@preventive/upstream 1.0.0-alpha.0

package/src/github/write.js

@@ -0,0 +1,112 @@
+import assert from 'node:assert/strict'
+import { Buffer } from 'node:buffer'
+
+import {
+  assertArgs, assertBoolean, assertLine, assertLogin, assertPath, assertRef, assertRepo, assertRepoName, assertSha, assertText,
+  optional, printable,
+} from '../args.js'
+import { HttpError, decode, readBody, send } from '../http.js'
+import { api, bindMethods, call, clientHeaders, repoApi } from './client.js'
+import { getRepoHead, readMethods } from './read.js'
+
+const CREATE_COMMIT_MUTATION = `mutation($input: CreateCommitOnBranchInput!) {
+  createCommitOnBranch(input: $input) {
+    commit { oid url }
+  }
+}`
+
+function toBase64(value, what) {
+  // Buffer.from would put U+FFFD in for a lone surrogate, and commit other bytes than asked.
+  assert.ok((typeof value === 'string' && value.isWellFormed()) || value instanceof Uint8Array, `createCommit: ${what} must be a well-formed string or a Uint8Array, got ${typeof value === 'string' ? 'a malformed string' : typeof value}`)
+  return Buffer.from(value).toString('base64')
+}
+
+function commitMessage(message) {
+  if (typeof message === 'string') {
+    assertLine('createCommit', 'message', message)
+    return { headline: message }
+  }
+  assertArgs('createCommit', message, { headline: assertLine, body: optional(assertText) }, 'message')
+  return { headline: message.headline, ...(message.body && { body: message.body }) }
+}
+
+function fileChanges(additions = [], deletions = []) {
+  assert.ok(Array.isArray(additions), 'createCommit: additions must be an array')
+  assert.ok(Array.isArray(deletions), 'createCommit: deletions must be an array')
+  const seen = new Set()
+  const once = (path, what) => {
+    assertPath('createCommit', what, path)
+    assert.ok(!seen.has(path), `createCommit: ${what} names ${JSON.stringify(path)} a second time`)
+    seen.add(path)
+    return path
+  }
+  return {
+    additions: additions.map((addition, i) => {
+      assertArgs('createCommit', addition, { path: null, contents: null }, `additions[${i}]`)
+      return { path: once(addition.path, `additions[${i}].path`), contents: toBase64(addition.contents, `additions[${i}].contents`) }
+    }),
+    deletions: deletions.map((deletion, i) => {
+      if (typeof deletion === 'string') return { path: once(deletion, `deletions[${i}]`) }
+      assertArgs('createCommit', deletion, { path: null }, `deletions[${i}]`)
+      return { path: once(deletion.path, `deletions[${i}].path`) }
+    }),
+  }
+}
+
+function assertHead(method, what, head) {
+  const colon = typeof head === 'string' ? head.indexOf(':') : -1
+  if (colon === -1) return assertRef(method, what, head)
+  assertLogin(method, `${what} owner`, head.slice(0, colon))
+  assertRef(method, `${what} branch`, head.slice(colon + 1))
+}
+
+// Exported to test the error paths without a fetch mock.
+export function parseGraphQLResponse(status, text) {
+  if (status < 200 || status >= 300) {
+    throw new HttpError(status, `GitHub GraphQL ${status}: ${printable(text.slice(0, 4096)) || '(empty body)'}`)
+  }
+  let json
+  try { json = JSON.parse(text) } catch (err) {
+    throw new Error(`GitHub GraphQL ${status}: malformed JSON response (${err.message}): ${printable(text.slice(0, 200))}`, { cause: err })
+  }
+  if (json.errors) throw new Error(`GitHub GraphQL: ${printable(JSON.stringify(json.errors))}`)
+  return json.data
+}
+
+// A signed commit; the branch must already exist.
+async function createCommitOnBranch(headers, input) {
+  const res = await send(api(['graphql']), { method: 'POST', headers, body: { query: CREATE_COMMIT_MUTATION, variables: { input } }, as: 'json' })
+  return parseGraphQLResponse(res.status, decode(await readBody(res, 1024 * 1024), 'GitHub GraphQL')).createCommitOnBranch.commit
+}
+
+async function forkRepo(headers, options) {
+  assertArgs('forkRepo', options, { repo: assertRepo, name: optional(assertRepoName), organization: optional(assertLogin), defaultBranchOnly: optional(assertBoolean) })
+  const { repo, name, organization, defaultBranchOnly } = options
+  const body = { ...(name && { name }), ...(organization && { organization }), ...(defaultBranchOnly && { default_branch_only: true }) }
+  return await call(headers, repoApi(repo, ['forks']), { method: 'POST', body })
+}
+
+async function createBranch(headers, options) {
+  assertArgs('createBranch', options, { repo: assertRepo, branch: assertRef, oid: optional(assertSha) })
+  const { repo, branch } = options
+  const sha = options.oid ?? (await getRepoHead(headers, { repo })).oid
+  return await call(headers, repoApi(repo, ['git', 'refs']), { method: 'POST', body: { ref: `refs/heads/${branch}`, sha } })
+}
+
+async function createCommit(headers, options) {
+  assertArgs('createCommit', options, { repo: assertRepo, branch: assertRef, message: null, additions: null, deletions: null, expectedHeadOid: optional(assertSha) })
+  const { repo, branch } = options
+  const changes = fileChanges(options.additions, options.deletions)
+  const message = commitMessage(options.message)
+  const expectedHeadOid = options.expectedHeadOid ?? (await getRepoHead(headers, { repo, branch })).oid
+  return await createCommitOnBranch(headers, { branch: { repositoryNameWithOwner: repo, branchName: branch }, message, fileChanges: changes, expectedHeadOid })
+}
+
+async function createPR(headers, options) {
+  assertArgs('createPR', options, { repo: assertRepo, title: assertLine, body: optional(assertText), head: assertHead, base: assertRef, draft: optional(assertBoolean) })
+  const { repo, title, body, head, base, draft } = options
+  const payload = { title, head, base, ...(body && { body }), ...(draft && { draft: true }) }
+  return await call(headers, repoApi(repo, ['pulls']), { method: 'POST', body: payload })
+}
+
+export const createWriteClient = (options) => bindMethods(clientHeaders('createWriteClient', options, false), { ...readMethods, forkRepo, createBranch, createCommit, createPR })

