@agntn/registries 0.3.0 → 0.3.1

package/dist/_chunks/registries.mjs

@@ -1,5 +1,239 @@
-import { a as register, c as HTTPError, l as InvalidPURLError, t as Registry, u as NotFoundError } from "./registry.mjs";
-import { a as normalizeRepositoryURL, o as combineLicenses, s as normalizeLicense, t as buildPURL } from "./purl.mjs";
+import { a as register, c as HTTPError, l as InvalidPURLError, n as create, t as Registry, u as NotFoundError } from "./registry.mjs";
+/**
+* Normalize common license names to SPDX expressions.
+*
+* @param raw - License name or SPDX expression.
+* @returns {string} The normalized SPDX expression, or an empty string.
+*/
+function normalizeLicense(raw) {
+	if (!raw) return "";
+	const trimmed = raw.trim();
+	if (!trimmed) return "";
+	const lower = trimmed.toLowerCase();
+	const known = LICENSE_MAP.get(lower);
+	if (known) return known;
+	return trimmed;
+}
+const LICENSE_MAP = new Map([
+	["mit license", "MIT"],
+	["mit", "MIT"],
+	["apache license 2.0", "Apache-2.0"],
+	["apache 2.0", "Apache-2.0"],
+	["apache-2.0", "Apache-2.0"],
+	["apache license, version 2.0", "Apache-2.0"],
+	["apache2", "Apache-2.0"],
+	["bsd-2-clause", "BSD-2-Clause"],
+	["bsd-3-clause", "BSD-3-Clause"],
+	["bsd 2-clause", "BSD-2-Clause"],
+	["bsd 3-clause", "BSD-3-Clause"],
+	["simplified bsd license", "BSD-2-Clause"],
+	["new bsd license", "BSD-3-Clause"],
+	["isc license", "ISC"],
+	["isc", "ISC"],
+	["gpl-2.0", "GPL-2.0-only"],
+	["gpl-3.0", "GPL-3.0-only"],
+	["gpl-2.0-only", "GPL-2.0-only"],
+	["gpl-3.0-only", "GPL-3.0-only"],
+	["lgpl-2.1", "LGPL-2.1-only"],
+	["lgpl-3.0", "LGPL-3.0-only"],
+	["mpl-2.0", "MPL-2.0"],
+	["mozilla public license 2.0", "MPL-2.0"],
+	["unlicense", "Unlicense"],
+	["the unlicense", "Unlicense"],
+	["cc0-1.0", "CC0-1.0"],
+	["cc0", "CC0-1.0"],
+	["public domain", "Unlicense"],
+	["zlib", "Zlib"],
+	["wtfpl", "WTFPL"],
+	["artistic-2.0", "Artistic-2.0"],
+	["boost software license 1.0", "BSL-1.0"],
+	["bsl-1.0", "BSL-1.0"]
+]);
+/**
+* Combine license strings into one SPDX expression.
+*
+* @param licenses - License names or expressions to normalize.
+* @param operator - SPDX operator joining multiple licenses.
+* @returns {string} The combined SPDX expression, or an empty string.
+*/
+function combineLicenses(licenses, operator = "OR") {
+	const normalized = licenses.map((l) => normalizeLicense(l)).filter(Boolean);
+	if (normalized.length === 0) return "";
+	if (normalized.length === 1) return normalized[0];
+	return normalized.join(` ${operator} `);
+}
+const REPOSITORY_SHORTHANDS = [
+	["github:", "https://github.com/"],
+	["gitlab:", "https://gitlab.com/"],
+	["bitbucket:", "https://bitbucket.org/"]
+];
+const GIT_TRANSPORTS = [["git://", "https://"], ["ssh://git@", "https://"]];
+function extractRepositoryURL(raw) {
+	if (typeof raw === "string") return raw;
+	if (typeof raw !== "object" || raw === null) return "";
+	const url = raw["url"];
+	return typeof url === "string" ? url : "";
+}
+function replacePrefix(value, replacements) {
+	for (const [prefix, replacement] of replacements) if (value.startsWith(prefix)) return replacement + value.slice(prefix.length);
+	return value;
+}
+/**
+* Normalize repository shorthands and Git transports to HTTPS.
+*
+* @param raw - Repository URL string or object with a URL field.
+* @returns {string} The normalized URL, or an empty string.
+*/
+function normalizeRepositoryURL(raw) {
+	let url = extractRepositoryURL(raw).trim();
+	if (!url) return "";
+	url = replacePrefix(url, REPOSITORY_SHORTHANDS);
+	if (url.startsWith("git+")) url = url.slice(4);
+	url = replacePrefix(url, GIT_TRANSPORTS);
+	const sshMatch = url.match(/^git@([^:]+):(.+)$/);
+	if (sshMatch) url = `https://${sshMatch[1]}/${sshMatch[2]}`;
+	return url.replace(/\/$/, "").replace(/\.git$/, "");
+}
+const QUALIFIER_KEY_PATTERN = /^[a-z][a-z0-9._-]*$/;
+function decodePURLComponent(purlStr, value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		throw new InvalidPURLError(purlStr, "malformed percent-encoding");
+	}
+}
+function extractSubpath(purlStr, value) {
+	const hashIdx = value.indexOf("#");
+	if (hashIdx === -1) return {
+		remainder: value,
+		subpath: ""
+	};
+	const subpath = value.slice(hashIdx + 1).split("/").map((segment) => decodePURLComponent(purlStr, segment)).join("/");
+	return {
+		remainder: value.slice(0, hashIdx),
+		subpath
+	};
+}
+function extractQualifiers(purlStr, value) {
+	const queryIdx = value.indexOf("?");
+	if (queryIdx === -1) return {
+		qualifiers: {},
+		remainder: value
+	};
+	const qualifiers = {};
+	for (const pair of value.slice(queryIdx + 1).split("&")) {
+		const eqIdx = pair.indexOf("=");
+		if (eqIdx !== -1) qualifiers[decodePURLComponent(purlStr, pair.slice(0, eqIdx))] = decodePURLComponent(purlStr, pair.slice(eqIdx + 1));
+	}
+	return {
+		qualifiers,
+		remainder: value.slice(0, queryIdx)
+	};
+}
+function extractVersion(purlStr, value) {
+	const lastSlashIdx = value.lastIndexOf("/");
+	const lastAtIdx = value.lastIndexOf("@");
+	if (lastAtIdx === -1 || lastAtIdx <= lastSlashIdx) return {
+		remainder: value,
+		version: ""
+	};
+	return {
+		remainder: value.slice(0, lastAtIdx),
+		version: decodePURLComponent(purlStr, value.slice(lastAtIdx + 1))
+	};
+}
+/**
+* Parse a package URL into normalized components.
