@socketsecurity/lib 5.9.1 → 5.10.0

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.10.0](https://github.com/SocketDev/socket-lib/releases/tag/v5.10.0) - 2026-03-14
+
+### Changed
+
+- **releases/socket-btm**: Refactored `downloadSocketBtmRelease()` API for caller-controlled download paths
+  - Tool name moved from config object to required first parameter
+  - Config object is now optional second parameter (was required)
+  - Removed automatic `/${toolName}/${platformArch}` directory nesting - callers now have full control over download directory structure
+  - All optional parameters in config types now explicitly typed as `| undefined`
+  - Migration example:
+    - Before: `downloadSocketBtmRelease({ tool: 'lief', downloadDir: 'build' })`
+    - After: `downloadSocketBtmRelease('lief', { downloadDir: 'build' })`
+  - Rationale: Previous automatic path nesting created unexpected directory structures (e.g., `build/downloaded/lief/darwin-arm64/lief/assets/`) making it impossible for callers to predict exact file locations
+
 ## [5.9.1](https://github.com/SocketDev/socket-lib/releases/tag/v5.9.1) - 2026-03-14
 
 ### Fixed

package/dist/releases/github.js

@@ -121,7 +121,7 @@ async function downloadGitHubRelease(config) {
   }
   const path = /* @__PURE__ */ getPath();
   const resolvedDownloadDir = path.isAbsolute(downloadDir) ? downloadDir : path.join(cwd, downloadDir);
-  const binaryDir = path.join(resolvedDownloadDir, toolName, platformArch);
+  const binaryDir = resolvedDownloadDir;
   const binaryPath = path.join(binaryDir, binaryName);
   const versionPath = path.join(binaryDir, ".version");
   const fs = /* @__PURE__ */ getFs();

package/dist/releases/socket-btm.d.ts

@@ -13,25 +13,23 @@ export interface SocketBtmAssetConfig {
     /** @internal Discriminator fields */
     bin?: never;
     /** Working directory (defaults to process.cwd()). */
-    cwd?: string;
+    cwd?: string | undefined;
     /** Download destination directory. @default 'build/downloaded' */
-    downloadDir?: string;
+    downloadDir?: string | undefined;
     /** @internal Discriminator fields */
     libc?: never;
     /** Output filename. @default resolved asset name */
-    output?: string;
+    output?: string | undefined;
     /** Suppress log messages. @default false */
-    quiet?: boolean;
+    quiet?: boolean | undefined;
     /** Remove macOS quarantine attribute after download. @default false */
-    removeMacOSQuarantine?: boolean;
+    removeMacOSQuarantine?: boolean | undefined;
     /** Specific release tag to download. */
-    tag?: string;
+    tag?: string | undefined;
     /** @internal Discriminator fields */
     targetArch?: never;
     /** @internal Discriminator fields */
     targetPlatform?: never;
-    /** Tool/package name for directory structure and release matching. */
-    tool: string;
 }
 /**
  * Configuration for downloading socket-btm binary releases.
@@ -40,25 +38,23 @@ export interface SocketBtmBinaryConfig {
     /** @internal Discriminator field */
     asset?: never;
     /** Binary/executable name (without extension). @default tool */
-    bin?: string;
+    bin?: string | undefined;
     /** Working directory (defaults to process.cwd()). */
-    cwd?: string;
+    cwd?: string | undefined;
     /** Download destination directory. @default 'build/downloaded' */
-    downloadDir?: string;
+    downloadDir?: string | undefined;
     /** Linux libc variant. Auto-detected if not specified. */
-    libc?: Libc;
+    libc?: Libc | undefined;
     /** Suppress log messages. @default false */
-    quiet?: boolean;
+    quiet?: boolean | undefined;
     /** Remove macOS quarantine attribute after download. @default true */
-    removeMacOSQuarantine?: boolean;
+    removeMacOSQuarantine?: boolean | undefined;
     /** Specific release tag to download. */
-    tag?: string;
+    tag?: string | undefined;
     /** Target architecture (defaults to current arch). */
-    targetArch?: Arch;
+    targetArch?: Arch | undefined;
     /** Target platform (defaults to current platform). */
-    targetPlatform?: Platform;
-    /** Tool/package name for directory structure and release matching. */
-    tool: string;
+    targetPlatform?: Platform | undefined;
 }
 /**
  * Configuration for downloading socket-btm releases (binary or asset).
@@ -74,10 +70,11 @@ export declare function detectLibc(): Libc | undefined;
 /**
  * Download a release from socket-btm.
  *
- * @param config - Download configuration
+ * @param tool - Tool/package name for release matching (e.g., 'lief', 'curl')
+ * @param options - Download configuration
  * @returns Path to the downloaded file
  */
-export declare function downloadSocketBtmRelease(config: SocketBtmReleaseConfig): Promise<string>;
+export declare function downloadSocketBtmRelease(tool: string, options: SocketBtmReleaseConfig | undefined): Promise<string>;
 /**
  * Get asset name for a socket-btm binary.
  *

package/dist/releases/socket-btm.js

@@ -69,16 +69,17 @@ function detectLibc() {
     return "glibc";
   }
 }
-async function downloadSocketBtmRelease(config) {
-  const { cwd, downloadDir, quiet = false, tag, tool } = config;
+async function downloadSocketBtmRelease(tool, options) {
+  const config = Object.assign(/* @__PURE__ */ Object.create(null), options);
+  const { cwd, downloadDir, quiet = false, tag } = config;
   const toolPrefix = `${tool}-`;
   let downloadConfig;
-  if ("asset" in config) {
-    const {
-      asset,
-      output,
-      removeMacOSQuarantine = false
-    } = config;
+  if (options && "asset" in options) {
+    const assetConfig = Object.assign(
+      /* @__PURE__ */ Object.create(null),
+      options
+    );
+    const { asset, output, removeMacOSQuarantine = false } = assetConfig;
     let resolvedAsset;
     let resolvedTag = tag;
     const isExactMatch = typeof asset === "string" && !asset.includes("*");
@@ -127,13 +128,17 @@ async function downloadSocketBtmRelease(config) {
       removeMacOSQuarantine
     };
   } else {
+    const binaryConfig = Object.assign(
+      /* @__PURE__ */ Object.create(null),
+      options
+    );
     const {
       bin,
       libc = detectLibc(),
       removeMacOSQuarantine = true,
       targetArch = (0, import_platform.getArch)(),
       targetPlatform = (0, import_platform.getPlatform)()
-    } = config;
+    } = binaryConfig;
     const baseName = bin || tool;
     const assetName = getBinaryAssetName(
       baseName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/lib",
-  "version": "5.9.1",
+  "version": "5.10.0",
   "packageManager": "pnpm@10.32.1",
   "license": "MIT",
   "description": "Core utilities and infrastructure for Socket.dev security tools",