@dep-radius/core 0.1.0

package/dist/notes/match.js

@@ -0,0 +1,75 @@
+// No dictionaries. A name that looks like code matches as a token anywhere; a plain English word
+// matches only where it is written as code: `.email`, `email(`, `email<`, `<Email`.
+export function isCodeShaped(name) {
+    return /[A-Z_$0-9]/.test(name.slice(1)) || name.length >= 12;
+}
+function escape(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function patternFor(name) {
+    const n = escape(name);
+    if (name.length <= 2)
+        return new RegExp(`(?<=\\.)${n}(?![\\w$])`);
+    if (isCodeShaped(name))
+        return new RegExp(`(?<![\\w$])${n}(?![\\w$])`);
+    return new RegExp(`(?<=\\.)${n}(?![\\w$])|(?<![\\w$.])${n}(?=\\s*[(<])|(?<=<)${n}(?![\\w$])`);
+}
+// A breaking entry that names an API is about that API; when it is not one of yours, it is someone
+// else's break. One that names nothing ("drops Node 18", "ESM only") can be anyone's.
+function namesAnApi(e) {
+    const headline = e.regions.filter((r) => r.kind === "title" || r.kind === "inline-code");
+    return headline.some((r) => r.kind === "inline-code" || /[\w$]\(\)|\.[a-z]\w*\(/i.test(r.text));
+}
+export const DEMOTE_SHARE = 0.25;
+export function matchNotes(entries, strong, weak, options = {}) {
+    const share = options.demoteShare ?? DEMOTE_SHARE;
+    const live = entries.filter((e) => !e.noise);
+    const names = [
+        ...strong.map((name) => ({ name, strength: "strong" })),
+        ...weak
+            .filter((w) => !strong.includes(w))
+            .map((name) => ({ name, strength: "weak" })),
+    ].map((n) => ({ ...n, re: patternFor(n.name) }));
+    // a name found in the examples of many entries is example boilerplate, not news: `v.object()` in
+    // every snippet of a release says nothing about v.object
+    const withCode = live.filter((e) => e.regions.some((r) => r.kind === "code-block"));
+    const demoted = new Set();
+    for (const n of names) {
+        const inCode = withCode.filter((e) => e.regions.some((r) => r.kind === "code-block" && n.re.test(r.text))).length;
+        if (inCode >= 3 && inCode >= withCode.length * share)
+            demoted.add(n.name);
+    }
+    const matched = [];
+    const unattributedBreaking = [];
+    for (const e of live) {
+        const hits = [];
+        for (const n of names) {
+            let hitRegion;
+            for (const r of e.regions) {
+                if (r.kind === "code-block" &&
+                    // demotion never silences a breaking entry: one whose only link to the code is its example
+                    // is still a break
+                    ((demoted.has(n.name) && !e.breakingMarker) ||
+                        (n.strength === "weak" && !isCodeShaped(n.name))))
+                    continue;
+                if (n.re.test(r.text)) {
+                    hitRegion = r.kind;
+                    break;
+                }
+            }
+            if (hitRegion)
+                hits.push({ name: n.name, strength: n.strength, region: hitRegion });
+        }
+        if (hits.length > 0)
+            matched.push({
+                entry: e,
+                hits,
+                direct: hits.some((h) => h.strength === "strong" && h.region !== "code-block"),
+            });
+        else if (e.breakingMarker && !namesAnApi(e))
+            unattributedBreaking.push(e);
+    }
+    matched.sort((a, b) => Number(b.direct) - Number(a.direct) ||
+        Number(b.entry.breakingMarker) - Number(a.entry.breakingMarker));
+    return { matched, unattributedBreaking, total: live.length };
+}

package/dist/notes/repo-url.d.ts

@@ -0,0 +1,9 @@
+export interface RepoRef {
+    host: "github" | "other";
+    owner: string;
+    repo: string;
+    directory?: string;
+    raw: string;
+}
+export declare function parseRepository(input: unknown): RepoRef | undefined;
+//# sourceMappingURL=repo-url.d.ts.map

package/dist/notes/repo-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-url.d.ts","sourceRoot":"","sources":["../../src/notes/repo-url.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAA;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;CACZ;AAKD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CA8CnE"}

