@socketsecurity/lib 6.0.5 → 6.0.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (210) hide show
  1. package/CHANGELOG.md +18 -0
  2. package/dist/ai/discover.js +3 -2
  3. package/dist/ai/spawn.js +8 -5
  4. package/dist/ai/worktree.js +11 -6
  5. package/dist/ansi/strip.js +2 -2
  6. package/dist/archives/_internal.js +4 -4
  7. package/dist/archives/zip.js +1 -1
  8. package/dist/arrays/_internal.js +2 -2
  9. package/dist/arrays/chunk.js +1 -1
  10. package/dist/arrays/join.js +2 -2
  11. package/dist/arrays/unique.js +1 -1
  12. package/dist/bin/acorn-bindgen.cjs +769 -0
  13. package/dist/bin/acorn.wasm +0 -0
  14. package/dist/bin/check-primordials.js +3 -2
  15. package/dist/bin/check.js +3 -2
  16. package/dist/bin/exec.js +1 -1
  17. package/dist/bin/prim.cjs +39064 -0
  18. package/dist/bin/resolve.js +1 -1
  19. package/dist/colors/socket-palette.js +2 -2
  20. package/dist/compression/_internal.js +3 -2
  21. package/dist/compression/brotli.js +5 -12
  22. package/dist/compression/gzip.js +5 -13
  23. package/dist/constants/agents.js +4 -4
  24. package/dist/constants/packages.js +6 -6
  25. package/dist/constants/socket.js +1 -1
  26. package/dist/crypto/hash.js +2 -2
  27. package/dist/debug/_internal.js +2 -2
  28. package/dist/debug/caller-info.js +1 -1
  29. package/dist/debug/namespace.js +5 -5
  30. package/dist/debug/output.js +3 -3
  31. package/dist/dlx/binary-download.js +3 -2
  32. package/dist/eco/npm/npm/flags.js +5 -5
  33. package/dist/eco/npm/pnpm/flags.js +3 -3
  34. package/dist/env/boolean.js +1 -1
  35. package/dist/env/ci.js +1 -1
  36. package/dist/env/debug.js +1 -1
  37. package/dist/env/github.js +8 -8
  38. package/dist/env/home.js +1 -1
  39. package/dist/env/locale.js +3 -3
  40. package/dist/env/node-auth-token.js +1 -1
  41. package/dist/env/node-env.js +1 -1
  42. package/dist/env/npm.js +5 -5
  43. package/dist/env/number.js +1 -1
  44. package/dist/env/package-manager.js +3 -3
  45. package/dist/env/path.js +1 -1
  46. package/dist/env/pre-commit.js +1 -1
  47. package/dist/env/rewire.js +2 -2
  48. package/dist/env/shell.js +1 -1
  49. package/dist/env/socket-cli.js +13 -13
  50. package/dist/env/socket.js +33 -32
  51. package/dist/env/string.js +1 -1
  52. package/dist/env/temp-dir.js +3 -3
  53. package/dist/env/term.js +1 -1
  54. package/dist/env/test.js +3 -3
  55. package/dist/env/windows.js +4 -4
  56. package/dist/env/xdg.js +3 -3
  57. package/dist/events/exit/_internal.js +5 -5
  58. package/dist/events/exit/handler.js +1 -1
  59. package/dist/events/exit/intercept.js +2 -2
  60. package/dist/events/exit/lifecycle.js +3 -3
  61. package/dist/events/exit/signals.js +1 -1
  62. package/dist/external/@sinclair/typebox/value.js +5 -1
  63. package/dist/external/@sinclair/typebox.js +5 -1
  64. package/dist/external/@socketregistry/packageurl-js.js +27 -0
  65. package/dist/external-tools/bazel/resolve.js +2 -1
  66. package/dist/external-tools/cdxgen/resolve.js +2 -1
  67. package/dist/external-tools/from-pip-venv.d.ts +73 -0
  68. package/dist/external-tools/from-pip-venv.js +98 -0
  69. package/dist/external-tools/janus/asset-names.js +1 -1
  70. package/dist/external-tools/janus/from-download.js +3 -5
  71. package/dist/external-tools/janus/resolve.js +2 -1
  72. package/dist/external-tools/jre/from-download.js +2 -1
  73. package/dist/external-tools/jre/resolve.js +2 -1
  74. package/dist/external-tools/manifest.js +7 -5
  75. package/dist/external-tools/opengrep/resolve.js +2 -1
  76. package/dist/external-tools/sbt/resolve.js +2 -1
  77. package/dist/external-tools/skillspector/from-dlx.d.ts +24 -0
  78. package/dist/external-tools/skillspector/from-dlx.js +41 -0
  79. package/dist/external-tools/skillspector/from-path.d.ts +8 -0
  80. package/dist/external-tools/skillspector/from-path.js +32 -0
  81. package/dist/external-tools/skillspector/from-vfs.d.ts +8 -0
  82. package/dist/external-tools/skillspector/from-vfs.js +27 -0
  83. package/dist/external-tools/skillspector/resolve.d.ts +34 -0
  84. package/dist/external-tools/skillspector/resolve.js +53 -0
  85. package/dist/external-tools/skillspector/types.d.ts +24 -0
  86. package/dist/external-tools/skillspector/types.js +2 -0
  87. package/dist/external-tools/synp/resolve.js +2 -1
  88. package/dist/external-tools/trivy/resolve.js +2 -1
  89. package/dist/external-tools/trufflehog/resolve.js +2 -1
  90. package/dist/external-tools/uv/resolve.js +2 -1
  91. package/dist/fs/access.js +4 -4
  92. package/dist/fs/encoding.js +2 -2
  93. package/dist/fs/find-up.js +2 -2
  94. package/dist/fs/inspect.js +6 -6
  95. package/dist/fs/read-dir.js +3 -3
  96. package/dist/fs/read-file.js +6 -6
  97. package/dist/fs/read-json.js +2 -2
  98. package/dist/fs/safe.js +2 -2
  99. package/dist/fs/unique.js +1 -1
  100. package/dist/fs/validate.js +1 -1
  101. package/dist/fs/write-json.js +1 -1
  102. package/dist/git/_internal.js +2 -1
  103. package/dist/globs/_internal.js +4 -4
  104. package/dist/globs/match.js +4 -3
  105. package/dist/globs/matcher.js +2 -2
