@socketsecurity/sdk 1.9.2 → 1.10.0

package/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.10.0](https://github.com/SocketDev/socket-sdk-js/releases/tag/v1.10.0) - 2025-10-04
+
+### Added
+- Added `PromiseQueue` utility for controlled concurrency in async operations
+- HTTP retry logic with exponential backoff for improved reliability on transient failures
+- Added option type interfaces: `CreateDependenciesSnapshotOptions`, `CreateOrgFullScanOptions`, `CreateScanFromFilepathsOptions`, `StreamOrgFullScanOptions`, `UploadManifestFilesOptions`
+
+### Changed
+- **BREAKING**: Refactored SDK methods to use options objects instead of positional parameters for better API clarity:
+  - `createDependenciesSnapshot(filepaths, options)` - replaced `repo` and `branch` positional parameters with options object
+  - `createOrgFullScan(orgSlug, filepaths, options)` - replaced positional parameters with options object
+  - `createScanFromFilepaths(filepaths, options)` - replaced positional parameters with options object
+  - `streamOrgFullScan(orgSlug, fullScanId, options)` - replaced positional parameters with options object
+  - `uploadManifestFiles(orgSlug, filepaths, options)` - replaced positional parameters with options object
+- Improved type safety by replacing `any` types with `unknown` or `never` where appropriate
+- Enhanced code style with numeric separators for better readability of large numbers
+- Improved coverage reporting accuracy with c8 ignore comments
+- Updated `@socketsecurity/registry` dependency to 1.4.0
+
+### Fixed
+- Fixed import assertion syntax for JSON imports to use standard import syntax
+- Fixed HTTP retry test mocks to correctly match PUT method requests
+- Fixed critical issues in type handling and URL search parameter conversions
+
 ## [1.9.2](https://github.com/SocketDev/socket-sdk-js/releases/tag/v1.9.2) - 2025-10-04
 
 ### Changed

package/README.md

@@ -19,7 +19,11 @@ pnpm add @socketsecurity/sdk
 ```javascript
 import { SocketSdk } from '@socketsecurity/sdk'
 
-const client = new SocketSdk('yourApiKeyHere')
+const client = new SocketSdk('yourApiKeyHere', {
+  retries: 3,        // Retry failed requests up to 3 times (default: 3)
+  retryDelay: 1000,  // Start with 1s delay, exponential backoff (default: 1000ms)
+  timeout: 30000,    // Request timeout in milliseconds (optional)
+})
 
 const res = await client.getQuota()
 
@@ -29,6 +33,27 @@ if (res.success) {
 }
 ```
 
+### Configuration Options
+
+The SDK constructor accepts the following options:
+
+```typescript
+interface SocketSdkOptions {
+  baseUrl?: string          // API base URL (default: 'https://api.socket.dev/v0/')
+  timeout?: number          // Request timeout in milliseconds
+  retries?: number          // Number of retry attempts for failed requests (default: 3)
+  retryDelay?: number       // Initial retry delay in ms, with exponential backoff (default: 1000)
+  userAgent?: string        // Custom user agent string
+  agent?: Agent             // Custom HTTP agent for advanced networking
+}
+```
+
+**Retry Logic:**
+- Automatically retries transient network errors and 5xx server responses
+- Uses exponential backoff: 1s, 2s, 4s, 8s... (configurable via `retryDelay`)
+- Does NOT retry 401/403 authentication errors (immediate failure)
+- Set `retries: 0` to disable retry logic entirely
+
 ### Quota Management Example
 
 ```javascript

package/dist/constants.js

@@ -8,9 +8,6 @@ exports.publicPolicy = exports.httpAgentNames = exports.DEFAULT_USER_AGENT = voi
  * @fileoverview Configuration constants and enums for the Socket SDK.
  * Provides default values, HTTP agents, and public policy configurations for API interactions.
  */
-// Import attributes are only supported when the '--module' option is set to
-// 'esnext', 'node18', 'node20', 'nodenext', or 'preserve'.
-// @ts-ignore: Avoid TS import attributes error.
 const package_json_1 = __importDefault(require("../package.json"));
 const user_agent_1 = require("./user-agent");
 exports.DEFAULT_USER_AGENT = (0, user_agent_1.createUserAgentFromPkgJson)(package_json_1.default);

package/dist/file-upload.js

@@ -24,7 +24,7 @@ function createRequestBodyForFilepaths(filepaths, basePath) {
         const filename = node_path_1.default.basename(absPath);
         requestBody.push([
             `Content-Disposition: form-data; name="${relPath}"; filename="${filename}"\r\n`,
-            `Content-Type: application/octet-stream\r\n\r\n`,
+            'Content-Type: application/octet-stream\r\n\r\n',
             (0, node_fs_1.createReadStream)(absPath, { highWaterMark: 1024 * 1024 }),
         ]);
     }
@@ -39,7 +39,7 @@ function createRequestBodyForJson(jsonData, basename = 'data.json') {
     const name = node_path_1.default.basename(basename, ext);
     return [
         `Content-Disposition: form-data; name="${name}"; filename="${basename}"\r\n` +
-            `Content-Type: application/json\r\n\r\n`,
+            'Content-Type: application/json\r\n\r\n',
         node_stream_1.Readable.from(JSON.stringify(jsonData), { highWaterMark: 1024 * 1024 }),
         '\r\n',
     ];

package/dist/http-client.d.ts

@@ -75,4 +75,39 @@ export declare function isResponseOk(response: IncomingMessage): boolean;
  * Transform artifact data based on authentication status.
  * Filters and compacts response data for public/free-tier users.
