@socketsecurity/lib 6.0.9 → 6.0.10

package/dist/fs/find.js

@@ -20,7 +20,6 @@ node_process = require_runtime.__toESM(node_process);
 *   visiting root itself, so a match at e.g. `/.foo` was never found. The
 *   current shape visits root, then breaks.
 */
-const abortSignal = require_process_abort.getAbortSignal();
 /**
 * Find a file or directory by traversing up parent directories. Searches from
 * the starting directory upward to the filesystem root. Useful for finding
@@ -44,7 +43,7 @@ const abortSignal = require_process_abort.getAbortSignal();
 * @returns Normalized absolute path if found, undefined otherwise
 */
 async function findUp(name, options) {
-	const { cwd = node_process.default.cwd(), signal = abortSignal } = {
+	const { cwd = node_process.default.cwd(), signal = require_process_abort.getAbortSignal() } = {
 		__proto__: null,
 		...options
 	};

package/dist/fs/inspect.d.ts

@@ -94,7 +94,7 @@ export declare function isSymlinkSync(filepath: PathLike): boolean;
  *
  * @returns Promise resolving to Stats object, or undefined on error
  */
-export declare function safeStat(filepath: PathLike): Promise<import("fs").Stats | undefined>;
+export declare function safeStat(filepath: PathLike): Promise<import("node:fs").Stats | undefined>;
 /**
  * Safely get file stats synchronously, returning undefined on error. Useful for
  * checking file existence and properties without error handling. Returns
@@ -114,4 +114,4 @@ export declare function safeStat(filepath: PathLike): Promise<import("fs").Stats
  *
  * @returns Stats object, or undefined on error
  */
-export declare function safeStatSync(filepath: PathLike): import("fs").BigIntStats | import("fs").Stats | undefined;
+export declare function safeStatSync(filepath: PathLike): import("node:fs").BigIntStats | import("node:fs").Stats | undefined;

package/dist/fs/read-file.js

@@ -15,7 +15,6 @@ const require_fs_encoding = require('./encoding.js');
 *   the default and any string encoding return a string. The runtime fast-path
 *   normalizes encoding once and forwards untouched options to `node:fs`.
 */
-const abortSignal = require_process_abort.getAbortSignal();
 /**
 * Read a file as binary data asynchronously. Returns a Buffer without encoding
 * the contents. Useful for reading images, archives, or other binary formats.
@@ -37,7 +36,7 @@ const abortSignal = require_process_abort.getAbortSignal();
 async function readFileBinary(filepath, options) {
 	const opts = typeof options === "string" ? { encoding: options } : options;
 	return await require_node_fs.getNodeFs().promises.readFile(filepath, {
-		signal: abortSignal,
+		signal: require_process_abort.getAbortSignal(),
 		...opts,
 		encoding: void 0
 	});
@@ -88,7 +87,7 @@ function readFileBinarySync(filepath, options) {
 async function readFileUtf8(filepath, options) {
 	const opts = typeof options === "string" ? { encoding: options } : options;
 	return await require_node_fs.getNodeFs().promises.readFile(filepath, {
-		signal: abortSignal,
+		signal: require_process_abort.getAbortSignal(),
 		...opts,
 		encoding: "utf8"
 	});
@@ -138,7 +137,7 @@ async function safeReadFile(filepath, options) {
 	try {
 		return await fs.promises.readFile(filepath, {
 			__proto__: null,
-			signal: abortSignal,
+			signal: require_process_abort.getAbortSignal(),
 			...readOpts,
 			encoding
 		});

package/dist/fs/safe.js

@@ -184,7 +184,7 @@ function safeDeleteSync(filepath, options) {
 		lastError = e;
 		if (attempt < maxRetries) {
 			const waitMs = delay;
-			require_primordials_array.AtomicsWait(new require_primordials_array.Int32ArrayCtor(new require_primordials_globals.SharedArrayBufferCtor(4)), 0, 0, waitMs);
+			if (require_primordials_globals.SharedArrayBufferCtor !== void 0) require_primordials_array.AtomicsWait(new require_primordials_array.Int32ArrayCtor(new require_primordials_globals.SharedArrayBufferCtor(4)), 0, 0, waitMs);
 			delay *= 2;
 		}
 	}

