@socketsecurity/lib 5.27.0 → 6.0.0

package/dist/packages/manifest.d.ts

@@ -1,34 +1,34 @@
 /**
- * @fileoverview Package manifest and packument fetching utilities.
+ * @file Package manifest and packument fetching utilities.
  */
-import type { PackageJson, PacoteOptions } from '../packages';
+import type { PackageJson, PacoteOptions } from './types';
 /**
  * Create a package.json object for a Socket registry package.
  *
  * @example
- * ```typescript
- * const pkgJson = createPackageJson('is-number', 'packages/npm/is-number', {
- *   version: '1.0.0',
- *   description: 'Check if a value is a number'
- * })
- * ```
+ *   ;```typescript
+ *   const pkgJson = createPackageJson('is-number', 'packages/npm/is-number', {
+ *     version: '1.0.0',
+ *     description: 'Check if a value is a number',
+ *   })
+ *   ```
  */
 export declare function createPackageJson(sockRegPkgName: string, directory: string, options?: PackageJson | undefined): PackageJson;
 /**
  * Fetch the manifest for a package.
  *
  * @example
- * ```typescript
- * const manifest = await fetchPackageManifest('lodash@4.17.21')
- * ```
+ *   ;```typescript
+ *   const manifest = await fetchPackageManifest('lodash@4.17.21')
+ *   ```
  */
 export declare function fetchPackageManifest(pkgNameOrId: string, options?: PacoteOptions): Promise<unknown>;
 /**
  * Fetch the packument (package document) for a package.
  *
  * @example
- * ```typescript
- * const packument = await fetchPackagePackument('lodash')
- * ```
+ *   ;```typescript
+ *   const packument = await fetchPackagePackument('lodash')
+ *   ```
  */
 export declare function fetchPackagePackument(pkgNameOrId: string, options?: PacoteOptions): Promise<unknown>;

package/dist/packages/manifest.js

@@ -36,17 +36,18 @@ __export(manifest_exports, {
 });
 module.exports = __toCommonJS(manifest_exports);
 var import_packages = require("../constants/packages");
-var import_process = require("../constants/process");
+var import_abort = require("../process/abort");
 var import_socket = require("../constants/socket");
 var import_npm_package_arg = __toESM(require("../external/npm-package-arg"));
 var import_pacote = __toESM(require("../external/pacote"));
 var import_semver = __toESM(require("../external/semver"));
-var import_arrays = require("../arrays");
-var import_objects = require("../objects");
+var import_predicates = require("../arrays/predicates");
+var import_predicates2 = require("../objects/predicates");
+var import_sort = require("../objects/sort");
 var import_exports = require("./exports");
 var import_validation = require("./validation");
-var import_primordials = require("../primordials");
-const abortSignal = (0, import_process.getAbortSignal)();
+var import_object = require("../primordials/object");
+const abortSignal = (0, import_abort.getAbortSignal)();
 const packageDefaultNodeRange = (0, import_packages.getPackageDefaultNodeRange)();
 const PACKAGE_DEFAULT_SOCKET_CATEGORIES = (0, import_packages.getPackageDefaultSocketCategories)();
 const packumentCache = (0, import_packages.getPackumentCache)();
@@ -85,15 +86,15 @@ function createPackageJson(sockRegPkgName, directory, options) {
       directory
     },
     ...type ? { type } : {},
-    ...(0, import_objects.isObjectObject)(entryExports) ? { exports: { ...entryExports } } : {},
+    ...(0, import_predicates2.isPlainObject)(entryExports) ? { exports: { ...entryExports } } : {},
     ...entryExports ? {} : { main: `${main ?? "./index.js"}` },
     sideEffects: sideEffects !== void 0 && !!sideEffects,
-    ...(0, import_objects.isObjectObject)(dependencies) ? { dependencies: { ...dependencies } } : {},
-    ...(0, import_objects.isObjectObject)(overrides) ? { overrides: { ...overrides } } : {},
-    ...(0, import_objects.isObjectObject)(resolutions) ? { resolutions: { ...resolutions } } : {},
-    ...(0, import_objects.isObjectObject)(engines) ? {
-      engines: (0, import_primordials.ObjectFromEntries)(
-        (0, import_objects.objectEntries)(engines).map((pair) => {
+    ...(0, import_predicates2.isPlainObject)(dependencies) ? { dependencies: { ...dependencies } } : {},
+    ...(0, import_predicates2.isPlainObject)(overrides) ? { overrides: { ...overrides } } : {},
+    ...(0, import_predicates2.isPlainObject)(resolutions) ? { resolutions: { ...resolutions } } : {},
+    ...(0, import_predicates2.isPlainObject)(engines) ? {
+      engines: (0, import_object.ObjectFromEntries)(
+        (0, import_sort.objectEntries)(engines).map((pair) => {
           const strKey = String(pair[0]);
           const result = [strKey, pair[1]];
           if (strKey === "node") {
@@ -112,8 +113,8 @@ function createPackageJson(sockRegPkgName, directory, options) {
         })
       )
     } : { engines: { node: packageDefaultNodeRange } },
-    files: (0, import_arrays.isArray)(files) ? files.slice() : ["*.d.ts", "*.js"],
-    ...(0, import_objects.isObjectObject)(socket) ? { socket: { ...socket } } : {
+    files: (0, import_predicates.isArray)(files) ? files.slice() : ["*.d.ts", "*.js"],
+    ...(0, import_predicates2.isPlainObject)(socket) ? { socket: { ...socket } } : {
       socket: {
         // Valid categories are: cleanup, levelup, speedup, tuneup
         categories: PACKAGE_DEFAULT_SOCKET_CATEGORIES
@@ -155,7 +156,7 @@ async function fetchPackageManifest(pkgNameOrId, options) {
       pacoteOptions
     );
   }
-  return null;
+  return void 0;
 }
 // @__NO_SIDE_EFFECTS__
 async function fetchPackagePackument(pkgNameOrId, options) {

