@agntn/registries 0.2.0 → 0.3.1

package/dist/_chunks/registry.d.mts

@@ -1,5 +1,74 @@
-import { c as URLBuilder, i as Package, l as Version, n as Dependency, r as Maintainer, t as ClientOptions } from "./types.mjs";
-
+//#region src/core/types.d.ts
+/** Normalized package metadata returned by any registry. */
+interface Package {
+  name: string;
+  description: string;
+  homepage: string;
+  documentation: string;
+  repository: string;
+  licenses: string;
+  keywords: string[];
+  namespace: string;
+  latestVersion: string;
+  metadata: Record<string, unknown>;
+}
+/** A single version entry of a package. */
+interface Version {
+  number: string;
+  publishedAt: Date | null;
+  licenses: string;
+  integrity: string;
+  status: VersionStatus;
+  metadata: Record<string, unknown>;
+}
+/** Dependency of a package version. */
+interface Dependency {
+  name: string;
+  requirements: string;
+  scope: Scope;
+  optional: boolean;
+}
+/** Maintainer / author of a package. */
+interface Maintainer {
+  uuid: string;
+  login: string;
+  name: string;
+  email: string;
+  url: string;
+  role: string;
+}
+type VersionStatus = "" | "yanked" | "deprecated" | "retracted";
+type Scope = "runtime" | "development" | "test" | "build" | "optional";
+/** URL builder for a specific registry. */
+interface URLBuilder {
+  registry(name: string, version?: string): string;
+  download(name: string, version: string): string;
+  documentation(name: string, version?: string): string;
+  readme(name: string, version?: string): string;
+  purl(name: string, version?: string): string;
+}
+/** Options for the HTTP client. */
+interface ClientOptions {
+  maxRetries?: number;
+  baseDelay?: number;
+  timeout?: number;
+  rateLimiter?: RateLimiter;
+  userAgent?: string;
+}
+/** Rate limiter interface — bring your own implementation. */
+interface RateLimiter {
+  wait(signal?: AbortSignal): Promise<void>;
+}
+/** Parsed PURL components. */
+interface ParsedPURL {
+  type: string;
+  namespace: string;
+  name: string;
+  version: string;
+  qualifiers: Record<string, string>;
+  subpath: string;
+}
+//#endregion
 //#region src/core/client.d.ts
 /** HTTP client with retry, backoff, rate limiting, and timeout. */
 declare class Client {
@@ -10,10 +79,30 @@ declare class Client {
   private readonly rateLimiter;
   private readonly fetch;
   constructor(options?: ClientOptions);
-  /** Fetch JSON from a URL with retry and rate limiting. */
-  getJSON<T>(url: string, signal?: AbortSignal, headers?: Record<string, string>): Promise<T>;
+  /**
+   * Fetch JSON with retry and rate limiting.
+   *
+   * @param url - Request URL.
+   * @param signal - Optional cancellation signal.
+   * @param headers - Optional request headers.
+   * @returns {Promise<T>} The decoded response body.
+   */
+  getJSON<T>(url: string, signal?: AbortSignal, headers?: Readonly<Record<string, string>>): Promise<T>;
+  /**
+   * ofetch drops its timeout once a signal is supplied, sleeps through backoff with a plain
+   * timer and retries after an abort, so the request owns all three here.
+   *
+   * @param signal - Optional cancellation signal.
+   * @returns {FetchOptions} The request hooks that own timeout, backoff and cancellation.
+   */
+  private retryControl;
+  private attemptSignal;
 }
-/** Get or create the shared default client. */
+/**
+ * Get or create the shared HTTP client.
+ *
+ * @returns {Client} The shared client.
+ */
 declare function defaultClient(): Client;
 //#endregion
 //#region src/core/registry.d.ts
@@ -26,14 +115,36 @@ declare abstract class Registry {
   abstract fetchMaintainers(name: string, signal?: AbortSignal): Promise<Maintainer[]>;
   abstract urls(): URLBuilder;
 }
-/** Register an ecosystem class. Called by each registry module on import. */
+/**
+ * Register an ecosystem adapter.
+ *
+ * @param ecosystem - Ecosystem key.
+ * @param defaultURL - Default registry API URL.
+ * @param RegistryClass - Adapter constructor.
+ */
 declare function register(ecosystem: string, defaultURL: string, RegistryClass: new (baseURL: string, client: Client) => Registry): void;
-/** Create a registry instance for the given ecosystem. */
+/**
+ * Create an adapter for a registered ecosystem.
+ *
+ * @param ecosystem - Ecosystem key.
+ * @param baseURL - Optional registry API URL override.
+ * @param client - Optional HTTP client.
+ * @returns {Registry} The registry adapter.
+ */
 declare function create(ecosystem: string, baseURL?: string, client?: Client): Registry;
-/** List all registered ecosystem names. */
+/**
+ * List registered ecosystems.
+ *
+ * @returns {string[]} The ecosystem keys.
+ */
 declare function ecosystems(): string[];
-/** Check if an ecosystem is registered. */
+/**
+ * Check whether an ecosystem is registered.
+ *
+ * @param ecosystem - Ecosystem key.
+ * @returns {boolean} Whether an adapter is registered.
+ */
 declare function has(ecosystem: string): boolean;
 //#endregion
-export { register as a, has as i, create as n, Client as o, ecosystems as r, defaultClient as s, Registry as t };
+export { VersionStatus as _, register as a, ClientOptions as c, Package as d, ParsedPURL as f, Version as g, URLBuilder as h, has as i, Dependency as l, Scope as m, create as n, Client as o, RateLimiter as p, ecosystems as r, defaultClient as s, Registry as t, Maintainer as u };
 //# sourceMappingURL=registry.d.mts.map

package/dist/_chunks/registry.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.mts","names":[],"sources":["../../src/core/client.ts","../../src/core/registry.ts"],"mappings":";;;;cAsDa,MAAA;EAAA,SACF,UAAA;EAAA,SACA,SAAA;EAAA,SACA,OAAA;EAAA,SACA,SAAA;EAAA,iBACQ,WAAA;EAAA,iBACA,KAAA;cAEL,OAAA,GAAS,aAAA;EAqCf;EAAA,OAAA,GAAA,CACJ,GAAA,UACA,MAAA,GAAS,WAAA,EACT,OAAA,GAAU,MAAA,mBACT,OAAA,CAAQ,CAAA;AAAA;;iBAyBG,aAAA,CAAA,GAAiB,MAAA;;;;uBC1HX,QAAA;EAAA,SACX,SAAA,CAAA;EAAA,SACA,YAAA,CAAa,IAAA,UAAc,MAAA,GAAS,WAAA,GAAc,OAAA,CAAQ,OAAA;EAAA,SAC1D,aAAA,CAAc,IAAA,UAAc,MAAA,GAAS,WAAA,GAAc,OAAA,CAAQ,OAAA;EAAA,SAC3D,iBAAA,CACP,IAAA,UACA,OAAA,UACA,MAAA,GAAS,WAAA,GACR,OAAA,CAAQ,UAAA;EAAA,SACF,gBAAA,CAAiB,IAAA,UAAc,MAAA,GAAS,WAAA,GAAc,OAAA,CAAQ,UAAA;EAAA,SAC9D,IAAA,CAAA,GAAQ,UAAA;AAAA;;iBAOH,QAAA,CACd,SAAA,UACA,UAAA,UACA,aAAA,OAAoB,OAAA,UAAiB,MAAA,EAAQ,MAAA,KAAW,QAAA;;iBAO1C,MAAA,CAAO,SAAA,UAAmB,OAAA,WAAkB,MAAA,GAAS,MAAA,GAAS,QAAA;;iBAS9D,UAAA,CAAA;;iBAKA,GAAA,CAAI,SAAA"}
+{"version":3,"file":"registry.d.mts","names":[],"sources":["../../src/core/types.ts","../../src/core/client.ts","../../src/core/registry.ts"],"mappings":";;UACiB,OAAA;EACf,IAAA;EACA,WAAA;EACA,QAAA;EACA,aAAA;EACA,UAAA;EACA,QAAA;EACA,QAAA;EACA,SAAA;EACA,aAAA;EACA,QAAA,EAAU,MAAA;AAAA;;UAIK,OAAA;EACf,MAAA;EACA,WAAA,EAAa,IAAA;EACb,QAAA;EACA,SAAA;EACA,MAAA,EAAQ,aAAA;EACR,QAAA,EAAU,MAAA;AAAA;;UAIK,UAAA;EACf,IAAA;EACA,YAAA;EACA,KAAA,EAAO,KAAA;EACP,QAAA;AAAA;;UAIe,UAAA;EACf,IAAA;EACA,KAAA;EACA,IAAA;EACA,KAAA;EACA,GAAA;EACA,IAAA;AAAA;AAAA,KAGU,aAAA;AAAA,KACA,KAAA;;UAGK,UAAA;EACf,QAAA,CAAS,IAAA,UAAc,OAAA;EACvB,QAAA,CAAS,IAAA,UAAc,OAAA;EACvB,aAAA,CAAc,IAAA,UAAc,OAAA;EAC5B,MAAA,CAAO,IAAA,UAAc,OAAA;EACrB,IAAA,CAAK,IAAA,UAAc,OAAA;AAAA;AAlBrB;AAAA,UAsBiB,aAAA;EACf,UAAA;EACA,SAAA;EACA,OAAA;EACA,WAAA,GAAc,WAAA;EACd,SAAA;AAAA;;UAIe,WAAA;EACf,IAAA,CAAK,MAAA,GAAS,WAAA,GAAc,OAAA;AAAA;AAvB9B;AAAA,UA2BiB,UAAA;EACf,IAAA;EACA,SAAA;EACA,IAAA;EACA,OAAA;EACA,UAAA,EAAY,MAAA;EACZ,OAAA;AAAA;;;;cCdW,MAAA;EAAA,SACF,UAAA;EAAA,SACA,SAAA;EAAA,SACA,OAAA;EAAA,SACA,SAAA;EAAA,iBACQ,WAAA;EAAA,iBACA,KAAA;cAEL,OAAA,GAAS,aAAA;EDhDL;;;;;;;;ECyEV,OAAA,GAAA,CACJ,GAAA,UACA,MAAA,GAAS,WAAA,EACT,OAAA,GAAU,QAAA,CAAS,MAAA,oBAClB,OAAA,CAAQ,CAAA;ED7ED;;;AAIZ;;;;EAJY,QCyGF,YAAA;EAAA,QAqCA,aAAA;AAAA;;;;;ADlIV;iBCuKgB,aAAA,CAAA,GAAiB,MAAA;;;;uBClMX,QAAA;EAAA,SACX,SAAA,CAAA;EAAA,SACA,YAAA,CAAa,IAAA,UAAc,MAAA,GAAS,WAAA,GAAc,OAAA,CAAQ,OAAA;EAAA,SAC1D,aAAA,CAAc,IAAA,UAAc,MAAA,GAAS,WAAA,GAAc,OAAA,CAAQ,OAAA;EAAA,SAC3D,iBAAA,CACP,IAAA,UACA,OAAA,UACA,MAAA,GAAS,WAAA,GACR,OAAA,CAAQ,UAAA;EAAA,SACF,gBAAA,CAAiB,IAAA,UAAc,MAAA,GAAS,WAAA,GAAc,OAAA,CAAQ,UAAA;EAAA,SAC9D,IAAA,CAAA,GAAQ,UAAA;AAAA;;;;;;;;iBAaH,QAAA,CACd,SAAA,UACA,UAAA,UACA,aAAA,OAAoB,OAAA,UAAiB,MAAA,EAAQ,MAAA,KAAW,QAAA;;;;;;;;;iBAc1C,MAAA,CAAO,SAAA,UAAmB,OAAA,WAAkB,MAAA,GAAS,MAAA,GAAS,QAAA;;;;;;iBAa9D,UAAA,CAAA;;;;AFlChB;;;iBE4CgB,GAAA,CAAI,SAAA"}