package/dist/git/_internal.js

@@ -251,7 +251,11 @@ function stableKey(value) {
 	return require_primordials_json.JSONStringify(value, (_key, val) => {
 		if (val && typeof val === "object" && !require_primordials_array.ArrayIsArray(val)) {
 			const sorted = {};
-			for (const k of require_primordials_object.ObjectKeys(val).toSorted()) sorted[k] = val[k];
+			const sortedKeys = require_primordials_object.ObjectKeys(val).toSorted();
+			for (let i = 0, { length } = sortedKeys; i < length; i += 1) {
+				const k = sortedKeys[i];
+				sorted[k] = val[k];
+			}
 			return sorted;
 		}
 		return val;

package/dist/github/commit.d.ts

@@ -0,0 +1,92 @@
+/**
+ * @file Create a SIGNED commit on a branch via the GitHub git-objects API
+ *   (blob -> tree -> commit -> ref PATCH). Commits created through the API are
+ *   web-flow-verified ("Verified" / signed) without a local GPG or SSH signing
+ *   key — the only way CI can land a commit on a branch whose protection
+ *   requires signed commits. Built on `github/request` (`fetchGitHub`) and the
+ *   `github/token` resolver for auth/retry/error consistency.
+ */
+/**
+ * A single file to include in the signed commit.
+ */
+export interface CommitFile {
+    /**
+     * UTF-8 text contents to write at `path`.
+     */
+    readonly content: string;
+    /**
+     * Repo-relative path, POSIX separators (e.g. 'package.json').
+     */
+    readonly path: string;
+}
+/**
+ * Options for `createSignedCommit`.
+ */
+export interface CreateSignedCommitOptions {
+    /**
+     * Override the API origin (GitHub Enterprise or tests). Defaults to
+     * https://api.github.com.
+     */
+    readonly apiUrl?: string | undefined;
+    /**
+     * SHA of the tree to layer the new files onto (usually `HEAD^{tree}`).
+     */
+    readonly baseTreeSha: string;
+    /**
+     * Branch to advance (e.g. 'main').
+     */
+    readonly branch: string;
+    /**
+     * Files to write in the commit.
+     */
+    readonly files: readonly CommitFile[];
+    /**
+     * Commit message.
+     */
+    readonly message: string;
+    /**
+     * Parent commit SHA (usually `HEAD`).
+     */
+    readonly parentSha: string;
+    /**
+     * Repo in "owner/name" form.
+     */
+    readonly repo: string;
+    /**
+     * GitHub token. Falls back to env / git config via `getGitHubToken()`.
+     */
+    readonly token?: string | undefined;
+}
+export declare function buildHeaders(token: string): Record<string, string>;
+/**
+ * Create a signed commit on a branch via the GitHub git-objects API (blob ->
+ * tree -> commit -> ref PATCH). Returns the new commit SHA. Commits created
+ * through the API are web-flow-verified ("Verified") without a local signing
+ * key — the only way CI can land signed commits on protected branches.
+ *
+ * @example
+ *   ;```ts
+ *   const sha = await createSignedCommit({
+ *     repo: 'owner/repo',
+ *     branch: 'main',
+ *     parentSha: 'abc123',
+ *     baseTreeSha: 'def456',
+ *     message: 'chore: bump version to 1.2.0',
+ *     files: [
+ *       { path: 'package.json', content: '{"version":"1.2.0"}' },
+ *       { path: 'CHANGELOG.md', content: '# Changelog\n' },
+ *     ],
+ *     token: process.env['GITHUB_TOKEN'],
+ *   })
+ *   ```
+ *
+ * @param options - Commit options including repo, branch, parent SHA, base tree
+ *   SHA, files, message, and optional token/API URL override.
+ *
+ * @returns The new (verified) commit SHA.
+ *
+ * @throws {Error} When any GitHub git-objects API call fails.
+ */
+export declare function createSignedCommit(options: CreateSignedCommitOptions): Promise<string>;
+export declare function patch(url: string, headers: Record<string, string>, body: unknown): Promise<void>;
+export declare function post<T>(url: string, headers: Record<string, string>, body: unknown): Promise<T>;

