@socketsecurity/lib 6.0.0 → 6.0.2

package/dist/logger/symbols-builder.d.ts

@@ -1,6 +1,6 @@
 /**
  * @file Free-function helpers for per-instance log-symbol construction + symbol
- *   stripping. Extracted from `logger/logger.ts` (the `Logger` class) so the
+ *   stripping. Extracted from `logger/node.ts` (the `Logger` class) so the
  *   class stays under the 1000-line hard cap and so other callers (alt loggers,
  *   format helpers) can reuse the same logic without instantiating a `Logger`.
  *

package/dist/logger/types.d.ts

@@ -4,7 +4,7 @@
  *   interface returned by `Logger.createTask`. Pure types; no runtime side
  *   effects so this module stays cheap to import everywhere.
  */
-import type { Logger } from './logger';
+import type { Logger } from './node';
 /**
  * Log symbols for terminal output with colored indicators.
  *

package/dist/packages/isolation.js

@@ -40,7 +40,7 @@ var import_platform = require("../constants/platform");
 var import_message = require("../errors/message");
 var import_normalize = require("../paths/normalize");
 var import_socket = require("../paths/socket");
-var import_spawn = require("../spawn/spawn");
+var import_child = require("../process/spawn/child");
 var import_operations = require("./operations");
 var import_error = require("../primordials/error");
 var import_json = require("../primordials/json");
@@ -123,7 +123,7 @@ async function isolatePackage(packageSpec, options) {
       await install(packageTempDir);
     } else {
       const packageInstallSpec = (0, import_string.StringPrototypeStartsWith)(spec, "https://") ? spec : `${packageName}@${spec}`;
-      await (0, import_spawn.spawn)("pnpm", ["add", packageInstallSpec], {
+      await (0, import_child.spawn)("pnpm", ["add", packageInstallSpec], {
         cwd: packageTempDir,
         shell: import_platform.WIN32,
         stdio: "pipe"
@@ -170,7 +170,7 @@ async function isolatePackage(packageSpec, options) {
   if (install) {
     await install(installedPath);
   } else {
-    await (0, import_spawn.spawn)("pnpm", ["install"], {
+    await (0, import_child.spawn)("pnpm", ["install"], {
       cwd: installedPath,
       shell: import_platform.WIN32,
       stdio: "pipe"

package/dist/packages/provenance.d.ts

@@ -2,6 +2,18 @@
  * @file Package provenance and attestation verification utilities.
  */
 import type { ProvenanceOptions } from './types';
+/**
+ * Comparator ordering two trust statuses by ascending trust level. Sorts an
+ * array of statuses lowest-trust-first; negate for highest-first.
+ */
+export declare function compareTrust(a: TrustStatus, b: TrustStatus): -1 | 0 | 1;
+/**
+ * Whether `next` sits at a lower trust level than `prev` — i.e. a release
+ * regressed its supply-chain posture. Drives the post-publish provenance
+ * reminder: a version that drops from trustedPublisher back to bare provenance
+ * is a red flag worth surfacing.
+ */
+export declare function didTrustDecrease(prev: TrustStatus, next: TrustStatus): boolean;
 /**
  * Fetch package provenance information from npm registry.
  *
@@ -30,7 +42,37 @@ export declare function getFetcher(): import("../external/make-fetch-happen").Ma
  *   ```
  */
 export declare function getProvenanceDetails(attestationData: unknown): unknown;
+/**
+ * Map a trust status to its 0..3 ladder level.
+ */
+export declare function getTrustLevel(status: TrustStatus): TrustLevel;
+/**
+ * Map a trust status to its human-readable level name.
+ */
+export declare function getTrustLevelName(status: TrustStatus): TrustLevelName;
+/**
+ * Extract provenance / trusted-publisher / staged-publish flags from a registry
+ * version document.
+ */
+export declare function getTrustStatus(meta: unknown): TrustStatus;
 /**
  * Check if a value indicates a trusted publisher (GitHub or GitLab).
  */
 export declare function isTrustedPublisher(value: unknown): boolean;
+/**
+ * Trust signals derived from a registry version document.
+ */
+export interface TrustStatus {
+    provenance: boolean;
+    trustedPublisher: boolean;
+    stagedPublish: boolean;
+}
+/**
+ * Trust ladder, low → high. The index IS the level (0..3), so a single array
+ * maps both directions: `TRUST_LEVELS[level]` → name, and
+ * `TRUST_LEVELS.indexOf(name)` → level. One source of truth, no parallel Record
+ * to keep in sync.
