@socketsecurity/lib 5.27.0 → 6.0.0

package/dist/globs/defaults.js

@@ -0,0 +1,61 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var defaults_exports = {};
+__export(defaults_exports, {
+  defaultIgnore: () => defaultIgnore
+});
+module.exports = __toCommonJS(defaults_exports);
+var import_mutate = require("../objects/mutate");
+const defaultIgnore = (0, import_mutate.objectFreeze)([
+  // https://docs.npmjs.com/cli/v10/configuring-npm/package-json#files
+  "**/.git",
+  "**/.npmrc",
+  "**/node_modules",
+  // https://github.com/npm/npm-packlist/blob/v10.0.0/lib/index.js#L15-L38
+  "**/.DS_Store",
+  "**/.gitignore",
+  "**/.hg",
+  "**/.lock-wscript",
+  "**/.npmignore",
+  "**/.svn",
+  "**/.wafpickle-*",
+  "**/.*.swp",
+  "**/._*/**",
+  "**/archived-packages/**",
+  "**/build/config.gypi",
+  "**/CVS",
+  "**/npm-debug.log",
+  "**/*.orig",
+  // Inline generic socket-registry .gitignore entries.
+  "**/.env",
+  "**/.eslintcache",
+  "**/.nvm",
+  "**/.tap",
+  "**/.vscode",
+  "**/*.tsbuildinfo",
+  "**/Thumbs.db",
+  // Inline additional ignores.
+  "**/bower_components"
+]);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  defaultIgnore
+});

package/dist/globs/glob.d.ts

@@ -0,0 +1,59 @@
+/**
+ * @file `glob` (async) and `globSync` — fast-glob wrappers with a
+ *   `node:fs.glob` fast-path when the option surface lines up.
+ *   `canUseNodeFsGlob` is the per-call gate. Trailing-slash workaround for
+ *   fast-glob ignore patterns
+ *   ───────────────────────────────────────────────────────── TL;DR: when you
+ *   pass `ignore: ['**\/dist/']` to fast-glob, the `dist` directory still gets
+ *   walked. Strip the trailing slash before passing it to fast-glob and the
+ *   ignore actually takes effect. Why this exists ─────────────── The gitignore
+ *   convention is to write directory entries with a trailing slash: `dist/`,
+ *   `node_modules/`, `coverage/`. Tools that translate gitignore lines into
+ *   glob patterns (including socket-cli's `globWithGitIgnore` helper,
+ *   npm-packlist, etc.) preserve that slash. fast-glob has TWO independent
+ *   filters that handle the trailing slash differently:
+ *
+ *   1. The DEEP filter decides whether to walk INTO a candidate directory. The
+ *      deep filter compiles `**\/dist/` into a regex that requires a trailing
+ *      slash on the input, but it tests `entryPath = 'dist'` (no slash, because
+ *      readdir entries don't include one). So fast-glob walks in anyway.
+ *   2. The ENTRY filter (post-walk) retries with a trailing slash appended for
+ *      directory entries — so it correctly excludes the results, but only AFTER
+ *      the entire subtree has been walked. Net effect: a `dist/` ignore pattern
+ *      correctly removes contents from the result array, but only after
+ *      walking. On a 300k-file `dist/` under tight memory this is the
+ *      difference between "instant" and "OOM kill". Stripping the trailing
+ *      slash makes it `**\/dist`, which both filters interpret correctly.
+ */
+import type { FastGlobOptions, Pattern } from './types';
+/**
+ * Whether the caller's option bag is fully expressible with `node:fs.glob`
+ * (`cwd` + `exclude`). Any other option means we must fall back to fast-glob,
+ * which exposes the wider surface.
+ *
+ * Exported for unit tests; not part of the public API.
+ *
+ * @internal
+ */
+export declare function canUseNodeFsGlob(options: FastGlobOptions | undefined): boolean;
+/**
+ * Asynchronously find files matching glob patterns.
+ *
+ * @example
+ *   ;```typescript
+ *   const files = await glob('src/*.ts', { cwd: '/tmp/project' })
+ *   console.log(files) // ['src/index.ts', 'src/utils.ts']
+ *   ```
+ */
+export declare function glob(patterns: Pattern | Pattern[], options?: FastGlobOptions): Promise<string[]>;
+/**
+ * Synchronously find files matching glob patterns. Wrapper around
+ * fast-glob.sync.
+ *
+ * @example
+ *   ;```typescript
+ *   const files = globSync('*.json', { cwd: '/tmp/project' })
+ *   console.log(files) // ['package.json', 'tsconfig.json']
+ *   ```
+ */
+export declare function globSync(patterns: Pattern | Pattern[], options?: FastGlobOptions): string[];