+*
+* @param purlStr - Package URL to parse.
+* @returns {ParsedPURL} The normalized components.
+* @see https://github.com/package-url/purl-spec (ECMA-427)
+*/
+function parsePURL(purlStr) {
+	if (!purlStr.startsWith("pkg:")) throw new InvalidPURLError(purlStr, "must start with \"pkg:\"");
+	const subpathParts = extractSubpath(purlStr, purlStr.slice(4));
+	const qualifierParts = extractQualifiers(purlStr, subpathParts.remainder);
+	const versionParts = extractVersion(purlStr, qualifierParts.remainder);
+	const remainder = versionParts.remainder;
+	const slashIdx = remainder.indexOf("/");
+	if (slashIdx === -1) throw new InvalidPURLError(purlStr, "missing type/name separator");
+	const type = remainder.slice(0, slashIdx).toLowerCase();
+	if (!type) throw new InvalidPURLError(purlStr, "empty type");
+	const rest = remainder.slice(slashIdx + 1);
+	if (!rest) throw new InvalidPURLError(purlStr, "empty name");
+	const lastSlashIdx = rest.lastIndexOf("/");
+	let namespace = "";
+	let name;
+	if (lastSlashIdx !== -1) {
+		namespace = rest.slice(0, lastSlashIdx).split("/").map((s) => decodePURLComponent(purlStr, s)).join("/");
+		name = decodePURLComponent(purlStr, rest.slice(lastSlashIdx + 1));
+	} else name = decodePURLComponent(purlStr, rest);
+	if (type === "pypi") name = name.toLowerCase().replaceAll(/[-_.]+/g, "-");
+	if (type === "alpm") name = name.toLowerCase();
+	return {
+		type,
+		namespace,
+		name,
+		version: versionParts.version,
+		qualifiers: qualifierParts.qualifiers,
+		subpath: subpathParts.subpath
+	};
+}
+/**
+* Build a registry package name from PURL components.
+*
+* @param parsed - Parsed package URL components.
+* @returns {string} The namespace-qualified package name.
+*/
+function fullName(parsed) {
+	if (parsed.namespace) return `${parsed.namespace}/${parsed.name}`;
+	return parsed.name;
+}
+/**
+* Create a registry from a package URL.
+*
+* @param purlStr - Package URL to resolve.
+* @param client - Optional HTTP client.
+* @returns {[Registry, string, string]} The registry, package name, and version.
+*/
+function createFromPURL(purlStr, client) {
+	const parsed = parsePURL(purlStr);
+	const baseURL = parsed.qualifiers["repository_url"] ?? "";
+	return [
+		create(parsed.type, baseURL || void 0, client),
+		fullName(parsed),
+		parsed.version
+	];
+}
+/**
+* Build a package URL from normalized components.
+*
+* @param parts - Package URL components.
+* @returns {string} The canonical package URL.
+*/
+function buildPURL(parts) {
+	let purl = `pkg:${parts.type}/`;
+	if (parts.namespace) purl += `${parts.namespace.split("/").map((s) => encodeURIComponent(s)).join("/")}/`;
+	purl += encodeURIComponent(parts.name);
+	if (parts.version) purl += `@${encodeURIComponent(parts.version)}`;
+	if (parts.qualifiers && Object.keys(parts.qualifiers).length > 0) {
+		const qualifiers = /* @__PURE__ */ new Map();
+		for (const [key, value] of Object.entries(parts.qualifiers)) {
+			const canonicalKey = key.toLowerCase();
+			if (!QUALIFIER_KEY_PATTERN.test(canonicalKey)) throw new InvalidPURLError(purl, `invalid qualifier key "${key}"`);
+			if (qualifiers.has(canonicalKey)) throw new InvalidPURLError(purl, `duplicate qualifier key "${canonicalKey}"`);
+			qualifiers.set(canonicalKey, value);
+		}
+		const qs = [...qualifiers].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, value]) => `${key}=${encodeURIComponent(value)}`).join("&");
+		purl += `?${qs}`;
+	}
+	if (parts.subpath) purl += `#${parts.subpath.split("/").map((s) => encodeURIComponent(s)).join("/")}`;
+	return purl;
+}
+function rethrowFetchError(error, ecosystem, packageName, version = "") {
+	if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError(ecosystem, packageName, version);
+	throw error;
+}
 /** npm registry client. */
 var NpmRegistry = class extends Registry {
 	constructor(baseURL, client) {
@@ -19,7 +253,7 @@ var NpmRegistry = class extends Registry {
 			const data = await this.client.getJSON(url, signal);
 			const latestVersion = data["dist-tags"].latest;
 			const latestVersionData = data.versions[latestVersion];
-			const licenses = this.extractLicense(data.license || latestVersionData?.license);
+			const licenses = data.license ? this.extractLicense(data.license) : this.extractLicense(latestVersionData?.license);
 			const namespace = this.extractNamespace(name);
 			return {
 				name: data.name,
@@ -28,14 +262,13 @@ var NpmRegistry = class extends Registry {
 				documentation: "",
 				repository: normalizeRepositoryURL(data.repository || ""),
 				licenses,
-				keywords: data.keywords || [],
+				keywords: data.keywords ?? [],
 				namespace,
 				latestVersion,
 				metadata: {}
 			};
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("npm", name);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name);
 		}
 	}
 	async fetchVersions(name, signal) {
@@ -43,25 +276,21 @@ var NpmRegistry = class extends Registry {
 		const url = `${this.baseURL}/${encodedName}`;
 		try {
 			const data = await this.client.getJSON(url, signal);
-			const versions = [];