package/dist/packages/normalize.d.ts

@@ -1,42 +1,43 @@
 /**
- * @fileoverview Package.json normalization utilities.
+ * @file Package.json normalization utilities.
  */
-import type { NormalizeOptions, PackageJson } from '../packages';
+import type { NormalizeOptions, PackageJson } from './types';
+export declare function getEscapedScopeRegExp(): RegExp;
 /**
  * Normalize a package.json object with standard npm package normalization.
  *
  * @example
- * ```typescript
- * const pkgJson = { name: 'my-pkg', version: '1.0.0' }
- * const normalized = normalizePackageJson(pkgJson)
- * ```
+ *   ;```typescript
+ *   const pkgJson = { name: 'my-pkg', version: '1.0.0' }
+ *   const normalized = normalizePackageJson(pkgJson)
+ *   ```
  */
 export declare function normalizePackageJson(pkgJson: PackageJson, options?: NormalizeOptions): PackageJson;
 /**
  * Extract escaped scope from a Socket registry package name.
  *
  * @example
- * ```typescript
- * resolveEscapedScope('babel__core') // 'babel__'
- * resolveEscapedScope('lodash')      // undefined
- * ```
+ *   ;```typescript
+ *   resolveEscapedScope('babel__core') // 'babel__'
+ *   resolveEscapedScope('lodash') // undefined
+ *   ```
  */
 export declare function resolveEscapedScope(sockRegPkgName: string): string | undefined;
 /**
  * Resolve original package name from Socket registry package name.
  *
  * @example
- * ```typescript
- * resolveOriginalPackageName('@socketregistry/is-number') // 'is-number'
- * ```
+ *   ;```typescript
+ *   resolveOriginalPackageName('@socketregistry/is-number') // 'is-number'
+ *   ```
  */
 export declare function resolveOriginalPackageName(sockRegPkgName: string): string;
 /**
  * Convert escaped scope to standard npm scope format.
  *
  * @example
- * ```typescript
- * unescapeScope('babel__') // '@babel'
- * ```
+ *   ;```typescript
+ *   unescapeScope('babel__') // '@babel'
+ *   ```
  */
 export declare function unescapeScope(escapedScope: string): string;