package/dist/notes/repo-url.js

@@ -0,0 +1,46 @@
+// Every shape `repository` takes in the wild:
+// "git+https://github.com/o/r.git", "git+ssh://git@github.com/o/r.git", "github:o/r", "o/r",
+// "https://github.com/o/r/tree/main/packages/x", { type, url, directory }
+export function parseRepository(input) {
+    let url;
+    let directory;
+    if (typeof input === "string")
+        url = input;
+    else if (input && typeof input === "object") {
+        const o = input;
+        if (typeof o.url === "string")
+            url = o.url;
+        if (typeof o.directory === "string")
+            directory = o.directory;
+    }
+    if (!url)
+        return undefined;
+    const raw = url.trim();
+    const shorthand = /^(?:github:)?([\w.-]+)\/([\w.-]+?)(?:\.git)?(?:#.*)?$/.exec(raw);
+    if (shorthand?.[1] &&
+        shorthand[2] &&
+        !raw.includes("://") &&
+        !raw.includes("@")) {
+        return {
+            host: "github",
+            owner: shorthand[1],
+            repo: shorthand[2],
+            ...(directory ? { directory } : {}),
+            raw,
+        };
+    }
+    if (/^(gitlab|bitbucket):/.test(raw))
+        return { host: "other", owner: "", repo: "", raw };
+    const m = /github\.com[/:]([\w.-]+)\/([\w.-]+?)(?:\.git)?(?:\/(?:tree|blob)\/[^/]+\/(.+?))?\/?(?:#.*)?$/.exec(raw);
+    if (m?.[1] && m[2]) {
+        const dir = directory ?? m[3];
+        return {
+            host: "github",
+            owner: m[1],
+            repo: m[2],
+            ...(dir ? { directory: dir.replace(/\/+$/, "") } : {}),
+            raw,
+        };
+    }
+    return { host: "other", owner: "", repo: "", raw };
+}

package/dist/options.d.ts

@@ -0,0 +1,53 @@
+import type { Logger } from "./infra/log.ts";
+import type { Limiter } from "./infra/limit.ts";
+import type { DiskCache } from "./infra/cache.ts";
+import type { HttpClient } from "./infra/http.ts";
+export type Format = "terminal" | "json" | "markdown";
+export interface Options {
+    root: string;
+    specs: string[];
+    format: Format;
+    offline: boolean;
+    minAgeMs: number | undefined;
+    latest: boolean;
+    notes: boolean;
+    surface: boolean;
+    prod: boolean;
+    concurrency: number;
+    cacheDir: string;
+    verbose: boolean;
+    now: number;
+    color: boolean;
+}
+export type RunEvent = {
+    type: "files";
+    done: number;
+    total: number;
+} | {
+    type: "packages";
+    total: number;
+} | {
+    type: "package-start";
+    name: string;
+} | {
+    type: "package";
+    name: string;
+    done: number;
+    total: number;
+};
+export interface Ctx {
+    http: HttpClient;
+    cache: DiskCache;
+    now: number;
+    offline: boolean;
+    log: Logger;
+    net: Limiter;
+    github: Limiter;
+    heavy: Limiter;
+    githubToken: () => Promise<string | undefined>;
+    env: NodeJS.ProcessEnv;
+}
+export declare function parseDuration(input: string): number;
+export declare function formatAge(ms: number): string;
+export declare const DEFAULT_MIN_AGE_MS = 86400000;
+//# sourceMappingURL=options.d.ts.map

package/dist/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEjD,MAAM,MAAM,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,CAAA;AAErD,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,EAAE,OAAO,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,OAAO,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,OAAO,CAAA;CACf;AAGD,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAElE,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,UAAU,CAAA;IAChB,KAAK,EAAE,SAAS,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,OAAO,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,EAAE,OAAO,CAAA;IACd,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAE9C,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CACvB;AAaD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMnD;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAI5C;AAED,eAAO,MAAM,kBAAkB,WAAa,CAAA"}

package/dist/options.js

@@ -0,0 +1,27 @@
+const UNITS = {
+    ms: 1,
+    s: 1000,
+    m: 60_000,
+    min: 60_000,
+    h: 3_600_000,
+    d: 86_400_000,
+    w: 604_800_000,
+};
+// "0", "90m", "36h", "7d"; a bare number is minutes, as pnpm's minimumReleaseAge is.
+export function parseDuration(input) {
+    const s = input.trim();
+    if (/^\d+(\.\d+)?$/.test(s))
+        return Number(s) * 60_000;
+    const m = /^(\d+(?:\.\d+)?)\s*(ms|s|m|min|h|d|w)$/i.exec(s);
+    if (!m?.[1] || !m[2])
+        throw new Error(`invalid duration: ${input}`);
+    return Number(m[1]) * (UNITS[m[2].toLowerCase()] ?? 0);
+}
+export function formatAge(ms) {
+    if (ms < 3_600_000)
+        return `${Math.max(1, Math.round(ms / 60_000))}m`;
+    if (ms < 172_800_000)
+        return `${Math.round(ms / 3_600_000)}h`;
+    return `${Math.round(ms / 86_400_000)}d`;
+}
+export const DEFAULT_MIN_AGE_MS = 86_400_000;