-			for (const [versionStr, versionData] of Object.entries(data.versions)) {
+			return Object.entries(data.versions).map(([versionStr, versionData]) => {
 				const licenses = this.extractLicense(versionData.license);
 				const publishedAt = data.time?.[versionStr] ? new Date(data.time[versionStr]) : null;
 				const status = versionData.deprecated ? "deprecated" : "";
-				const integrity = versionData.dist?.integrity ? versionData.dist.integrity : versionData.dist?.shasum ? `sha1-${versionData.dist.shasum}` : "";
-				versions.push({
+				return {
 					number: versionStr,
 					publishedAt,
 					licenses,
-					integrity,
+					integrity: versionData.dist?.integrity ? versionData.dist.integrity : versionData.dist?.shasum ? `sha1-${versionData.dist.shasum}` : "",
 					status,
 					metadata: {}
-				});
-			}
-			return versions;
+				};
+			});
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("npm", name);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name);
 		}
 	}
 	async fetchDependencies(name, version, signal) {
@@ -69,38 +298,15 @@ var NpmRegistry = class extends Registry {
 		const url = `${this.baseURL}/${encodedName}/${version}`;
 		try {
 			const versionData = await this.client.getJSON(url, signal);
-			const dependencies = [];
-			if (versionData.dependencies) for (const [depName, requirements] of Object.entries(versionData.dependencies)) {
-				if (versionData.optionalDependencies && Object.hasOwn(versionData.optionalDependencies, depName)) continue;
-				dependencies.push({
-					name: depName,
-					requirements,
-					scope: "runtime",
-					optional: false
-				});
-			}
-			if (versionData.devDependencies) for (const [depName, requirements] of Object.entries(versionData.devDependencies)) dependencies.push({
-				name: depName,
-				requirements,
-				scope: "development",
-				optional: false
-			});
-			if (versionData.optionalDependencies) for (const [depName, requirements] of Object.entries(versionData.optionalDependencies)) dependencies.push({
-				name: depName,
-				requirements,
-				scope: "runtime",
-				optional: true
-			});
-			if (versionData.peerDependencies) for (const [depName, requirements] of Object.entries(versionData.peerDependencies)) dependencies.push({
-				name: depName,
-				requirements,
-				scope: "runtime",
-				optional: false
-			});
-			return dependencies;
+			const optionalNames = Object.keys(versionData.optionalDependencies ?? {});
+			return [
+				...this.mapDependencies(versionData.dependencies, "runtime", false, optionalNames),
+				...this.mapDependencies(versionData.devDependencies, "development", false),
+				...this.mapDependencies(versionData.optionalDependencies, "runtime", true),
+				...this.mapDependencies(versionData.peerDependencies, "runtime", false)
+			];
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("npm", name, version);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name, version);
 		}
 	}
 	async fetchMaintainers(name, signal) {
@@ -108,55 +314,10 @@ var NpmRegistry = class extends Registry {
 		const url = `${this.baseURL}/${encodedName}`;
 		try {
 			const data = await this.client.getJSON(url, signal);
-			const maintainers = [];
-			const seen = /* @__PURE__ */ new Set();
-			if (data.maintainers) for (const maintainer of data.maintainers) {
-				const key = this.maintainerKey(maintainer.name, maintainer.email);
-				if (!key || seen.has(key)) continue;
-				seen.add(key);
-				maintainers.push({
-					uuid: "",
-					login: maintainer.email ? maintainer.email.split("@")[0] : "",
-					name: maintainer.name || "",
-					email: maintainer.email || "",
-					url: maintainer.url || "",
-					role: ""
-				});
-			}
-			const latestTag = data["dist-tags"].latest;
-			const latestVersion = data.versions[latestTag];
-			if (latestVersion?.author) {
-				const key = this.maintainerKey(latestVersion.author.name, latestVersion.author.email);
-				if (key && !seen.has(key)) {
-					seen.add(key);
-					maintainers.push({
-						uuid: "",
-						login: latestVersion.author.email ? latestVersion.author.email.split("@")[0] : "",
-						name: latestVersion.author.name || "",
-						email: latestVersion.author.email || "",
-						url: latestVersion.author.url || "",
-						role: "author"
-					});
-				}
-			}
-			if (latestVersion?.contributors) for (const contributor of latestVersion.contributors) {
-				const key = this.maintainerKey(contributor.name, contributor.email);
-				if (key && !seen.has(key)) {
-					seen.add(key);
-					maintainers.push({
-						uuid: "",
-						login: contributor.email ? contributor.email.split("@")[0] : "",
-						name: contributor.name || "",
-						email: contributor.email || "",
-						url: contributor.url || "",
-						role: "contributor"
-					});
-				}
-			}
-			return maintainers;
+			const latestVersion = data.versions[data["dist-tags"].latest];
+			return this.collectMaintainers(data.maintainers, latestVersion?.author, latestVersion?.contributors);
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("npm", name);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name);
