{"service":"HALOWERK paketwerk","version":"1.0.0","currency":"USDC","network":"eip155:8453","network_name":"Base Mainnet","recipient":"0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E","payment_header":"PAYMENT-SIGNATURE","endpoints":[{"method":"POST","path":"/v1/package-versions","url":"https://paket.halowerk.com/v1/package-versions","tool":"package_versions","price_usdc":0.003,"price_model":"per_call","summary":"Get every published version of a package across npm, PyPI, Maven, Go, Cargo, NuGet and RubyGems in one schema — correctly ordered, with publication dates, the default version, deprecations and withdrawal reasons.","description":"Returns the full version history of a package from a single normalised schema that covers seven ecosystems. Versions are ordered by semantic version, not alphabetically and not in registry order, so 1.10.0 sorts after 1.9.0 — the mistake that quietly breaks naive comparisons. For each version you get the publication timestamp, whether it is the registry default, whether it is deprecated and the deprecation reason as the registry states it.","input_schema":{"type":"object","required":["system","name"],"additionalProperties":false,"properties":{"system":{"type":"string","enum":["npm","pypi","maven","go","cargo","nuget","rubygems"],"description":"The package ecosystem."},"name":{"type":"string","minLength":1,"maxLength":300,"description":"Package name. Maven uses groupId:artifactId, Go uses the module path."},"include_prereleases":{"type":"boolean","default":true,"description":"Whether pre-release versions appear in the list. They are counted either way."},"limit":{"type":"integer","minimum":1,"maximum":500,"default":200,"description":"How many versions to return, newest first."}}},"needs_history":false,"payment_required":true,"serviceName":"package_versions","tags":["packages","versions","sbom","dependencies"],"example_request":{"system":"npm","name":"express","include_prereleases":true,"limit":200},"requestExample":{"system":"npm","name":"express","include_prereleases":true,"limit":200},"outputSchema":{"type":"object"}},{"method":"POST","path":"/v1/package-freshness","url":"https://paket.halowerk.com/v1/package-freshness","tool":"package_freshness","price_usdc":0.003,"price_model":"per_call","summary":"Score how actively a package is maintained from its own release history — age of the current version, the usual gap between releases, whether that rhythm has broken down, and deprecation — with every threshold stated.","description":"Turns the release history of a package into a maintenance signal an agent can act on. Four measurements go in: the age in days of the newest stable release, the median gap between the last ten releases, the ratio of the current silence to that median, and whether the newest version is deprecated. Each maps to a component score and the components combine into a grade from A to E.","input_schema":{"type":"object","required":["system","name"],"additionalProperties":false,"properties":{"system":{"type":"string","enum":["npm","pypi","maven","go","cargo","nuget","rubygems"]},"name":{"type":"string","minLength":1,"maxLength":300},"include_prereleases":{"type":"boolean","default":false,"description":"Whether pre-releases count as releases for the rhythm. Off by default: a nightly build stream would mask a dormant stable line."}}},"needs_history":false,"payment_required":true,"serviceName":"package_freshness","tags":["packages","maintenance","risk","dependencies"],"example_request":{"system":"npm","name":"express","include_prereleases":false},"requestExample":{"system":"npm","name":"express","include_prereleases":false},"outputSchema":{"type":"object"}},{"method":"POST","path":"/v1/lifecycle-check","url":"https://paket.halowerk.com/v1/lifecycle-check","tool":"lifecycle_check","price_usdc":0.003,"price_model":"per_call","summary":"Find out how long a runtime, database or operating system version is still supported — days remaining, the end-of-life and end-of-active-support dates, and the newest release line that is still maintained.","description":"Answers the question an agent actually has about a product cycle: for the version in use, is support over, how many days remain, and where should it move.","input_schema":{"type":"object","required":["product"],"additionalProperties":false,"properties":{"product":{"type":"string","minLength":1,"maxLength":80,"description":"Product identifier as used by endoflife.date, e.g. nodejs, python, postgresql, ubuntu, debian, redis."