package/dist/registry/candidates.d.ts

@@ -0,0 +1,24 @@
+import type { Packument } from "./packument.ts";
+import type { Bump, Candidate } from "../model.ts";
+export interface CandidateOptions {
+    now: number;
+    minAgeMs: number;
+    ageExcluded: (version: string) => boolean;
+    latest: boolean;
+    explicit?: string;
+}
+export type CandidateResult = {
+    kind: "candidate";
+    candidate: Candidate;
+} | {
+    kind: "up-to-date";
+    skippedNewer: Candidate["skippedNewer"];
+    alsoAvailable?: Candidate["alsoAvailable"];
+} | {
+    kind: "error";
+    reason: string;
+};
+export declare function bumpOf(from: string, to: string): Bump;
+export declare function stableRange(p: Packument, from: string, to: string): string[];
+export declare function selectCandidate(p: Packument, installed: string, opts: CandidateOptions): CandidateResult;
+//# sourceMappingURL=candidates.d.ts.map

package/dist/registry/candidates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"candidates.d.ts","sourceRoot":"","sources":["../../src/registry/candidates.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAA;IACzC,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAC3C;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,YAAY,EAAE,SAAS,CAAC,cAAc,CAAC,CAAA;IACvC,aAAa,CAAC,EAAE,SAAS,CAAC,eAAe,CAAC,CAAA;CAC3C,GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAErC,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CASrD;AAaD,wBAAgB,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAU5E;AAED,wBAAgB,eAAe,CAC7B,CAAC,EAAE,SAAS,EACZ,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,gBAAgB,GACrB,eAAe,CA2GjB"}

package/dist/registry/candidates.js

@@ -0,0 +1,139 @@
+import semver from "semver";
+export function bumpOf(from, to) {
+    const a = semver.parse(from);
+    const b = semver.parse(to);
+    if (!a || !b)
+        return "major";
+    if (a.major !== b.major)
+        return "major";
+    if (a.major === 0 && a.minor !== b.minor)
+        return "major";
+    if (a.minor !== b.minor)
+        return "minor";
+    if (a.major === 0 && a.minor === 0 && a.patch !== b.patch)
+        return "major";
+    return "patch";
+}
+// The caret line of the installed version: what semver promises is safe.
+function sameLine(installed, v) {
+    const a = semver.parse(installed);
+    const b = semver.parse(v);
+    if (a.major !== b.major)
+        return false;
+    if (a.major > 0)
+        return true;
+    if (a.minor !== b.minor)
+        return false;
+    if (a.minor > 0)
+        return true;
+    return a.patch === b.patch;
+}
+export function stableRange(p, from, to) {
+    return Object.keys(p.versions)
+        .filter((v) => semver.valid(v) &&
+        !semver.prerelease(v) &&
+        semver.gt(v, from) &&
+        semver.lte(v, to))
+        .sort(semver.compare);
+}
+export function selectCandidate(p, installed, opts) {
+    if (!semver.valid(installed))
+        return {
+            kind: "error",
+            reason: `installed version ${installed} is not semver`,
+        };
+    if (opts.explicit) {
+        const target = p["dist-tags"][opts.explicit] ?? opts.explicit;
+        if (!p.versions[target])
+            return {
+                kind: "error",
+                reason: `version ${opts.explicit} does not exist`,
+            };
+        if (semver.eq(target, installed))
+            return { kind: "up-to-date", skippedNewer: [] };
+        const from = semver.lt(target, installed) ? target : installed;
+        const to = semver.lt(target, installed) ? installed : target;
+        return {
+            kind: "candidate",
+            candidate: {
+                pkg: p.name,
+                from: installed,
+                to: target,
+                bump: bumpOf(from, to),
+                publishedAt: p.time[target] ?? "",
+                range: stableRange(p, from, to),
+                skippedNewer: [],
+            },
+        };
+    }
+    const skipped = [];
+    const eligible = [];
+    const newer = Object.keys(p.versions)
+        .filter((v) => semver.valid(v) && !semver.prerelease(v) && semver.gt(v, installed))
+        .sort(semver.rcompare);
+    for (const v of newer) {
+        const pv = p.versions[v];
+        const published = p.time[v];
+        if (pv.deprecated) {
+            skipped.push({ version: v, reason: "deprecated" });
+            continue;
+        }
+        if (!published)
+            continue;
+        const age = opts.now - Date.parse(published);
+        if (age < opts.minAgeMs && !opts.ageExcluded(v)) {
+            skipped.push({ version: v, reason: "too-new", publishedAt: published });
+            continue;
+        }
+        eligible.push(v);
+    }
+    const latestTag = p["dist-tags"].latest;
+    const onLine = eligible.filter((v) => sameLine(installed, v));
+    const beyond = eligible.filter((v) => !sameLine(installed, v));
+    let target;
+    if (opts.latest) {
+        target = eligible[0];
+    }
+    else {
+        target = onLine[0];
+        // npm never installs above `latest` for a range, so neither does the brief
+        if (target &&
+            latestTag &&
+            semver.valid(latestTag) &&
+            sameLine(installed, latestTag) &&
+            semver.gt(target, latestTag)) {
+            for (const v of onLine)
+                if (semver.gt(v, latestTag))
+                    skipped.push({ version: v, reason: "above-dist-tag" });
+            target = semver.gt(latestTag, installed) ? latestTag : undefined;
+        }
+    }
+    const skippedNewer = skipped
+        .filter((s) => !target || semver.gt(s.version, target))
+        .filter((s) => opts.latest || sameLine(installed, s.version))
+        .sort((a, b) => semver.compare(a.version, b.version))
+        .slice(0, 3);
+    const above = opts.latest ? undefined : beyond[0];
+    const alsoAvailable = above
+        ? { version: above, bump: bumpOf(installed, above) }
+        : undefined;
+    if (!target)
+        return {
+            kind: "up-to-date",
+            skippedNewer,
+            ...(alsoAvailable ? { alsoAvailable } : {}),
+        };
+    return {
+        kind: "candidate",
+        candidate: {
+            pkg: p.name,
+            from: installed,
+            to: target,
+            bump: bumpOf(installed, target),
+            publishedAt: p.time[target] ?? "",
+            range: stableRange(p, installed, target),
+            skippedNewer,
+            ...(alsoAvailable ? { alsoAvailable } : {}),
+        },
+    };
+}

