@socketsecurity/lib 5.27.0 → 6.0.0

package/dist/http-request/request.js

@@ -0,0 +1,106 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var request_exports = {};
+__export(request_exports, {
+  httpRequest: () => httpRequest,
+  httpRequestAttempt: () => import_request_attempt2.httpRequestAttempt,
+  readIncomingResponse: () => import_response_reader.readIncomingResponse
+});
+module.exports = __toCommonJS(request_exports);
+var import_promises = require("node:timers/promises");
+var import_error = require("../primordials/error");
+var import_math = require("../primordials/math");
+var import_number = require("../primordials/number");
+var import_request_attempt = require("./request-attempt");
+var import_response_types = require("./response-types");
+var import_request_attempt2 = require("./request-attempt");
+var import_response_reader = require("./response-reader");
+async function httpRequest(url, options) {
+  const {
+    body,
+    ca,
+    followRedirects = true,
+    headers = {},
+    hooks,
+    maxRedirects = 5,
+    maxResponseSize,
+    method = "GET",
+    onRetry,
+    retries = 0,
+    retryDelay = 1e3,
+    stream = false,
+    throwOnError = false,
+    timeout = 3e4
+  } = { __proto__: null, ...options };
+  const isStreamBody = body !== void 0 && typeof body === "object" && typeof body.pipe === "function";
+  if (isStreamBody && retries > 0) {
+    throw new import_error.ErrorCtor(
+      "Streaming body (Readable/FormData) cannot be used with retries. Streams are consumed on first attempt and cannot be replayed. Set retries: 0 or buffer the body as a string/Buffer."
+    );
+  }
+  const attemptOpts = {
+    body,
+    ca,
+    // Disable redirect following for stream bodies — the stream is consumed
+    // on the first request and cannot be re-piped to the redirect target.
+    followRedirects: isStreamBody ? false : followRedirects,
+    headers,
+    hooks,
+    maxRedirects,
+    maxResponseSize,
+    method,
+    stream,
+    timeout
+  };
+  let lastError;
+  for (let attempt = 0; attempt <= retries; attempt++) {
+    try {
+      const response = await (0, import_request_attempt.httpRequestAttempt)(url, attemptOpts);
+      if (throwOnError && !response.ok) {
+        throw new import_response_types.HttpResponseError(response);
+      }
+      return response;
+    } catch (e) {
+      lastError = e;
+      if (attempt === retries) {
+        break;
+      }
+      const delayMs = retryDelay * 2 ** attempt;
+      if (onRetry) {
+        const retryResult = onRetry(attempt + 1, e, delayMs);
+        if (retryResult === false) {
+          break;
+        }
+        const actualDelay = typeof retryResult === "number" && !(0, import_number.NumberIsNaN)(retryResult) ? (0, import_math.MathMax)(0, retryResult) : delayMs;
+        await (0, import_promises.setTimeout)(actualDelay);
+      } else {
+        await (0, import_promises.setTimeout)(delayMs);
+      }
+    }
+  }
+  throw lastError || new import_error.ErrorCtor("Request failed after retries");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  httpRequest,
+  httpRequestAttempt,
+  readIncomingResponse
+});

package/dist/http-request/response-reader.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @file Read a raw Node `IncomingMessage` into our `HttpResponse` shape. Split
+ *   out of `http-request/request.ts` for size hygiene. Useful when a caller
+ *   already has an `IncomingMessage` from code that bypasses `httpRequest()`
+ *   (e.g., multipart uploads via `http.request()` directly, or third-party HTTP
+ *   libraries) and wants the same fetch-like body accessors.
+ */
+import type { IncomingResponse } from './request-types';
+import type { HttpResponse } from './response-types';
+/**
+ * Read and buffer a client-side IncomingResponse into an HttpResponse.
+ *
+ * Useful when you have a raw response from code that bypasses `httpRequest()`
+ * (e.g., multipart form-data uploads via `http.request()`, or responses from
+ * third-party HTTP libraries) and need to convert it into the standard
+ * HttpResponse interface.
+ *
+ * @example
+ *   ;```typescript
+ *   const raw = await makeRawRequest('https://example.com/api')
+ *   const response = await readIncomingResponse(raw)
+ *   console.log(response.status, response.body.toString('utf8'))
+ *   ```
+ */
+export declare function readIncomingResponse(msg: IncomingResponse): Promise<HttpResponse>;