},"version":{"type":"string","maxLength":40,"description":"The version in use, e.g. 20.11.1. Without it every cycle is returned."}}},"needs_history":false,"payment_required":true,"serviceName":"lifecycle_check","tags":["eol","lifecycle","compliance","upgrade"],"example_request":{"product":"nodejs","version":"20.11.1"},"requestExample":{"product":"nodejs","version":"20.11.1"},"outputSchema":{"type":"object"}},{"method":"POST","path":"/v1/dependency-graph","url":"https://paket.halowerk.com/v1/dependency-graph","tool":"dependency_graph","price_usdc":0.005,"price_model":"per_call","summary":"Resolve the full transitive dependency tree of a package version with each node placed at its true depth, direct and indirect counts, duplicate versions of the same package, and the edges with their version requirements.","description":"Returns the resolved dependency graph of one package version across seven ecosystems: every node with its ecosystem, name, resolved version, whether it is bundled, and its depth from the root. Depth is computed as the shortest path from the root by breadth-first search — a depth-first walk loops forever on a cyclic graph and recursion overflows the stack on large trees, so neither is used.","input_schema":{"type":"object","required":["system","name"],"additionalProperties":false,"properties":{"system":{"type":"string","enum":["npm","pypi","maven","go","cargo","nuget","rubygems"]},"name":{"type":"string","minLength":1,"maxLength":300},"version":{"type":"string","maxLength":60,"description":"The version to resolve. Without it the registry default version is used."},"max_nodes":{"type":"integer","minimum":10,"maximum":3000,"default":800},"include_edges":{"type":"boolean","default":true}}},"needs_history":false,"payment_required":true,"serviceName":"dependency_graph","tags":["dependencies","graph","sbom","packages"],"example_request":{"system":"npm","name":"express","version":"4.18.2","max_nodes":800,"include_edges":true},"requestExample":{"system":"npm","name":"express","version":"4.18.2","max_nodes":800,"include_edges":true},"outputSchema":{"type":"object"}},{"method":"POST","path":"/v1/upgrade-path","url":"https://paket.halowerk.com/v1/upgrade-path","tool":"upgrade_path","price_usdc":0.004,"price_model":"per_call","summary":"Plan the upgrade from an installed version to a target as a sequence of testable steps that never skips a major version, with the release date, the number of versions crossed and the deprecation state of each stop.","description":"Turns \"we are on 2.4.1 and want to be current\" into an ordered list of stops. The rule it enforces is that no major version is skipped: going from 2 to 5 means stopping at the last release of 3 and the last release of 4, because that is where the migration notes live and where the warnings about the next major are published.","input_schema":{"type":"object","required":["system","name","from_version"],"additionalProperties":false,"properties":{"system":{"type":"string","enum":["npm","pypi","maven","go","cargo","nuget","rubygems"]},"name":{"type":"string","minLength":1,"maxLength":300},"from_version":{"type":"string","minLength":1,"maxLength":60,"description":"The version currently installed."},"to_version":{"type":"string","maxLength":60,"description":"Target version. Defaults to the newest stable release."