  */
-export declare function reshapeArtifactForPublicPolicy<T extends Record<string, any>>(data: T, isAuthenticated: boolean, actions?: string | undefined): T;
+export declare function reshapeArtifactForPublicPolicy<T extends Record<string, unknown>>(data: T, isAuthenticated: boolean, actions?: string | undefined): T;
+/**
+ * Retry helper for HTTP requests with exponential backoff.
+ * Wraps any async HTTP function and retries on failure.
+ *
+ * @param fn - Async function to retry
+ * @param retries - Number of retry attempts (default: 3)
+ * @param retryDelay - Initial delay in ms (default: 1000)
+ * @returns Result of the function call
+ * @throws {Error} Last error if all retries exhausted
+ */
+export declare function withRetry<T>(fn: () => Promise<T>, retries?: number, retryDelay?: number): Promise<T>;
+/**
+ * Create GET request with automatic retry logic.
+ * Retries on network errors and 5xx responses.
+ *
+ * @param retries - Number of retry attempts (default: 3)
+ * @param retryDelay - Initial delay in ms (default: 1000)
+ */
+export declare function createGetRequestWithRetry(baseUrl: string, urlPath: string, options: RequestOptions, retries?: number, retryDelay?: number): Promise<IncomingMessage>;
+/**
+ * Create DELETE request with automatic retry logic.
+ * Retries on network errors and 5xx responses.
+ *
+ * @param retries - Number of retry attempts (default: 3)
+ * @param retryDelay - Initial delay in ms (default: 1000)
+ */
+export declare function createDeleteRequestWithRetry(baseUrl: string, urlPath: string, options: RequestOptions, retries?: number, retryDelay?: number): Promise<IncomingMessage>;
+/**
+ * Create request with JSON payload and automatic retry logic.
+ * Retries on network errors and 5xx responses.
+ *
+ * @param retries - Number of retry attempts (default: 3)
+ * @param retryDelay - Initial delay in ms (default: 1000)
+ */
+export declare function createRequestWithJsonAndRetry(method: SendMethod, baseUrl: string, urlPath: string, json: unknown, options: RequestOptions, retries?: number, retryDelay?: number): Promise<IncomingMessage>;

package/dist/http-client.js

@@ -13,6 +13,10 @@ exports.getResponse = getResponse;
 exports.getResponseJson = getResponseJson;
 exports.isResponseOk = isResponseOk;
 exports.reshapeArtifactForPublicPolicy = reshapeArtifactForPublicPolicy;
+exports.withRetry = withRetry;
+exports.createGetRequestWithRetry = createGetRequestWithRetry;
+exports.createDeleteRequestWithRetry = createDeleteRequestWithRetry;
+exports.createRequestWithJsonAndRetry = createRequestWithJsonAndRetry;
 /**
  * @fileoverview HTTP client utilities for Socket API communication.
  * Provides low-level HTTP request handling with proper error management and response parsing.
@@ -248,12 +252,15 @@ function reshapeArtifactForPublicPolicy(data, isAuthenticated, actions) {
         // Handle both single artifacts and objects with artifacts arrays.
         if (data['artifacts']) {
             // Object with artifacts array.
+            const artifacts = data['artifacts'];
             return {
                 ...data,
-                artifacts: data['artifacts']?.map(reshapeArtifact),
+                artifacts: Array.isArray(artifacts)
+                    ? artifacts.map(reshapeArtifact)
+                    : artifacts,
             };
         }
-        else if (data['alerts']) {
+        if (data['alerts']) {
             // Single artifact with alerts.
             return reshapeArtifact(data);
         }
@@ -261,3 +268,80 @@ function reshapeArtifactForPublicPolicy(data, isAuthenticated, actions) {
     return data;
     /* c8 ignore stop */
 }
+/**
+ * Retry helper for HTTP requests with exponential backoff.
+ * Wraps any async HTTP function and retries on failure.
+ *
+ * @param fn - Async function to retry
+ * @param retries - Number of retry attempts (default: 3)
+ * @param retryDelay - Initial delay in ms (default: 1000)
+ * @returns Result of the function call
+ * @throws {Error} Last error if all retries exhausted
+ */
+async function withRetry(fn, retries = 3, retryDelay = 1000) {
+    let lastError;
+    for (let attempt = 0; attempt <= retries; attempt++) {
+        try {
+            // eslint-disable-next-line no-await-in-loop
+            return await fn();
+        }
+        catch (error) {
+            lastError = error;
+            // Last attempt - throw error with retry context.
+            if (attempt === retries) {
+                const enhancedError = new Error(`Request failed after ${retries + 1} attempts`, { cause: lastError });
+                throw enhancedError;
+            }
+            // Check if error is retryable (network errors, 5xx responses).
+            if (error instanceof ResponseError) {
+                const status = error.response.statusCode;
+                // Don't retry client errors (4xx).
+                if (status && status >= 400 && status < 500) {
+                    throw error;
+                }
+                (0, debug_1.debugLog)('withRetry', `Retrying after ${status} error (attempt ${attempt + 1}/${retries + 1})`);
+            }
+            else {
+                (0, debug_1.debugLog)('withRetry', `Retrying after network error (attempt ${attempt + 1}/${retries + 1})`);
+            }
+            // Exponential backoff.
+            const delayMs = retryDelay * 2 ** attempt;
+            (0, debug_1.debugLog)('withRetry', `Waiting ${delayMs}ms before retry`);
+            // eslint-disable-next-line no-await-in-loop
+            await new Promise(resolve => setTimeout(resolve, delayMs));
+        }
+    }
+    // Fallback error if lastError is somehow undefined.
+    /* c8 ignore next - Defensive fallback for undefined lastError */
+    throw lastError || new Error('Request failed after retries');
+}
+/**
+ * Create GET request with automatic retry logic.