package/dist/_chunks/registry.mjs

@@ -69,6 +69,9 @@ const DEFAULT_BASE_DELAY = 50;
 const DEFAULT_TIMEOUT = 3e4;
 const DEFAULT_USER_AGENT = "registries/0.1.0";
 const MAX_TIMER_DELAY = 2147483647;
+function retryCount(value) {
+	return typeof value === "number" ? value : 0;
+}
 function parseRetryAfterValue(header) {
 	if (!header) return void 0;
 	const trimmed = header.trim();
@@ -83,18 +86,21 @@ function parseRetryAfterValue(header) {
 	return Math.max(seconds, 0);
 }
 /**
-* Parse a `Retry-After` header into seconds.
-*
-* Handles two formats (RFC 7231 §7.1.3):
-* - **Numeric**: `"120"` → 120
-* - **HTTP-date**: `"Wed, 21 Oct 2025 07:28:00 GMT"` → seconds until that time
+* Parse a Retry-After header into seconds, defaulting to 60.
 *
-* Returns 60 when the header is absent, empty, or unparseable.
+* @param header - Numeric seconds or an HTTP date.
+* @returns {number} The retry delay in seconds.
 */
 function parseRetryAfter(header) {
 	return parseRetryAfterValue(header) ?? 60;
 }
-/** Apply a valid, timer-safe `Retry-After` value or reject an unschedulable delay. */
+/**
+* Apply a valid Retry-After value or reject an unschedulable delay.
+*
+* @param header - Numeric seconds or an HTTP date.
+* @param fallbackDelay - Delay in milliseconds used without a valid header.
+* @returns {number} A timer-safe delay in milliseconds.
+*/
 function retryDelayFor(header, fallbackDelay) {
 	const retryAfter = parseRetryAfterValue(header);
 	if (retryAfter === void 0) return fallbackDelay;
@@ -116,22 +122,8 @@ var Client = class {
 		this.timeout = options.timeout ?? DEFAULT_TIMEOUT;
 		this.userAgent = options.userAgent ?? DEFAULT_USER_AGENT;
 		this.rateLimiter = options.rateLimiter ?? null;
-		const maxRetries = this.maxRetries;
-		const baseDelay = this.baseDelay;
 		this.fetch = ofetch.create({
 			retry: this.maxRetries,
-			retryDelay(context) {
-				const attempt = maxRetries - (typeof context.options.retry === "number" ? context.options.retry : 0);
-				const delay = baseDelay * Math.pow(2, attempt - 1);
-				const jitteredDelay = delay + delay * Math.random() * .1;
-				const retryAfter = context.response?.headers.get("Retry-After");
-				try {
-					return retryDelayFor(retryAfter, jitteredDelay);
-				} catch (error) {
-					if (error instanceof RateLimitError && context.response?.status !== 429) throw new HTTPError(context.response?.status ?? 0, String(context.request), "");
-					throw error;
-				}
-			},
 			retryStatusCodes: [
 				408,
 				409,
@@ -142,20 +134,26 @@ var Client = class {
 				503,
 				504
 			],
-			timeout: this.timeout,
 			headers: {
 				Accept: "application/json",
 				"User-Agent": this.userAgent
 			}
 		});
 	}
-	/** Fetch JSON from a URL with retry and rate limiting. */
+	/**
+	* Fetch JSON with retry and rate limiting.
+	*
+	* @param url - Request URL.
+	* @param signal - Optional cancellation signal.
+	* @param headers - Optional request headers.
+	* @returns {Promise<T>} The decoded response body.
+	*/
 	async getJSON(url, signal, headers) {
 		if (this.rateLimiter) await this.rateLimiter.wait(signal);
 		try {
 			return await this.fetch(url, {
-				signal,
-				headers
+				headers,
+				...this.retryControl(signal)
 			});
 		} catch (error) {
 			if (error instanceof FetchError) {
@@ -166,33 +164,125 @@ var Client = class {
 			throw error;
 		}
 	}
+	/**
+	* ofetch drops its timeout once a signal is supplied, sleeps through backoff with a plain
+	* timer and retries after an abort, so the request owns all three here.
+	*
+	* @param signal - Optional cancellation signal.
+	* @returns {FetchOptions} The request hooks that own timeout, backoff and cancellation.
+	*/
+	retryControl(signal) {
+		let pendingDelay = 0;
+		return {
+			signal,
+			retryDelay: (context) => {
+				const remaining = retryCount(context.options.retry);
+				const attempt = this.maxRetries - remaining;
+				const delay = this.baseDelay * Math.pow(2, attempt - 1);
+				const jitteredDelay = delay + delay * Math.random() * .1;
+				const retryAfter = context.response?.headers.get("Retry-After");
+				try {
+					pendingDelay = retryDelayFor(retryAfter, jitteredDelay);
+				} catch (error) {
+					if (error instanceof RateLimitError && context.response?.status !== 429) {
+						const requestURL = typeof context.request === "string" ? context.request : context.request.url;
+						throw new HTTPError(context.response?.status ?? 0, requestURL, "");
+					}
+					throw error;
+				}
+				return 0;
+			},
+			onRequest: async ({ options }) => {
+				if (pendingDelay > 0) {
+					await abortableDelay(pendingDelay, signal);
+					pendingDelay = 0;
+				}
+				options.signal = this.attemptSignal(signal);
+			},
+			onRequestError: ({ options }) => {
+				if (signal?.aborted) options.retry = false;
+			}
+		};
+	}
+	attemptSignal(signal) {
+		const active = [signal, this.timeout > 0 ? AbortSignal.timeout(this.timeout) : void 0].filter((candidate) => candidate !== void 0);
+		return active.length > 0 ? AbortSignal.any(active) : void 0;
+	}
 };
+/**
+* Sleep that returns as soon as the signal fires, so an abort never waits out a Retry-After.
+*
+* @param milliseconds - Delay before resolving.
+* @param signal - Optional cancellation signal that ends the wait early.
+* @returns {Promise<void>} Resolution after the delay or the abort.
+*/
+function abortableDelay(milliseconds, signal) {
+	if (!signal) return new Promise((resolve) => setTimeout(resolve, milliseconds));
+	if (signal.aborted) return Promise.resolve();
+	return new Promise((resolve) => {
+		const onAbort = () => {
+			clearTimeout(timer);
+			resolve();
+		};
+		const timer = setTimeout(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		}, milliseconds);
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
 let _defaultClient;
-/** Get or create the shared default client. */
+/**
+* Get or create the shared HTTP client.
+*
+* @returns {Client} The shared client.
+*/
 function defaultClient() {
-	if (!_defaultClient) _defaultClient = new Client();
+	_defaultClient ??= new Client();
 	return _defaultClient;
 }
 /** Common base for package registries and registry decorators. */
 var Registry = class {};
 const constructors = /* @__PURE__ */ new Map();
 const defaults = /* @__PURE__ */ new Map();
-/** Register an ecosystem class. Called by each registry module on import. */
+/**
+* Register an ecosystem adapter.
+*
+* @param ecosystem - Ecosystem key.
+* @param defaultURL - Default registry API URL.
+* @param RegistryClass - Adapter constructor.
+*/
 function register(ecosystem, defaultURL, RegistryClass) {
 	constructors.set(ecosystem, RegistryClass);
 	defaults.set(ecosystem, defaultURL);
 }
-/** Create a registry instance for the given ecosystem. */
+/**
+* Create an adapter for a registered ecosystem.
+*
+* @param ecosystem - Ecosystem key.
+* @param baseURL - Optional registry API URL override.
+* @param client - Optional HTTP client.
+* @returns {Registry} The registry adapter.
+*/
 function create(ecosystem, baseURL, client) {
 	const RegistryClass = constructors.get(ecosystem);
 	if (!RegistryClass) throw new UnknownEcosystemError(ecosystem);
 	return new RegistryClass(baseURL || defaults.get(ecosystem), client ?? defaultClient());
 }
-/** List all registered ecosystem names. */
+/**
+* List registered ecosystems.
+*
+* @returns {string[]} The ecosystem keys.
+*/
 function ecosystems() {
 	return [...constructors.keys()];
 }
-/** Check if an ecosystem is registered. */
+/**
+* Check whether an ecosystem is registered.
+*
+* @param ecosystem - Ecosystem key.
+* @returns {boolean} Whether an adapter is registered.
+*/
 function has(ecosystem) {
 	return constructors.has(ecosystem);
 }

