@socketsecurity/lib 6.0.1 → 6.0.2

package/dist/logger/symbols-builder.d.ts

@@ -1,6 +1,6 @@
 /**
  * @file Free-function helpers for per-instance log-symbol construction + symbol
- *   stripping. Extracted from `logger/default.ts` (the `Logger` class) so the
+ *   stripping. Extracted from `logger/node.ts` (the `Logger` class) so the
  *   class stays under the 1000-line hard cap and so other callers (alt loggers,
  *   format helpers) can reuse the same logic without instantiating a `Logger`.
  *

package/dist/logger/types.d.ts

@@ -4,7 +4,7 @@
  *   interface returned by `Logger.createTask`. Pure types; no runtime side
  *   effects so this module stays cheap to import everywhere.
  */
-import type { Logger } from './default';
+import type { Logger } from './node';
 /**
  * Log symbols for terminal output with colored indicators.
  *

package/dist/packages/provenance.d.ts

@@ -2,6 +2,18 @@
  * @file Package provenance and attestation verification utilities.
  */
 import type { ProvenanceOptions } from './types';
+/**
+ * Comparator ordering two trust statuses by ascending trust level. Sorts an
+ * array of statuses lowest-trust-first; negate for highest-first.
+ */
+export declare function compareTrust(a: TrustStatus, b: TrustStatus): -1 | 0 | 1;
+/**
+ * Whether `next` sits at a lower trust level than `prev` — i.e. a release
+ * regressed its supply-chain posture. Drives the post-publish provenance
+ * reminder: a version that drops from trustedPublisher back to bare provenance
+ * is a red flag worth surfacing.
+ */
+export declare function didTrustDecrease(prev: TrustStatus, next: TrustStatus): boolean;
 /**
  * Fetch package provenance information from npm registry.
  *
@@ -30,7 +42,37 @@ export declare function getFetcher(): import("../external/make-fetch-happen").Ma
  *   ```
  */
 export declare function getProvenanceDetails(attestationData: unknown): unknown;
+/**
+ * Map a trust status to its 0..3 ladder level.
+ */
+export declare function getTrustLevel(status: TrustStatus): TrustLevel;
+/**
+ * Map a trust status to its human-readable level name.
+ */
+export declare function getTrustLevelName(status: TrustStatus): TrustLevelName;
+/**
+ * Extract provenance / trusted-publisher / staged-publish flags from a registry
+ * version document.
+ */
+export declare function getTrustStatus(meta: unknown): TrustStatus;
 /**
  * Check if a value indicates a trusted publisher (GitHub or GitLab).
  */
 export declare function isTrustedPublisher(value: unknown): boolean;
+/**
+ * Trust signals derived from a registry version document.
+ */
+export interface TrustStatus {
+    provenance: boolean;
+    trustedPublisher: boolean;
+    stagedPublish: boolean;
+}
+/**
+ * Trust ladder, low → high. The index IS the level (0..3), so a single array
+ * maps both directions: `TRUST_LEVELS[level]` → name, and
+ * `TRUST_LEVELS.indexOf(name)` → level. One source of truth, no parallel Record
+ * to keep in sync.