+ * Retries on network errors and 5xx responses.
+ *
+ * @param retries - Number of retry attempts (default: 3)
+ * @param retryDelay - Initial delay in ms (default: 1000)
+ */
+async function createGetRequestWithRetry(baseUrl, urlPath, options, retries = 3, retryDelay = 1000) {
+    return await withRetry(() => createGetRequest(baseUrl, urlPath, options), retries, retryDelay);
+}
+/**
+ * Create DELETE request with automatic retry logic.
+ * Retries on network errors and 5xx responses.
+ *
+ * @param retries - Number of retry attempts (default: 3)
+ * @param retryDelay - Initial delay in ms (default: 1000)
+ */
+async function createDeleteRequestWithRetry(baseUrl, urlPath, options, retries = 3, retryDelay = 1000) {
+    return await withRetry(() => createDeleteRequest(baseUrl, urlPath, options), retries, retryDelay);
+}
+/**
+ * Create request with JSON payload and automatic retry logic.
+ * Retries on network errors and 5xx responses.
+ *
+ * @param retries - Number of retry attempts (default: 3)
+ * @param retryDelay - Initial delay in ms (default: 1000)
+ */
+async function createRequestWithJsonAndRetry(method, baseUrl, urlPath, json, options, retries = 3, retryDelay = 1000) {
+    return await withRetry(() => createRequestWithJson(method, baseUrl, urlPath, json, options), retries, retryDelay);
+}

package/dist/index.d.ts

@@ -4,11 +4,11 @@
  */
 import { DEFAULT_USER_AGENT, httpAgentNames, publicPolicy } from './constants';
 import { normalizeBaseUrl, promiseWithResolvers, queryToSearchParams, resolveAbsPaths, resolveBasePath } from './utils';
-export type * from './types';
-export { createUserAgentFromPkgJson } from './user-agent';
-export { createDeleteRequest, createGetRequest, createRequestWithJson, getErrorResponseBody, getHttpModule, getResponse, getResponseJson, isResponseOk, reshapeArtifactForPublicPolicy, ResponseError, } from './http-client';
 export { createRequestBodyForFilepaths, createRequestBodyForJson, createUploadRequest, } from './file-upload';
-export { SocketSdk } from './socket-sdk-class';
+export { createDeleteRequest, createGetRequest, createRequestWithJson, getErrorResponseBody, getHttpModule, getResponse, getResponseJson, isResponseOk, ResponseError, reshapeArtifactForPublicPolicy, } from './http-client';
 export { calculateTotalQuotaCost, getAllMethodRequirements, getMethodRequirements, getMethodsByPermissions, getMethodsByQuotaCost, getQuotaCost, getQuotaUsageSummary, getRequiredPermissions, hasQuotaForMethods, } from './quota-utils';
+export { SocketSdk } from './socket-sdk-class';
+export type * from './types';
+export { createUserAgentFromPkgJson } from './user-agent';
 export { normalizeBaseUrl, promiseWithResolvers, queryToSearchParams, resolveAbsPaths, resolveBasePath, };
 export { DEFAULT_USER_AGENT, httpAgentNames, publicPolicy };

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.publicPolicy = exports.httpAgentNames = exports.DEFAULT_USER_AGENT = exports.resolveBasePath = exports.resolveAbsPaths = exports.queryToSearchParams = exports.promiseWithResolvers = exports.normalizeBaseUrl = exports.hasQuotaForMethods = exports.getRequiredPermissions = exports.getQuotaUsageSummary = exports.getQuotaCost = exports.getMethodsByQuotaCost = exports.getMethodsByPermissions = exports.getMethodRequirements = exports.getAllMethodRequirements = exports.calculateTotalQuotaCost = exports.SocketSdk = exports.createUploadRequest = exports.createRequestBodyForJson = exports.createRequestBodyForFilepaths = exports.ResponseError = exports.reshapeArtifactForPublicPolicy = exports.isResponseOk = exports.getResponseJson = exports.getResponse = exports.getHttpModule = exports.getErrorResponseBody = exports.createRequestWithJson = exports.createGetRequest = exports.createDeleteRequest = exports.createUserAgentFromPkgJson = void 0;
+exports.publicPolicy = exports.httpAgentNames = exports.DEFAULT_USER_AGENT = exports.resolveBasePath = exports.resolveAbsPaths = exports.queryToSearchParams = exports.promiseWithResolvers = exports.normalizeBaseUrl = exports.createUserAgentFromPkgJson = exports.SocketSdk = exports.hasQuotaForMethods = exports.getRequiredPermissions = exports.getQuotaUsageSummary = exports.getQuotaCost = exports.getMethodsByQuotaCost = exports.getMethodsByPermissions = exports.getMethodRequirements = exports.getAllMethodRequirements = exports.calculateTotalQuotaCost = exports.reshapeArtifactForPublicPolicy = exports.ResponseError = exports.isResponseOk = exports.getResponseJson = exports.getResponse = exports.getHttpModule = exports.getErrorResponseBody = exports.createRequestWithJson = exports.createGetRequest = exports.createDeleteRequest = exports.createUploadRequest = exports.createRequestBodyForJson = exports.createRequestBodyForFilepaths = void 0;
 /**
  * @fileoverview Main entry point for the Socket SDK.
  * Provides the SocketSdk class and utility functions for Socket security analysis API interactions.
