@vltpkg/cli-js 1.0.0-rc.24 → 1.0.0-rc.25

package/security-archive-src-update-expired.js

@@ -0,0 +1,2247 @@
+var global = globalThis;
+import {Buffer} from "node:buffer";
+import {setTimeout as _vlt_setTimeout,clearTimeout as _vlt_clearTimeout,setImmediate as _vlt_setImmediate,clearImmediate as _vlt_clearImmediate,setInterval as _vlt_setInterval,clearInterval as _vlt_clearInterval} from "node:timers";
+globalThis.setTimeout = _vlt_setTimeout;
+globalThis.clearTimeout = _vlt_clearTimeout;
+globalThis.setImmediate = _vlt_setImmediate;
+globalThis.clearImmediate = _vlt_clearImmediate;
+globalThis.setInterval = _vlt_setInterval;
+globalThis.clearInterval = _vlt_clearInterval;
+import {createRequire as _vlt_createRequire} from "node:module";
+var require = _vlt_createRequire(import.meta.filename);
+
+// ../../src/security-archive/src/update-expired.ts
+import { DatabaseSync } from "node:sqlite";
+import { mkdirSync } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+import { pathToFileURL } from "node:url";
+
+// ../../node_modules/.vlt/~npm~is-network-error@1.3.1/node_modules/is-network-error/index.js
+var objectToString = Object.prototype.toString;
+var isError = (value) => objectToString.call(value) === "[object Error]";
+var errorMessages = /* @__PURE__ */ new Set([
+  "network error",
+  // Chrome
+  "NetworkError when attempting to fetch resource.",
+  // Firefox
+  "The Internet connection appears to be offline.",
+  // Safari 16
+  "Network request failed",
+  // `cross-fetch`
+  "fetch failed",
+  // Undici (Node.js)
+  "terminated",
+  // Undici (Node.js)
+  " A network error occurred.",
+  // Bun (WebKit)
+  "Network connection lost"
+  // Cloudflare Workers (fetch)
+]);
+function isNetworkError(error2) {
+  const isValid = error2 && isError(error2) && error2.name === "TypeError" && typeof error2.message === "string";
+  if (!isValid) {
+    return false;
+  }
+  const { message, stack } = error2;
+  if (message === "Load failed") {
+    return stack === void 0 || "__sentry_captured__" in error2;
+  }
+  if (message.startsWith("error sending request for url")) {
+    return true;
+  }
+  if (message === "Failed to fetch" || message.startsWith("Failed to fetch (") && message.endsWith(")")) {
+    return true;
+  }
+  return errorMessages.has(message);
+}
+
+// ../../node_modules/.vlt/~npm~p-retry@7.1.1/node_modules/p-retry/index.js
+function validateRetries(retries) {
+  if (typeof retries === "number") {
+    if (retries < 0) {
+      throw new TypeError("Expected `retries` to be a non-negative number.");
+    }
+    if (Number.isNaN(retries)) {
+      throw new TypeError("Expected `retries` to be a valid number or Infinity, got NaN.");
+    }
+  } else if (retries !== void 0) {
+    throw new TypeError("Expected `retries` to be a number or Infinity.");
+  }
+}
+function validateNumberOption(name, value, { min = 0, allowInfinity = false } = {}) {
+  if (value === void 0) {
+    return;
+  }
+  if (typeof value !== "number" || Number.isNaN(value)) {
+    throw new TypeError(`Expected \`${name}\` to be a number${allowInfinity ? " or Infinity" : ""}.`);
+  }
+  if (!allowInfinity && !Number.isFinite(value)) {
+    throw new TypeError(`Expected \`${name}\` to be a finite number.`);
+  }
+  if (value < min) {
+    throw new TypeError(`Expected \`${name}\` to be \u2265 ${min}.`);
+  }
+}
+var AbortError = class extends Error {
+  constructor(message) {
+    super();
+    if (message instanceof Error) {
+      this.originalError = message;
+      ({ message } = message);
+    } else {
+      this.originalError = new Error(message);
+      this.originalError.stack = this.stack;
+    }
+    this.name = "AbortError";
+    this.message = message;
+  }
+};
+function calculateDelay(retriesConsumed, options) {
+  const attempt = Math.max(1, retriesConsumed + 1);
+  const random = options.randomize ? Math.random() + 1 : 1;
+  let timeout = Math.round(random * options.minTimeout * options.factor ** (attempt - 1));
+  timeout = Math.min(timeout, options.maxTimeout);
+  return timeout;
+}
+function calculateRemainingTime(start, max) {
+  if (!Number.isFinite(max)) {
+    return max;
+  }
+  return max - (performance.now() - start);
+}
+async function onAttemptFailure({ error: error2, attemptNumber, retriesConsumed, startTime, options }) {
+  const normalizedError = error2 instanceof Error ? error2 : new TypeError(`Non-error was thrown: "${error2}". You should only throw errors.`);
+  if (normalizedError instanceof AbortError) {
+    throw normalizedError.originalError;
+  }
+  const retriesLeft = Number.isFinite(options.retries) ? Math.max(0, options.retries - retriesConsumed) : options.retries;
+  const maxRetryTime = options.maxRetryTime ?? Number.POSITIVE_INFINITY;
+  const context = Object.freeze({
+    error: normalizedError,
+    attemptNumber,
+    retriesLeft,
+    retriesConsumed
+  });
+  await options.onFailedAttempt(context);
+  if (calculateRemainingTime(startTime, maxRetryTime) <= 0) {
+    throw normalizedError;
+  }
+  const consumeRetry = await options.shouldConsumeRetry(context);
+  const remainingTime = calculateRemainingTime(startTime, maxRetryTime);
+  if (remainingTime <= 0 || retriesLeft <= 0) {
+    throw normalizedError;
+  }
+  if (normalizedError instanceof TypeError && !isNetworkError(normalizedError)) {
+    if (consumeRetry) {