package/dist/_chunks/registry.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"registry.mjs","names":[],"sources":["../../src/core/errors.ts","../../src/core/client.ts","../../src/core/registry.ts"],"sourcesContent":["/** Custom error types for registry operations. */\n\nexport class PkioError extends Error {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = \"PkioError\";\n  }\n}\n\nexport class HTTPError extends PkioError {\n  readonly statusCode: number;\n  readonly url: string;\n  readonly body: string;\n\n  constructor(statusCode: number, url: string, body: string) {\n    super(`HTTP ${statusCode}: ${url}`);\n    this.name = \"HTTPError\";\n    this.statusCode = statusCode;\n    this.url = url;\n    this.body = body;\n  }\n\n  isNotFound(): boolean {\n    return this.statusCode === 404;\n  }\n\n  isRateLimit(): boolean {\n    return this.statusCode === 429;\n  }\n\n  isServerError(): boolean {\n    return this.statusCode >= 500;\n  }\n}\n\nexport class NotFoundError extends PkioError {\n  readonly ecosystem: string;\n  readonly packageName: string;\n  readonly version: string;\n\n  constructor(ecosystem: string, packageName: string, version = \"\") {\n    const versionSuffix = version ? `@${version}` : \"\";\n    super(`Package not found: ${ecosystem}/${packageName}${versionSuffix}`);\n    this.name = \"NotFoundError\";\n    this.ecosystem = ecosystem;\n    this.packageName = packageName;\n    this.version = version;\n  }\n}\n\nexport class RateLimitError extends PkioError {\n  readonly retryAfter: number;\n\n  constructor(retryAfter: number) {\n    super(`Rate limited. Retry after ${retryAfter}s`);\n    this.name = \"RateLimitError\";\n    this.retryAfter = retryAfter;\n  }\n}\n\nexport class UnknownEcosystemError extends PkioError {\n  readonly ecosystem: string;\n\n  constructor(ecosystem: string) {\n    super(`Unknown ecosystem: ${ecosystem}`);\n    this.name = \"UnknownEcosystemError\";\n    this.ecosystem = ecosystem;\n  }\n}\n\nexport class InvalidPURLError extends PkioError {\n  readonly purl: string;\n\n  constructor(purl: string, reason: string) {\n    super(`Invalid PURL \"${purl}\": ${reason}`);\n    this.name = \"InvalidPURLError\";\n    this.purl = purl;\n  }\n}\n","import { ofetch, FetchError } from \"ofetch\";\nimport type { $Fetch } from \"ofetch\";\nimport type { ClientOptions, RateLimiter } from \"./types.ts\";\nimport { HTTPError, RateLimitError } from \"./errors.ts\";\n\nconst DEFAULT_MAX_RETRIES = 5;\nconst DEFAULT_BASE_DELAY = 50;\nconst DEFAULT_TIMEOUT = 30_000;\nconst DEFAULT_USER_AGENT = \"registries/0.1.0\";\nconst MAX_TIMER_DELAY = 2_147_483_647;\n\nfunction parseRetryAfterValue(header: string | null | undefined): number | undefined {\n  if (!header) return undefined;\n  const trimmed = header.trim();\n  if (!trimmed) return undefined;\n\n  if (/^\\d+$/.test(trimmed)) {\n    const seconds = Number(trimmed);\n    return Number.isNaN(seconds) ? undefined : seconds;\n  }\n\n  const timestamp = /[a-z]/i.test(trimmed) ? Date.parse(trimmed) : NaN;\n  if (Number.isNaN(timestamp)) return undefined;\n\n  const seconds = Math.ceil((timestamp - Date.now()) / 1000);\n  return Math.max(seconds, 0);\n}\n\n/**\n * Parse a `Retry-After` header into seconds.\n *\n * Handles two formats (RFC 7231 §7.1.3):\n * - **Numeric**: `\"120\"` → 120\n * - **HTTP-date**: `\"Wed, 21 Oct 2025 07:28:00 GMT\"` → seconds until that time\n *\n * Returns 60 when the header is absent, empty, or unparseable.\n */\nexport function parseRetryAfter(header: string | null | undefined): number {\n  return parseRetryAfterValue(header) ?? 60;\n}\n\n/** Apply a valid, timer-safe `Retry-After` value or reject an unschedulable delay. */\nexport function retryDelayFor(header: string | null | undefined, fallbackDelay: number): number {\n  const retryAfter = parseRetryAfterValue(header);\n  if (retryAfter === undefined) return fallbackDelay;\n\n  const retryAfterDelay = retryAfter * 1000;\n  if (!Number.isFinite(retryAfterDelay) || retryAfterDelay > MAX_TIMER_DELAY) {\n    throw new RateLimitError(retryAfter);\n  }\n  return Math.max(fallbackDelay, retryAfterDelay);\n}\n\n/** HTTP client with retry, backoff, rate limiting, and timeout. */\nexport class Client {\n  readonly maxRetries: number;\n  readonly baseDelay: number;\n  readonly timeout: number;\n  readonly userAgent: string;\n  private readonly rateLimiter: RateLimiter | null;\n  private readonly fetch: $Fetch;\n\n  constructor(options: ClientOptions = {}) {\n    this.maxRetries = options.maxRetries ?? DEFAULT_MAX_RETRIES;\n    this.baseDelay = options.baseDelay ?? DEFAULT_BASE_DELAY;\n    this.timeout = options.timeout ?? DEFAULT_TIMEOUT;\n    this.userAgent = options.userAgent ?? DEFAULT_USER_AGENT;\n    this.rateLimiter = options.rateLimiter ?? null;\n\n    const maxRetries = this.maxRetries;\n    const baseDelay = this.baseDelay;\n\n    this.fetch = ofetch.create({\n      retry: this.maxRetries,\n      retryDelay(context) {\n        const remaining = typeof context.options.retry === \"number\" ? context.options.retry : 0;\n        const attempt = maxRetries - remaining;\n        const delay = baseDelay * Math.pow(2, attempt - 1);\n        const jitteredDelay = delay + delay * Math.random() * 0.1;\n        const retryAfter = context.response?.headers.get(\"Retry-After\");\n        try {\n          return retryDelayFor(retryAfter, jitteredDelay);\n        } catch (error) {\n          if (error instanceof RateLimitError && context.response?.status !== 429) {\n            throw new HTTPError(context.response?.status ?? 0, String(context.request), \"\");\n          }\n          throw error;\n        }\n      },\n      retryStatusCodes: [408, 409, 425, 429, 500, 502, 503, 504],\n      timeout: this.timeout,\n      headers: {\n        Accept: \"application/json\",\n        \"User-Agent\": this.userAgent,\n      },\n    });\n  }\n\n  /** Fetch JSON from a URL with retry and rate limiting. */\n  async getJSON<T>(\n    url: string,\n    signal?: AbortSignal,\n    headers?: Record<string, string>,\n  ): Promise<T> {\n    if (this.rateLimiter) {\n      await this.rateLimiter.wait(signal);\n    }\n\n    try {\n      return await this.fetch<T>(url, { signal, headers });\n    } catch (error) {\n      if (error instanceof FetchError) {\n        if (error.statusCode === 429) {\n          throw new RateLimitError(parseRetryAfter(error.response?.headers.get(\"Retry-After\")));\n        }\n\n        const body = typeof error.data === \"string\" ? error.data : JSON.stringify(error.data ?? \"\");\n\n        throw new HTTPError(error.statusCode ?? 0, url, body);\n      }\n      throw error;\n    }\n  }\n}\n\nlet _defaultClient: Client | undefined;\n\n/** Get or create the shared default client. */\nexport function defaultClient(): Client {\n  if (!_defaultClient) {\n    _defaultClient = new Client();\n  }\n  return _defaultClient;\n}\n","import type { Client } from \"./client.ts\";\nimport { defaultClient } from \"./client.ts\";\nimport { UnknownEcosystemError } from \"./errors.ts\";\nimport type { Dependency, Maintainer, Package, URLBuilder, Version } from \"./types.ts\";\n\n/** Common base for package registries and registry decorators. */\nexport abstract class Registry {\n  abstract ecosystem(): string;\n  abstract fetchPackage(name: string, signal?: AbortSignal): Promise<Package>;\n  abstract fetchVersions(name: string, signal?: AbortSignal): Promise<Version[]>;\n  abstract fetchDependencies(\n    name: string,\n    version: string,\n    signal?: AbortSignal,\n  ): Promise<Dependency[]>;\n  abstract fetchMaintainers(name: string, signal?: AbortSignal): Promise<Maintainer[]>;\n  abstract urls(): URLBuilder;\n}\n\nconst constructors = new Map<string, new (baseURL: string, client: Client) => Registry>();\nconst defaults = new Map<string, string>();\n\n/** Register an ecosystem class. Called by each registry module on import. */\nexport function register(\n  ecosystem: string,\n  defaultURL: string,\n  RegistryClass: new (baseURL: string, client: Client) => Registry,\n): void {\n  constructors.set(ecosystem, RegistryClass);\n  defaults.set(ecosystem, defaultURL);\n}\n\n/** Create a registry instance for the given ecosystem. */\nexport function create(ecosystem: string, baseURL?: string, client?: Client): Registry {\n  const RegistryClass = constructors.get(ecosystem);\n  if (!RegistryClass) {\n    throw new UnknownEcosystemError(ecosystem);\n  }\n  return new RegistryClass(baseURL || defaults.get(ecosystem)!, client ?? defaultClient());\n}\n\n/** List all registered ecosystem names. */\nexport function ecosystems(): string[] {\n  return [...constructors.keys()];\n}\n\n/** Check if an ecosystem is registered. */\nexport function has(ecosystem: string): boolean {\n  return