v1.0.0: full rewrite as @scanii/core by rferreira · Pull Request #1 · scanii/scanii-node

rferreira · 2026-04-28T10:12:14Z

Summary

Full rewrite of the scanii-js skeleton (unpublishable monorepo with empty stubs) as a clean, single-package zero-dependency TypeScript SDK. Publishes as @scanii/core on npm at 1.0.0, replacing the placeholder 0.0.1 stub.

API surface mirrors scanii-java v8.0.0 translated to async/Promise TS — process, processAsync, fetch, retrieve, ping, createAuthToken, retrieveAuthToken, deleteAuthToken.
Errors:ScaniiError base, ScaniiAuthError (401/403), ScaniiRateLimitError (429, with retryAfter parsed from Retry-After).
Zero runtime deps. Native fetch + FormData + Blob + URLSearchParams. No axios, no node-fetch, no form-data, no undici.
Dual build: ESM + CJS + shipped .d.ts via tsup. Built artifacts: dist/index.cjs, dist/index.mjs, dist/index.d.ts, dist/index.d.mts.
Targets: Node 22+ and modern browsers (ES2022 + DOM).
API v2.2 throughout (skeleton was on v2.1).
Tests: Jest. Unit suite mocks global.fetch directly (no nock/undici). Integration suite hits scanii-cli at localhost:4000; uses the UUID 38DCC0C9-… inline fixture per workspace CLAUDE.md §5 (not EICAR — that gets quarantined on Windows / macOS runners).
CI:pr.yml on Node 22 + 24 across ubuntu / macos / windows, scanii-cli started via scanii/setup-cli-action@v1. release.yml triggered by release: published, publishes via OIDC trusted publishing on the npm GitHub environment, with --provenance.

Naming reminder

Package name on npm is @scanii/core — scoped, NOT unscoped scanii. The unscoped scanii name remains a deprecated 0.0.1 placeholder for squat-protection only and is not touched by this change. README has a one-line note pointing consumers from scanii to @scanii/core.

@scanii/react and @scanii/web are deferred — not touched here.

Out of scope (per packet)

Browser polyfills (Node 22+ and ES2022 browsers have everything natively).
React hooks / web components / monorepo / workspaces.
Retry logic, backoff, batch helpers, concurrency primitives — Principle 3.
Tag-pushing or release creation — Rafael's responsibility.

Test plan

npm ci clean install
npm run typecheck passes (strict TS, verbatimModuleSyntax, noUncheckedIndexedAccess)
npm run lint passes (eslint flat config, typescript-eslint recommended)
npm test — 32 tests pass (unit suite green; integration suite green against locally running scanii-cli, with documented self-skips for older cli builds missing the UUID signature / token-auth / callback delivery)
npm run build — emits dist/index.cjs (13 KB), dist/index.mjs (12 KB), index.d.ts (9 KB)
Smoke test: require('./dist/index.cjs') and dynamic-import('./dist/index.mjs') both resolve ScaniiClient, VERSION === "1.0.0"
Smoke test: end-to-end process() against a running scanii-cli — clean file returns findings: [], contentLength accurate
Reviewer: confirm GitHub npm environment is wired so the OIDC publish step can resolve at v1.0.0 tag time
Reviewer: spot-check that @scanii/core@0.0.1 placeholder will be cleanly superseded by v1.0.0 publish

🤖 Generated with Claude Code

Replaces the unpublishable scanii-js monorepo skeleton with a clean, single-package zero-dependency TypeScript SDK published as @scanii/core on npm. API mirrors scanii-java v8.0.0 translated to async/Promise-returning TS: process / processAsync / fetch / retrieve / ping / createAuthToken / retrieveAuthToken / deleteAuthToken. Error hierarchy: ScaniiError, ScaniiAuthError, ScaniiRateLimitError (with retryAfter). Native fetch + FormData + Blob — no polyfills, no runtime deps. ESM + CJS dual build via tsup with shipped .d.ts. Targets Node 22+ and modern browsers. Tests: jest unit suite mocking global.fetch + integration suite against scanii-cli (started via scanii/setup-cli-action@v1 in CI). Malware fixture is the UUID 38DCC0C9-... per workspace CLAUDE.md §5, generated inline (not committed). CI: pr.yml on Node 22+24 across ubuntu/macos/windows. release.yml publishes to npm via OIDC trusted publishing on release: published — does not create the GitHub Release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rferreira · 2026-04-28T10:16:28Z

+
+## 1.0.0 — Initial release
+
+First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.


Remove mention of scanii-js

rferreira · 2026-04-28T10:16:39Z

+
+First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.
+
+**Reference frozen at `scanii-java` v8.0.0.** Method names, response shape, and error hierarchy mirror the Java reference, translated to idiomatic TypeScript.


Remove reference to the Java SDK

rferreira · 2026-04-28T10:17:02Z

+- **scanii-cli** integration tests cover the cross-OS matrix (Linux / macOS / Windows on Node 22 + 24) without burning real Scanii credits.
+- **OIDC trusted publishing** with provenance attestation.
+
+### Migration


Remove migration for first release

Per PR review: scanii-js and the @scanii/core@0.0.1 placeholder are internal context, not consumer-facing release notes. Java reference is implementation detail. No migration path applies for a first release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rferreira · 2026-04-28T10:12:14Z

Summary

Full rewrite of the scanii-js skeleton (unpublishable monorepo with empty stubs) as a clean, single-package zero-dependency TypeScript SDK. Publishes as @scanii/core on npm at 1.0.0, replacing the placeholder 0.0.1 stub.