package/dist/github/commit.js

@@ -0,0 +1,113 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_json = require('../primordials/json.js');
+const require_http_request_request = require('../http-request/request.js');
+const require_github_token = require('./token.js');
+const require_github_constants = require('./constants.js');
+
+//#region src/github/commit.ts
+/**
+* @file Create a SIGNED commit on a branch via the GitHub git-objects API
+*   (blob -> tree -> commit -> ref PATCH). Commits created through the API are
+*   web-flow-verified ("Verified" / signed) without a local GPG or SSH signing
+*   key — the only way CI can land a commit on a branch whose protection
+*   requires signed commits. Built on `github/request` (`fetchGitHub`) and the
+*   `github/token` resolver for auth/retry/error consistency.
+*/
+function buildHeaders(token) {
+	return {
+		accept: "application/vnd.github+json",
+		authorization: `Bearer ${token}`,
+		"content-type": "application/json",
+		"x-github-api-version": "2022-11-28"
+	};
+}
+/**
+* Create a signed commit on a branch via the GitHub git-objects API (blob ->
+* tree -> commit -> ref PATCH). Returns the new commit SHA. Commits created
+* through the API are web-flow-verified ("Verified") without a local signing
+* key — the only way CI can land signed commits on protected branches.
+*
+* @example
+*   ;```ts
+*   const sha = await createSignedCommit({
+*     repo: 'owner/repo',
+*     branch: 'main',
+*     parentSha: 'abc123',
+*     baseTreeSha: 'def456',
+*     message: 'chore: bump version to 1.2.0',
+*     files: [
+*       { path: 'package.json', content: '{"version":"1.2.0"}' },
+*       { path: 'CHANGELOG.md', content: '# Changelog\n' },
+*     ],
+*     token: process.env['GITHUB_TOKEN'],
+*   })
+*   ```
+*
+* @param options - Commit options including repo, branch, parent SHA, base tree
+*   SHA, files, message, and optional token/API URL override.
+*
+* @returns The new (verified) commit SHA.
+*
+* @throws {Error} When any GitHub git-objects API call fails.
+*/
+async function createSignedCommit(options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const token = opts.token ?? require_github_token.getGitHubToken() ?? "";
+	const git = `${opts.apiUrl ?? "https://api.github.com"}/repos/${opts.repo}/git`;
+	const headers = buildHeaders(token);
+	const treeEntries = [];
+	for (let i = 0, { length } = opts.files; i < length; i += 1) {
+		const file = opts.files[i];
+		const blob = await post(`${git}/blobs`, headers, {
+			content: Buffer.from(file.content, "utf8").toString("base64"),
+			encoding: "base64"
+		});
+		treeEntries.push({
+			mode: "100644",
+			path: file.path,
+			sha: blob.sha,
+			type: "blob"
+		});
+	}
+	const newTree = await post(`${git}/trees`, headers, {
+		base_tree: opts.baseTreeSha,
+		tree: treeEntries
+	});
+	const commit = await post(`${git}/commits`, headers, {
+		message: opts.message,
+		parents: [opts.parentSha],
+		tree: newTree.sha
+	});
+	await patch(`${git}/refs/heads/${opts.branch}`, headers, { sha: commit.sha });
+	return commit.sha;
+}
+async function patch(url, headers, body) {
+	const response = await require_http_request_request.httpRequest(url, {
+		body: require_primordials_json.JSONStringify(body),
+		headers,
+		method: "PATCH",
+		timeout: 3e4
+	});
+	if (!response.ok) throw new Error(`GitHub API PATCH ${url} failed — status ${response.status}: ${response.statusText}`);
+}
+async function post(url, headers, body) {
+	const response = await require_http_request_request.httpRequest(url, {
+		body: require_primordials_json.JSONStringify(body),
+		headers,
+		method: "POST",
+		timeout: 3e4
+	});
+	if (!response.ok) throw new Error(`GitHub API POST ${url} failed — status ${response.status}: ${response.statusText}`);
+	return response.json();
+}
+
+//#endregion
+exports.buildHeaders = buildHeaders;
+exports.createSignedCommit = createSignedCommit;
+exports.patch = patch;
+exports.post = post;