  106. package/dist/globs/stream.js +1 -1
  107. package/dist/http-request/browser.js +17 -11
  108. package/dist/http-request/download.js +1 -1
  109. package/dist/http-request/headers.d.ts +32 -3
  110. package/dist/http-request/headers.js +42 -13
  111. package/dist/http-request/request-attempt.js +1 -0
  112. package/dist/http-request/request-types.d.ts +5 -0
  113. package/dist/http-request/request.js +32 -15
  114. package/dist/http-request/response-reader.d.ts +12 -1
  115. package/dist/http-request/response-reader.js +22 -2
  116. package/dist/http-request/user-agent.js +1 -1
  117. package/dist/json/edit.js +1 -1
  118. package/dist/json/parse.js +4 -4
  119. package/dist/logger/colors.js +2 -2
  120. package/dist/logger/console.js +1 -1
  121. package/dist/logger/symbols.js +1 -1
  122. package/dist/node/async-hooks.js +2 -2
  123. package/dist/node/child-process.js +2 -2
  124. package/dist/node/crypto.js +2 -2
  125. package/dist/node/events.js +2 -2
  126. package/dist/node/fs-promises.js +2 -2
  127. package/dist/node/fs.js +2 -2
  128. package/dist/node/http.js +2 -2
  129. package/dist/node/https.js +2 -2
  130. package/dist/node/module.js +3 -3
  131. package/dist/node/os.js +2 -2
  132. package/dist/node/path.js +2 -2
  133. package/dist/node/timers-promises.js +2 -2
  134. package/dist/node/url.js +2 -2
  135. package/dist/node/util.js +2 -2
  136. package/dist/objects/getters.js +2 -2
  137. package/dist/objects/inspect.js +3 -3
  138. package/dist/objects/mutate.js +1 -1
  139. package/dist/objects/predicates.js +4 -4
  140. package/dist/objects/sort.js +4 -4
  141. package/dist/packages/edit-class.js +1 -1
  142. package/dist/packages/edit.js +2 -2
  143. package/dist/packages/exports.js +6 -6
  144. package/dist/packages/licenses.js +8 -8
  145. package/dist/packages/manifest.js +3 -3
  146. package/dist/packages/normalize.js +4 -4
  147. package/dist/packages/operations.js +11 -11
  148. package/dist/packages/provenance.d.ts +6 -0
  149. package/dist/packages/provenance.js +12 -3
  150. package/dist/packages/specs.js +5 -5
  151. package/dist/packages/validation.js +3 -3
  152. package/dist/paths/_internal.js +3 -3
  153. package/dist/paths/conversion.js +4 -4
  154. package/dist/paths/normalize.js +3 -1
  155. package/dist/paths/packages.js +3 -3
  156. package/dist/paths/predicates.js +7 -7
  157. package/dist/paths/resolve.js +3 -3
  158. package/dist/process/spawn/_internal.js +3 -3
  159. package/dist/process/spawn/errors.js +2 -2
  160. package/dist/process/spawn/stdio.js +1 -1
  161. package/dist/promises/_internal.js +1 -1
  162. package/dist/promises/iterate.js +5 -5
  163. package/dist/promises/options.js +3 -3
  164. package/dist/promises/retry.js +1 -1
  165. package/dist/secrets/_internal.js +3 -2
  166. package/dist/secrets/keychain.js +5 -4
  167. package/dist/secrets/linux.js +6 -4
  168. package/dist/secrets/macos.js +5 -3
  169. package/dist/secrets/rc.js +9 -6
  170. package/dist/secrets/windows.js +7 -4
  171. package/dist/shell/parse.d.ts +108 -1
  172. package/dist/shell/parse.js +168 -2
  173. package/dist/smol/detect.js +1 -1
  174. package/dist/smol/http.js +1 -1
  175. package/dist/smol/https.js +1 -1
  176. package/dist/smol/manifest.js +1 -1
  177. package/dist/smol/path.js +1 -1
  178. package/dist/smol/primordial.js +1 -1
  179. package/dist/smol/purl.js +1 -1
  180. package/dist/smol/versions.js +1 -1
  181. package/dist/smol/vfs.js +1 -1
  182. package/dist/sorts/_internal.js +4 -4
  183. package/dist/sorts/natural.js +3 -3
  184. package/dist/sorts/semver.js +1 -1
  185. package/dist/sorts/strings.js +1 -1
  186. package/dist/spinner/default.js +1 -1
  187. package/dist/spinner/spinner.js +1 -1
  188. package/dist/ssri/convert.js +2 -2
  189. package/dist/ssri/parse.js +1 -1
  190. package/dist/ssri/validate.js +2 -2
  191. package/dist/stdio/prompts.js +1 -1
  192. package/dist/streams/parallel.js +2 -2
  193. package/dist/streams/transform.js +1 -1
  194. package/dist/strings/format.js +4 -4
  195. package/dist/strings/predicates.js +2 -2
  196. package/dist/strings/search.js +1 -1
  197. package/dist/strings/transform.js +3 -3
  198. package/dist/strings/width.js +2 -2
  199. package/dist/temporal/instant.js +4 -2
  200. package/dist/temporal/slots.js +3 -2
  201. package/dist/themes/context.js +2 -2
  202. package/dist/url/parse.js +2 -2
  203. package/dist/url/predicates.js +1 -1
  204. package/dist/url/search-params.js +6 -6
  205. package/dist/words/article.js +1 -1
  206. package/dist/words/capitalize.js +1 -1
  207. package/dist/words/pluralize.d.ts +24 -2
  208. package/dist/words/pluralize.js +37 -2
  209. package/dist/words/types.d.ts +25 -2
  210. package/package.json +44 -4
@@ -1,6 +1,12 @@
1
1
  "use strict";
2
2
  /* Socket Lib - Built with rolldown */
3
3
  Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
4
+ const require_primordials_error = require('../primordials/error.js');
5
+ const require_primordials_math = require('../primordials/math.js');
6