package/dist/packages/normalize.js

@@ -30,6 +30,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var normalize_exports = {};
 __export(normalize_exports, {
+  getEscapedScopeRegExp: () => getEscapedScopeRegExp,
   normalizePackageJson: () => normalizePackageJson,
   resolveEscapedScope: () => resolveEscapedScope,
   resolveOriginalPackageName: () => resolveOriginalPackageName,
@@ -37,41 +38,42 @@ __export(normalize_exports, {
 });
 module.exports = __toCommonJS(normalize_exports);
 var import_socket = require("../constants/socket");
-var import_regexps = require("../regexps");
+var import_escape = require("../regexps/escape");
 var import_normalize_package_data = __toESM(require("../external/normalize-package-data"));
-var import_objects = require("../objects");
+var import_mutate = require("../objects/mutate");
 var import_operations = require("./operations");
-var import_primordials = require("../primordials");
-const ArrayIsArray = Array.isArray;
-const ObjectHasOwn = Object.hasOwn;
+var import_array = require("../primordials/array");
+var import_object = require("../primordials/object");
+var import_regexp = require("../primordials/regexp");
+var import_string = require("../primordials/string");
 function getEscapedScopeRegExp() {
   const firstChar = import_socket.REGISTRY_SCOPE_DELIMITER[0];
-  return new import_primordials.RegExpCtor(
-    `^[^${(0, import_regexps.escapeRegExp)(firstChar)}]+${(0, import_regexps.escapeRegExp)(import_socket.REGISTRY_SCOPE_DELIMITER)}(?!${(0, import_regexps.escapeRegExp)(firstChar)})`
+  return new import_regexp.RegExpCtor(
+    `^[^${(0, import_escape.escapeRegExp)(firstChar)}]+${(0, import_escape.escapeRegExp)(import_socket.REGISTRY_SCOPE_DELIMITER)}(?!${(0, import_escape.escapeRegExp)(firstChar)})`
   );
 }
 // @__NO_SIDE_EFFECTS__
 function normalizePackageJson(pkgJson, options) {
   const { preserve } = { __proto__: null, ...options };
-  if (!ObjectHasOwn(pkgJson, "version")) {
+  if (!(0, import_object.ObjectHasOwn)(pkgJson, "version")) {
     pkgJson.version = "0.0.0";
   }
   const preserved = [
     ["_id", void 0],
     ["readme", void 0],
-    ...ObjectHasOwn(pkgJson, "bugs") ? [] : [["bugs", void 0]],
-    ...ObjectHasOwn(pkgJson, "homepage") ? [] : [["homepage", void 0]],
-    ...ObjectHasOwn(pkgJson, "name") ? [] : [["name", void 0]],
-    ...ArrayIsArray(preserve) ? preserve.map((k) => [
+    ...(0, import_object.ObjectHasOwn)(pkgJson, "bugs") ? [] : [["bugs", void 0]],
+    ...(0, import_object.ObjectHasOwn)(pkgJson, "homepage") ? [] : [["homepage", void 0]],
+    ...(0, import_object.ObjectHasOwn)(pkgJson, "name") ? [] : [["name", void 0]],
+    ...(0, import_array.ArrayIsArray)(preserve) ? preserve.map((k) => [
       k,
-      ObjectHasOwn(pkgJson, k) ? pkgJson[k] : void 0
+      (0, import_object.ObjectHasOwn)(pkgJson, k) ? pkgJson[k] : void 0
     ]) : []
   ];
   (0, import_normalize_package_data.default)(pkgJson);
   if (pkgJson.name && pkgJson.version) {
     const extensions = (0, import_operations.findPackageExtensions)(pkgJson.name, pkgJson.version);
     if (extensions && typeof extensions === "object") {
-      (0, import_objects.merge)(pkgJson, extensions);
+      (0, import_mutate.merge)(pkgJson, extensions);
     }
   }
   for (const { 0: key, 1: value } of preserved) {
@@ -82,17 +84,17 @@ function normalizePackageJson(pkgJson, options) {
 // @__NO_SIDE_EFFECTS__
 function resolveEscapedScope(sockRegPkgName) {
   const escapedScopeRegExp = getEscapedScopeRegExp();
-  const match = (0, import_primordials.RegExpPrototypeExec)(escapedScopeRegExp, sockRegPkgName)?.[0];
+  const match = (0, import_regexp.RegExpPrototypeExec)(escapedScopeRegExp, sockRegPkgName)?.[0];
   return match || void 0;
 }
 // @__NO_SIDE_EFFECTS__
 function resolveOriginalPackageName(sockRegPkgName) {
-  const name = (0, import_primordials.StringPrototypeStartsWith)(
+  const name = (0, import_string.StringPrototypeStartsWith)(
     sockRegPkgName,
     `${import_socket.SOCKET_REGISTRY_SCOPE}/`
   ) ? sockRegPkgName.slice(import_socket.SOCKET_REGISTRY_SCOPE.length + 1) : sockRegPkgName;
   const escapedScope = /* @__PURE__ */ resolveEscapedScope(name);
-  return escapedScope ? `${/* @__PURE__ */ unescapeScope(escapedScope)}/${(0, import_primordials.StringPrototypeSlice)(name, escapedScope.length)}` : name;
+  return escapedScope ? `${/* @__PURE__ */ unescapeScope(escapedScope)}/${(0, import_string.StringPrototypeSlice)(name, escapedScope.length)}` : name;
 }
 // @__NO_SIDE_EFFECTS__
 function unescapeScope(escapedScope) {
@@ -103,6 +105,7 @@ function unescapeScope(escapedScope) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  getEscapedScopeRegExp,
   normalizePackageJson,
   resolveEscapedScope,
   resolveOriginalPackageName,