package/dist/globs/glob.js

@@ -0,0 +1,84 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var glob_exports = {};
+__export(glob_exports, {
+  canUseNodeFsGlob: () => canUseNodeFsGlob,
+  glob: () => glob,
+  globSync: () => globSync
+});
+module.exports = __toCommonJS(glob_exports);
+var import_resolvers = require("../promises/resolvers");
+var import_internal = require("./_internal");
+function canUseNodeFsGlob(options) {
+  if (!options) {
+    return true;
+  }
+  for (const key of Object.keys(options)) {
+    if (key !== "cwd" && key !== "ignore") {
+      return false;
+    }
+  }
+  return true;
+}
+// @__NO_SIDE_EFFECTS__
+async function glob(patterns, options) {
+  const normalizedIgnore = (0, import_internal.normalizeIgnorePatterns)(options?.ignore);
+  if (canUseNodeFsGlob(options)) {
+    const out2 = await (0, import_resolvers.fromAsync)(
+      (0, import_internal.getFsPromises)().glob(patterns, {
+        ...options?.cwd ? { cwd: options.cwd } : {},
+        ...normalizedIgnore ? { exclude: normalizedIgnore } : {}
+      })
+    );
+    return (0, import_internal.normalizeGlobResults)(out2);
+  }
+  const fastGlob = (0, import_internal.getFastGlob)();
+  const out = await fastGlob.glob(patterns, {
+    ...options,
+    ...normalizedIgnore ? { ignore: normalizedIgnore } : {}
+  });
+  return (0, import_internal.normalizeGlobResults)(out);
+}
+// @__NO_SIDE_EFFECTS__
+function globSync(patterns, options) {
+  const normalizedIgnore = (0, import_internal.normalizeIgnorePatterns)(options?.ignore);
+  if (canUseNodeFsGlob(options)) {
+    return (0, import_internal.normalizeGlobResults)([
+      ...(0, import_internal.getFs)().globSync(patterns, {
+        ...options?.cwd ? { cwd: options.cwd } : {},
+        ...normalizedIgnore ? { exclude: normalizedIgnore } : {}
+      })
+    ]);
+  }
+  const fastGlob = (0, import_internal.getFastGlob)();
+  return (0, import_internal.normalizeGlobResults)(
+    fastGlob.globSync(patterns, {
+      ...options,
+      ...normalizedIgnore ? { ignore: normalizedIgnore } : {}
+    })
+  );
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  canUseNodeFsGlob,
+  glob,
+  globSync
+});

package/dist/globs/matcher.d.ts

@@ -0,0 +1,46 @@
+/**
+ * @file `getGlobMatcher` — picomatch-backed sync predicate with an LRU-memoized
+ *   matcher cache. `getMatchesGlob` exposes Node 22+'s native
+ *   `path.matchesGlob` for the rare case where the caller wants strict
+ *   (`nocase: false`, `dot: false`) matching.
+ */
+import type { Pattern } from './types';
+/**
+ * Return a glob-matcher function, memoized by pattern + options.
+ *
+ * The returned function is a fast synchronous predicate built on picomatch.
+ * Results are memoized — calling `getGlobMatcher(['*.ts'])` a thousand times in
+ * a loop returns the same compiled matcher each time, so callers do not need to
+ * hoist it themselves.
+ *
+ * The cache is LRU with a cap of 100 entries. Cache keys fold together the
+ * (sorted) pattern list and (sorted) option set, so arguments that differ only
+ * in ordering share a matcher.
+ *
+ * Default options: `dot: true`, `nocase: true`. Patterns starting with `!`
+ * become ignore patterns.
+ *
+ * @example
+ *   ;```typescript
+ *   const isMatch = getGlobMatcher('*.ts')
+ *   isMatch('index.ts') // true
+ *   isMatch('index.js') // false
+ *
+ *   const isSource = getGlobMatcher(['src/**', '!**\/*.test.ts'])
+ *   ```
+ */
+export declare function getGlobMatcher(glob: Pattern | Pattern[], options?: {
+    dot?: boolean;
+    nocase?: boolean;
+    ignore?: string[];
+}): (path: string) => boolean;
+/**
+ * Resolve `path.matchesGlob` (or `undefined` if the runtime predates it).
+ * Probes once and caches the result for every subsequent call.
+ *
+ * Used by `getGlobMatcher`'s narrow fast-path — see the conditions spelled out
+ * at the call site. Exported for unit tests.
+ *
+ * @internal
+ */
+export declare function getMatchesGlob(): ((p: string, pattern: string) => boolean) | undefined;

