Code provenance

ddg-kit contains new code under Apache-2.0.

Sources used as behavioral evidence

• the public duck-duck-scrape@2.2.7 package declarations and runtime behavior
• the dependent/API census stored under docs/research
• one explicit, single-query DuckDuckGo bootstrap probe on 2026-07-28
• one explicit, single logical-query no-result canary on 2026-07-28
• local downstream canaries recorded under docs/canary
• synthetic, hand-authored provider fixtures

The old package was inspected to understand observed public fields and legacy request behavior. No code from that package was copied into this repository.

The live responses were not stored. The project retained response classification facts without response bodies: a page contained a VQD token and a provider-signed links.duckduckgo.com/d.js preload path; one canary completed the no-result path; HTML/Lite HTTP 202 responses contained challenge markers; an OpenCandle News canary mapped three results.

Dependency license review

The local lockfile's production dependency tree was inspected on 2026-07-28. Observed licenses were MIT, BSD-2-Clause, and ISC. Direct runtime dependencies are cheerio@1.0.0 (MIT) and undici@6.28.0 (MIT).

Fixture policy

Fixtures contain invented queries, domains, tokens, titles, descriptions, and response payloads. They do not reproduce a third-party page or search response.

Release review

Independent review rejected 0.1.0-rc.1 under finding RC1-001. The mandatory npm run check command failed in two fresh bundle clones because the root TypeScript project included an installed-tarball fixture and tried to resolve the untracked dist/index.d.ts.

Version 0.1.0-rc.2 excludes that fixture from the root project and adds a regression test for the TypeScript project boundary. The local v0.1.0-rc.2 tag identifies the frozen review commit.

A fresh reviewer accepted RC2 with documented publication conditions after rebuilding the exact tarball, running the Node matrix, installing clean ESM and CommonJS consumers, inspecting package contents, and selecting a News HTTP 418 failure case. At review time, the package remained private and unpublished. The acceptance did not authorize a public repository, manifest changes, push, or publication.

Stable promotion

Version 0.1.0 promotes the runtime code from the accepted RC2 commit. Changes after that commit update documentation, package version and repository metadata, publication settings, and the publish workflow. They do not change source code, runtime dependencies, build scripts, tests, or the public API.

The stable release keeps the RC2 code acceptance record. The release owner built the final 0.1.0 tarball from the stable commit, inspected its contents, and installed that exact file in clean ESM and CommonJS consumers.

Publication record

• Source commit: f0881c1942d274289c10ab323a88ce48d7ae166f
• Git tag and release: v0.1.0
• npm package: ddg-kit@0.1.0
• Tarball SHA-256: 4572E4851E7B782076E36C6DB63DB22D2B508B00779F420F511F8B108F9F1FEF
• npm integrity: sha512-8rXECjpAh+dLDtpon+dvF4hnXmskja2MPdIaBNlex7IPZlE04hE42B2+3h1G2MfK41bRFWj5Babu6qUXhNeeDQ==
• Publish workflow: run 30382576423 in GitHub Actions

The publication workflow completed the package checks and requested npm provenance. Registry metadata exposes the attestation. A fresh registry download matched the frozen tarball SHA-256, and clean ESM and CommonJS installation checks passed.