+ */
+export declare const TRUST_LEVELS: readonly ['none', 'provenance', 'trustedPublisher', 'stagedPublish'];
+export type TrustLevel = 0 | 1 | 2 | 3;
+export type TrustLevelName = (typeof TRUST_LEVELS)[number];

package/dist/packages/provenance.js

@@ -30,11 +30,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var provenance_exports = {};
 __export(provenance_exports, {
+  TRUST_LEVELS: () => TRUST_LEVELS,
+  compareTrust: () => compareTrust,
+  didTrustDecrease: () => didTrustDecrease,
   fetchPackageProvenance: () => fetchPackageProvenance,
   findProvenance: () => findProvenance,
   getAttestations: () => getAttestations,
   getFetcher: () => getFetcher,
   getProvenanceDetails: () => getProvenanceDetails,
+  getTrustLevel: () => getTrustLevel,
+  getTrustLevelName: () => getTrustLevelName,
+  getTrustStatus: () => getTrustStatus,
   isTrustedPublisher: () => isTrustedPublisher
 });
 module.exports = __toCommonJS(provenance_exports);
@@ -43,13 +49,29 @@ var import_packages = require("../constants/packages");
 var import_make_fetch_happen = __toESM(require("../external/make-fetch-happen"));
 var import_signal = require("../abort/signal");
 var import_parse = require("../url/parse");
+var import_predicates = require("../objects/predicates");
 var import_array = require("../primordials/array");
 var import_buffer = require("../primordials/buffer");
 var import_json = require("../primordials/json");
+var import_object = require("../primordials/object");
 var import_string = require("../primordials/string");
 const SLSA_PROVENANCE_V0_2 = "https://slsa.dev/provenance/v0.2";
 const SLSA_PROVENANCE_V1_0 = "https://slsa.dev/provenance/v1";
 let _fetcher;
+function compareTrust(a, b) {
+  const levelA = getTrustLevel(a);
+  const levelB = getTrustLevel(b);
+  if (levelA < levelB) {
+    return -1;
+  }
+  if (levelA > levelB) {
+    return 1;
+  }
+  return 0;
+}
+function didTrustDecrease(prev, next) {
+  return getTrustLevel(next) < getTrustLevel(prev);
+}
 // @__NO_SIDE_EFFECTS__
 async function fetchPackageProvenance(pkgName, pkgVersion, options) {
   const { signal, timeout = 1e4 } = {
@@ -165,6 +187,43 @@ function getProvenanceDetails(attestationData) {
     workflowRunId
   };
 }
+function getTrustLevel(status) {
+  if (status.stagedPublish) {
+    return 3;
+  }
+  if (status.trustedPublisher && status.provenance) {
+    return 2;
+  }
+  if (status.provenance) {
+    return 1;
+  }
+  return 0;
+}
+function getTrustLevelName(status) {
+  return TRUST_LEVELS[getTrustLevel(status)];
+}
+function getTrustStatus(meta) {
+  const status = {
+    provenance: false,
+    trustedPublisher: false,
+    // Reserved: the npm registry does not yet expose a staged-publish flag, so
+    // this stays false until a registry signal exists to set it.