package/dist/packages/operations.d.ts

@@ -1,63 +1,76 @@
 /**
- * @fileoverview Package operations including extraction, packing, and I/O.
+ * @file Package operations including extraction, packing, and I/O.
  */
-import type { ExtractOptions, NormalizeOptions, PackageJson, PacoteOptions, ReadPackageJsonOptions } from '../packages';
+import type { ExtractOptions, NormalizeOptions, PackageJson, PacoteOptions, ReadPackageJsonOptions } from './types';
 /**
  * Extract a package to a destination directory.
  *
  * @example
- * ```typescript
- * await extractPackage('lodash@4.17.21', { dest: '/tmp/lodash' })
- * ```
+ *   ;```typescript
+ *   await extractPackage('lodash@4.17.21', { dest: '/tmp/lodash' })
+ *   ```
  */
 export declare function extractPackage(pkgNameOrId: string, options?: ExtractOptions, callback?: (destPath: string) => Promise<unknown>): Promise<void>;
 /**
  * Find package extensions for a given package.
  *
  * @example
- * ```typescript
- * const extensions = findPackageExtensions('my-pkg', '1.0.0')
- * ```
+ *   ;```typescript
+ *   const extensions = findPackageExtensions('my-pkg', '1.0.0')
+ *   ```
  */
 export declare function findPackageExtensions(pkgName: string, pkgVer: string): unknown;
 /**
  * Get the release tag for a version.
  *
  * @example
- * ```typescript
- * getReleaseTag('lodash@latest')    // 'latest'
- * getReleaseTag('@scope/pkg@beta')  // 'beta'
- * getReleaseTag('lodash')           // ''
- * ```
+ *   ;```typescript
+ *   getReleaseTag('lodash@latest') // 'latest'
+ *   getReleaseTag('@scope/pkg@beta') // 'beta'
+ *   getReleaseTag('lodash') // ''
+ *   ```
  */
 export declare function getReleaseTag(spec: string): string;
 /**
  * Pack a package tarball using pacote.
  *
  * @example
- * ```typescript
- * const tarball = await packPackage('lodash@4.17.21')
- * ```
+ *   ;```typescript
+ *   const tarball = await packPackage('lodash@4.17.21')
+ *   ```
  */
 export declare function packPackage(spec: string, options?: PacoteOptions): Promise<unknown>;
+/**
+ * Slugify an npm package name into a hyphenated identifier suitable for
+ * User-Agent tokens, log namespaces, file paths, and other contexts where `@`
+ * and `/` are not welcome.
+ *
+ * @example
+ *   ;```typescript
+ *   pkgNameToSlug('@socketsecurity/lib') // 'socketsecurity-lib'
+ *   pkgNameToSlug('@cyclonedx/cdxgen') // 'cyclonedx-cdxgen'
+ *   pkgNameToSlug('lodash') // 'lodash'
+ *   ```
+ */
+export declare function pkgNameToSlug(pkgName: string): string;
 /**
  * Read and parse a package.json file asynchronously.
  *
  * @example
- * ```typescript
- * const pkgJson = await readPackageJson('/tmp/my-project')
- * console.log(pkgJson?.name)
- * ```
+ *   ;```typescript
+ *   const pkgJson = await readPackageJson('/tmp/my-project')
+ *   console.log(pkgJson?.name)
+ *   ```
  */
 export declare function readPackageJson(filepath: string, options?: ReadPackageJsonOptions): Promise<PackageJson | undefined>;
 /**
  * Read and parse package.json from a file path synchronously.
  *
  * @example
- * ```typescript
- * const pkgJson = readPackageJsonSync('/tmp/my-project')
- * console.log(pkgJson?.name)
- * ```
+ *   ;```typescript
+ *   const pkgJson = readPackageJsonSync('/tmp/my-project')
+ *   console.log(pkgJson?.name)
+ *   ```
  */
 export declare function readPackageJsonSync(filepath: string, options?: NormalizeOptions & {
     editable?: boolean;
@@ -67,19 +80,19 @@ export declare function readPackageJsonSync(filepath: string, options?: Normaliz
  * Resolve GitHub tarball URL for a package specifier.
  *
  * @example
- * ```typescript
- * const url = await resolveGitHubTgzUrl('my-pkg@1.0.0', '/tmp/my-project')
- * ```
+ *   ;```typescript
+ *   const url = await resolveGitHubTgzUrl('my-pkg@1.0.0', '/tmp/my-project')
+ *   ```
  */
 export declare function resolveGitHubTgzUrl(pkgNameOrId: string, where?: unknown): Promise<string>;
 /**
  * Resolve full package name from a PURL object with custom delimiter.
  *
  * @example
- * ```typescript
- * resolvePackageName({ name: 'core', namespace: '@babel' })  // '@babel/core'
- * resolvePackageName({ name: 'lodash' })                     // 'lodash'
- * ```
+ *   ;```typescript
+ *   resolvePackageName({ name: 'core', namespace: '@babel' }) // '@babel/core'
+ *   resolvePackageName({ name: 'lodash' }) // 'lodash'
+ *   ```
  */
 export declare function resolvePackageName(purlObj: {
     name: string;
@@ -89,10 +102,10 @@ export declare function resolvePackageName(purlObj: {
  * Convert npm package name to Socket registry format with delimiter.
  *
  * @example
- * ```typescript
- * resolveRegistryPackageName('@babel/core') // 'babel__core'
- * resolveRegistryPackageName('lodash')      // 'lodash'
- * ```
+ *   ;```typescript
+ *   resolveRegistryPackageName('@babel/core') // 'babel__core'
+ *   resolveRegistryPackageName('lodash') // 'lodash'
+ *   ```
  */
 export declare function resolveRegistryPackageName(pkgName: string): string;
-export type { PackageJson } from '../packages';
+export type { PackageJson } from './types';