package/src/http.js

@@ -0,0 +1,112 @@
+import assert from 'node:assert/strict'
+
+import { matches, printable } from './args.js'
+
+// Every request goes through here, to a URL from buildUrl, which has to
+// come back out of `new URL()` unchanged: no segment can then be read as
+// `..` (`%2e%2e` included), a query or a fragment.
+
+export const NPM_REGISTRY = 'https://registry.npmjs.org'
+export const GITHUB_API = 'https://api.github.com'
+export const OSV_API = 'https://api.osv.dev'
+export const CRATES_API = 'https://crates.io'
+export const PACKAGIST_REPO = 'https://repo.packagist.org'
+export const MAX_BYTES = 512 * 1024 * 1024
+
+const ORIGINS = new Set([NPM_REGISTRY, GITHUB_API, OSV_API, CRATES_API, PACKAGIST_REPO])
+const isSegment = matches(/^(?!\.\.?$)(?:[\w.~@-]|%[\dA-F]{2})+$/u)
+const isQueryKey = matches(/^[a-z_]+(?:\[\])?$/u)
+const isQueryValue = (value) => (typeof value === 'string' && value !== '') || (Number.isSafeInteger(value) && value >= 0)
+// Only a `key[]` repeats, and it always does.
+const isQuery = ([key, value]) => isQueryKey(key) && (key.endsWith('[]') ? Array.isArray(value) && value.length > 0 && value.every(isQueryValue) : isQueryValue(value))
+// A line break in a value would start a header of its own.
+const isHeader = ([name, value]) => /^[A-Za-z][\w-]*$/u.test(name) && matches(/^[ -~]*$/u)(value)
+const LIMITS = {
+  json: { bytes: 64 * 1024 * 1024, ms: 30_000 },
+  text: { bytes: 128 * 1024 * 1024, ms: 30_000 },
+  bytes: { bytes: MAX_BYTES, ms: 300_000 },
+}
+const decoder = new TextDecoder('utf-8', { fatal: true })
+
+export class HttpError extends Error {
+  constructor(status, message) {
+    super(message)
+    this.name = 'HttpError'
+    this.status = status
+  }
+}
+
+export function decode(bytes, from) {
+  try {
+    return decoder.decode(bytes)
+  } catch (err) {
+    throw new Error(`Malformed UTF-8 from ${from}`, { cause: err })
+  }
+}
+
+// encodeURIComponent leaves `!'()*` as they are.
+export function encodeSegment(value) {
+  assert.equal(typeof value, 'string')
+  return encodeURIComponent(value).replace(/[!'()*]/gu, (char) => `%${char.codePointAt(0).toString(16).toUpperCase()}`)
+}
+
+export function buildUrl(origin, segments, query = {}) {
+  assert.ok(ORIGINS.has(origin), `Unexpected origin: ${origin}`)
+  assert.ok(segments.length > 0 && segments.every(isSegment), `Unexpected URL path segment in ${JSON.stringify(segments)}`)
+  assert.ok(Object.entries(query).every(isQuery), `Unexpected query parameter in ${JSON.stringify(query)}`)
+  const search = new URLSearchParams(Object.entries(query).flatMap(([key, value]) => [value].flat().map((item) => [key, item]))).toString()
+  const href = `${origin}/${segments.join('/')}${search && `?${search}`}`
+  assert.equal(new URL(href).href, href, `URL changed in parsing: ${href}`)
+  return href
+}
+
+// Redirects aren't followed unless asked: an answer about another repo is
+// worse than an error.
+export async function send(url, { method = 'GET', headers = {}, body, redirect = 'manual', as } = {}) {
+  const parsed = typeof url === 'string' ? URL.parse(url) : null
+  assert.ok(parsed?.href === url && ORIGINS.has(parsed.origin) && !parsed.username && !parsed.password && !parsed.hash, `Unexpected URL: ${printable(url)}`)
+  assert.ok(['GET', 'POST'].includes(method), `Unexpected method: ${method}`)
+  assert.ok(['manual', 'follow'].includes(redirect), `Unexpected redirect mode: ${redirect}`)
+  assert.ok(Object.hasOwn(LIMITS, as), `Unexpected response type: ${as}`)
+  assert.ok(Object.entries(headers).every(isHeader), 'Unexpected header')
+  const json = body === undefined ? {} : { headers: { ...headers, 'Content-Type': 'application/json' }, body: JSON.stringify(body) }
+  return await fetch(url, { method, headers, redirect, signal: AbortSignal.timeout(LIMITS[as].ms), ...json })
+}
+
+export async function readBody(res, limit, { truncate = false } = {}) {
+  const declared = Number(res.headers.get('content-length'))
+  if (!truncate && declared > limit) {
+    await res.body?.cancel()
+    throw new Error(`Response too large: ${declared} bytes, over ${limit}`)
+  }
+  const chunks = []
+  let size = 0
+  for await (const chunk of res.body ?? []) {
+    chunks.push(chunk)
+    size += chunk.byteLength
+    if (size <= limit) continue
+    if (!truncate) throw new Error(`Response too large: over ${limit} bytes`)
+    break
+  }
+  return new Uint8Array(await new Blob(chunks).arrayBuffer(), 0, Math.min(size, limit))
+}
+
+// Read as the caller says, not by content type, which proxies drop or
+// rewrite.
+export async function request(url, options) {
+  const res = await send(url, options)
+  if (!res.ok) {
+    // A stream decode holds back a character cut at the limit rather than refusing it.
+    const text = await readBody(res, 4096, { truncate: true }).then((bytes) => new TextDecoder('utf-8', { fatal: true }).decode(bytes, { stream: true })).catch(() => '')
+    throw new HttpError(res.status, `${options.method ?? 'GET'} ${url} ${res.status}: ${printable(text)}`)
+  }
+  const bytes = await readBody(res, LIMITS[options.as].bytes)
+  if (options.as === 'bytes') return bytes
+  const text = decode(bytes, url)
+  if (options.as === 'text') return text
+  try {
+    return JSON.parse(text)
+  } catch (err) {
+    throw new Error(`Malformed JSON from ${url}: ${printable(text.slice(0, 200))}`, { cause: err })
+  }
+}