+    stagedPublish: false
+  };
+  if (!(0, import_predicates.isObject)(meta)) {
+    return status;
+  }
+  const npmUser = (0, import_object.ObjectHasOwn)(meta, "_npmUser") ? meta["_npmUser"] : void 0;
+  if ((0, import_predicates.isObject)(npmUser) && (0, import_object.ObjectHasOwn)(npmUser, "trustedPublisher") && npmUser["trustedPublisher"]) {
+    status.trustedPublisher = true;
+  }
+  const dist = (0, import_object.ObjectHasOwn)(meta, "dist") ? meta["dist"] : void 0;
+  const attestations = (0, import_predicates.isObject)(dist) && (0, import_object.ObjectHasOwn)(dist, "attestations") ? dist["attestations"] : void 0;
+  if ((0, import_predicates.isObject)(attestations) && (0, import_object.ObjectHasOwn)(attestations, "provenance") && attestations["provenance"]) {
+    status.provenance = true;
+  }
+  return status;
+}
 function isTrustedPublisher(value) {
   if (typeof value !== "string" || !value) {
     return false;
@@ -191,12 +250,24 @@ function isTrustedPublisher(value) {
   }
   return (0, import_string.StringPrototypeIncludes)(value, "github") || (0, import_string.StringPrototypeIncludes)(value, "gitlab");
 }
+const TRUST_LEVELS = [
+  "none",
+  "provenance",
+  "trustedPublisher",
+  "stagedPublish"
+];
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  TRUST_LEVELS,
+  compareTrust,
+  didTrustDecrease,
   fetchPackageProvenance,
   findProvenance,
   getAttestations,
   getFetcher,
   getProvenanceDetails,
+  getTrustLevel,
+  getTrustLevelName,
+  getTrustStatus,
   isTrustedPublisher
 });

package/dist/packages/types.d.ts

@@ -73,6 +73,8 @@ export type PackageJson = {
     private?: boolean | undefined;
     publishConfig?: Record<string, unknown> | undefined;
     files?: string[] | undefined;
+    keywords?: string[] | undefined;
+    sideEffects?: boolean | string[] | undefined;
     engines?: Record<string, string> | undefined;
     os?: string[] | undefined;
     cpu?: string[] | undefined;

package/dist/primordials/globals.d.ts

@@ -12,6 +12,9 @@ export declare const ProxyCtor: ProxyConstructor;
 export declare const SharedArrayBufferCtor: SharedArrayBufferConstructor;
 export declare const InfinityValue: number;
 export declare const NaNValue: number;
-export declare const globalThisRef: typeof globalThis;
-export declare const decodeComponent: typeof decodeURIComponent;
-export declare const encodeComponent: typeof encodeURIComponent;
+declare const capturedGlobalThis: typeof globalThis;
+export { capturedGlobalThis as globalThis };
+export declare const atob: typeof globalThis.atob;
+export declare const btoa: typeof globalThis.btoa;
+export declare const decodeURIComponent: typeof globalThis.decodeURIComponent;
+export declare const encodeURIComponent: typeof globalThis.encodeURIComponent;

package/dist/primordials/globals.js

@@ -26,9 +26,11 @@ __export(globals_exports, {
   NaNValue: () => NaNValue,
   ProxyCtor: () => ProxyCtor,
   SharedArrayBufferCtor: () => SharedArrayBufferCtor,
-  decodeComponent: () => decodeComponent,
-  encodeComponent: () => encodeComponent,
-  globalThisRef: () => globalThisRef
+  atob: () => atob,
+  btoa: () => btoa,
+  decodeURIComponent: () => decodeURIComponent,
+  encodeURIComponent: () => encodeURIComponent,
+  globalThis: () => capturedGlobalThis
 });
 module.exports = __toCommonJS(globals_exports);
 const BigIntCtor = BigInt;
@@ -37,9 +39,11 @@ const ProxyCtor = Proxy;
 const SharedArrayBufferCtor = SharedArrayBuffer;
 const InfinityValue = Infinity;
 const NaNValue = NaN;
-const globalThisRef = globalThis;
-const decodeComponent = globalThis.decodeURIComponent;
-const encodeComponent = globalThis.encodeURIComponent;
+const capturedGlobalThis = globalThis;
+const atob = globalThis.atob;
+const btoa = globalThis.btoa;
+const decodeURIComponent = globalThis.decodeURIComponent;
+const encodeURIComponent = globalThis.encodeURIComponent;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   BigIntCtor,
@@ -48,7 +52,9 @@ const encodeComponent = globalThis.encodeURIComponent;
   NaNValue,
   ProxyCtor,
   SharedArrayBufferCtor,
-  decodeComponent,
-  encodeComponent,
-  globalThisRef
+  atob,
+  btoa,
+  decodeURIComponent,
+  encodeURIComponent,
+  globalThis
 });

package/dist/primordials/map-set.d.ts

@@ -4,6 +4,30 @@
  *   constructor — there's a separate `weakRefSafe` wrapper in `./uncurry` for
  *   the throws-on-non-Object case.