@@ -16,9 +16,11 @@ Object.defineProperty(exports, "promiseWithResolvers", { enumerable: true, get:
 Object.defineProperty(exports, "queryToSearchParams", { enumerable: true, get: function () { return utils_1.queryToSearchParams; } });
 Object.defineProperty(exports, "resolveAbsPaths", { enumerable: true, get: function () { return utils_1.resolveAbsPaths; } });
 Object.defineProperty(exports, "resolveBasePath", { enumerable: true, get: function () { return utils_1.resolveBasePath; } });
-// Re-export functions from modules
-const user_agent_1 = require("./user-agent");
-Object.defineProperty(exports, "createUserAgentFromPkgJson", { enumerable: true, get: function () { return user_agent_1.createUserAgentFromPkgJson; } });
+// Re-export file upload functions
+const file_upload_1 = require("./file-upload");
+Object.defineProperty(exports, "createRequestBodyForFilepaths", { enumerable: true, get: function () { return file_upload_1.createRequestBodyForFilepaths; } });
+Object.defineProperty(exports, "createRequestBodyForJson", { enumerable: true, get: function () { return file_upload_1.createRequestBodyForJson; } });
+Object.defineProperty(exports, "createUploadRequest", { enumerable: true, get: function () { return file_upload_1.createUploadRequest; } });
 // Re-export HTTP client functions
 const http_client_1 = require("./http-client");
 Object.defineProperty(exports, "createDeleteRequest", { enumerable: true, get: function () { return http_client_1.createDeleteRequest; } });
@@ -29,16 +31,8 @@ Object.defineProperty(exports, "getHttpModule", { enumerable: true, get: functio
 Object.defineProperty(exports, "getResponse", { enumerable: true, get: function () { return http_client_1.getResponse; } });
 Object.defineProperty(exports, "getResponseJson", { enumerable: true, get: function () { return http_client_1.getResponseJson; } });
 Object.defineProperty(exports, "isResponseOk", { enumerable: true, get: function () { return http_client_1.isResponseOk; } });
-Object.defineProperty(exports, "reshapeArtifactForPublicPolicy", { enumerable: true, get: function () { return http_client_1.reshapeArtifactForPublicPolicy; } });
 Object.defineProperty(exports, "ResponseError", { enumerable: true, get: function () { return http_client_1.ResponseError; } });
-// Re-export file upload functions
-const file_upload_1 = require("./file-upload");
-Object.defineProperty(exports, "createRequestBodyForFilepaths", { enumerable: true, get: function () { return file_upload_1.createRequestBodyForFilepaths; } });
-Object.defineProperty(exports, "createRequestBodyForJson", { enumerable: true, get: function () { return file_upload_1.createRequestBodyForJson; } });
-Object.defineProperty(exports, "createUploadRequest", { enumerable: true, get: function () { return file_upload_1.createUploadRequest; } });
-// Re-export the main SocketSdk class
-const socket_sdk_class_1 = require("./socket-sdk-class");
-Object.defineProperty(exports, "SocketSdk", { enumerable: true, get: function () { return socket_sdk_class_1.SocketSdk; } });
+Object.defineProperty(exports, "reshapeArtifactForPublicPolicy", { enumerable: true, get: function () { return http_client_1.reshapeArtifactForPublicPolicy; } });
 // Re-export quota utility functions
 const quota_utils_1 = require("./quota-utils");
 Object.defineProperty(exports, "calculateTotalQuotaCost", { enumerable: true, get: function () { return quota_utils_1.calculateTotalQuotaCost; } });
@@ -50,3 +44,9 @@ Object.defineProperty(exports, "getQuotaCost", { enumerable: true, get: function
 Object.defineProperty(exports, "getQuotaUsageSummary", { enumerable: true, get: function () { return quota_utils_1.getQuotaUsageSummary; } });
 Object.defineProperty(exports, "getRequiredPermissions", { enumerable: true, get: function () { return quota_utils_1.getRequiredPermissions; } });
 Object.defineProperty(exports, "hasQuotaForMethods", { enumerable: true, get: function () { return quota_utils_1.hasQuotaForMethods; } });
+// Re-export the main SocketSdk class
+const socket_sdk_class_1 = require("./socket-sdk-class");
+Object.defineProperty(exports, "SocketSdk", { enumerable: true, get: function () { return socket_sdk_class_1.SocketSdk; } });
+// Re-export functions from modules
+const user_agent_1 = require("./user-agent");
+Object.defineProperty(exports, "createUserAgentFromPkgJson", { enumerable: true, get: function () { return user_agent_1.createUserAgentFromPkgJson; } });

package/dist/promise-queue.d.ts

@@ -0,0 +1,35 @@
+export declare class PromiseQueue {
+    private queue;
+    private running;
+    private readonly maxConcurrency;
+    private readonly maxQueueLength;
+    /**
+     * Creates a new PromiseQueue
+     * @param maxConcurrency - Maximum number of promises that can run concurrently
+     * @param maxQueueLength - Maximum queue size (older tasks are dropped if exceeded)
+     */
+    constructor(maxConcurrency: number, maxQueueLength?: number | undefined);
+    /**
+     * Add a task to the queue
+     * @param fn - Async function to execute
+     * @returns Promise that resolves with the function's result
+     */
+    add<T>(fn: () => Promise<T>): Promise<T>;
+    private runNext;
+    /**
+     * Wait for all queued and running tasks to complete
+     */
+    onIdle(): Promise<void>;
+    /**
+     * Get the number of tasks currently running
+     */
+    get activeCount(): number;
+    /**
+     * Get the number of tasks waiting in the queue
+     */
+    get pendingCount(): number;
+    /**
+     * Clear all pending tasks from the queue (does not affect running tasks)
+     */
+    clear(): void;
+}

package/dist/promise-queue.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PromiseQueue = void 0;
+class PromiseQueue {
+    queue = [];
+    running = 0;
+    maxConcurrency;
+    maxQueueLength;
