@socketsecurity/lib 6.0.8 → 6.0.10

package/dist/npm/registry.js

@@ -0,0 +1,284 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_string = require('../primordials/string.js');
+
+//#region src/npm/registry.ts
+/**
+* @file Browser-safe npm registry client — pure parsers + injectable-fetch
+*   shell. Safe for Chrome MV3 service workers, content scripts, and any
+*   environment without `node:*` builtins. The HTTP adapter is injected by the
+*   caller (`{ http: { json } }`) so Node callers pass `httpJson` from
+*   `@socketsecurity/lib/http-request` and browser callers pass `httpJson` from
+*   `@socketsecurity/lib/http-request/browser`. No network dependency at module
+*   load time.
+*
+*   ## Endpoints covered
+*
+*   - Packument: `registry.npmjs.org/<pkg>`
+*   - Version manifest (package.json):
+*     `cdn.jsdelivr.net/npm/<pkg>@<ver>/package.json`
+*   - Weekly downloads: `api.npmjs.org/downloads/point/last-week/<pkg>`
+*   - Attestation bundle: `registry.npmjs.org/-/npm/v1/attestations/<pkg>@<ver>`
+*   - Org packages: `registry.npmjs.org/-/org/<org>/package`
+*
+*   ## URL encoding
+*
+*   Registry endpoints (`registry.npmjs.org`, `api.npmjs.org`): scoped names
+*   encode to `@scope%2Fname` (one `encodeURIComponent` call that encodes the
+*   slash, then `%40` is restored to `@`).
+*   CDN endpoint (`cdn.jsdelivr.net`): scope and name are encoded separately,
+*   preserving the literal `/` between them. A prior extension bug sent
+*   `@scope%2Fname` to the CDN which returned 400; the fix is this split-encode
+*   path.
+*
+*   ## Trusted Publisher detection
+*
+*   From the packument alone, only `!!dist.attestations` is detectable —
+*   proving provenance was signed but not identifying which repo or workflow is
+*   configured as the TP. To get repo + workflow call `getAttestations()` then
+*   `parseProvenancePredicate()` to parse the SLSA
+*   `externalParameters.workflow` field. The npm access page
+*   (`/package/<name>/access`) is session-only HTML and is out of scope for
+*   this public client.
+*/
+const NPM_REGISTRY = "https://registry.npmjs.org";
+const NPM_DOWNLOADS_API = "https://api.npmjs.org";
+const CDN_JSDELIVR = "https://cdn.jsdelivr.net";
+const SLSA_PROVENANCE_TYPE = "https://slsa.dev/provenance/v1";
+/**
+* Build the CDN path `<encoded-name>@<encoded-version>/package.json`.
+* Exposed as a pure function so callers can construct the full URL themselves.
+*/
+function buildCdnPath(name, version) {
+	return `${encodeCdnName(name)}@${encodeURIComponent(version)}/package.json`;
+}
+/**
+* Detect Trusted Publisher configuration from a packument version entry.
+*
+* From the packument alone, only the presence of `dist.attestations` is
+* detectable (`configured: true` means provenance was signed; it does NOT
+* confirm that a TP source is configured on npmjs.com). To get `repo` and
+* `workflow`, fetch the attestation bundle with `getAttestations()` and parse
+* it with `parseProvenancePredicate()`.
+*/
+function detectTrustedPublisher(versionEntry) {
+	if (!hasProvenance(versionEntry)) return { configured: false };
+	return { configured: true };
+}
+/**
+* Encode a package name for use in registry CDN URLs.
+* Scope and name are encoded individually, preserving the literal `/`.
+* Use this for `cdn.jsdelivr.net` URLs — fixes the `@scope%2Fname` → 400 bug.
+*/
+function encodeCdnName(name) {
+	if (require_primordials_string.StringPrototypeIndexOf(name, "/") === -1) return encodeURIComponent(name);
+	const slashAt = require_primordials_string.StringPrototypeIndexOf(name, "/");
+	const scope = require_primordials_string.StringPrototypeSlice(name, 0, slashAt);