+ const require_primordials_array = require('../primordials/array.js');
7
+ const require_primordials_date = require('../primordials/date.js');
8
+ const require_primordials_json = require('../primordials/json.js');
9
+ const require_primordials_promise = require('../primordials/promise.js');
4
10
  const require_http_request_browser_fetch = require('./browser-fetch.js');
5
11
 
6
12
  //#region src/http-request/browser.ts
@@ -75,7 +81,7 @@ async function attempt(url, options) {
75
81
  if (options.followRedirects === false) init.redirect = "manual";
76
82
  const { signal, cleanup } = combineSignals(options.signal, options.timeout);
77
83
  if (signal) init.signal = signal;
78
- const startedAt = Date.now();
84
+ const startedAt = require_primordials_date.DateNow();
79
85
  if (options.hooks?.onRequest) options.hooks.onRequest({
80
86
  method,
81
87
  url,
@@ -85,13 +91,13 @@ async function attempt(url, options) {
85
91
  try {
86
92
  const response = await require_http_request_browser_fetch.doFetch(url, init);
87
93
  const buffer = await response.arrayBuffer();
88
- if (options.maxResponseSize !== void 0 && buffer.byteLength > options.maxResponseSize) throw new Error(`Response body (${buffer.byteLength} bytes) exceeds maxResponseSize (${options.maxResponseSize})`);
89
- const body = new Uint8Array(buffer);
94
+ if (options.maxResponseSize !== void 0 && buffer.byteLength > options.maxResponseSize) throw new require_primordials_error.ErrorCtor(`Response body (${buffer.byteLength} bytes) exceeds maxResponseSize (${options.maxResponseSize})`);
95
+ const body = new require_primordials_array.Uint8ArrayCtor(buffer);
90
96
  const headers = headersToRecord(response.headers);
91
97
  if (options.hooks?.onResponse) options.hooks.onResponse({
92
98
  method,
93
99
  url,
94
- duration: Date.now() - startedAt,
100
+ duration: require_primordials_date.DateNow() - startedAt,
95
101
  status: response.status,
96
102
  statusText: response.statusText,
97
103
  headers
@@ -110,15 +116,15 @@ async function attempt(url, options) {
110
116
  return decodeText(body);
111
117
  },
112
118
  json() {
113
- return JSON.parse(decodeText(body));
119
+ return require_primordials_json.JSONParse(decodeText(body));
114
120
  }
115
121
  };
116
122
  } catch (err) {
117
123
  if (options.hooks?.onResponse) options.hooks.onResponse({
118
124
  method,
119
125
  url,
120
- duration: Date.now() - startedAt,
121
- error: err instanceof Error ? err : new Error(String(err))
126
+ duration: require_primordials_date.DateNow() - startedAt,
127
+ error: err instanceof Error ? err : new require_primordials_error.ErrorCtor(String(err))
122
128
  });
123
129
  throw err;
124
130
  } finally {
@@ -166,7 +172,7 @@ async function httpRequest(url, options) {
166
172
  for (let i = 0; i < maxAttempts; i++) try {
167
173
  const response = await attempt(url, opts);
168
174
  if (response.status >= 500 && i + 1 < maxAttempts) {
169
- await sleep(baseDelay * Math.pow(2, i));
175
+ await sleep(baseDelay * require_primordials_math.MathPow(2, i));
170
176
  continue;
171
177
  }
172
178
  if (opts.throwOnError && !response.ok) throw new HttpResponseError(response);
@@ -175,11 +181,11 @@ async function httpRequest(url, options) {
175
181
  lastError = err;
176
182
  if (err instanceof HttpResponseError) throw err;
177
183
  if (i + 1 < maxAttempts) {
178
- await sleep(baseDelay * Math.pow(2, i));
184
+ await sleep(baseDelay * require_primordials_math.MathPow(2, i));
179
185
  continue;
180
186
  }
181
187
  }
182
- throw lastError instanceof Error ? lastError : /* @__PURE__ */ new Error(`HTTP request to ${url} failed`);
188
+ throw lastError instanceof Error ? lastError : new require_primordials_error.ErrorCtor(`HTTP request to ${url} failed`);
183
189
  }
184
190
  /**
185
191
  * GET / POST a text endpoint. Throws `HttpResponseError` on non-2xx.
@@ -191,7 +197,7 @@ async function httpText(url, options) {
191
197
  })).text();
192
198
  }
193
199
  function sleep(ms) {
194
- return new Promise((resolve) => setTimeout(resolve, ms));
200
+ return new require_primordials_promise.PromiseCtor((resolve) => setTimeout(resolve, ms));
195
201
  }
196
202
 
197
203
  //#endregion
@@ -7,8 +7,8 @@ const require_primordials_error = require('../primordials/error.js');
7
7
  const require_primordials_math = require('../primordials/math.js');
8
8
  const require_primordials_number = require('../primordials/number.js');
9
9
  const require_node_fs = require('../node/fs.js');
10
- const require_fs_safe = require('../fs/safe.js');
11
10
  const require_primordials_promise = require('../primordials/promise.js');
11
+ const require_fs_safe = require('../fs/safe.js');
12
12
  const require_http_request_request_attempt = require('./request-attempt.js');
13
13
  const require_http_request_response_types = require('./response-types.js');
14
14
  let node_timers_promises = require("node:timers/promises");
@@ -9,6 +9,34 @@
9
9
  * payload. No I/O — these can be imported anywhere without dragging the
10
10
  * Node.js `http`/`https` modules into the bundle.