+    /**
+     * Creates a new PromiseQueue
+     * @param maxConcurrency - Maximum number of promises that can run concurrently
+     * @param maxQueueLength - Maximum queue size (older tasks are dropped if exceeded)
+     */
+    constructor(maxConcurrency, maxQueueLength) {
+        this.maxConcurrency = maxConcurrency;
+        this.maxQueueLength = maxQueueLength;
+        if (maxConcurrency < 1) {
+            throw new Error('maxConcurrency must be at least 1');
+        }
+    }
+    /**
+     * Add a task to the queue
+     * @param fn - Async function to execute
+     * @returns Promise that resolves with the function's result
+     */
+    async add(fn) {
+        return await new Promise((resolve, reject) => {
+            const task = { fn, resolve, reject };
+            if (this.maxQueueLength && this.queue.length >= this.maxQueueLength) {
+                // Drop oldest task to prevent memory buildup
+                this.queue.shift();
+            }
+            this.queue.push(task);
+            this.runNext();
+        });
+    }
+    runNext() {
+        if (this.running >= this.maxConcurrency || this.queue.length === 0) {
+            return;
+        }
+        const task = this.queue.shift();
+        /* c8 ignore next 3 - Defensive check; unreachable since we verify queue.length above */
+        if (!task) {
+            return;
+        }
+        this.running++;
+        task
+            .fn()
+            .then(task.resolve)
+            .catch(task.reject)
+            .finally(() => {
+            this.running--;
+            this.runNext();
+        });
+    }
+    /**
+     * Wait for all queued and running tasks to complete
+     */
+    async onIdle() {
+        return await new Promise(resolve => {
+            const check = () => {
+                if (this.running === 0 && this.queue.length === 0) {
+                    resolve();
+                }
+                else {
+                    setImmediate(check);
+                }
+            };
+            check();
+        });
+    }
+    /**
+     * Get the number of tasks currently running
+     */
+    get activeCount() {
+        return this.running;
+    }
+    /**
+     * Get the number of tasks waiting in the queue
+     */
+    get pendingCount() {
+        return this.queue.length;
+    }
+    /**
+     * Clear all pending tasks from the queue (does not affect running tasks)
+     */
+    clear() {
+        this.queue = [];
+    }
+}
+exports.PromiseQueue = PromiseQueue;

package/dist/quota-utils.js

@@ -22,8 +22,11 @@ function loadRequirements() {
         return requirements;
     }
     try {
-        // Resolve path relative to current working directory
-        const requirementsPath = (0, node_path_1.join)(process.cwd(), 'requirements.json');
+        // Resolve path relative to this module file location.
+        // When compiled, __dirname will point to dist/ directory.
+        // In source, __dirname points to src/ directory.
+        // requirements.json is always in the parent directory of dist/ or src/.
+        const requirementsPath = (0, node_path_1.join)(__dirname, '..', 'requirements.json');
         const data = (0, node_fs_1.readFileSync)(requirementsPath, 'utf8');
         requirements = JSON.parse(data);
         return requirements;

package/dist/socket-sdk-class.d.ts

@@ -1,4 +1,4 @@
-import type { ArtifactPatches, BatchPackageFetchResultType, BatchPackageStreamOptions, Entitlement, GetOptions, PatchViewResponse, QueryParams, SendOptions, SocketSdkGenericResult, SocketSdkOptions, SocketSdkResult, UploadManifestFilesError, UploadManifestFilesReturnType } from './types';
+import type { ArtifactPatches, BatchPackageFetchResultType, BatchPackageStreamOptions, CreateDependenciesSnapshotOptions, CreateOrgFullScanOptions, CreateScanFromFilepathsOptions, Entitlement, GetOptions, PatchViewResponse, QueryParams, SendOptions, SocketSdkGenericResult, SocketSdkOptions, SocketSdkResult, StreamOrgFullScanOptions, UploadManifestFilesError, UploadManifestFilesOptions, UploadManifestFilesReturnType } from './types';
 import type { IncomingMessage } from 'node:http';
 /**
  * Socket SDK for programmatic access to Socket.dev security analysis APIs.
@@ -8,7 +8,7 @@ export declare class SocketSdk {
     #private;
     /**
      * Initialize Socket SDK with API token and configuration options.
-     * Sets up authentication, base URL, and HTTP client options.
+     * Sets up authentication, base URL, HTTP client options, and retry behavior.
      */
     constructor(apiToken: string, options?: SocketSdkOptions | undefined);
     /**
@@ -39,7 +39,7 @@ export declare class SocketSdk {
      *
      * @throws {Error} When server returns 5xx status codes
      */
-    createDependenciesSnapshot(filepaths: string[], pathsRelativeTo?: string, queryParams?: QueryParams | undefined): Promise<SocketSdkResult<'createDependenciesSnapshot'>>;
+    createDependenciesSnapshot(filepaths: string[], options?: CreateDependenciesSnapshotOptions | undefined): Promise<SocketSdkResult<'createDependenciesSnapshot'>>;
     /**
      * Create a diff scan from two full scan IDs.
      * Compares two existing full scans to identify changes.
@@ -53,7 +53,7 @@ export declare class SocketSdk {
      *
      * @throws {Error} When server returns 5xx status codes
      */
-    createOrgFullScan(orgSlug: string, filepaths: string[], pathsRelativeTo?: string, queryParams?: QueryParams | undefined): Promise<SocketSdkResult<'CreateOrgFullScan'>>;
+    createOrgFullScan(orgSlug: string, filepaths: string[], options?: CreateOrgFullScanOptions | undefined): Promise<SocketSdkResult<'CreateOrgFullScan'>>;
     /**
      * Create a new repository in an organization.
      * Registers a repository for monitoring and security scanning.