+ */
+export declare const TRUST_LEVELS: readonly ['none', 'provenance', 'trustedPublisher', 'stagedPublish'];
+export type TrustLevel = 0 | 1 | 2 | 3;
+export type TrustLevelName = (typeof TRUST_LEVELS)[number];

package/dist/packages/provenance.js

@@ -30,11 +30,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var provenance_exports = {};
 __export(provenance_exports, {
+  TRUST_LEVELS: () => TRUST_LEVELS,
+  compareTrust: () => compareTrust,
+  didTrustDecrease: () => didTrustDecrease,
   fetchPackageProvenance: () => fetchPackageProvenance,
   findProvenance: () => findProvenance,
   getAttestations: () => getAttestations,
   getFetcher: () => getFetcher,
   getProvenanceDetails: () => getProvenanceDetails,
+  getTrustLevel: () => getTrustLevel,
+  getTrustLevelName: () => getTrustLevelName,
+  getTrustStatus: () => getTrustStatus,
   isTrustedPublisher: () => isTrustedPublisher
 });
 module.exports = __toCommonJS(provenance_exports);
@@ -43,13 +49,29 @@ var import_packages = require("../constants/packages");
 var import_make_fetch_happen = __toESM(require("../external/make-fetch-happen"));
 var import_signal = require("../abort/signal");
 var import_parse = require("../url/parse");
+var import_predicates = require("../objects/predicates");
 var import_array = require("../primordials/array");
 var import_buffer = require("../primordials/buffer");
 var import_json = require("../primordials/json");
+var import_object = require("../primordials/object");
 var import_string = require("../primordials/string");
 const SLSA_PROVENANCE_V0_2 = "https://slsa.dev/provenance/v0.2";
 const SLSA_PROVENANCE_V1_0 = "https://slsa.dev/provenance/v1";
 let _fetcher;
+function compareTrust(a, b) {
+  const levelA = getTrustLevel(a);
+  const levelB = getTrustLevel(b);
+  if (levelA < levelB) {
+    return -1;
+  }
+  if (levelA > levelB) {
+    return 1;
+  }
+  return 0;
+}
+function didTrustDecrease(prev, next) {
+  return getTrustLevel(next) < getTrustLevel(prev);
+}
 // @__NO_SIDE_EFFECTS__
 async function fetchPackageProvenance(pkgName, pkgVersion, options) {
   const { signal, timeout = 1e4 } = {
@@ -165,6 +187,43 @@ function getProvenanceDetails(attestationData) {
     workflowRunId
   };
 }
+function getTrustLevel(status) {
+  if (status.stagedPublish) {
+    return 3;
+  }
+  if (status.trustedPublisher && status.provenance) {
+    return 2;
+  }
+  if (status.provenance) {
+    return 1;
+  }
+  return 0;
+}
+function getTrustLevelName(status) {
+  return TRUST_LEVELS[getTrustLevel(status)];
+}
+function getTrustStatus(meta) {
+  const status = {
+    provenance: false,
+    trustedPublisher: false,
+    // Reserved: the npm registry does not yet expose a staged-publish flag, so
+    // this stays false until a registry signal exists to set it.
+    stagedPublish: false
+  };
+  if (!(0, import_predicates.isObject)(meta)) {
+    return status;
+  }
+  const npmUser = (0, import_object.ObjectHasOwn)(meta, "_npmUser") ? meta["_npmUser"] : void 0;
+  if ((0, import_predicates.isObject)(npmUser) && (0, import_object.ObjectHasOwn)(npmUser, "trustedPublisher") && npmUser["trustedPublisher"]) {
+    status.trustedPublisher = true;
+  }
+  const dist = (0, import_object.ObjectHasOwn)(meta, "dist") ? meta["dist"] : void 0;
+  const attestations = (0, import_predicates.isObject)(dist) && (0, import_object.ObjectHasOwn)(dist, "attestations") ? dist["attestations"] : void 0;
+  if ((0, import_predicates.isObject)(attestations) && (0, import_object.ObjectHasOwn)(attestations, "provenance") && attestations["provenance"]) {
+    status.provenance = true;
+  }
+  return status;
+}
 function isTrustedPublisher(value) {
   if (typeof value !== "string" || !value) {
     return false;
@@ -191,12 +250,24 @@ function isTrustedPublisher(value) {
   }
   return (0, import_string.StringPrototypeIncludes)(value, "github") || (0, import_string.StringPrototypeIncludes)(value, "gitlab");
 }
+const TRUST_LEVELS = [
+  "none",
+  "provenance",
+  "trustedPublisher",
+  "stagedPublish"
+];
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  TRUST_LEVELS,
+  compareTrust,
+  didTrustDecrease,
   fetchPackageProvenance,
   findProvenance,
   getAttestations,
   getFetcher,
   getProvenanceDetails,
+  getTrustLevel,
+  getTrustLevelName,
+  getTrustStatus,
   isTrustedPublisher
 });

package/dist/primordials/map-set.d.ts

@@ -4,6 +4,30 @@
  *   constructor — there's a separate `weakRefSafe` wrapper in `./uncurry` for
  *   the throws-on-non-Object case.