package/dist/packages/operations.js

@@ -34,6 +34,7 @@ __export(operations_exports, {
   findPackageExtensions: () => findPackageExtensions,
   getReleaseTag: () => getReleaseTag,
   packPackage: () => packPackage,
+  pkgNameToSlug: () => pkgNameToSlug,
   readPackageJson: () => readPackageJson,
   readPackageJsonSync: () => readPackageJsonSync,
   resolveGitHubTgzUrl: () => resolveGitHubTgzUrl,
@@ -42,7 +43,7 @@ __export(operations_exports, {
 });
 module.exports = __toCommonJS(operations_exports);
 var import_packages = require("../constants/packages");
-var import_process = require("../constants/process");
+var import_abort = require("../process/abort");
 var import_socket = require("../constants/socket");
 var import_cacache = __toESM(require("../external/cacache"));
 var import_libnpmpack = __toESM(require("../external/libnpmpack"));
@@ -51,14 +52,16 @@ var import_npm_package_arg = __toESM(require("../external/npm-package-arg"));
 var import_packageurl_js = require("../external/@socketregistry/packageurl-js");
 var import_pacote = __toESM(require("../external/pacote"));
 var semver = __toESM(require("../external/semver"));
-var import_fs = require("../fs");
-var import_objects = require("../objects");
+var import_purl = require("../smol/purl");
+var import_read_json = require("../fs/read-json");
+var import_mutate = require("../objects/mutate");
+var import_predicates = require("../objects/predicates");
 var import_normalize = require("./normalize");
 var import_packages2 = require("../paths/packages");
 var import_specs = require("./specs");
 var import_edit = require("./edit");
-var import_primordials = require("../primordials");
-const abortSignal = (0, import_process.getAbortSignal)();
+var import_string = require("../primordials/string");
+const abortSignal = (0, import_abort.getAbortSignal)();
 const packageExtensions = (0, import_packages.getPackageExtensions)();
 const packumentCache = (0, import_packages.getPackumentCache)();
 const pacoteCachePath = (0, import_packages.getPacoteCachePath)();
@@ -119,7 +122,7 @@ function findPackageExtensions(pkgName, pkgVer) {
           result = {};
         }
         if (typeof ext === "object" && ext !== null) {
-          (0, import_objects.merge)(result, ext);
+          (0, import_mutate.merge)(result, ext);
         }
       }
     }
@@ -132,13 +135,13 @@ function getReleaseTag(spec) {
     return "";
   }
   let atIndex = -1;
-  if ((0, import_primordials.StringPrototypeStartsWith)(spec, "@")) {
-    atIndex = (0, import_primordials.StringPrototypeIndexOf)(spec, "@", 1);
+  if ((0, import_string.StringPrototypeStartsWith)(spec, "@")) {
+    atIndex = (0, import_string.StringPrototypeIndexOf)(spec, "@", 1);
   } else {
-    atIndex = (0, import_primordials.StringPrototypeIndexOf)(spec, "@");
+    atIndex = (0, import_string.StringPrototypeIndexOf)(spec, "@");
   }
   if (atIndex !== -1) {
-    return (0, import_primordials.StringPrototypeSlice)(spec, atIndex + 1);
