@socketsecurity/lib 6.0.2 → 6.0.4

package/dist/releases/github-asset-url.js

@@ -1,50 +1,59 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var github_asset_url_exports = {};
-__export(github_asset_url_exports, {
-  fetchReleaseAssetsViaGraphQL: () => fetchReleaseAssetsViaGraphQL,
-  getReleaseAssetUrl: () => getReleaseAssetUrl
-});
-module.exports = __toCommonJS(github_asset_url_exports);
-var import_request = require("../http-request/request");
-var import_retry = require("../promises/retry");
-var import_array = require("../primordials/array");
-var import_error = require("../primordials/error");
-var import_json = require("../primordials/json");
-var import_object = require("../primordials/object");
-var import_github_assets = require("./github-assets");
-var import_github_auth = require("./github-auth");
-const RETRY_CONFIG = (0, import_object.ObjectFreeze)({
-  __proto__: null,
-  // Exponential backoff: delay doubles with each retry (5s, 10s, 20s).
-  backoffFactor: 2,
-  // Initial delay before first retry.
-  baseDelayMs: 5e3,
-  // Maximum number of retry attempts (excluding initial request).
-  retries: 2
-});
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_error = require('../primordials/error.js');
+const require_primordials_array = require('../primordials/array.js');
+const require_primordials_json = require('../primordials/json.js');
+const require_promises_retry = require('../promises/retry.js');
+const require_http_request_request = require('../http-request/request.js');
+const require_releases_github_assets = require('./github-assets.js');
+const require_releases_github_auth = require('./github-auth.js');
+const require_releases_github_retry_config = require('./github-retry-config.js');
+
+//#region src/releases/github-asset-url.ts
+/**
+* @file Per-release asset-URL discovery for GitHub releases. Split out of
+*   `releases/github-api.ts` for size hygiene. Holds the "fetch this specific
+*   tag's downloadable asset URL" path (REST with GraphQL fallback for ES-index
+*   incidents):
+*
+*   - `fetchReleaseAssetsViaGraphQL` — GraphQL fallback when REST's per-tag
+*     endpoint returns 200 + empty body
+*   - `getReleaseAssetUrl` — REST per-tag lookup + pattern matcher + GraphQL
+*     fallback The list-all-releases path lives in `./github-listing`.
+*/
+/**
+* Fetch the assets of a single release identified by tag via GraphQL.
+*
+* Why this exists: `getReleaseAssetUrl` uses REST `/releases/tags/:tag` to look
+* up a single release and find a downloadable asset. During GitHub incidents
+* that endpoint can return 200 + empty body the same way the listing endpoint
+* does (the per-tag lookup joins against the same listing index for asset
+* discovery). This helper hits GraphQL `repository.release(tagName)` which uses
+* a different backend.
+*
+* Field shape diff we normalize: GraphQL returns REST equivalent
+* `releaseAssets.nodes[].downloadUrl` `assets[].browser_download_url`
+*
+* Same URL, different field name and one extra connection-wrapper level. The
+* mapping at the bottom converts so the asset-matcher in `getReleaseAssetUrl`
+* can run unchanged.
+*
+* Return contract:
+*
+* - Array of assets (REST shape) when the release exists.
+* - `undefined` when the release with that tag genuinely doesn't exist (GraphQL
+*   returned `release: null` over the wire — we translate that to undefined per
+*   the codebase convention). The caller throws a clean "tag not found" error
+*   in that case.
+* - Throws on transport errors (non-OK HTTP, GraphQL errors[], or even the
+*   GraphQL backend ALSO returning empty body — at that point both transports
+*   are degraded and we want the pRetry wrapper to back off and retry).