  */
+declare global {
+    interface Map<K, V> {
+        getOrInsert(key: K, value: V): V;
+        getOrInsertComputed(key: K, callbackfn: (key: K) => V): V;
+    }
+    interface WeakMap<K extends WeakKey, V> {
+        getOrInsert(key: K, value: V): V;
+        getOrInsertComputed(key: K, callbackfn: (key: K) => V): V;
+    }
+    interface ReadonlySetLike<T> {
+        has(value: T): boolean;
+        keys(): IterableIterator<T>;
+        readonly size: number;
+    }
+    interface Set<T> {
+        difference<U>(other: ReadonlySetLike<U>): Set<T>;
+        intersection<U>(other: ReadonlySetLike<U>): Set<T & U>;
+        isDisjointFrom(other: ReadonlySetLike<unknown>): boolean;
+        isSubsetOf(other: ReadonlySetLike<unknown>): boolean;
+        isSupersetOf(other: ReadonlySetLike<unknown>): boolean;
+        symmetricDifference<U>(other: ReadonlySetLike<U>): Set<T | U>;
+        union<U>(other: ReadonlySetLike<U>): Set<T | U>;
+    }
+}
 export declare const MapCtor: MapConstructor;
 export declare const SetCtor: SetConstructor;
 export declare const WeakMapCtor: WeakMapConstructor;
@@ -14,6 +38,8 @@ export declare const MapPrototypeDelete: (self: unknown, key: any) => boolean;
 export declare const MapPrototypeEntries: (self: unknown) => MapIterator<[any, any]>;
 export declare const MapPrototypeForEach: (self: unknown, callbackfn: (value: any, key: any, map: Map<any, any>) => void, thisArg?: any) => void;
 export declare const MapPrototypeGet: (self: unknown, key: any) => any;
+export declare const MapPrototypeGetOrInsert: (self: unknown, key: any, value: any) => any;
+export declare const MapPrototypeGetOrInsertComputed: (self: unknown, key: any, callbackfn: (key: any) => any) => any;
 export declare const MapPrototypeHas: (self: unknown, key: any) => boolean;
 export declare const MapPrototypeKeys: (self: unknown) => MapIterator<any>;
 export declare const MapPrototypeSet: (self: unknown, key: any, value: any) => Map<any, any>;
@@ -21,13 +47,22 @@ export declare const MapPrototypeValues: (self: unknown) => MapIterator<any>;
 export declare const SetPrototypeAdd: (self: unknown, value: any) => Set<any>;
 export declare const SetPrototypeClear: (self: unknown) => void;
 export declare const SetPrototypeDelete: (self: unknown, value: any) => boolean;
+export declare const SetPrototypeDifference: <U>(self: unknown, other: ReadonlySetLike<U>) => Set<any>;
 export declare const SetPrototypeEntries: (self: unknown) => SetIterator<[any, any]>;
 export declare const SetPrototypeForEach: (self: unknown, callbackfn: (value: any, value2: any, set: Set<any>) => void, thisArg?: any) => void;
 export declare const SetPrototypeHas: (self: unknown, value: any) => boolean;
+export declare const SetPrototypeIntersection: <U>(self: unknown, other: ReadonlySetLike<U>) => Set<any>;
+export declare const SetPrototypeIsDisjointFrom: (self: unknown, other: ReadonlySetLike<unknown>) => boolean;
+export declare const SetPrototypeIsSubsetOf: (self: unknown, other: ReadonlySetLike<unknown>) => boolean;
+export declare const SetPrototypeIsSupersetOf: (self: unknown, other: ReadonlySetLike<unknown>) => boolean;
 export declare const SetPrototypeKeys: (self: unknown) => SetIterator<any>;
+export declare const SetPrototypeSymmetricDifference: <U>(self: unknown, other: ReadonlySetLike<U>) => Set<any>;
+export declare const SetPrototypeUnion: <U>(self: unknown, other: ReadonlySetLike<U>) => Set<any>;
 export declare const SetPrototypeValues: (self: unknown) => SetIterator<any>;
 export declare const WeakMapPrototypeDelete: (self: unknown, key: WeakKey) => boolean;