package/dist/http-request/response-reader.js

@@ -0,0 +1,54 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var response_reader_exports = {};
+__export(response_reader_exports, {
+  readIncomingResponse: () => readIncomingResponse
+});
+module.exports = __toCommonJS(response_reader_exports);
+var import_buffer = require("../primordials/buffer");
+var import_json = require("../primordials/json");
+async function readIncomingResponse(msg) {
+  const chunks = [];
+  for await (const chunk of msg) {
+    chunks.push(chunk);
+  }
+  const body = (0, import_buffer.BufferConcat)(chunks);
+  const status = msg.statusCode ?? 0;
+  const statusText = msg.statusMessage ?? "";
+  return {
+    arrayBuffer: () => body.buffer.slice(
+      body.byteOffset,
+      body.byteOffset + body.byteLength
+    ),
+    body,
+    headers: msg.headers,
+    json: () => (0, import_json.JSONParse)(body.toString("utf8")),
+    ok: status >= 200 && status < 300,
+    rawResponse: msg,
+    status,
+    statusText,
+    text: () => body.toString("utf8")
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  readIncomingResponse
+});

package/dist/http-request/response-types.d.ts

@@ -0,0 +1,123 @@
+/**
+ * @file Types for HTTP response surface — `HttpResponse` with its fetch-like
+ *   body accessors, and `HttpResponseError` for `throwOnError`. Split out of
+ *   `http-request/types.ts` for size hygiene.
+ */
+import type { IncomingHttpHeaders } from 'node:http';
+import type { IncomingResponse } from './request-types';
+/**
+ * HTTP response object with fetch-like interface. Provides multiple ways to
+ * access the response body.
+ */
+export interface HttpResponse {
+    /**
+     * Get response body as ArrayBuffer. Useful for binary data or when you need
+     * compatibility with browser APIs.
+     *
+     * @example
+     *   ;```ts
+     *   const response = await httpRequest('https://example.com/image.png')
+     *   const arrayBuffer = response.arrayBuffer()
+     *   console.log(arrayBuffer.byteLength)
+     *   ```
+     *
+     * @returns The response body as an ArrayBuffer
+     */
+    arrayBuffer(): ArrayBuffer;
+    /**
+     * Raw response body as Buffer. Direct access to the underlying Node.js
+     * Buffer.
+     *
+     * @example
+     *   ;```ts
+     *   const response = await httpRequest('https://example.com/data')
+     *   console.log(response.body.length) // Size in bytes
+     *   console.log(response.body.toString('hex')) // View as hex
+     *   ```
+     */
+    body: Buffer;
+    /**
+     * HTTP response headers. Keys are lowercase header names, values can be
+     * strings or string arrays.
+     *
+     * @example
+     *   ;```ts
+     *   const response = await httpRequest('https://example.com')
+     *   console.log(response.headers['content-type'])
+     *   console.log(response.headers['set-cookie']) // May be string[]
+     *   ```
+     */
+    headers: IncomingHttpHeaders;
+    /**
+     * Parse response body as JSON. Type parameter `T` allows specifying the
+     * expected JSON structure.
+     *
+     * @example
+     *   ;```ts
+     *   interface User {
+     *     name: string
+     *     id: number
+     *   }
+     *   const response = await httpRequest('https://api.example.com/user')
+     *   const user = response.json<User>()
+     *   console.log(user.name, user.id)
+     *   ```
+     *
+     * @template T - Expected JSON type (defaults to `unknown`)
+     *
+     * @returns Parsed JSON data
+     *
+     * @throws {SyntaxError} When response body is not valid JSON
+     */
+    json<T = unknown>(): T;
+    /**
+     * Whether the request was successful (status code 200-299).
+     *
+     * @example
+     *   ;```ts
+     *   const response = await httpRequest('https://example.com/data')
+     *   if (response.ok) {
+     *     console.log('Success:', response.json())
+     *   } else {
+     *     console.error('Failed:', response.status, response.statusText)
+     *   }
+     *   ```
+     */
+    ok: boolean;
+    /**
+     * HTTP status code (e.g., 200, 404, 500).
+     */
+    status: number;
+    /**
+     * HTTP status message (e.g., "OK", "Not Found", "Internal Server Error").
+     */
+    statusText: string;
+    /**
+     * Get response body as UTF-8 text string.
+     *
+     * @example
+     *   ;```ts
+     *   const response = await httpRequest('https://example.com')
+     *   const html = response.text()
+     *   console.log(html.includes('<html>'))
+     *   ```
+     *
+     * @returns The response body as a string
+     */
+    text(): string;
+    /**
+     * The underlying Node.js IncomingResponse for advanced use cases (e.g.,
+     * streaming, custom header inspection). Only available when the response was
+     * not consumed by the convenience methods.
+     */
+    rawResponse?: IncomingResponse | undefined;
+}
+/**
+ * Error thrown when an HTTP response has a non-2xx status code and
+ * `throwOnError` is enabled. Carries the full `HttpResponse` so callers can
+ * inspect status, headers, and body.
+ */
+export declare class HttpResponseError extends Error {
+    response: HttpResponse;
+    constructor(response: HttpResponse, message?: string | undefined);
+}