+      throw normalizedError;
+    }
+    options.signal?.throwIfAborted();
+    return false;
+  }
+  if (!await options.shouldRetry(context)) {
+    throw normalizedError;
+  }
+  if (!consumeRetry) {
+    options.signal?.throwIfAborted();
+    return false;
+  }
+  const delayTime = calculateDelay(retriesConsumed, options);
+  const finalDelay = Math.min(delayTime, remainingTime);
+  options.signal?.throwIfAborted();
+  if (finalDelay > 0) {
+    await new Promise((resolve3, reject) => {
+      const onAbort = () => {
+        clearTimeout(timeoutToken);
+        options.signal?.removeEventListener("abort", onAbort);
+        reject(options.signal.reason);
+      };
+      const timeoutToken = setTimeout(() => {
+        options.signal?.removeEventListener("abort", onAbort);
+        resolve3();
+      }, finalDelay);
+      if (options.unref) {
+        timeoutToken.unref?.();
+      }
+      options.signal?.addEventListener("abort", onAbort, { once: true });
+    });
+  }
+  options.signal?.throwIfAborted();
+  return true;
+}
+async function pRetry(input, options = {}) {
+  options = { ...options };
+  validateRetries(options.retries);
+  if (Object.hasOwn(options, "forever")) {
+    throw new Error("The `forever` option is no longer supported. For many use-cases, you can set `retries: Infinity` instead.");
+  }
+  options.retries ??= 10;
+  options.factor ??= 2;
+  options.minTimeout ??= 1e3;
+  options.maxTimeout ??= Number.POSITIVE_INFINITY;
+  options.maxRetryTime ??= Number.POSITIVE_INFINITY;
+  options.randomize ??= false;
+  options.onFailedAttempt ??= () => {
+  };
+  options.shouldRetry ??= () => true;
+  options.shouldConsumeRetry ??= () => true;
+  validateNumberOption("factor", options.factor, { min: 0, allowInfinity: false });
+  validateNumberOption("minTimeout", options.minTimeout, { min: 0, allowInfinity: false });
+  validateNumberOption("maxTimeout", options.maxTimeout, { min: 0, allowInfinity: true });
+  validateNumberOption("maxRetryTime", options.maxRetryTime, { min: 0, allowInfinity: true });
+  if (!(options.factor > 0)) {
+    options.factor = 1;
+  }
+  options.signal?.throwIfAborted();
+  let attemptNumber = 0;
+  let retriesConsumed = 0;
+  const startTime = performance.now();
+  while (Number.isFinite(options.retries) ? retriesConsumed <= options.retries : true) {
+    attemptNumber++;
+    try {
+      options.signal?.throwIfAborted();
+      const result = await input(attemptNumber);
+      options.signal?.throwIfAborted();
+      return result;
+    } catch (error2) {
+      if (await onAttemptFailure({
+        error: error2,
+        attemptNumber,
+        retriesConsumed,
+        startTime,
+        options
+      })) {
+        retriesConsumed++;
+      }
+    }
+  }
+  throw new Error("Retry attempts exhausted without throwing an error.");
+}
+
+// ../../src/error-cause/src/index.ts
+var { captureStackTrace } = Error;
+function create(cls, defaultFrom, message, cause, from = defaultFrom) {
+  const er = new cls(message, cause ? { cause } : void 0);
+  captureStackTrace?.(er, from);
+  return er;
+}
+function error(message, cause, from) {
+  return create(Error, error, message, cause, from);
+}
+function typeError(message, cause, from) {
+  return create(TypeError, typeError, message, cause, from);
+}
+function syntaxError(message, cause, from) {
+  return create(
+    SyntaxError,
+    syntaxError,
+    message,
+    cause,
+    from
+  );
+}
+
+// ../../src/spec/src/index.ts
+import { homedir } from "node:os";
+import {
+  isAbsolute,
+  join,
+  resolve,
+  win32 as winPath
+} from "node:path";
+import { inspect } from "node:util";
+
+// ../../src/fast-split/src/index.ts
+function fastSplit(str, delim, limit = -1, onPart) {
+  let i = 0;
+  let p = 0;
+  const l = delim.length;
+  const parts = [];
+  while (i !== -1) {
+    i = str.indexOf(delim, p);
+    const part = i === -1 || parts.length === limit - 1 ? str.substring(p) : str.substring(p, i);
+    parts.push(onPart?.(part, parts, i) ?? part);
+    if (parts.length === limit) {
+      return parts;
+    }
+    p = i + l;
+  }
+  return parts;
+}
+
+// ../../src/semver/src/version.ts
+var maybeNumber = (s) => {
+  if (!/^[0-9]+$/.test(s)) return s;
+  const n = Number(s);
+  return n <= Number.MAX_SAFE_INTEGER ? n : s;
+};
+var safeNumber = (s, version2, field) => {
+  const n = Number(s);
+  if (n > Number.MAX_SAFE_INTEGER) {
+    throw invalidVersion(
+      version2,
+      `invalid ${field}, must be <= ${Number.MAX_SAFE_INTEGER}`
+    );
+  }
+  return n;
+};
+var re = {
+  prefix: /^[ v=]+/,
+  main: /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)/,
+  prerelease: /-([0-9a-zA-Z_.-]+)(?:$|\+)/,
+  build: /\+([0-9a-zA-Z_.-]+)$/,
+  full: /^[ v=]*(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9a-zA-Z_.-]+))?(?:\+([0-9a-zA-Z_.-]+))?$/
+};
+var invalidVersion = (version2, message) => {
+  const er = syntaxError(
+    `invalid version: ${message}`,
+    { version: version2 },
+    Version
+  );
+  return er;
+};
+var Version = class _Version {
+  /** raw string provided to create this Version */
+  raw;
+  /**  major version number */
+  major;
+  /** minor version number */
+  minor;
+  /** patch version number */
+  patch;
+  /**
+   * List of `'.'`-separated strings and numbers indicating that this
+   * version is a prerelease.