11
11
  */
12
+ /**
13
+ * Build an HTTP Basic `Authorization` header value from a Socket API token.
14
+ *
15
+ * The Socket API uses the token as the username with an empty password, so the
16
+ * credential pair is `<token>:`. Centralized here so every fleet caller emits
17
+ * the identical shape instead of hand-rolling `btoa(\`${token}:`)`.
18
+ *
19
+ * @example
20
+ * ;```ts
21
+ * const headers = { Authorization: basicAuthHeader(apiToken) }
22
+ * // { Authorization: 'Basic c2t0X3h4eHg6' }
23
+ * ```
24
+ *
25
+ * @param token - The Socket API token (used as the Basic-auth username).
26
+ *
27
+ * @returns The `Authorization` header value, e.g. `Basic <base64>`.
28
+ */
29
+ export declare function basicAuthHeader(token: string): string;
30
+ /**
31
+ * Whether a header name looks credential-bearing and should be redacted from
32
+ * logs and telemetry. Case-insensitive substring match on the name only — the
33
+ * value is never inspected.
34
+ *
35
+ * @param name - The header name (e.g. `Authorization`, `x-api-key`).
36
+ *
37
+ * @returns `true` when the value should be replaced with `[REDACTED]`.
38
+ */
39
+ export declare function isSensitiveHeaderName(name: string): boolean;
12
40
  /**
13
41
  * Parse a `Retry-After` HTTP header value into milliseconds.
14
42
  *
@@ -37,9 +65,10 @@ export declare function parseRetryAfterHeader(value: string | string[] | undefin
37
65
  /**
38
66
  * Redact sensitive HTTP headers for safe logging and telemetry.
39
67
  *
40
- * Replaces values of sensitive headers (Authorization, Cookie, etc.) with
41
- * `[REDACTED]`. Non-sensitive headers are passed through unchanged. Array
42
- * values are joined with `', '`.
68
+ * Replaces values of credential-bearing headers with `[REDACTED]`, matching the
69
+ * header name by shape (see `isSensitiveHeaderName`) so custom token headers
70
+ * are covered without an enumerated list. Non-sensitive headers pass through
71
+ * unchanged. Array values are joined with `', '`.
43
72
  *
44
73
  * @example
45
74
  * ;```ts
@@ -3,9 +3,9 @@
3
3
  Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
4
4
  const require_primordials_number = require('../primordials/number.js');
5
5
  const require_primordials_array = require('../primordials/array.js');
6
- const require_primordials_map_set = require('../primordials/map-set.js');
7
6
  const require_primordials_date = require('../primordials/date.js');
8
7
  const require_primordials_object = require('../primordials/object.js');
8
+ const require_primordials_globals = require('../primordials/globals.js');
9
9
 
10
10
  //#region src/http-request/headers.ts
11
11
  /**
@@ -21,6 +21,40 @@ const require_primordials_object = require('../primordials/object.js');
21
21
  */
22
22
  const RETRY_AFTER_INT_RE = /^\d+$/;
23
23
  /**
24
+ * Build an HTTP Basic `Authorization` header value from a Socket API token.
25
+ *
26
+ * The Socket API uses the token as the username with an empty password, so the
27
+ * credential pair is `<token>:`. Centralized here so every fleet caller emits
28
+ * the identical shape instead of hand-rolling `btoa(\`${token}:`)`.
29
+ *
30
+ * @example
31
+ * ;```ts
32
+ * const headers = { Authorization: basicAuthHeader(apiToken) }
33
+ * // { Authorization: 'Basic c2t0X3h4eHg6' }
34
+ * ```
35
+ *
36
+ * @param token - The Socket API token (used as the Basic-auth username).
37
+ *
38
+ * @returns The `Authorization` header value, e.g. `Basic <base64>`.
39
+ */
40
+ /*@__NO_SIDE_EFFECTS__*/
41
+ function basicAuthHeader(token) {
42
+ return `Basic ${require_primordials_globals.btoa(`${token}:`)}`;
43
+ }
44
+ const SENSITIVE_HEADER_NAME_RE = /auth|cookie|credential|key|password|secret|token/i;
45
+ /**
46
+ * Whether a header name looks credential-bearing and should be redacted from
47
+ * logs and telemetry. Case-insensitive substring match on the name only — the
48
+ * value is never inspected.
49
+ *
50
+ * @param name - The header name (e.g. `Authorization`, `x-api-key`).
51
+ *
52
+ * @returns `true` when the value should be replaced with `[REDACTED]`.
53
+ */
54
+ function isSensitiveHeaderName(name) {
55
+ return SENSITIVE_HEADER_NAME_RE.test(name);
56
+ }
57
+ /**
24
58
  * Parse a `Retry-After` HTTP header value into milliseconds.
25
59
  *
26
60
  * Supports both formats defined in RFC 7231 §7.1.3:
@@ -59,9 +93,10 @@ function parseRetryAfterHeader(value) {
59
93
  /**
60
94
  * Redact sensitive HTTP headers for safe logging and telemetry.
61
95
  *
62
- * Replaces values of sensitive headers (Authorization, Cookie, etc.) with
63
- * `[REDACTED]`. Non-sensitive headers are passed through unchanged. Array
64
- * values are joined with `', '`.