 export declare const WeakMapPrototypeGet: (self: unknown, key: WeakKey) => any;
+export declare const WeakMapPrototypeGetOrInsert: (self: unknown, key: WeakKey, value: any) => any;
+export declare const WeakMapPrototypeGetOrInsertComputed: (self: unknown, key: WeakKey, callbackfn: (key: WeakKey) => any) => any;
 export declare const WeakMapPrototypeHas: (self: unknown, key: WeakKey) => boolean;
 export declare const WeakMapPrototypeSet: (self: unknown, key: WeakKey, value: any) => WeakMap<WeakKey, any>;
 export declare const WeakSetPrototypeAdd: (self: unknown, value: WeakKey) => WeakSet<WeakKey>;

package/dist/primordials/map-set.js

@@ -26,6 +26,8 @@ __export(map_set_exports, {
   MapPrototypeEntries: () => MapPrototypeEntries,
   MapPrototypeForEach: () => MapPrototypeForEach,
   MapPrototypeGet: () => MapPrototypeGet,
+  MapPrototypeGetOrInsert: () => MapPrototypeGetOrInsert,
+  MapPrototypeGetOrInsertComputed: () => MapPrototypeGetOrInsertComputed,
   MapPrototypeHas: () => MapPrototypeHas,
   MapPrototypeKeys: () => MapPrototypeKeys,
   MapPrototypeSet: () => MapPrototypeSet,
@@ -34,14 +36,23 @@ __export(map_set_exports, {
   SetPrototypeAdd: () => SetPrototypeAdd,
   SetPrototypeClear: () => SetPrototypeClear,
   SetPrototypeDelete: () => SetPrototypeDelete,
+  SetPrototypeDifference: () => SetPrototypeDifference,
   SetPrototypeEntries: () => SetPrototypeEntries,
   SetPrototypeForEach: () => SetPrototypeForEach,
   SetPrototypeHas: () => SetPrototypeHas,
+  SetPrototypeIntersection: () => SetPrototypeIntersection,
+  SetPrototypeIsDisjointFrom: () => SetPrototypeIsDisjointFrom,
+  SetPrototypeIsSubsetOf: () => SetPrototypeIsSubsetOf,
+  SetPrototypeIsSupersetOf: () => SetPrototypeIsSupersetOf,
   SetPrototypeKeys: () => SetPrototypeKeys,
+  SetPrototypeSymmetricDifference: () => SetPrototypeSymmetricDifference,
+  SetPrototypeUnion: () => SetPrototypeUnion,
   SetPrototypeValues: () => SetPrototypeValues,
   WeakMapCtor: () => WeakMapCtor,
   WeakMapPrototypeDelete: () => WeakMapPrototypeDelete,
   WeakMapPrototypeGet: () => WeakMapPrototypeGet,
+  WeakMapPrototypeGetOrInsert: () => WeakMapPrototypeGetOrInsert,
+  WeakMapPrototypeGetOrInsertComputed: () => WeakMapPrototypeGetOrInsertComputed,
   WeakMapPrototypeHas: () => WeakMapPrototypeHas,
   WeakMapPrototypeSet: () => WeakMapPrototypeSet,
   WeakRefCtor: () => WeakRefCtor,
@@ -62,6 +73,10 @@ const MapPrototypeDelete = (0, import_uncurry.uncurryThis)(Map.prototype.delete)
 const MapPrototypeEntries = (0, import_uncurry.uncurryThis)(Map.prototype.entries);
 const MapPrototypeForEach = (0, import_uncurry.uncurryThis)(Map.prototype.forEach);
 const MapPrototypeGet = (0, import_uncurry.uncurryThis)(Map.prototype.get);
+const MapPrototypeGetOrInsert = (0, import_uncurry.uncurryThis)(Map.prototype.getOrInsert);
+const MapPrototypeGetOrInsertComputed = (0, import_uncurry.uncurryThis)(
+  Map.prototype.getOrInsertComputed
+);
 const MapPrototypeHas = (0, import_uncurry.uncurryThis)(Map.prototype.has);
 const MapPrototypeKeys = (0, import_uncurry.uncurryThis)(Map.prototype.keys);
 const MapPrototypeSet = (0, import_uncurry.uncurryThis)(Map.prototype.set);
@@ -69,13 +84,30 @@ const MapPrototypeValues = (0, import_uncurry.uncurryThis)(Map.prototype.values)
 const SetPrototypeAdd = (0, import_uncurry.uncurryThis)(Set.prototype.add);
 const SetPrototypeClear = (0, import_uncurry.uncurryThis)(Set.prototype.clear);
 const SetPrototypeDelete = (0, import_uncurry.uncurryThis)(Set.prototype.delete);
+const SetPrototypeDifference = (0, import_uncurry.uncurryThis)(Set.prototype.difference);
 const SetPrototypeEntries = (0, import_uncurry.uncurryThis)(Set.prototype.entries);