+	const pkg = require_primordials_string.StringPrototypeSlice(name, slashAt + 1);
+	return `${encodeURIComponent(scope)}/${encodeURIComponent(pkg)}`;
+}
+/**
+* Encode a package name for use in registry / download-API URLs.
+*
+* Registry form (`cdn: false`, the default): `encodeURIComponent` then restore
+* the leading `@` so `@scope/name` → `@scope%2Fname`.
+*
+* CDN form (`cdn: true`): scope and name are encoded individually so the
+* literal `/` separator is preserved: `@scope/name` → `@scope/name` (each
+* segment encoded separately). This fixes the `@scope%2Fname` → 400 bug on
+* `cdn.jsdelivr.net`.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
+function encodePackageName(name, options) {
+	if ({
+		__proto__: null,
+		cdn: false,
+		...options
+	}.cdn) return encodeCdnName(name);
+	return encodeRegistryName(name);
+}
+/**
+* Encode a package name for use in registry / download-API URLs.
+* Applies `encodeURIComponent` then restores `@` so scoped names become
+* `@scope%2Fname`.
+*/
+function encodeRegistryName(name) {
+	return encodeURIComponent(name).replace("%40", "@");
+}
+/**
+* Fetch the attestation bundle for a package version from the npm transparency
+* log. Returns `undefined` when no attestations entry is present in the
+* packument (404 is treated as absent rather than an error).
+*/
+async function getAttestations(name, version, options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const encoded = `${encodeRegistryName(name)}@${encodeURIComponent(version)}`;
+	const url = `${NPM_REGISTRY}/-/npm/v1/attestations/${encoded}`;
+	try {
+		return await opts.http.json(url);
+	} catch {
+		return;
+	}
+}
+/**
+* Fetch the list of packages belonging to an npm org.
+* Returns package names as a string array.
+*/
+async function getOrgPackages(org, options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const url = `${NPM_REGISTRY}/-/org/${encodeURIComponent(org)}/package`;
+	const raw = await opts.http.json(url);
+	return Object.keys(raw);
+}
+/**
+* Fetch and parse the full packument for a package.
+*/
+async function getPackument(name, options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const url = `${NPM_REGISTRY}/${encodeRegistryName(name)}`;
+	const parsed = parsePackument(await opts.http.json(url));
+	if (!parsed) throw new Error(`getPackument: invalid packument response for "${name}" from ${url}`);
+	return parsed;
+}
+/**
+* Fetch a version's package.json via the jsDelivr CDN.
+*
+* Uses split-encode for scoped names so `cdn.jsdelivr.net` receives the literal
+* `/` between scope and name (not `%2F` which causes 400s).
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
+async function getVersionManifest(name, version, options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const cdnPath = buildCdnPath(name, version);
+	const url = `${CDN_JSDELIVR}/npm/${cdnPath}`;
+	return opts.http.json(url);
+}
+/**
+* Fetch last-week download counts for a package from the npm downloads API.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
+async function getWeeklyDownloads(name, options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const url = `${NPM_DOWNLOADS_API}/downloads/point/last-week/${encodeRegistryName(name)}`;
+	return opts.http.json(url);
+}
+/**
+* Return true when `versionEntry.dist.attestations` is present — indicating a
+* SLSA provenance attestation was produced for this version.
+*/
+function hasProvenance(versionEntry) {
+	return !!versionEntry.dist?.attestations;
+}
+/**
+* Return `true` when `version` of `name` is already published to the registry.
+* Authoritative — reads the packument's `versions` map rather than a CDN, so a
+* pre-publish guard never false-negatives on CDN lag (the asymmetric-cost case:
+* a wrong "not published" invites a duplicate-version publish attempt). Returns
+* `false` when the package does not exist or the packument fetch fails.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
+*/
+async function isVersionPublished(name, version, options) {
+	try {
+		return (await getPackument(name, options)).versions[version] !== void 0;
+	} catch {
+		return false;
+	}
+}
+/**
+* Parse a raw packument JSON response into a typed `PackumentRecord`.
+* Adds the `distTags` alias for `dist-tags` so callers don't need bracket
+* notation. Returns `undefined` when the input is not a valid packument shape.
+*/
+function parsePackument(raw) {
+	if (raw === void 0 || raw === null || typeof raw !== "object" || !("versions" in raw) || !("dist-tags" in raw)) return;
+	const rec = raw;
+	return {
+		"dist-tags": rec["dist-tags"] ?? {},
+		distTags: rec["dist-tags"] ?? {},
+		name: typeof rec.name === "string" ? rec.name : "",
+		time: rec.time,
+		versions: rec.versions ?? {}
+	};
+}
+/**
+* Parse an npm transparency-log attestation bundle (the JSON returned from
+* `registry.npmjs.org/-/npm/v1/attestations/<pkg>@<ver>`) and extract the
+* SLSA provenance predicate.
+*
+* Returns the first SLSA provenance v1 predicate found, or `undefined` when
+* none is present or the bundle is malformed.
+*/
+function parseProvenancePredicate(bundle) {
+	if (bundle === void 0 || bundle === null || typeof bundle !== "object" || !("attestations" in bundle) || !Array.isArray(bundle.attestations)) return;
+	const { attestations } = bundle;
+	/* c8 ignore start - the prior Array.isArray guard above already narrows
+	* `attestations` to a real array; even an empty array is truthy, so this
+	* falsy-check can never take its true branch at runtime. Kept only to
+	* satisfy the optional `attestations?: ... | undefined` field type. */
+	if (!attestations) return;
+	/* c8 ignore stop */
+	for (const entry of attestations) {
+		if (entry.predicateType !== SLSA_PROVENANCE_TYPE) continue;
+		const b = entry.bundle;
+		if (b === void 0 || b === null || typeof b !== "object") continue;
+		const verificationMaterial = b.verificationMaterial;
+		if (verificationMaterial === void 0 || verificationMaterial === null || typeof verificationMaterial !== "object") continue;
+		const content = verificationMaterial.content;
+		if (typeof content !== "string") continue;
+		let parsed;
+		try {
+			parsed = JSON.parse(content);
+		} catch {
+			continue;
+		}
+		if (parsed === void 0 || parsed === null || typeof parsed !== "object") continue;
+		const envelope = parsed;
+		if (typeof envelope.payload !== "string") continue;
+		let payload;
+		try {
+			payload = JSON.parse(atob(envelope.payload));
+		} catch {
+			continue;
+		}
+		if (payload === void 0 || payload === null || typeof payload !== "object") continue;
+		const statement = payload;
+		if (statement.predicate === void 0 || statement.predicate === null || typeof statement.predicate !== "object") continue;
+		return statement.predicate;
+	}
+}
+
+//#endregion
+exports.buildCdnPath = buildCdnPath;
+exports.detectTrustedPublisher = detectTrustedPublisher;
+exports.encodeCdnName = encodeCdnName;
+exports.encodePackageName = encodePackageName;
+exports.encodeRegistryName = encodeRegistryName;
+exports.getAttestations = getAttestations;
+exports.getOrgPackages = getOrgPackages;
+exports.getPackument = getPackument;
+exports.getVersionManifest = getVersionManifest;
+exports.getWeeklyDownloads = getWeeklyDownloads;
+exports.hasProvenance = hasProvenance;
+exports.isVersionPublished = isVersionPublished;
+exports.parsePackument = parsePackument;
+exports.parseProvenancePredicate = parseProvenancePredicate;