+    return (0, import_string.StringPrototypeSlice)(spec, atIndex + 1);
   }
   return "";
 }
@@ -153,12 +156,16 @@ async function packPackage(spec, options) {
   });
 }
 // @__NO_SIDE_EFFECTS__
+function pkgNameToSlug(pkgName) {
+  return pkgName.charCodeAt(0) === 64 ? `${pkgName.slice(1).replace("/", "-")}` : pkgName;
+}
+// @__NO_SIDE_EFFECTS__
 async function readPackageJson(filepath, options) {
   const { editable, normalize, throws, ...normalizeOptions } = {
     __proto__: null,
     ...options
   };
-  const pkgJson = await (0, import_fs.readJson)((0, import_packages2.resolvePackageJsonPath)(filepath), {
+  const pkgJson = await (0, import_read_json.readJson)((0, import_packages2.resolvePackageJsonPath)(filepath), {
     throws
   });
   if (pkgJson) {
@@ -179,7 +186,7 @@ function readPackageJsonSync(filepath, options) {
     __proto__: null,
     ...options
   };
-  const pkgJson = (0, import_fs.readJsonSync)((0, import_packages2.resolvePackageJsonPath)(filepath), { throws });
+  const pkgJson = (0, import_read_json.readJsonSync)((0, import_packages2.resolvePackageJsonPath)(filepath), { throws });
   if (pkgJson) {
     if (editable) {
       return (0, import_edit.toEditablePackageJsonSync)(pkgJson, {
@@ -194,7 +201,7 @@ function readPackageJsonSync(filepath, options) {
 }
 // @__NO_SIDE_EFFECTS__
 async function resolveGitHubTgzUrl(pkgNameOrId, where) {
-  const whereIsPkgJson = (0, import_objects.isObjectObject)(where);
+  const whereIsPkgJson = (0, import_predicates.isPlainObject)(where);
   const pkgJson = whereIsPkgJson ? where : await /* @__PURE__ */ readPackageJson(where, { normalize: true });
   if (!pkgJson) {
     return "";
@@ -227,7 +234,12 @@ async function resolveGitHubTgzUrl(pkgNameOrId, where) {
     }
     if (apiUrl) {
       const resp = await fetcher(apiUrl);
-      const json = await resp.json();
+      let json;
+      try {
+        json = await resp.json();
+      } catch {
+        json = void 0;
+      }
       const sha = json?.object?.sha;
       if (sha) {
         return (0, import_specs.gitHubTgzUrl)(user, project, sha);
@@ -243,7 +255,9 @@ function resolvePackageName(purlObj, delimiter = "/") {
 }
 // @__NO_SIDE_EFFECTS__
 function resolveRegistryPackageName(pkgName) {
-  const purlObj = import_packageurl_js.PackageURL.fromString(`pkg:npm/${pkgName}`);
+  const input = `pkg:npm/${pkgName}`;
+  const smolPurl = (0, import_purl.getSmolPurl)();
+  const purlObj = smolPurl ? smolPurl.parse(input) : import_packageurl_js.PackageURL.fromString(input);
   return purlObj.namespace ? `${purlObj.namespace.slice(1)}${import_socket.REGISTRY_SCOPE_DELIMITER}${purlObj.name}` : pkgName;
 }
 // Annotate the CommonJS export names for ESM import in node:
@@ -252,6 +266,7 @@ function resolveRegistryPackageName(pkgName) {
   findPackageExtensions,
   getReleaseTag,
   packPackage,
+  pkgNameToSlug,
   readPackageJson,
   readPackageJsonSync,
   resolveGitHubTgzUrl,