package/src/npm/repos.js

@@ -0,0 +1,68 @@
+import assert from 'node:assert/strict'
+
+import { assertArgs, assertBoolean, assertPackageName, assertRepo, isRepo, optional, show } from '../args.js'
+import { readCacheJSON, writeCacheJSON } from '../cache.js'
+import { HttpError, NPM_REGISTRY, buildUrl, request } from '../http.js'
+import { assertRepoDirectory, getRepo, isRepoDirectory } from '../package.js'
+import { pool } from '../pool.js'
+
+const DIR = 'npm/repos'
+const TTL_MS = 30 * 24 * 60 * 60 * 1000 // A link only moves on a transfer or rename, and GitHub redirects those.
+const CONCURRENCY = 8
+
+// `latest`, not the full packument, which is megabytes of version history.
+async function fetchRepo(method, name) {
+  const json = await request(buildUrl(NPM_REGISTRY, [...name.split('/'), 'latest']), { as: 'json' })
+  assert.ok(json?.name === name, `${method}: the registry answered for ${show(json?.name)}, not ${name}`)
+  return getRepo(json)
+}
+
+export async function getGitHub(name) {
+  assertPackageName('getGitHub', 'name', name)
+  const link = await fetchRepo('getGitHub', name)
+  assert.ok(link.github, `getGitHub: no GitHub repo for ${name}`)
+  return link
+}
+
+// An entry without `directory` predates the field: a miss, not a package
+// at the repo root.
+export async function readPackageRepoCache(name) {
+  assertPackageName('readPackageRepoCache', 'name', name)
+  const entry = await readCacheJSON(DIR, `${name}.json`)
+  const age = typeof entry?.at === 'number' ? Date.now() - entry.at : Number.NaN
+  const fresh = age >= 0 && age <= TTL_MS // An entry from the future is not fresh forever.
+  if (!fresh || entry.name !== name || !isRepo(entry.github) || !isRepoDirectory(entry.directory)) return null
+  return { github: entry.github, ...(entry.directory && { directory: entry.directory }) }
+}
+
+// Only resolved repos are cached: a 404, a rate limit and a package with
+// no repo link fail alike.
+export async function writePackageRepoCache(name, github, directory = '') {
+  assertPackageName('writePackageRepoCache', 'name', name)
+  assertRepo('writePackageRepoCache', 'github', github)
+  assertRepoDirectory('writePackageRepoCache', 'directory', directory)
+  return await writeCacheJSON(DIR, `${name}.json`, { at: Date.now(), name, github, directory })
+}
+
+export async function resolvePackageRepos(packageNames, options = {}) {
+  assert.ok(typeof packageNames?.[Symbol.iterator] === 'function' && typeof packageNames !== 'string', 'resolvePackageRepos: packageNames must be an iterable of names')
+  assertArgs('resolvePackageRepos', options, { cachedOnly: optional(assertBoolean) })
+  const names = [...new Set(packageNames)]
+  for (const name of names) assertPackageName('resolvePackageRepos', 'name', name)
+  const found = await pool(names, CONCURRENCY, (name) => (options.cachedOnly ? readPackageRepoCache(name) : lookUpPackageRepo(name)).catch(() => null))
+  return new Map(names.flatMap((name, i) => (found[i] ? [[name, found[i]]] : [])))
+}
+
+// Through the cache. Null for a package the registry does not have, or
+// one naming no GitHub repo; any other failure throws.
+export async function lookUpPackageRepo(name) {
+  const stored = await readPackageRepoCache(name)
+  if (stored) return stored
+  const { github, directory } = await fetchRepo('lookUpPackageRepo', name).catch((err) => {
+    if (err instanceof HttpError && err.status === 404) return {}
+    throw err
+  })
+  if (!github) return null
+  await writePackageRepoCache(name, github, directory)
+  return { github, ...(directory && { directory }) }
+}