package/dist/objects/getters.d.ts

@@ -1,6 +1,6 @@
 /**
  * @file Lazy-getter primitives + `createConstantsObject`.
- *   `createConstantsObject` is the most-used factory in this module — fleet
+ *   `createConstantsObject` is the most-used factory in this module — Socket
  *   repos use it to assemble frozen settings objects with a mix of eager
  *   values, lazy-computed values, and internals reachable through
  *   `kInternalsSymbol`. The `defineLazyGetter*` helpers underneath are the

package/dist/objects/getters.js

@@ -10,7 +10,7 @@ const require_objects_sort = require('./sort.js');
 //#region src/objects/getters.ts
 /**
 * @file Lazy-getter primitives + `createConstantsObject`.
-*   `createConstantsObject` is the most-used factory in this module — fleet
+*   `createConstantsObject` is the most-used factory in this module — Socket
 *   repos use it to assemble frozen settings objects with a mix of eager
 *   values, lazy-computed values, and internals reachable through
 *   `kInternalsSymbol`. The `defineLazyGetter*` helpers underneath are the

package/dist/objects/predicates.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_arrays_predicates = require('../arrays/predicates.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_arrays_predicates = require('../arrays/predicates.js');
 
 //#region src/objects/predicates.ts
 /**

package/dist/packages/exports.js

@@ -2,11 +2,11 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_primordials_error = require('../primordials/error.js');
-const require_arrays_predicates = require('../arrays/predicates.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_primordials_string = require('../primordials/string.js');
+const require_arrays_predicates = require('../arrays/predicates.js');
 const require_objects_predicates = require('../objects/predicates.js');
 const require_primordials_map_set = require('../primordials/map-set.js');
-const require_primordials_string = require('../primordials/string.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_constants_sentinels = require('../constants/sentinels.js');
 

package/dist/packages/isolation.js

@@ -3,9 +3,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_error = require('../primordials/error.js');
-const require_constants_platform = require('../constants/platform.js');
 const require_primordials_object = require('../primordials/object.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_constants_platform = require('../constants/platform.js');
 const require_paths_conversion = require('../paths/conversion.js');
 const require_paths_predicates = require('../paths/predicates.js');
 const require_node_fs = require('../node/fs.js');