package/dist/github/ghsa.js

@@ -5,9 +5,9 @@ const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_error = require('../primordials/error.js');
 const require_primordials_json = require('../primordials/json.js');
 const require_http_request_request = require('../http-request/request.js');
+const require_github_token = require('./token.js');
 const require_github_constants = require('./constants.js');
 const require_github_errors = require('./errors.js');
-const require_github_token = require('./token.js');
 const require_github_request = require('./request.js');
 const require_github_refs_cache = require('./refs-cache.js');
 let node_process = require("node:process");

package/dist/github/refs-graphql.js

@@ -3,8 +3,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_json = require('../primordials/json.js');
 const require_http_request_request = require('../http-request/request.js');
-const require_github_constants = require('./constants.js');
 const require_github_token = require('./token.js');
+const require_github_constants = require('./constants.js');
 
 //#region src/github/refs-graphql.ts
 /**

package/dist/github/request.js

@@ -7,8 +7,8 @@ const require_primordials_json = require('../primordials/json.js');
 const require_errors_message = require('../errors/message.js');
 const require_http_request_request = require('../http-request/request.js');
 const require_env_github_status = require('../env/github-status.js');
-const require_github_errors = require('./errors.js');
 const require_github_token = require('./token.js');
+const require_github_errors = require('./errors.js');
 
 //#region src/github/request.ts
 /**

package/dist/github/token.d.ts

@@ -14,7 +14,10 @@ import type { SpawnOptions } from '../process/spawn/types';
  *
  * 1. `GITHUB_TOKEN` - Standard GitHub token variable
  * 2. `GH_TOKEN` - Alternative GitHub CLI token variable
- * 3. `SOCKET_CLI_GITHUB_TOKEN` - Socket-specific token variable
+ *
+ * The Socket-CLI-specific `SOCKET_CLI_GITHUB_TOKEN` is intentionally NOT read
+ * here — that variable is the CLI's concern (`getSocketCliGithubToken`), so
+ * this generic resolver stays limited to the standard GitHub token names.
  *
  * @example
  *   ;```ts
@@ -60,7 +63,7 @@ export declare function getGitHubTokenFromGitConfig(options?: SpawnOptions | und
  *
  * Priority order:
  *
- * 1. Environment variables (GITHUB_TOKEN, GH_TOKEN, SOCKET_CLI_GITHUB_TOKEN)
+ * 1. Environment variables (GITHUB_TOKEN, GH_TOKEN)
  * 2. Git config (github.token)
  *
  * @example

package/dist/github/token.js

@@ -3,7 +3,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_process_spawn_child = require('../process/spawn/child.js');
 const require_env_github = require('../env/github.js');
-const require_env_socket_cli = require('../env/socket-cli.js');
 
 //#region src/github/token.ts
 /**
@@ -21,7 +20,10 @@ const require_env_socket_cli = require('../env/socket-cli.js');
 *
 * 1. `GITHUB_TOKEN` - Standard GitHub token variable
 * 2. `GH_TOKEN` - Alternative GitHub CLI token variable
-* 3. `SOCKET_CLI_GITHUB_TOKEN` - Socket-specific token variable
+*
+* The Socket-CLI-specific `SOCKET_CLI_GITHUB_TOKEN` is intentionally NOT read
+* here — that variable is the CLI's concern (`getSocketCliGithubToken`), so
+* this generic resolver stays limited to the standard GitHub token names.
 *
 * @example
 *   ;```ts
@@ -34,7 +36,7 @@ const require_env_socket_cli = require('../env/socket-cli.js');
 * @returns The first available GitHub token, or `undefined` if none found
 */
 function getGitHubToken() {
-	return require_env_github.getGithubToken() || require_env_github.getGhToken() || require_env_socket_cli.getSocketCliGithubToken() || void 0;
+	return require_env_github.getGithubToken() || require_env_github.getGhToken() || void 0;
 }
 /**
 * Get GitHub authentication token from git config. Reads the `github.token`
@@ -79,7 +81,7 @@ async function getGitHubTokenFromGitConfig(options) {
 *
 * Priority order:
 *
-* 1. Environment variables (GITHUB_TOKEN, GH_TOKEN, SOCKET_CLI_GITHUB_TOKEN)
+* 1. Environment variables (GITHUB_TOKEN, GH_TOKEN)
 * 2. Git config (github.token)
 *
 * @example