@@ -74,7 +74,7 @@ export declare class SocketSdk {
      *
      * @throws {Error} When server returns 5xx status codes
      */
-    createScanFromFilepaths(filepaths: string[], pathsRelativeTo?: string, issueRules?: Record<string, boolean> | undefined): Promise<SocketSdkResult<'createReport'>>;
+    createScanFromFilepaths(filepaths: string[], options?: CreateScanFromFilepathsOptions | undefined): Promise<SocketSdkResult<'createReport'>>;
     /**
      * Delete a diff scan from an organization.
      * Permanently removes diff scan data and results.
@@ -362,7 +362,7 @@ export declare class SocketSdk {
      *
      * @throws {Error} When server returns 5xx status codes
      */
-    streamOrgFullScan(orgSlug: string, fullScanId: string, output?: string | boolean): Promise<SocketSdkResult<'getOrgFullScan'>>;
+    streamOrgFullScan(orgSlug: string, fullScanId: string, options?: StreamOrgFullScanOptions | undefined): Promise<SocketSdkResult<'getOrgFullScan'>>;
     /**
      * Stream patches for artifacts in a scan report.
      *
@@ -411,7 +411,7 @@ export declare class SocketSdk {
      *
      * @throws {Error} When server returns 5xx status codes
      */
-    uploadManifestFiles(orgSlug: string, filepaths: string[], pathsRelativeTo?: string): Promise<UploadManifestFilesReturnType | UploadManifestFilesError>;
+    uploadManifestFiles(orgSlug: string, filepaths: string[], options?: UploadManifestFilesOptions | undefined): Promise<UploadManifestFilesReturnType | UploadManifestFilesError>;
     /**
      * View detailed information about a specific patch by its UUID.
      *

package/dist/socket-sdk-class.js

@@ -31,12 +31,14 @@ class SocketSdk {
     #apiToken;
     #baseUrl;
     #reqOptions;
+    #retries;
+    #retryDelay;
     /**
      * Initialize Socket SDK with API token and configuration options.
-     * Sets up authentication, base URL, and HTTP client options.
+     * Sets up authentication, base URL, HTTP client options, and retry behavior.
      */
     constructor(apiToken, options) {
-        const { agent: agentOrObj, baseUrl = 'https://api.socket.dev/v0/', timeout, userAgent, } = { __proto__: null, ...options };
+        const { agent: agentOrObj, baseUrl = 'https://api.socket.dev/v0/', retries = 3, retryDelay = 1000, timeout, userAgent, } = { __proto__: null, ...options };
         const agentKeys = agentOrObj ? Object.keys(agentOrObj) : [];
         const agentAsGotOptions = agentOrObj;
         const agent = (agentKeys.length && agentKeys.every(k => constants_1.httpAgentNames.has(k))
@@ -47,6 +49,8 @@ class SocketSdk {
             : agentOrObj);
         this.#apiToken = apiToken;
         this.#baseUrl = (0, utils_1.normalizeBaseUrl)(baseUrl);
+        this.#retries = retries;
+        this.#retryDelay = retryDelay;
         this.#reqOptions = {
             ...(agent ? { agent } : {}),
             headers: {
@@ -57,6 +61,33 @@ class SocketSdk {
             ...(timeout ? { timeout } : {}),
         };
     }
+    /**
+     * Execute an HTTP request with retry logic.
+     * Internal method for wrapping HTTP operations with exponential backoff.
+     */
+    async #executeWithRetry(operation) {
+        const result = await (0, promises_1.pRetry)(operation, {
+            baseDelayMs: this.#retryDelay,
+            onRetry(_attempt, error) {
+                /* c8 ignore next 3 - Early return for non-ResponseError types in retry logic */
+                if (!(error instanceof http_client_1.ResponseError)) {
+                    return;
+                }
+                const { statusCode } = error.response;
+                // Don't retry authentication/authorization errors - they won't succeed.
+                if (statusCode === 401 || statusCode === 403) {
+                    throw error;
+                }
+            },
+            onRetryRethrow: true,
+            retries: this.#retries,
+        });
+        /* c8 ignore next 3 - Defensive check for undefined result from pRetry abort */
+        if (result === undefined) {
+            throw new Error('Request aborted');
+        }
+        return result;
+    }
     /**
      * Create async generator for streaming batch package URL processing.
      * Internal method for handling chunked PURL responses with error handling.
@@ -64,30 +95,21 @@ class SocketSdk {
     async *#createBatchPurlGenerator(componentsObj, queryParams) {
         let res;
         try {
-            res = await (0, promises_1.pRetry)(() => this.#createBatchPurlRequest(componentsObj, queryParams), {
-                retries: 4,
-                onRetryRethrow: true,
-                onRetry(_attempt, error) {
-                    /* c8 ignore next 3 - Early return for non-ResponseError types in retry logic, difficult to test without complex network error simulation. */
-                    if (!(error instanceof http_client_1.ResponseError)) {
-                        return;
-                    }
-                    const { statusCode } = error.response;
-                    // Don't retry authentication/authorization errors - they won't succeed.
-                    if (statusCode === 401 || statusCode === 403) {
-                        throw error;
-                    }
-                },
-            });
+            res = await this.#executeWithRetry(() => this.#createBatchPurlRequest(componentsObj, queryParams));
         }
         catch (e) {
             yield await this.#handleApiError(e);
             return;
         }
+        // Validate response before processing.
+        /* c8 ignore next 3 - Defensive check, response should always be defined after successful request */
+        if (!res) {
+            throw new Error('Failed to get response from batch PURL request');
+        }
         // Parse the newline delimited JSON response.
         const rli = node_readline_1.default.createInterface({
             input: res,
-            crlfDelay: Infinity,
+            crlfDelay: Number.POSITIVE_INFINITY,
             signal: abort_signal_1.default,
         });
         const isPublicToken = this.#apiToken === SOCKET_PUBLIC_API_TOKEN_1.default;
@@ -285,10 +307,15 @@ class SocketSdk {
         catch (e) {
             return await this.#handleApiError(e);
         }
+        // Validate response before processing.