package/dist/globs/matcher.js

@@ -0,0 +1,99 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var matcher_exports = {};
+__export(matcher_exports, {
+  getGlobMatcher: () => getGlobMatcher,
+  getMatchesGlob: () => getMatchesGlob
+});
+module.exports = __toCommonJS(matcher_exports);
+var import_array = require("../primordials/array");
+var import_json = require("../primordials/json");
+var import_object = require("../primordials/object");
+var import_string = require("../primordials/string");
+var import_internal = require("./_internal");
+let _matchesGlob;
+let _matchesGlobProbed = false;
+// @__NO_SIDE_EFFECTS__
+function getGlobMatcher(glob, options) {
+  const patterns = (0, import_array.ArrayIsArray)(glob) ? glob : [glob];
+  const sortedPatterns = [...patterns].sort();
+  const sortedOptions = options ? (0, import_object.ObjectKeys)(options).sort().map((k) => {
+    const value = options[k];
+    const normalized = (0, import_array.ArrayIsArray)(value) ? [...value].sort() : value;
+    return `${k}:${(0, import_json.JSONStringify)(normalized)}`;
+  }).join(",") : "";
+  const key = `${sortedPatterns.join("|")}:${sortedOptions}`;
+  const existing = import_internal.matcherCache.get(key);
+  if (existing) {
+    import_internal.matcherCache.delete(key);
+    import_internal.matcherCache.set(key, existing);
+    return existing;
+  }
+  if (import_internal.matcherCache.size >= import_internal.MATCHER_CACHE_MAX_SIZE) {
+    const oldest = import_internal.matcherCache.keys().next().value;
+    if (oldest !== void 0) {
+      import_internal.matcherCache.delete(oldest);
+    }
+  }
+  let matcher;
+  if (patterns.length === 1 && !(0, import_string.StringPrototypeStartsWith)(patterns[0], "!") && options !== void 0 && options.nocase === false && options.dot === false && (options.ignore === void 0 || options.ignore.length === 0)) {
+    const matchesGlob = /* @__PURE__ */ getMatchesGlob();
+    if (matchesGlob !== void 0) {
+      const pattern = patterns[0];
+      matcher = (p) => matchesGlob(p, pattern);
+    }
+  }
+  if (matcher === void 0) {
+    const positivePatterns = patterns.filter(
+      (p) => !(0, import_string.StringPrototypeStartsWith)(p, "!")
+    );
+    const negativePatterns = patterns.filter((p) => (0, import_string.StringPrototypeStartsWith)(p, "!")).map((p) => p.slice(1));
+    const matchOptions = {
+      dot: true,
+      nocase: true,
+      ...options,
+      ...negativePatterns.length > 0 ? { ignore: negativePatterns } : {}
+    };
+    const picomatch = (0, import_internal.getPicomatch)();
+    matcher = picomatch(
+      positivePatterns.length > 0 ? positivePatterns : patterns,
+      matchOptions
+    );
+  }
+  import_internal.matcherCache.set(key, matcher);
+  return matcher;
+}
+// @__NO_SIDE_EFFECTS__
+function getMatchesGlob() {
+  if (!_matchesGlobProbed) {
+    const fn = require("node:path").matchesGlob;
+    if (typeof fn === "function") {
+      _matchesGlob = fn;
+    }
+    _matchesGlobProbed = true;
+  }
+  return _matchesGlob;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getGlobMatcher,
+  getMatchesGlob
+});