constructors.has(ecosystem);\n}\n"],"mappings":";;AAEA,IAAa,YAAb,cAA+B,MAAM;CACnC,YAAY,SAAiB,SAAwB;AACnD,QAAM,SAAS,QAAQ;AACvB,OAAK,OAAO;;;AAIhB,IAAa,YAAb,cAA+B,UAAU;CACvC;CACA;CACA;CAEA,YAAY,YAAoB,KAAa,MAAc;AACzD,QAAM,QAAQ,WAAW,IAAI,MAAM;AACnC,OAAK,OAAO;AACZ,OAAK,aAAa;AAClB,OAAK,MAAM;AACX,OAAK,OAAO;;CAGd,aAAsB;AACpB,SAAO,KAAK,eAAe;;CAG7B,cAAuB;AACrB,SAAO,KAAK,eAAe;;CAG7B,gBAAyB;AACvB,SAAO,KAAK,cAAc;;;AAI9B,IAAa,gBAAb,cAAmC,UAAU;CAC3C;CACA;CACA;CAEA,YAAY,WAAmB,aAAqB,UAAU,IAAI;EAChE,MAAM,gBAAgB,UAAU,IAAI,YAAY;AAChD,QAAM,sBAAsB,UAAU,GAAG,cAAc,gBAAgB;AACvE,OAAK,OAAO;AACZ,OAAK,YAAY;AACjB,OAAK,cAAc;AACnB,OAAK,UAAU;;;AAInB,IAAa,iBAAb,cAAoC,UAAU;CAC5C;CAEA,YAAY,YAAoB;AAC9B,QAAM,6BAA6B,WAAW,GAAG;AACjD,OAAK,OAAO;AACZ,OAAK,aAAa;;;AAItB,IAAa,wBAAb,cAA2C,UAAU;CACnD;CAEA,YAAY,WAAmB;AAC7B,QAAM,sBAAsB,YAAY;AACxC,OAAK,OAAO;AACZ,OAAK,YAAY;;;AAIrB,IAAa,mBAAb,cAAsC,UAAU;CAC9C;CAEA,YAAY,MAAc,QAAgB;AACxC,QAAM,iBAAiB,KAAK,KAAK,SAAS;AAC1C,OAAK,OAAO;AACZ,OAAK,OAAO;;;ACvEhB,MAAM,sBAAsB;AAC5B,MAAM,qBAAqB;AAC3B,MAAM,kBAAkB;AACxB,MAAM,qBAAqB;AAC3B,MAAM,kBAAkB;AAExB,SAAS,qBAAqB,QAAuD;AACnF,KAAI,CAAC,OAAQ,QAAO,KAAA;CACpB,MAAM,UAAU,OAAO,MAAM;AAC7B,KAAI,CAAC,QAAS,QAAO,KAAA;AAErB,KAAI,QAAQ,KAAK,QAAQ,EAAE;EACzB,MAAM,UAAU,OAAO,QAAQ;AAC/B,SAAO,OAAO,MAAM,QAAQ,GAAG,KAAA,IAAY;;CAG7C,MAAM,YAAY,SAAS,KAAK,QAAQ,GAAG,KAAK,MAAM,QAAQ,GAAG;AACjE,KAAI,OAAO,MAAM,UAAU,CAAE,QAAO,KAAA;CAEpC,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,KAAK,IAAI,IAAK;AAC1D,QAAO,KAAK,IAAI,SAAS,EAAE;;;;;;;;;;;AAY7B,SAAgB,gBAAgB,QAA2C;AACzE,QAAO,qBAAqB,OAAO,IAAI;;;AAIzC,SAAgB,cAAc,QAAmC,eAA+B;CAC9F,MAAM,aAAa,qBAAqB,OAAO;AAC/C,KAAI,eAAe,KAAA,EAAW,QAAO;CAErC,MAAM,kBAAkB,aAAa;AACrC,KAAI,CAAC,OAAO,SAAS,gBAAgB,IAAI,kBAAkB,gBACzD,OAAM,IAAI,eAAe,WAAW;AAEtC,QAAO,KAAK,IAAI,eAAe,gBAAgB;;;AAIjD,IAAa,SAAb,MAAoB;CAClB;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,UAAyB,EAAE,EAAE;AACvC,OAAK,aAAa,QAAQ,cAAc;AACxC,OAAK,YAAY,QAAQ,aAAa;AACtC,OAAK,UAAU,QAAQ,WAAW;AAClC,OAAK,YAAY,QAAQ,aAAa;AACtC,OAAK,cAAc,QAAQ,eAAe;EAE1C,MAAM,aAAa,KAAK;EACxB,MAAM,YAAY,KAAK;AAEvB,OAAK,QAAQ,OAAO,OAAO;GACzB,OAAO,KAAK;GACZ,WAAW,SAAS;IAElB,MAAM,UAAU,cADE,OAAO,QAAQ,QAAQ,UAAU,WAAW,QAAQ,QAAQ,QAAQ;IAEtF,MAAM,QAAQ,YAAY,KAAK,IAAI,GAAG,UAAU,EAAE;IAClD,MAAM,gBAAgB,QAAQ,QAAQ,KAAK,QAAQ,GAAG;IACtD,MAAM,aAAa,QAAQ,UAAU,QAAQ,IAAI,cAAc;AAC/D,QAAI;AACF,YAAO,cAAc,YAAY,cAAc;aACxC,OAAO;AACd,SAAI,iBAAiB,kBAAkB,QAAQ,UAAU,WAAW,IAClE,OAAM,IAAI,UAAU,QAAQ,UAAU,UAAU,GAAG,OAAO,QAAQ,QAAQ,EAAE,GAAG;AAEjF,WAAM;;;GAGV,kBAAkB;IAAC;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAI;GAC1D,SAAS,KAAK;GACd,SAAS;IACP,QAAQ;IACR,cAAc,KAAK;;GAEtB,CAAC;;;CAIJ,MAAM,QACJ,KACA,QACA,SACY;AACZ,MAAI,KAAK,YACP,OAAM,KAAK,YAAY,KAAK,OAAO;AAGrC,MAAI;AACF,UAAO,MAAM,KAAK,MAAS,KAAK;IAAE;IAAQ;IAAS,CAAC;WAC7C,OAAO;AACd,OAAI,iBAAiB,YAAY;AAC/B,QAAI,MAAM,eAAe,IACvB,OAAM,IAAI,eAAe,gBAAgB,MAAM,UAAU,QAAQ,IAAI,cAAc,CAAC,CAAC;IAGvF,MAAM,OAAO,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO,KAAK,UAAU,MAAM,QAAQ,GAAG;AAE3F,UAAM,IAAI,UAAU,MAAM,cAAc,GAAG,KAAK,KAAK;;AAEvD,SAAM;;;;AAKZ,IAAI;;AAGJ,SAAgB,gBAAwB;AACtC,KAAI,CAAC,eACH,kBAAiB,IAAI,QAAQ;AAE/B,QAAO;;;AC9HT,IAAsB,WAAtB,MAA+B;AAa/B,MAAM,+BAAe,IAAI,KAAgE;AACzF,MAAM,2BAAW,IAAI,KAAqB;;AAG1C,SAAgB,SACd,WACA,YACA,eACM;AACN,cAAa,IAAI,WAAW,cAAc;AAC1C,UAAS,IAAI,WAAW,WAAW;;;AAIrC,SAAgB,OAAO,WAAmB,SAAkB,QAA2B;CACrF,MAAM,gBAAgB,aAAa,IAAI,UAAU;AACjD,KAAI,CAAC,cACH,OAAM,IAAI,sBAAsB,UAAU;AAE5C,QAAO,IAAI,cAAc,WAAW,SAAS,IAAI,UAAU,EAAG,UAAU,eAAe,CAAC;;;AAI1F,SAAgB,aAAuB;AACrC,QAAO,CAAC,GAAG,aAAa,MAAM,CAAC;;;AAIjC,SAAgB,IAAI,WAA4B;AAC9C,QAAO,aAAa,IAAI,UAAU"}
+{"version":3,"file":"registry.mjs","names":[],"sources":["../../src/core/errors.ts","../../src/core/client.ts","../../src/core/registry.ts"],"sourcesContent":["/** Custom error types for registry operations. */\n\nexport class PkioError extends Error {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = \"PkioError\";\n  }\n}\n\nexport class HTTPError extends PkioError {\n  readonly statusCode: number;\n  readonly url: string;\n  readonly body: string;\n\n  constructor(statusCode: number, url: string, body: string) {\n    super(`HTTP ${statusCode}: ${url}`);\n    this.name = \"HTTPError\";\n    this.statusCode = statusCode;\n    this.url = url;\n    this.body = body;\n  }\n\n  isNotFound(): boolean {\n    return this.statusCode === 404;\n  }\n\n  isRateLimit(): boolean {\n    return this.statusCode === 429;\n  }\n\n  isServerError(): boolean {\n    return this.statusCode >= 500;\n  }\n}\n\nexport class NotFoundError extends PkioError {\n  readonly ecosystem: string;\n  readonly packageName: string;\n  readonly version: string;\n\n  constructor(ecosystem: string, packageName: string, version = \"\") {\n    const versionSuffix = version ? `@${version}` : \"\";\n    super(`Package not found: ${ecosystem}/${packageName}${versionSuffix}`);\n    this.name = \"NotFoundError\";\n    this.ecosystem = ecosystem;\n    this.packageName = packageName;\n    this.version = version;\n  }\n}\n\nexport class RateLimitError extends PkioError {\n  readonly retryAfter: number;\n\n  constructor(retryAfter: number) {\n    super(`Rate limited. Retry after ${retryAfter}s`);\n    this.name = \"RateLimitError\";\n    this.retryAfter = retryAfter;\n  }\n}\n\nexport class UnknownEcosystemError extends PkioError {\n  readonly ecosystem: string;\n\n  constructor(ecosystem: string) {\n    super(`Unknown ecosystem: ${ecosystem}`);\n    this.name = \"UnknownEcosystemError\";\n    this.ecosystem = ecosystem;\n  }\n}\n\nexport class InvalidPURLError extends PkioError {\n  readonly purl: string;\n\n  constructor(purl: string, reason: string) {\n    super(`Invalid PURL \"${purl}\": ${reason}`);\n    this.name = \"InvalidPURLError\";\n    this.purl = purl;\n  }\n}\n","import { ofetch, FetchError } from \"ofetch\";\nimport type { $Fetch, FetchOptions } from \"ofetch\";\nimport type { ClientOptions, RateLimiter } from \"./types.ts\";\nimport { HTTPError, RateLimitError } from \"./errors.ts\";\n\nconst DEFAULT_MAX_RETRIES = 5;\nconst DEFAULT_BASE_DELAY = 50;\nconst DEFAULT_TIMEOUT = 30_000;\nconst DEFAULT_USER_AGENT = \"registries/0.1.0\";\nconst MAX_TIMER_DELAY = 2_147_483_647;\n\nfunction retryCount(value: unknown): number {\n  return typeof value === \"number\" ? value : 0;\n}\n\nfunction parseRetryAfterValue(header: string | null | undefined): number | undefined {\n  if (!header) return undefined;\n  const trimmed = header.trim();\n  if (!trimmed) return undefined;\n\n  if (/^\\d+$/.test(trimmed)) {\n    const seconds = Number(trimmed);\n    return Number.isNaN(seconds) ? undefined : seconds;\n  }\n\n  const timestamp = /[a-z]/i.test(trimmed) ? Date.parse(trimmed) : NaN;\n  if (Number.isNaN(timestamp)) return undefined;\n\n  const seconds = Math.ceil((timestamp - Date.now()) / 1000);\n  return Math.max(seconds, 0);\n}\n\n/**\n * Parse a Retry-After header into seconds, defaulting to 60.\n *\n * @param header - Numeric seconds or an HTTP date.\n * @returns {number} The retry delay in seconds.\n */\nexport function parseRetryAfter(header: string | null | undefined): number {\n  return parseRetryAfterValue(header) ?? 60;\n}\n\n/**\n * Apply a valid Retry-After value or reject an unschedulable delay.\n *\n * @param header - Numeric seconds or an HTTP date.\n * @param fallbackDelay - Delay in milliseconds used without a valid header.\n * @returns {number} A timer-safe delay in milliseconds.\n */\nexport function retryDelayFor(header: string | null | undefined, fallbackDelay: number): number {\n  const retryAfter = parseRetryAfterValue(header);\n  if (retryAfter === undefined) return fallbackDelay;\n\n  const retryAfterDelay = retryAfter * 1000;\n  if (!Number.isFinite(retryAfterDelay) || retryAfterDelay > MAX_TIMER_DELAY) {\n    throw new RateLimitError(retryAfter);\n  }\n  return Math.max(fallbackDelay, retryAfterDelay);\n}\n\n/** HTTP client with retry, backoff, rate limiting, and timeout. */\nexport class Client {\n  readonly maxRetries: number;\n  readonly baseDelay: number;\n  readonly timeout: number;\n  readonly userAgent: string;\n  private readonly rateLimiter: RateLimiter | null;\n  private readonly fetch: $Fetch;\n\n  constructor(options: ClientOptions = {}) {\n    this.maxRetries = options.maxRetries ?? DEFAULT_MAX_RETRIES;\n    this.baseDelay = options.baseDelay ?? DEFAULT_BASE_DELAY;\n    this.timeout = options.timeout ?? DEFAULT_TIMEOUT;\n    this.userAgent = options.userAgent ?? DEFAULT_USER_AGENT;\n    this.rateLimiter = options.rateLimiter ?? null;\n\n    this.fetch = ofetch.create({\n      retry: this.maxRetries,\n      retryStatusCodes: [408, 409, 425, 429, 500, 502, 503, 504],\n      headers: {\n        Accept: \"application/json\",\n        \"User-Agent\": this.userAgent,\n      },\n    });\n  }\n\n  /**\n   * Fetch JSON with retry and rate limiting.\n   *\n   * @param url - Request URL.\n   * @param signal - Optional cancellation signal.\n   * @param headers - Optional request headers.\n   * @returns {Promise<T>} The decoded response body.\n   */\n  async getJSON<T>(\n    url: string,\n    signal?: AbortSignal,\n    headers?: Readonly<Record<string, string>>,\n  ): Promise<T> {\n    if (this.rateLimiter) {\n      await this.rateLimiter.wait(signal);\n    }\n\n    try {\n      return await this.fetch<T>(url, { headers, ...this.retryControl(signal) });\n    } catch (error) {\n      if (error instanceof FetchError) {\n        if (error.statusCode === 429) {\n          throw new RateLimitError(parseRetryAfter(error.response?.headers.get(\"Retry-After\")));\n        }\n\n        const body = typeof error.data === \"string\" ? error.data : JSON.stringify(error.data ?? \"\");\n\n        throw new HTTPError(error.statusCode ?? 0, url, body);\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * ofetch drops its timeout once a signal is supplied, sleeps through backoff with a plain\n   * timer and retries after an abort, so the request owns all three here.\n   *\n   * @param signal - Optional cancellation signal.\n   * @returns {FetchOptions} The request hooks that own timeout, backoff and cancellation.