  */
+declare global {
+    interface Map<K, V> {
+        getOrInsert(key: K, value: V): V;
+        getOrInsertComputed(key: K, callbackfn: (key: K) => V): V;
+    }
+    interface WeakMap<K extends WeakKey, V> {
+        getOrInsert(key: K, value: V): V;
+        getOrInsertComputed(key: K, callbackfn: (key: K) => V): V;
+    }
+    interface ReadonlySetLike<T> {
+        has(value: T): boolean;
+        keys(): IterableIterator<T>;
+        readonly size: number;
+    }
+    interface Set<T> {
+        difference<U>(other: ReadonlySetLike<U>): Set<T>;
+        intersection<U>(other: ReadonlySetLike<U>): Set<T & U>;
+        isDisjointFrom(other: ReadonlySetLike<unknown>): boolean;
+        isSubsetOf(other: ReadonlySetLike<unknown>): boolean;
+        isSupersetOf(other: ReadonlySetLike<unknown>): boolean;
+        symmetricDifference<U>(other: ReadonlySetLike<U>): Set<T | U>;
+        union<U>(other: ReadonlySetLike<U>): Set<T | U>;
+    }
+}
 export declare const MapCtor: MapConstructor;
 export declare const SetCtor: SetConstructor;
 export declare const WeakMapCtor: WeakMapConstructor;
@@ -14,6 +38,8 @@ export declare const MapPrototypeDelete: (self: unknown, key: any) => boolean;
 export declare const MapPrototypeEntries: (self: unknown) => MapIterator<[any, any]>;
 export declare const MapPrototypeForEach: (self: unknown, callbackfn: (value: any, key: any, map: Map<any, any>) => void, thisArg?: any) => void;
 export declare const MapPrototypeGet: (self: unknown, key: any) => any;
+export declare const MapPrototypeGetOrInsert: (self: unknown, key: any, value: any) => any;
+export declare const MapPrototypeGetOrInsertComputed: (self: unknown, key: any, callbackfn: (key: any) => any) => any;
 export declare const MapPrototypeHas: (self: unknown, key: any) => boolean;
 export declare const MapPrototypeKeys: (self: unknown) => MapIterator<any>;
 export declare const MapPrototypeSet: (self: unknown, key: any, value: any) => Map<any, any>;
@@ -21,13 +47,22 @@ export declare const MapPrototypeValues: (self: unknown) => MapIterator<any>;
 export declare const SetPrototypeAdd: (self: unknown, value: any) => Set<any>;
 export declare const SetPrototypeClear: (self: unknown) => void;
 export declare const SetPrototypeDelete: (self: unknown, value: any) => boolean;
+export declare const SetPrototypeDifference: <U>(self: unknown, other: ReadonlySetLike<U>) => Set<any>;
 export declare const SetPrototypeEntries: (self: unknown) => SetIterator<[any, any]>;
 export declare const SetPrototypeForEach: (self: unknown, callbackfn: (value: any, value2: any, set: Set<any>) => void, thisArg?: any) => void;
 export declare const SetPrototypeHas: (self: unknown, value: any) => boolean;
+export declare const SetPrototypeIntersection: <U>(self: unknown, other: ReadonlySetLike<U>) => Set<any>;
+export declare const SetPrototypeIsDisjointFrom: (self: unknown, other: ReadonlySetLike<unknown>) => boolean;
+export declare const SetPrototypeIsSubsetOf: (self: unknown, other: ReadonlySetLike<unknown>) => boolean;
+export declare const SetPrototypeIsSupersetOf: (self: unknown, other: ReadonlySetLike<unknown>) => boolean;
 export declare const SetPrototypeKeys: (self: unknown) => SetIterator<any>;
+export declare const SetPrototypeSymmetricDifference: <U>(self: unknown, other: ReadonlySetLike<U>) => Set<any>;
+export declare const SetPrototypeUnion: <U>(self: unknown, other: ReadonlySetLike<U>) => Set<any>;
 export declare const SetPrototypeValues: (self: unknown) => SetIterator<any>;
 export declare const WeakMapPrototypeDelete: (self: unknown, key: WeakKey) => boolean;
 export declare const WeakMapPrototypeGet: (self: unknown, key: WeakKey) => any;
+export declare const WeakMapPrototypeGetOrInsert: (self: unknown, key: WeakKey, value: any) => any;