package/dist/registry/npmrc.d.ts

@@ -0,0 +1,13 @@
+export interface RegistryConfig {
+    defaultRegistry: string;
+    scoped: Record<string, string>;
+    tokens: Record<string, string>;
+    minimumReleaseAgeMs?: number;
+    minimumReleaseAgeSource?: string;
+    minimumReleaseAgeExclude: string[];
+}
+export declare function loadRegistryConfig(root: string, env: NodeJS.ProcessEnv): RegistryConfig;
+export declare function registryFor(cfg: RegistryConfig, pkg: string): string;
+export declare function authHeaders(cfg: RegistryConfig, url: string): Record<string, string>;
+export declare function isAgeExcluded(cfg: RegistryConfig, pkg: string, version: string): boolean;
+//# sourceMappingURL=npmrc.d.ts.map

package/dist/registry/npmrc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npmrc.d.ts","sourceRoot":"","sources":["../../src/registry/npmrc.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAA;CACnC;AAuBD,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,cAAc,CA2ChB;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAMpE;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,MAAM,GACV,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAGD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GACd,OAAO,CAeT"}

package/dist/registry/npmrc.js

@@ -0,0 +1,99 @@
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { existsSync, readFileSync } from "node:fs";
+import { parseDuration } from "../options.js";
+function parseIni(text, env) {
+    const out = {};
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#") || line.startsWith(";"))
+            continue;
+        const eq = line.indexOf("=");
+        if (eq < 0)
+            continue;
+        const key = line.slice(0, eq).trim();
+        const value = line
+            .slice(eq + 1)
+            .trim()
+            .replace(/^"(.*)"$/, "$1")
+            .replace(/\$\{([^}]+)\}/g, (_, name) => env[name] ?? "");
+        out[key] = value;
+    }
+    return out;
+}
+export function loadRegistryConfig(root, env) {
+    const merged = {};
+    for (const file of [join(homedir(), ".npmrc"), join(root, ".npmrc")]) {
+        if (existsSync(file))
+            Object.assign(merged, parseIni(readFileSync(file, "utf8"), env));
+    }
+    const cfg = {
+        defaultRegistry: trimSlash(env.npm_config_registry || merged.registry || "https://registry.npmjs.org"),
+        scoped: {},
+        tokens: {},
+        minimumReleaseAgeExclude: [],
+    };
+    for (const [k, v] of Object.entries(merged)) {
+        const scope = /^(@[^:]+):registry$/.exec(k);
+        if (scope?.[1])
+            cfg.scoped[scope[1]] = trimSlash(v);
+        const token = /^\/\/(.+?)\/?:_authToken$/.exec(k);
+        if (token?.[1] && v)
+            cfg.tokens[token[1].replace(/\/$/, "")] = v;
+    }
+    const npmrcAge = merged["minimum-release-age"];
+    if (npmrcAge) {
+        cfg.minimumReleaseAgeMs = parseDuration(npmrcAge);
+        cfg.minimumReleaseAgeSource = ".npmrc minimum-release-age";
+    }
