@socketsecurity/lib 6.0.2 → 6.0.4

package/dist/releases/github-downloads.js

@@ -1,143 +1,123 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var github_downloads_exports = {};
-__export(github_downloads_exports, {
-  downloadGitHubRelease: () => downloadGitHubRelease,
-  downloadReleaseAsset: () => downloadReleaseAsset
-});
-module.exports = __toCommonJS(github_downloads_exports);
-var import_node_process = __toESM(require("node:process"));
-var import_safe = require("../fs/safe");
-var import_download = require("../http-request/download");
-var import_default = require("../logger/default");
-var import_error = require("../primordials/error");
-var import_string = require("../primordials/string");
-var import_child = require("../process/spawn/child");
-var import_github_asset_url = require("./github-asset-url");
-var import_github_listing = require("./github-listing");
-var import_fs = require("../node/fs");
-var import_path = require("../node/path");
-const logger = (0, import_default.getDefaultLogger)();
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_primordials_error = require('../primordials/error.js');
+const require_primordials_string = require('../primordials/string.js');
+const require_node_fs = require('../node/fs.js');
+const require_node_path = require('../node/path.js');
+const require_logger_default = require('../logger/default.js');
+const require_process_spawn_child = require('../process/spawn/child.js');
+const require_fs_safe = require('../fs/safe.js');
+const require_http_request_download = require('../http-request/download.js');
+const require_releases_github_asset_url = require('./github-asset-url.js');
+const require_releases_github_listing = require('./github-listing.js');
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+
+//#region src/releases/github-downloads.ts
+/**
+* @file GitHub release asset downloads.
+*/
+const logger = require_logger_default.getDefaultLogger();
+/**
+* Download a binary from any GitHub repository with version caching.
+*
+* @example
+*   ;```typescript
+*   const binaryPath = await downloadGitHubRelease({
+*     owner: 'SocketDev',
+*     repo: 'socket-btm',
+*     toolName: 'lief',
+*     toolPrefix: 'lief-',
+*     assetName: 'lief-linux-x64',
+*     binaryName: 'lief',
+*     platformArch: 'linux-x64',
+*   })
+*   ```
+*
+* @param config - Download configuration.
+*
+* @returns Path to the downloaded binary
+*/
 async function downloadGitHubRelease(config) {
-  const {
-    assetName,
-    binaryName,
-    cwd = import_node_process.default.cwd(),
-    downloadDir = "build/downloaded",
-    owner,
-    platformArch,
-    quiet = false,
-    removeMacOSQuarantine = true,
-    repo,
-    tag: explicitTag,
-    toolName,
-    toolPrefix
-  } = config;
-  let tag;
-  if (explicitTag) {
-    tag = explicitTag;
-  } else if (toolPrefix) {
-    const latestTag = await (0, import_github_listing.getLatestRelease)(toolPrefix, { owner, repo });
-    if (!latestTag) {
-      throw new import_error.ErrorCtor(`No ${toolPrefix} release found in ${owner}/${repo}`);
-    }
-    tag = latestTag;
-  } else {
-    throw new import_error.ErrorCtor("Either toolPrefix or tag must be provided");
-  }
-  const path = (0, import_path.getNodePath)();
-  const resolvedDownloadDir = path.isAbsolute(downloadDir) ? downloadDir : path.join(cwd, downloadDir);
-  const binaryDir = resolvedDownloadDir;
-  const binaryPath = path.join(binaryDir, binaryName);
-  const versionPath = path.join(binaryDir, ".version");
-  const fs = (0, import_fs.getNodeFs)();
-  if (fs.existsSync(versionPath) && fs.existsSync(binaryPath)) {
-    const cachedVersion = (await fs.promises.readFile(versionPath, "utf8")).trim();