+export declare const WeakMapPrototypeGetOrInsertComputed: (self: unknown, key: WeakKey, callbackfn: (key: WeakKey) => any) => any;
 export declare const WeakMapPrototypeHas: (self: unknown, key: WeakKey) => boolean;
 export declare const WeakMapPrototypeSet: (self: unknown, key: WeakKey, value: any) => WeakMap<WeakKey, any>;
 export declare const WeakSetPrototypeAdd: (self: unknown, value: WeakKey) => WeakSet<WeakKey>;

package/dist/primordials/map-set.js

@@ -26,6 +26,8 @@ __export(map_set_exports, {
   MapPrototypeEntries: () => MapPrototypeEntries,
   MapPrototypeForEach: () => MapPrototypeForEach,
   MapPrototypeGet: () => MapPrototypeGet,
+  MapPrototypeGetOrInsert: () => MapPrototypeGetOrInsert,
+  MapPrototypeGetOrInsertComputed: () => MapPrototypeGetOrInsertComputed,
   MapPrototypeHas: () => MapPrototypeHas,
   MapPrototypeKeys: () => MapPrototypeKeys,
   MapPrototypeSet: () => MapPrototypeSet,
@@ -34,14 +36,23 @@ __export(map_set_exports, {
   SetPrototypeAdd: () => SetPrototypeAdd,
   SetPrototypeClear: () => SetPrototypeClear,
   SetPrototypeDelete: () => SetPrototypeDelete,
+  SetPrototypeDifference: () => SetPrototypeDifference,
   SetPrototypeEntries: () => SetPrototypeEntries,
   SetPrototypeForEach: () => SetPrototypeForEach,
   SetPrototypeHas: () => SetPrototypeHas,
+  SetPrototypeIntersection: () => SetPrototypeIntersection,
+  SetPrototypeIsDisjointFrom: () => SetPrototypeIsDisjointFrom,
+  SetPrototypeIsSubsetOf: () => SetPrototypeIsSubsetOf,
+  SetPrototypeIsSupersetOf: () => SetPrototypeIsSupersetOf,
   SetPrototypeKeys: () => SetPrototypeKeys,
+  SetPrototypeSymmetricDifference: () => SetPrototypeSymmetricDifference,
+  SetPrototypeUnion: () => SetPrototypeUnion,
   SetPrototypeValues: () => SetPrototypeValues,
   WeakMapCtor: () => WeakMapCtor,
   WeakMapPrototypeDelete: () => WeakMapPrototypeDelete,
   WeakMapPrototypeGet: () => WeakMapPrototypeGet,
+  WeakMapPrototypeGetOrInsert: () => WeakMapPrototypeGetOrInsert,
+  WeakMapPrototypeGetOrInsertComputed: () => WeakMapPrototypeGetOrInsertComputed,
   WeakMapPrototypeHas: () => WeakMapPrototypeHas,
   WeakMapPrototypeSet: () => WeakMapPrototypeSet,
   WeakRefCtor: () => WeakRefCtor,
@@ -62,6 +73,10 @@ const MapPrototypeDelete = (0, import_uncurry.uncurryThis)(Map.prototype.delete)
 const MapPrototypeEntries = (0, import_uncurry.uncurryThis)(Map.prototype.entries);
 const MapPrototypeForEach = (0, import_uncurry.uncurryThis)(Map.prototype.forEach);
 const MapPrototypeGet = (0, import_uncurry.uncurryThis)(Map.prototype.get);
+const MapPrototypeGetOrInsert = (0, import_uncurry.uncurryThis)(Map.prototype.getOrInsert);
+const MapPrototypeGetOrInsertComputed = (0, import_uncurry.uncurryThis)(
+  Map.prototype.getOrInsertComputed
+);
 const MapPrototypeHas = (0, import_uncurry.uncurryThis)(Map.prototype.has);
 const MapPrototypeKeys = (0, import_uncurry.uncurryThis)(Map.prototype.keys);
 const MapPrototypeSet = (0, import_uncurry.uncurryThis)(Map.prototype.set);
@@ -69,13 +84,30 @@ const MapPrototypeValues = (0, import_uncurry.uncurryThis)(Map.prototype.values)
 const SetPrototypeAdd = (0, import_uncurry.uncurryThis)(Set.prototype.add);
 const SetPrototypeClear = (0, import_uncurry.uncurryThis)(Set.prototype.clear);
 const SetPrototypeDelete = (0, import_uncurry.uncurryThis)(Set.prototype.delete);
+const SetPrototypeDifference = (0, import_uncurry.uncurryThis)(Set.prototype.difference);
 const SetPrototypeEntries = (0, import_uncurry.uncurryThis)(Set.prototype.entries);
 const SetPrototypeForEach = (0, import_uncurry.uncurryThis)(Set.prototype.forEach);
 const SetPrototypeHas = (0, import_uncurry.uncurryThis)(Set.prototype.has);
+const SetPrototypeIntersection = (0, import_uncurry.uncurryThis)(Set.prototype.intersection);
+const SetPrototypeIsDisjointFrom = (0, import_uncurry.uncurryThis)(
+  Set.prototype.isDisjointFrom
+);
+const SetPrototypeIsSubsetOf = (0, import_uncurry.uncurryThis)(Set.prototype.isSubsetOf);