96
+ * Replaces values of credential-bearing headers with `[REDACTED]`, matching the
97
+ * header name by shape (see `isSensitiveHeaderName`) so custom token headers
98
+ * are covered without an enumerated list. Non-sensitive headers pass through
99
+ * unchanged. Array values are joined with `', '`.
65
100
  *
66
101
  * @example
67
102
  * ;```ts
@@ -78,18 +113,10 @@ function parseRetryAfterHeader(value) {
78
113
  */
79
114
  function sanitizeHeaders(headers) {
80
115
  if (!headers) return {};
81
- const sensitiveHeaders = new require_primordials_map_set.SetCtor([
82
- "authorization",
83
- "cookie",
84
- "proxy-authorization",
85
- "proxy-authenticate",
86
- "set-cookie",
87
- "www-authenticate"
88
- ]);
89
116
  const result = { __proto__: null };
90
117
  for (const key of require_primordials_object.ObjectKeys(headers)) {
91
118
  const value = headers[key];
92
- if (sensitiveHeaders.has(key.toLowerCase())) result[key] = "[REDACTED]";
119
+ if (isSensitiveHeaderName(key)) result[key] = "[REDACTED]";
93
120
  else if (require_primordials_array.ArrayIsArray(value)) result[key] = value.join(", ");
94
121
  else if (value !== void 0 && value !== null) result[key] = String(value);
95
122
  }
@@ -97,5 +124,7 @@ function sanitizeHeaders(headers) {
97
124
  }
98
125
 
99
126
  //#endregion
127
+ exports.basicAuthHeader = basicAuthHeader;
128
+ exports.isSensitiveHeaderName = isSensitiveHeaderName;
100
129
  exports.parseRetryAfterHeader = parseRetryAfterHeader;
101
130
  exports.sanitizeHeaders = sanitizeHeaders;
@@ -39,6 +39,7 @@ async function httpRequestAttempt(url, options) {
39
39
  const startTime = require_primordials_date.DateNow();
40
40
  const streamHeaders = body && typeof body === "object" && "getHeaders" in body && typeof body.getHeaders === "function" ? body.getHeaders() : void 0;
41
41
  const mergedHeaders = {
42
+ ...stream ? void 0 : { "Accept-Encoding": "gzip, br" },
42
43
  "User-Agent": require_http_request_user_agent.getSocketCallerUserAgent(),
43
44
  ...streamHeaders,
44
45
  ...headers
@@ -138,6 +138,11 @@ export interface HttpRequestOptions {
138
138
  * HTTP headers to send with the request. A `User-Agent` header is
139
139
  * automatically added if not provided.
140
140
  *
141
+ * On retried attempts (when `retries` > 0), three telemetry headers are added
142
+ * automatically for server-side logging and are NOT removable here:
143
+ * `Retry-Attempt` (1-based retry number), `Retry-Max` (the `retries`
144
+ * ceiling), and `Retry-After` (seconds waited before this attempt).
145
+ *
141
146
  * @example
142
147
  * ;```ts
143
148
  * await httpRequest('https://api.example.com/data', {
@@ -71,7 +71,7 @@ async function httpRequest(url, options) {
71
71
  };
72
72
  const isStreamBody = body !== void 0 && typeof body === "object" && typeof body.pipe === "function";
73
73
  if (isStreamBody && retries > 0) throw new require_primordials_error.ErrorCtor("Streaming body (Readable/FormData) cannot be used with retries. Streams are consumed on first attempt and cannot be replayed. Set retries: 0 or buffer the body as a string/Buffer.");
74
- const attemptOpts = {
74
+ const baseAttemptOpts = {
75
75
  body,
76
76
  ca,
77
77
  followRedirects: isStreamBody ? false : followRedirects,
@@ -85,20 +85,37 @@ async function httpRequest(url, options) {
85
85
  timeout
86
86
  };
87
87
  let lastError;
88
- for (let attempt = 0; attempt <= retries; attempt++) try {
89
- const response = await require_http_request_request_attempt.httpRequestAttempt(url, attemptOpts);
90
- if (throwOnError && !response.ok) throw new require_http_request_response_types.HttpResponseError(response);
91
- return response;
92
- } catch (e) {
93
- lastError = e;
94
- if (attempt === retries) break;
95
- if (signal?.aborted) break;
96
- const delayMs = retryDelay * 2 ** attempt;
97
- if (onRetry) {
98
- const retryResult = onRetry(attempt + 1, e, delayMs);
99
- if (retryResult === false) break;
100
- await (0, node_timers_promises.setTimeout)(typeof retryResult === "number" && !require_primordials_number.NumberIsNaN(retryResult) ? require_primordials_math.MathMax(0, retryResult) : delayMs);
101
- } else await (0, node_timers_promises.setTimeout)(delayMs);
88
+ let lastDelaySeconds = 0;
89
+ for (let attempt = 0; attempt <= retries; attempt++) {
90
+ const attemptOpts = attempt > 0 ? {
91
+ ...baseAttemptOpts,
92
+ headers: {
93
+ ...headers,
94
+ "Retry-Attempt": `${attempt}`,
95
+ "Retry-Max": `${retries}`,
96
+ "Retry-After": `${lastDelaySeconds}`
97
+ }
98
+ } : baseAttemptOpts;
99
+ try {
100
+ const response = await require_http_request_request_attempt.httpRequestAttempt(url, attemptOpts);
101
+ if (throwOnError && !response.ok) throw new require_http_request_response_types.HttpResponseError(response);
102
+ return response;
103
+ } catch (e) {
104
+ lastError = e;
105
+ if (attempt === retries) break;
106
+ if (signal?.aborted) break;
107
+ const delayMs = retryDelay * 2 ** attempt;
108
+ if (onRetry) {
109
+ const retryResult = onRetry(attempt + 1, e, delayMs);
110
+ if (retryResult === false) break;
111
+ const actualDelay = typeof retryResult === "number" && !require_primordials_number.NumberIsNaN(retryResult) ? require_primordials_math.MathMax(0, retryResult) : delayMs;
112
+ lastDelaySeconds = require_primordials_math.MathRound(actualDelay / 1e3);
113
+ await (0, node_timers_promises.setTimeout)(actualDelay);
114
+ } else {
115
+ lastDelaySeconds = require_primordials_math.MathRound(delayMs / 1e3);
116
+ await (0, node_timers_promises.setTimeout)(delayMs);
117
+ }
118
+ }
102
119
  }
103
120
  throw lastError || new require_primordials_error.ErrorCtor("Request failed after retries");
104
121
  }
@@ -3,10 +3,21 @@
3
3
  * out of `http-request/request.ts` for size hygiene. Useful when a caller
4
4
  * already has an `IncomingMessage` from code that bypasses `httpRequest()`
5
5
  * (e.g., multipart uploads via `http.request()` directly, or third-party HTTP
6
- * libraries) and wants the same fetch-like body accessors.