+   *
+   * This is undefined if the version does not have a prerelease section.
+   */
+  prerelease;
+  /**
+   * List of `'.'`-separated strings in the `build` section.
+   *
+   * This is undefined if the version does not have a build.
+   */
+  build;
+  /** Canonical strict form of this version */
+  toString() {
+    return `${this.major}.${this.minor}.${this.patch}${this.prerelease ? "-" + this.prerelease.join(".") : ""}${this.build ? "+" + this.build.join(".") : ""}`;
+  }
+  /** Generate a `Version` object from a SemVer string */
+  static parse(version2) {
+    version2 = version2.replace(re.prefix, "").trim();
+    if (version2.length > 256) {
+      throw invalidVersion(
+        version2,
+        "must be less than 256 characters"
+      );
+    }
+    const parsed = re.full.exec(version2);
+    if (!parsed) {
+      const main2 = re.main.exec(version2);
+      if (!main2) {
+        throw invalidVersion(
+          version2,
+          "no Major.minor.patch tuple present"
+        );
+      } else {
+        throw invalidVersion(
+          version2,
+          "invalid build or patch section"
+        );
+      }
+    }
+    const [_, major_, minor_, patch_, prerelease, build] = parsed;
+    const major = safeNumber(major_, version2, "major");
+    const minor = safeNumber(minor_, version2, "minor");
+    const patch = safeNumber(patch_, version2, "patch");
+    return new _Version(
+      version2,
+      major,
+      minor,
+      patch,
+      prerelease,
+      build
+    );
+  }
+  constructor(version2, major, minor, patch, prerelease, build) {
+    this.raw = version2;
+    this.major = major;
+    this.minor = minor;
+    this.patch = patch;
+    if (prerelease) {
+      this.prerelease = fastSplit(prerelease, ".", -1, (c) => {
+        if (!c) {
+          throw invalidVersion(
+            version2,
+            "invalid prerelease, empty identifiers not allowed"
+          );
+        }
+        return maybeNumber(c);
+      });
+    }
+    if (build) {
+      this.build = fastSplit(build, ".", -1, (c) => {
+        if (!c) {
+          throw invalidVersion(
+            version2,
+            "invalid build metadata, empty identifiers not allowed"
+          );
+        }
+      });
+    }
+  }
+  /**
+   * Return 1 if this is > the provided version, -1 if we're less, or 0 if
+   * they are equal.
+   *
+   * No special handling for prerelease versions, this is just a precedence
+   * comparison.
+   *
+   * This can be used to sort a list of versions by precedence:
+   *
+   * ```ts
+   * const versions: Version[] = getVersionsSomehow()
+   * const sorted = versions.sort((a, b) => a.compare(b))
+   * ```
+   */
+  compare(v) {
+    if (this.major > v.major) return 1;
+    if (this.major < v.major) return -1;
+    if (this.minor > v.minor) return 1;
+    if (this.minor < v.minor) return -1;
+    if (this.patch > v.patch) return 1;
+    if (this.patch < v.patch) return -1;
+    if (!v.prerelease?.length)
+      return !this.prerelease?.length ? 0 : -1;
+    if (!this.prerelease?.length) return 1;
+    const len = Math.max(this.prerelease.length, v.prerelease.length);
+    const me = this.prerelease;
+    const thee = v.prerelease;
+    for (let i = 0; i < len; i++) {
+      const m = me[i];
+      const t = thee[i];
+      if (m === t) continue;
+      if (t === void 0) return 1;
+      if (m === void 0) return -1;
+      if (typeof m !== typeof t) {
+        return typeof m === "string" ? 1 : -1;
+      }
+      return m > t ? 1 : -1;
+    }
+    return 0;
+  }
+  /**
+   * The inverse of compare, for sorting version lists in reverse order
+   */
+  rcompare(v) {
+    return -1 * this.compare(v);
+  }
+  /** true if this version is > the argument */
+  greaterThan(v) {
+    return this.compare(v) === 1;
+  }
+  /** true if this version is >= the argument */
+  greaterThanEqual(v) {
+    return this.compare(v) > -1;
+  }
+  /** true if this version is < the argument */
+  lessThan(v) {
+    return this.compare(v) === -1;
+  }
+  /** true if this version is &lt;= the argument */
+  lessThanEqual(v) {
+    return this.compare(v) < 1;
+  }
+  /** true if these two versions have equal SemVer precedence */
+  equals(v) {
+    return this.compare(v) === 0;
+  }
+  /** just compare the M.m.p parts of the version */
+  tupleEquals(v) {
+    return this.major === v.major && this.minor === v.minor && this.patch === v.patch;
+  }
+  /** true if this version satisfies the range */
+  satisfies(r) {
+    return r.test(this);
+  }
+  /**
+   * Increment the version in place, in the manner specified.
+   *
+   * Part behaviors:
+   *
+   * - `'major'` If the version is a `M.0.0-...` version with a prerelease, then
+   * simply drop the prerelease. Otherwise, set the minor and patch to 0, and
+   * increment the major. So `1.0.0-beta` becomes `1.0.0`, and `1.2.3` becomes
+   * `2.0.0`
+   *
+   * - `'minor'` If the version is a `M.m.0-...` version with a prerelease, then
+   * simply drop the prerelease. Otherwise, set the patch to 0, and increment the
+   * minor. So `1.2.0-beta` becomes `1.2.0`, and `1.2.3` becomes `1.3.0`.
+   *
+   * - `'patch'` If the version has a prerelease, then simply drop the
+   * prerelease. Otherwise, increment the patch value. So `1.2.3-beta` becomes
+   * `1.2.3` and `1.2.3` becomes `1.2.4`.
+   *
+   * - `'premajor'` Set the patch and minor versions to `0`, increment the major
+   * version, and add a prerelease, using the optional identifier.