+    const ws = join(root, "pnpm-workspace.yaml");
+    if (existsSync(ws)) {
+        const text = readFileSync(ws, "utf8");
+        const age = /^minimumReleaseAge:\s*(\d+)\s*$/m.exec(text);
+        if (age?.[1]) {
+            cfg.minimumReleaseAgeMs = Number(age[1]) * 60_000;
+            cfg.minimumReleaseAgeSource = "pnpm-workspace.yaml minimumReleaseAge";
+        }
+        const block = /^minimumReleaseAgeExclude:\s*\n((?:[ \t]+-.*\n?)*)/m.exec(text);
+        for (const line of block?.[1]?.split("\n") ?? []) {
+            const m = /^\s+-\s+['"]?([^'"\s]+)['"]?/.exec(line);
+            if (m?.[1])
+                cfg.minimumReleaseAgeExclude.push(m[1]);
+        }
+    }
+    return cfg;
+}
+export function registryFor(cfg, pkg) {
+    if (pkg.startsWith("@")) {
+        const scope = pkg.split("/")[0];
+        if (cfg.scoped[scope])
+            return cfg.scoped[scope];
+    }
+    return cfg.defaultRegistry;
+}
+export function authHeaders(cfg, url) {
+    const host = url.replace(/^https?:\/\//, "");
+    let best = "";
+    for (const prefix of Object.keys(cfg.tokens)) {
+        if (host.startsWith(prefix) && prefix.length > best.length)
+            best = prefix;
+    }
+    return best ? { authorization: `Bearer ${cfg.tokens[best]}` } : {};
+}
+// "lib", "lib@2.1.0" (only that version waived), "@scope/*"
+export function isAgeExcluded(cfg, pkg, version) {
+    return cfg.minimumReleaseAgeExclude.some((pattern) => {
+        const at = pattern.lastIndexOf("@");
+        const [name, ver] = at > 0
+            ? [pattern.slice(0, at), pattern.slice(at + 1)]
+            : [pattern, undefined];
+        const nameOk = name.endsWith("*")
+            ? pkg.startsWith(name.slice(0, -1))
+            : pkg === name;
+        return (nameOk &&
+            (ver === undefined || ver.split("||").some((v) => v.trim() === version)));
+    });
+}
+function trimSlash(s) {
+    return s.replace(/\/+$/, "");
+}

package/dist/registry/packument.d.ts

@@ -0,0 +1,34 @@
+import type { Ctx } from "../options.ts";
+import { type RegistryConfig } from "./npmrc.ts";
+export interface PackumentVersion {
+    version: string;
+    deprecated?: string;
+    dist: {
+        tarball: string;
+        integrity?: string;
+        shasum?: string;
+    };
+    types?: string;
+    typings?: string;
+    exports?: unknown;
+    typesVersions?: Record<string, Record<string, string[]>>;
+    repository?: unknown;
+    bin?: unknown;
+}
+export interface Packument {
+    name: string;
+    "dist-tags": Record<string, string>;
+    time: Record<string, string>;
+    repository?: unknown;
+    versions: Record<string, PackumentVersion>;
+}
+export type PackumentResult = {
+    ok: true;
+    packument: Packument;
+} | {
+    ok: false;
+    reason: "not-found" | "unpublished" | "offline-uncached" | "http-error";
+    detail?: string;
+};
+export declare function getPackument(ctx: Ctx, cfg: RegistryConfig, name: string): Promise<PackumentResult>;
+//# sourceMappingURL=packument.d.ts.map