package/src/npm/tarball.js

@@ -0,0 +1,115 @@
+import assert from 'node:assert/strict'
+import { Buffer } from 'node:buffer'
+import { createHash } from 'node:crypto'
+import { readFile, stat } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { join, resolve } from 'node:path'
+
+import { assertArgs, assertPackageName, assertPackageVersion, assertion, matches, show } from '../args.js'
+import { readCache, writeCache } from '../cache.js'
+import { MAX_BYTES, NPM_REGISTRY, buildUrl, request } from '../http.js'
+
+const DIR = 'npm/tarballs' // No expiry: the registry never takes a version twice.
+// One sha512 and nothing else, as the registry writes it: a sha1, a second
+// hash or an option is refused rather than trusted. 64 bytes leave the
+// last character before `==` two bits, so only A, Q, g or w is canonical.
+const assertIntegrity = assertion('"sha512-" and a base64 sha512', matches(/^sha512-[\dA-Za-z+/]{85}[AQgw]==$/u))
+const sha512 = (bytes) => `sha512-${createHash('sha512').update(bytes).digest('base64')}`
+
+function assertPackage(method, name, version) {
+  assertPackageName(method, 'name', name)
+  assertPackageVersion(method, 'version', version)
+}
+
+function tarballUrl(name, version) {
+  const segments = name.split('/')
+  return buildUrl(NPM_REGISTRY, [...segments, '-', `${segments.at(-1)}-${version}.tgz`])
+}
+
+// `{ tarball, integrity }` and nothing else, the tarball exactly the
+// registry's own URL for that version. Each field is read once, and only
+// as the object's own, into a copy that is checked and used from then on:
+// the caller's object can change while a request is out, and a field on
+// its prototype is not one it has.
+function checkedDist(method, name, version, dist) {
+  assertArgs(method, dist, { tarball: null, integrity: null }, 'dist')
+  const [tarball, integrity] = ['tarball', 'integrity'].map((key) => (Object.hasOwn(dist, key) ? dist[key] : undefined))
+  assertIntegrity(method, 'dist.integrity', integrity)
+  const expected = tarballUrl(name, version)
+  assert.ok(tarball === expected, `${method}: dist.tarball must be ${expected}, got ${show(tarball)}`)
+  return { tarball, integrity }
+}
+
+async function getDist(method, name, version) {
+  const json = await request(buildUrl(NPM_REGISTRY, [...name.split('/'), version]), { as: 'json' })
+  assert.ok(json?.name === name && json.version === version, `${method}: the registry answered for ${show(json?.name)}@${show(json?.version)}, not ${name}@${version}`)
+  return checkedDist(method, name, version, { tarball: json.dist?.tarball, integrity: json.dist?.integrity })
+}
+
+function assertBytes(bytes, integrity, what) {
+  const actual = sha512(bytes)
+  assert.ok(actual === integrity, `getTarball: integrity mismatch for ${what}: expected ${integrity}, got ${actual}`)
+}
+
+// Where npm keeps its cache, short of an .npmrc moving it: npm_config_cache,
+// as npm sets it for what it runs, else npm's default. On Windows, npm 4
+// and before defaulted to %APPDATA%, later ones to %LOCALAPPDATA%.