+*/
 async function fetchReleaseAssetsViaGraphQL(owner, repo, tag) {
-  const response = await (0, import_request.httpRequest)("https://api.github.com/graphql", {
-    body: (0, import_json.JSONStringify)({
-      query: `query($owner: String!, $repo: String!, $tag: String!) {
+	const response = await require_http_request_request.httpRequest("https://api.github.com/graphql", {
+		body: require_primordials_json.JSONStringify({
+			query: `query($owner: String!, $repo: String!, $tag: String!) {
         repository(owner: $owner, name: $repo) {
           release(tagName: $tag) {
             tagName
@@ -52,116 +61,114 @@ async function fetchReleaseAssetsViaGraphQL(owner, repo, tag) {
           }
         }
       }`,
-      variables: { owner, repo, tag }
-    }),
-    headers: { ...(0, import_github_auth.getAuthHeaders)(), "Content-Type": "application/json" },
-    method: "POST"
-  });
-  if (!response.ok) {
-    throw new import_error.ErrorCtor(
-      `Failed to fetch ${owner}/${repo} release ${tag} (GraphQL): ${response.status} ${response.statusText}`
-    );
-  }
-  if (response.body.byteLength === 0) {
-    throw new import_error.ErrorCtor(
-      `Failed to fetch ${owner}/${repo} release ${tag}: GraphQL returned empty body`
-    );
-  }
-  let parsed;
-  try {
-    parsed = (0, import_json.JSONParse)(response.body.toString("utf8"));
-  } catch (cause) {
-    throw new import_error.ErrorCtor(
-      `Failed to parse ${owner}/${repo} release ${tag} response (GraphQL)`,
-      { cause }
-    );
-  }
-  if (parsed.errors?.length) {
-    throw new import_error.ErrorCtor(
-      `GraphQL repository.release(${owner}/${repo}, ${tag}) returned errors: ${parsed.errors.map((e) => e.message).join("; ")}`
-    );
-  }
-  const release = parsed.data?.repository?.release;
-  if (!release) {
-    return void 0;
-  }
-  return (release.releaseAssets?.nodes ?? []).map((n) => ({
-    browser_download_url: n.downloadUrl,
-    name: n.name
-  }));
+			variables: {
+				owner,
+				repo,
+				tag
+			}
+		}),
+		headers: {
+			...require_releases_github_auth.getAuthHeaders(),
+			"Content-Type": "application/json"
+		},
+		method: "POST"
+	});
+	if (!response.ok) throw new require_primordials_error.ErrorCtor(`Failed to fetch ${owner}/${repo} release ${tag} (GraphQL): ${response.status} ${response.statusText}`);
+	if (response.body.byteLength === 0) throw new require_primordials_error.ErrorCtor(`Failed to fetch ${owner}/${repo} release ${tag}: GraphQL returned empty body`);
+	let parsed;
+	try {
+		parsed = require_primordials_json.JSONParse(response.body.toString("utf8"));
+	} catch (cause) {
+		throw new require_primordials_error.ErrorCtor(`Failed to parse ${owner}/${repo} release ${tag} response (GraphQL)`, { cause });
+	}
+	/* c8 ignore next 4 */
+	if (parsed.errors?.length) throw new require_primordials_error.ErrorCtor(`GraphQL repository.release(${owner}/${repo}, ${tag}) returned errors: ${parsed.errors.map((e) => e.message).join("; ")}`);
+	const release = parsed.data?.repository?.release;
+	if (!release) return;
+	/* c8 ignore start */
+	return (release.releaseAssets?.nodes ?? []).map((n) => ({
+		browser_download_url: n.downloadUrl,
+		name: n.name
+	}));
+	/* c8 ignore stop */
 }
+/**
+* Get download URL for a specific release asset. Supports pattern matching for
+* dynamic asset discovery.
+*
+* @example
+*   ;```typescript
+*   const url = await getReleaseAssetUrl('v1.0.0', 'tool-linux-x64', {
+*     owner: 'SocketDev',
+*     repo: 'socket-btm',
+*   })
+*   ```
+*
+* @param tag - Release tag name.
+* @param assetPattern - Asset name or pattern (glob string, prefix/suffix
+*   object, or RegExp)
+* @param repoConfig - Repository configuration (owner/repo)
+* @param options - Additional options.
+* @param options.nothrow - If true, return undefined instead of throwing when
+*   both REST and GraphQL backends are degraded. Default: false.
+*
+* @returns Browser download URL for the asset, or undefined when not found.
+*
+* @throws {Error} If both REST and GraphQL backends are degraded and nothrow is
+*   false.