API surface mirrors scanii-java v8.0.0 translated to async/Promise TS — process, processAsync, fetch, retrieve, ping, createAuthToken, retrieveAuthToken, deleteAuthToken.
Errors:ScaniiError base, ScaniiAuthError (401/403), ScaniiRateLimitError (429, with retryAfter parsed from Retry-After).
Zero runtime deps. Native fetch + FormData + Blob + URLSearchParams. No axios, no node-fetch, no form-data, no undici.
Dual build: ESM + CJS + shipped .d.ts via tsup. Built artifacts: dist/index.cjs, dist/index.mjs, dist/index.d.ts, dist/index.d.mts.
Targets: Node 22+ and modern browsers (ES2022 + DOM).
API v2.2 throughout (skeleton was on v2.1).
Tests: Jest. Unit suite mocks global.fetch directly (no nock/undici). Integration suite hits scanii-cli at localhost:4000; uses the UUID 38DCC0C9-… inline fixture per workspace CLAUDE.md §5 (not EICAR — that gets quarantined on Windows / macOS runners).
CI:pr.yml on Node 22 + 24 across ubuntu / macos / windows, scanii-cli started via scanii/setup-cli-action@v1. release.yml triggered by release: published, publishes via OIDC trusted publishing on the npm GitHub environment, with --provenance.

Naming reminder

Package name on npm is @scanii/core — scoped, NOT unscoped scanii. The unscoped scanii name remains a deprecated 0.0.1 placeholder for squat-protection only and is not touched by this change. README has a one-line note pointing consumers from scanii to @scanii/core.

@scanii/react and @scanii/web are deferred — not touched here.

Out of scope (per packet)

Browser polyfills (Node 22+ and ES2022 browsers have everything natively).
React hooks / web components / monorepo / workspaces.
Retry logic, backoff, batch helpers, concurrency primitives — Principle 3.
Tag-pushing or release creation — Rafael's responsibility.

Test plan

npm ci clean install
npm run typecheck passes (strict TS, verbatimModuleSyntax, noUncheckedIndexedAccess)
npm run lint passes (eslint flat config, typescript-eslint recommended)
npm test — 32 tests pass (unit suite green; integration suite green against locally running scanii-cli, with documented self-skips for older cli builds missing the UUID signature / token-auth / callback delivery)
npm run build — emits dist/index.cjs (13 KB), dist/index.mjs (12 KB), index.d.ts (9 KB)
Smoke test: require('./dist/index.cjs') and dynamic-import('./dist/index.mjs') both resolve ScaniiClient, VERSION === "1.0.0"
Smoke test: end-to-end process() against a running scanii-cli — clean file returns findings: [], contentLength accurate
Reviewer: confirm GitHub npm environment is wired so the OIDC publish step can resolve at v1.0.0 tag time
Reviewer: spot-check that @scanii/core@0.0.1 placeholder will be cleanly superseded by v1.0.0 publish

🤖 Generated with Claude Code

Replaces the unpublishable scanii-js monorepo skeleton with a clean, single-package zero-dependency TypeScript SDK published as @scanii/core on npm. API mirrors scanii-java v8.0.0 translated to async/Promise-returning TS: process / processAsync / fetch / retrieve / ping / createAuthToken / retrieveAuthToken / deleteAuthToken. Error hierarchy: ScaniiError, ScaniiAuthError, ScaniiRateLimitError (with retryAfter). Native fetch + FormData + Blob — no polyfills, no runtime deps. ESM + CJS dual build via tsup with shipped .d.ts. Targets Node 22+ and modern browsers. Tests: jest unit suite mocking global.fetch + integration suite against scanii-cli (started via scanii/setup-cli-action@v1 in CI). Malware fixture is the UUID 38DCC0C9-... per workspace CLAUDE.md §5, generated inline (not committed). CI: pr.yml on Node 22+24 across ubuntu/macos/windows. release.yml publishes to npm via OIDC trusted publishing on release: published — does not create the GitHub Release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rferreira · 2026-04-28T10:16:28Z

+
+## 1.0.0 — Initial release
+
+First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.


Remove mention of scanii-js

rferreira · 2026-04-28T10:16:39Z

+
+First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.
+
+**Reference frozen at `scanii-java` v8.0.0.** Method names, response shape, and error hierarchy mirror the Java reference, translated to idiomatic TypeScript.


Remove reference to the Java SDK

rferreira · 2026-04-28T10:17:02Z

+- **scanii-cli** integration tests cover the cross-OS matrix (Linux / macOS / Windows on Node 22 + 24) without burning real Scanii credits.
+- **OIDC trusted publishing** with provenance attestation.
+
+### Migration


Remove migration for first release

Per PR review: scanii-js and the @scanii/core@0.0.1 placeholder are internal context, not consumer-facing release notes. Java reference is implementation detail. No migration path applies for a first release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rferreira · 2026-04-28T10:12:14Z

Summary

Full rewrite of the scanii-js skeleton (unpublishable monorepo with empty stubs) as a clean, single-package zero-dependency TypeScript SDK. Publishes as @scanii/core on npm at 1.0.0, replacing the placeholder 0.0.1 stub.