 		}
 	}
 	urls() {
@@ -185,23 +346,58 @@ var NpmRegistry = class extends Registry {
 			}
 		};
 	}
-	/** Build a stable dedup key. Prefers email (unique per account), falls back to name. */
+	mapDependencies(entries, scope, optional, excluded = []) {
+		const dependencies = [];
+		for (const [name, requirements] of Object.entries(entries ?? {})) {
+			if (excluded.includes(name)) continue;
+			dependencies.push({
+				name,
+				requirements,
+				scope,
+				optional
+			});
+		}
+		return dependencies;
+	}
+	collectMaintainers(maintainers, author, contributors) {
+		const candidates = [
+			...(maintainers ?? []).map((maintainer) => [maintainer, ""]),
+			...author ? [[author, "author"]] : [],
+			...(contributors ?? []).map((contributor) => [contributor, "contributor"])
+		];
+		const seen = /* @__PURE__ */ new Set();
+		const result = [];
+		for (const [maintainer, role] of candidates) {
+			const key = this.maintainerKey(maintainer.name, maintainer.email);
+			if (!key || seen.has(key)) continue;
+			seen.add(key);
+			result.push(this.toMaintainer(maintainer, role));
+		}
+		return result;
+	}
+	toMaintainer(maintainer, role) {
+		return {
+			uuid: "",
+			login: maintainer.email ? maintainer.email.split("@")[0] : "",
+			name: maintainer.name || "",
+			email: maintainer.email || "",
+			url: maintainer.url || "",
+			role
+		};
+	}
 	maintainerKey(name, email) {
 		if (email) return email;
 		if (name) return name;
 		return "";
 	}
-	/** Encode package name for URL (handle scoped packages). */
 	encodeName(name) {
 		if (name.startsWith("@")) return name.replace("/", "%2F");
 		return name;
 	}
-	/** Extract namespace from scoped package name. */
 	extractNamespace(name) {
 		if (name.startsWith("@")) return name.split("/")[0] || "";
 		return "";
 	}
-	/** Extract and normalize license. */
 	extractLicense(raw) {
 		if (!raw) return "";
 		if (typeof raw === "string") return normalizeLicense(raw);
@@ -213,6 +409,9 @@ var NpmRegistry = class extends Registry {
 	}
 };
 register("npm", "https://registry.npmjs.org", NpmRegistry);
+function preferNonEmpty(value, fallback) {
+	return value || fallback;
+}
 /** Crates.io registry client. */
 var CargoRegistry = class extends Registry {
 	constructor(baseURL, client) {
@@ -230,7 +429,7 @@ var CargoRegistry = class extends Registry {
 		try {
 			const data = await this.client.getJSON(url, signal);
 			const crateData = data.crate;
-			const latestVersion = crateData.max_stable_version || crateData.max_version;
+			const latestVersion = preferNonEmpty(crateData.max_stable_version, crateData.max_version);
 			const latestVersionData = data.versions.find((v) => v.num === latestVersion);
 			return {
 				name: crateData.name,
@@ -253,8 +452,7 @@ var CargoRegistry = class extends Registry {
 				}
 			};
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("cargo", name);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name);
 		}
 	}
 	async fetchVersions(name, signal) {
@@ -280,8 +478,7 @@ var CargoRegistry = class extends Registry {
 			}
 			return versions;
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("cargo", name);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name);
 		}
 	}
 	async fetchDependencies(name, version, signal) {
@@ -303,8 +500,7 @@ var CargoRegistry = class extends Registry {
 			}
 			return dependencies;
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("cargo", name, version);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name, version);
 		}
 	}
 	async fetchMaintainers(name, signal) {
@@ -322,8 +518,7 @@ var CargoRegistry = class extends Registry {
 			});
 			return maintainers;
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("cargo", name);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name);
 		}
 	}
 	urls() {
@@ -357,6 +552,80 @@ const PYPI_FILENAME_SEPARATORS = [
 	"-",
 	"."
 ];
+/**
+* PEP 639 projects put the SPDX expression in `license_expression` and leave `license` null.
+*
+* @param info - License fields of the JSON API `info` object.
+* @returns {string} The normalized SPDX expression, or an empty string.
+*/
+function pypiLicense(info) {
+	return normalizeLicense(info.license_expression || info.license);
+}
+const QUOTED_NAME_PATTERN = /^"((?:[^"\\]|\\.)*)"\s*<([^>]*)>$/;
+const ANGLE_ADDRESS_PATTERN = /^([^<]*?)\s*<([^>]*)>$/;
+const COMMENT_PATTERN = /\(([^)]*)\)/g;
+const ADDRESS_ITEM_PATTERN = /(?:"(?:[^"\\]|\\.)*"|<[^>]*>|\([^)]*\)|[^,])+/g;
+/**
+* Split an address list on the commas outside quotes, angle brackets and one level of comments.
+*
+* @param value - Comma separated mailboxes.
+* @returns {string[]} The trimmed, non-empty items.
+*/
+function splitAddressList(value) {
+	return [...value.matchAll(ADDRESS_ITEM_PATTERN)].map(([item]) => item.trim()).filter(Boolean);
+}
+/**
+* Read one mailbox; a comment names a bare address, and a bare name has no address.
+*
+* @param item - One item of an address list.
+* @returns {PyPIContact} The name and email found in it.