+*/
 async function getReleaseAssetUrl(tag, assetPattern, repoConfig, options = {}) {
-  const { nothrow = false } = options;
-  const { owner, repo } = repoConfig;
-  const isMatch = typeof assetPattern === "string" && !assetPattern.includes("*") && !assetPattern.includes("{") ? (input) => input === assetPattern : (0, import_github_assets.createAssetMatcher)(assetPattern);
-  const assets = await (0, import_retry.pRetry)(async () => {
-    const response = await (0, import_request.httpRequest)(
-      `https://api.github.com/repos/${owner}/${repo}/releases/tags/${tag}`,
-      {
-        headers: (0, import_github_auth.getAuthHeaders)()
-      }
-    );
-    if (!response.ok) {
-      throw new import_error.ErrorCtor(
-        `Failed to fetch ${owner}/${repo} release ${tag}: ${response.status}`
-      );
-    }
-    let assets2;
-    if (response.body.byteLength === 0) {
-      let fallbackAssets;
-      try {
-        fallbackAssets = await fetchReleaseAssetsViaGraphQL(owner, repo, tag);
-      } catch (cause) {
-        if (nothrow) {
-          return void 0;
-        }
-        throw new import_error.ErrorCtor(
-          `Failed to fetch ${owner}/${repo} release ${tag}: both REST and GraphQL backends degraded`,
-          { cause }
-        );
-      }
-      if (fallbackAssets === void 0) {
-        if (nothrow) {
-          return void 0;
-        }
-        throw new import_error.ErrorCtor(`Release ${tag} not found in ${owner}/${repo}`);
-      }
-      assets2 = fallbackAssets;
-    } else {
-      let release;
-      try {
-        release = (0, import_json.JSONParse)(response.body.toString("utf8"));
-      } catch (cause) {
-        throw new import_error.ErrorCtor(
-          `Failed to parse ${owner}/${repo} release ${tag} response`,
-          { cause }
-        );
-      }
-      if (!(0, import_array.ArrayIsArray)(release.assets)) {
-        throw new import_error.ErrorCtor(`Release ${tag} has no assets in ${owner}/${repo}`);
-      }
-      assets2 = release.assets;
-    }
-    return assets2;
-  }, RETRY_CONFIG);
-  if (!assets) {
-    if (nothrow) {
-      return void 0;
-    }
-    throw new import_error.ErrorCtor(`Release ${tag} not found in ${owner}/${repo}`);
-  }
-  const asset = assets.find((a) => isMatch(a.name));
-  if (!asset) {
-    if (nothrow) {
-      return void 0;
-    }
-    const patternDesc = typeof assetPattern === "string" ? assetPattern : "matching pattern";
-    throw new import_error.ErrorCtor(`Asset ${patternDesc} not found in release ${tag}`);
-  }
-  return asset.browser_download_url;
+	const { nothrow = false } = options;
+	const { owner, repo } = repoConfig;
+	/* c8 ignore start */
+	const isMatch = typeof assetPattern === "string" && !assetPattern.includes("*") && !assetPattern.includes("{") ? (input) => input === assetPattern : require_releases_github_assets.createAssetMatcher(assetPattern);
+	/* c8 ignore stop */
+	const assets = await /* @__PURE__ */ require_promises_retry.pRetry(async () => {
+		const response = await require_http_request_request.httpRequest(`https://api.github.com/repos/${owner}/${repo}/releases/tags/${tag}`, { headers: require_releases_github_auth.getAuthHeaders() });
+		if (!response.ok) throw new require_primordials_error.ErrorCtor(`Failed to fetch ${owner}/${repo} release ${tag}: ${response.status}`);
+		let assets;
+		if (response.body.byteLength === 0) {
+			let fallbackAssets;
+			try {
+				fallbackAssets = await fetchReleaseAssetsViaGraphQL(owner, repo, tag);
+			} catch (cause) {
+				/* c8 ignore next 7 - Both backends degraded; needs real
+				network failure on both REST and GraphQL. */
+				if (nothrow) return;
+				throw new require_primordials_error.ErrorCtor(`Failed to fetch ${owner}/${repo} release ${tag}: both REST and GraphQL backends degraded`, { cause });
+			}
+			/* c8 ignore start */
+			if (fallbackAssets === void 0) {
+				if (nothrow) return;
+				throw new require_primordials_error.ErrorCtor(`Release ${tag} not found in ${owner}/${repo}`);
+			}
+			assets = fallbackAssets;
+		} else {
+			let release;
+			try {
+				release = require_primordials_json.JSONParse(response.body.toString("utf8"));
+			} catch (cause) {
+				throw new require_primordials_error.ErrorCtor(`Failed to parse ${owner}/${repo} release ${tag} response`, { cause });
+			}
+			if (!require_primordials_array.ArrayIsArray(release.assets)) throw new require_primordials_error.ErrorCtor(`Release ${tag} has no assets in ${owner}/${repo}`);
+			assets = release.assets;
+		}
+		return assets;
+	}, require_releases_github_retry_config.GITHUB_RETRY_CONFIG);
+	if (!assets) {
+		if (nothrow) return;
+		throw new require_primordials_error.ErrorCtor(`Release ${tag} not found in ${owner}/${repo}`);
+	}
+	const asset = assets.find((a) => isMatch(a.name));
+	/* c8 ignore start */
+	if (!asset) {
+		if (nothrow) return;
+		throw new require_primordials_error.ErrorCtor(`Asset ${typeof assetPattern === "string" ? assetPattern : "matching pattern"} not found in release ${tag}`);
+	}
+	/* c8 ignore stop */
+	return asset.browser_download_url;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  fetchReleaseAssetsViaGraphQL,
-  getReleaseAssetUrl
-});
+
+//#endregion
+exports.fetchReleaseAssetsViaGraphQL = fetchReleaseAssetsViaGraphQL;
+exports.getReleaseAssetUrl = getReleaseAssetUrl;

package/dist/releases/github-assets.js

@@ -1,52 +1,40 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var github_assets_exports = {};
-__export(github_assets_exports, {
-  createAssetMatcher: () => createAssetMatcher
-});
-module.exports = __toCommonJS(github_assets_exports);
-var import_picomatch = __toESM(require("../external/picomatch"));
-var import_string = require("../primordials/string");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_primordials_string = require('../primordials/string.js');
+let src_external_picomatch = require("../external/picomatch");
+src_external_picomatch = require_runtime.__toESM(src_external_picomatch);
+
+//#region src/releases/github-assets.ts
+/**
+* @file Asset matching helpers for GitHub releases.
