@socketsecurity/lib 6.0.3 → 6.0.5

package/dist/http-request/browser.js

@@ -1,224 +1,206 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_http_request_browser_fetch = require('./browser-fetch.js');
+
+//#region src/http-request/browser.ts
+/**
+* @file Browser-safe HTTP request layer — mirrors the public surface of
+*   `@socketsecurity/lib/http-request` (`httpJson`, `httpText`, `httpRequest`,
+*   `HttpResponseError`) but uses the browser's `fetch` API instead of Node's
+*   `node:https`. Designed for Chrome MV3 service workers, content scripts,
+*   popups, and any other browser context that doesn't have `node:http` /
+*   `node:https` / `node:stream`. Consumers import from
+*   `@socketsecurity/lib/http-request/browser` directly, OR from
+*   `@socketsecurity/lib/http-request` inside a bundler that resolves the
+*   `browser` package.json conditional (rolldown, vite, esbuild) — the bundler
+*   picks this entry automatically. API parity with the Node side is the goal —
+*   same function names, same option shapes (where browsers can support them),
+*   same error shape. Caveats:
+*
+*   - `HttpResponse.body` is `Uint8Array` here, vs Node's `Buffer`. Most callers
+*     use `arrayBuffer()` / `text()` / `json()` and don't care.
+*   - `HttpResponse.headers` is `Record<string, string>` here, vs Node's
+*     `IncomingHttpHeaders` (which has array-valued headers like `set-cookie`).
+*     Browser `fetch()` flattens repeated headers per spec.
+*   - Hooks (`onRequest` / `onResponse`) are not yet supported in the browser
+*     path. Add when needed.
+*/
+/**
+* Browser-side HTTP error. Mirrors the Node-side `HttpResponseError` shape
+* (same `.name`, same `.response.status/statusText` access pattern, same
+* `instanceof` semantics) but constructs from a `BrowserHttpResponse` instead
+* of a Node `HttpResponse`.
+*/
+var HttpResponseError = class extends Error {
+	response;
+	constructor(response, message) {
+		const statusCode = response.status ?? "unknown";
+		const statusMessage = response.statusText || "No status message";
+		super(message ?? `HTTP ${statusCode}: ${statusMessage}`);
+		this.name = "HttpResponseError";
+		this.response = response;
+	}
 };
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var browser_exports = {};
-__export(browser_exports, {
-  HttpResponseError: () => HttpResponseError,
-  attempt: () => attempt,
-  combineSignals: () => combineSignals,
-  decodeText: () => decodeText,
-  headersToRecord: () => headersToRecord,
-  httpJson: () => httpJson,
-  httpRequest: () => httpRequest,
-  httpText: () => httpText,
-  sleep: () => sleep
-});
-module.exports = __toCommonJS(browser_exports);
-var import_browser_fetch = require("./browser-fetch");
-class HttpResponseError extends Error {
-  response;
-  constructor(response, message) {
-    const statusCode = response.status ?? "unknown";
-    const statusMessage = response.statusText || "No status message";
-    super(message ?? `HTTP ${statusCode}: ${statusMessage}`);
-    this.name = "HttpResponseError";
-    this.response = response;
-  }
-}
+/**
+* Combine an external `signal` with an internal `timeout`-driven
+* AbortController so either can cancel the in-flight fetch.
+*/
 function combineSignals(external, timeoutMs) {
-  if (!timeoutMs) {
-    return { signal: external, cleanup: () => {
-    } };
-  }
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  let externalListener;
-  if (external) {
-    if (external.aborted) {
-      controller.abort();
-    } else {
-      externalListener = () => controller.abort();
-      external.addEventListener("abort", externalListener);
-    }
-  }
-  return {
-    signal: controller.signal,
-    cleanup: () => {
-      clearTimeout(timer);
-      if (external && externalListener) {
-        external.removeEventListener("abort", externalListener);
-      }
-    }
-  };
+	if (!timeoutMs) return {
+		signal: external,
+		cleanup: () => {}
+	};
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), timeoutMs);
+	let externalListener;
+	if (external) if (external.aborted) controller.abort();
+	else {
+		externalListener = () => controller.abort();
+		external.addEventListener("abort", externalListener);
+	}
+	return {
+		signal: controller.signal,
+		cleanup: () => {
+			clearTimeout(timer);
+			if (external && externalListener) external.removeEventListener("abort", externalListener);
+		}
+	};
 }
 async function attempt(url, options) {
-  const method = options.method ?? "GET";
-  const init = { method };
-  if (options.headers) {
-    init.headers = options.headers;
-  }
-  if (options.body !== void 0) {
-    ;
-    init.body = options.body;
-  }
-  if (options.followRedirects === false) {
-    init.redirect = "manual";
-  }
-  const { signal, cleanup } = combineSignals(options.signal, options.timeout);