+*/
+function parseMailbox(item) {
+	const quoted = item.match(QUOTED_NAME_PATTERN);
+	if (quoted) return {
+		name: quoted[1].replaceAll(/\\(.)/g, "$1").trim(),
+		email: quoted[2].trim()
+	};
+	const comments = [];
+	const bare = item.replaceAll(COMMENT_PATTERN, (_match, comment) => {
+		comments.push(comment.trim());
+		return " ";
+	}).trim();
+	const comment = comments.filter(Boolean).join(" ");
+	const angled = bare.match(ANGLE_ADDRESS_PATTERN);
+	if (angled) return {
+		name: angled[1].trim() || comment,
+		email: angled[2].trim()
+	};
+	return bare.includes("@") ? {
+		name: comment,
+		email: bare
+	} : {
+		name: bare || comment,
+		email: ""
+	};
+}
+/**
+* PEP 621 keeps people without an email in the name field, so the label stays its own entry.
+*
+* @param name - The `author` or `maintainer` field.
+* @param emails - The matching `author_email` or `maintainer_email` field.
+* @returns {PyPIContact[]} One contact per person.
+*/
+function pypiContacts(name, emails) {
+	const label = name?.trim() ?? "";
+	const contacts = splitAddressList(emails ?? "").map(parseMailbox);
+	if (!label) return contacts;
+	if (contacts.length === 1 && !contacts[0].name) return [{
+		name: label,
+		email: contacts[0].email
+	}];
+	if (contacts.some((contact) => contact.name.toLowerCase() === label.toLowerCase())) return contacts;
+	return [{
+		name: label,
+		email: ""
+	}, ...contacts];
+}
 /** PyPI registry client. */
 var PyPIRegistry = class extends Registry {
 	constructor(baseURL, client) {
@@ -375,7 +644,7 @@ var PyPIRegistry = class extends Registry {
 		const url = `${this.baseURL}/pypi/${normalized}/json`;
 		try {
 			const info = (await this.client.getJSON(url, signal)).info;
-			const licenses = normalizeLicense(info.license);
+			const licenses = pypiLicense(info);
 			const repository = this.extractRepository(info.project_urls);
 			const keywords = this.parseKeywords(info.keywords);
 			return {
@@ -391,8 +660,7 @@ var PyPIRegistry = class extends Registry {
 				metadata: {}
 			};
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("pypi", name);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name);
 		}
 	}
 	async fetchVersions(name, signal) {
@@ -400,43 +668,9 @@ var PyPIRegistry = class extends Registry {
 		const url = `${this.baseURL}/simple/${normalized}/`;
 		try {
 			const data = await this.client.getJSON(url, signal, { Accept: "application/vnd.pypi.simple.v1+json" });
-			const filesByVersion = /* @__PURE__ */ new Map();
-			for (const version of data.versions) filesByVersion.set(version, []);
-			for (const file of data.files) {
-				const version = this.matchFileVersion(file.filename, normalized, data.versions);
-				if (version) filesByVersion.get(version).push(file);
-			}
-			const versions = [];
-			for (const [versionStr, files] of filesByVersion) {
-				if (files.length === 0) {
-					versions.push({
-						number: versionStr,
-						publishedAt: null,
-						licenses: "",
-						integrity: "",
-						status: "",
-						metadata: {}
-					});
-					continue;
-				}
-				const file = files.find((f) => f.filename.endsWith(".tar.gz")) ?? files[0];
-				const publishedAt = file["upload-time"] ? new Date(file["upload-time"]) : null;
-				const integrity = file.hashes?.sha256 ? `sha256-${file.hashes.sha256}` : "";
-				const status = file.yanked ? "yanked" : "";
-				this.downloadUrls.set(`${normalized}@${versionStr}`, file.url);
-				versions.push({
-					number: versionStr,
-					publishedAt,
-					licenses: "",
-					integrity,
-					status,
-					metadata: {}
-				});
-			}
-			return versions;
+			return [...this.indexFilesByVersion(normalized, data.versions, data.files)].map(([version, files]) => this.toVersion(normalized, version, files));
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("pypi", name);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name);
 		}
 	}
 	async fetchDependencies(name, version, signal) {
@@ -451,28 +685,33 @@ var PyPIRegistry = class extends Registry {
 			}
 			return dependencies;
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("pypi", name, version);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name, version);
 		}
 	}
 	async fetchMaintainers(name, signal) {
 		const normalized = this.normalizeName(name);
 		const url = `${this.baseURL}/pypi/${normalized}/json`;
 		try {
-			const data = await this.client.getJSON(url, signal);
+			const { info } = await this.client.getJSON(url, signal);
+			const groups = [["author", pypiContacts(info.author, info.author_email)], ["maintainer", pypiContacts(info.maintainer, info.maintainer_email)]];
+			const seen = /* @__PURE__ */ new Set();
 			const maintainers = [];
-			if (data.info.author || data.info.author_email) maintainers.push({
-				uuid: "",
-				login: data.info.author_email ? data.info.author_email.split("@")[0] : "",
-				name: data.info.author || "",
-				email: data.info.author_email || "",
-				url: "",
-				role: "author"
-			});
+			for (const [role, contacts] of groups) for (const contact of contacts) {
+				const key = (contact.email || contact.name).toLowerCase();
+				if (seen.has(key)) continue;
+				seen.add(key);
+				maintainers.push({
+					uuid: "",
+					login: contact.email ? contact.email.split("@")[0] : "",
+					name: contact.name,
+					email: contact.email,