package/dist/globs/stream.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @file `globStreamLicenses` — license-file discovery as an async stream.
+ *   Specialized for the npm-packlist-style license file search (`LICENSE*`,
+ *   `COPYING*`, etc.) with optional originals inclusion.
+ */
+import type { GlobOptions } from './types';
+/**
+ * Create a stream of license file paths matching glob patterns.
+ *
+ * @example
+ *   ;```typescript
+ *   const stream = globStreamLicenses('/tmp/my-package')
+ *   for await (const licensePath of stream) {
+ *     console.log(licensePath)
+ *   }
+ *   ```
+ */
+export declare function globStreamLicenses(dirname: string, options?: GlobOptions): NodeJS.ReadableStream;

package/dist/globs/stream.js

@@ -0,0 +1,58 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var stream_exports = {};
+__export(stream_exports, {
+  globStreamLicenses: () => globStreamLicenses
+});
+module.exports = __toCommonJS(stream_exports);
+var import_globs = require("../paths/globs");
+var import_array = require("../primordials/array");
+var import_internal = require("./_internal");
+// @__NO_SIDE_EFFECTS__
+function globStreamLicenses(dirname, options) {
+  const {
+    ignore: ignoreOpt,
+    ignoreOriginals,
+    recursive,
+    ...globOptions
+  } = { __proto__: null, ...options };
+  const baseIgnore = (0, import_array.ArrayIsArray)(ignoreOpt) ? (0, import_internal.normalizeIgnorePatterns)(ignoreOpt) : import_internal.defaultIgnore;
+  const ignore = [...baseIgnore, "**/*.{cjs,cts,js,json,mjs,mts,ts}"];
+  if (ignoreOriginals) {
+    ignore.push(import_globs.LICENSE_ORIGINAL_GLOB_RECURSIVE);
+  }
+  const fastGlob = (0, import_internal.getFastGlob)();
+  return fastGlob.globStream(
+    [recursive ? import_globs.LICENSE_GLOB_RECURSIVE : import_globs.LICENSE_GLOB],
+    {
+      __proto__: null,
+      absolute: true,
+      caseSensitiveMatch: false,
+      cwd: dirname,
+      ...globOptions,
+      ...ignore ? { ignore } : {}
+    }
+  );
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  globStreamLicenses
+});

package/dist/globs/types.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @file Public type surface for `globs/*` modules — the `Pattern` alias, the
+ *   `FastGlobOptions` mirror of fast-glob's option surface, and the
+ *   `GlobOptions` extension that adds Socket-specific `recursive` /
+ *   `ignoreOriginals` flags. Pure types, no runtime side effects.
+ */
+export type Pattern = string;
+export interface FastGlobOptions {
+    absolute?: boolean;
+    baseNameMatch?: boolean;
+    braceExpansion?: boolean;
+    caseSensitiveMatch?: boolean;
+    concurrency?: number;
+    cwd?: string;
+    deep?: number;
+    dot?: boolean;
+    extglob?: boolean;
+    followSymbolicLinks?: boolean;
+    fs?: unknown;
+    globstar?: boolean;
+    ignore?: string[];
+    ignoreFiles?: string[];
+    markDirectories?: boolean;
+    objectMode?: boolean;
+    onlyDirectories?: boolean;
+    onlyFiles?: boolean;
+    stats?: boolean;
+    suppressErrors?: boolean;
+    throwErrorOnBrokenSymbolicLink?: boolean;
+    unique?: boolean;
+}
+export interface GlobOptions extends FastGlobOptions {
+    ignoreOriginals?: boolean;
+    recursive?: boolean;
+}

package/dist/globs/types.js

@@ -0,0 +1,18 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);

