@socketsecurity/lib 5.9.0 → 5.10.0

package/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.10.0](https://github.com/SocketDev/socket-lib/releases/tag/v5.10.0) - 2026-03-14
+
+### Changed
+
+- **releases/socket-btm**: Refactored `downloadSocketBtmRelease()` API for caller-controlled download paths
+  - Tool name moved from config object to required first parameter
+  - Config object is now optional second parameter (was required)
+  - Removed automatic `/${toolName}/${platformArch}` directory nesting - callers now have full control over download directory structure
+  - All optional parameters in config types now explicitly typed as `| undefined`
+  - Migration example:
+    - Before: `downloadSocketBtmRelease({ tool: 'lief', downloadDir: 'build' })`
+    - After: `downloadSocketBtmRelease('lief', { downloadDir: 'build' })`
+  - Rationale: Previous automatic path nesting created unexpected directory structures (e.g., `build/downloaded/lief/darwin-arm64/lief/assets/`) making it impossible for callers to predict exact file locations
+
+## [5.9.1](https://github.com/SocketDev/socket-lib/releases/tag/v5.9.1) - 2026-03-14
+
+### Fixed
+
+- **fs**: `safeDelete()` and `safeDeleteSync()` now properly implement retry logic
+  - Previously `maxRetries` was incorrectly passed as `concurrency` to del (parallelism, not retries)
+  - `safeDelete()` now wraps `deleteAsync()` with `pRetry()` for exponential backoff
+  - `safeDeleteSync()` implements sync retry loop with `Atomics.wait()` for non-blocking sleep
+  - Both use `backoffFactor: 2` (delay doubles each retry: 200ms → 400ms → 800ms by default)
+  - `maxRetries` and `retryDelay` options in `RemoveOptions` now work as documented
+
 ## [5.9.0](https://github.com/SocketDev/socket-lib/releases/tag/v5.9.0) - 2026-03-14
 
 ### Changed

package/dist/fs.js

@@ -53,6 +53,7 @@ module.exports = __toCommonJS(fs_exports);
 var import_process = require("./constants/process");
 var import_arrays = require("./arrays");
 var import_del = require("./external/del");
+var import_promises = require("./promises");
 var import_globs = require("./globs");
 var import_parse = require("./json/parse");
 var import_objects = require("./objects");
@@ -527,12 +528,23 @@ async function safeDelete(filepath, options) {
       shouldForce = true;
     }
   }
-  await (0, import_del.deleteAsync)(patterns, {
-    concurrency: opts.maxRetries || defaultRemoveOptions.maxRetries,
-    dryRun: false,
-    force: shouldForce,
-    onlyFiles: false
-  });
+  const maxRetries = opts.maxRetries ?? defaultRemoveOptions.maxRetries;
+  const retryDelay = opts.retryDelay ?? defaultRemoveOptions.retryDelay;
+  await (0, import_promises.pRetry)(
+    async () => {
+      await (0, import_del.deleteAsync)(patterns, {
+        dryRun: false,
+        force: shouldForce,
+        onlyFiles: false
+      });
+    },
+    {
+      retries: maxRetries,
+      baseDelayMs: retryDelay,
+      backoffFactor: 2,
+      signal: opts.signal
+    }
+  );
 }
 function safeDeleteSync(filepath, options) {
   const opts = { __proto__: null, ...options };
@@ -557,12 +569,30 @@ function safeDeleteSync(filepath, options) {
       shouldForce = true;
     }
   }
-  (0, import_del.deleteSync)(patterns, {
-    concurrency: opts.maxRetries || defaultRemoveOptions.maxRetries,
-    dryRun: false,
-    force: shouldForce,
-    onlyFiles: false
-  });
+  const maxRetries = opts.maxRetries ?? defaultRemoveOptions.maxRetries;
+  const retryDelay = opts.retryDelay ?? defaultRemoveOptions.retryDelay;
+  let lastError;
+  let delay = retryDelay;
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    try {
+      (0, import_del.deleteSync)(patterns, {
+        dryRun: false,
+        force: shouldForce,
+        onlyFiles: false
+      });
+      return;
+    } catch (error) {
+      lastError = error;
+      if (attempt < maxRetries) {
+        const waitMs = delay;
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, waitMs);
+        delay *= 2;
+      }
+    }
+  }
+  if (lastError) {
+    throw lastError;
+  }
 }
 async function safeMkdir(path, options) {
   const fs = /* @__PURE__ */ getFs();

package/dist/releases/github.js

@@ -121,7 +121,7 @@ async function downloadGitHubRelease(config) {
   }
   const path = /* @__PURE__ */ getPath();
   const resolvedDownloadDir = path.isAbsolute(downloadDir) ? downloadDir : path.join(cwd, downloadDir);
-  const binaryDir = path.join(resolvedDownloadDir, toolName, platformArch);
+  const binaryDir = resolvedDownloadDir;
   const binaryPath = path.join(binaryDir, binaryName);
   const versionPath = path.join(binaryDir, ".version");
   const fs = /* @__PURE__ */ getFs();