package/dist/registry/packument.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"packument.d.ts","sourceRoot":"","sources":["../../src/registry/packument.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AAGxC,OAAO,EAAe,KAAK,cAAc,EAAe,MAAM,YAAY,CAAA;AAE1E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;IACxD,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,GAAG,CAAC,EAAE,OAAO,CAAA;CACd;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;CAC3C;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAClC;IACE,EAAE,EAAE,KAAK,CAAA;IACT,MAAM,EAAE,WAAW,GAAG,aAAa,GAAG,kBAAkB,GAAG,YAAY,CAAA;IACvE,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAKL,wBAAsB,YAAY,CAChC,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,eAAe,CAAC,CA8C1B"}

package/dist/registry/packument.js

@@ -0,0 +1,85 @@
+import { safeKey } from "../infra/cache.js";
+import { OfflineError } from "../infra/http.js";
+import { authHeaders, registryFor } from "./npmrc.js";
+const FRESH_MS = 60 * 60 * 1000;
+// The full document, because the abbreviated one has no `time`, `repository`, `types` or `exports`.
+export async function getPackument(ctx, cfg, name) {
+    const key = `packuments/${safeKey(name)}.json`;
+    const cached = await ctx.cache.getJson(key);
+    if (cached && (ctx.offline || ctx.now - cached.storedAt < FRESH_MS))
+        return { ok: true, packument: cached.value.packument };
+    if (ctx.offline)
+        return { ok: false, reason: "offline-uncached" };
+    const url = `${registryFor(cfg, name)}/${name.replace("/", "%2f")}`;
+    const headers = {
+        accept: "application/json",
+        ...authHeaders(cfg, url),
+    };
+    if (cached?.value.etag)
+        headers["if-none-match"] = cached.value.etag;
+    try {
+        const res = await ctx.net(() => ctx.http.get({ url, headers }));
+        if (res.status === 304 && cached) {
+            await ctx.cache.setJson(key, cached.value, ctx.now);
+            return { ok: true, packument: cached.value.packument };
+        }
+        if (res.status === 404)
+            return { ok: false, reason: "not-found" };
+        if (res.status !== 200) {
+            if (cached)
+                return { ok: true, packument: cached.value.packument };
+            return { ok: false, reason: "http-error", detail: `HTTP ${res.status}` };
+        }
+        const full = JSON.parse(res.body.toString("utf8"));
+        const packument = trim(full);
+        if (!packument.versions || Object.keys(packument.versions).length === 0) {
+            return {
+                ok: false,
+                reason: packument.time?.unpublished ? "unpublished" : "not-found",
+            };
+        }
+        await ctx.cache.setJson(key, { etag: res.headers.etag, packument }, ctx.now);
+        return { ok: true, packument };
+    }
+    catch (error) {
+        if (cached)
+            return { ok: true, packument: cached.value.packument };
+        if (error instanceof OfflineError)
+            return { ok: false, reason: "offline-uncached" };
+        return { ok: false, reason: "http-error", detail: String(error) };
+    }
+}
+function trim(full) {
+    const versions = {};
+    for (const [v, raw] of Object.entries((full.versions ?? {}))) {
+        const dist = (raw.dist ?? {});
+        const pv = {
+            version: v,
+            dist: {
+                tarball: dist.tarball,
+                integrity: dist.integrity,
+                shasum: dist.shasum,
+            },
+        };
+        if (typeof raw.deprecated === "string" && raw.deprecated)
+            pv.deprecated = raw.deprecated;
+        if (typeof raw.types === "string")
+            pv.types = raw.types;
+        if (typeof raw.typings === "string")
+            pv.typings = raw.typings;
+        if (raw.exports !== undefined)
+            pv.exports = raw.exports;
+        if (raw.typesVersions)
+            pv.typesVersions = raw.typesVersions;
+        if (raw.repository !== undefined)
+            pv.repository = raw.repository;
+        versions[v] = pv;
+    }
+    return {
+        name: String(full.name),
+        "dist-tags": (full["dist-tags"] ?? {}),
+        time: (full.time ?? {}),
+        repository: full.repository,
+        versions,
+    };
+}

package/dist/registry/tar.d.ts

@@ -0,0 +1,2 @@
+export declare function readTarball(tgz: Uint8Array, keep: (path: string) => boolean): Map<string, Buffer>;
+//# sourceMappingURL=tar.d.ts.map

package/dist/registry/tar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar.d.ts","sourceRoot":"","sources":["../../src/registry/tar.ts"],"names":[],"mappings":"AAKA,wBAAgB,WAAW,CACzB,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAC9B,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAsCrB"}