+					url: "",
+					role
+				});
+			}
 			return maintainers;
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("pypi", name);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name);
 		}
 	}
 	urls() {
@@ -501,7 +740,38 @@ var PyPIRegistry = class extends Registry {
 			}
 		};
 	}
-	/** Match a filename to a version from the known versions list. */
+	indexFilesByVersion(normalizedName, versions, files) {
+		const filesByVersion = /* @__PURE__ */ new Map();
+		for (const version of versions) filesByVersion.set(version, []);
+		for (const file of files) {
+			const version = this.matchFileVersion(file.filename, normalizedName, versions);
+			if (version) filesByVersion.get(version).push(file);
+		}
+		return filesByVersion;
+	}
+	toVersion(normalizedName, version, files) {
+		if (files.length === 0) return {
+			number: version,
+			publishedAt: null,
+			licenses: "",
+			integrity: "",
+			status: "",
+			metadata: {}
+		};
+		const file = files.find((file) => file.filename.endsWith(".tar.gz")) ?? files[0];
+		const publishedAt = file["upload-time"] ? new Date(file["upload-time"]) : null;
+		const integrity = file.hashes?.sha256 ? `sha256-${file.hashes.sha256}` : "";
+		const status = file.yanked ? "yanked" : "";
+		this.downloadUrls.set(`${normalizedName}@${version}`, file.url);
+		return {
+			number: version,
+			publishedAt,
+			licenses: "",
+			integrity,
+			status,
+			metadata: {}
+		};
+	}
 	matchFileVersion(filename, normalizedName, versions) {
 		const lower = filename.toLowerCase();
 		let prefix;
@@ -522,11 +792,9 @@ var PyPIRegistry = class extends Registry {
 		const stripped = afterPrefix.replace(/\.(tar\.(gz|bz2|xz)|zip)$/i, "");
 		if (versions.includes(stripped)) return stripped;
 	}
-	/** Normalize package name per PEP 503. */
 	normalizeName(name) {
-		return name.toLowerCase().replace(/[-_.]+/g, "-");
+		return name.toLowerCase().replaceAll(/[-_.]+/g, "-");
 	}
-	/** Extract repository URL from project_urls. */
 	extractRepository(projectUrls) {
 		return normalizeRepositoryURL(this.findProjectUrl(projectUrls, [
 			"Repository",
@@ -536,7 +804,6 @@ var PyPIRegistry = class extends Registry {
 			"Homepage"
 		]));
 	}
-	/** Find a project URL by key, case-insensitive. */
 	findProjectUrl(projectUrls, keys) {
 		if (!projectUrls) return "";
 		const lowered = /* @__PURE__ */ new Map();
@@ -547,12 +814,30 @@ var PyPIRegistry = class extends Registry {
 		}
 		return "";
 	}
-	/** Parse comma-separated keywords. */
 	parseKeywords(keywords) {
 		if (!keywords) return [];
 		return keywords.split(",").map((k) => k.trim()).filter(Boolean);
 	}
-	/** Parse PEP 508 dependency string into a normalized Dependency. */
+	parseExtraMarker(marker) {
+		const extraMatch = marker.match(/extra\s*==\s*["']([^"']+)["']/);
+		if (!extraMatch) return {
+			scope: "runtime",
+			optional: false
+		};
+		const extraName = extraMatch[1].toLowerCase();
+		if (/^dev(elop(ment)?)?$/.test(extraName)) return {
+			scope: "development",
+			optional: true
+		};
+		if (/^test(s|ing)?$/.test(extraName)) return {
+			scope: "test",
+			optional: true
+		};
+		return {
+			scope: "runtime",
+			optional: true
+		};
+	}
 	parsePEP508(depStr) {
 		const semiIdx = depStr.indexOf(";");
 		const mainPart = semiIdx === -1 ? depStr.trim() : depStr.slice(0, semiIdx).trim();
@@ -562,26 +847,28 @@ var PyPIRegistry = class extends Registry {
 		const depName = match[1];
 		let versionSpec = match[2].trim();
 		if (versionSpec.startsWith("(") && versionSpec.endsWith(")")) versionSpec = versionSpec.slice(1, -1).trim();
-		let scope = "runtime";
-		let optional = false;
-		if (markerStr) {
-			const extraMatch = markerStr.match(/extra\s*==\s*["']([^"']+)["']/);
-			if (extraMatch) {
-				optional = true;
-				const extraName = extraMatch[1].toLowerCase();
-				if (/^dev(elop(ment)?)?$/.test(extraName)) scope = "development";
-				else if (/^test(s|ing)?$/.test(extraName)) scope = "test";
-			}
-		}
+		const marker = this.parseExtraMarker(markerStr);
 		return {
 			name: this.normalizeName(depName),
 			requirements: versionSpec,
-			scope,
-			optional
+			scope: marker.scope,
+			optional: marker.optional
 		};
 	}
 };
 register("pypi", "https://pypi.org", PyPIRegistry);
+function orEmpty(value) {
+	return value || "";
+}
+function gemLicenses(licenses) {
+	return licenses ? combineLicenses(licenses.map((license) => normalizeLicense(license))) : "";
+}
+function gemRepositoryURL(sourceCodeURI, metadata, homepageURI) {
+	const metadataURI = metadata?.["source_code_uri"];
+	if (sourceCodeURI) return normalizeRepositoryURL(sourceCodeURI);
+	if (metadataURI) return normalizeRepositoryURL(metadataURI);
+	return normalizeRepositoryURL(homepageURI ?? "");
+}
 /** RubyGems registry client. */
 var RubyGemsRegistry = class extends Registry {
 	constructor(baseURL, client) {
@@ -598,23 +885,22 @@ var RubyGemsRegistry = class extends Registry {
 		const url = `${this.baseURL}/api/v1/gems/${name}.json`;
 		try {
 			const data = await this.client.getJSON(url, signal);
-			const licenses = data.licenses ? combineLicenses(data.licenses.map((l) => normalizeLicense(l))) : "";
-			const repository = normalizeRepositoryURL(data.source_code_uri || data.metadata?.source_code_uri || data.homepage_uri || "");
+			const licenses = gemLicenses(data.licenses);