API surface mirrors scanii-java v8.0.0 translated to async/Promise TS — process, processAsync, fetch, retrieve, ping, createAuthToken, retrieveAuthToken, deleteAuthToken.
Errors:ScaniiError base, ScaniiAuthError (401/403), ScaniiRateLimitError (429, with retryAfter parsed from Retry-After).
Zero runtime deps. Native fetch + FormData + Blob + URLSearchParams. No axios, no node-fetch, no form-data, no undici.
Dual build: ESM + CJS + shipped .d.ts via tsup. Built artifacts: dist/index.cjs, dist/index.mjs, dist/index.d.ts, dist/index.d.mts.
Targets: Node 22+ and modern browsers (ES2022 + DOM).
API v2.2 throughout (skeleton was on v2.1).
Tests: Jest. Unit suite mocks global.fetch directly (no nock/undici). Integration suite hits scanii-cli at localhost:4000; uses the UUID 38DCC0C9-… inline fixture per workspace CLAUDE.md §5 (not EICAR — that gets quarantined on Windows / macOS runners).
CI:pr.yml on Node 22 + 24 across ubuntu / macos / windows, scanii-cli started via scanii/setup-cli-action@v1. release.yml triggered by release: published, publishes via OIDC trusted publishing on the npm GitHub environment, with --provenance.

Naming reminder

Package name on npm is @scanii/core — scoped, NOT unscoped scanii. The unscoped scanii name remains a deprecated 0.0.1 placeholder for squat-protection only and is not touched by this change. README has a one-line note pointing consumers from scanii to @scanii/core.

@scanii/react and @scanii/web are deferred — not touched here.

Out of scope (per packet)

Browser polyfills (Node 22+ and ES2022 browsers have everything natively).
React hooks / web components / monorepo / workspaces.
Retry logic, backoff, batch helpers, concurrency primitives — Principle 3.
Tag-pushing or release creation — Rafael's responsibility.

Test plan

npm ci clean install
npm run typecheck passes (strict TS, verbatimModuleSyntax, noUncheckedIndexedAccess)
npm run lint passes (eslint flat config, typescript-eslint recommended)
npm test — 32 tests pass (unit suite green; integration suite green against locally running scanii-cli, with documented self-skips for older cli builds missing the UUID signature / token-auth / callback delivery)
npm run build — emits dist/index.cjs (13 KB), dist/index.mjs (12 KB), index.d.ts (9 KB)
Smoke test: require('./dist/index.cjs') and dynamic-import('./dist/index.mjs') both resolve ScaniiClient, VERSION === "1.0.0"
Smoke test: end-to-end process() against a running scanii-cli — clean file returns findings: [], contentLength accurate
Reviewer: confirm GitHub npm environment is wired so the OIDC publish step can resolve at v1.0.0 tag time
Reviewer: spot-check that @scanii/core@0.0.1 placeholder will be cleanly superseded by v1.0.0 publish

🤖 Generated with Claude Code

Replaces the unpublishable scanii-js monorepo skeleton with a clean, single-package zero-dependency TypeScript SDK published as @scanii/core on npm. API mirrors scanii-java v8.0.0 translated to async/Promise-returning TS: process / processAsync / fetch / retrieve / ping / createAuthToken / retrieveAuthToken / deleteAuthToken. Error hierarchy: ScaniiError, ScaniiAuthError, ScaniiRateLimitError (with retryAfter). Native fetch + FormData + Blob — no polyfills, no runtime deps. ESM + CJS dual build via tsup with shipped .d.ts. Targets Node 22+ and modern browsers. Tests: jest unit suite mocking global.fetch + integration suite against scanii-cli (started via scanii/setup-cli-action@v1 in CI). Malware fixture is the UUID 38DCC0C9-... per workspace CLAUDE.md §5, generated inline (not committed). CI: pr.yml on Node 22+24 across ubuntu/macos/windows. release.yml publishes to npm via OIDC trusted publishing on release: published — does not create the GitHub Release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rferreira · 2026-04-28T10:16:28Z

+
+## 1.0.0 — Initial release
+
+First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.


Remove mention of scanii-js

rferreira · 2026-04-28T10:16:39Z

+
+First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.
+
+**Reference frozen at `scanii-java` v8.0.0.** Method names, response shape, and error hierarchy mirror the Java reference, translated to idiomatic TypeScript.


Remove reference to the Java SDK

rferreira · 2026-04-28T10:17:02Z

+- **scanii-cli** integration tests cover the cross-OS matrix (Linux / macOS / Windows on Node 22 + 24) without burning real Scanii credits.
+- **OIDC trusted publishing** with provenance attestation.
+
+### Migration


Remove migration for first release

Per PR review: scanii-js and the @scanii/core@0.0.1 placeholder are internal context, not consumer-facing release notes. Java reference is implementation detail. No migration path applies for a first release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rferreira · 2026-04-28T10:12:14Z

Summary

Full rewrite of the scanii-js skeleton (unpublishable monorepo with empty stubs) as a clean, single-package zero-dependency TypeScript SDK. Publishes as @scanii/core on npm at 1.0.0, replacing the placeholder 0.0.1 stub.