package/dist/packages/provenance.d.ts

@@ -1,23 +1,36 @@
 /**
- * @fileoverview Package provenance and attestation verification utilities.
+ * @file Package provenance and attestation verification utilities.
  */
-import type { ProvenanceOptions } from '../packages';
+import type { ProvenanceOptions } from './types';
 /**
  * Fetch package provenance information from npm registry.
  *
  * @example
- * ```typescript
- * const provenance = await fetchPackageProvenance('lodash', '4.17.21')
- * ```
+ *   ;```typescript
+ *   const provenance = await fetchPackageProvenance('lodash', '4.17.21')
+ *   ```
  */
 export declare function fetchPackageProvenance(pkgName: string, pkgVersion: string, options?: ProvenanceOptions): Promise<unknown>;
+/**
+ * Find the first attestation with valid provenance data.
+ */
+export declare function findProvenance(attestations: unknown[]): unknown;
+/**
+ * Extract and filter SLSA provenance attestations from attestation data.
+ */
+export declare function getAttestations(attestationData: unknown): unknown[];
+export declare function getFetcher(): import("../external/make-fetch-happen").MakeFetchHappen;
 /**
  * Convert raw attestation data to user-friendly provenance details.
  *
  * @example
- * ```typescript
- * const details = getProvenanceDetails(attestationData)
- * // { level: 'trusted', repository: '...', commitSha: '...' }
- * ```
+ *   ;```typescript
+ *   const details = getProvenanceDetails(attestationData)
+ *   // { level: 'trusted', repository: '...', commitSha: '...' }
+ *   ```
  */
 export declare function getProvenanceDetails(attestationData: unknown): unknown;
+/**
+ * Check if a value indicates a trusted publisher (GitHub or GitLab).
+ */
+export declare function isTrustedPublisher(value: unknown): boolean;