+   *
+   * - `'preminor'` Set the patch version to `0`, increment the minor version,
+   * and add a prerelease, using the optional identifier.
+   *
+   * - `'prepatch'` If a prerelease is already present, increment the patch
+   * version, otherwise leave it untouched, and add a prerelease, using the
+   * optional identifier.
+   *
+   * - `'prerelease'` If a prerelease version is present, then behave the same as
+   * `'prepatch'`. Otherwise, add a prerelease, using the optional identifier.
+   *
+   * - `'pre'` This is mostly for use by the other prerelease incrementers.
+   *
+   *     - If a prerelease identifier is provided:
+   *
+   *        Update that named portion of the prerelease. For example,
+   *        `inc('1.2.3-beta.4', 'pre', 'beta')` would result in `1.2.3-beta.5`.
+   *
+   *        If there is no prerelease identifier by that name, then replace the
+   *        prerelease with `[name]`. So `inc('1.2.3-alpha.4', 'pre', 'beta')`
+   *        would result in `1.2.3-beta`.
+   *
+   *        If the prerelease identifer is present, but has no numeric value
+   *        following it, then add `0`. So `inc('1.2.3-beta', 'pre', 'beta')`
+   *        would result in `1.2.3-beta.0`.
+   *
+   *     - If no prerelease identifier is provided:
+   *
+   *       If there is no current prerelease, then set the prerelease to `0`. So,
+   *       `inc('1.2.3', 'pre')` becomes `1.2.3-0`.
+   *
+   *       If the last item in the prerelease is numeric, then increment it. So,
+   *       `inc('1.2.3-beta.3', 'pre')` becomes `1.2.3-beta.4`.
+   */
+  inc(part, prereleaseIdentifier) {
+    switch (part) {
+      case "premajor":
+        this.prerelease = void 0;
+        this.patch = 0;
+        this.minor = 0;
+        this.major++;
+        this.inc("pre", prereleaseIdentifier);
+        break;
+      case "preminor":
+        this.prerelease = void 0;
+        this.patch = 0;
+        this.minor++;
+        this.inc("pre", prereleaseIdentifier);
+        break;
+      case "prepatch":
+        this.prerelease = void 0;
+        this.inc("patch");
+        this.inc("pre", prereleaseIdentifier);
+        break;
+      case "prerelease":
+        if (!this.prerelease?.length)
+          this.inc("patch", prereleaseIdentifier);
+        this.inc("pre", prereleaseIdentifier);
+        break;
+      case "pre": {
+        if (!prereleaseIdentifier) {
+          if (!this.prerelease?.length) {
+            this.prerelease = [0];
+            break;
+          }
+          const last = this.prerelease[this.prerelease.length - 1];
+          if (typeof last === "number") {
+            this.prerelease[this.prerelease.length - 1] = last + 1;
+          } else {
+            this.prerelease.push(0);
+          }
+          break;
+        }
+        if (!this.prerelease?.length) {
+          this.prerelease = [prereleaseIdentifier];
+          break;
+        }
+        const i = this.prerelease.indexOf(
+          maybeNumber(prereleaseIdentifier)
+        );
+        if (i === -1) {
+          this.prerelease = [prereleaseIdentifier];
+          break;
+        }
+        const baseValue = this.prerelease[i + 1];
+        if (typeof baseValue === "number") {
+          this.prerelease[i + 1] = baseValue + 1;
+          break;
+        }
+        if (i === this.prerelease.length - 1) {
+          this.prerelease.push(0);
+          break;
+        }
+        this.prerelease.splice(i + 1, 0, 0);
+        break;
+      }
+      case "major":
+        if (!this.prerelease?.length || this.minor || this.patch)
+          this.major++;
+        this.prerelease = void 0;
+        this.patch = 0;
+        this.minor = 0;
+        break;
+      case "minor":
+        if (!this.prerelease?.length || this.patch) this.minor++;
+        this.prerelease = void 0;
+        this.patch = 0;
+        break;
+      case "patch":
+        if (!this.prerelease?.length) this.patch++;
+        this.prerelease = void 0;
+        break;
+      default:
+        throw typeError(
+          "Invalid increment identifier",
+          {
+            version: this,
+            found: part,
+            validOptions: [
+              "major",
+              "minor",
+              "patch",
+              "premajor",
+              "preminor",
+              "prepatch",
+              "prerelease",
+              "pre"
+            ]
+          },
+          this.inc
+        );
+    }
+    this.raw = this.toString();
+    return this;
+  }
+};
+
+// ../../src/semver/src/comparator.ts
+var isOperator = (o) => !!o && (o === ">" || o === "<" || o === ">=" || o === "<=" || o === "" || o === "~" || o === "^" || o === "~>");
+var preJunk = new Set("=v 	");
+var invalidComp = (c, message) => syntaxError(
+  `invalid comparator: '${c}' ${message}`,
+  { found: c },
+  Comparator
+);
+var assertNumber = (value, c, field) => {
+  const n = Number(value);
+  if (n !== n) {
+    throw invalidComp(
+      c,
+      `${field} must be numeric or 'x', got: '${value}'`
+    );
+  }
+  return n;
+};
+var assertVersion = (v, comp) => {
+  if (!v) {
+    throw invalidComp(comp, "no value provided for operator");
+  }
+};
+var assertMissing = (value, c, field) => {
+  if (value && !isX(value)) {
+    throw invalidComp(
+      c,
+      `cannot omit '${field}' and include subsequent fields`
+    );
+  }
+};
+var MAJOR = 0;
+var MINOR = 1;
+var PATCH = 2;
+var isX = (c) => !c || c === "X" || c === "x" || c === "*";
+var isFullVersion = (parsed) => void 0 !== parsed[PATCH];
+var isXPatch = (parsed) => void 0 !== parsed[MINOR] && void 0 === parsed[PATCH];
+var isXMinor = (parsed) => void 0 !== parsed[MAJOR] && void 0 === parsed[MINOR];
+var isXMajor = (parsed) => void 0 === parsed[MAJOR];
+var Comparator = class {
+  /**
+   * does this range include prereleases, even when they do not
+   * match the tuple in the comparator?