API surface mirrors scanii-java v8.0.0 translated to async/Promise TS — process, processAsync, fetch, retrieve, ping, createAuthToken, retrieveAuthToken, deleteAuthToken.
Errors:ScaniiError base, ScaniiAuthError (401/403), ScaniiRateLimitError (429, with retryAfter parsed from Retry-After).
Zero runtime deps. Native fetch + FormData + Blob + URLSearchParams. No axios, no node-fetch, no form-data, no undici.
Dual build: ESM + CJS + shipped .d.ts via tsup. Built artifacts: dist/index.cjs, dist/index.mjs, dist/index.d.ts, dist/index.d.mts.
Targets: Node 22+ and modern browsers (ES2022 + DOM).
API v2.2 throughout (skeleton was on v2.1).
Tests: Jest. Unit suite mocks global.fetch directly (no nock/undici). Integration suite hits scanii-cli at localhost:4000; uses the UUID 38DCC0C9-… inline fixture per workspace CLAUDE.md §5 (not EICAR — that gets quarantined on Windows / macOS runners).
CI:pr.yml on Node 22 + 24 across ubuntu / macos / windows, scanii-cli started via scanii/setup-cli-action@v1. release.yml triggered by release: published, publishes via OIDC trusted publishing on the npm GitHub environment, with --provenance.

Naming reminder

Package name on npm is @scanii/core — scoped, NOT unscoped scanii. The unscoped scanii name remains a deprecated 0.0.1 placeholder for squat-protection only and is not touched by this change. README has a one-line note pointing consumers from scanii to @scanii/core.

@scanii/react and @scanii/web are deferred — not touched here.

Out of scope (per packet)

Browser polyfills (Node 22+ and ES2022 browsers have everything natively).
React hooks / web components / monorepo / workspaces.
Retry logic, backoff, batch helpers, concurrency primitives — Principle 3.
Tag-pushing or release creation — Rafael's responsibility.

Test plan

npm ci clean install
npm run typecheck passes (strict TS, verbatimModuleSyntax, noUncheckedIndexedAccess)
npm run lint passes (eslint flat config, typescript-eslint recommended)
npm test — 32 tests pass (unit suite green; integration suite green against locally running scanii-cli, with documented self-skips for older cli builds missing the UUID signature / token-auth / callback delivery)
npm run build — emits dist/index.cjs (13 KB), dist/index.mjs (12 KB), index.d.ts (9 KB)
Smoke test: require('./dist/index.cjs') and dynamic-import('./dist/index.mjs') both resolve ScaniiClient, VERSION === "1.0.0"
Smoke test: end-to-end process() against a running scanii-cli — clean file returns findings: [], contentLength accurate
Reviewer: confirm GitHub npm environment is wired so the OIDC publish step can resolve at v1.0.0 tag time
Reviewer: spot-check that @scanii/core@0.0.1 placeholder will be cleanly superseded by v1.0.0 publish

🤖 Generated with Claude Code

Replaces the unpublishable scanii-js monorepo skeleton with a clean, single-package zero-dependency TypeScript SDK published as @scanii/core on npm. API mirrors scanii-java v8.0.0 translated to async/Promise-returning TS: process / processAsync / fetch / retrieve / ping / createAuthToken / retrieveAuthToken / deleteAuthToken. Error hierarchy: ScaniiError, ScaniiAuthError, ScaniiRateLimitError (with retryAfter). Native fetch + FormData + Blob — no polyfills, no runtime deps. ESM + CJS dual build via tsup with shipped .d.ts. Targets Node 22+ and modern browsers. Tests: jest unit suite mocking global.fetch + integration suite against scanii-cli (started via scanii/setup-cli-action@v1 in CI). Malware fixture is the UUID 38DCC0C9-... per workspace CLAUDE.md §5, generated inline (not committed). CI: pr.yml on Node 22+24 across ubuntu/macos/windows. release.yml publishes to npm via OIDC trusted publishing on release: published — does not create the GitHub Release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rferreira · 2026-04-28T10:16:28Z

+
+## 1.0.0 — Initial release
+
+First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.


Remove mention of scanii-js

rferreira · 2026-04-28T10:16:39Z

+
+First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.
+
+**Reference frozen at `scanii-java` v8.0.0.** Method names, response shape, and error hierarchy mirror the Java reference, translated to idiomatic TypeScript.


Remove reference to the Java SDK

rferreira · 2026-04-28T10:17:02Z

+- **scanii-cli** integration tests cover the cross-OS matrix (Linux / macOS / Windows on Node 22 + 24) without burning real Scanii credits.
+- **OIDC trusted publishing** with provenance attestation.
+
+### Migration


Remove migration for first release

Per PR review: scanii-js and the @scanii/core@0.0.1 placeholder are internal context, not consumer-facing release notes. Java reference is implementation detail. No migration path applies for a first release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rferreira · 2026-04-28T10:12:14Z

Summary

Full rewrite of the scanii-js skeleton (unpublishable monorepo with empty stubs) as a clean, single-package zero-dependency TypeScript SDK. Publishes as @scanii/core on npm at 1.0.0, replacing the placeholder 0.0.1 stub.

API surface mirrors scanii-java v8.0.0 translated to async/Promise TS — process, processAsync, fetch, retrieve, ping, createAuthToken, retrieveAuthToken, deleteAuthToken.
Errors:ScaniiError base, ScaniiAuthError (401/403), ScaniiRateLimitError (429, with retryAfter parsed from Retry-After).
Zero runtime deps. Native fetch + FormData + Blob + URLSearchParams. No axios, no node-fetch, no form-data, no undici.
Dual build: ESM + CJS + shipped .d.ts via tsup. Built artifacts: dist/index.cjs, dist/index.mjs, dist/index.d.ts, dist/index.d.mts.
Targets: Node 22+ and modern browsers (ES2022 + DOM).
API v2.2 throughout (skeleton was on v2.1).
Tests: Jest. Unit suite mocks global.fetch directly (no nock/undici). Integration suite hits scanii-cli at localhost:4000; uses the UUID 38DCC0C9-… inline fixture per workspace CLAUDE.md §5 (not EICAR — that gets quarantined on Windows / macOS runners).
CI:pr.yml on Node 22 + 24 across ubuntu / macos / windows, scanii-cli started via scanii/setup-cli-action@v1. release.yml triggered by release: published, publishes via OIDC trusted publishing on the npm GitHub environment, with --provenance.