package/dist/github/workflow-runs.d.ts

@@ -0,0 +1,107 @@
+/**
+ * @file Look up a GitHub Actions workflow run for a commit and classify its
+ *   verdict — the "is CI green on this SHA?" primitive behind gated releases
+ *   (bump/tag/publish only after the pre-release commit's CI passes). Built on
+ *   the shared `fetchGitHub` REST client, so it inherits token resolution +
+ *   rate-limit handling and needs no `gh` CLI. The pure helpers
+ *   (`classifyRunVerdict`, `buildWorkflowRunsUrl`, `selectLatestRun`) hold the
+ *   logic; `getRunForCommit` / `waitForRun` are the thin I/O wrappers.
+ */
+/**
+ * Build the GitHub REST URL that lists the runs of `workflow` for `sha`,
+ * newest first, capped to one. Pure.
+ */
+export declare function buildWorkflowRunsUrl(query: WorkflowRunQuery): string;
+/**
+ * A workflow run's terminal verdict, normalized from GitHub's `status` +
+ * `conclusion` pair. `pending` = the run has not completed yet.
+ */
+export type WorkflowRunVerdict = 'green' | 'pending' | 'red';
+/**
+ * A GitHub Actions workflow run, narrowed to the fields a release gate needs.
+ * `conclusion` is `undefined` until the run reaches `status === 'completed'`.
+ */
+export interface WorkflowRun {
+    conclusion: string | undefined;
+    htmlUrl: string | undefined;
+    id: number;
+    status: string;
+}
+/**
+ * One entry in the `GET .../runs` response, as GitHub returns it (snake_case,
+ * `conclusion` nullable until completion).
+ */
+export interface WorkflowRunApiEntry {
+    conclusion?: string | null | undefined;
+    html_url?: string | undefined;
+    id: number;
+    status: string;
+}
+/**
+ * The `GET /repos/{owner}/{repo}/actions/workflows/{workflow}/runs` response
+ * shape, narrowed to `workflow_runs`.
+ */
+export interface WorkflowRunsApiResponse {
+    workflow_runs?: WorkflowRunApiEntry[] | undefined;
+}
+/**
+ * Identifies the workflow run to resolve: a repo, a commit SHA, and the
+ * workflow to scope to.
+ */
+export interface WorkflowRunQuery {
+    owner: string;
+    repo: string;
+    sha: string;
+    token?: string | undefined;
+    /**
+     * Workflow file name (e.g. `ci.yml`) or numeric workflow id. Scopes the
+     * lookup so a repo with many workflows resolves the intended run.
+     */
+    workflow: string;
+}
+/**
+ * Options for `waitForRun`: a `WorkflowRunQuery` plus polling bounds.
+ */
+export interface WaitForRunOptions extends WorkflowRunQuery {
+    /**
+     * Maximum number of polls before giving up and returning the last verdict
+     * (usually `pending`). Default 120 (~10 min at the default interval).
+     */
+    maxAttempts?: number | undefined;
+    /**
+     * Milliseconds between polls. Default 5000. Pass `0` in tests.
+     */
+    pollIntervalMs?: number | undefined;
+}
+/**
+ * The result of `waitForRun`: the final verdict and the last run observed
+ * (`undefined` when no run ever appeared for the SHA).
+ */
+export interface WaitForRunResult {
+    run: WorkflowRun | undefined;
+    verdict: WorkflowRunVerdict;
+}
+/**
+ * Classify a run's `status` + `conclusion` into a release verdict. Pure — a run
+ * that has not `completed` is `pending`; a completed run is `green` only when
+ * it `succeeded`, otherwise `red` (failure, cancelled, timed_out, …).
+ */
+export declare function classifyRunVerdict(status: string | undefined, conclusion: string | undefined): WorkflowRunVerdict;
+/**
+ * Fetch the newest workflow run for `sha`, or `undefined` when none has been
+ * created yet (CI may not have triggered at read time).
+ */
+export declare function getRunForCommit(query: WorkflowRunQuery): Promise<WorkflowRun | undefined>;
+/**
+ * Pick the newest run from a `GET .../runs` response and normalize it to a
+ * `WorkflowRun` (nullable `conclusion` → `undefined`). Returns `undefined` when
+ * no run exists for the SHA. Pure.
+ */
+export declare function selectLatestRun(response: WorkflowRunsApiResponse): WorkflowRun | undefined;
+/**
+ * Poll the workflow run for `sha` until it completes (or the attempt budget is
+ * spent), returning the final verdict and the last run seen. A `red` or `green`
+ * verdict resolves immediately; `pending` (no run yet, or still running) keeps
+ * polling every `pollIntervalMs` up to `maxAttempts`.
+ */
+export declare function waitForRun(options: WaitForRunOptions): Promise<WaitForRunResult>;