+   */
+  includePrerelease;
+  /** raw string used to create this comparator */
+  raw;
+  /** tokens extracted from the raw string input */
+  tokens;
+  /**
+   * Either the `any` comparator, the `none` comparator, or an operator
+   * and a {@link ParsedXRange}
+   */
+  tuples = [];
+  /** true if this comparator can not match anything */
+  isNone = false;
+  /**
+   * true if this comparator is a `'*'` type of range.
+   *
+   * Note that it still will not match versions with a prerelease value,
+   * unless the tuple in the version matches the tuple provided to the
+   * comparator, and the comparator version also has a prerelease value,
+   * unless `includePrerelease` is set.
+   */
+  isAny = false;
+  /** the canonical strict simplified parsed form of this constructor */
+  toString() {
+    return this.isNone ? "<0.0.0-0" : this.isAny ? "*" : (
+      /* c8 ignore next */
+      this.tuples.map((c) => isAny(c) ? "*" : c.join("")).join(" ")
+    );
+  }
+  constructor(comp, includePrerelease = false) {
+    this.includePrerelease = includePrerelease;
+    comp = comp.trim();
+    this.raw = comp;
+    let hyphen = false;
+    const rawComps = fastSplit(comp, " ", -1, (part, parts, i) => {
+      if (part === "-") {
+        if (hyphen) {
+          throw invalidComp(
+            comp,
+            "multiple hyphen ranges not allowed"
+          );
+        }
+        if (parts.length !== 1 || i === -1) {
+          throw invalidComp(
+            comp,
+            "hyphen must be between two versions"
+          );
+        }
+        hyphen = true;
+      } else if (hyphen && parts.length !== 2) {
+        throw invalidComp(comp, "hyphen range must be alone");
+      }
+    });
+    const comps = [];
+    let followingOperator = false;
+    let l = 0;
+    for (const c of rawComps) {
+      if (c === "") continue;
+      if (!followingOperator) {
+        followingOperator = isOperator(c);
+        comps.push(c);
+        l++;
+        continue;
+      }
+      comps[l - 1] += c;
+      followingOperator = false;
+    }
+    if (hyphen) {
+      const [min, _, max] = comps;
+      if (!min || !max) {
+        throw invalidComp(comp, "hyphen must be between two versions");
+      }
+      this.#parseHyphenRange(min, max);
+    } else if (!comps.length || comps.length === 1 && isX(comps[0])) {
+      this.tuples.push(this.#getComparatorAny());
+    } else {
+      for (const c of comps) {
+        this.#parse(c);
+        if (this.isNone) break;
+      }
+    }
+    this.tokens = comps;
+    this.isAny = true;
+    for (const c of this.tuples) {
+      if (Array.isArray(c) || !c.isAny) {
+        this.isAny = false;
+        break;
+      }
+    }
+  }
+  // inclusive min
+  #xInclusiveMin(raw) {
+    const z = this.includePrerelease ? "0" : void 0;
+    const [M, m = 0, p = 0, pr = z, build] = this.#parseX(raw);
+    return M === void 0 ? this.#getComparatorAny() : [">=", new Version(raw, M, m, p, pr, build)];
+  }
+  // exclusive min
+  #xExclusiveMin(raw) {
+    const parsed = this.#parseX(raw);
+    if (isFullVersion(parsed)) {
+      return [">", new Version(raw, ...parsed)];
+    }
+    const z = this.includePrerelease ? "0" : void 0;
+    if (isXPatch(parsed)) {
+      return [
+        ">=",
+        new Version(
+          raw,
+          parsed[MAJOR],
+          parsed[MINOR] + 1,
+          0,
+          z,
+          void 0
+        )
+      ];
+    }
+    if (isXMinor(parsed)) {
+      return [
+        ">=",
+        new Version(raw, parsed[MAJOR] + 1, 0, 0, z, void 0)
+      ];
+    }
+    this.isNone = true;
+    this.tuples.length = 0;
+    return comparatorNone;
+  }
+  #xInclusiveMax(raw) {
+    const parsed = this.#parseX(raw);
+    return isFullVersion(parsed) ? ["<=", new Version(raw, ...parsed)] : isXPatch(parsed) ? [
+      "<",
+      new Version(
+        raw,
+        parsed[MAJOR],
+        parsed[MINOR] + 1,
+        0,
+        "0",
+        void 0
+      )
+    ] : isXMinor(parsed) ? [
+      "<",
+      new Version(raw, parsed[MAJOR] + 1, 0, 0, "0", void 0)
+    ] : this.#getComparatorAny();
+  }
+  #xExclusiveMax(raw) {
+    const z = this.includePrerelease ? "0" : void 0;
+    const [M = 0, m = 0, p = 0, pr = z, build] = this.#parseX(raw);
+    if (M === 0 && m === 0 && p === 0 && pr === "0") {
+      this.isNone = true;
+      this.tuples.length = 0;
+      return comparatorNone;
+    }
+    return ["<", new Version(raw, M, m, p, pr, build)];
+  }
+  #validXM(raw, m, p) {
+    assertMissing(m, raw, "major");
+    assertMissing(p, raw, "major");
+    if (m === "" || p === "") {
+      throw invalidComp(raw, `(Did you mean '*'?)`);
+    }
+    return [];
+  }
+  #validXm(raw, M, m, p) {