 const SetPrototypeForEach = (0, import_uncurry.uncurryThis)(Set.prototype.forEach);
 const SetPrototypeHas = (0, import_uncurry.uncurryThis)(Set.prototype.has);
+const SetPrototypeIntersection = (0, import_uncurry.uncurryThis)(Set.prototype.intersection);
+const SetPrototypeIsDisjointFrom = (0, import_uncurry.uncurryThis)(
+  Set.prototype.isDisjointFrom
+);
+const SetPrototypeIsSubsetOf = (0, import_uncurry.uncurryThis)(Set.prototype.isSubsetOf);
+const SetPrototypeIsSupersetOf = (0, import_uncurry.uncurryThis)(Set.prototype.isSupersetOf);
 const SetPrototypeKeys = (0, import_uncurry.uncurryThis)(Set.prototype.keys);
+const SetPrototypeSymmetricDifference = (0, import_uncurry.uncurryThis)(
+  Set.prototype.symmetricDifference
+);
+const SetPrototypeUnion = (0, import_uncurry.uncurryThis)(Set.prototype.union);
 const SetPrototypeValues = (0, import_uncurry.uncurryThis)(Set.prototype.values);
 const WeakMapPrototypeDelete = (0, import_uncurry.uncurryThis)(WeakMap.prototype.delete);
 const WeakMapPrototypeGet = (0, import_uncurry.uncurryThis)(WeakMap.prototype.get);
+const WeakMapPrototypeGetOrInsert = (0, import_uncurry.uncurryThis)(
+  WeakMap.prototype.getOrInsert
+);
+const WeakMapPrototypeGetOrInsertComputed = (0, import_uncurry.uncurryThis)(
+  WeakMap.prototype.getOrInsertComputed
+);
 const WeakMapPrototypeHas = (0, import_uncurry.uncurryThis)(WeakMap.prototype.has);
 const WeakMapPrototypeSet = (0, import_uncurry.uncurryThis)(WeakMap.prototype.set);
 const WeakSetPrototypeAdd = (0, import_uncurry.uncurryThis)(WeakSet.prototype.add);
@@ -89,6 +121,8 @@ const WeakSetPrototypeHas = (0, import_uncurry.uncurryThis)(WeakSet.prototype.ha
   MapPrototypeEntries,
   MapPrototypeForEach,
   MapPrototypeGet,
+  MapPrototypeGetOrInsert,
+  MapPrototypeGetOrInsertComputed,
   MapPrototypeHas,
   MapPrototypeKeys,
   MapPrototypeSet,
@@ -97,14 +131,23 @@ const WeakSetPrototypeHas = (0, import_uncurry.uncurryThis)(WeakSet.prototype.ha
   SetPrototypeAdd,
   SetPrototypeClear,
   SetPrototypeDelete,
+  SetPrototypeDifference,
   SetPrototypeEntries,
   SetPrototypeForEach,
   SetPrototypeHas,
+  SetPrototypeIntersection,
+  SetPrototypeIsDisjointFrom,
+  SetPrototypeIsSubsetOf,
+  SetPrototypeIsSupersetOf,
   SetPrototypeKeys,
+  SetPrototypeSymmetricDifference,
+  SetPrototypeUnion,
   SetPrototypeValues,
   WeakMapCtor,
   WeakMapPrototypeDelete,
   WeakMapPrototypeGet,
+  WeakMapPrototypeGetOrInsert,
+  WeakMapPrototypeGetOrInsertComputed,
   WeakMapPrototypeHas,
   WeakMapPrototypeSet,
   WeakRefCtor,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/lib",
-  "version": "6.0.1",
+  "version": "6.0.2",
   "description": "Core utilities and infrastructure for Socket.dev security tools",
   "keywords": [
     "Socket.dev",
@@ -1484,12 +1484,31 @@
       "types": "./dist/globs/types.d.ts",
       "default": "./dist/globs/types.js"
     },
+    "./http-request": {
+      "source": "./src/http-request/node.ts",
+      "browser": {
+        "types": "./dist/http-request/browser.d.ts",
+        "default": "./dist/http-request/browser.js"
+      },
+      "types": "./dist/http-request/node.d.ts",
+      "default": "./dist/http-request/node.js"
+    },
     "./http-request/browser": {
+      "browser": {
+        "source": "./src/http-request/browser.ts",
+        "types": "./dist/http-request/browser.d.ts",
+        "default": "./dist/http-request/browser.js"
+      },
       "source": "./src/http-request/browser.ts",
       "types": "./dist/http-request/browser.d.ts",
       "default": "./dist/http-request/browser.js"
     },
     "./http-request/browser-fetch": {
+      "browser": {