\n   */\n  private retryControl(\n    signal?: AbortSignal,\n  ): Pick<FetchOptions, \"signal\" | \"retryDelay\" | \"onRequest\" | \"onRequestError\"> {\n    let pendingDelay = 0;\n    return {\n      signal,\n      retryDelay: (context) => {\n        const remaining = retryCount(context.options.retry);\n        const attempt = this.maxRetries - remaining;\n        const delay = this.baseDelay * Math.pow(2, attempt - 1);\n        const jitteredDelay = delay + delay * Math.random() * 0.1;\n        const retryAfter = context.response?.headers.get(\"Retry-After\");\n        try {\n          pendingDelay = retryDelayFor(retryAfter, jitteredDelay);\n        } catch (error) {\n          if (error instanceof RateLimitError && context.response?.status !== 429) {\n            const requestURL =\n              typeof context.request === \"string\" ? context.request : context.request.url;\n            throw new HTTPError(context.response?.status ?? 0, requestURL, \"\");\n          }\n          throw error;\n        }\n        return 0;\n      },\n      onRequest: async ({ options }) => {\n        if (pendingDelay > 0) {\n          await abortableDelay(pendingDelay, signal);\n          pendingDelay = 0;\n        }\n        options.signal = this.attemptSignal(signal);\n      },\n      onRequestError: ({ options }) => {\n        if (signal?.aborted) options.retry = false;\n      },\n    };\n  }\n\n  private attemptSignal(signal?: AbortSignal): AbortSignal | undefined {\n    const signals = [signal, this.timeout > 0 ? AbortSignal.timeout(this.timeout) : undefined];\n    const active = signals.filter((candidate) => candidate !== undefined);\n    return active.length > 0 ? AbortSignal.any(active) : undefined;\n  }\n}\n\n/**\n * Sleep that returns as soon as the signal fires, so an abort never waits out a Retry-After.\n *\n * @param milliseconds - Delay before resolving.\n * @param signal - Optional cancellation signal that ends the wait early.\n * @returns {Promise<void>} Resolution after the delay or the abort.\n */\nfunction abortableDelay(milliseconds: number, signal?: AbortSignal): Promise<void> {\n  if (!signal) return new Promise((resolve) => setTimeout(resolve, milliseconds));\n  if (signal.aborted) return Promise.resolve();\n  return new Promise((resolve) => {\n    const onAbort = (): void => {\n      clearTimeout(timer);\n      resolve();\n    };\n    const timer = setTimeout(() => {\n      signal.removeEventListener(\"abort\", onAbort);\n      resolve();\n    }, milliseconds);\n    signal.addEventListener(\"abort\", onAbort, { once: true });\n  });\n}\n\nlet _defaultClient: Client | undefined;\n\n/**\n * Get or create the shared HTTP client.\n *\n * @returns {Client} The shared client.\n */\nexport function defaultClient(): Client {\n  _defaultClient ??= new Client();\n  return _defaultClient;\n}\n","import type { Client } from \"./client.ts\";\nimport { defaultClient } from \"./client.ts\";\nimport { UnknownEcosystemError } from \"./errors.ts\";\nimport type { Dependency, Maintainer, Package, URLBuilder, Version } from \"./types.ts\";\n\n/** Common base for package registries and registry decorators. */\nexport abstract class Registry {\n  abstract ecosystem(): string;\n  abstract fetchPackage(name: string, signal?: AbortSignal): Promise<Package>;\n  abstract fetchVersions(name: string, signal?: AbortSignal): Promise<Version[]>;\n  abstract fetchDependencies(\n    name: string,\n    version: string,\n    signal?: AbortSignal,\n  ): Promise<Dependency[]>;\n  abstract fetchMaintainers(name: string, signal?: AbortSignal): Promise<Maintainer[]>;\n  abstract urls(): URLBuilder;\n}\n\nconst constructors = new Map<string, new (baseURL: string, client: Client) => Registry>();\nconst defaults = new Map<string, string>();\n\n/**\n * Register an ecosystem adapter.\n *\n * @param ecosystem - Ecosystem key.\n * @param defaultURL - Default registry API URL.\n * @param RegistryClass - Adapter constructor.\n */\nexport function register(\n  ecosystem: string,\n  defaultURL: string,\n  RegistryClass: new (baseURL: string, client: Client) => Registry,\n): void {\n  constructors.set(ecosystem, RegistryClass);\n  defaults.set(ecosystem, defaultURL);\n}\n\n/**\n * Create an adapter for a registered ecosystem.\n *\n * @param ecosystem - Ecosystem key.\n * @param baseURL - Optional registry API URL override.\n * @param client - Optional HTTP client.\n * @returns {Registry} The registry adapter.\n */\nexport function create(ecosystem: string, baseURL?: string, client?: Client): Registry {\n  const RegistryClass = constructors.get(ecosystem);\n  if (!RegistryClass) {\n    throw new UnknownEcosystemError(ecosystem);\n  }\n  return new RegistryClass(baseURL || defaults.get(ecosystem)!, client ?? defaultClient());\n}\n\n/**\n * List registered ecosystems.\n *\n * @returns {string[]} The ecosystem keys.\n */\nexport function ecosystems(): string[] {\n  return [...constructors.keys()];\n}\n\n/**\n * Check whether an ecosystem is registered.\n *\n * @param ecosystem - Ecosystem key.\n * @returns {boolean} Whether an adapter is registered.\n */\nexport function has(ecosystem: string): boolean {\n  return constructors.has(ecosystem);\n}\n"],"mappings":";;AAEA,IAAa,YAAb,cAA+B,MAAM;CACnC,YAAY,SAAiB,SAAwB;AACnD,QAAM,SAAS,QAAQ;AACvB,OAAK,OAAO;;;AAIhB,IAAa,YAAb,cAA+B,UAAU;CACvC;CACA;CACA;CAEA,YAAY,YAAoB,KAAa,MAAc;AACzD,QAAM,QAAQ,WAAW,IAAI,MAAM;AACnC,OAAK,OAAO;AACZ,OAAK,aAAa;AAClB,OAAK,MAAM;AACX,OAAK,OAAO;;CAGd,aAAsB;AACpB,SAAO,KAAK,eAAe;;CAG7B,cAAuB;AACrB,SAAO,KAAK,eAAe;;CAG7B,gBAAyB;AACvB,SAAO,KAAK,cAAc;;;AAI9B,IAAa,gBAAb,cAAmC,UAAU;CAC3C;CACA;CACA;CAEA,YAAY,WAAmB,aAAqB,UAAU,IAAI;EAChE,MAAM,gBAAgB,UAAU,IAAI,YAAY;AAChD,QAAM,sBAAsB,UAAU,GAAG,cAAc,gBAAgB;AACvE,OAAK,OAAO;AACZ,OAAK,YAAY;AACjB,OAAK,cAAc;AACnB,OAAK,UAAU;;;AAInB,IAAa,iBAAb,cAAoC,UAAU;CAC5C;CAEA,YAAY,YAAoB;AAC9B,QAAM,6BAA6B,WAAW,GAAG;AACjD,OAAK,OAAO;AACZ,OAAK,aAAa;;;AAItB,IAAa,wBAAb,cAA2C,UAAU;CACnD;CAEA,YAAY,WAAmB;AAC7B,QAAM,sBAAsB,YAAY;AACxC,OAAK,OAAO;AACZ,OAAK,YAAY;;;AAIrB,IAAa,mBAAb,cAAsC,UAAU;CAC9C;CAEA,YAAY,MAAc,QAAgB;AACxC,QAAM,iBAAiB,KAAK,KAAK,SAAS;AAC1C,OAAK,OAAO;AACZ,OAAK,OAAO;;;ACvEhB,MAAM,sBAAsB;AAC5B,MAAM,qBAAqB;AAC3B,MAAM,kBAAkB;AACxB,MAAM,qBAAqB;AAC3B,MAAM,kBAAkB;AAExB,SAAS,WAAW,OAAwB;AAC1C,QAAO,OAAO,UAAU,WAAW,QAAQ;;AAG7C,SAAS,qBAAqB,QAAuD;AACnF,KAAI,CAAC,OAAQ,QAAO,KAAA;CACpB,MAAM,UAAU,OAAO,MAAM;AAC7B,KAAI,CAAC,QAAS,QAAO,KAAA;AAErB,KAAI,QAAQ,KAAK,QAAQ,EAAE;EACzB,MAAM,UAAU,OAAO,QAAQ;AAC/B,SAAO,OAAO,MAAM,QAAQ,GAAG,KAAA,IAAY;;CAG7C,MAAM,YAAY,SAAS,KAAK,QAAQ,GAAG,KAAK,MAAM,QAAQ,GAAG;AACjE,KAAI,OAAO,MAAM,UAAU,CAAE,QAAO,KAAA;CAEpC,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,KAAK,IAAI,IAAK;AAC1D,QAAO,KAAK,IAAI,SAAS,EAAE;;;;;;;;AAS7B,SAAgB,gBAAgB,QAA2C;AACzE,QAAO,qBAAqB,OAAO,IAAI;;;;;;;;;AAUzC,SAAgB,cAAc,QAAmC,eAA+B;CAC9F,MAAM,aAAa,qBAAqB,OAAO;AAC/C,KAAI,eAAe,KAAA,EAAW,QAAO;CAErC,MAAM,kBAAkB,aAAa;AACrC,KAAI,CAAC,OAAO,SAAS,gBAAgB,IAAI,kBAAkB,gBACzD,OAAM,IAAI,eAAe,WAAW;AAEtC,QAAO,KAAK,IAAI,eAAe,gBAAgB;;;AAIjD,IAAa,SAAb,MAAoB;CAClB;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,UAAyB,EAAE,EAAE;AACvC,OAAK,aAAa,QAAQ,cAAc;AACxC,OAAK,YAAY,QAAQ,aAAa;AACtC,OAAK,UAAU,QAAQ,WAAW;AAClC,OAAK,YAAY,QAAQ,aAAa;AACtC,OAAK,cAAc,QAAQ,eAAe;AAE1C,OAAK,QAAQ,OAAO,OAAO;GACzB,OAAO,KAAK;GACZ,kBAAkB;IAAC;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAK;IAAI;GAC1D,SAAS;IACP,QAAQ;IACR,cAAc,KAAK;;GAEtB,CAAC;;;;;;;;;;CAWJ,MAAM,QACJ,KACA,QACA,SACY;AACZ,MAAI,KAAK,YACP,OAAM,KAAK,YAAY,KAAK,OAAO;AAGrC,MAAI;AACF,UAAO,MAAM,KAAK,MAAS,KAAK;IAAE;IAAS,GAAG,KAAK,aAAa,OAAA;IAAS,CAAC;WACnE,OAAO;AACd,OAAI,iBAAiB,YAAY;AAC/B,QAAI,MAAM,eAAe,IACvB,OAAM,IAAI,eAAe,gBAAgB,MAAM,UAAU,QAAQ,IAAI,cAAc,CAAC,CAAC;IAGvF,MAAM,OAAO,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO,KAAK,UAAU,MAAM,QAAQ,GAAG;AAE3F,UAAM,IAAI,UAAU,MAAM,cAAc,GAAG,KAAK,KAAK;;AAEvD,SAAM;;;;;;;;;;CAWV,aACE,QAC8E;EAC9E,IAAI,eAAe;AACnB,SAAO;GACL;GACA,aAAa,YAAY;IACvB,MAAM,YAAY,WAAW,QAAQ,QAAQ,MAAM;IACnD,MAAM,UAAU,KAAK,aAAa;IAClC,MAAM,QAAQ,KAAK,YAAY,KAAK,IAAI,GAAG,UAAU,EAAE;IACvD,MAAM,gBAAgB,QAAQ,QAAQ,KAAK,QAAQ,GAAG;IACtD,MAAM,aAAa,QAAQ,UAAU,QAAQ,IAAI,cAAc;AAC/D,QAAI;AACF,oBAAe,cAAc,YAAY,cAAc;aAChD,OAAO;AACd,SAAI,iBAAiB,kBAAkB,QAAQ,UAAU,WAAW,KAAK;MACvE,MAAM,aACJ,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU,QAAQ,QAAQ;AAC1E,YAAM,IAAI,UAAU,QAAQ,UAAU,UAAU,GAAG,YAAY,GAAG;;AAEpE,WAAM;;AAER,WAAO;;GAET,WAAW,OAAO,EAAE,cAAc;AAChC,QAAI,eAAe,GAAG;AACpB,WAAM,eAAe,cAAc,OAAO;AAC1C,oBAAe;;AAEjB,YAAQ,SAAS,KAAK,cAAc,OAAO;;GAE7C,iBAAiB,EAAE,cAAc;AAC/B,QAAI,QAAQ,QAAS,SAAQ,QAAQ;;GAExC;;CAGH,cAAsB,QAA+C;EAEnE,MAAM,SADU,CAAC,QAAQ,KAAK,UAAU,IAAI,YAAY,QAAQ,KAAK,QAAQ,GAAG,KAAA,EAAU,CACnE,QAAQ,cAAc,cAAc,KAAA,EAAU;AACrE,SAAO,OAAO,SAAS,IAAI,YAAY,IAAI,OAAO,GAAG,KAAA;;;;;;;;;;AAWzD,SAAS,eAAe,cAAsB,QAAqC;AACjF,KAAI,CAAC,OAAQ,QAAO,IAAI,SAAS,YAAY,WAAW,SAAS,aAAa,CAAC;AAC/E,KAAI,OAAO,QAAS,QAAO,QAAQ,SAAS;AAC5C,QAAO,IAAI,SAAS,YAAY;EAC9B,MAAM,gBAAsB;AAC1B,gBAAa,MAAM;AACnB,YAAS;;EAEX,MAAM,QAAQ,iBAAiB;AAC7B,UAAO,oBAAoB,SAAS,QAAQ;AAC5C,YAAS;KACR,aAAa;AAChB,SAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM,CAAC;GACzD;;AAGJ,IAAI;;;;;;AAOJ,SAAgB,gBAAwB;AACtC,oBAAmB,IAAI,QAAQ;AAC/B,QAAO;;;ACpMT,IAAsB,WAAtB,MAA+B;AAa/B,MAAM,+BAAe,IAAI,KAAgE;AACzF,MAAM,2BAAW,IAAI,KAAqB;;;;;;;;AAS1C,SAAgB,SACd,WACA,YACA,eACM;AACN,cAAa,IAAI,WAAW,cAAc;AAC1C,UAAS,IAAI,WAAW,WAAW;;;;;;;;;;AAWrC,SAAgB,OAAO,WAAmB,SAAkB,QAA2B;CACrF,MAAM,gBAAgB,aAAa,IAAI,UAAU;AACjD,KAAI,CAAC,cACH,OAAM,IAAI,sBAAsB,UAAU;AAE5C,QAAO,IAAI,cAAc,WAAW,SAAS,IAAI,UAAU,EAAG,UAAU,eAAe,CAAC;;;;;;;AAQ1F,SAAgB,aAAuB;AACrC,QAAO,CAAC,GAAG,aAAa,MAAM,CAAC;;;;;;;;AASjC,SAAgB,IAAI,WAA4B;AAC9C,QAAO,aAAa,IAAI,UAAU"}