-  if (signal) {
-    init.signal = signal;
-  }
-  const startedAt = Date.now();
-  if (options.hooks?.onRequest) {
-    options.hooks.onRequest({
-      method,
-      url,
-      headers: options.headers,
-      timeout: options.timeout
-    });
-  }
-  try {
-    const response = await (0, import_browser_fetch.doFetch)(url, init);
-    const buffer = await response.arrayBuffer();
-    if (options.maxResponseSize !== void 0 && buffer.byteLength > options.maxResponseSize) {
-      throw new Error(
-        `Response body (${buffer.byteLength} bytes) exceeds maxResponseSize (${options.maxResponseSize})`
-      );
-    }
-    const body = new Uint8Array(buffer);
-    const headers = headersToRecord(response.headers);
-    if (options.hooks?.onResponse) {
-      options.hooks.onResponse({
-        method,
-        url,
-        duration: Date.now() - startedAt,
-        status: response.status,
-        statusText: response.statusText,
-        headers
-      });
-    }
-    return {
-      body,
-      headers,
-      status: response.status,
-      statusText: response.statusText,
-      ok: response.ok,
-      url: response.url,
-      arrayBuffer() {
-        return buffer;
-      },
-      text() {
-        return decodeText(body);
-      },
-      json() {
-        return JSON.parse(decodeText(body));
-      }
-    };
-  } catch (err) {
-    if (options.hooks?.onResponse) {
-      options.hooks.onResponse({
-        method,
-        url,
-        duration: Date.now() - startedAt,
-        error: err instanceof Error ? err : new Error(String(err))
-      });
-    }
-    throw err;
-  } finally {
-    cleanup();
-  }
+	const method = options.method ?? "GET";
+	const init = { method };
+	if (options.headers) init.headers = options.headers;
+	if (options.body !== void 0) init.body = options.body;
+	if (options.followRedirects === false) init.redirect = "manual";
+	const { signal, cleanup } = combineSignals(options.signal, options.timeout);
+	if (signal) init.signal = signal;
+	const startedAt = Date.now();
+	if (options.hooks?.onRequest) options.hooks.onRequest({
+		method,
+		url,
+		headers: options.headers,
+		timeout: options.timeout
+	});
+	try {
+		const response = await require_http_request_browser_fetch.doFetch(url, init);
+		const buffer = await response.arrayBuffer();
+		if (options.maxResponseSize !== void 0 && buffer.byteLength > options.maxResponseSize) throw new Error(`Response body (${buffer.byteLength} bytes) exceeds maxResponseSize (${options.maxResponseSize})`);
+		const body = new Uint8Array(buffer);
+		const headers = headersToRecord(response.headers);
+		if (options.hooks?.onResponse) options.hooks.onResponse({
+			method,
+			url,
+			duration: Date.now() - startedAt,
+			status: response.status,
+			statusText: response.statusText,
+			headers
+		});
+		return {
+			body,
+			headers,
+			status: response.status,
+			statusText: response.statusText,
+			ok: response.ok,
+			url: response.url,
+			arrayBuffer() {
+				return buffer;
+			},
+			text() {
+				return decodeText(body);
+			},
+			json() {
+				return JSON.parse(decodeText(body));
+			}
+		};
+	} catch (err) {
+		if (options.hooks?.onResponse) options.hooks.onResponse({
+			method,
+			url,
+			duration: Date.now() - startedAt,
+			error: err instanceof Error ? err : new Error(String(err))
+		});
+		throw err;
+	} finally {
+		cleanup();
+	}
 }
 function decodeText(bytes) {
-  return new TextDecoder("utf-8").decode(bytes);
+	return new TextDecoder("utf-8").decode(bytes);
 }
 function headersToRecord(headers) {
-  const out = {};
-  headers.forEach((value, key) => {
-    out[key.toLowerCase()] = value;
-  });
-  return out;
+	const out = {};
+	headers.forEach((value, key) => {
+		out[key.toLowerCase()] = value;
+	});
+	return out;
 }
+/**
+* GET / POST a JSON endpoint. Automatically sets `Accept: application/json` and
+* `Content-Type: application/json` (when a body is present). Throws
+* `HttpResponseError` on non-2xx.
+*/
 async function httpJson(url, options) {
-  const opts = options ?? {};
-  const headers = {
-    Accept: "application/json",
-    ...opts.headers ?? {}
-  };
-  if (opts.body !== void 0 && !("Content-Type" in headers)) {
-    headers["Content-Type"] = "application/json";
-  }
-  const response = await httpRequest(url, {
-    ...opts,
-    headers,
-    throwOnError: true
-  });
-  return response.json();
+	const opts = options ?? {};
+	const headers = {
+		Accept: "application/json",
+		...opts.headers ?? {}
+	};
+	if (opts.body !== void 0 && !("Content-Type" in headers)) headers["Content-Type"] = "application/json";
+	return (await httpRequest(url, {
+		...opts,
+		headers,
+		throwOnError: true
+	})).json();
 }
+/**
+* Lower-level HTTP request. Use `httpJson` / `httpText` for the common cases.