package/dist/http-request/response-types.js

@@ -0,0 +1,40 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var response_types_exports = {};
+__export(response_types_exports, {
+  HttpResponseError: () => HttpResponseError
+});
+module.exports = __toCommonJS(response_types_exports);
+class HttpResponseError extends Error {
+  response;
+  constructor(response, message) {
+    const statusCode = response.status ?? "unknown";
+    const statusMessage = response.statusText || "No status message";
+    super(message ?? `HTTP ${statusCode}: ${statusMessage}`);
+    this.name = "HttpResponseError";
+    this.response = response;
+    Error.captureStackTrace(this, HttpResponseError);
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  HttpResponseError
+});

package/dist/http-request/user-agent.d.ts

@@ -0,0 +1,55 @@
+/**
+ * @file User-Agent header generation for socket-lib's outbound HTTP requests.
+ *   Three-token format aligned with socket-cli's `getCliUserAgent` and
+ *   coana-tech-cli's `configureAxiosUserAgent`: `<slug>/<version>
+ *   node/<node-version> <platform>/<arch>` e.g. `socketsecurity-lib/6.0.0
+ *   node/v22.10.0 darwin/arm64` Downstream callers (sdxgen SEA binary, fleet
+ *   CLIs, etc.) can identify themselves via the `SOCKET_CALLER_USER_AGENT` env
+ *   var, which is appended to the lib's own UA so the server still sees the lib
+ *   identifier. @example import { getSocketCallerUserAgent } from
+ *   '@socketsecurity/lib/http-request/user-agent'
+ *   request.setHeader('User-Agent', getSocketCallerUserAgent())
+ */
+/**
+ * Compose a three-token User-Agent string from a `{ name, version }` pair,
+ * optionally appending a caller-supplied identifier.
+ *
+ * Used directly by socket-lib's own outbound requests (via
+ * `getSocketCallerUserAgent`) and exported for sibling packages (socket-cli,
+ * socket-sdk-js) so the fleet emits one canonical UA shape.
+ *
+ * @example
+ *   ;```typescript
+ *   buildUserAgent({ name: '@socketsecurity/lib', version: '6.0.0' })
+ *   // 'socketsecurity-lib/6.0.0 node/v22.10.0 darwin/arm64'
+ *
+ *   buildUserAgent({ name: 'sdxgen', version: '0.5.0' }, 'embedded-by-foo/1')
+ *   // 'sdxgen/0.5.0 node/v22.10.0 darwin/arm64 embedded-by-foo/1'
+ *   ```
+ */
+export declare function buildUserAgent(pkg: {
+    name: string;
+    version: string;
+}, caller?: string | undefined): string;
+/**
+ * User-Agent header for socket-lib's own outbound HTTP requests.
+ *
+ * Composes the lib's base UA (lazily cached — name, lib version, node version,
+ * platform, and arch are stable for the process lifetime) with the
+ * caller-supplied identifier from `SOCKET_CALLER_USER_AGENT` (re-read every
+ * call so child-process / test-stub changes propagate).
+ *
+ * Empty or whitespace-only env values are treated as unset.
+ *
+ * @example
+ *   ;```typescript
+ *   // No env override:
+ *   getSocketCallerUserAgent()
+ *   // 'socketsecurity-lib/6.0.0 node/v22.10.0 darwin/arm64'
+ *
+ *   // With SOCKET_CALLER_USER_AGENT='sdxgen/0.5.0':
+ *   getSocketCallerUserAgent()
+ *   // 'socketsecurity-lib/6.0.0 node/v22.10.0 darwin/arm64 sdxgen/0.5.0'
+ *   ```
+ */
+export declare function getSocketCallerUserAgent(): string;