+        /* c8 ignore next 3 - Defensive check, response should always be defined after successful request */
+        if (!res) {
+            throw new Error('Failed to get response from batch PURL request');
+        }
         // Parse the newline delimited JSON response.
         const rli = node_readline_1.default.createInterface({
             input: res,
-            crlfDelay: Infinity,
+            crlfDelay: Number.POSITIVE_INFINITY,
             signal: abort_signal_1.default,
         });
         const isPublicToken = this.#apiToken === SOCKET_PUBLIC_API_TOKEN_1.default;
@@ -365,9 +392,13 @@ class SocketSdk {
         while (running.length > 0) {
             // eslint-disable-next-line no-await-in-loop
             const { generator, iteratorResult } = await Promise.race(running.map(entry => entry.promise));
-            // Remove generator.
-            /* c8 ignore next 3 - Concurrent generator cleanup edge case. */
-            running.splice(running.findIndex(entry => entry.generator === generator), 1);
+            // Remove generator with safe index lookup.
+            const index = running.findIndex(entry => entry.generator === generator);
+            /* c8 ignore next 3 - Defensive check for concurrent generator cleanup edge case. */
+            if (index === -1) {
+                continue;
+            }
+            running.splice(index, 1);
             // Yield the value if one is given, even when done:true.
             if (iteratorResult.value) {
                 yield iteratorResult.value;
@@ -394,11 +425,15 @@ class SocketSdk {
      *
      * @throws {Error} When server returns 5xx status codes
      */
-    async createDependenciesSnapshot(filepaths, pathsRelativeTo = '.', queryParams) {
+    async createDependenciesSnapshot(filepaths, options) {
+        const { pathsRelativeTo = '.', queryParams } = {
+            __proto__: null,
+            ...options,
+        };
         const basePath = (0, utils_1.resolveBasePath)(pathsRelativeTo);
         const absFilepaths = (0, utils_1.resolveAbsPaths)(filepaths, basePath);
         try {
-            const data = await (0, http_client_1.getResponseJson)(await (0, file_upload_1.createUploadRequest)(this.#baseUrl, `dependencies/upload?${(0, utils_1.queryToSearchParams)(queryParams)}`, (0, file_upload_1.createRequestBodyForFilepaths)(absFilepaths, basePath), this.#reqOptions));
+            const data = await this.#executeWithRetry(async () => await (0, http_client_1.getResponseJson)(await (0, file_upload_1.createUploadRequest)(this.#baseUrl, `dependencies/upload?${(0, utils_1.queryToSearchParams)(queryParams)}`, (0, file_upload_1.createRequestBodyForFilepaths)(absFilepaths, basePath), this.#reqOptions)));
             return this.#handleApiSuccess(data);
         }
         catch (e) {
@@ -426,7 +461,11 @@ class SocketSdk {
      *
      * @throws {Error} When server returns 5xx status codes
      */
-    async createOrgFullScan(orgSlug, filepaths, pathsRelativeTo = '.', queryParams) {
+    async createOrgFullScan(orgSlug, filepaths, options) {
+        const { pathsRelativeTo = '.', queryParams } = {
+            __proto__: null,
+            ...options,
+        };
         const basePath = (0, utils_1.resolveBasePath)(pathsRelativeTo);
         const absFilepaths = (0, utils_1.resolveAbsPaths)(filepaths, basePath);
         try {
@@ -473,7 +512,11 @@ class SocketSdk {
      *
      * @throws {Error} When server returns 5xx status codes
      */
-    async createScanFromFilepaths(filepaths, pathsRelativeTo = '.', issueRules) {
+    async createScanFromFilepaths(filepaths, options) {
+        const { issueRules, pathsRelativeTo = '.' } = {
+            __proto__: null,
+            ...options,
+        };
         const basePath = (0, utils_1.resolveBasePath)(pathsRelativeTo);
         const absFilepaths = (0, utils_1.resolveAbsPaths)(filepaths, basePath);
         try {
@@ -769,7 +812,7 @@ class SocketSdk {
      */
     async getOrganizations() {
         try {
-            const data = await (0, http_client_1.getResponseJson)(await (0, http_client_1.createGetRequest)(this.#baseUrl, 'organizations', this.#reqOptions));
+            const data = await this.#executeWithRetry(async () => await (0, http_client_1.getResponseJson)(await (0, http_client_1.createGetRequest)(this.#baseUrl, 'organizations', this.#reqOptions)));
             return this.#handleApiSuccess(data);
         }
         catch (e) {
@@ -1182,7 +1225,11 @@ class SocketSdk {
      *
      * @throws {Error} When server returns 5xx status codes
      */
-    async streamOrgFullScan(orgSlug, fullScanId, output) {
+    async streamOrgFullScan(orgSlug, fullScanId, options) {
+        const { output } = {
+            __proto__: null,
+            ...options,
+        };
         try {
             const req = (0, http_client_1.getHttpModule)(this.#baseUrl)
                 .request(`${this.#baseUrl}orgs/${encodeURIComponent(orgSlug)}/full-scans/${encodeURIComponent(fullScanId)}`, {
@@ -1196,12 +1243,23 @@ class SocketSdk {
                 throw new http_client_1.ResponseError(res);
             }
             if (typeof output === 'string') {
-                // Stream to file
-                res.pipe((0, node_fs_1.createWriteStream)(output));
+                // Stream to file with error handling.