+* Returns the response unconditionally — callers inspect `.ok` or pass
+* `throwOnError: true` to get a thrown `HttpResponseError` on non-2xx.
+*/
 async function httpRequest(url, options) {
-  const opts = options ?? {};
-  const maxAttempts = (opts.retries ?? 0) + 1;
-  const baseDelay = opts.retryDelay ?? 250;
-  let lastError;
-  for (let i = 0; i < maxAttempts; i++) {
-    try {
-      const response = await attempt(url, opts);
-      if (response.status >= 500 && i + 1 < maxAttempts) {
-        await sleep(baseDelay * Math.pow(2, i));
-        continue;
-      }
-      if (opts.throwOnError && !response.ok) {
-        throw new HttpResponseError(response);
-      }
-      return response;
-    } catch (err) {
-      lastError = err;
-      if (err instanceof HttpResponseError) {
-        throw err;
-      }
-      if (i + 1 < maxAttempts) {
-        await sleep(baseDelay * Math.pow(2, i));
-        continue;
-      }
-    }
-  }
-  throw lastError instanceof Error ? lastError : new Error(`HTTP request to ${url} failed`);
+	const opts = options ?? {};
+	const maxAttempts = (opts.retries ?? 0) + 1;
+	const baseDelay = opts.retryDelay ?? 250;
+	let lastError;
+	for (let i = 0; i < maxAttempts; i++) try {
+		const response = await attempt(url, opts);
+		if (response.status >= 500 && i + 1 < maxAttempts) {
+			await sleep(baseDelay * Math.pow(2, i));
+			continue;
+		}
+		if (opts.throwOnError && !response.ok) throw new HttpResponseError(response);
+		return response;
+	} catch (err) {
+		lastError = err;
+		if (err instanceof HttpResponseError) throw err;
+		if (i + 1 < maxAttempts) {
+			await sleep(baseDelay * Math.pow(2, i));
+			continue;
+		}
+	}
+	throw lastError instanceof Error ? lastError : /* @__PURE__ */ new Error(`HTTP request to ${url} failed`);
 }
+/**
+* GET / POST a text endpoint. Throws `HttpResponseError` on non-2xx.
+*/
 async function httpText(url, options) {
-  const response = await httpRequest(url, {
-    ...options ?? {},
-    throwOnError: true
-  });
-  return response.text();
+	return (await httpRequest(url, {
+		...options ?? {},
+		throwOnError: true
+	})).text();
 }
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+	return new Promise((resolve) => setTimeout(resolve, ms));
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  HttpResponseError,
-  attempt,
-  combineSignals,
-  decodeText,
-  headersToRecord,
-  httpJson,
-  httpRequest,
-  httpText,
-  sleep
-});
+
+//#endregion
+exports.HttpResponseError = HttpResponseError;
+exports.attempt = attempt;
+exports.combineSignals = combineSignals;
+exports.decodeText = decodeText;
+exports.headersToRecord = headersToRecord;
+exports.httpJson = httpJson;
+exports.httpRequest = httpRequest;
+exports.httpText = httpText;
+exports.sleep = sleep;

package/dist/http-request/checksums.js

@@ -1,72 +1,108 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var checksums_exports = {};
-__export(checksums_exports, {
-  fetchChecksums: () => fetchChecksums,
-  parseChecksums: () => parseChecksums
-});
-module.exports = __toCommonJS(checksums_exports);
-var import_error = require("../primordials/error");
-var import_string = require("../primordials/string");
-var import_request = require("./request");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_error = require('../primordials/error.js');
+const require_primordials_string = require('../primordials/string.js');
+const require_http_request_request = require('./request.js');
+
+//#region src/http-request/checksums.ts
+/**
+* @file Checksum file fetching + parsing for download verification.
+*   `parseChecksums` understands the three common file shapes:
+*
+*   - BSD style: `SHA256 (filename) = hash`
+*   - GNU style: `hash filename` (two spaces)
+*   - Simple: `hash filename` (single space) Comment lines (`#…`) and blank lines
+*     are skipped. Hashes are lowercased. `fetchChecksums` is the URL helper —
+*     it fetches a checksums file via `httpRequest` and runs the body through
+*     `parseChecksums`. The pair lets `httpDownload({ sha256:
+*     checksums['file.zip'] })` keep the verification logic close to the
+*     manifest source.