},"include_prereleases":{"type":"boolean","default":false}}},"needs_history":false,"payment_required":true,"serviceName":"upgrade_path","tags":["upgrade","versions","packages","migration"],"example_request":{"system":"npm","name":"express","from_version":"4.16.0","include_prereleases":false},"requestExample":{"system":"npm","name":"express","from_version":"4.16.0","include_prereleases":false},"outputSchema":{"type":"object"}},{"method":"POST","path":"/v1/dependency-bloat","url":"https://paket.halowerk.com/v1/dependency-bloat","tool":"dependency_bloat","price_usdc":0.005,"price_model":"per_call","summary":"Measure the weight a package adds to a project — total transitive nodes, depth, duplicated versions and fan-out — and name the single direct dependency that drags in the most of it.","description":"Scores how much a package costs to depend on, using the resolved graph rather than a guess. Four measurements: the number of transitive nodes, the maximum depth, how many packages appear at more than one version, and the fan-out of the root. From those comes a grade from A to E with every threshold returned, so the judgement can be recomputed with different weights.","input_schema":{"type":"object","required":["system","name"],"additionalProperties":false,"properties":{"system":{"type":"string","enum":["npm","pypi","maven","go","cargo","nuget","rubygems"]},"name":{"type":"string","minLength":1,"maxLength":300},"version":{"type":"string","maxLength":60}}},"needs_history":false,"payment_required":true,"serviceName":"dependency_bloat","tags":["dependencies","risk","packages","supply-chain"],"example_request":{"system":"npm","name":"express","version":"4.18.2"},"requestExample":{"system":"npm","name":"express","version":"4.18.2"},"outputSchema":{"type":"object"}},{"method":"POST","path":"/v1/artifact-hash","url":"https://paket.halowerk.com/v1/artifact-hash","tool":"artifact_hash","price_usdc":0.003,"price_model":"per_call","summary":"Identify which published package version a file hash belongs to, across npm, PyPI, Maven, Go, Cargo, NuGet and RubyGems — for artefacts that turned up without provenance.","description":"Takes a file digest and answers which released package version it is. Useful for an artefact found in a container layer, a build directory or an attachment with no metadata attached. Hex and base64 input are both accepted and normalised, the digest length is checked against the declared algorithm before anything is fetched, and the response names every matching package version, since one artefact can be published under more than one coordinate.","input_schema":{"type":"object","required":["hash"],"additionalProperties":false,"properties":{"hash":{"type":"string","minLength":16,"maxLength":200,"description":"The digest, hex or base64."},"algorithm":{"type":"string","enum":["SHA1","SHA256","SHA512","MD5"],"default":"SHA1","description":"Digest algorithm. SHA1 is what most registries publish for archives."}}},"needs_history":false,"payment_required":true,"serviceName":"artifact_hash","tags":["hash","provenance","supply-chain","packages"],"example_request":{"hash":"3fabe08296e930c796c19e3c516979386ba9fd59","algorithm":"SHA1"},"requestExample":{"hash":"3fabe08296e930c796c19e3c516979386ba9fd59","algorithm":"SHA1"},"outputSchema":{"type":"object"}},{"method":"POST","path":"/v1/package-match","url":"https://paket.halowerk.com/v1/package-match","tool":"package_match","price_usdc":0.004,"price_model":"per_call","summary":"Find out whether packages in different ecosystems come from the same source project, and list every package an npm, PyPI, Maven, Go, Cargo, NuGet or RubyGems name declares a link to.","description":"Resolves a package to the source projects it declares, with the provenance of each link stated. This is the honest way to answer whether two packages belong together: names repeat across ecosystems and mean different things there, and that gap is exactly what dependency confusion attacks aim at.","input_schema":{"type":"object","required":["system","name"],"additionalProperties":false,"properties":{"system":{"type":"string","enum":["npm","pypi","maven","go","cargo","nuget","rubygems"]},"name":{"type":"string","minLength":1,"maxLength":300},"version":{"type":"string","maxLength":60,"description":"Defaults to the registry default version."},"compare_system":{"type":"string","enum":["npm","pypi","maven","go","cargo","nuget","rubygems"],"description":"Second package to compare against."