package/dist/{commands → _chunks}/shared.mjs

@@ -1,7 +1,6 @@
-import { c as HTTPError, f as RateLimitError, l as InvalidPURLError, n as create, p as UnknownEcosystemError, r as ecosystems, u as NotFoundError } from "../_chunks/registry.mjs";
-import { i as parsePURL, n as createFromPURL, r as fullName } from "../_chunks/purl.mjs";
-import "../_chunks/registries.mjs";
-import { CachedRegistry } from "../cache/cached-registry.mjs";
+import { c as HTTPError, f as RateLimitError, l as InvalidPURLError, n as create, p as UnknownEcosystemError, r as ecosystems, u as NotFoundError } from "./registry.mjs";
+import { c as createFromPURL, l as fullName, u as parsePURL } from "./registries.mjs";
+import { t as CachedRegistry } from "./cached-registry.mjs";
 import consola from "consola";
 const sharedArgs = {
 	json: {
@@ -16,8 +15,11 @@ const sharedArgs = {
 	}
 };
 /**
-* Resolve a PURL string or shorthand into [registry, name, version].
-* Uses CachedRegistry unless --no-cache is set.
+* Resolve a PURL or shorthand, using cache unless disabled.
+*
+* @param input - PURL or shorthand package identifier.
+* @param useCache - Whether to wrap the registry with caching.
+* @returns {[Registry, string, string]} The registry, package name, and version.
 */
 function resolvePURL(input, useCache = true) {
 	let purl = input;
@@ -33,7 +35,12 @@ function resolvePURL(input, useCache = true) {
 	}
 	return createFromPURL(purl);
 }
-/** Run a command with standard error handling. */
+/**
+* Run a command with standard CLI error handling.
+*
+* @param fn - Command operation to run.
+* @returns {Promise<void>} Completion after the command or handled exit.
+*/
 async function withErrorHandling(fn) {
 	try {
 		await fn();
@@ -64,6 +71,6 @@ async function withErrorHandling(fn) {
 		throw error;
 	}
 }
-export { resolvePURL, sharedArgs, withErrorHandling };
+export { sharedArgs as n, withErrorHandling as r, resolvePURL as t };
 
 //# sourceMappingURL=shared.mjs.map

package/dist/_chunks/shared.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.mjs","names":[],"sources":["../../src/commands/shared.ts"],"sourcesContent":["import consola from \"consola\";\nimport { createFromPURL, parsePURL, fullName } from \"../core/purl.ts\";\nimport { create, ecosystems, type Registry } from \"../core/registry.ts\";\nimport {\n  HTTPError,\n  NotFoundError,\n  RateLimitError,\n  UnknownEcosystemError,\n  InvalidPURLError,\n} from \"../core/errors.ts\";\nimport { CachedRegistry } from \"../cache/cached-registry.ts\";\nimport \"../registries/index.ts\";\n\nexport const sharedArgs = {\n  json: {\n    type: \"boolean\" as const,\n    description: \"Output as JSON\",\n    default: false,\n  },\n  \"no-cache\": {\n    type: \"boolean\" as const,\n    description: \"Bypass cache, fetch fresh data\",\n    default: false,\n  },\n} as const;\n\n/**\n * Resolve a PURL or shorthand, using cache unless disabled.\n *\n * @param input - PURL or shorthand package identifier.\n * @param useCache - Whether to wrap the registry with caching.\n * @returns {[Registry, string, string]} The registry, package name, and version.\n */\nexport function resolvePURL(input: string, useCache = true): [Registry, string, string] {\n  let purl = input;\n  if (!purl.startsWith(\"pkg:\")) {\n    purl = `pkg:${purl}`;\n  }\n\n  if (useCache) {\n    const parsed = parsePURL(purl);\n    const baseURL = parsed.qualifiers[\"repository_url\"] ?? \"\";\n    const inner = create(parsed.type, baseURL || undefined);\n    const reg = new CachedRegistry(inner);\n    return [reg, fullName(parsed), parsed.version];\n  }\n\n  return createFromPURL(purl);\n}\n\n/**\n * Run a command with standard CLI error handling.\n *\n * @param fn - Command operation to run.\n * @returns {Promise<void>} Completion after the command or handled exit.\n */\nexport async function withErrorHandling(fn: () => Promise<void>): Promise<void> {\n  try {\n    await fn();\n  } catch (error) {\n    if (error instanceof NotFoundError) {\n      consola.error(\n        `Package not found: ${error.ecosystem}/${error.packageName}${error.version ? `@${error.version}` : \"\"}`,\n      );\n      return process.exit(1);\n    }\n    if (error instanceof UnknownEcosystemError) {\n      consola.error(`Unknown ecosystem: ${error.ecosystem}`);\n      consola.info(`Supported: ${ecosystems().join(\", \")}`);\n      return process.exit(1);\n    }\n    if (error instanceof InvalidPURLError) {\n      consola.error(`Invalid PURL: ${error.purl}`);\n      consola.info(\"Examples: pkg:npm/lodash, npm/lodash@4.17.21, pkg:cargo/serde\");\n      return process.exit(1);\n    }\n    if (error instanceof RateLimitError) {\n      consola.error(`Rate limited by registry. Retry after ${error.retryAfter}s`);\n      return process.exit(1);\n    }\n    if (error instanceof HTTPError) {\n      consola.error(`Registry request failed: HTTP ${error.statusCode} (${error.url})`);\n      if (error.isServerError()) {\n        consola.info(\"The registry may be temporarily unavailable. Try again later.\");\n      }\n      return process.exit(1);\n    }\n    throw error;\n  }\n}\n"],"mappings":";;;;AAaA,MAAa,aAAa;CACxB,MAAM;EACJ,MAAM;EACN,aAAa;EACb,SAAS;EACV;CACD,YAAY;EACV,MAAM;EACN,aAAa;EACb,SAAS;;CAEZ;;;;;;;;AASD,SAAgB,YAAY,OAAe,WAAW,MAAkC;CACtF,IAAI,OAAO;AACX,KAAI,CAAC,KAAK,WAAW,OAAO,CAC1B,QAAO,OAAO;AAGhB,KAAI,UAAU;EACZ,MAAM,SAAS,UAAU,KAAK;EAC9B,MAAM,UAAU,OAAO,WAAW,qBAAqB;AAGvD,SAAO;GADK,IAAI,eADF,OAAO,OAAO,MAAM,WAAW,KAAA,EAAU,CAClB;GACxB,SAAS,OAAO;GAAE,OAAO;GAAQ;;AAGhD,QAAO,eAAe,KAAK;;;;;;;;AAS7B,eAAsB,kBAAkB,IAAwC;AAC9E,KAAI;AACF,QAAM,IAAI;UACH,OAAO;AACd,MAAI,iBAAiB,eAAe;AAClC,WAAQ,MACN,sBAAsB,MAAM,UAAU,GAAG,MAAM,cAAc,MAAM,UAAU,IAAI,MAAM,YAAY,KACpG;AACD,UAAO,QAAQ,KAAK,EAAE;;AAExB,MAAI,iBAAiB,uBAAuB;AAC1C,WAAQ,MAAM,sBAAsB,MAAM,YAAY;AACtD,WAAQ,KAAK,cAAc,YAAY,CAAC,KAAK,KAAK,GAAG;AACrD,UAAO,QAAQ,KAAK,EAAE;;AAExB,MAAI,iBAAiB,kBAAkB;AACrC,WAAQ,MAAM,iBAAiB,MAAM,OAAO;AAC5C,WAAQ,KAAK,gEAAgE;AAC7E,UAAO,QAAQ,KAAK,EAAE;;AAExB,MAAI,iBAAiB,gBAAgB;AACnC,WAAQ,MAAM,yCAAyC,MAAM,WAAW,GAAG;AAC3E,UAAO,QAAQ,KAAK,EAAE;;AAExB,MAAI,iBAAiB,WAAW;AAC9B,WAAQ,MAAM,iCAAiC,MAAM,WAAW,IAAI,MAAM,IAAI,GAAG;AACjF,OAAI,MAAM,eAAe,CACvB,SAAQ,KAAK,gEAAgE;AAE/E,UAAO,QAAQ,KAAK,EAAE;;AAExB,QAAM"}