Naming reminder

Package name on npm is @scanii/core — scoped, NOT unscoped scanii. The unscoped scanii name remains a deprecated 0.0.1 placeholder for squat-protection only and is not touched by this change. README has a one-line note pointing consumers from scanii to @scanii/core.

@scanii/react and @scanii/web are deferred — not touched here.

Out of scope (per packet)

Browser polyfills (Node 22+ and ES2022 browsers have everything natively).
React hooks / web components / monorepo / workspaces.
Retry logic, backoff, batch helpers, concurrency primitives — Principle 3.
Tag-pushing or release creation — Rafael's responsibility.

Test plan

npm ci clean install
npm run typecheck passes (strict TS, verbatimModuleSyntax, noUncheckedIndexedAccess)
npm run lint passes (eslint flat config, typescript-eslint recommended)
npm test — 32 tests pass (unit suite green; integration suite green against locally running scanii-cli, with documented self-skips for older cli builds missing the UUID signature / token-auth / callback delivery)
npm run build — emits dist/index.cjs (13 KB), dist/index.mjs (12 KB), index.d.ts (9 KB)
Smoke test: require('./dist/index.cjs') and dynamic-import('./dist/index.mjs') both resolve ScaniiClient, VERSION === "1.0.0"
Smoke test: end-to-end process() against a running scanii-cli — clean file returns findings: [], contentLength accurate
Reviewer: confirm GitHub npm environment is wired so the OIDC publish step can resolve at v1.0.0 tag time
Reviewer: spot-check that @scanii/core@0.0.1 placeholder will be cleanly superseded by v1.0.0 publish

🤖 Generated with Claude Code

Replaces the unpublishable scanii-js monorepo skeleton with a clean, single-package zero-dependency TypeScript SDK published as @scanii/core on npm. API mirrors scanii-java v8.0.0 translated to async/Promise-returning TS: process / processAsync / fetch / retrieve / ping / createAuthToken / retrieveAuthToken / deleteAuthToken. Error hierarchy: ScaniiError, ScaniiAuthError, ScaniiRateLimitError (with retryAfter). Native fetch + FormData + Blob — no polyfills, no runtime deps. ESM + CJS dual build via tsup with shipped .d.ts. Targets Node 22+ and modern browsers. Tests: jest unit suite mocking global.fetch + integration suite against scanii-cli (started via scanii/setup-cli-action@v1 in CI). Malware fixture is the UUID 38DCC0C9-... per workspace CLAUDE.md §5, generated inline (not committed). CI: pr.yml on Node 22+24 across ubuntu/macos/windows. release.yml publishes to npm via OIDC trusted publishing on release: published — does not create the GitHub Release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rferreira · 2026-04-28T10:16:28Z

+
+## 1.0.0 — Initial release
+
+First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.


Remove mention of scanii-js

rferreira · 2026-04-28T10:16:39Z

+
+First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.
+
+**Reference frozen at `scanii-java` v8.0.0.** Method names, response shape, and error hierarchy mirror the Java reference, translated to idiomatic TypeScript.


Remove reference to the Java SDK

rferreira · 2026-04-28T10:17:02Z

+- **scanii-cli** integration tests cover the cross-OS matrix (Linux / macOS / Windows on Node 22 + 24) without burning real Scanii credits.
+- **OIDC trusted publishing** with provenance attestation.
+
+### Migration


Remove migration for first release

Per PR review: scanii-js and the @scanii/core@0.0.1 placeholder are internal context, not consumer-facing release notes. Java reference is implementation detail. No migration path applies for a first release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rferreira · 2026-04-28T10:12:14Z

Summary

Full rewrite of the scanii-js skeleton (unpublishable monorepo with empty stubs) as a clean, single-package zero-dependency TypeScript SDK. Publishes as @scanii/core on npm at 1.0.0, replacing the placeholder 0.0.1 stub.

API surface mirrors scanii-java v8.0.0 translated to async/Promise TS — process, processAsync, fetch, retrieve, ping, createAuthToken, retrieveAuthToken, deleteAuthToken.
Errors:ScaniiError base, ScaniiAuthError (401/403), ScaniiRateLimitError (429, with retryAfter parsed from Retry-After).
Zero runtime deps. Native fetch + FormData + Blob + URLSearchParams. No axios, no node-fetch, no form-data, no undici.
Dual build: ESM + CJS + shipped .d.ts via tsup. Built artifacts: dist/index.cjs, dist/index.mjs, dist/index.d.ts, dist/index.d.mts.
Targets: Node 22+ and modern browsers (ES2022 + DOM).
API v2.2 throughout (skeleton was on v2.1).
Tests: Jest. Unit suite mocks global.fetch directly (no nock/undici). Integration suite hits scanii-cli at localhost:4000; uses the UUID 38DCC0C9-… inline fixture per workspace CLAUDE.md §5 (not EICAR — that gets quarantined on Windows / macOS runners).
CI:pr.yml on Node 22 + 24 across ubuntu / macos / windows, scanii-cli started via scanii/setup-cli-action@v1. release.yml triggered by release: published, publishes via OIDC trusted publishing on the npm GitHub environment, with --provenance.