package/dist/github/workflow-runs.js

@@ -0,0 +1,98 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_github_request = require('./request.js');
+const require_promises_timers = require('../promises/timers.js');
+
+//#region src/github/workflow-runs.ts
+/**
+* @file Look up a GitHub Actions workflow run for a commit and classify its
+*   verdict — the "is CI green on this SHA?" primitive behind gated releases
+*   (bump/tag/publish only after the pre-release commit's CI passes). Built on
+*   the shared `fetchGitHub` REST client, so it inherits token resolution +
+*   rate-limit handling and needs no `gh` CLI. The pure helpers
+*   (`classifyRunVerdict`, `buildWorkflowRunsUrl`, `selectLatestRun`) hold the
+*   logic; `getRunForCommit` / `waitForRun` are the thin I/O wrappers.
+*/
+/**
+* Build the GitHub REST URL that lists the runs of `workflow` for `sha`,
+* newest first, capped to one. Pure.
+*/
+function buildWorkflowRunsUrl(query) {
+	const { owner, repo, sha, workflow } = {
+		__proto__: null,
+		...query
+	};
+	return `https://api.github.com/repos/${owner}/${repo}/actions/workflows/${workflow}/runs?head_sha=${sha}&per_page=1`;
+}
+/**
+* Classify a run's `status` + `conclusion` into a release verdict. Pure — a run
+* that has not `completed` is `pending`; a completed run is `green` only when
+* it `succeeded`, otherwise `red` (failure, cancelled, timed_out, …).
+*/
+function classifyRunVerdict(status, conclusion) {
+	if (status !== "completed") return "pending";
+	return conclusion === "success" ? "green" : "red";
+}
+/**
+* Fetch the newest workflow run for `sha`, or `undefined` when none has been
+* created yet (CI may not have triggered at read time).
+*/
+async function getRunForCommit(query) {
+	const opts = {
+		__proto__: null,
+		...query
+	};
+	return selectLatestRun(await require_github_request.fetchGitHub(buildWorkflowRunsUrl(opts), opts.token ? { token: opts.token } : void 0));
+}
+/**
+* Pick the newest run from a `GET .../runs` response and normalize it to a
+* `WorkflowRun` (nullable `conclusion` → `undefined`). Returns `undefined` when
+* no run exists for the SHA. Pure.
+*/
+function selectLatestRun(response) {
+	const raw = {
+		__proto__: null,
+		...response
+	}.workflow_runs?.[0];
+	if (!raw) return;
+	return {
+		conclusion: raw.conclusion ?? void 0,
+		htmlUrl: raw.html_url ?? void 0,
+		id: raw.id,
+		status: raw.status
+	};
+}
+/**
+* Poll the workflow run for `sha` until it completes (or the attempt budget is
+* spent), returning the final verdict and the last run seen. A `red` or `green`
+* verdict resolves immediately; `pending` (no run yet, or still running) keeps
+* polling every `pollIntervalMs` up to `maxAttempts`.
+*/
+async function waitForRun(options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const maxAttempts = opts.maxAttempts ?? 120;
+	const pollIntervalMs = opts.pollIntervalMs ?? 5e3;
+	let run;
+	let verdict = "pending";
+	for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+		run = await getRunForCommit(opts);
+		verdict = classifyRunVerdict(run?.status, run?.conclusion);
+		if (verdict !== "pending") break;
+		if (attempt < maxAttempts - 1) await require_promises_timers.sleep(pollIntervalMs);
+	}
+	return {
+		run,
+		verdict
+	};
+}
+
+//#endregion
+exports.buildWorkflowRunsUrl = buildWorkflowRunsUrl;
+exports.classifyRunVerdict = classifyRunVerdict;
+exports.getRunForCommit = getRunForCommit;
+exports.selectLatestRun = selectLatestRun;
+exports.waitForRun = waitForRun;