+        "source": "./src/http-request/browser-fetch.ts",
+        "types": "./dist/http-request/browser-fetch.d.ts",
+        "default": "./dist/http-request/browser-fetch.js"
+      },
       "source": "./src/http-request/browser-fetch.ts",
       "types": "./dist/http-request/browser-fetch.d.ts",
       "default": "./dist/http-request/browser-fetch.js"
@@ -1499,11 +1518,6 @@
       "types": "./dist/http-request/checksums.d.ts",
       "default": "./dist/http-request/checksums.js"
     },
-    "./http-request/convenience": {
-      "source": "./src/http-request/convenience.ts",
-      "types": "./dist/http-request/convenience.d.ts",
-      "default": "./dist/http-request/convenience.js"
-    },
     "./http-request/download": {
       "source": "./src/http-request/download.ts",
       "types": "./dist/http-request/download.d.ts",
@@ -1524,6 +1538,20 @@
       "types": "./dist/http-request/headers.d.ts",
       "default": "./dist/http-request/headers.js"
     },
+    "./http-request/http-request": {
+      "source": "./src/http-request/node.ts",
+      "browser": {
+        "types": "./dist/http-request/browser.d.ts",
+        "default": "./dist/http-request/browser.js"
+      },
+      "types": "./dist/http-request/node.d.ts",
+      "default": "./dist/http-request/node.js"
+    },
+    "./http-request/node": {
+      "source": "./src/http-request/node.ts",
+      "types": "./dist/http-request/node.d.ts",
+      "default": "./dist/http-request/node.js"
+    },
     "./http-request/request": {
       "source": "./src/http-request/request.ts",
       "types": "./dist/http-request/request.d.ts",
@@ -1620,11 +1648,20 @@
       "default": "./dist/links/types.js"
     },
     "./logger": {
-      "source": "./src/logger/default.ts",
-      "types": "./dist/logger/default.d.ts",
-      "default": "./dist/logger/default.js"
+      "source": "./src/logger/node.ts",
+      "browser": {
+        "types": "./dist/logger/browser.d.ts",
+        "default": "./dist/logger/browser.js"
+      },
+      "types": "./dist/logger/node.d.ts",
+      "default": "./dist/logger/node.js"
     },
     "./logger/browser": {
+      "browser": {
+        "source": "./src/logger/browser.ts",
+        "types": "./dist/logger/browser.d.ts",
+        "default": "./dist/logger/browser.js"
+      },
       "source": "./src/logger/browser.ts",
       "types": "./dist/logger/browser.d.ts",
       "default": "./dist/logger/browser.js"
@@ -1644,6 +1681,20 @@
       "types": "./dist/logger/default.d.ts",
       "default": "./dist/logger/default.js"
     },
+    "./logger/logger": {
+      "source": "./src/logger/node.ts",
+      "browser": {
+        "types": "./dist/logger/browser.d.ts",
+        "default": "./dist/logger/browser.js"
+      },
+      "types": "./dist/logger/node.d.ts",
+      "default": "./dist/logger/node.js"
+    },
+    "./logger/node": {
+      "source": "./src/logger/node.ts",
+      "types": "./dist/logger/node.d.ts",
+      "default": "./dist/logger/node.js"
+    },
     "./logger/symbols": {
       "source": "./src/logger/symbols.ts",
       "types": "./dist/logger/symbols.d.ts",
@@ -2698,27 +2749,6 @@
     "access": "public",
     "provenance": true
   },
-  "scripts": {
-    "build": "node scripts/build/cli.mts",
-    "check": "node scripts/check.mts",
-    "check:paths": "node scripts/check-paths.mts",
-    "clean": "node scripts/build/clean.mts",
-    "cover": "node scripts/test/cover.mts",
-    "dev": "node scripts/build/cli.mts --watch",
-    "fix": "node scripts/fix.mts",
-    "format": "oxfmt -c .config/oxfmtrc.json --write .",
-    "format:check": "oxfmt -c .config/oxfmtrc.json --check .",