+function npmCacheDirs() {
+  const configured = process.env.npm_config_cache || process.env.NPM_CONFIG_CACHE
+  if (configured) return [resolve(configured.replace(/^~(?=[/\\])/u, homedir()))]
+  if (process.platform !== 'win32') return [join(homedir(), '.npm')]
+  return [process.env.LOCALAPPDATA, process.env.APPDATA].map((dir) => join(dir || homedir(), 'npm-cache'))
+}
+
+// Only a regular file: a FIFO or a device would block or never end.
+async function readRegularFile(path) {
+  const stats = await stat(path).catch(() => null)
+  if (!stats?.isFile() || stats.size > MAX_BYTES) return null
+  return await readFile(path).then((bytes) => new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength), () => null)
+}
+
+// npm 5+ (cacache) files a tarball by its sha512, npm 4 and before as
+// <name>/<version>/package.tgz; ~/.audit as <org>:<name>-<version>.tgz.
+async function readLocalCaches(name, version, integrity) {
+  const hex = Buffer.from(integrity.slice('sha512-'.length), 'base64').toString('hex')
+  const npm = npmCacheDirs().flatMap((root) => [join(root, '_cacache/content-v2/sha512', hex.slice(0, 2), hex.slice(2, 4), hex.slice(4)), join(root, name, version, 'package.tgz')])
+  const audit = join(homedir(), '.audit/cache/tgz', `${name.replace(/^@/u, '').replace('/', ':')}-${version}.tgz`)
+  for (const path of [...npm, audit]) {
+    const bytes = await readRegularFile(path)
+    if (bytes && sha512(bytes) === integrity) return bytes
+  }
+  return null
+}
+
+export async function getMeta(name, version) {
+  assertPackage('getMeta', name, version)
+  return { name, version, dist: await getDist('getMeta', name, version) }
+}
+
+export async function verifyDist(name, version, dist) {
+  assertPackage('verifyDist', name, version)
+  const given = checkedDist('verifyDist', name, version, dist)
+  const { integrity } = await getDist('verifyDist', name, version)
+  assert.ok(given.integrity === integrity, `verifyDist: ${name}@${version} is ${integrity} on the registry, not ${given.integrity}`)
+}
+
+// Without `dist`, the version document is read every time, cache or not:
+// bytes from a cache are checked against the registry's integrity, never
+// against anything a cache itself holds. A mismatch in ours throws rather
+// than fetching over it.
+export async function getTarball(name, version, dist) {
+  assertPackage('getTarball', name, version)
+  dist = dist === undefined ? await getDist('getTarball', name, version) : checkedDist('getTarball', name, version, dist)
+  const local = await readLocalCaches(name, version, dist.integrity)
+  if (local) return local
+  const key = `${name}@${version}.tgz`
+  const cached = await readCache(DIR, key)
+  if (cached) {
+    assertBytes(cached, dist.integrity, `${name}@${version} from the cache`)
+    return cached
+  }
+  const bytes = await request(dist.tarball, { as: 'bytes' })
+  assertBytes(bytes, dist.integrity, `${name}@${version} from ${dist.tarball}`)
+  await writeCache(DIR, key, bytes)
+  return bytes
+}