package/dist/http-request/user-agent.js

@@ -0,0 +1,61 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var user_agent_exports = {};
+__export(user_agent_exports, {
+  buildUserAgent: () => buildUserAgent,
+  getSocketCallerUserAgent: () => getSocketCallerUserAgent
+});
+module.exports = __toCommonJS(user_agent_exports);
+var import_node_process = __toESM(require("node:process"));
+var import_socket = require("../constants/socket");
+var import_rewire = require("../env/rewire");
+var import_operations = require("../packages/operations");
+// @__NO_SIDE_EFFECTS__
+function buildUserAgent(pkg, caller) {
+  const base = `${(0, import_operations.pkgNameToSlug)(pkg.name)}/${pkg.version} node/${import_node_process.default.version} ${import_node_process.default.platform}/${import_node_process.default.arch}`;
+  return caller ? `${base} ${caller}` : base;
+}
+let cachedBaseUserAgent;
+function getSocketCallerUserAgent() {
+  if (cachedBaseUserAgent === void 0) {
+    cachedBaseUserAgent = /* @__PURE__ */ buildUserAgent({
+      name: import_socket.SOCKET_LIB_NAME,
+      version: import_socket.SOCKET_LIB_VERSION
+    });
+  }
+  const caller = (0, import_rewire.getEnvValue)("SOCKET_CALLER_USER_AGENT");
+  return caller && caller.trim() ? `${cachedBaseUserAgent} ${caller}` : cachedBaseUserAgent;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  buildUserAgent,
+  getSocketCallerUserAgent
+});