-    "lint": "node scripts/lint.mts",
-    "prim": "node tools/prim/bin/prim.mts",
-    "security": "node scripts/security.mts",
-    "prepare": "node scripts/install-git-hooks.mts && node scripts/build/cli.mts --quiet",
-    "prepublishOnly": "pnpm run build",
-    "test": "node scripts/test/cli.mts",
-    "update": "node scripts/update.mts",
-    "lockstep": "node scripts/lockstep.mts",
-    "lockstep:emit-schema": "node scripts/lockstep-emit-schema.mts",
-    "setup-security-tools": "node .claude/hooks/setup-security-tools/install.mts"
-  },
   "devDependencies": {
     "@anthropic-ai/claude-code": "2.1.92",
     "@babel/core": "7.28.4",
@@ -2736,13 +2766,13 @@
     "@npmcli/promise-spawn": "8.0.3",
     "@sinclair/typebox": "0.34.49",
     "@socketregistry/is-unicode-supported": "1.0.5",
-    "@socketregistry/packageurl-js": "catalog:",
-    "@socketregistry/packageurl-js-stable": "catalog:",
+    "@socketregistry/packageurl-js": "npm:@socketregistry/packageurl-js@1.4.2",
+    "@socketregistry/packageurl-js-stable": "npm:@socketregistry/packageurl-js@1.4.2",
     "@socketregistry/yocto-spinner": "1.0.25",
-    "@socketsecurity/lib": "catalog:",
-    "@socketsecurity/lib-stable": "catalog:",
-    "@socketsecurity/sdk": "catalog:",
-    "@socketsecurity/sdk-stable": "catalog:",
+    "@socketsecurity/lib": "npm:@socketsecurity/lib@6.0.1",
+    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@6.0.1",
+    "@socketsecurity/sdk": "npm:@socketsecurity/sdk@4.0.1",
+    "@socketsecurity/sdk-stable": "npm:@socketsecurity/sdk@4.0.1",
     "@types/node": "24.9.2",
     "@typescript/native-preview": "7.0.0-dev.20260511.1",
     "@vitest/coverage-v8": "4.0.3",
@@ -2773,7 +2803,6 @@
     "pacote": "21.5.0",
     "picomatch": "4.0.4",
     "pony-cause": "2.1.11",
-    "prim": "workspace:*",
     "semver": "7.7.2",
     "signal-exit": "4.1.0",
     "spdx-correct": "3.2.0",
@@ -2790,7 +2819,8 @@
     "which": "5.0.0",
     "yargs-parser": "22.0.0",
     "yoctocolors-cjs": "2.1.3",
-    "zod": "4.1.12"
+    "zod": "4.1.12",
+    "prim": "0.1.0"
   },
   "peerDependencies": {
     "typescript": ">=5.0.0"
@@ -2804,5 +2834,23 @@
     "node": ">=22",
     "pnpm": ">=11.3.0"
   },
-  "packageManager": "pnpm@11.3.0"
-}
+  "scripts": {
+    "build": "node scripts/build/cli.mts",
+    "check": "node scripts/check.mts",
+    "check:paths": "node scripts/check-paths.mts",
+    "clean": "node scripts/build/clean.mts",
+    "cover": "node scripts/test/cover.mts",
+    "dev": "node scripts/build/cli.mts --watch",
+    "fix": "node scripts/fix.mts",
+    "format": "oxfmt -c .config/oxfmtrc.json --write .",
+    "format:check": "oxfmt -c .config/oxfmtrc.json --check .",
+    "lint": "node scripts/lint.mts",
+    "prim": "node tools/prim/bin/prim.mts",
+    "security": "node scripts/security.mts",
+    "test": "node scripts/test/cli.mts",
+    "update": "node scripts/update.mts",
+    "lockstep": "node scripts/lockstep.mts",
+    "lockstep:emit-schema": "node scripts/lockstep-emit-schema.mts",
+    "setup-security-tools": "node .claude/hooks/setup-security-tools/install.mts"
+  }
+}

package/dist/http-request/convenience.d.ts

@@ -1,104 +0,0 @@
-/**
- * @file Thin convenience wrappers over `httpRequest` — `httpJson` and
- *   `httpText`. Both set sensible default `Accept` (and `Content-Type` when a
- *   body is present) headers, then delegate to `httpRequest`. User-supplied
- *   headers always win in the merge. Each wrapper throws `HttpResponseError` on
- *   non-2xx responses (parallel to the `throwOnError` mode of `httpRequest`) so
- *   callers never have to inspect `.ok` themselves.