6
+ * libraries) and wants the same fetch-like body accessors. The body is
7
+ * transparently decompressed when the response carries a `Content-Encoding`
8
+ * of `gzip` or `br` — the two encodings `httpRequest` advertises via
9
+ * `Accept-Encoding`. Node's http client does not decompress on its own, so
10
+ * without this step a compressed Socket API response would reach callers as
11
+ * raw deflated bytes and fail JSON parsing.
7
12
  */
8
13
  import type { IncomingResponse } from './request-types';
9
14
  import type { HttpResponse } from './response-types';
15
+ /**
16
+ * Decompress a response body per its `Content-Encoding`. Returns the input
17
+ * unchanged for `identity` or any unrecognized/absent encoding — we only
18
+ * decompress what `httpRequest` advertised support for (`gzip`, `br`).
19
+ */
20
+ export declare function decodeBody(body: Buffer, contentEncoding: string | string[] | undefined): Promise<Buffer>;
10
21
  /**
11
22
  * Read and buffer a client-side IncomingResponse into an HttpResponse.
12
23
  *
@@ -3,6 +3,8 @@
3
3
  Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
4
4
  const require_primordials_buffer = require('../primordials/buffer.js');
5
5
  const require_primordials_json = require('../primordials/json.js');
6
+ const require_compression_brotli = require('../compression/brotli.js');
7
+ const require_compression_gzip = require('../compression/gzip.js');
6
8
 
7
9
  //#region src/http-request/response-reader.ts
8
10
  /**
@@ -10,9 +12,26 @@ const require_primordials_json = require('../primordials/json.js');
10
12
  * out of `http-request/request.ts` for size hygiene. Useful when a caller
11
13
  * already has an `IncomingMessage` from code that bypasses `httpRequest()`
12
14
  * (e.g., multipart uploads via `http.request()` directly, or third-party HTTP
13
- * libraries) and wants the same fetch-like body accessors.
15
+ * libraries) and wants the same fetch-like body accessors. The body is
16
+ * transparently decompressed when the response carries a `Content-Encoding`
17
+ * of `gzip` or `br` — the two encodings `httpRequest` advertises via
18
+ * `Accept-Encoding`. Node's http client does not decompress on its own, so
19
+ * without this step a compressed Socket API response would reach callers as
20
+ * raw deflated bytes and fail JSON parsing.
14
21
  */
15
22
  /**
23
+ * Decompress a response body per its `Content-Encoding`. Returns the input
24
+ * unchanged for `identity` or any unrecognized/absent encoding — we only
25
+ * decompress what `httpRequest` advertised support for (`gzip`, `br`).
26
+ */
27
+ async function decodeBody(body, contentEncoding) {
28
+ if (!contentEncoding || body.length === 0) return body;
29
+ const encoding = (Array.isArray(contentEncoding) ? contentEncoding[0] : contentEncoding).trim().toLowerCase();
30
+ if (encoding === "gzip") return await require_compression_gzip.decompressGzip(body);
31
+ if (encoding === "br") return await require_compression_brotli.decompressBrotli(body);
32
+ return body;
33
+ }
34
+ /**
16
35
  * Read and buffer a client-side IncomingResponse into an HttpResponse.