+    assertMissing(p, raw, "major");
+    if (m === "" || p === "") {
+      throw invalidComp(raw, `(Did you mean '${M}'?)`);
+    }
+    return [assertNumber(M, raw, "major")];
+  }
+  #validXp(raw, M, m, p) {
+    if (p === "") {
+      throw invalidComp(raw, `(Did you mean '${M}.${m}'?)`);
+    }
+    return [
+      assertNumber(M, raw, "major"),
+      assertNumber(m, raw, "minor")
+    ];
+  }
+  #validTuple(raw, M, m, p) {
+    return [
+      assertNumber(M, raw, "major"),
+      assertNumber(m, raw, "minor"),
+      assertNumber(p, raw, "patch")
+    ];
+  }
+  #validXbuild(raw, M, m, p, pl) {
+    const patch = p.substring(0, pl);
+    const build = p.substring(pl + 1);
+    if (!patch) {
+      throw invalidComp(raw, "cannot specify build without patch");
+    }
+    if (!build) {
+      throw invalidComp(raw, `encountered '+', but no build value`);
+    }
+    return [
+      assertNumber(M, raw, "major"),
+      assertNumber(m, raw, "minor"),
+      assertNumber(patch, raw, "patch"),
+      void 0,
+      build
+    ];
+  }
+  #validXpr(raw, M, m, p, hy) {
+    {
+      const patch = p.substring(0, hy);
+      const pr = p.substring(hy + 1);
+      if (!patch) {
+        throw invalidComp(
+          raw,
+          "cannot specify prerelease without patch"
+        );
+      }
+      if (!pr) {
+        throw invalidComp(
+          raw,
+          `encountered '-', but no prerelease value`
+        );
+      }
+      return [
+        assertNumber(M, raw, "major"),
+        assertNumber(m, raw, "minor"),
+        assertNumber(patch, raw, "patch"),
+        pr,
+        void 0
+      ];
+    }
+  }
+  #validXprbuild(raw, M, m, p, hy, pl) {
+    const patch = p.substring(0, hy);
+    const pr = p.substring(hy + 1, pl);
+    const build = p.substring(pl + 1);
+    if (!patch) {
+      throw invalidComp(
+        raw,
+        "cannot specify prerelease without patch"
+      );
+    }
+    if (!pr) {
+      throw invalidComp(
+        raw,
+        `encountered '-', but no prerelease value`
+      );
+    }
+    if (!build) {
+      throw invalidComp(raw, `encountered '+', but no build value`);
+    }
+    return [
+      assertNumber(M, raw, "major"),
+      assertNumber(m, raw, "minor"),
+      assertNumber(patch, raw, "patch"),
+      pr,
+      build
+    ];
+  }
+  // pull the relevant values out of an X-range or version
+  // return the fields for creating a Version object.
+  // only call once operator is stripped off
+  #parseX(raw) {
+    let [M, m, p] = fastSplit(raw, ".", 3);
+    let prune = 0;
+    while (M && preJunk.has(M.charAt(prune))) prune++;
+    if (M !== void 0 && prune !== 0) M = M.substring(prune);
+    if (!M || isX(M)) return this.#validXM(raw, m, p);
+    if (!m || isX(m)) return this.#validXm(raw, M, m, p);
+    if (!p || isX(p)) return this.#validXp(raw, M, m, p);
+    const hy = p.indexOf("-");
+    const pl = p.indexOf("+");
+    if (pl === -1 && hy === -1) return this.#validTuple(raw, M, m, p);
+    if (pl === -1) return this.#validXpr(raw, M, m, p, hy);
+    if (hy === -1) return this.#validXbuild(raw, M, m, p, pl);
+    return this.#validXprbuild(raw, M, m, p, hy, pl);
+  }
+  #parseHyphenRange(min, max) {
+    const minv = this.#xInclusiveMin(min);
+    const maxv = this.#xInclusiveMax(max);
+    const minAny = isAny(minv);
+    const maxAny = isAny(maxv);
+    if (minAny && maxAny) this.tuples.push(this.#getComparatorAny());
+    else if (minAny) this.tuples.push(maxv);
+    else if (maxAny) this.tuples.push(minv);
+    else this.tuples.push(minv, maxv);
+  }
+  #parse(comp) {
+    const first = comp.charAt(0);
+    const first2 = comp.substring(0, 2);
+    const v1 = comp.substring(1);
+    const v2 = comp.substring(2);
+    switch (first2) {
+      case "~>":
+        assertVersion(v2, comp);
+        return this.#parseTilde(v2);
+      case ">=":
+        assertVersion(v2, comp);
+        return this.tuples.push(this.#xInclusiveMin(v2));
+      case "<=":
+        assertVersion(v2, comp);
+        return this.tuples.push(this.#xInclusiveMax(v2));
+    }
+    switch (first) {
+      case "~":
+        assertVersion(v1, comp);
+        return this.#parseTilde(v1);
+      case "^":
+        assertVersion(v1, comp);
+        return this.#parseCaret(v1);
+      case ">":
+        assertVersion(v1, comp);
+        return this.tuples.push(this.#xExclusiveMin(v1));
+      case "<":
+        assertVersion(v1, comp);
+        return this.tuples.push(this.#xExclusiveMax(v1));
+    }
+    return this.#parseEq(comp);
+  }
+  #parseTilde(comp) {
+    const parsed = this.#parseX(comp);
+    if (isXMajor(parsed)) {
+      this.tuples.push(this.#getComparatorAny());
+      return;
+    }
+    const z = this.includePrerelease ? "0" : void 0;