package/dist/{dlx/integrity.d.ts → integrity.d.ts}

@@ -1,30 +1,30 @@
 /**
- * @fileoverview Integrity specification helpers for dlx downloads.
+ * @file Integrity specification helpers for downloads and file verification.
+ *   Used by `dlx/binary-download` and external-tools resolvers; safe to consume
+ *   from any module that needs to verify bytes against an expected hash. Single
+ *   supported format per flavor:
  *
- * Single supported format per flavor:
  *   - integrity: SRI with sha512 only (what npm registry returns)
- *   - checksum:  sha256 hex (what `shasum -a 256` produces; common for
- *                binary release assets on GitHub)
- *
- * Callers may pass a {@link HashSpec} as a bare string (sniffed via
- * format) or as an explicit `{ type, value }` object. The normalized
- * form carried around internally is always the object.
+ *   - checksum: sha256 hex (what `shasum -a 256` produces; common for binary
+ *     release assets on GitHub) Callers may pass a {@link HashSpec} as a bare
+ *     string (sniffed via format) or as an explicit `{ type, value }` object.
+ *     The normalized form carried around internally is always the object.
  */
 /**
  * Tagged union representing an expected hash.
  *
  * @example
- * // Bare SRI (sniffed as integrity):
- * 'sha512-abc...'
+ *   // Bare SRI (sniffed as integrity):
+ *   'sha512-abc...'
  *
  * @example
- * // Bare sha256 hex (sniffed as checksum):
- * 'a1b2c3...'
+ *   // Bare sha256 hex (sniffed as checksum):
+ *   'a1b2c3...'
  *
  * @example
- * // Explicit:
- * { type: 'integrity', value: 'sha512-abc...' }
- * { type: 'checksum', value: 'a1b2c3...' }
+ *   // Explicit:
+ *   { type: 'integrity', value: 'sha512-abc...' }
+ *   { type: 'checksum', value: 'a1b2c3...' }
  */
 export type HashSpec = string | {
     type: 'integrity';
@@ -41,15 +41,26 @@ export interface NormalizedHash {
     value: string;
 }
 /**
- * Both hash formats for the same bytes. Returned from downloads so callers
- * can record whichever format their config uses.
+ * Both hash formats for the same bytes. Returned from downloads so callers can
+ * record whichever format their config uses.
  */
 export interface ComputedHashes {
-    /** SRI integrity: `sha512-<base64>`. Matches what the npm registry returns. */
+    /**
+     * SRI integrity: `sha512-<base64>`. Matches what the npm registry returns.
+     */
     integrity: string;
-    /** SHA-256 hex (64 chars). Matches `shasum -a 256`. */
+    /**
+     * SHA-256 hex (64 chars). Matches `shasum -a 256`.
+     */
     checksum: string;
 }
+/**
+ * Compute both integrity (sha512 SRI) and checksum (sha256 hex) for a buffer of
+ * bytes.
+ */
+export declare function computeHashes(bytes: Buffer): ComputedHashes;
+export declare function isChecksumString(s: string): boolean;
+export declare function isIntegrityString(s: string): boolean;
 /**
  * Normalize a {@link HashSpec} to its canonical `{ type, value }` form.
  *
@@ -58,21 +69,16 @@ export interface ComputedHashes {
  * - Bare string of 64 hex chars → checksum.
  * - Anything else throws TypeError.
  *
- * @throws TypeError if the string is not a recognized format, or if an
- *   explicit object's value doesn't match its declared type.
+ * @throws TypeError if the string is not a recognized format, or if an explicit
+ *   object's value doesn't match its declared type.
  */
 export declare function normalizeHash(spec: HashSpec): NormalizedHash;
 /**
- * Compute both integrity (sha512 SRI) and checksum (sha256 hex) for a
- * buffer of bytes.
- */
-export declare function computeHashes(bytes: Buffer): ComputedHashes;
-/**
- * Verify computed hashes against an expected {@link NormalizedHash}.
- * Uses `crypto.timingSafeEqual` for constant-time comparison.
+ * Verify computed hashes against an expected {@link NormalizedHash}. Uses
+ * `crypto.timingSafeEqual` for constant-time comparison.
  *
- * @throws DlxHashMismatchError when the hash of the matching type
- *   doesn't match the expected value.
+ * @throws DlxHashMismatchError when the hash of the matching type doesn't match
+ *   the expected value.
  */
 export declare function verifyHash(expected: NormalizedHash, computed: ComputedHashes): void;
 /**