package/dist/http-request/_internal.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @file Private lazy loaders for the Node.js modules used by the
+ *   `http-request/*` leaves. The `_` prefix keeps this module out of the
+ *   generated package.json `exports` map (the `dist/**\/_*` ignore pattern in
+ *   `scripts/fix/generate-package-exports.mts` filters it out), so it is not
+ *   part of the public surface — it exists only as a re-export shim so existing
+ *   siblings keep working unchanged. New code should import the canonical
+ *   helpers directly:
+ *
+ *   - `getNodeCrypto` from `@socketsecurity/lib/node/crypto`
+ *   - `getNodeFs` from `@socketsecurity/lib/node/fs`
+ *   - `getNodeHttp` from `@socketsecurity/lib/node/http`
+ *   - `getNodeHttps` from `@socketsecurity/lib/node/https`
+ */
+export { getNodeCrypto as getCrypto } from '../node/crypto';
+export { getNodeFs as getFs } from '../node/fs';
+export { getNodeHttp as getHttp } from '../node/http';
+export { getNodeHttps as getHttps } from '../node/https';

package/dist/http-request/_internal.js

@@ -0,0 +1,39 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var internal_exports = {};
+__export(internal_exports, {
+  getCrypto: () => import_crypto.getNodeCrypto,
+  getFs: () => import_fs.getNodeFs,
+  getHttp: () => import_http.getNodeHttp,
+  getHttps: () => import_https.getNodeHttps
+});
+module.exports = __toCommonJS(internal_exports);
+var import_crypto = require("../node/crypto");
+var import_fs = require("../node/fs");
+var import_http = require("../node/http");
+var import_https = require("../node/https");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getCrypto,
+  getFs,
+  getHttp,
+  getHttps
+});

package/dist/http-request/checksums.d.ts

@@ -0,0 +1,69 @@
+/**
+ * @file Checksum file fetching + parsing for download verification.
+ *   `parseChecksums` understands the three common file shapes:
+ *
+ *   - BSD style: `SHA256 (filename) = hash`
+ *   - GNU style: `hash filename` (two spaces)
+ *   - Simple: `hash filename` (single space) Comment lines (`#…`) and blank lines
+ *     are skipped. Hashes are lowercased. `fetchChecksums` is the URL helper —
+ *     it fetches a checksums file via `httpRequest` and runs the body through
+ *     `parseChecksums`. The pair lets `httpDownload({ sha256:
+ *     checksums['file.zip'] })` keep the verification logic close to the
+ *     manifest source.
+ */
+import type { Checksums, FetchChecksumsOptions } from './download-types';
+/**
+ * Fetch and parse a checksums file from a URL.
+ *
+ * This is useful for verifying downloads from GitHub releases which typically
+ * publish a checksums.txt file alongside release assets.
+ *
+ * @example
+ *   ;```ts
+ *   // Fetch checksums from GitHub release
+ *   const checksums = await fetchChecksums(
+ *     'https://github.com/org/repo/releases/download/v1.0.0/checksums.txt',
+ *   )
+ *
+ *   // Use with httpDownload
+ *   await httpDownload(
+ *     'https://github.com/org/repo/releases/download/v1.0.0/tool_linux.tar.gz',
+ *     '/tmp/tool.tar.gz',
+ *     { sha256: checksums['tool_linux.tar.gz'] },
+ *   )
+ *   ```
+ *
+ * @param url - URL to the checksums file.
+ * @param options - Request options.
+ *
+ * @returns Map of filenames to lowercase SHA256 hashes
+ *
+ * @throws {Error} When the checksums file cannot be fetched
+ */
+export declare function fetchChecksums(url: string, options?: FetchChecksumsOptions | undefined): Promise<Checksums>;
+/**
+ * Parse a checksums file text into a filename-to-hash map.
+ *
+ * Supports standard checksums file formats: - BSD style: "SHA256 (filename) =
+ * hash" - GNU style: "hash filename" (two spaces) - Simple style: "hash
+ * filename" (single space)
+ *
+ * Lines starting with '#' are treated as comments and ignored. Empty lines are
+ * ignored.
+ *
+ * @example
+ *   ```ts
+ *   const text = `
+ *   # SHA256 checksums
+ *   e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  file.zip
+ *   abc123def456...  other.tar.gz
+ *   `
+ *   const checksums = parseChecksums(text)
+ *   console.log(checksums['file.zip']) // 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
+ *   ```
+ *
+ * @param text - Raw text content of a checksums file.
+ *
+ * @returns Map of filenames to lowercase SHA256 hashes
+ */
+export declare function parseChecksums(text: string): Checksums;