package/dist/_chunks/tool-operations.mjs

@@ -0,0 +1,63 @@
+import { d as PkioError, l as InvalidPURLError, r as ecosystems } from "./registry.mjs";
+import { u as parsePURL } from "./registries.mjs";
+import { a as fetchVersionsFromPURL, i as fetchPackageFromPURL, n as fetchDependenciesFromPURL, r as fetchMaintainersFromPURL, t as bulkFetchPackages } from "./helpers.mjs";
+const MAX_PURL_LENGTH = 2048;
+const MAX_BULK_PACKAGES = 50;
+const DEFAULT_BULK_CONCURRENCY = 15;
+const MAX_BULK_CONCURRENCY = 50;
+function jsonResult(details) {
+	return {
+		content: [{
+			type: "text",
+			text: JSON.stringify(details, null, 2)
+		}],
+		details
+	};
+}
+function assertPURL(purl) {
+	if (typeof purl !== "string" || purl.length === 0) throw new InvalidPURLError(String(purl), "must be a non-empty string");
+	if (purl.length > MAX_PURL_LENGTH) throw new InvalidPURLError(purl.slice(0, MAX_PURL_LENGTH), `must not exceed ${MAX_PURL_LENGTH} characters`);
+	const parsed = parsePURL(purl);
+	if (Object.hasOwn(parsed.qualifiers, "repository_url")) throw new InvalidPURLError(purl, "repository_url is not allowed in agent tools");
+}
+function isPURLArray(value) {
+	return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function assertBulkParams(params) {
+	if (!isPURLArray(params.purls) || params.purls.length === 0) throw new PkioError("Bulk package lookup needs at least one PURL");
+	if (params.purls.length > MAX_BULK_PACKAGES) throw new PkioError(`Bulk package lookup accepts at most ${MAX_BULK_PACKAGES} PURLs`);
+	for (const purl of params.purls) assertPURL(purl);
+	const concurrency = params.concurrency ?? DEFAULT_BULK_CONCURRENCY;
+	if (!Number.isInteger(concurrency) || concurrency < 1 || concurrency > MAX_BULK_CONCURRENCY) throw new PkioError(`Concurrency must be an integer from 1 through ${MAX_BULK_CONCURRENCY}`);
+}
+async function packageOperation(params, signal, client) {
+	assertPURL(params.purl);
+	return jsonResult(await fetchPackageFromPURL(params.purl, signal, client));
+}
+async function versionsOperation(params, signal, client) {
+	assertPURL(params.purl);
+	return jsonResult(await fetchVersionsFromPURL(params.purl, signal, client));
+}
+async function dependenciesOperation(params, signal, client) {
+	assertPURL(params.purl);
+	return jsonResult(await fetchDependenciesFromPURL(params.purl, signal, client));
+}
+async function maintainersOperation(params, signal, client) {
+	assertPURL(params.purl);
+	return jsonResult(await fetchMaintainersFromPURL(params.purl, signal, client));
+}
+async function bulkPackagesOperation(params, signal, client) {
+	assertBulkParams(params);
+	const packages = await bulkFetchPackages(params.purls, {
+		concurrency: params.concurrency ?? DEFAULT_BULK_CONCURRENCY,
+		signal,
+		client
+	});
+	return jsonResult(Object.fromEntries(packages));
+}
+async function ecosystemsOperation() {
+	return jsonResult({ ecosystems: ecosystems().sort() });
+}
+export { bulkPackagesOperation as a, maintainersOperation as c, MAX_PURL_LENGTH as i, packageOperation as l, MAX_BULK_CONCURRENCY as n, dependenciesOperation as o, MAX_BULK_PACKAGES as r, ecosystemsOperation as s, DEFAULT_BULK_CONCURRENCY as t, versionsOperation as u };
+
+//# sourceMappingURL=tool-operations.mjs.map

package/dist/_chunks/tool-operations.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-operations.mjs","names":[],"sources":["../../src/tool-operations.ts"],"sourcesContent":["import \"./registries/index.ts\";\nimport type { Client } from \"./core/client.ts\";\nimport { InvalidPURLError, PkioError } from \"./core/errors.ts\";\nimport { parsePURL } from \"./core/purl.ts\";\nimport { ecosystems } from \"./core/registry.ts\";\nimport type { Package } from \"./core/types.ts\";\nimport {\n  bulkFetchPackages,\n  fetchDependenciesFromPURL,\n  fetchMaintainersFromPURL,\n  fetchPackageFromPURL,\n  fetchVersionsFromPURL,\n} from \"./helpers.ts\";\n\nexport const MAX_PURL_LENGTH = 2_048;\nexport const MAX_BULK_PACKAGES = 50;\nexport const DEFAULT_BULK_CONCURRENCY = 15;\nexport const MAX_BULK_CONCURRENCY = 50;\n\nexport interface ToolResult<T> {\n  content: Array<{ type: \"text\"; text: string }>;\n  details: T;\n  isError?: boolean;\n}\n\nexport interface PURLParams {\n  readonly purl: string;\n}\n\nexport interface BulkPackagesParams {\n  readonly purls: readonly string[];\n  readonly concurrency?: number;\n}\n\nfunction jsonResult<T>(details: T): ToolResult<T> {\n  return {\n    content: [{ type: \"text\", text: JSON.stringify(details, null, 2) }],\n    details,\n  };\n}\n\nfunction assertPURL(purl: string): void {\n  if (typeof purl !== \"string\" || purl.length === 0) {\n    throw new InvalidPURLError(String(purl), \"must be a non-empty string\");\n  }\n  if (purl.length > MAX_PURL_LENGTH) {\n    throw new InvalidPURLError(\n      purl.slice(0, MAX_PURL_LENGTH),\n      `must not exceed ${MAX_PURL_LENGTH} characters`,\n    );\n  }\n\n  const parsed = parsePURL(purl);\n  if (Object.hasOwn(parsed.qualifiers, \"repository_url\")) {\n    throw new InvalidPURLError(purl, \"repository_url is not allowed in agent tools\");\n  }\n}\n\nfunction isPURLArray(value: unknown): value is readonly string[] {\n  return Array.isArray(value) && value.every((item: unknown) => typeof item === \"string\");\n}\n\nfunction assertBulkParams(params: Readonly<BulkPackagesParams>): void {\n  if (!isPURLArray(params.purls) || params.purls.length === 0) {\n    throw new PkioError(\"Bulk package lookup needs at least one PURL\");\n  }\n  if (params.purls.length > MAX_BULK_PACKAGES) {\n    throw new PkioError(`Bulk package lookup accepts at most ${MAX_BULK_PACKAGES} PURLs`);\n  }\n  for (const purl of params.purls) assertPURL(purl);\n\n  const concurrency = params.concurrency ?? DEFAULT_BULK_CONCURRENCY;\n  if (!Number.isInteger(concurrency) || concurrency < 1 || concurrency > MAX_BULK_CONCURRENCY) {\n    throw new PkioError(`Concurrency must be an integer from 1 through ${MAX_BULK_CONCURRENCY}`);\n  }\n}\n\nexport async function packageOperation(\n  params: Readonly<PURLParams>,\n  signal?: AbortSignal,\n  client?: Client,\n): Promise<ToolResult<Package>> {\n  assertPURL(params.purl);\n  return jsonResult(await fetchPackageFromPURL(params.purl, signal, client));\n}\n\nexport async function versionsOperation(\n  params: Readonly<PURLParams>,\n  signal?: AbortSignal,\n  client?: Client,\n) {\n  assertPURL(params.purl);\n  return jsonResult(await fetchVersionsFromPURL(params.purl, signal, client));\n}\n\nexport async function dependenciesOperation(\n  params: Readonly<PURLParams>,\n  signal?: AbortSignal,\n  client?: Client,\n) {\n  assertPURL(params.purl);\n  return jsonResult(await fetchDependenciesFromPURL(params.purl, signal, client));\n}\n\nexport async function maintainersOperation(\n  params: Readonly<PURLParams>,\n  signal?: AbortSignal,\n  client?: Client,\n) {\n  assertPURL(params.purl);\n  return jsonResult(await fetchMaintainersFromPURL(params.purl, signal, client));\n}\n\nexport async function bulkPackagesOperation(\n  params: Readonly<BulkPackagesParams>,\n  signal?: AbortSignal,\n  client?: Client,\n): Promise<ToolResult<Record<string, Package>>> {\n  assertBulkParams(params);\n  const packages = await bulkFetchPackages(params.purls, {\n    concurrency: params.concurrency ?? DEFAULT_BULK_CONCURRENCY,\n    signal,\n    client,\n  });\n  return jsonResult(Object.fromEntries(packages));\n}\n\nexport async function ecosystemsOperation(): Promise<ToolResult<{ ecosystems: string[] }>> {\n  return jsonResult({ ecosystems: ecosystems().sort() });\n}\n"],"mappings":";;;AAcA,MAAa,kBAAkB;AAC/B,MAAa,oBAAoB;AACjC,MAAa,2BAA2B;AACxC,MAAa,uBAAuB;AAiBpC,SAAS,WAAc,SAA2B;AAChD,QAAO;EACL,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,SAAS,MAAM,EAAA;GAAI,CAAC;EACnE;EACD;;AAGH,SAAS,WAAW,MAAoB;AACtC,KAAI,OAAO,SAAS,YAAY,KAAK,WAAW,EAC9C,OAAM,IAAI,iBAAiB,OAAO,KAAK,EAAE,6BAA6B;AAExE,KAAI,KAAK,SAAS,gBAChB,OAAM,IAAI,iBACR,KAAK,MAAM,GAAG,gBAAgB,EAC9B,mBAAmB,gBAAgB,aACpC;CAGH,MAAM,SAAS,UAAU,KAAK;AAC9B,KAAI,OAAO,OAAO,OAAO,YAAY,iBAAiB,CACpD,OAAM,IAAI,iBAAiB,MAAM,+CAA+C;;AAIpF,SAAS,YAAY,OAA4C;AAC/D,QAAO,MAAM,QAAQ,MAAM,IAAI,MAAM,OAAO,SAAkB,OAAO,SAAS,SAAS;;AAGzF,SAAS,iBAAiB,QAA4C;AACpE,KAAI,CAAC,YAAY,OAAO,MAAM,IAAI,OAAO,MAAM,WAAW,EACxD,OAAM,IAAI,UAAU,8CAA8C;AAEpE,KAAI,OAAO,MAAM,SAAS,kBACxB,OAAM,IAAI,UAAU,uCAAuC,kBAAkB,QAAQ;AAEvF,MAAK,MAAM,QAAQ,OAAO,MAAO,YAAW,KAAK;CAEjD,MAAM,cAAc,OAAO,eAAe;AAC1C,KAAI,CAAC,OAAO,UAAU,YAAY,IAAI,cAAc,KAAK,cAAc,qBACrE,OAAM,IAAI,UAAU,iDAAiD,uBAAuB;;AAIhG,eAAsB,iBACpB,QACA,QACA,QAC8B;AAC9B,YAAW,OAAO,KAAK;AACvB,QAAO,WAAW,MAAM,qBAAqB,OAAO,MAAM,QAAQ,OAAO,CAAC;;AAG5E,eAAsB,kBACpB,QACA,QACA,QACA;AACA,YAAW,OAAO,KAAK;AACvB,QAAO,WAAW,MAAM,sBAAsB,OAAO,MAAM,QAAQ,OAAO,CAAC;;AAG7E,eAAsB,sBACpB,QACA,QACA,QACA;AACA,YAAW,OAAO,KAAK;AACvB,QAAO,WAAW,MAAM,0BAA0B,OAAO,MAAM,QAAQ,OAAO,CAAC;;AAGjF,eAAsB,qBACpB,QACA,QACA,QACA;AACA,YAAW,OAAO,KAAK;AACvB,QAAO,WAAW,MAAM,yBAAyB,OAAO,MAAM,QAAQ,OAAO,CAAC;;AAGhF,eAAsB,sBACpB,QACA,QACA,QAC8C;AAC9C,kBAAiB,OAAO;CACxB,MAAM,WAAW,MAAM,kBAAkB,OAAO,OAAO;EACrD,aAAa,OAAO,eAAe;EACnC;EACA;EACD,CAAC;AACF,QAAO,WAAW,OAAO,YAAY,SAAS,CAAC;;AAGjD,eAAsB,sBAAqE;AACzF,QAAO,WAAW,EAAE,YAAY,YAAY,CAAC,MAAM,EAAE,CAAC"}