package/dist/packages/manifest.d.ts

@@ -32,3 +32,32 @@ export declare function fetchPackageManifest(pkgNameOrId: string, options?: Paco
  *   ```
  */
 export declare function fetchPackagePackument(pkgNameOrId: string, options?: PacoteOptions): Promise<unknown>;
+/**
+ * Dev/build-only top-level package.json fields not needed at runtime. The
+ * conservative default for {@link trimPublishManifest}; extend per-package via
+ * its `drop` option.
+ */
+export declare const DEFAULT_TRIM_FIELDS: readonly string[];
+export interface TrimPublishManifestOptions {
+    /**
+     * Top-level fields to omit (defaults to {@link DEFAULT_TRIM_FIELDS}).
+     */
+    readonly drop?: readonly string[] | undefined;
+    /**
+     * Fields to KEEP even when listed in `drop` (e.g. a runtime postinstall).
+     */
+    readonly keep?: readonly string[] | undefined;
+}
+/**
+ * Return a shallow copy of `manifest` that omits dev/build-only top-level
+ * fields so a published tarball + its npm metadata stay lean (npm caps total
+ * per-package metadata at 100 MB). The original object is left intact; persist
+ * the result only for the publish, never over the repo's own package.json.
+ *
+ * @example
+ *   ;```typescript
+ *   const lean = trimPublishManifest(pkg) // omits devDependencies + scripts
+ *   const kept = trimPublishManifest(pkg, { keep: ['scripts'] })
+ *   ```
+ */
+export declare function trimPublishManifest(manifest: PackageJson, options?: TrimPublishManifestOptions | undefined): PackageJson;

package/dist/packages/manifest.js

@@ -2,19 +2,18 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
-const require_arrays_predicates = require('../arrays/predicates.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_arrays_predicates = require('../arrays/predicates.js');
 const require_objects_predicates = require('../objects/predicates.js');
 const require_process_abort = require('../process/abort.js');
 const require_constants_socket = require('../constants/socket.js');
 const require_constants_packages = require('../constants/packages.js');
+const require_versions__internal = require('../versions/_internal.js');
 const require_objects_sort = require('../objects/sort.js');
 const require_packages_exports = require('./exports.js');
 const require_packages_validation = require('./validation.js');
 let src_external_npm_package_arg = require("../external/npm-package-arg");
 src_external_npm_package_arg = require_runtime.__toESM(src_external_npm_package_arg);
-let src_external_semver = require("../external/semver");
-src_external_semver = require_runtime.__toESM(src_external_semver);
 let src_external_pacote = require("../external/pacote");
 src_external_pacote = require_runtime.__toESM(src_external_pacote);
 
@@ -22,7 +21,6 @@ src_external_pacote = require_runtime.__toESM(src_external_pacote);
 /**
 * @file Package manifest and packument fetching utilities.
 */
-const abortSignal = require_process_abort.getAbortSignal();
 const packageDefaultNodeRange = require_constants_packages.getPackageDefaultNodeRange();
 const PACKAGE_DEFAULT_SOCKET_CATEGORIES = require_constants_packages.getPackageDefaultSocketCategories();
 const packumentCache = require_constants_packages.getPackumentCache();
@@ -72,8 +70,9 @@ function createPackageJson(sockRegPkgName, directory, options) {
 			if (strKey === "node") {
 				const { 1: range } = result;
 				if (typeof range === "string" && range && packageDefaultNodeRange) {
-					const coercedRange = src_external_semver.default.coerce(range);
-					if (!src_external_semver.default.satisfies(coercedRange?.version ?? "0.0.0", packageDefaultNodeRange)) result[1] = packageDefaultNodeRange;
+					const semver = require_versions__internal.getSemver();
+					const coercedRange = semver.coerce(range);
+					if (!semver.satisfies(coercedRange?.version ?? "0.0.0", packageDefaultNodeRange)) result[1] = packageDefaultNodeRange;
 				}
 			}
 			return result;
@@ -93,7 +92,7 @@ function createPackageJson(sockRegPkgName, directory, options) {
 async function fetchPackageManifest(pkgNameOrId, options) {
 	const pacoteOptions = {
 		__proto__: null,
-		signal: abortSignal,
+		signal: require_process_abort.getAbortSignal(),
 		...options,
 		packumentCache,
 		preferOffline: true
@@ -125,15 +124,51 @@ async function fetchPackagePackument(pkgNameOrId, options) {
 	try {
 		return await src_external_pacote.default.packument(pkgNameOrId, {
 			__proto__: null,