- */
-import type { HttpRequestOptions } from './request-types';
-/**
- * Perform an HTTP request and parse JSON response. Convenience wrapper around
- * `httpRequest` for JSON API calls. Automatically sets appropriate headers for
- * JSON requests: - `Accept: application/json` (always) - `Content-Type:
- * application/json` (when body is present) User-provided headers override these
- * defaults.
- *
- * @example
- *   ;```ts
- *   // Simple JSON GET (automatically sets Accept: application/json)
- *   const data = await httpJson('https://api.example.com/data')
- *   console.log(data)
- *
- *   // With type safety
- *   interface User {
- *     id: number
- *     name: string
- *     email: string
- *   }
- *   const user = await httpJson<User>('https://api.example.com/user/123')
- *   console.log(user.name, user.email)
- *
- *   // POST with JSON body (automatically sets Content-Type: application/json)
- *   const result = await httpJson('https://api.example.com/users', {
- *     method: 'POST',
- *     body: JSON.stringify({ name: 'Alice', email: 'alice@example.com' }),
- *   })
- *
- *   // With custom headers and retries
- *   const data = await httpJson('https://api.example.com/data', {
- *     headers: {
- *       Authorization: 'Bearer token123',
- *     },
- *     retries: 3,
- *     retryDelay: 1000,
- *   })
- *   ```
- *
- * @template T - Expected JSON response type (defaults to `unknown`)
- *
- * @param url - The URL to request (must start with http:// or https://)
- * @param options - Request configuration options.
- *
- * @returns Promise resolving to parsed JSON data
- *
- * @throws {Error} When request fails, response is not ok (status < 200 or >=
- *   300), or JSON parsing fails.
- */
-export declare function httpJson<T = unknown>(url: string, options?: HttpRequestOptions | undefined): Promise<T>;
-/**
- * Perform an HTTP request and return text response. Convenience wrapper around
- * `httpRequest` for fetching text content. Automatically sets appropriate
- * headers for text requests: - `Accept: text/plain` (always) - `Content-Type:
- * text/plain` (when body is present) User-provided headers override these
- * defaults.
- *
- * @example
- *   ;```ts
- *   // Fetch HTML (automatically sets Accept: text/plain)
- *   const html = await httpText('https://example.com')
- *   console.log(html.includes('<!DOCTYPE html>'))
- *
- *   // Fetch plain text
- *   const text = await httpText('https://example.com/file.txt')
- *   console.log(text)
- *
- *   // POST with text body (automatically sets Content-Type: text/plain)
- *   const result = await httpText('https://example.com/api', {
- *     method: 'POST',
- *     body: 'raw text data',
- *   })
- *
- *   // With custom headers (override defaults)
- *   const text = await httpText('https://example.com/data.txt', {
- *     headers: {
- *       Authorization: 'Bearer token123',
- *       Accept: 'text/html', // Override default Accept header
- *     },
- *   })
- *
- *   // With timeout
- *   const text = await httpText('https://example.com/large-file.txt', {
- *     timeout: 60000, // 1 minute
- *   })
- *   ```
- *
- * @param url - The URL to request (must start with http:// or https://)
- * @param options - Request configuration options.
- *
- * @returns Promise resolving to response body as UTF-8 string
- *
- * @throws {Error} When request fails or response is not ok (status < 200 or >=
- *   300)
- */
-export declare function httpText(url: string, options?: HttpRequestOptions | undefined): Promise<string>;