Naming reminder

Package name on npm is @scanii/core — scoped, NOT unscoped scanii. The unscoped scanii name remains a deprecated 0.0.1 placeholder for squat-protection only and is not touched by this change. README has a one-line note pointing consumers from scanii to @scanii/core.

@scanii/react and @scanii/web are deferred — not touched here.

Out of scope (per packet)

Browser polyfills (Node 22+ and ES2022 browsers have everything natively).
React hooks / web components / monorepo / workspaces.
Retry logic, backoff, batch helpers, concurrency primitives — Principle 3.
Tag-pushing or release creation — Rafael's responsibility.

Test plan

npm ci clean install
npm run typecheck passes (strict TS, verbatimModuleSyntax, noUncheckedIndexedAccess)
npm run lint passes (eslint flat config, typescript-eslint recommended)
npm test — 32 tests pass (unit suite green; integration suite green against locally running scanii-cli, with documented self-skips for older cli builds missing the UUID signature / token-auth / callback delivery)
npm run build — emits dist/index.cjs (13 KB), dist/index.mjs (12 KB), index.d.ts (9 KB)
Smoke test: require('./dist/index.cjs') and dynamic-import('./dist/index.mjs') both resolve ScaniiClient, VERSION === "1.0.0"
Smoke test: end-to-end process() against a running scanii-cli — clean file returns findings: [], contentLength accurate
Reviewer: confirm GitHub npm environment is wired so the OIDC publish step can resolve at v1.0.0 tag time
Reviewer: spot-check that @scanii/core@0.0.1 placeholder will be cleanly superseded by v1.0.0 publish

🤖 Generated with Claude Code

Replaces the unpublishable scanii-js monorepo skeleton with a clean, single-package zero-dependency TypeScript SDK published as @scanii/core on npm. API mirrors scanii-java v8.0.0 translated to async/Promise-returning TS: process / processAsync / fetch / retrieve / ping / createAuthToken / retrieveAuthToken / deleteAuthToken. Error hierarchy: ScaniiError, ScaniiAuthError, ScaniiRateLimitError (with retryAfter). Native fetch + FormData + Blob — no polyfills, no runtime deps. ESM + CJS dual build via tsup with shipped .d.ts. Targets Node 22+ and modern browsers. Tests: jest unit suite mocking global.fetch + integration suite against scanii-cli (started via scanii/setup-cli-action@v1 in CI). Malware fixture is the UUID 38DCC0C9-... per workspace CLAUDE.md §5, generated inline (not committed). CI: pr.yml on Node 22+24 across ubuntu/macos/windows. release.yml publishes to npm via OIDC trusted publishing on release: published — does not create the GitHub Release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rferreira · 2026-04-28T10:16:28Z

+
+## 1.0.0 — Initial release
+
+First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.


Remove mention of scanii-js

rferreira · 2026-04-28T10:16:39Z

+
+First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.
+
+**Reference frozen at `scanii-java` v8.0.0.** Method names, response shape, and error hierarchy mirror the Java reference, translated to idiomatic TypeScript.


Remove reference to the Java SDK

rferreira · 2026-04-28T10:17:02Z

+- **scanii-cli** integration tests cover the cross-OS matrix (Linux / macOS / Windows on Node 22 + 24) without burning real Scanii credits.
+- **OIDC trusted publishing** with provenance attestation.
+
+### Migration


Remove migration for first release

Per PR review: scanii-js and the @scanii/core@0.0.1 placeholder are internal context, not consumer-facing release notes. Java reference is implementation detail. No migration path applies for a first release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rferreira · 2026-04-28T10:12:14Z

Summary

Full rewrite of the scanii-js skeleton (unpublishable monorepo with empty stubs) as a clean, single-package zero-dependency TypeScript SDK. Publishes as @scanii/core on npm at 1.0.0, replacing the placeholder 0.0.1 stub.

API surface mirrors scanii-java v8.0.0 translated to async/Promise TS — process, processAsync, fetch, retrieve, ping, createAuthToken, retrieveAuthToken, deleteAuthToken.
Errors:ScaniiError base, ScaniiAuthError (401/403), ScaniiRateLimitError (429, with retryAfter parsed from Retry-After).
Zero runtime deps. Native fetch + FormData + Blob + URLSearchParams. No axios, no node-fetch, no form-data, no undici.
Dual build: ESM + CJS + shipped .d.ts via tsup. Built artifacts: dist/index.cjs, dist/index.mjs, dist/index.d.ts, dist/index.d.mts.
Targets: Node 22+ and modern browsers (ES2022 + DOM).
API v2.2 throughout (skeleton was on v2.1).
Tests: Jest. Unit suite mocks global.fetch directly (no nock/undici). Integration suite hits scanii-cli at localhost:4000; uses the UUID 38DCC0C9-… inline fixture per workspace CLAUDE.md §5 (not EICAR — that gets quarantined on Windows / macOS runners).
CI:pr.yml on Node 22 + 24 across ubuntu / macos / windows, scanii-cli started via scanii/setup-cli-action@v1. release.yml triggered by release: published, publishes via OIDC trusted publishing on the npm GitHub environment, with --provenance.

Naming reminder

Package name on npm is @scanii/core — scoped, NOT unscoped scanii. The unscoped scanii name remains a deprecated 0.0.1 placeholder for squat-protection only and is not touched by this change. README has a one-line note pointing consumers from scanii to @scanii/core.

@scanii/react and @scanii/web are deferred — not touched here.