+			const repository = gemRepositoryURL(data.source_code_uri, data.metadata, data.homepage_uri);
 			return {
 				name: data.name,
-				description: data.description || "",
-				homepage: data.homepage_uri || "",
-				documentation: data.documentation_uri || "",
+				description: orEmpty(data.description),
+				homepage: orEmpty(data.homepage_uri),
+				documentation: orEmpty(data.documentation_uri),
 				repository,
 				licenses,
 				keywords: [],
 				namespace: "",
-				latestVersion: data.version || "",
-				metadata: data.metadata || {}
+				latestVersion: orEmpty(data.version),
+				metadata: data.metadata ?? {}
 			};
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("gem", name);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name);
 		}
 	}
 	async fetchVersions(name, signal) {
@@ -636,8 +922,7 @@ var RubyGemsRegistry = class extends Registry {
 			}
 			return versions;
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("gem", name);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name);
 		}
 	}
 	async fetchDependencies(name, version, signal) {
@@ -659,8 +944,7 @@ var RubyGemsRegistry = class extends Registry {
 			});
 			return dependencies;
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("gem", name, version);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name, version);
 		}
 	}
 	async fetchMaintainers(name, signal) {
@@ -678,8 +962,7 @@ var RubyGemsRegistry = class extends Registry {
 			});
 			return maintainers;
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("gem", name);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name);
 		}
 	}
 	urls() {
@@ -735,16 +1018,15 @@ var PackagistRegistry = class extends Registry {
 				description: packageData.description || "",
 				homepage: "",
 				documentation: "",
-				repository: normalizeRepositoryURL(packageData.repository || latestVersionData.source?.url || ""),
+				repository: normalizeRepositoryURL(packageData.repository ? packageData.repository : latestVersionData.source?.url ?? ""),
 				licenses,
-				keywords: packageData.keywords || [],
+				keywords: packageData.keywords ?? [],
 				namespace: vendor,
 				latestVersion,
 				metadata: {}
 			};
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("composer", name);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name);
 		}
 	}
 	async fetchVersions(name, signal) {
@@ -767,8 +1049,7 @@ var PackagistRegistry = class extends Registry {
 			}
 			return versions;
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("composer", name);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name);
 		}
 	}
 	async fetchDependencies(name, version, signal) {
@@ -796,8 +1077,7 @@ var PackagistRegistry = class extends Registry {
 			}
 			return dependencies;
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("composer", name, version);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name, version);
 		}
 	}
 	async fetchMaintainers(name, signal) {
@@ -805,26 +1085,9 @@ var PackagistRegistry = class extends Registry {
 		const url = `${this.baseURL}/packages/${vendor}/${pkg}.json`;
 		try {
 			const data = await this.client.getJSON(url, signal);
-			const maintainers = [];
-			const seen = /* @__PURE__ */ new Set();
-			for (const versionData of Object.values(data.package.versions)) if (versionData.authors) for (const author of versionData.authors) {
-				const key = `${author.name}:${author.email}`;
-				if (!seen.has(key)) {
-					seen.add(key);
-					maintainers.push({
-						uuid: "",
-						login: author.email ? author.email.split("@")[0] : "",
-						name: author.name || "",
-						email: author.email || "",
-						url: author.homepage || "",
-						role: author.role || ""
-					});
-				}
-			}
-			return maintainers;
+			return this.collectMaintainers(Object.values(data.package.versions));
 		} catch (error) {
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("composer", name);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name);
 		}
 	}
 	urls() {
@@ -857,13 +1120,32 @@ var PackagistRegistry = class extends Registry {
 			}
 		};
 	}
-	/** Parse "vendor/package" format. */
+	collectMaintainers(versions) {
+		const maintainers = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const version of versions) for (const author of version.authors ?? []) {
+			const key = `${author.name}:${author.email}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			maintainers.push(this.toMaintainer(author));
+		}
+		return maintainers;
+	}
+	toMaintainer(author) {
+		return {
+			uuid: "",
+			login: author.email ? author.email.split("@")[0] : "",
+			name: author.name || "",
+			email: author.email || "",
+			url: author.homepage || "",
+			role: author.role || ""
+		};
+	}
 	parseName(name) {
 		const parts = name.split("/");
 		if (parts.length !== 2 || !parts[0] || !parts[1]) throw new InvalidPURLError(`pkg:composer/${name}`, "invalid Composer package name, expected \"vendor/package\" format");
 		return [parts[0], parts[1]];
 	}
-	/** Find the highest non-dev version. */
 	findLatestVersion(versions) {
 		const stable = versions.filter((v) => !v.startsWith("dev-") && !v.endsWith("-dev"));
 		if (stable.length === 0) return versions[0] || "";
@@ -880,12 +1162,10 @@ var PackagistRegistry = class extends Registry {