package/dist/_chunks/version.mjs

@@ -0,0 +1,4 @@
+const version = "0.3.1";
+export { version as t };
+
+//# sourceMappingURL=version.mjs.map

package/dist/_chunks/version.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.mjs","names":["packageJSON.version"],"sources":["../../package.json","../../src/version.ts"],"sourcesContent":["","import packageJSON from \"../package.json\" with { type: \"json\" };\n\nexport const version = packageJSON.version;\n"],"mappings":"ACEA,MAAa"}

package/dist/{commands → _chunks}/versions.mjs

@@ -1,7 +1,8 @@
-import "../_chunks/registry.mjs";
-import "../_chunks/purl.mjs";
-import "../_chunks/registries.mjs";
-import { resolvePURL, sharedArgs, withErrorHandling } from "./shared.mjs";
+import "./registry.mjs";
+import "./registries.mjs";
+import "./lockfile.mjs";
+import "./cached-registry.mjs";
+import { n as sharedArgs, r as withErrorHandling, t as resolvePURL } from "./shared.mjs";
 import { defineCommand } from "citty";
 import consola from "consola";
 function selectRecentVersions(versions, limit) {
@@ -41,18 +42,18 @@ var versions_default = defineCommand({
 				return;
 			}
 			consola.log("");
-			consola.log(`  \x1b[1m${name}\x1b[0m — ${versions.length} version${versions.length === 1 ? "" : "s"}`);
+			consola.log(`  \x1B[1m${name}\x1B[0m — ${versions.length} version${versions.length === 1 ? "" : "s"}`);
 			consola.log("");
 			for (const v of shown) {
-				const status = v.status ? ` \x1b[33m[${v.status}]\x1b[0m` : "";
-				const date = v.publishedAt ? `  \x1b[90m${v.publishedAt.toISOString().slice(0, 10)}\x1b[0m` : "";
+				const status = v.status ? ` \x1B[33m[${v.status}]\x1B[0m` : "";
+				const date = v.publishedAt ? `  \x1B[90m${v.publishedAt.toISOString().slice(0, 10)}\x1B[0m` : "";
 				consola.log(`  ${v.number}${status}${date}`);
 			}
-			if (versions.length > limit) consola.log(`\n  \x1b[90m... and ${versions.length - limit} more (use --limit to show more)\x1b[0m`);
+			if (versions.length > limit) consola.log(`\n  \x1B[90m... and ${versions.length - limit} more (use --limit to show more)\x1B[0m`);
 			consola.log("");
 		});
 	}
 });
-export { versions_default as default, selectRecentVersions };
+export { versions_default as default };
 
 //# sourceMappingURL=versions.mjs.map

package/dist/_chunks/versions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"versions.mjs","names":[],"sources":["../../src/commands/versions.ts"],"sourcesContent":["import { defineCommand } from \"citty\";\nimport consola from \"consola\";\nimport type { Version } from \"../core/types.ts\";\n\nimport { sharedArgs, resolvePURL, withErrorHandling } from \"./shared.ts\";\nexport function selectRecentVersions(versions: readonly Version[], limit: number): Version[] {\n  return versions\n    .toSorted((a, b) => {\n      if (a.publishedAt === null) return b.publishedAt === null ? 0 : 1;\n      if (b.publishedAt === null) return -1;\n      return b.publishedAt.getTime() - a.publishedAt.getTime();\n    })\n    .slice(0, limit);\n}\n\nexport default defineCommand({\n  meta: {\n    name: \"versions\",\n    description: \"List package versions\",\n  },\n  args: {\n    ...sharedArgs,\n    purl: {\n      type: \"positional\",\n      description: \"Package PURL (e.g. pkg:npm/lodash, cargo/serde)\",\n      required: true,\n    },\n    limit: {\n      type: \"string\",\n      alias: \"l\",\n      description: \"Max versions to show\",\n      default: \"20\",\n    },\n  },\n  async run({ args }) {\n    await withErrorHandling(async () => {\n      const [reg, name] = resolvePURL(args.purl, !args[\"no-cache\"]);\n      const versions = await reg.fetchVersions(name);\n      const limit = Number.parseInt(args.limit, 10) || 20;\n      const shown = selectRecentVersions(versions, limit);\n\n      if (args.json) {\n        console.log(JSON.stringify(shown, null, 2));\n        return;\n      }\n\n      consola.log(\"\");\n      consola.log(\n        `  \\x1B[1m${name}\\x1B[0m — ${versions.length} version${versions.length === 1 ? \"\" : \"s\"}`,\n      );\n      consola.log(\"\");\n\n      for (const v of shown) {\n        const status = v.status ? ` \\x1B[33m[${v.status}]\\x1B[0m` : \"\";\n        const date = v.publishedAt\n          ? `  \\x1B[90m${v.publishedAt.toISOString().slice(0, 10)}\\x1B[0m`\n          : \"\";\n        consola.log(`  ${v.number}${status}${date}`);\n      }\n\n      if (versions.length > limit) {\n        consola.log(\n          `\\n  \\x1B[90m... and ${versions.length - limit} more (use --limit to show more)\\x1B[0m`,\n        );\n      }\n      consola.log(\"\");\n    });\n  },\n});\n"],"mappings":";;;;;;;AAKA,SAAgB,qBAAqB,UAA8B,OAA0B;AAC3F,QAAO,SACJ,UAAU,GAAG,MAAM;AAClB,MAAI,EAAE,gBAAgB,KAAM,QAAO,EAAE,gBAAgB,OAAO,IAAI;AAChE,MAAI,EAAE,gBAAgB,KAAM,QAAO;AACnC,SAAO,EAAE,YAAY,SAAS,GAAG,EAAE,YAAY,SAAS;GACxD,CACD,MAAM,GAAG,MAAM;;AAGpB,IAAA,mBAAe,cAAc;CAC3B,MAAM;EACJ,MAAM;EACN,aAAa;EACd;CACD,MAAM;EACJ,GAAG;EACH,MAAM;GACJ,MAAM;GACN,aAAa;GACb,UAAU;GACX;EACD,OAAO;GACL,MAAM;GACN,OAAO;GACP,aAAa;GACb,SAAS;;EAEZ;CACD,MAAM,IAAI,EAAE,QAAQ;AAClB,QAAM,kBAAkB,YAAY;GAClC,MAAM,CAAC,KAAK,QAAQ,YAAY,KAAK,MAAM,CAAC,KAAK,YAAY;GAC7D,MAAM,WAAW,MAAM,IAAI,cAAc,KAAK;GAC9C,MAAM,QAAQ,OAAO,SAAS,KAAK,OAAO,GAAG,IAAI;GACjD,MAAM,QAAQ,qBAAqB,UAAU,MAAM;AAEnD,OAAI,KAAK,MAAM;AACb,YAAQ,IAAI,KAAK,UAAU,OAAO,MAAM,EAAE,CAAC;AAC3C;;AAGF,WAAQ,IAAI,GAAG;AACf,WAAQ,IACN,YAAY,KAAK,YAAY,SAAS,OAAO,UAAU,SAAS,WAAW,IAAI,KAAK,MACrF;AACD,WAAQ,IAAI,GAAG;AAEf,QAAK,MAAM,KAAK,OAAO;IACrB,MAAM,SAAS,EAAE,SAAS,aAAa,EAAE,OAAO,YAAY;IAC5D,MAAM,OAAO,EAAE,cACX,aAAa,EAAE,YAAY,aAAa,CAAC,MAAM,GAAG,GAAG,CAAC,WACtD;AACJ,YAAQ,IAAI,KAAK,EAAE,SAAS,SAAS,OAAO;;AAG9C,OAAI,SAAS,SAAS,MACpB,SAAQ,IACN,uBAAuB,SAAS,SAAS,MAAM,yCAChD;AAEH,WAAQ,IAAI,GAAG;IACf;;CAEL,CAAC"}