeaders()
- * // { Accept: 'application/vnd.github+json', Authorization: 'Bearer ...' }
- * ```
+ *   ;```typescript
+ *   const headers = getAuthHeaders()
+ *   // { Accept: 'application/vnd.github+json', Authorization: 'Bearer ...' }
+ *   ```
+ *
+ * @returns Headers object with Authorization header if token exists.
  */
 export declare function getAuthHeaders(): Record<string, string>;

package/dist/releases/github-downloads.d.ts

@@ -1,41 +1,46 @@
 /**
- * @fileoverview GitHub release asset downloads.
+ * @file GitHub release asset downloads.
  */
 import type { AssetPattern, DownloadGitHubReleaseConfig, RepoConfig } from './github-types';
 /**
  * Download a binary from any GitHub repository with version caching.
  *
- * @param config - Download configuration
- * @returns Path to the downloaded binary
- *
  * @example
- * ```typescript
- * const binaryPath = await downloadGitHubRelease({
- *   owner: 'SocketDev', repo: 'socket-btm',
- *   toolName: 'lief', toolPrefix: 'lief-',
- *   assetName: 'lief-linux-x64', binaryName: 'lief',
- *   platformArch: 'linux-x64',
- * })
- * ```
+ *   ;```typescript
+ *   const binaryPath = await downloadGitHubRelease({
+ *     owner: 'SocketDev',
+ *     repo: 'socket-btm',
+ *     toolName: 'lief',
+ *     toolPrefix: 'lief-',
+ *     assetName: 'lief-linux-x64',
+ *     binaryName: 'lief',
+ *     platformArch: 'linux-x64',
+ *   })
+ *   ```
+ *
+ * @param config - Download configuration.
+ *
+ * @returns Path to the downloaded binary
  */
 export declare function downloadGitHubRelease(config: DownloadGitHubReleaseConfig): Promise<string>;
 /**
- * Download a specific release asset.
- * Supports pattern matching for dynamic asset discovery.
- *
- * @param tag - Release tag name
- * @param assetPattern - Asset name or pattern (glob string, prefix/suffix object, or RegExp)
- * @param outputPath - Path to write the downloaded file
- * @param repoConfig - Repository configuration (owner/repo)
- * @param options - Additional options
+ * Download a specific release asset. Supports pattern matching for dynamic
+ * asset discovery.
  *
  * @example
- * ```typescript
- * await downloadReleaseAsset(
- *   'v1.0.0', 'tool-linux-x64', '/tmp/tool',
- *   { owner: 'SocketDev', repo: 'socket-btm' },
- * )
- * ```
+ *   ;```typescript
+ *   await downloadReleaseAsset('v1.0.0', 'tool-linux-x64', '/tmp/tool', {
+ *     owner: 'SocketDev',
+ *     repo: 'socket-btm',
+ *   })
+ *   ```
+ *
+ * @param tag - Release tag name.
+ * @param assetPattern - Asset name or pattern (glob string, prefix/suffix
+ *   object, or RegExp)
+ * @param outputPath - Path to write the downloaded file.
+ * @param repoConfig - Repository configuration (owner/repo)
+ * @param options - Additional options.
  */
 export declare function downloadReleaseAsset(tag: string, assetPattern: string | AssetPattern, outputPath: string, repoConfig: RepoConfig, options?: {
     quiet?: boolean;