-    if (cachedVersion === tag && fs.existsSync(binaryPath)) {
-      if (!quiet) {
-        logger.info(`Using cached ${toolName} (${platformArch}): ${binaryPath}`);
-      }
-      return binaryPath;
-    }
-  }
-  if (!quiet) {
-    logger.info(`Downloading ${toolName} for ${platformArch}...`);
-  }
-  await downloadReleaseAsset(
-    tag,
-    assetName,
-    binaryPath,
-    { owner, repo },
-    { quiet }
-  );
-  const isWindows = (0, import_string.StringPrototypeEndsWith)(binaryName, ".exe");
-  if (!isWindows) {
-    fs.chmodSync(binaryPath, 493);
-    if (removeMacOSQuarantine && import_node_process.default.platform === "darwin" && (0, import_string.StringPrototypeStartsWith)(platformArch, "darwin")) {
-      try {
-        await (0, import_child.spawn)("xattr", ["-d", "com.apple.quarantine", binaryPath], {
-          stdio: "ignore"
-        });
-      } catch {
-      }
-    }
-  }
-  await fs.promises.writeFile(versionPath, tag, "utf8");
-  if (!quiet) {
-    logger.info(`Downloaded ${toolName} to ${binaryPath}`);
-  }
-  return binaryPath;
+	const { assetName, binaryName, cwd = node_process.default.cwd(), downloadDir = "build/downloaded", owner, platformArch, quiet = false, removeMacOSQuarantine = true, repo, tag: explicitTag, toolName, toolPrefix } = config;
+	let tag;
+	if (explicitTag) tag = explicitTag;
+	else if (toolPrefix) {
+		const latestTag = await require_releases_github_listing.getLatestRelease(toolPrefix, {
+			owner,
+			repo
+		});
+		if (!latestTag) throw new require_primordials_error.ErrorCtor(`No ${toolPrefix} release found in ${owner}/${repo}`);
+		tag = latestTag;
+	} else throw new require_primordials_error.ErrorCtor("Either toolPrefix or tag must be provided");
+	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const binaryDir = path.isAbsolute(downloadDir) ? downloadDir : path.join(cwd, downloadDir);
+	const binaryPath = path.join(binaryDir, binaryName);
+	const versionPath = path.join(binaryDir, ".version");
+	const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+	if (fs.existsSync(versionPath) && fs.existsSync(binaryPath)) {
+		if ((await fs.promises.readFile(versionPath, "utf8")).trim() === tag && fs.existsSync(binaryPath)) {
+			if (!quiet) logger.info(`Using cached ${toolName} (${platformArch}): ${binaryPath}`);
+			return binaryPath;
+		}
+	}
+	if (!quiet) logger.info(`Downloading ${toolName} for ${platformArch}...`);
+	await downloadReleaseAsset(tag, assetName, binaryPath, {
+		owner,
+		repo
+	}, { quiet });
+	if (!require_primordials_string.StringPrototypeEndsWith(binaryName, ".exe")) {
+		fs.chmodSync(binaryPath, 493);
+		if (removeMacOSQuarantine && node_process.default.platform === "darwin" && require_primordials_string.StringPrototypeStartsWith(platformArch, "darwin")) try {
+			await require_process_spawn_child.spawn("xattr", [
+				"-d",
+				"com.apple.quarantine",
+				binaryPath
+			], { stdio: "ignore" });
+		} catch {}
+	}
+	await fs.promises.writeFile(versionPath, tag, "utf8");
+	if (!quiet) logger.info(`Downloaded ${toolName} to ${binaryPath}`);
+	return binaryPath;
 }
+/**
+* Download a specific release asset. Supports pattern matching for dynamic
+* asset discovery.
+*
+* @example
+*   ;```typescript
+*   await downloadReleaseAsset('v1.0.0', 'tool-linux-x64', '/tmp/tool', {
+*     owner: 'SocketDev',
+*     repo: 'socket-btm',
+*   })
+*   ```
+*
+* @param tag - Release tag name.
+* @param assetPattern - Asset name or pattern (glob string, prefix/suffix
+*   object, or RegExp)
+* @param outputPath - Path to write the downloaded file.
+* @param repoConfig - Repository configuration (owner/repo)
+* @param options - Additional options.
+*/
 async function downloadReleaseAsset(tag, assetPattern, outputPath, repoConfig, options = {}) {
-  const { owner, repo } = repoConfig;
-  const { quiet = false } = options;
-  const downloadUrl = await (0, import_github_asset_url.getReleaseAssetUrl)(tag, assetPattern, {
-    owner,
-    repo
-  });
-  if (!downloadUrl) {
-    const patternDesc = typeof assetPattern === "string" ? assetPattern : "matching pattern";
-    throw new import_error.ErrorCtor(`Asset ${patternDesc} not found in release ${tag}`);
-  }
-  const path = (0, import_path.getNodePath)();
-  await (0, import_safe.safeMkdir)(path.dirname(outputPath));
-  await (0, import_download.httpDownload)(downloadUrl, outputPath, {
-    logger: quiet ? void 0 : logger,
-    progressInterval: 10,
-    retries: 2,
-    retryDelay: 5e3
-  });
+	const { owner, repo } = repoConfig;
+	const { quiet = false } = options;
+	const downloadUrl = await require_releases_github_asset_url.getReleaseAssetUrl(tag, assetPattern, {
+		owner,
+		repo
+	});
+	if (!downloadUrl) throw new require_primordials_error.ErrorCtor(`Asset ${typeof assetPattern === "string" ? assetPattern : "matching pattern"} not found in release ${tag}`);
+	await require_fs_safe.safeMkdir((/* @__PURE__ */ require_node_path.getNodePath()).dirname(outputPath));
+	await require_http_request_download.httpDownload(downloadUrl, outputPath, {
+		logger: quiet ? void 0 : logger,
+		progressInterval: 10,
+		retries: 2,
+		retryDelay: 5e3
+	});
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  downloadGitHubRelease,
-  downloadReleaseAsset
-});
+
+//#endregion
+exports.downloadGitHubRelease = downloadGitHubRelease;
+exports.downloadReleaseAsset = downloadReleaseAsset;

package/dist/releases/github-listing.js

@@ -1,53 +1,56 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var github_listing_exports = {};
-__export(github_listing_exports, {
-  fetchReleasesViaGraphQL: () => fetchReleasesViaGraphQL,
-  fetchReleasesViaRest: () => fetchReleasesViaRest,
-  getLatestRelease: () => getLatestRelease
-});
-module.exports = __toCommonJS(github_listing_exports);
-var import_request = require("../http-request/request");
-var import_retry = require("../promises/retry");
-var import_array = require("../primordials/array");
-var import_date = require("../primordials/date");
-var import_error = require("../primordials/error");
-var import_json = require("../primordials/json");
-var import_object = require("../primordials/object");
-var import_string = require("../primordials/string");
-var import_github_assets = require("./github-assets");
-var import_github_auth = require("./github-auth");
-const RETRY_CONFIG = (0, import_object.ObjectFreeze)({
-  __proto__: null,
-  // Exponential backoff: delay doubles with each retry (5s, 10s, 20s).
-  backoffFactor: 2,
-  // Initial delay before first retry.
-  baseDelayMs: 5e3,
-  // Maximum number of retry attempts (excluding initial request).
-  retries: 2
-});
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_error = require('../primordials/error.js');
+const require_primordials_string = require('../primordials/string.js');
+const require_primordials_array = require('../primordials/array.js');
+const require_primordials_date = require('../primordials/date.js');
+const require_primordials_json = require('../primordials/json.js');
+const require_promises_retry = require('../promises/retry.js');
+const require_http_request_request = require('../http-request/request.js');
+const require_releases_github_assets = require('./github-assets.js');
+const require_releases_github_auth = require('./github-auth.js');
+const require_releases_github_retry_config = require('./github-retry-config.js');
+
+//#region src/releases/github-listing.ts
+/**
+* @file GitHub release listing via REST + GraphQL. Split out of
+*   `releases/github-api.ts` for size hygiene. Holds the "list all releases for
+*   a repo" path (both transports + the latest-matching-tag picker that
+*   composes them):
+*
+*   - `fetchReleasesViaRest` — canonical REST `/releases?per_page=100` listing
+*   - `fetchReleasesViaGraphQL` — GraphQL fallback when REST's ES index is
+*     degraded
+*   - `getLatestRelease` — REST → GraphQL fallback + prefix/asset filter The
+*     per-tag asset-URL lookup lives in `./github-asset-url`.
+*/
+/**
+* Fetch the latest 100 releases for a repo via GraphQL.
+*
+* Why this exists: `fetchReleasesViaRest` can return `[]` for two reasons (real
+* empty repo vs. GitHub-incident-degraded backend). When REST returns nothing,
+* the caller in `getLatestRelease` calls THIS to disambiguate — if we return >0
+* here, REST was lying.
+*
+* Field shape diffs we normalize: GraphQL returns REST equivalent Why they
+* differ `tagName` `tag_name` camelCase vs. snake_case `publishedAt`
+* `published_at` camelCase vs. snake_case `releaseAssets.nodes` `assets`
+* GraphQL connection wrapper unwrapped.
+*
+* We re-shape inside the `.map(...)` at the bottom so callers downstream can
+* use the SAME code path regardless of which transport ran.
+*
+* Why we hit a different backend: GraphQL queries don't go through the same
+* Elasticsearch index that REST listings rely on. During incidents that drop
+* the ES index (or its connectivity), GraphQL's `repository.releases`
+* connection keeps working because it reads from a different data path inside
+* GitHub. That's the entire reason this fallback exists.
+*/
 async function fetchReleasesViaGraphQL(owner, repo) {
-  const response = await (0, import_request.httpRequest)("https://api.github.com/graphql", {
-    body: (0, import_json.JSONStringify)({
-      query: `query($owner: String!, $repo: String!) {
+	const response = await require_http_request_request.httpRequest("https://api.github.com/graphql", {
+		body: require_primordials_json.JSONStringify({
+			query: `query($owner: String!, $repo: String!) {
         repository(owner: $owner, name: $repo) {
           releases(first: 100, orderBy: {field: CREATED_AT, direction: DESC}) {
             nodes {
@@ -58,114 +61,132 @@ async function fetchReleasesViaGraphQL(owner, repo) {
           }
         }
       }`,
-      variables: { owner, repo }
-    }),
-    headers: { ...(0, import_github_auth.getAuthHeaders)(), "Content-Type": "application/json" },
-    method: "POST"
-  });
-  if (!response.ok) {
-    throw new import_error.ErrorCtor(
-      `Failed to fetch ${owner}/${repo} releases (GraphQL): ${response.status}`
-    );
-  }
-  let parsed;
-  try {
-    parsed = (0, import_json.JSONParse)(response.body.toString("utf8"));
-  } catch (cause) {
-    throw new import_error.ErrorCtor(
-      `Failed to parse GitHub GraphQL response for ${owner}/${repo} releases`,
-      { cause }
-    );
-  }
-  if (parsed.errors?.length) {
-    throw new import_error.ErrorCtor(
-      `GraphQL repository.releases(${owner}/${repo}) returned errors: ${parsed.errors.map((e) => e.message).join("; ")}`
-    );
-  }
-  return (parsed.data?.repository?.releases?.nodes ?? []).map((n) => ({
-    tag_name: n.tagName,
-    published_at: n.publishedAt,
-    assets: n.releaseAssets?.nodes ?? []
-  }));
+			variables: {
+				owner,
+				repo
+			}
+		}),
+		headers: {
+			...require_releases_github_auth.getAuthHeaders(),
+			"Content-Type": "application/json"
+		},
+		method: "POST"
+	});
+	if (!response.ok) throw new require_primordials_error.ErrorCtor(`Failed to fetch ${owner}/${repo} releases (GraphQL): ${response.status}`);
+	let parsed;
+	try {
+		parsed = require_primordials_json.JSONParse(response.body.toString("utf8"));
+	} catch (cause) {
+		throw new require_primordials_error.ErrorCtor(`Failed to parse GitHub GraphQL response for ${owner}/${repo} releases`, { cause });
+	}
+	/* c8 ignore start */
+	if (parsed.errors?.length) throw new require_primordials_error.ErrorCtor(`GraphQL repository.releases(${owner}/${repo}) returned errors: ${parsed.errors.map((e) => e.message).join("; ")}`);
+	return (parsed.data?.repository?.releases?.nodes ?? []).map((n) => ({
+		tag_name: n.tagName,
+		published_at: n.publishedAt,
+		assets: n.releaseAssets?.nodes ?? []
+	}));
+	/* c8 ignore stop */
 }
+/**
+* Fetch the latest 100 releases for a repo via REST.
+*
+* Why this returns `[]` on TWO different cases:
+*
+* - HTTP 200 + zero-byte body. This is the documented GitHub "search degraded"
+*   incident shape (see status.github.com). The releases listing endpoint
+*   shares an Elasticsearch index with search; when that ES is degraded,
+*   `/releases` returns a successful 200 OK but with NO BODY. There's no error
+*   code, no Retry-After, no rate-limit header — just an empty payload.
+* - HTTP 200 + literal `[]`. This is the _normal_ "the repo has no releases"
+*   response — say a brand-new repo with no published versions.