+const SetPrototypeIsSupersetOf = (0, import_uncurry.uncurryThis)(Set.prototype.isSupersetOf);
 const SetPrototypeKeys = (0, import_uncurry.uncurryThis)(Set.prototype.keys);
+const SetPrototypeSymmetricDifference = (0, import_uncurry.uncurryThis)(
+  Set.prototype.symmetricDifference
+);
+const SetPrototypeUnion = (0, import_uncurry.uncurryThis)(Set.prototype.union);
 const SetPrototypeValues = (0, import_uncurry.uncurryThis)(Set.prototype.values);
 const WeakMapPrototypeDelete = (0, import_uncurry.uncurryThis)(WeakMap.prototype.delete);
 const WeakMapPrototypeGet = (0, import_uncurry.uncurryThis)(WeakMap.prototype.get);
+const WeakMapPrototypeGetOrInsert = (0, import_uncurry.uncurryThis)(
+  WeakMap.prototype.getOrInsert
+);
+const WeakMapPrototypeGetOrInsertComputed = (0, import_uncurry.uncurryThis)(
+  WeakMap.prototype.getOrInsertComputed
+);
 const WeakMapPrototypeHas = (0, import_uncurry.uncurryThis)(WeakMap.prototype.has);
 const WeakMapPrototypeSet = (0, import_uncurry.uncurryThis)(WeakMap.prototype.set);
 const WeakSetPrototypeAdd = (0, import_uncurry.uncurryThis)(WeakSet.prototype.add);
@@ -89,6 +121,8 @@ const WeakSetPrototypeHas = (0, import_uncurry.uncurryThis)(WeakSet.prototype.ha
   MapPrototypeEntries,
   MapPrototypeForEach,
   MapPrototypeGet,
+  MapPrototypeGetOrInsert,
+  MapPrototypeGetOrInsertComputed,
   MapPrototypeHas,
   MapPrototypeKeys,
   MapPrototypeSet,
@@ -97,14 +131,23 @@ const WeakSetPrototypeHas = (0, import_uncurry.uncurryThis)(WeakSet.prototype.ha
   SetPrototypeAdd,
   SetPrototypeClear,
   SetPrototypeDelete,
+  SetPrototypeDifference,
   SetPrototypeEntries,
   SetPrototypeForEach,
   SetPrototypeHas,
+  SetPrototypeIntersection,
+  SetPrototypeIsDisjointFrom,
+  SetPrototypeIsSubsetOf,
+  SetPrototypeIsSupersetOf,
   SetPrototypeKeys,
+  SetPrototypeSymmetricDifference,
+  SetPrototypeUnion,
   SetPrototypeValues,
   WeakMapCtor,
   WeakMapPrototypeDelete,
   WeakMapPrototypeGet,
+  WeakMapPrototypeGetOrInsert,
+  WeakMapPrototypeGetOrInsertComputed,
   WeakMapPrototypeHas,
   WeakMapPrototypeSet,
   WeakRefCtor,

package/dist/primordials/url.d.ts

@@ -6,7 +6,7 @@ export declare const URLCtor: typeof URL;
 export declare const URLSearchParamsCtor: typeof URLSearchParams;
 export declare const URLSearchParamsPrototypeAppend: (self: unknown, name: string, value: string) => void;
 export declare const URLSearchParamsPrototypeDelete: (self: unknown, name: string, value?: string | undefined) => void;
-export declare const URLSearchParamsPrototypeForEach: <TThis = import("url").URLSearchParams>(self: unknown, fn: (this: TThis, value: string, name: string, searchParams: import("url").URLSearchParams) => void, thisArg?: TThis | undefined) => void;
+export declare const URLSearchParamsPrototypeForEach: (self: unknown, callbackfn: (value: string, key: string, parent: URLSearchParams) => void, thisArg?: any) => void;
 export declare const URLSearchParamsPrototypeGet: (self: unknown, name: string) => string | null;
 export declare const URLSearchParamsPrototypeGetAll: (self: unknown, name: string) => string[];
 export declare const URLSearchParamsPrototypeHas: (self: unknown, name: string, value?: string | undefined) => boolean;

package/dist/process/lock-manager.js

@@ -25,15 +25,15 @@ __export(lock_manager_exports, {
 module.exports = __toCommonJS(lock_manager_exports);
 var import_message = require("../errors/message");
 var import_safe = require("../fs/safe");
-var import_logger = require("../logger/logger");
+var import_default = require("../logger/default");
 var import_date = require("../primordials/date");
 var import_error = require("../primordials/error");
 var import_map_set = require("../primordials/map-set");
 var import_math = require("../primordials/math");
 var import_retry = require("../promises/retry");