+    if (isXMinor(parsed)) {
+      const [M2] = parsed;
+      this.tuples.push(
+        [">=", new Version(comp, M2, 0, 0, z, void 0)],
+        ["<", new Version(comp, M2 + 1, 0, 0, "0", void 0)]
+      );
+      return;
+    }
+    if (isXPatch(parsed)) {
+      const [M2, m2] = parsed;
+      const z2 = this.includePrerelease ? "0" : void 0;
+      this.tuples.push(
+        [">=", new Version(comp, M2, m2, 0, z2, void 0)],
+        ["<", new Version(comp, M2, m2 + 1, 0, "0", void 0)]
+      );
+      return;
+    }
+    const [M, m, p, pr = z, build] = parsed;
+    this.tuples.push(
+      [">=", new Version(comp, M, m, p, pr, build)],
+      ["<", new Version(comp, M, m + 1, 0, "0", build)]
+    );
+  }
+  #parseCaret(comp) {
+    const min = this.#xInclusiveMin(comp);
+    if (isAny(min)) {
+      this.tuples.push(min);
+      return;
+    }
+    const minv = min[1];
+    if (minv.major !== 0) {
+      this.tuples.push(min, [
+        "<",
+        new Version(comp, minv.major + 1, 0, 0, "0", void 0)
+      ]);
+    } else if (minv.minor !== 0) {
+      this.tuples.push(min, [
+        "<",
+        new Version(
+          comp,
+          minv.major,
+          minv.minor + 1,
+          0,
+          "0",
+          void 0
+        )
+      ]);
+    } else if (!minv.prerelease?.length) {
+      this.tuples.push(["", minv]);
+    } else {
+      this.tuples.push(min, [
+        "<",
+        new Version(
+          comp,
+          minv.major,
+          minv.minor,
+          minv.patch + 1,
+          "0",
+          void 0
+        )
+      ]);
+    }
+  }
+  #parseEq(comp) {
+    const parsed = this.#parseX(comp);
+    const z = this.includePrerelease ? "0" : void 0;
+    if (isFullVersion(parsed)) {
+      this.tuples.push(["", new Version(comp, ...parsed)]);
+    } else if (isXMajor(parsed)) {
+      this.tuples.push(this.#getComparatorAny());
+    } else if (isXMinor(parsed)) {
+      this.tuples.push([
+        ">=",
+        new Version(comp, parsed[MAJOR], 0, 0, z, void 0)
+      ]);
+      this.tuples.push([
+        "<",
+        new Version(comp, parsed[MAJOR] + 1, 0, 0, "0", void 0)
+      ]);
+    } else if (isXPatch(parsed)) {
+      this.tuples.push(
+        [
+          ">=",
+          new Version(
+            comp,
+            parsed[MAJOR],
+            parsed[MINOR],
+            0,
+            z,
+            void 0
+          )
+        ],
+        [
+          "<",
+          new Version(
+            comp,
+            parsed[MAJOR],
+            parsed[MINOR] + 1,
+            0,
+            "0",
+            void 0
+          )
+        ]
+      );
+    }
+  }
+  /** return true if the version is a match for this comparator */
+  test(v) {
+    if (this.isNone) return false;
+    const ip = this.includePrerelease;
+    const hasPR = !!v.prerelease?.length;
+    let prOK = ip || !hasPR;
+    for (const c of this.tuples) {
+      if (isAny(c)) {
+        continue;
+      }
+      const [op, cv] = c;
+      prOK ||= !!cv.prerelease?.length && v.tupleEquals(cv);
+      switch (op) {
+        case "":
+          if (!v.equals(cv)) return false;
+          continue;
+        case ">":
+          if (!v.greaterThan(cv)) return false;
+          continue;
+        case ">=":
+          if (!v.greaterThanEqual(cv)) return false;
+          continue;
+        case "<":
+          if (!v.lessThan(cv)) return false;
+          continue;
+        case "<=":
+          if (!v.lessThanEqual(cv)) return false;
+          continue;
+      }
+    }
+    return prOK;
+  }
+  #getComparatorAny() {
+    return this.includePrerelease ? comparatorAnyPR : comparatorAny;
+  }
+};
+var isAny = (c) => c === comparatorAny || c === comparatorAnyPR;
+var comparatorAny = {
+  isAny: true,
+  toString: () => "*",
+  includePrerelease: false,
+  test: (v) => !v.prerelease?.length
+};
+var comparatorAnyPR = {
+  isAny: true,
+  toString: () => "*",
+  includePrerelease: true,
+  test: (_) => true
+};
+var comparatorNone = {
+  isNone: true,
+  toString: () => "<0.0.0-0",
+  includePrerelease: false,
+  test: (_) => false
+};
+
+// ../../src/types/src/index.ts
+var asError = (er, fallbackMessage = "Unknown error") => er instanceof Error ? er : new Error(String(er) || fallbackMessage);
+
+// ../../src/semver/src/range.ts
+var Range = class {
+  /** raw string used to create this Range */
+  raw;
+  /** true if the range is `*` */
+  isAny;
+  /** true if the range is a single semver version */
+  isSingle;
+  /** true if the range cannot match anything */
+  /**
+   * set of {@link Comparator} objects representing the `||`-separated sections
+   * of the range. If at least one of these matches, then the version is a
+   * match.