 			return 0;
 		})[0] || versions[0] || "";
 	}
-	/** Extract and normalize licenses. */
 	extractLicenses(raw) {
 		if (!raw) return "";
 		return combineLicenses(Array.isArray(raw) ? raw : [raw]);
 	}
-	/** Skip PHP and extension dependencies. */
 	shouldSkipDependency(name) {
 		return name === "php" || name.startsWith("ext-");
 	}
@@ -1017,17 +1297,14 @@ var AlpmRegistry = class extends Registry {
 			role: "maintainer"
 		}));
 	}
-	/** Search official repos by exact package name. Prefers x86_64 results. */
 	async searchOfficial(name, signal) {
 		const url = `${this.baseURL}/packages/search/json/?name=${encodeURIComponent(name)}`;
 		try {
 			const data = await this.client.getJSON(url, signal);
 			if (!data.results || data.results.length === 0) throw new NotFoundError("alpm", name);
-			return data.results.find((r) => r.arch === "x86_64") || data.results[0];
+			return data.results.find((r) => r.arch === "x86_64") ?? data.results[0];
 		} catch (error) {
-			if (error instanceof NotFoundError) throw error;
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("alpm", name);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), name);
 		}
 	}
 	async fetchAurPackage(name, signal) {
@@ -1038,8 +1315,8 @@ var AlpmRegistry = class extends Registry {
 			homepage: result.URL || "",
 			documentation: "",
 			repository: "",
-			licenses: combineLicenses(result.License || []),
-			keywords: result.Keywords || [],
+			licenses: combineLicenses(result.License ?? []),
+			keywords: result.Keywords ?? [],
 			namespace: "aur",
 			latestVersion: result.Version,
 			metadata: {
@@ -1057,7 +1334,7 @@ var AlpmRegistry = class extends Registry {
 		return [{
 			number: result.Version,
 			publishedAt: result.LastModified ? /* @__PURE__ */ new Date(result.LastModified * 1e3) : null,
-			licenses: combineLicenses(result.License || []),
+			licenses: combineLicenses(result.License ?? []),
 			integrity: "",
 			status: result.OutOfDate ? "deprecated" : "",
 			metadata: {
@@ -1069,7 +1346,7 @@ var AlpmRegistry = class extends Registry {
 	async fetchAurDependencies(name, version, signal) {
 		const result = await this.fetchAurInfo(name, signal);
 		this.assertVersionMatches(`aur/${name}`, version, result.Version);
-		return this.buildDependencies(result.Depends || [], result.MakeDepends || [], result.OptDepends || [], result.CheckDepends || []);
+		return this.buildDependencies(result.Depends ?? [], result.MakeDepends ?? [], result.OptDepends ?? [], result.CheckDepends ?? []);
 	}
 	async fetchAurMaintainers(name, signal) {
 		const result = await this.fetchAurInfo(name, signal);
@@ -1083,7 +1360,6 @@ var AlpmRegistry = class extends Registry {
 			role: "maintainer"
 		}];
 	}
-	/** Fetch package info from AUR RPC v5. */
 	async fetchAurInfo(name, signal) {
 		const url = `${AUR_BASE_URL}/rpc/v5/info/${encodeURIComponent(name)}`;
 		try {
@@ -1091,12 +1367,9 @@ var AlpmRegistry = class extends Registry {
 			if (!data.results || data.results.length === 0) throw new NotFoundError("alpm", `aur/${name}`);
 			return data.results[0];
 		} catch (error) {
-			if (error instanceof NotFoundError) throw error;
-			if (error instanceof HTTPError && error.isNotFound()) throw new NotFoundError("alpm", `aur/${name}`);
-			throw error;
+			rethrowFetchError(error, this.ecosystem(), `aur/${name}`);
 		}
 	}
-	/** Parse "namespace/name" into components. Defaults to "arch" namespace. */
 	parseName(fullName) {
 		const normalized = fullName.trim().toLowerCase();
 		const slashIdx = normalized.indexOf("/");
@@ -1115,11 +1388,9 @@ var AlpmRegistry = class extends Registry {
 	assertVersionMatches(name, requested, current) {
 		if (requested && requested !== current) throw new NotFoundError("alpm", name, requested);
 	}
-	/** Format ALPM version: epoch:pkgver-pkgrel (epoch omitted when 0). */
 	formatVersion(result) {
 		return `${result.epoch && result.epoch > 0 ? `${result.epoch}:` : ""}${result.pkgver}-${result.pkgrel}`;
 	}
-	/** Build normalized dependency list from ALPM dependency arrays. */
 	buildDependencies(depends, makedepends, optdepends, checkdepends) {
 		const dependencies = [];
 		for (const dep of depends) {
@@ -1160,7 +1431,6 @@ var AlpmRegistry = class extends Registry {
 		}
 		return dependencies;
 	}
-	/** Parse a dependency string like "glibc>=2.33" or "bash". */
 	parseDep(dep) {
 		const match = dep.match(/^([a-zA-Z0-9@._+-]+)(.*)$/);
 		if (!match) return {
@@ -1172,7 +1442,6 @@ var AlpmRegistry = class extends Registry {
 			requirements: match[2].trim()
 		};
 	}
-	/** Parse optional dependency like "perl-locale-gettext: translation support". */
 	parseOptDep(dep) {
 		const colonIdx = dep.indexOf(":");
 		if (colonIdx === -1) {
@@ -1192,6 +1461,6 @@ var AlpmRegistry = class extends Registry {
 	}
 };
 register("alpm", "https://archlinux.org", AlpmRegistry);
-export { CargoRegistry as a, PyPIRegistry as i, PackagistRegistry as n, NpmRegistry as o, RubyGemsRegistry as r, AlpmRegistry as t };
+export { CargoRegistry as a, createFromPURL as c, normalizeRepositoryURL as d, combineLicenses as f, PyPIRegistry as i, fullName as l, PackagistRegistry as n, NpmRegistry as o, normalizeLicense as p, RubyGemsRegistry as r, buildPURL as s, AlpmRegistry as t, parsePURL as u };
 
 //# sourceMappingURL=registries.mjs.map