-var import_register = require("../signal-exit/register");
+var import_handler = require("../events/exit/handler");
 var import_internal = require("./_internal");
-const logger = (0, import_logger.getDefaultLogger)();
+const logger = (0, import_default.getDefaultLogger)();
 class ProcessLockManager {
   activeLocks = new import_map_set.SetCtor();
   touchTimers = new import_map_set.MapCtor();
@@ -46,7 +46,7 @@ class ProcessLockManager {
     if (this.exitHandlerRegistered) {
       return;
     }
-    (0, import_register.onExit)(() => {
+    (0, import_handler.onExit)(() => {
       for (const timer of this.touchTimers.values()) {
         clearInterval(timer);
       }

package/dist/{spawn → process/spawn}/_internal.js

@@ -27,8 +27,8 @@ __export(internal_exports, {
   windowsScriptExtRegExp: () => windowsScriptExtRegExp
 });
 module.exports = __toCommonJS(internal_exports);
-var import_strip = require("../ansi/strip");
-var import_map_set = require("../primordials/map-set");
+var import_strip = require("../../ansi/strip");
+var import_map_set = require("../../primordials/map-set");
 const stackCache = new import_map_set.WeakMapCtor();
 const spawnBinPathCache = new import_map_set.MapCtor();
 const windowsScriptExtRegExp = /\.(?:cmd|bat|ps1)$/i;
@@ -36,7 +36,7 @@ let _npmCliPromiseSpawn;
 // @__NO_SIDE_EFFECTS__
 function getNpmCliPromiseSpawn() {
   if (_npmCliPromiseSpawn === void 0) {
-    _npmCliPromiseSpawn = require("../external/@npmcli/promise-spawn");
+    _npmCliPromiseSpawn = require("../../external/@npmcli/promise-spawn");
   }
   return _npmCliPromiseSpawn;
 }

package/dist/{spawn/spawn.js → process/spawn/child.js}

@@ -28,27 +28,27 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var spawn_exports = {};
-__export(spawn_exports, {
+var child_exports = {};
+__export(child_exports, {
   spawn: () => spawn,
   spawnSync: () => spawnSync
 });
-module.exports = __toCommonJS(spawn_exports);
+module.exports = __toCommonJS(child_exports);
 var import_node_process = __toESM(require("node:process"));
-var import_which = require("../bin/which");
-var import_abort = require("../process/abort");
-var import_child_process = require("../node/child-process");
-var import_fs = require("../node/fs");
-var import_path = require("../node/path");
-var import_inspect = require("../objects/inspect");
-var import_normalize = require("../paths/normalize");
-var import_regexp = require("../primordials/regexp");
-var import_registry = require("../spinner/registry");
+var import_which = require("../../bin/which");
+var import_abort = require("../../process/abort");
+var import_child_process = require("../../node/child-process");
+var import_fs = require("../../node/fs");
+var import_path = require("../../node/path");
+var import_inspect = require("../../objects/inspect");
+var import_normalize = require("../../paths/normalize");
+var import_regexp = require("../../primordials/regexp");
+var import_default = require("../../spinner/default");
 var import_internal = require("./_internal");
 var import_errors = require("./errors");
 var import_stdio = require("./stdio");
 const abortSignal = (0, import_abort.getAbortSignal)();
-const spinner = (0, import_registry.getDefaultSpinner)();
+const spinner = (0, import_default.getDefaultSpinner)();
 function spawn(cmd, args, options, extra) {
   const {
     spinner: optionsSpinner = spinner,

package/dist/{spawn → process/spawn}/errors.js

@@ -24,11 +24,11 @@ __export(errors_exports, {
   isSpawnError: () => isSpawnError
 });
 module.exports = __toCommonJS(errors_exports);
-var import_stack = require("../errors/stack");
-var import_predicates = require("../objects/predicates");
-var import_error = require("../primordials/error");
-var import_object = require("../primordials/object");
-var import_reflect = require("../primordials/reflect");