-			signal: abortSignal,
+			signal: require_process_abort.getAbortSignal(),
 			...options,
 			packumentCache,
 			preferOffline: true
 		});
 	} catch {}
 }
+/**
+* Dev/build-only top-level package.json fields not needed at runtime. The
+* conservative default for {@link trimPublishManifest}; extend per-package via
+* its `drop` option.
+*/
+const DEFAULT_TRIM_FIELDS = ["devDependencies", "scripts"];
+/**
+* Return a shallow copy of `manifest` that omits dev/build-only top-level
+* fields so a published tarball + its npm metadata stay lean (npm caps total
+* per-package metadata at 100 MB). The original object is left intact; persist
+* the result only for the publish, never over the repo's own package.json.
+*
+* @example
+*   ;```typescript
+*   const lean = trimPublishManifest(pkg) // omits devDependencies + scripts
+*   const kept = trimPublishManifest(pkg, { keep: ['scripts'] })
+*   ```
+*/
+function trimPublishManifest(manifest, options) {
+	const opts = {
+		__proto__: null,
+		...options
+	};
+	const drop = new Set(opts.drop ?? DEFAULT_TRIM_FIELDS);
+	const keep = new Set(opts.keep ?? []);
+	const source = manifest;
+	const keys = require_primordials_object.ObjectKeys(source);
+	const out = {};
+	for (let i = 0, { length } = keys; i < length; i += 1) {
+		const key = keys[i];
+		if (!drop.has(key) || keep.has(key)) out[key] = source[key];
+	}
+	return out;
+}
 
 //#endregion
+exports.DEFAULT_TRIM_FIELDS = DEFAULT_TRIM_FIELDS;
 exports.createPackageJson = createPackageJson;
 exports.fetchPackageManifest = fetchPackageManifest;
-exports.fetchPackagePackument = fetchPackagePackument;
+exports.fetchPackagePackument = fetchPackagePackument;
+exports.trimPublishManifest = trimPublishManifest;

package/dist/packages/metadata-extensions.js

@@ -1,11 +1,9 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_objects_mutate = require('../objects/mutate.js');
 const require_constants_packages = require('../constants/packages.js');
-let src_external_semver = require("../external/semver");
-src_external_semver = require_runtime.__toESM(src_external_semver);
+const require_versions__internal = require('../versions/_internal.js');
 
 //#region src/packages/metadata-extensions.ts
 /**
@@ -30,7 +28,7 @@ function findPackageExtensions(pkgName, pkgVer) {
 		const lastAtSignIndex = selector.lastIndexOf("@");
 		if (pkgName === selector.slice(0, lastAtSignIndex)) {
 			const range = selector.slice(lastAtSignIndex + 1);
-			if (src_external_semver.satisfies(pkgVer, range)) {
+			if (require_versions__internal.getSemver().satisfies(pkgVer, range)) {
 				if (result === void 0) result = {};
 				if (typeof ext === "object" && ext !== null) require_objects_mutate.merge(result, ext);
 			}

package/dist/packages/normalize.js

@@ -6,8 +6,8 @@ const require_primordials_object = require('../primordials/object.js');
 const require_primordials_string = require('../primordials/string.js');
 const require_primordials_regexp = require('../primordials/regexp.js');
 const require_primordials_array = require('../primordials/array.js');
-const require_objects_mutate = require('../objects/mutate.js');
 const require_constants_socket = require('../constants/socket.js');
+const require_objects_mutate = require('../objects/mutate.js');
 const require_regexps_escape = require('../regexps/escape.js');
 const require_packages_metadata_extensions = require('./metadata-extensions.js');
 let src_external_normalize_package_data = require("../external/normalize-package-data");

package/dist/packages/provenance.d.ts

@@ -5,6 +5,8 @@ import type { ProvenanceOptions } from './types';
 /**
  * Comparator ordering two trust statuses by ascending trust level. Sorts an
  * array of statuses lowest-trust-first; negate for highest-first.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function compareTrust(a: TrustStatus, b: TrustStatus): -1 | 0 | 1;
 /**
@@ -12,6 +14,8 @@ export declare function compareTrust(a: TrustStatus, b: TrustStatus): -1 | 0 | 1
  * regressed its supply-chain posture. Drives the post-publish provenance
  * reminder: a version that drops from trustedPublisher back to bare provenance
  * is a red flag worth surfacing.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function didTrustDecrease(prev: TrustStatus, next: TrustStatus): boolean;
 /**
@@ -48,6 +52,8 @@ export declare function getProvenanceDetails(attestationData: unknown): unknown;
 export declare function getTrustLevel(status: TrustStatus): TrustLevel;