package/dist/releases/github-downloads.js

@@ -35,29 +35,17 @@ __export(github_downloads_exports, {
 });
 module.exports = __toCommonJS(github_downloads_exports);
 var import_node_process = __toESM(require("node:process"));
-var import_fs = require("../fs");
-var import_http_request = require("../http-request");
-var import_logger = require("../logger");
-var import_primordials = require("../primordials");
-var import_spawn = require("../spawn");
-var import_github_api = require("./github-api");
-const logger = (0, import_logger.getDefaultLogger)();
-let _fs;
-let _path;
-// @__NO_SIDE_EFFECTS__
-function getFs() {
-  if (_fs === void 0) {
-    _fs = require("node:fs");
-  }
-  return _fs;
-}
-// @__NO_SIDE_EFFECTS__
-function getPath() {
-  if (_path === void 0) {
-    _path = require("node:path");
-  }
-  return _path;
-}
+var import_safe = require("../fs/safe");
+var import_download = require("../http-request/download");
+var import_default = require("../logger/default");
+var import_error = require("../primordials/error");
+var import_string = require("../primordials/string");
+var import_child = require("../process/spawn/child");
+var import_github_asset_url = require("./github-asset-url");
+var import_github_listing = require("./github-listing");
+var import_fs = require("../node/fs");
+var import_path = require("../node/path");
+const logger = (0, import_default.getDefaultLogger)();
 async function downloadGitHubRelease(config) {
   const {
     assetName,
@@ -77,20 +65,20 @@ async function downloadGitHubRelease(config) {
   if (explicitTag) {
     tag = explicitTag;
   } else if (toolPrefix) {
-    const latestTag = await (0, import_github_api.getLatestRelease)(toolPrefix, { owner, repo });
+    const latestTag = await (0, import_github_listing.getLatestRelease)(toolPrefix, { owner, repo });
     if (!latestTag) {
-      throw new import_primordials.ErrorCtor(`No ${toolPrefix} release found in ${owner}/${repo}`);
+      throw new import_error.ErrorCtor(`No ${toolPrefix} release found in ${owner}/${repo}`);
     }
     tag = latestTag;
   } else {
-    throw new import_primordials.ErrorCtor("Either toolPrefix or tag must be provided");
+    throw new import_error.ErrorCtor("Either toolPrefix or tag must be provided");
   }
-  const path = /* @__PURE__ */ getPath();
+  const path = (0, import_path.getNodePath)();
   const resolvedDownloadDir = path.isAbsolute(downloadDir) ? downloadDir : path.join(cwd, downloadDir);
   const binaryDir = resolvedDownloadDir;
   const binaryPath = path.join(binaryDir, binaryName);
   const versionPath = path.join(binaryDir, ".version");
-  const fs = /* @__PURE__ */ getFs();
+  const fs = (0, import_fs.getNodeFs)();
   if (fs.existsSync(versionPath) && fs.existsSync(binaryPath)) {
     const cachedVersion = (await fs.promises.readFile(versionPath, "utf8")).trim();
     if (cachedVersion === tag && fs.existsSync(binaryPath)) {
@@ -110,12 +98,12 @@ async function downloadGitHubRelease(config) {
     { owner, repo },
     { quiet }
   );
-  const isWindows = (0, import_primordials.StringPrototypeEndsWith)(binaryName, ".exe");
+  const isWindows = (0, import_string.StringPrototypeEndsWith)(binaryName, ".exe");
   if (!isWindows) {
     fs.chmodSync(binaryPath, 493);
-    if (removeMacOSQuarantine && import_node_process.default.platform === "darwin" && (0, import_primordials.StringPrototypeStartsWith)(platformArch, "darwin")) {
+    if (removeMacOSQuarantine && import_node_process.default.platform === "darwin" && (0, import_string.StringPrototypeStartsWith)(platformArch, "darwin")) {
       try {
-        await (0, import_spawn.spawn)("xattr", ["-d", "com.apple.quarantine", binaryPath], {
+        await (0, import_child.spawn)("xattr", ["-d", "com.apple.quarantine", binaryPath], {
           stdio: "ignore"
         });
       } catch {
@@ -131,17 +119,17 @@ async function downloadGitHubRelease(config) {
 async function downloadReleaseAsset(tag, assetPattern, outputPath, repoConfig, options = {}) {
   const { owner, repo } = repoConfig;
   const { quiet = false } = options;
-  const downloadUrl = await (0, import_github_api.getReleaseAssetUrl)(tag, assetPattern, {
+  const downloadUrl = await (0, import_github_asset_url.getReleaseAssetUrl)(tag, assetPattern, {
     owner,
     repo
   });
   if (!downloadUrl) {
     const patternDesc = typeof assetPattern === "string" ? assetPattern : "matching pattern";
-    throw new import_primordials.ErrorCtor(`Asset ${patternDesc} not found in release ${tag}`);
+    throw new import_error.ErrorCtor(`Asset ${patternDesc} not found in release ${tag}`);
   }
-  const path = /* @__PURE__ */ getPath();
-  await (0, import_fs.safeMkdir)(path.dirname(outputPath));
-  await (0, import_http_request.httpDownload)(downloadUrl, outputPath, {
+  const path = (0, import_path.getNodePath)();
+  await (0, import_safe.safeMkdir)(path.dirname(outputPath));
+  await (0, import_download.httpDownload)(downloadUrl, outputPath, {
     logger: quiet ? void 0 : logger,
     progressInterval: 10,
     retries: 2,