package/dist/releases/socket-btm.d.ts

@@ -13,25 +13,23 @@ export interface SocketBtmAssetConfig {
     /** @internal Discriminator fields */
     bin?: never;
     /** Working directory (defaults to process.cwd()). */
-    cwd?: string;
+    cwd?: string | undefined;
     /** Download destination directory. @default 'build/downloaded' */
-    downloadDir?: string;
+    downloadDir?: string | undefined;
     /** @internal Discriminator fields */
     libc?: never;
     /** Output filename. @default resolved asset name */
-    output?: string;
+    output?: string | undefined;
     /** Suppress log messages. @default false */
-    quiet?: boolean;
+    quiet?: boolean | undefined;
     /** Remove macOS quarantine attribute after download. @default false */
-    removeMacOSQuarantine?: boolean;
+    removeMacOSQuarantine?: boolean | undefined;
     /** Specific release tag to download. */
-    tag?: string;
+    tag?: string | undefined;
     /** @internal Discriminator fields */
     targetArch?: never;
     /** @internal Discriminator fields */
     targetPlatform?: never;
-    /** Tool/package name for directory structure and release matching. */
-    tool: string;
 }
 /**
  * Configuration for downloading socket-btm binary releases.
@@ -40,25 +38,23 @@ export interface SocketBtmBinaryConfig {
     /** @internal Discriminator field */
     asset?: never;
     /** Binary/executable name (without extension). @default tool */
-    bin?: string;
+    bin?: string | undefined;
     /** Working directory (defaults to process.cwd()). */
-    cwd?: string;
+    cwd?: string | undefined;
     /** Download destination directory. @default 'build/downloaded' */
-    downloadDir?: string;
+    downloadDir?: string | undefined;
     /** Linux libc variant. Auto-detected if not specified. */
-    libc?: Libc;
+    libc?: Libc | undefined;
     /** Suppress log messages. @default false */
-    quiet?: boolean;
+    quiet?: boolean | undefined;
     /** Remove macOS quarantine attribute after download. @default true */
-    removeMacOSQuarantine?: boolean;
+    removeMacOSQuarantine?: boolean | undefined;
     /** Specific release tag to download. */
-    tag?: string;
+    tag?: string | undefined;
     /** Target architecture (defaults to current arch). */
-    targetArch?: Arch;
+    targetArch?: Arch | undefined;
     /** Target platform (defaults to current platform). */
-    targetPlatform?: Platform;
-    /** Tool/package name for directory structure and release matching. */
-    tool: string;
+    targetPlatform?: Platform | undefined;
 }
 /**
  * Configuration for downloading socket-btm releases (binary or asset).
@@ -74,10 +70,11 @@ export declare function detectLibc(): Libc | undefined;
 /**
  * Download a release from socket-btm.
  *
- * @param config - Download configuration
+ * @param tool - Tool/package name for release matching (e.g., 'lief', 'curl')
+ * @param options - Download configuration
  * @returns Path to the downloaded file
  */
-export declare function downloadSocketBtmRelease(config: SocketBtmReleaseConfig): Promise<string>;
+export declare function downloadSocketBtmRelease(tool: string, options: SocketBtmReleaseConfig | undefined): Promise<string>;
 /**
  * Get asset name for a socket-btm binary.
  *

package/dist/releases/socket-btm.js

@@ -69,16 +69,17 @@ function detectLibc() {
     return "glibc";
   }
 }
-async function downloadSocketBtmRelease(config) {
-  const { cwd, downloadDir, quiet = false, tag, tool } = config;
+async function downloadSocketBtmRelease(tool, options) {
+  const config = Object.assign(/* @__PURE__ */ Object.create(null), options);
+  const { cwd, downloadDir, quiet = false, tag } = config;
   const toolPrefix = `${tool}-`;
   let downloadConfig;
-  if ("asset" in config) {
-    const {
-      asset,
-      output,
-      removeMacOSQuarantine = false
-    } = config;
+  if (options && "asset" in options) {
+    const assetConfig = Object.assign(
+      /* @__PURE__ */ Object.create(null),
+      options
+    );
+    const { asset, output, removeMacOSQuarantine = false } = assetConfig;
     let resolvedAsset;
     let resolvedTag = tag;
     const isExactMatch = typeof asset === "string" && !asset.includes("*");
@@ -127,13 +128,17 @@ async function downloadSocketBtmRelease(config) {
       removeMacOSQuarantine
     };
   } else {
+    const binaryConfig = Object.assign(
+      /* @__PURE__ */ Object.create(null),
+      options
+    );
     const {
       bin,
       libc = detectLibc(),
       removeMacOSQuarantine = true,
       targetArch = (0, import_platform.getArch)(),
       targetPlatform = (0, import_platform.getPlatform)()
-    } = config;
+    } = binaryConfig;
     const baseName = bin || tool;
     const assetName = getBinaryAssetName(
       baseName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/lib",
-  "version": "5.9.0",
+  "version": "5.10.0",
   "packageManager": "pnpm@10.32.1",
   "license": "MIT",
   "description": "Core utilities and infrastructure for Socket.dev security tools",
@@ -734,7 +734,7 @@
     "@socketregistry/is-unicode-supported": "1.0.5",
     "@socketregistry/packageurl-js": "1.3.5",
     "@socketregistry/yocto-spinner": "1.0.25",
-    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@5.8.2",
+    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@5.9.0",
     "@types/node": "24.9.2",
     "@typescript/native-preview": "7.0.0-dev.20250920.1",
     "@vitest/coverage-v8": "4.0.3",