+*/
 const CHECKSUM_BSD_RE = /^SHA256\s+\((.+)\)\s+=\s+([a-fA-F0-9]{64})$/;
 const CHECKSUM_GNU_RE = /^([a-fA-F0-9]{64})\s+(.+)$/;
+/**
+* Fetch and parse a checksums file from a URL.
+*
+* This is useful for verifying downloads from GitHub releases which typically
+* publish a checksums.txt file alongside release assets.
+*
+* @example
+*   ;```ts
+*   // Fetch checksums from GitHub release
+*   const checksums = await fetchChecksums(
+*     'https://github.com/org/repo/releases/download/v1.0.0/checksums.txt',
+*   )
+*
+*   // Use with httpDownload
+*   await httpDownload(
+*     'https://github.com/org/repo/releases/download/v1.0.0/tool_linux.tar.gz',
+*     '/tmp/tool.tar.gz',
+*     { sha256: checksums['tool_linux.tar.gz'] },
+*   )
+*   ```
+*
+* @param url - URL to the checksums file.
+* @param options - Request options.
+*
+* @returns Map of filenames to lowercase SHA256 hashes
+*
+* @throws {Error} When the checksums file cannot be fetched
+*/
 async function fetchChecksums(url, options) {
-  const {
-    ca,
-    headers = {},
-    timeout = 3e4
-  } = {
-    __proto__: null,
-    ...options
-  };
-  const response = await (0, import_request.httpRequest)(url, { ca, headers, timeout });
-  if (!response.ok) {
-    throw new import_error.ErrorCtor(
-      `Failed to fetch checksums from ${url}: ${response.status} ${response.statusText}`
-    );
-  }
-  return parseChecksums(response.body.toString("utf8"));
+	const { ca, headers = {}, timeout = 3e4 } = {
+		__proto__: null,
+		...options
+	};
+	const response = await require_http_request_request.httpRequest(url, {
+		ca,
+		headers,
+		timeout
+	});
+	if (!response.ok) throw new require_primordials_error.ErrorCtor(`Failed to fetch checksums from ${url}: ${response.status} ${response.statusText}`);
+	return parseChecksums(response.body.toString("utf8"));
 }
+/**
+* Parse a checksums file text into a filename-to-hash map.
+*
+* Supports standard checksums file formats: - BSD style: "SHA256 (filename) =
+* hash" - GNU style: "hash filename" (two spaces) - Simple style: "hash
+* filename" (single space)
+*
+* Lines starting with '#' are treated as comments and ignored. Empty lines are
+* ignored.
+*
+* @example
+*   ```ts
+*   const text = `
+*   # SHA256 checksums
+*   e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  file.zip
+*   abc123def456...  other.tar.gz
+*   `
+*   const checksums = parseChecksums(text)
+*   console.log(checksums['file.zip']) // 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
+*   ```
+*
+* @param text - Raw text content of a checksums file.
+*
+* @returns Map of filenames to lowercase SHA256 hashes
+*/
 function parseChecksums(text) {
-  const checksums = { __proto__: null };
-  for (const line of (0, import_string.StringPrototypeSplit)(text, "\n")) {
-    const trimmed = line.trim();
-    if (!trimmed || (0, import_string.StringPrototypeStartsWith)(trimmed, "#")) {
-      continue;
-    }
-    const bsdMatch = CHECKSUM_BSD_RE.exec(trimmed);
-    if (bsdMatch) {
-      checksums[bsdMatch[1]] = bsdMatch[2].toLowerCase();
-      continue;
-    }
-    const gnuMatch = CHECKSUM_GNU_RE.exec(trimmed);
-    if (gnuMatch) {
-      checksums[gnuMatch[2]] = gnuMatch[1].toLowerCase();
-    }
-  }
-  return checksums;
+	const checksums = { __proto__: null };
+	for (const line of require_primordials_string.StringPrototypeSplit(text, "\n")) {
+		const trimmed = line.trim();
+		if (!trimmed || require_primordials_string.StringPrototypeStartsWith(trimmed, "#")) continue;
+		const bsdMatch = CHECKSUM_BSD_RE.exec(trimmed);
+		if (bsdMatch) {
+			checksums[bsdMatch[1]] = bsdMatch[2].toLowerCase();
+			continue;
+		}
+		const gnuMatch = CHECKSUM_GNU_RE.exec(trimmed);
+		if (gnuMatch) checksums[gnuMatch[2]] = gnuMatch[1].toLowerCase();
+	}
+	return checksums;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  fetchChecksums,
-  parseChecksums
-});
+
+//#endregion
+exports.fetchChecksums = fetchChecksums;
+exports.parseChecksums = parseChecksums;

package/dist/http-request/download-types.js

@@ -1,18 +1,2 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var download_types_exports = {};
-module.exports = __toCommonJS(download_types_exports);
+/* Socket Lib - Built with rolldown */