+*
+* Both produce the same `[]` here because the helper can't tell them apart
+* without context. The CALLER (getLatestRelease) does the cross-check: if REST
+* returns `[]`, query GraphQL once. If GraphQL also returns `[]`, the repo
+* really is empty. If it returns >0, REST was lying and we use GraphQL's
+* answer.
+*
+* Why we throw on non-OK status: `pRetry` wraps this call and retries on thrown
+* errors with exponential backoff. A 5xx is transient and worth retrying; we
+* want it to throw so pRetry can do its job. Empty body is NOT thrown because
+* pRetry can't help — a 200 OK is "done" as far as retry policy is concerned.
+*/
 async function fetchReleasesViaRest(owner, repo) {
-  const response = await (0, import_request.httpRequest)(
-    `https://api.github.com/repos/${owner}/${repo}/releases?per_page=100`,
-    { headers: (0, import_github_auth.getAuthHeaders)() }
-  );
-  if (!response.ok) {
-    throw new import_error.ErrorCtor(
-      `Failed to fetch ${owner}/${repo} releases: ${response.status}`
-    );
-  }
-  const text = response.body.toString("utf8");
-  if (text.length === 0) {
-    return [];
-  }
-  let parsed;
-  try {
-    parsed = (0, import_json.JSONParse)(text);
-  } catch (cause) {
-    throw new import_error.ErrorCtor(`Failed to parse ${owner}/${repo} releases response`, {
-      cause
-    });
-  }
-  return (0, import_array.ArrayIsArray)(parsed) ? parsed : [];
+	const response = await require_http_request_request.httpRequest(`https://api.github.com/repos/${owner}/${repo}/releases?per_page=100`, { headers: require_releases_github_auth.getAuthHeaders() });
+	if (!response.ok) throw new require_primordials_error.ErrorCtor(`Failed to fetch ${owner}/${repo} releases: ${response.status}`);
+	const text = response.body.toString("utf8");
+	if (text.length === 0) return [];
+	let parsed;
+	try {
+		parsed = require_primordials_json.JSONParse(text);
+	} catch (cause) {
+		throw new require_primordials_error.ErrorCtor(`Failed to parse ${owner}/${repo} releases response`, { cause });
+	}
+	/* c8 ignore start */
+	return require_primordials_array.ArrayIsArray(parsed) ? parsed : [];
+	/* c8 ignore stop */
 }
+/**
+* Get latest release tag matching a tool prefix. Optionally filter by releases
+* containing a matching asset.
+*
+* @example
+*   ;```typescript
+*   const tag = await getLatestRelease('lief-', {
+*     owner: 'SocketDev',
+*     repo: 'socket-btm',
+*   })
+*   console.log(tag) // 'lief-2025-01-15-abc1234'
+*   ```
+*
+* @param toolPrefix - Tool name prefix to search for (e.g., 'node-smol-')
+* @param repoConfig - Repository configuration (owner/repo)
+* @param options - Additional options.
+* @param options.assetPattern - Optional pattern to filter releases by matching
+*   asset.
+* @param options.nothrow - If true, return undefined instead of throwing when
+*   both REST and GraphQL backends are degraded. Default: false.
+*
+* @returns Latest release tag or undefined if not found
+*
+* @throws {Error} If both REST and GraphQL backends are degraded and nothrow is
+*   false.