},"compare_name":{"type":"string","maxLength":300}}},"needs_history":false,"payment_required":true,"serviceName":"package_match","tags":["packages","provenance","supply-chain","sbom"],"example_request":{"system":"npm","name":"express","compare_system":"pypi","compare_name":"requests"},"requestExample":{"system":"npm","name":"express","compare_system":"pypi","compare_name":"requests"},"outputSchema":{"type":"object"}},{"method":"POST","path":"/v1/deprecation-monitor","url":"https://paket.halowerk.com/v1/deprecation-monitor","tool":"deprecation_monitor","price_usdc":0.004,"price_model":"per_call","summary":"Watch a list of packages and get told what changed since your last check — newly deprecated packages and versions, withdrawals that were taken back, and new releases on a deprecated line.","description":"A monitor with memory. The first call stores a snapshot of the packages you name and returns the baseline, explicitly marked as such rather than reporting everything as new — a monitor that cries wolf on day one is not read on day two.","input_schema":{"type":"object","required":["packages"],"additionalProperties":false,"properties":{"packages":{"type":"array","minItems":1,"maxItems":50,"description":"The packages to watch.","items":{"type":"object","required":["system","name"],"additionalProperties":false,"properties":{"system":{"type":"string","enum":["npm","pypi","maven","go","cargo","nuget","rubygems"]},"name":{"type":"string","minLength":1,"maxLength":300}}}},"snapshot_token":{"type":"string","maxLength":80,"description":"Token from an earlier call. Without it a new baseline is created."}}},"needs_history":false,"payment_required":true,"serviceName":"deprecation_monitor","tags":["packages","deprecation","monitoring","supply-chain"],"example_request":{"packages":[{"system":"npm","name":"request"},{"system":"npm","name":"express"}]},"requestExample":{"packages":[{"system":"npm","name":"request"},{"system":"npm","name":"express"}]},"outputSchema":{"type":"object"}},{"method":"POST","path":"/v1/release-cadence","url":"https://paket.halowerk.com/v1/release-cadence","tool":"release_cadence","price_usdc":0.004,"price_model":"per_call","summary":"Detect changes in a package release rhythm — unusually long silences, sudden bursts and a shift in the underlying cadence — measured against the package own history rather than a cross-project average.","description":"Looks at when a package published, not how often, and reports where the pattern breaks. Three kinds of finding, which mean different things and are kept apart. A long gap: a silence several times the package own median interval, which suggests dormancy. A burst: several releases inside a short window, which is either emergency fixes or an automated publish loop that ran away, and the response gives the dates so the reader can tell.","input_schema":{"type":"object","required":["system","name"],"additionalProperties":false,"properties":{"system":{"type":"string","enum":["npm","pypi","maven","go","cargo","nuget","rubygems"]},"name":{"type":"string","minLength":1,"maxLength":300},"include_prereleases":{"type":"boolean","default":false},"sensitivity":{"type":"string","enum":["low","normal","high"],"default":"normal","description":"How far from the median counts as an anomaly. low = 5x median gap, normal = 3x, high = 2x."}}},"needs_history":false,"payment_required":true,"serviceName":"release_cadence","tags":["packages","anomaly","maintenance","supply-chain"],"example_request":{"system":"npm","name":"express","include_prereleases":false,"sensitivity":"normal"},"requestExample":{"system":"npm","name":"express","include_prereleases":false,"sensitivity":"normal"},"outputSchema":{"type":"object"}},{"method":"POST","path":"/v1/dependency-confusion","url":"https://paket.halowerk.com/v1/dependency-confusion","tool":"dependency_confusion","price_usdc":0.005,"price_model":"per_call","summary":"Check whether your internal package names also exist publicly, whether the public one is newer than yours, and how recently it appeared — the three things that decide a dependency confusion attack.","description":"Takes the names your organisation publishes internally and checks each against the public registry of the same ecosystem. Three findings, kept apart because they call for different actions. Name