Out of scope (per packet)

Browser polyfills (Node 22+ and ES2022 browsers have everything natively).
React hooks / web components / monorepo / workspaces.
Retry logic, backoff, batch helpers, concurrency primitives — Principle 3.
Tag-pushing or release creation — Rafael's responsibility.

Test plan

npm ci clean install
npm run typecheck passes (strict TS, verbatimModuleSyntax, noUncheckedIndexedAccess)
npm run lint passes (eslint flat config, typescript-eslint recommended)
npm test — 32 tests pass (unit suite green; integration suite green against locally running scanii-cli, with documented self-skips for older cli builds missing the UUID signature / token-auth / callback delivery)
npm run build — emits dist/index.cjs (13 KB), dist/index.mjs (12 KB), index.d.ts (9 KB)
Smoke test: require('./dist/index.cjs') and dynamic-import('./dist/index.mjs') both resolve ScaniiClient, VERSION === "1.0.0"
Smoke test: end-to-end process() against a running scanii-cli — clean file returns findings: [], contentLength accurate
Reviewer: confirm GitHub npm environment is wired so the OIDC publish step can resolve at v1.0.0 tag time
Reviewer: spot-check that @scanii/core@0.0.1 placeholder will be cleanly superseded by v1.0.0 publish

🤖 Generated with Claude Code

Replaces the unpublishable scanii-js monorepo skeleton with a clean, single-package zero-dependency TypeScript SDK published as @scanii/core on npm. API mirrors scanii-java v8.0.0 translated to async/Promise-returning TS: process / processAsync / fetch / retrieve / ping / createAuthToken / retrieveAuthToken / deleteAuthToken. Error hierarchy: ScaniiError, ScaniiAuthError, ScaniiRateLimitError (with retryAfter). Native fetch + FormData + Blob — no polyfills, no runtime deps. ESM + CJS dual build via tsup with shipped .d.ts. Targets Node 22+ and modern browsers. Tests: jest unit suite mocking global.fetch + integration suite against scanii-cli (started via scanii/setup-cli-action@v1 in CI). Malware fixture is the UUID 38DCC0C9-... per workspace CLAUDE.md §5, generated inline (not committed). CI: pr.yml on Node 22+24 across ubuntu/macos/windows. release.yml publishes to npm via OIDC trusted publishing on release: published — does not create the GitHub Release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rferreira · 2026-04-28T10:16:28Z

+
+## 1.0.0 — Initial release
+
+First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.


Remove mention of scanii-js

rferreira · 2026-04-28T10:16:39Z

+
+First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.
+
+**Reference frozen at `scanii-java` v8.0.0.** Method names, response shape, and error hierarchy mirror the Java reference, translated to idiomatic TypeScript.


Remove reference to the Java SDK

rferreira · 2026-04-28T10:17:02Z

+- **scanii-cli** integration tests cover the cross-OS matrix (Linux / macOS / Windows on Node 22 + 24) without burning real Scanii credits.
+- **OIDC trusted publishing** with provenance attestation.
+
+### Migration


Remove migration for first release

Per PR review: scanii-js and the @scanii/core@0.0.1 placeholder are internal context, not consumer-facing release notes. Java reference is implementation detail. No migration path applies for a first release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rferreira · 2026-04-28T10:12:14Z

Summary

Full rewrite of the scanii-js skeleton (unpublishable monorepo with empty stubs) as a clean, single-package zero-dependency TypeScript SDK. Publishes as @scanii/core on npm at 1.0.0, replacing the placeholder 0.0.1 stub.

API surface mirrors scanii-java v8.0.0 translated to async/Promise TS — process, processAsync, fetch, retrieve, ping, createAuthToken, retrieveAuthToken, deleteAuthToken.
Errors:ScaniiError base, ScaniiAuthError (401/403), ScaniiRateLimitError (429, with retryAfter parsed from Retry-After).
Zero runtime deps. Native fetch + FormData + Blob + URLSearchParams. No axios, no node-fetch, no form-data, no undici.
Dual build: ESM + CJS + shipped .d.ts via tsup. Built artifacts: dist/index.cjs, dist/index.mjs, dist/index.d.ts, dist/index.d.mts.
Targets: Node 22+ and modern browsers (ES2022 + DOM).
API v2.2 throughout (skeleton was on v2.1).
Tests: Jest. Unit suite mocks global.fetch directly (no nock/undici). Integration suite hits scanii-cli at localhost:4000; uses the UUID 38DCC0C9-… inline fixture per workspace CLAUDE.md §5 (not EICAR — that gets quarantined on Windows / macOS runners).
CI:pr.yml on Node 22 + 24 across ubuntu / macos / windows, scanii-cli started via scanii/setup-cli-action@v1. release.yml triggered by release: published, publishes via OIDC trusted publishing on the npm GitHub environment, with --provenance.

Naming reminder

Package name on npm is @scanii/core — scoped, NOT unscoped scanii. The unscoped scanii name remains a deprecated 0.0.1 placeholder for squat-protection only and is not touched by this change. README has a one-line note pointing consumers from scanii to @scanii/core.

@scanii/react and @scanii/web are deferred — not touched here.

Out of scope (per packet)

Browser polyfills (Node 22+ and ES2022 browsers have everything natively).
React hooks / web components / monorepo / workspaces.
Retry logic, backoff, batch helpers, concurrency primitives — Principle 3.
Tag-pushing or release creation — Rafael's responsibility.