+*/
+/**
+* Create a matcher function for a pattern using picomatch for glob patterns or
+* simple prefix/suffix matching for object patterns.
+*
+* @example
+*   ;```typescript
+*   const isMatch = createAssetMatcher('tool-*-linux-x64')
+*   isMatch('tool-v1.0-linux-x64') // true
+*   isMatch('tool-v1.0-darwin-arm64') // false
+*   ```
+*
+* @param pattern - Pattern to match (string glob, prefix/suffix object, or
+*   RegExp)
+*
+* @returns Function that tests if a string matches the pattern
+*/
 function createAssetMatcher(pattern) {
-  if (typeof pattern === "string") {
-    const isMatch = (0, import_picomatch.default)(pattern);
-    return (input) => isMatch(input);
-  }
-  if (pattern instanceof RegExp) {
-    return (input) => pattern.test(input);
-  }
-  const { prefix, suffix } = pattern;
-  return (input) => (0, import_string.StringPrototypeStartsWith)(input, prefix) && (0, import_string.StringPrototypeEndsWith)(input, suffix);
+	if (typeof pattern === "string") {
+		const isMatch = (0, src_external_picomatch.default)(pattern);
+		return (input) => isMatch(input);
+	}
+	if (pattern instanceof RegExp) return (input) => pattern.test(input);
+	const { prefix, suffix } = pattern;
+	return (input) => require_primordials_string.StringPrototypeStartsWith(input, prefix) && require_primordials_string.StringPrototypeEndsWith(input, suffix);
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  createAssetMatcher
-});
+
+//#endregion
+exports.createAssetMatcher = createAssetMatcher;

package/dist/releases/github-auth.js

@@ -1,51 +1,35 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var github_auth_exports = {};
-__export(github_auth_exports, {
-  getAuthHeaders: () => getAuthHeaders
-});
-module.exports = __toCommonJS(github_auth_exports);
-var import_node_process = __toESM(require("node:process"));
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+
+//#region src/releases/github-auth.ts
+/**
+* @file GitHub API authentication header helpers.
+*/
+/**
+* Get GitHub authentication headers if token is available. Checks GH_TOKEN or
+* GITHUB_TOKEN environment variables.
+*
+* @example
+*   ;```typescript
+*   const headers = getAuthHeaders()
+*   // { Accept: 'application/vnd.github+json', Authorization: 'Bearer ...' }
+*   ```
+*
+* @returns Headers object with Authorization header if token exists.
+*/
 function getAuthHeaders() {
-  const token = import_node_process.default.env["GH_TOKEN"] || import_node_process.default.env["GITHUB_TOKEN"];
-  const headers = {
-    Accept: "application/vnd.github+json",
-    "X-GitHub-Api-Version": "2022-11-28"
-  };
-  if (token) {
-    headers["Authorization"] = `Bearer ${token}`;
-  }
-  return headers;
+	const token = node_process.default.env["GH_TOKEN"] || node_process.default.env["GITHUB_TOKEN"];
+	const headers = {
+		Accept: "application/vnd.github+json",
+		"X-GitHub-Api-Version": "2022-11-28"
+	};
+	if (token) headers["Authorization"] = `Bearer ${token}`;
+	return headers;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  getAuthHeaders
-});
+
+//#endregion
+exports.getAuthHeaders = getAuthHeaders;