is free: nobody has taken it, the door is open but unattended, and the answer is to reserve the name yourself. Name is taken and old: probably an unrelated project that happens to share the name, worth confirming but rarely urgent.","input_schema":{"type":"object","required":["system","packages"],"additionalProperties":false,"properties":{"system":{"type":"string","enum":["npm","pypi","maven","go","cargo","nuget","rubygems"]},"packages":{"type":"array","minItems":1,"maxItems":60,"description":"Your internal package names, optionally with the internal version.","items":{"type":"object","required":["name"],"additionalProperties":false,"properties":{"name":{"type":"string","minLength":1,"maxLength":300},"internal_version":{"type":"string","maxLength":60}}}}}},"needs_history":false,"payment_required":true,"serviceName":"dependency_confusion","tags":["supply-chain","security","packages","risk"],"example_request":{"system":"npm","packages":[{"name":"express","internal_version":"1.0.0"},{"name":"my-internal-lib-xyz"}]},"requestExample":{"system":"npm","packages":[{"name":"express","internal_version":"1.0.0"},{"name":"my-internal-lib-xyz"}]},"outputSchema":{"type":"object"},"outputExample":{"system":"npm","checked":2,"urgent_count":0,"unclaimed_count":0,"results":[{"name":"express","risk":"unknown","reason":"Register nicht lesbar: Name nicht auflösbar: api.deps.dev"},{"name":"my-internal-lib-xyz","risk":"unknown","reason":"Register nicht lesbar: Name nicht auflösbar: api.deps.dev"}],"scope_note":"Namen werden genommen, wie sie uebergeben wurden. Ein Name unter einem Organisationsbereich ist ein anderer Name als der ungebundene — sie gleichzusetzen generated einen Fehlalarm bei jedem eigenen Paket.","decisive_factor":"Nicht das blosse Vorhandensein entscheidet, sondern welche Version der Aufloeser heightr findet.","meta":{"source":"deps.dev (Google Open Source Insights)","licence":"Die Rohdaten stammen aus den oeffentlichen Paketregistern; deps.dev stellt sie ohne Registrierung bereit. Angaben zu Lizenzen sind maschinell ermittelt und ersetzen keine Rechtsvalidation.","attribution":"Daten ueber deps.dev, Google Open Source Insights","source_timestamp":null,"retrieved_at":"2026-10-22T23:41:24.493Z","age_ms":0,"cache":"miss","coverage":"2 Namen","confidence":0.8,"warnings":["At least one name could not be checked; it is not treated as safe."]}}},{"method":"POST","path":"/v1/typosquat-radar","url":"https://paket.halowerk.com/v1/typosquat-radar","tool":"typosquat_radar","price_usdc":0.006,"price_model":"per_call","summary":"Find packages whose names are one typo away from yours and that actually exist — generated systematically rather than searched, with age, release count and shared source project so a real squat can be told from a coincidence.","description":"Generates the typical misspellings of a package name and looks up every one of them in the registry. Generation rather than search is deliberate: most of the seven ecosystems have no search API, and the ones that do rank by popularity instead of similarity, so a fresh squat with no downloads never appears.","input_schema":{"type":"object","required":["system","name"],"additionalProperties":false,"properties":{"system":{"type":"string","enum":["npm","pypi","maven","go","cargo","nuget","rubygems"]},"name":{"type":"string","minLength":3,"maxLength":120,"description":"The package name to protect."},"max_variants":{"type":"integer","minimum":5,"maximum":80,"default":45,"description":"How many generated variants to look up."},"recent_days":{"type":"integer","minimum":1,"maximum":3650,"default":365,"description":"A variant first published within this many days counts as recent, which is the strongest signal."}}},"needs_history":false,"payment_required":true,"serviceName":"typosquat_radar","tags":["supply-chain","security","packages","typosquat"],"example_request":{"system":"npm","name":"express","max_variants":45,"recent_days":365},"requestExample":{"system":"npm","name":"express","max_variants":45,"recent_days":365},"outputSchema":{"type":"object"},"outputExample":{"package":{"system":"npm","name":"express","source_project":null},"variants_checked":36,"variants_possible":36,"variants_skipped":0,"sweep_complete":true,"hits":[],"hit_count":0,"high_priority":0,"method":"Vertipper werden generated und nachgeschlagen, nicht gesucht: eine Suche sortiert nach Beliebtheit, und ein frischer Nachbau hat keine.","not_an_accusation":"Ein Match ist kein Vorwurf. Zwei Projekte koennen unabhaengig aehnlich heissen — entscheidend sind Alter, value der Versionen und das Quellprojekt.","meta":{"source":"deps.dev (Google Open Source Insights)","licence":"Die Rohdaten stammen aus den oeffentlichen Paketregistern; deps.dev stellt sie ohne Registrierung bereit. Angaben zu Lizenzen sind maschinell ermittelt und ersetzen keine Rechtsvalidation.","attribution":"Daten ueber deps.dev, Google Open Source Insights","source_timestamp":null,"retrieved_at":"2026-10-22T23:41:24.589Z","age_ms":0,"cache":"miss","coverage":"36 Varianten","confidence":1,"warnings":["No source project is known for the original package, so projects cannot be compared."]}}},{"method":"POST","path":"/v1/runtime-compat","url":"https://paket.halowerk.com/v1/runtime-compat","tool":"runtime_compat","price_usdc":0.004,"price_model":"per_call","summary":"Read the operating system, CPU architecture and runtime requirements a package version declares, as one machine-readable matrix — and see clearly which of them the package simply does not state.","description":"Normalises what a package version declares about where it can run. For npm that is the engines, os and cpu fields plus the declared package type and whether native build scripts are present; for PyPI it is requires_python together with the operating system, implementation and Python version classifiers.","input_schema":{"type":"object","required":["system","name"],"additionalProperties":false,"properties":{"system":{"type":"string","enum":["npm","pypi"],"description":"Only npm and PyPI declare these fields machine-readably."},"name":{"type":"string","minLength":1,"maxLength":300},"version":{"type":"string","maxLength":60,"description":"Defaults to the latest version."},"target_runtime":{"type":"string","maxLength":40,"description":"Your runtime version, e.g. 20.11.1 for Node or 3.11 for Python."},"target_os":{"type":"string","maxLength":30,"description":"linux, darwin, win32 …"},"target_arch":{"type":"string","maxLength":20,"description":"x64, arm64 …"}}},"needs_history":false,"payment_required":true,"serviceName":"runtime_compat","tags":["packages","compatibility","runtime","platform"],"example_request":{"system":"npm","name":"express","version":"4.18.2","target_runtime":"20.11.1","target_os":"linux"},"requestExample":{"system":"npm","name":"express","version":"4.18.2","target_runtime":"20.11.1","target_os":"linux"},"outputSchema":{"type":"object"}},{"method":"POST","path":"/v1/maintainer-pulse","url":"https://paket.halowerk.com/v1/maintainer-pulse","tool":"maintainer_pulse","price_usdc":0.005,"price_model":"per_call","summary":"Condense the state of the project behind a package — last push, release rhythm, open issues, stars, forks and OpenSSF scorecard — into one maintenance signal that still works when the GitHub rate limit is exhausted.","description":"Answers whether the project behind a package is still alive, from two sources with different roles. deps.dev supplies stars, forks, open issue count, the declared licence and the OpenSSF scorecard without any rate limit or account.","input_schema":{"type":"object","required":["system","name"],"additionalProperties":false,"properties":{"system":{"type":"string","enum":["npm","pypi","maven","go","cargo","nuget","rubygems"]},"name":{"type":"string","minLength":1,"maxLength":300},"use_github":{"type":"boolean","default":true,"description":"Whether to try GitHub for push activity. Off makes the call faster and never rate-limited."}}},"needs_history":false,"payment_required":true,"serviceName":"maintainer_pulse","tags":["packages","maintenance","risk","governance"],"example_request":{"system":"npm","name":"express","use_github":true},"requestExample":{"system":"npm","name":"express","use_github":true},"outputSchema":{"type":"object"}}],"updated_at":"2026-11-13T11:50:15.729Z"}