+                const writeStream = (0, node_fs_1.createWriteStream)(output);
+                res.pipe(writeStream);
+                /* c8 ignore next 4 - Write stream error handler, difficult to test reliably */
+                writeStream.on('error', error => {
+                    throw new Error(`Failed to write to file: ${output}`, {
+                        cause: error,
+                    });
+                });
             }
             else if (output === true) {
-                // Stream to stdout
+                // Stream to stdout with error handling.
                 res.pipe(process.stdout);
+                /* c8 ignore next 3 - Stdout error handler, difficult to test reliably */
+                process.stdout.on('error', error => {
+                    throw new Error('Failed to write to stdout', { cause: error });
+                });
             }
             // If output is false or undefined, just return the response without streaming
             return this.#handleApiSuccess(res);
@@ -1240,8 +1298,8 @@ class SocketSdk {
                             controller.enqueue(data);
                         }
                         catch (e) {
-                            // Skip invalid JSON lines
-                            continue;
+                            // Log parse errors for debugging invalid NDJSON lines.
+                            (0, debug_1.debugLog)('streamPatchesFromScan', `Failed to parse line: ${e}`);
                         }
                     }
                 });
@@ -1334,7 +1392,11 @@ class SocketSdk {
      *
      * @throws {Error} When server returns 5xx status codes
      */
-    async uploadManifestFiles(orgSlug, filepaths, pathsRelativeTo = '.') {
+    async uploadManifestFiles(orgSlug, filepaths, options) {
+        const { pathsRelativeTo = '.' } = {
+            __proto__: null,
+            ...options,
+        };
         const basePath = (0, utils_1.resolveBasePath)(pathsRelativeTo);
         const absFilepaths = (0, utils_1.resolveAbsPaths)(filepaths, basePath);
         try {

package/dist/types.d.ts

@@ -73,12 +73,14 @@ export type GotOptions = {
     http?: HttpAgent | undefined;
     https?: HttpsAgent | undefined;
 };
-export type QueryParams = Record<string, any>;
+export type QueryParams = Record<string, unknown>;
 export type HeadersRecord = Record<string, string | string[]> | undefined;
+export type SocketMetricSchema = components['schemas']['SocketMetricSchema'];
+export type SocketId = components['schemas']['SocketId'];
 export type SocketArtifactWithExtras = SocketArtifact & {
-    scorecards?: any | undefined;
-    supplyChainRisk?: any | undefined;
-    topLevelAncestors?: any | undefined;
+    scorecards?: unknown | undefined;
+    supplyChainRisk?: SocketMetricSchema | undefined;
+    topLevelAncestors?: SocketId[] | undefined;
 };
 export type RequestOptions = ((HttpsRequestOptions & {
     headers?: HeadersRecord | undefined;
@@ -130,6 +132,8 @@ export type SocketSdkGenericResult<T> = {
 export interface SocketSdkOptions {
     agent?: Agent | GotOptions | undefined;
     baseUrl?: string | undefined;
+    retries?: number | undefined;
+    retryDelay?: number | undefined;
     timeout?: number | undefined;
     userAgent?: string | undefined;
 }
@@ -157,3 +161,21 @@ export type BatchPackageStreamOptions = {
     concurrencyLimit?: number | undefined;
     queryParams?: QueryParams | undefined;
 };
+export type CreateDependenciesSnapshotOptions = {
+    pathsRelativeTo?: string | undefined;
+    queryParams?: QueryParams | undefined;
+};
+export type CreateOrgFullScanOptions = {
+    pathsRelativeTo?: string | undefined;
+    queryParams?: QueryParams | undefined;
+};
+export type CreateScanFromFilepathsOptions = {
+    issueRules?: Record<string, boolean> | undefined;
+    pathsRelativeTo?: string | undefined;
+};
+export type StreamOrgFullScanOptions = {
+    output?: boolean | string | undefined;
+};
+export type UploadManifestFilesOptions = {
+    pathsRelativeTo?: string | undefined;
+};

package/dist/utils.d.ts

@@ -14,7 +14,7 @@ export declare function promiseWithResolvers<T>(): ReturnType<typeof Promise.wit
  * Convert query parameters to URLSearchParams with API-compatible key normalization.
  * Transforms camelCase keys to snake_case and filters out empty values.
  */
-export declare function queryToSearchParams(init?: URLSearchParams | string | QueryParams | Iterable<[string, any]> | ReadonlyArray<[string, any]> | null | undefined): URLSearchParams;
+export declare function queryToSearchParams(init?: URLSearchParams | string | QueryParams | Iterable<[string, unknown]> | ReadonlyArray<[string, unknown]> | null | undefined): URLSearchParams;
 /**
  * Convert relative file paths to absolute paths.
  * Resolves paths relative to specified base directory or current working directory.

package/dist/utils.js

@@ -47,8 +47,8 @@ function promiseWithResolvers() {
  * Transforms camelCase keys to snake_case and filters out empty values.
  */
 function queryToSearchParams(init) {
-    const params = new URLSearchParams(init ?? '');
-    const normalized = { __proto__: null };
+    const params = new URLSearchParams(init);
+    const normalized = Object.create(null);
     const entries = params.entries();
     for (const entry of entries) {
         let key = entry[0];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/sdk",
-  "version": "1.9.2",
+  "version": "1.10.0",
   "license": "MIT",
   "description": "SDK for the Socket API client",
   "author": {
@@ -75,7 +75,7 @@
     "update:socket": "pnpm -r update '@socketsecurity/*' --latest"
   },
   "dependencies": {
-    "@socketsecurity/registry": "1.3.10"
+    "@socketsecurity/registry": "1.4.0"
   },
   "devDependencies": {
     "@biomejs/biome": "2.2.4",