@urbankitstudio/atlas 0.6.3 → 0.6.5

package/README.md

@@ -1,5 +1,7 @@
 # @urbankitstudio/atlas
 
+[![Socket Badge](https://badge.socket.dev/npm/package/@urbankitstudio/atlas)](https://socket.dev/npm/package/@urbankitstudio/atlas)
+
 JS SDK for the **UrbanKit County Parcel REST API Atlas** — a curated index of public ArcGIS REST endpoints for US county parcel data, with searchable field metadata, sample queries, and license info.
 
 Use it to:
@@ -132,12 +134,20 @@ Omit `?fips=` to get every tracked county in one call.
 
 ## Coverage today
 
-The atlas bundles **171 counties across all 50 US states** (174 verified endpoints), covering the largest counties in each. Call `listStates()` to enumerate the full set. Every state is now populated with at least one verified county endpoint.
+The atlas bundles **227 counties across all 50 US states** (241 verified endpoints), covering the largest counties in each. Call `listStates()` to enumerate the full set.
+
+Every state has at least one county on record, and 223 of the 227 carry a verified endpoint. The other 4 have `hasPublicRest: false` and an empty `endpoints` array, with `notes` recording the reason and who to contact. Those reasons vary: a subscription-only regional GIS partner, a statewide server that requires an auth token, a state with no county-level parcel authority. They ship rather than being omitted, so `findCounty()` still resolves them. **Check `hasPublicRest`** rather than assuming every county has an endpoint; `totals.countiesWithEndpoint` gives the queryable count directly.
 
 Counties are added as their public REST endpoints are verified. Package versions bump when data refreshes — pin to a minor range (`^0.x`) to receive new counties without breaking changes.
 
 The live, browseable atlas lives at [urbankitstudio.com/parcel-atlas](https://urbankitstudio.com/parcel-atlas).
 
+## Socket flags `urlStrings` — that's the atlas, not a leak
+
+[Socket](https://socket.dev/npm/package/@urbankitstudio/atlas)'s supply-chain scanner flags this package for `urlStrings`: code and data containing many literal URLs. That flag is doing its job correctly, and the answer is not to hide the URLs — **they are the product.** Every one is a public, government-run ArcGIS REST endpoint for county parcel data, plus the two `urbankitstudio.com` URLs this SDK references for live status (`LIVE_STATUS_URL`, above) and parcel-lookup deep links. The package does not call any of them itself; it hands them to you as data (`sideEffects: false`, zero runtime dependencies).
+
+Socket also flags `unpopularPackage` — a download-count signal, not a code issue, that install growth resolves on its own.
+
 ## License
 
 MIT — see [LICENSE](./LICENSE). © 2026 UrbanKit Studio.

package/data/california.json

@@ -218,7 +218,7 @@
           "status": "restricted",
           "basis": {
             "type": "county_cited_statute",
-            "note": "Every row's OwnerName value is the literal string \"Protected Per CA Gov Code 7928.205\" rather than a name. The county applies the redaction server-side to the whole layer and cites that section itself. The section protects the home address of elected and appointed officials, so this is the county's own reading applied to every parcel, not a statewide rule: San Diego County publishes owner names on its public layer.",
+            "note": "Every row's OwnerName value is the literal string \"Protected Per CA Gov Code 7928.205\" rather than a name. The county applies the redaction server-side to the whole layer and cites that section itself. The section protects the home address of elected and appointed officials, so this is the county's own reading applied to every parcel, not a statewide rule. Read narrowly, the section would cover a small number of parcels. The county applies it to every one.",
             "citation": "Cal. Gov. Code 7928.205",
             "attributedTo": "San Bernardino County",
             "sourceUrl": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=7928.205&lawCode=GOV"
@@ -271,7 +271,7 @@
         "url": "https://gis-public.sandiegocounty.gov/",
         "email": null
       },
-      "notes": "16 fields confirmed 2026-09-03 on the County of San Diego's public parcel layer (service copyright 'SanGIS, County of San Diego Assessor', service description 'County of San Diego Assessors Parcels (PARCELS_ALL) redacted for public use', ~1.09M rows, maxRecordCount 1000, native State Plane feet, add outSR=4326 for lon/lat): APN, APN_8, SITUS_ADDRESS (house number), SITUS_PRE_DIR, SITUS_STREET, SITUS_SUFFIX, SITUS_POST_DIR, SITUS_FRACTION, SITUS_BUILDING, SITUS_SUITE, SITUS_ZIP, SITUS_JURIS, ACREAGE, QUAL_CLASS_SHAPE and geometry. No owner name, mailing address, sale date, value or community name: the county redacts them on every public derivative. Until 2026-09-03 this entry pointed at the City of San Diego's GeocoderMerged/MapServer/1 (65 fields including OWN_NAME1-3 and OWN_ADDR1-4), which has answered ArcGIS error 500 'Service GeocoderMerged/MapServer not started' since 2026-09-02 20:45Z (autoheal #581); a made-up service name on that host errors differently, so the service exists and is stopped. If the city restarts it, it can return as the owner-bearing endpoint.",
+      "notes": "16 fields confirmed 2026-09-03 on the County of San Diego's public parcel layer (service copyright 'SanGIS, County of San Diego Assessor', service description 'County of San Diego Assessors Parcels (PARCELS_ALL) redacted for public use', ~1.09M rows, maxRecordCount 1000, native State Plane feet, add outSR=4326 for lon/lat): APN, APN_8, SITUS_ADDRESS (house number), SITUS_PRE_DIR, SITUS_STREET, SITUS_SUFFIX, SITUS_POST_DIR, SITUS_FRACTION, SITUS_BUILDING, SITUS_SUITE, SITUS_ZIP, SITUS_JURIS, ACREAGE, QUAL_CLASS_SHAPE and geometry. No owner name, mailing address, sale date, value or community name: the county redacts them on every public derivative. Until 2026-09-03 this entry pointed at the City of San Diego's GeocoderMerged/MapServer/1, which then served owner names (OWN_NAME1-3, OWN_ADDR1-4) and answered ArcGIS error 500 'Service GeocoderMerged/MapServer not started' from 2026-09-02 20:45Z (autoheal #581); a made-up service name on that host errored differently, so the service existed and was stopped. Probed 2026-09-17: the city service is RUNNING again, reports 56 fields, and no longer serves owner names. Asking it for OWN_NAME1/2/3 returns ArcGIS error 400 'Failed to execute query' while the identical request for APN and ASR_TOTAL returns a feature, so the field was withdrawn rather than the service being down. It still reports displayFieldName 'OWN_NAME1' in every response, so a metadata-only or liveness-only check reads this endpoint as owner-bearing and healthy. Do not restore it as the owner source on a restart signal alone: ask for the field.",
       "capabilityOverrides": {
         "owner_name": {
           "status": "not_published",