Test plan

npm ci clean install
npm run typecheck passes (strict TS, verbatimModuleSyntax, noUncheckedIndexedAccess)
npm run lint passes (eslint flat config, typescript-eslint recommended)
npm test — 32 tests pass (unit suite green; integration suite green against locally running scanii-cli, with documented self-skips for older cli builds missing the UUID signature / token-auth / callback delivery)
npm run build — emits dist/index.cjs (13 KB), dist/index.mjs (12 KB), index.d.ts (9 KB)
Smoke test: require('./dist/index.cjs') and dynamic-import('./dist/index.mjs') both resolve ScaniiClient, VERSION === "1.0.0"
Smoke test: end-to-end process() against a running scanii-cli — clean file returns findings: [], contentLength accurate
Reviewer: confirm GitHub npm environment is wired so the OIDC publish step can resolve at v1.0.0 tag time
Reviewer: spot-check that @scanii/core@0.0.1 placeholder will be cleanly superseded by v1.0.0 publish

🤖 Generated with Claude Code

Replaces the unpublishable scanii-js monorepo skeleton with a clean, single-package zero-dependency TypeScript SDK published as @scanii/core on npm. API mirrors scanii-java v8.0.0 translated to async/Promise-returning TS: process / processAsync / fetch / retrieve / ping / createAuthToken / retrieveAuthToken / deleteAuthToken. Error hierarchy: ScaniiError, ScaniiAuthError, ScaniiRateLimitError (with retryAfter). Native fetch + FormData + Blob — no polyfills, no runtime deps. ESM + CJS dual build via tsup with shipped .d.ts. Targets Node 22+ and modern browsers. Tests: jest unit suite mocking global.fetch + integration suite against scanii-cli (started via scanii/setup-cli-action@v1 in CI). Malware fixture is the UUID 38DCC0C9-... per workspace CLAUDE.md §5, generated inline (not committed). CI: pr.yml on Node 22+24 across ubuntu/macos/windows. release.yml publishes to npm via OIDC trusted publishing on release: published — does not create the GitHub Release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rferreira · 2026-04-28T10:16:28Z

+
+## 1.0.0 — Initial release
+
+First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.


Remove mention of scanii-js

rferreira · 2026-04-28T10:16:39Z

+
+First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.
+
+**Reference frozen at `scanii-java` v8.0.0.** Method names, response shape, and error hierarchy mirror the Java reference, translated to idiomatic TypeScript.


Remove reference to the Java SDK

rferreira · 2026-04-28T10:17:02Z

+- **scanii-cli** integration tests cover the cross-OS matrix (Linux / macOS / Windows on Node 22 + 24) without burning real Scanii credits.
+- **OIDC trusted publishing** with provenance attestation.
+
+### Migration


Remove migration for first release

Per PR review: scanii-js and the @scanii/core@0.0.1 placeholder are internal context, not consumer-facing release notes. Java reference is implementation detail. No migration path applies for a first release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rferreira commented Apr 28, 2026
View reviewed changes

rferreira merged commit f7443ba into mainApr 28, 2026
6 checks passed

rferreira deleted the feat/v1.0.0-rewrite branch April 28, 2026 10:45

rferreira commented Apr 28, 2026
View reviewed changes

rferreira merged commit f7443ba into mainApr 28, 2026
6 checks passed

rferreira deleted the feat/v1.0.0-rewrite branch April 28, 2026 10:45

rferreira commented Apr 28, 2026
View reviewed changes

rferreira merged commit f7443ba into mainApr 28, 2026
6 checks passed

rferreira deleted the feat/v1.0.0-rewrite branch April 28, 2026 10:45

rferreira commented Apr 28, 2026
View reviewed changes

rferreira merged commit f7443ba into mainApr 28, 2026
6 checks passed

rferreira deleted the feat/v1.0.0-rewrite branch April 28, 2026 10:45

rferreira commented Apr 28, 2026
View reviewed changes

rferreira merged commit f7443ba into mainApr 28, 2026
6 checks passed

rferreira deleted the feat/v1.0.0-rewrite branch April 28, 2026 10:45

rferreira commented Apr 28, 2026
View reviewed changes

rferreira merged commit f7443ba into mainApr 28, 2026
6 checks passed

rferreira deleted the feat/v1.0.0-rewrite branch April 28, 2026 10:45

rferreira commented Apr 28, 2026
View reviewed changes

rferreira merged commit f7443ba into mainApr 28, 2026
6 checks passed

rferreira deleted the feat/v1.0.0-rewrite branch April 28, 2026 10:45

rferreira commented Apr 28, 2026
View reviewed changes

rferreira merged commit f7443ba into mainApr 28, 2026
6 checks passed

rferreira deleted the feat/v1.0.0-rewrite branch April 28, 2026 10:45


		## 1.0.0 — Initial release

		First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.


		First public release of the Scanii Node SDK as `@scanii/core`. Replaces the unpublished `scanii-js` skeleton; supersedes the `@scanii/core@0.0.1` placeholder published to claim the name on npm.

		Reference frozen at `scanii-java` v8.0.0. Method names, response shape, and error hierarchy mirror the Java reference, translated to idiomatic TypeScript.

Uh oh!

Conversation

rferreira commented Apr 28, 2026

Summary

Naming reminder

Out of scope (per packet)

Test plan

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

rferreira commented Apr 28, 2026

Summary

Naming reminder

Out of scope (per packet)

Test plan

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

rferreira commented Apr 28, 2026

Summary

Naming reminder

Out of scope (per packet)

Test plan

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

rferreira commented Apr 28, 2026

Summary

Naming reminder

Out of scope (per packet)

Test plan

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment