feat(sdk): bump socket-cli v1.x to @socketsecurity/sdk 4.x (SURF-1446 + SURF-742)

[John-David Dalton (jdalton)]

Bumps @socketsecurity/sdk 1.4.96 → 4.0.2 on the v1.x line and migrates every call site. This PR is SURF-1446 (v1.x → latest SDK) and delivers SURF-742 (cached scan view) by riding the bump. Ported against main, which is already on SDK 4.x.

SDK 4.x deltas handled

4.x renamed most org-scoped methods and reshaped option/result types:

• getOrgFullScan* → getFullScan / streamFullScan / listFullScans / getFullScanMetadata / deleteFullScan
• createOrgRepo/getOrgRepo/getOrgRepoList/updateOrgRepo/deleteOrgRepo → createRepository/getRepository/listRepositories/updateRepository/deleteRepository
• getOrganizations → listOrganizations; getSupportedScanFiles → getSupportedFiles
• createFullScan: positional cwd → options.pathsRelativeTo; pull_request now numeric
• uploadManifestFiles: positional string → { pathsRelativeTo }

Blast radius: 40 source files across scan/repository/organization/audit-log/package + utils. All SocketSdkSuccessResult<'op'> annotations retargeted to the new operation keys so they stay type-safe (stale keys silently resolve to any in 4.x).

Notable behavior/compat fixes:

• getSupportedFiles is org-scoped in v4 — fetchSupportedScanFileNames now takes an orgSlug (threaded from callers, getDefaultOrgSlug fallback).
• setupSdk only forwards a timeout when set — v4 validates [5000, 300000]ms and the CLI default (0/unset) is invalid, which otherwise threw on every call.
• ALL_ECOSYSTEMS gains clawhub + socket to satisfy the PURL_Type exhaustiveness check against 4.x.

SURF-742 — cached scan view

socket scan view default + --json (non-stream) now read pre-computed results via ...full-scans/{id}?cached=true, polling 202→200 with exponential backoff (1s→10s, 10min budget) and parsing the 200 ndjson (queryApiSafeTextWithStatus, matching how main's CLI does it — the SDK's getFullScan returns scan metadata, not the artifact list). --stream --json stays on the streaming method (streamFullScan).

No casts/shims to force compilation — the one adaptation cast (enabledState) is for a __proto__: null literal against v4's widened ALERT_TYPE.

Verification

• tsgo: clean (0 errors; baseline was clean, so all 39 initial errors were bump-driven and resolved)
• eslint + oxlint + biome: clean
• Tests: fetch-scan.test.mts (5, nock, incl. 202→200 poll), api.test.mts (10), plus repository/organization/audit-log/package/scan command + output + util suites — all green (~200 tests across touched areas). Updated one v1.x integration test (cmd-scan-create "no manifest files") since an invalid token now fails at the org-scoped supported-files fetch.

Don't merge yet.

---

Note

High Risk
Major dependency jump with broad changes to scan create/view, uploads, and org/repo APIs; cached scan polling and org-scoped manifest discovery alter failure modes and timing for core CLI workflows.

Overview
Upgrades @socketsecurity/sdk from 1.4.96 to 4.0.2 and updates every call site to match 4.x method names and payloads (repos, full scans, org list, supported files, manifest upload/create scan).

API migration highlights: getOrganizations → listOrganizations; repo CRUD/list → createRepository / getRepository / listRepositories / etc.; full-scan ops → createFullScan, listFullScans, deleteFullScan, getFullScanMetadata; getSupportedScanFiles → getSupportedFiles(orgSlug) with orgSlug threaded through scan/fix/GitHub flows. Upload/create paths use { pathsRelativeTo } instead of a positional cwd; pagination and flags are numbers/booleans rather than stringified query params. setupSdk only passes timeout when set so v4’s [5000, 300000] validation does not reject the CLI default of 0.

Scan view (SURF-742): fetchScan loads artifacts via ?cached=true, polls 202 with exponential backoff (new queryApiSafeTextWithStatus), and fails fast on bad NDJSON; streaming uses streamFullScan. Adds fetch-scan.test.mts (nock). ALL_ECOSYSTEMS adds clawhub and socket for SDK type exhaustiveness.

Tests and typings are aligned to new SocketSdkSuccessResult<'…'> operation keys; one integration test tolerates auth failing earlier on org-scoped supported-files lookup.

^{Reviewed by Cursor Bugbot for commit d684814. Configure here.}

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​socketsecurity/​sdk@​4.0.3

View full report