+var import_stack = require("../../errors/stack");
+var import_predicates = require("../../objects/predicates");
+var import_error = require("../../primordials/error");
+var import_object = require("../../primordials/object");
+var import_reflect = require("../../primordials/reflect");
 var import_internal = require("./_internal");
 // @__NO_SIDE_EFFECTS__
 function enhanceSpawnError(error) {

package/dist/{spawn → process/spawn}/stdio.js

@@ -23,7 +23,7 @@ __export(stdio_exports, {
   isStdioType: () => isStdioType
 });
 module.exports = __toCommonJS(stdio_exports);
-var import_predicates = require("../arrays/predicates");
+var import_predicates = require("../../arrays/predicates");
 // @__NO_SIDE_EFFECTS__
 function isStdioType(stdio, type) {
   if (arguments.length === 1) {

package/dist/{spawn → process/spawn}/types.d.ts

@@ -18,8 +18,8 @@
  */
 import type { SendHandle, Serializable, StdioOptions } from 'node:child_process';
 import type { EventEmitter } from 'node:events';
-import type { Remap } from '../objects/types';
-import type { SpinnerInstance } from '../spinner/types';
+import type { Remap } from '../../objects/types';
+import type { SpinnerInstance } from '../../spinner/types';
 export type BufferEncoding = globalThis.BufferEncoding;
 /**
  * Options for spawning a child process with promise-based completion.
@@ -270,7 +270,7 @@ export interface WritableStreamType {
  * @property {number | undefined} gid - Group identity (POSIX)
  * @property {boolean | string | undefined} shell - Run command in shell.
  * @property {AbortSignal | undefined} signal - Abort signal.
- * @property {import('../spinner/types').SpinnerInstance | undefined} spinner -
+ * @property {import('../../spinner/types').SpinnerInstance | undefined} spinner -
  *   Spinner instance to pause during execution.
  * @property {StdioType | undefined} stdio - Stdio configuration.
  * @property {boolean | undefined} stdioString - Convert output to strings

package/dist/promises/types.d.ts

@@ -1,7 +1,8 @@
 /**
  * @file Public type surface for `promises/*` modules: `RetryOptions`,
- *   `IterationOptions`, and `PromiseWithResolvers`. Pure types, no runtime side
- *   effects.
+ *   `IterationOptions`, `PromiseWithResolvers`, and the `QueuedTask` storage
+ *   shape used by the bounded-concurrency `PromiseQueue`. Pure types, no
+ *   runtime side effects.
  */
 /**
  * Configuration options for retry behavior with exponential backoff.
@@ -188,3 +189,15 @@ export interface PromiseWithResolvers<T> {
      */
     reject: (reason?: unknown) => void;
 }
+/**
+ * Queued-task storage shape for the bounded-concurrency `PromiseQueue`.
+ *
+ * Each entry pairs a deferred task function with the resolver / rejecter for
+ * the promise returned to the caller, so the queue can run tasks under a
+ * concurrency cap and forward results when they settle.
+ */
+export type QueuedTask<T> = {
+    fn: () => Promise<T>;
+    resolve: (value: T) => void;
+    reject: (error: unknown) => void;
+};

package/dist/releases/github-archives.js

@@ -27,11 +27,11 @@ module.exports = __toCommonJS(github_archives_exports);
 var import_detect = require("../archives/detect");
 var import_extract = require("../archives/extract");
 var import_safe = require("../fs/safe");
-var import_logger = require("../logger/logger");
+var import_default = require("../logger/default");
 var import_error = require("../primordials/error");
 var import_github_downloads = require("./github-downloads");
 var import_path = require("../node/path");
-const logger = (0, import_logger.getDefaultLogger)();
+const logger = (0, import_default.getDefaultLogger)();
 async function downloadAndExtractArchive(tag, assetPattern, outputDir, repoConfig, options = { __proto__: null }) {
   const { cleanup = true, format, quiet = false, strip } = options;
   const path = (0, import_path.getNodePath)();