 /**
  * Map a trust status to its human-readable level name.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function getTrustLevelName(status: TrustStatus): TrustLevelName;
 /**
@@ -59,6 +65,8 @@ export declare function getTrustLevelName(status: TrustStatus): TrustLevelName;
  * 2FA-gated approve step. That signal ranks ABOVE both `trustedPublisher` and
  * `provenance` in pnpm's trust-evidence ladder, because it adds a human
  * approval gate on top of the OIDC publisher identity.
+ *
+ * @unused No internal or Socket consumers (exercised only by its unit tests).
  */
 export declare function getTrustStatus(meta: unknown): TrustStatus;
 /**

package/dist/packages/provenance.js

@@ -3,10 +3,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_buffer = require('../primordials/buffer.js');
-const require_abort_signal = require('../abort/signal.js');
 const require_primordials_object = require('../primordials/object.js');
-const require_objects_predicates = require('../objects/predicates.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_abort_signal = require('../abort/signal.js');
+const require_objects_predicates = require('../objects/predicates.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_primordials_json = require('../primordials/json.js');
 const require_constants_agents = require('../constants/agents.js');
@@ -25,6 +25,8 @@ let cachedFetcher;
 /**
 * Comparator ordering two trust statuses by ascending trust level. Sorts an
 * array of statuses lowest-trust-first; negate for highest-first.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function compareTrust(a, b) {
 	const levelA = getTrustLevel(a);
@@ -38,6 +40,8 @@ function compareTrust(a, b) {
 * regressed its supply-chain posture. Drives the post-publish provenance
 * reminder: a version that drops from trustedPublisher back to bare provenance
 * is a red flag worth surfacing.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function didTrustDecrease(prev, next) {
 	return getTrustLevel(next) < getTrustLevel(prev);
@@ -152,6 +156,8 @@ function getTrustLevel(status) {
 }
 /**
 * Map a trust status to its human-readable level name.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function getTrustLevelName(status) {
 	return TRUST_LEVELS[getTrustLevel(status)];
@@ -165,6 +171,8 @@ function getTrustLevelName(status) {
 * 2FA-gated approve step. That signal ranks ABOVE both `trustedPublisher` and
 * `provenance` in pnpm's trust-evidence ladder, because it adds a human
 * approval gate on top of the OIDC publisher identity.
+*
+* @unused No internal or Socket consumers (exercised only by its unit tests).
 */
 function getTrustStatus(meta) {
 	const status = {

package/dist/packages/specs.js

@@ -2,8 +2,8 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
-const require_objects_predicates = require('../objects/predicates.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_objects_predicates = require('../objects/predicates.js');
 const require_strings_predicates = require('../strings/predicates.js');
 const require_constants_socket = require('../constants/socket.js');
 const require_smol_purl = require('../smol/purl.js');

package/dist/packages/tarball.js

@@ -18,7 +18,6 @@ src_external_libnpmpack = require_runtime.__toESM(src_external_libnpmpack);
 *   spec into a tarball, both via pacote/libnpmpack with the shared packument
 *   cache.
 */
-const abortSignal = require_process_abort.getAbortSignal();
 const packumentCache = require_constants_packages.getPackumentCache();
 const pacoteCachePath = require_constants_packages.getPacoteCachePath();
 /**
@@ -68,7 +67,7 @@ async function packPackage(spec, options) {
 	/* c8 ignore start - External package registry packing */
 	return await (0, src_external_libnpmpack.default)(spec, {
 		__proto__: null,
-		signal: abortSignal,
+		signal: require_process_abort.getAbortSignal(),
 		...options,
 		packumentCache,
 		preferOffline: true

package/dist/packages/validation.d.ts

@@ -1,16 +1,6 @@
 /**
  * @file Package name validation utilities.
  */
-/**
- * Check if package name is a blessed Socket.dev package.
- *
- * @example
- *   ;```typescript
- *   isBlessedPackageName('@socketregistry/is-number') // true
- *   isBlessedPackageName('lodash') // false
- *   ```
- */
-export declare function isBlessedPackageName(name: unknown): boolean;
 /**
  * Check if a type string represents a registry fetcher type.
  *