package/dist/http-request/_internal.d.ts

@@ -2,7 +2,7 @@
  * @file Private lazy loaders for the Node.js modules used by the
  *   `http-request/*` leaves. The `_` prefix keeps this module out of the
  *   generated package.json `exports` map (the `dist/**\/_*` ignore pattern in
- *   `scripts/post-build/make-package-exports.mts` filters it out), so it is not
+ *   `scripts/fleet/make-package-exports.mts` filters it out), so it is not
  *   part of the public surface — it exists only as a re-export shim so existing
  *   siblings keep working unchanged. New code should import the canonical
  *   helpers directly:

package/dist/http-request/browser.d.ts

@@ -110,6 +110,12 @@ export interface BrowserHttpRequestOptions {
      * Defaults to 250ms.
      */
     retryDelay?: number | undefined;
+    /**
+     * Maximum delay (ms) for a single backoff wait. Caps the exponential growth
+     * (`retryDelay` * 2^attempt) so a high `retries` count can't produce
+     * multi-minute waits. Defaults to 30000ms.
+     */
+    retryDelayMax?: number | undefined;
     /**
      * Abort signal forwarded to fetch. Combined with `timeout` via
      * AbortController when both are present.

package/dist/http-request/browser.js

@@ -174,11 +174,12 @@ async function httpRequest(url, options) {
 	const opts = options ?? {};
 	const maxAttempts = (opts.retries ?? 0) + 1;
 	const baseDelay = opts.retryDelay ?? 250;
+	const maxDelay = opts.retryDelayMax ?? 3e4;
 	let lastError;
 	for (let i = 0; i < maxAttempts; i++) try {
 		const response = await attempt(url, opts);
 		if (response.status >= 500 && i + 1 < maxAttempts) {
-			await sleep(baseDelay * require_primordials_math.MathPow(2, i));
+			await sleep(require_primordials_math.MathMin(baseDelay * require_primordials_math.MathPow(2, i), maxDelay));
 			continue;
 		}
 		if (opts.throwOnError && !response.ok) throw new HttpResponseError(response);
@@ -187,7 +188,7 @@ async function httpRequest(url, options) {
 		lastError = err;
 		if (err instanceof HttpResponseError) throw err;
 		if (i + 1 < maxAttempts) {
-			await sleep(baseDelay * require_primordials_math.MathPow(2, i));
+			await sleep(require_primordials_math.MathMin(baseDelay * require_primordials_math.MathPow(2, i), maxDelay));
 			continue;
 		}
 	}

package/dist/http-request/download.js

@@ -168,6 +168,8 @@ async function httpDownloadAttempt(url, destPath, options) {
 			})();
 		};
 		fileStream.on("error", (error) => {
+			res.unpipe(fileStream);
+			res.destroy();
 			fileStream.destroy();
 			cleanupPartial();
 			reject(new require_primordials_error.ErrorCtor(`Failed to write file: ${error.message}`, { cause: error }));

package/dist/http-request/headers.d.ts

@@ -13,7 +13,7 @@
  * Build an HTTP Basic `Authorization` header value from a Socket API token.
  *
  * The Socket API uses the token as the username with an empty password, so the
- * credential pair is `<token>:`. Centralized here so every fleet caller emits
+ * credential pair is `<token>:`. Centralized here so every Socket caller emits
  * the identical shape instead of hand-rolling `btoa(\`${token}:`)`.
  *
  * @example