package/dist/{dlx/integrity.js → integrity.js}

@@ -22,31 +22,40 @@ var integrity_exports = {};
 __export(integrity_exports, {
   DlxHashMismatchError: () => DlxHashMismatchError,
   computeHashes: () => computeHashes,
+  isChecksumString: () => isChecksumString,
+  isIntegrityString: () => isIntegrityString,
   normalizeHash: () => normalizeHash,
   verifyHash: () => verifyHash
 });
 module.exports = __toCommonJS(integrity_exports);
 var import_node_crypto = require("node:crypto");
-var import_crypto = require("../crypto");
-var import_primordials = require("../primordials");
+var import_hash = require("./crypto/hash");
+var import_buffer = require("./primordials/buffer");
+var import_error = require("./primordials/error");
+var import_string = require("./primordials/string");
 const INTEGRITY_PREFIX = "sha512-";
 const INTEGRITY_BODY_RE = /^[A-Za-z0-9+/=]+$/;
 const CHECKSUM_RE = /^[a-f0-9]{64}$/i;
+function computeHashes(bytes) {
+  const integrity = `sha512-${(0, import_hash.hash)("sha512", bytes, "base64")}`;
+  const checksum = (0, import_hash.hash)("sha256", bytes, "hex");
+  return { integrity, checksum };
+}
+function isChecksumString(s) {
+  return CHECKSUM_RE.test(s);
+}
 function isIntegrityString(s) {
-  if (!(0, import_primordials.StringPrototypeStartsWith)(s, INTEGRITY_PREFIX)) {
+  if (!(0, import_string.StringPrototypeStartsWith)(s, INTEGRITY_PREFIX)) {
     return false;
   }
-  const body = (0, import_primordials.StringPrototypeSlice)(s, INTEGRITY_PREFIX.length);
+  const body = (0, import_string.StringPrototypeSlice)(s, INTEGRITY_PREFIX.length);
   return body.length > 0 && INTEGRITY_BODY_RE.test(body);
 }
-function isChecksumString(s) {
-  return CHECKSUM_RE.test(s);
-}
 function normalizeHash(spec) {
   if (typeof spec === "object" && spec !== null) {
     if (spec.type === "integrity") {
       if (!isIntegrityString(spec.value)) {
-        throw new import_primordials.TypeErrorCtor(
+        throw new import_error.TypeErrorCtor(
           `Expected SRI integrity string "sha512-<base64>", got: ${spec.value}`
         );
       }
@@ -54,18 +63,18 @@ function normalizeHash(spec) {
     }
     if (spec.type === "checksum") {
       if (!isChecksumString(spec.value)) {
-        throw new import_primordials.TypeErrorCtor(
+        throw new import_error.TypeErrorCtor(
           `Expected sha256 hex string (64 hex chars), got: ${spec.value}`
         );
       }
       return { type: "checksum", value: spec.value };
     }
-    throw new import_primordials.TypeErrorCtor(
+    throw new import_error.TypeErrorCtor(
       `Unknown hash type: ${spec.type}`
     );
   }
   if (typeof spec !== "string") {
-    throw new import_primordials.TypeErrorCtor(
+    throw new import_error.TypeErrorCtor(
       `HashSpec must be a string or { type, value } object, got: ${typeof spec}`
     );
   }
@@ -75,19 +84,14 @@ function normalizeHash(spec) {
   if (isChecksumString(spec)) {
     return { type: "checksum", value: spec };
   }
-  throw new import_primordials.TypeErrorCtor(
+  throw new import_error.TypeErrorCtor(
     `Unrecognized hash format. Expected SRI integrity ("sha512-<base64>") or sha256 hex (64 hex chars), got: ${spec}`
   );
 }
-function computeHashes(bytes) {
-  const integrity = `sha512-${(0, import_crypto.hash)("sha512", bytes, "base64")}`;
-  const checksum = (0, import_crypto.hash)("sha256", bytes, "hex");
-  return { integrity, checksum };
-}
 function verifyHash(expected, computed) {
   const actual = expected.type === "integrity" ? computed.integrity : computed.checksum;
-  const expectedBuf = (0, import_primordials.BufferFrom)(expected.value);
-  const actualBuf = (0, import_primordials.BufferFrom)(actual);
+  const expectedBuf = (0, import_buffer.BufferFrom)(expected.value);
+  const actualBuf = (0, import_buffer.BufferFrom)(actual);
   if (expectedBuf.length !== actualBuf.length || !(0, import_node_crypto.timingSafeEqual)(expectedBuf, actualBuf)) {
     throw new DlxHashMismatchError(expected, computed);
   }
@@ -109,6 +113,8 @@ class DlxHashMismatchError extends Error {
 0 && (module.exports = {
   DlxHashMismatchError,
   computeHashes,
+  isChecksumString,
+  isIntegrityString,
   normalizeHash,
   verifyHash
 });