17
36
  *
18
37
  * Useful when you have a raw response from code that bypasses `httpRequest()`
@@ -30,7 +49,7 @@ const require_primordials_json = require('../primordials/json.js');
30
49
  async function readIncomingResponse(msg) {
31
50
  const chunks = [];
32
51
  for await (const chunk of msg) chunks.push(chunk);
33
- const body = require_primordials_buffer.BufferConcat(chunks);
52
+ const body = await decodeBody(require_primordials_buffer.BufferConcat(chunks), msg.headers["content-encoding"]);
34
53
  const status = msg.statusCode ?? 0;
35
54
  const statusText = msg.statusMessage ?? "";
36
55
  return {
@@ -47,4 +66,5 @@ async function readIncomingResponse(msg) {
47
66
  }
48
67
 
49
68
  //#endregion
69
+ exports.decodeBody = decodeBody;
50
70
  exports.readIncomingResponse = readIncomingResponse;
@@ -38,7 +38,7 @@ node_process = require_runtime.__toESM(node_process);
38
38
  * // 'sdxgen/0.5.0 node/v22.10.0 darwin/arm64 embedded-by-foo/1'
39
39
  * ```
40
40
  */
41
- /* @__NO_SIDE_EFFECTS__ */
41
+ /*@__NO_SIDE_EFFECTS__*/
42
42
  function buildUserAgent(pkg, caller) {
43
43
  const base = `${/* @__PURE__ */ require_packages_operations.pkgNameToSlug(pkg.name)}/${pkg.version} node/${node_process.default.version} ${node_process.default.platform}/${node_process.default.arch}`;
44
44
  return caller ? `${base} ${caller}` : base;
package/dist/json/edit.js CHANGED
@@ -31,7 +31,7 @@ let _EditableJsonClass;
31
31
  * await config.save({ sort: true })
32
32
  * ```
33
33
  */
34
- /* @__NO_SIDE_EFFECTS__ */
34
+ /*@__NO_SIDE_EFFECTS__*/
35
35
  function getEditableJsonClass() {
36
36
  if (_EditableJsonClass === void 0) _EditableJsonClass = class EditableJson {
37
37
  _canSave = true;
@@ -30,7 +30,7 @@ const require_primordials_json = require('../primordials/json.js');
30
30
  *
31
31
  * @returns `true` if value is a Buffer, `false` otherwise
32
32
  */
33
- /* @__NO_SIDE_EFFECTS__ */
33
+ /*@__NO_SIDE_EFFECTS__*/
34
34
  function isBuffer(x) {
35
35
  if (!x || typeof x !== "object") return false;
36
36
  const obj = x;
@@ -59,7 +59,7 @@ function isBuffer(x) {
59
59
  *
60
60
  * @returns `true` if value is a JSON primitive, `false` otherwise
61
61
  */
62
- /* @__NO_SIDE_EFFECTS__ */
62
+ /*@__NO_SIDE_EFFECTS__*/
63
63
  function isJsonPrimitive(value) {
64
64
  return value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string";
65
65
  }
@@ -117,7 +117,7 @@ function isJsonPrimitive(value) {
117
117
  *
118
118
  * @throws {SyntaxError} When JSON is invalid and `throws` is `true` (default)
119
119
  */
120
- /* @__NO_SIDE_EFFECTS__ */
120
+ /*@__NO_SIDE_EFFECTS__*/
121
121
  function parseJson(content, options) {
122
122
  const { filepath, reviver, throws } = {
123
123
  __proto__: null,
@@ -183,7 +183,7 @@ const DEFAULT_MAX_SIZE = 10 * 1024 * 1024;
183
183
  * `allowPrototype` is not `true`).
184
184
  * @throws {Error} When schema validation fails.
185
185
  */
186
- /* @__NO_SIDE_EFFECTS__ */
186
+ /*@__NO_SIDE_EFFECTS__*/
187
187
  function parseJsonSafe(jsonString, schema, options = {}) {
188
188
  const { allowPrototype = false, maxSize = DEFAULT_MAX_SIZE } = options;
189
189
  if (require_primordials_buffer.BufferByteLength(jsonString, "utf8") > maxSize) throw new require_primordials_error.ErrorCtor(`JSON string exceeds maximum size limit${maxSize !== DEFAULT_MAX_SIZE ? ` of ${maxSize} bytes` : ""}`);
@@ -17,7 +17,7 @@ src_external_yoctocolors_cjs = require_runtime.__toESM(src_external_yoctocolors_
17
17
  * Apply a color to text using yoctocolors. Handles both named colors and RGB
18
18
  * tuples.
19
19
  */
20
- /* @__NO_SIDE_EFFECTS__ */
20
+ /*@__NO_SIDE_EFFECTS__*/
21
21
  function applyColor(text, color, colors) {
22
22
  if (typeof color === "string") return colors[color](text);
23
23
  const { 0: r, 1: g, 2: b } = color;
@@ -26,7 +26,7 @@ function applyColor(text, color, colors) {
26
26
  /**
27
27
  * Get the yoctocolors module for terminal colors.
28
28
  */
29
- /* @__NO_SIDE_EFFECTS__ */
29
+ /*@__NO_SIDE_EFFECTS__*/
30
30
  function getYoctocolors() {
31
31
  return src_external_yoctocolors_cjs.default;
32
32
  }
@@ -37,7 +37,7 @@ let _prototypeInitialized = false;
37
37
  /**
38
38
  * Construct a new Console instance.