package/src/package.js

@@ -0,0 +1,49 @@
+import assert from 'node:assert/strict'
+
+import { assertion, isRepo, isRepoPath, sameName } from './args.js'
+import { githubRepoOfUrl } from './remote.js'
+
+const bugsRegex = /^(?i:https?:\/\/github\.com)(?::\d{1,5})?\/(?<repo>[\w-]+\/[\w.-]+)\/issues\/?$/u
+// npm's `owner/name` shorthand means GitHub. No dots in the owner, so a
+// domain (`srvx.h3.dev/srvx`) isn't read as one; another forge's prefix
+// (`gitlab:`) can't match.
+const shorthandRegex = /^(?:github:)?(?<repo>[\w-]+\/[\w.-]+)$/u
+// The ref is one segment: a branch with a `/` reads as part of the directory.
+const homepageRegex = /^(?:https?:\/\/)?(?:www\.)?github\.com(?::\d{1,5})?\/(?<repo>[\w-]+\/[\w.-]+?)(?:\.git)?(?:\/(?:tree\/[^/]+(?:\/(?<directory>.*))?)?)?$/iu
+const str = (value) => (typeof value === 'string' ? value : '')
+const urlOf = (field) => str(field?.url ?? field)
+const homepageUrl = (homepage) => str(homepage).trim().split(/[?#]/u)[0] // npm appends `#readme`.
+const repoIn = (regex, text) => regex.exec(text)?.groups.repo
+// A URL's path spells a tree path percent-encoded; one that does not decode names none.
+function decodePath(path = '') {
+  try {
+    return decodeURIComponent(path)
+  } catch {}
+}
+
+// npm lets a repository name a commit-ish after `#`; it is not part of the repo.
+function repositoryRepo(url) {
+  const repo = url.replace(/#.*$/su, '')
+  return repoIn(shorthandRegex, repo) ?? githubRepoOfUrl(repo)
+}
+
+// Spaces are kept: git allows them at either end of a name.
+function repoSubdirectory(value) {
+  const path = str(value).replace(/^(?:\.\/|\/)+/u, '').replace(/\/+$/u, '')
+  return isRepoPath(path) ? path : undefined // No empty, `.`, `..` or `.git` part: a path inside the repo.
+}
+
+export const isRepoDirectory = (value) => typeof value === 'string' && (value === '' || repoSubdirectory(value) === value)
+export const assertRepoDirectory = assertion('a path inside the repository', isRepoDirectory)
+
+export function getRepo(pkg) {
+  assert.ok(pkg && typeof pkg === 'object' && !Array.isArray(pkg), 'getRepo: expected a package.json object')
+  const { bugs, repository } = pkg
+  const declared = repositoryRepo(urlOf(repository))
+  const homepage = homepageRegex.exec(homepageUrl(pkg.homepage))?.groups
+  const github = [repoIn(bugsRegex, urlOf(bugs)), declared, homepage?.repo].find(isRepo)
+  if (github === undefined) return {}
+  const directory = (sameName(declared, github) && repoSubdirectory(repository?.directory))
+    || (sameName(homepage?.repo, github) && repoSubdirectory(decodePath(homepage.directory)))
+  return { github, ...(directory && { directory }), url: `https://github.com/${github}` }
+}