+*/
 async function getLatestRelease(toolPrefix, repoConfig, options = {}) {
-  const { assetPattern, nothrow = false } = options;
-  const { owner, repo } = repoConfig;
-  const isMatch = assetPattern ? (0, import_github_assets.createAssetMatcher)(assetPattern) : void 0;
-  return await (0, import_retry.pRetry)(async () => {
-    let releases = await fetchReleasesViaRest(owner, repo);
-    if (releases.length === 0) {
-      let graphqlReleases;
-      try {
-        graphqlReleases = await fetchReleasesViaGraphQL(owner, repo);
-      } catch (cause) {
-        if (nothrow) {
-          return void 0;
-        }
-        throw new import_error.ErrorCtor(
-          `Failed to list ${owner}/${repo} releases: both REST and GraphQL backends degraded`,
-          { cause }
-        );
-      }
-      if (graphqlReleases.length > 0) {
-        releases = graphqlReleases;
-      }
-    }
-    const matchingReleases = releases.filter((release) => {
-      const { assets, tag_name: tag } = release;
-      if (!(0, import_string.StringPrototypeStartsWith)(tag, toolPrefix)) {
-        return false;
-      }
-      if (!assets || assets.length === 0) {
-        return false;
-      }
-      if (isMatch) {
-        const hasMatchingAsset = assets.some(
-          (a) => isMatch(a.name)
-        );
-        if (!hasMatchingAsset) {
-          return false;
-        }
-      }
-      return true;
-    });
-    if (matchingReleases.length === 0) {
-      return void 0;
-    }
-    matchingReleases.sort(
-      (a, b) => (0, import_date.DateParse)(b.published_at) - (0, import_date.DateParse)(a.published_at)
-    );
-    const latestRelease = matchingReleases[0];
-    return latestRelease.tag_name;
-  }, RETRY_CONFIG) ?? void 0;
+	const { assetPattern, nothrow = false } = options;
+	const { owner, repo } = repoConfig;
+	const isMatch = assetPattern ? require_releases_github_assets.createAssetMatcher(assetPattern) : void 0;
+	return await /* @__PURE__ */ require_promises_retry.pRetry(async () => {
+		let releases = await fetchReleasesViaRest(owner, repo);
+		if (releases.length === 0) {
+			let graphqlReleases;
+			try {
+				graphqlReleases = await fetchReleasesViaGraphQL(owner, repo);
+			} catch (cause) {
+				/* c8 ignore next 7 - REST + GraphQL both-degraded branch
+				requires both real backends to fail simultaneously. */
+				if (nothrow) return;
+				throw new require_primordials_error.ErrorCtor(`Failed to list ${owner}/${repo} releases: both REST and GraphQL backends degraded`, { cause });
+			}
+			if (graphqlReleases.length > 0) releases = graphqlReleases;
+		}
+		const matchingReleases = releases.filter((release) => {
+			const { assets, tag_name: tag } = release;
+			if (!require_primordials_string.StringPrototypeStartsWith(tag, toolPrefix)) return false;
+			if (!assets || assets.length === 0) return false;
+			if (isMatch) {
+				if (!assets.some((a) => isMatch(a.name))) return false;
+			}
+			return true;
+		});
+		if (matchingReleases.length === 0) return;
+		matchingReleases.sort((a, b) => require_primordials_date.DateParse(b.published_at) - require_primordials_date.DateParse(a.published_at));
+		return matchingReleases[0].tag_name;
+	}, require_releases_github_retry_config.GITHUB_RETRY_CONFIG) ?? void 0;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  fetchReleasesViaGraphQL,
-  fetchReleasesViaRest,
-  getLatestRelease
-});
+
+//#endregion
+exports.fetchReleasesViaGraphQL = fetchReleasesViaGraphQL;
+exports.fetchReleasesViaRest = fetchReleasesViaRest;
+exports.getLatestRelease = getLatestRelease;

package/dist/releases/github-retry-config.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @file Shared retry configuration for the GitHub release helpers
+ *   (`github-listing`, `github-asset-url`). Exponential backoff over the
+ *   transient-failure / rate-limit surface. `baseDelayMs` is overridable via
+ *   `SOCKET_GITHUB_RETRY_BASE_DELAY_MS` — set it to `0` for near-instant
+ *   retries. Tests set it so the backoff sleep (5s + 10s of real wallclock)
+ *   doesn't run: pRetry's delay goes through `node:timers/promises`, which
+ *   `vi.useFakeTimers()` doesn't reliably intercept, so a zero base delay is
+ *   the robust, fake-timer-independent way to keep these tests fast. CI can
+ *   also dial it down. Default stays 5000ms for production resilience.
+ */
+/**
+ * Default base delay (ms) before the first retry when the env override is unset
+ * or non-numeric.
+ */
+export declare const DEFAULT_BASE_DELAY_MS = 5000;
+/**
+ * Resolve the retry base delay from `SOCKET_GITHUB_RETRY_BASE_DELAY_MS`,
+ * falling back to {@link DEFAULT_BASE_DELAY_MS}. Read live (not memoized) so
+ * it's unit-testable by mutating the env — and so a long-lived process that has
+ * the env changed under it picks up the new value on next read.
+ *
+ * @returns The configured base delay in milliseconds.
+ */
+export declare function resolveBaseDelayMs(): number;
+export declare const GITHUB_RETRY_CONFIG: Readonly<{
+    __proto__: null;
+    backoffFactor: 2;
+    baseDelayMs: number;
+    retries: 2;
+}>;