39
39
  */
40
- /* @__NO_SIDE_EFFECTS__ */
40
+ /*@__NO_SIDE_EFFECTS__*/
41
41
  function constructConsole(...args) {
42
42
  /* c8 ignore next - Lazy-init second-call branch; module-singleton. */
43
43
  if (_Console === void 0) _Console = (/* @__PURE__ */ require("node:console")).Console;
@@ -83,7 +83,7 @@ const lastWasBlankSymbol = Symbol.for("logger.lastWasBlank");
83
83
  * console.log(`${LOG_SYMBOLS.warn} Deprecated API used`) // Theme warning color ⚠
84
84
  * ```
85
85
  */
86
- const LOG_SYMBOLS = /* @__PURE__ */ (() => {
86
+ const LOG_SYMBOLS = /*@__PURE__*/ (() => {
87
87
  const target = { __proto__: null };
88
88
  let initialized = false;
89
89
  const handler = { __proto__: null };
@@ -4,9 +4,9 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
4
4
 
5
5
  //#region src/node/async-hooks.ts
6
6
  let _asyncHooks;
7
- /* @__NO_SIDE_EFFECTS__ */
7
+ /*@__NO_SIDE_EFFECTS__*/
8
8
  function getNodeAsyncHooks() {
9
- return _asyncHooks ??= /* @__PURE__ */ require("node:async_hooks");
9
+ return _asyncHooks ??= /*@__PURE__*/ require("node:async_hooks");
10
10
  }
11
11
 
12
12
  //#endregion
@@ -4,9 +4,9 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
4
4
 
5
5
  //#region src/node/child-process.ts
6
6
  let _childProcess;
7
- /* @__NO_SIDE_EFFECTS__ */
7
+ /*@__NO_SIDE_EFFECTS__*/
8
8
  function getNodeChildProcess() {
9
- return _childProcess ??= /* @__PURE__ */ require("node:child_process");
9
+ return _childProcess ??= /*@__PURE__*/ require("node:child_process");
10
10
  }
11
11
 
12
12
  //#endregion
@@ -4,9 +4,9 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
4
4
 
5
5
  //#region src/node/crypto.ts
6
6
  let _crypto;
7
- /* @__NO_SIDE_EFFECTS__ */
7
+ /*@__NO_SIDE_EFFECTS__*/
8
8
  function getNodeCrypto() {
9
- return _crypto ??= /* @__PURE__ */ require("node:crypto");
9
+ return _crypto ??= /*@__PURE__*/ require("node:crypto");
10
10
  }
11
11
 
12
12
  //#endregion
@@ -4,9 +4,9 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
4
4
 
5
5
  //#region src/node/events.ts
6
6
  let _events;
7
- /* @__NO_SIDE_EFFECTS__ */
7
+ /*@__NO_SIDE_EFFECTS__*/
8
8
  function getNodeEvents() {
9
- return _events ??= /* @__PURE__ */ require("node:events");
9
+ return _events ??= /*@__PURE__*/ require("node:events");
10
10
  }
11
11
 
12
12
  //#endregion
@@ -4,9 +4,9 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
4
4
 
5
5
  //#region src/node/fs-promises.ts
6
6
  let _fsPromises;
7
- /* @__NO_SIDE_EFFECTS__ */
7
+ /*@__NO_SIDE_EFFECTS__*/
8
8
  function getNodeFsPromises() {
9
- return _fsPromises ??= /* @__PURE__ */ require("node:fs/promises");
9
+ return _fsPromises ??= /*@__PURE__*/ require("node:fs/promises");
10
10
  }
11
11
 
12
12
  //#endregion
package/dist/node/fs.js CHANGED
@@ -4,9 +4,9 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
4
4
 
5
5
  //#region src/node/fs.ts
6
6
  let _fs;
7
- /* @__NO_SIDE_EFFECTS__ */
7
+ /*@__NO_SIDE_EFFECTS__*/
8
8
  function getNodeFs() {
9
- return _fs ??= /* @__PURE__ */ require("node:fs");
9
+ return _fs ??= /*@__PURE__*/ require("node:fs");
10
10
  }
11
11
 
12
12
  //#endregion
package/dist/node/http.js CHANGED
@@ -4,9 +4,9 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
4
4
 
5
5
  //#region src/node/http.ts
6
6
  let _http;
7
- /* @__NO_SIDE_EFFECTS__ */
7
+ /*@__NO_SIDE_EFFECTS__*/
8
8
  function getNodeHttp() {
9
- return _http ??= /* @__PURE__ */ require("node:http");
9
+ return _http ??= /*@__PURE__*/ require("node:http");
10
10
  }
11
11
 
12
12
  //#endregion
@@ -4,9 +4,9 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
4
4
 
5
5
  //#region src/node/https.ts
6
6
  let _https;
7
- /* @__NO_SIDE_EFFECTS__ */
7
+ /*@__NO_SIDE_EFFECTS__*/
8
8
  function getNodeHttps() {
9
- return _https ??= /* @__PURE__ */ require("node:https");
9
+ return _https ??= /*@__PURE__*/ require("node:https");
10
10
  }
11
11
 
12
12
  //#endregion
@@ -4,9 +4,9 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
4
4
 
5
5
  //#region src/node/module.ts
6
6
  let _module;
7
- /* @__NO_SIDE_EFFECTS__ */
7
+ /*@__NO_SIDE_EFFECTS__*/
8
8
  function getNodeModule() {
9
- return _module ??= /* @__PURE__ */ require("node:module");
9
+ return _module ??= /*@__PURE__*/ require("node:module");
10
10
  }
11
11
  /**
12
12
  * Lazy + cached reference to `node:module`'s `isBuiltin(name)`. First call
@@ -17,7 +17,7 @@ function getNodeModule() {
17
17
  * (used by the smol-binding loaders to gate `require('node:smol-*')`).
18
18
  */
19
19
  let _isBuiltin;
20
- /* @__NO_SIDE_EFFECTS__ */
20
+ /*@__NO_SIDE_EFFECTS__*/
21
21
  function isNodeBuiltin(name) {
22
22
  return (_isBuiltin ??= (/* @__PURE__ */ getNodeModule()).isBuiltin)(name);
23
23
  }
package/dist/node/os.js CHANGED
@@ -4,9 +4,9 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
4
4
 
5
5
  //#region src/node/os.ts
6
6
  let _os;
7
- /* @__NO_SIDE_EFFECTS__ */
7
+ /*@__NO_SIDE_EFFECTS__*/
8
8
  function getNodeOs() {
9
- return _os ??= /* @__PURE__ */ require("node:os");
9
+ return _os ??= /*@__PURE__*/ require("node:os");
10
10
  }
11
11
 
12
12
  //#endregion
package/dist/node/path.js CHANGED
@@ -4,9 +4,9 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
4
4
 
5
5
  //#region src/node/path.ts
6
6
  let _path;
7
- /* @__NO_SIDE_EFFECTS__ */
7
+ /*@__NO_SIDE_EFFECTS__*/
8
8
  function getNodePath() {
9
- return _path ??= /* @__PURE__ */ require("node:path");
9
+ return _path ??= /*@__PURE__*/ require("node:path");
10
10
  }
11
11
 
12
12
  //#endregion