package/src/pool.js

@@ -0,0 +1,12 @@
+// `fn` over `items`, at most `limit` at a time; results in `items` order.
+export async function pool(items, limit, fn) {
+  const results = []
+  let next = 0
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, async () => {
+    while (next < items.length) {
+      const i = next++
+      results[i] = await fn(items[i])
+    }
+  }))
+  return results
+}

package/src/remote.js

@@ -0,0 +1,15 @@
+import { isRepo } from './args.js'
+
+// `user:token@` is skipped, never returned. It is held to the characters
+// RFC 3986 allows there — a `#`, `?` or `\` before the `@` ends the
+// authority early, so `https://evil.example#@github.com/a/b` goes to
+// evil.example — and URL parsing has to agree the host is github.com.
+const gitUrlRegex = /^(?i:(?:git\+)?(?:https?|git|ssh)):\/\/(?:[\w.~%!$&'()*+,;=:-]*@)?(?i:github\.com)(?::\d{1,5})?\/(?<repo>[\w-]+\/[\w.-]+?)(?:\.git)?\/?$/u
+const scpRegex = /^(?i:git\+ssh:\/\/)?git@(?i:github\.com):(?<repo>[\w-]+\/[\w.-]+?)(?:\.git)?$/u
+
+export function githubRepoOfUrl(url) {
+  if (typeof url !== 'string') return undefined
+  const onGitHub = URL.parse(url.replace(/^git\+/iu, ''))?.hostname.toLowerCase() === 'github.com'
+  const repo = scpRegex.exec(url)?.groups.repo ?? (onGitHub ? gitUrlRegex.exec(url)?.groups.repo : undefined)
+  return isRepo(repo) ? repo : undefined
+}

package/src/semver.js

@@ -0,0 +1,41 @@
+import assert from 'node:assert/strict'
+import { createRequire } from 'node:module'
+import { basename, dirname, resolve } from 'node:path'
+
+// npm's own semver, borrowed from the npm next to node rather than added
+// as a dependency: the same implementation `npm audit` uses.
+
+// Plain releases that semver.valid answers unchanged, so it need not be
+// loaded for them: no leading zeros, and at most 15 digits a part, under
+// Number.MAX_SAFE_INTEGER. Anything else, or any call with options, goes
+// to semver.
+const PLAIN_RELEASE = /^(?:0|[1-9]\d{0,14})\.(?:0|[1-9]\d{0,14})\.(?:0|[1-9]\d{0,14})$/u
+
+let found
+
+function find() {
+  const argv0 = process.argv[0]
+  // Another host executable's `../lib` is not npm's.
+  if (!['node', 'node.exe'].includes(basename(argv0 ?? ''))) return null
+  const require = createRequire(import.meta.url)
+  // POSIX keeps npm in <prefix>/lib beside <prefix>/bin/node; Windows, beside node.exe.
+  for (const prefix of ['../lib', '.']) {
+    try {
+      const lib = require(resolve(dirname(argv0), prefix, 'node_modules/npm/node_modules/semver'))
+      if (['compare', 'satisfies', 'valid', 'validRange'].every((name) => typeof lib?.[name] === 'function')) return lib
+    } catch {}
+  }
+  return null
+}
+
+function semver() {
+  if (found === undefined) found = find()
+  assert.ok(found, 'semver: no npm beside node to borrow it from')
+  return found
+}
+
+export const satisfies = (...args) => semver().satisfies(...args)
+export const validRange = (...args) => semver().validRange(...args)
+export const compareVersions = (...args) => semver().compare(...args)
+export const valid = (version, ...rest) => (rest.length === 0 && typeof version === 'string' && PLAIN_RELEASE.test(version) ? version : semver().valid(version, ...rest))
+export const isExactVersion = (version) => typeof version === 'string' && valid(version) === version