+   */
+  set = [];
+  /** true if all prerelease versions should be included */
+  includePrerelease;
+  /** cached toString */
+  #toString;
+  constructor(range, includePrerelease = false) {
+    this.raw = range;
+    this.includePrerelease = includePrerelease;
+    this.isAny = false;
+    let isFirst = true;
+    this.isSingle = false;
+    const comparatorErrors = [];
+    fastSplit(range, "||", -1, (part) => {
+      if (this.isAny) return;
+      const cmp = this.#maybeComparator(part, this.includePrerelease);
+      if (cmp instanceof Error) {
+        comparatorErrors.push(cmp);
+        return;
+      }
+      if (cmp.isAny) {
+        this.set = [cmp];
+        this.isAny = true;
+        return;
+      }
+      this.set.push(cmp);
+      if (!isFirst) this.isSingle = false;
+      else if (Array.isArray(cmp.tuples) && cmp.tuples.length === 1 && Array.isArray(cmp.tuples[0]) && cmp.tuples[0][0] === "") {
+        this.isSingle = true;
+      }
+      isFirst = false;
+    });
+    if (!this.set.length && comparatorErrors.length) {
+      if (comparatorErrors.length === 1 && comparatorErrors[0]) {
+        throw comparatorErrors[0];
+      }
+      throw new AggregateError(comparatorErrors);
+    }
+  }
+  #maybeComparator(part, includePrerelease) {
+    try {
+      return new Comparator(part, includePrerelease);
+    } catch (er) {
+      return asError(er);
+    }
+  }
+  /**
+   * test a {@link Version} against the range
+   */
+  test(v) {
+    return this.set.some((c) => c.test(v));
+  }
+  /** return the simplified canonical form of this range */
+  toString() {
+    if (this.#toString) return this.#toString;
+    if (this.isSingle) {
+      this.#toString = String(this.set[0]);
+      return this.#toString;
+    }
+    this.#toString = this.set.map((c) => String(c)).join(" || ");
+    return this.#toString;
+  }
+};
+
+// ../../src/semver/src/index.ts
+var parseRange = (range, includePrerelease = false) => {
+  if (typeof range === "object") {
+    if (range.includePrerelease === includePrerelease) return range;
+    range = range.raw;
+  }
+  try {
+    return new Range(range, includePrerelease);
+  } catch {
+    return void 0;
+  }
+};
+
+// ../../src/spec/src/browser.ts
+var kCustomInspect = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
+var defaultRegistry = "https://registry.npmjs.org/";
+var defaultRegistryName = "npm";
+var defaultRegistries = {
+  npm: defaultRegistry,
+  gh: "https://npm.pkg.github.com/"
+};
+var defaultJsrRegistries = { jsr: "https://npm.jsr.io/" };
+var defaultGitHosts = {
+  github: "git+ssh://git@github.com:$1/$2.git",
+  bitbucket: "git+ssh://git@bitbucket.org:$1/$2.git",
+  gitlab: "git+ssh://git@gitlab.com:$1/$2.git",
+  gist: "git+ssh://git@gist.github.com/$1.git"
+};
+var defaultGitHostArchives = {
+  github: "https://api.github.com/repos/$1/$2/tarball/$committish",
+  bitbucket: "https://bitbucket.org/$1/$2/get/$committish.tar.gz",
+  gist: "https://codeload.github.com/gist/$1/tar.gz/$committish",
+  gitlab: "https://gitlab.com/$1/$2/repository/archive.tar.gz?ref=$committish"
+};
+var gitHostWebsites = {
+  github: "https://github.com/",
+  bitbucket: "https://bitbucket.org/",
+  gist: "https://gist.github.com/",
+  gitlab: "https://gitlab.com/"
+};
+var getOptions = (options) => ({
+  catalog: {},
+  catalogs: {},
+  ...options,
+  "jsr-registries": {
+    ...options?.["jsr-registries"] ?? {},
+    ...defaultJsrRegistries
+  },
+  registry: options?.registry ?? defaultRegistry,
+  "scope-registries": options?.["scope-registries"] ?? {},
+  "git-hosts": options?.["git-hosts"] ? {
+    ...defaultGitHosts,
+    ...options["git-hosts"]
+  } : defaultGitHosts,
+  registries: {
+    ...options?.registries ?? {},
+    ...defaultRegistries
+  },
+  "git-host-archives": options?.["git-host-archives"] ? {
+    ...defaultGitHostArchives,
+    ...options["git-host-archives"]
+  } : defaultGitHostArchives
+});
+var startsWithSpecIdentifier = (spec, options) => spec.startsWith("/") || spec.startsWith("./") || spec.startsWith("../") || spec.startsWith("file:") || spec.startsWith("http:") || spec.startsWith("https:") || spec.startsWith("workspace:") || spec.startsWith("catalog:") || spec.startsWith("git@") || spec.startsWith("git://") || spec.startsWith("git+ssh://") || spec.startsWith("git+http://") || spec.startsWith("git+https://") || spec.startsWith("git+file://") || spec.startsWith("git@github.com") || spec.startsWith("registry:") || spec.startsWith("npm:") || spec.startsWith("jsr:") || spec.startsWith("gh:") || // anything that starts with a known git host key, or a
+// custom registered registry protocol e.g: `github:`, `custom:`
+[
+  ...Object.keys(options["git-hosts"]),
+  ...Object.keys(options.registries),
+  ...Object.keys(options["jsr-registries"])
+].some((key) => spec.startsWith(`${key}:`));
+var findFirstAt = (spec, hasScope) => spec.indexOf("@", hasScope ? 1 : 0);
+var findGitIdentifier = (spec) => spec.indexOf("#") > 2;
+var findFileIdentifier = (spec) => spec.includes("/");
+var Spec = class _Spec {
+  static parse(spec, bareOrOptions, options) {
+    return typeof spec === "object" ? spec : new this(spec, bareOrOptions, options);
+  }
+  static parseArgs(specOrBareSpec, opts) {
+    const options = getOptions(opts ?? {});
+    if (startsWithSpecIdentifier(specOrBareSpec, options)) {
+      const parsed = this.parse("(unknown)", specOrBareSpec, options);
+      if (parsed.subspec) {
+        const { namedJsrRegistry: jsrHost } = parsed;
+        if (!jsrHost) {
+          parsed.name = parsed.subspec.name;
+        }
+        parsed.spec = `${parsed.name}@${parsed.bareSpec}`;
+      }
+      return parsed;
+    } else {
+      const hasScope = specOrBareSpec.startsWith("@");
+      const at = findFirstAt(specOrBareSpec, hasScope);
+      if (at > -1) {
+        return this.parse(
+          specOrBareSpec.substring(0, at),
+          specOrBareSpec.substring(at + 1),
+          options
+        );
+      } else if (findGitIdentifier(specOrBareSpec) || !hasScope && findFileIdentifier(specOrBareSpec)) {
+        return this.parse("(unknown)", specOrBareSpec, options);
+      } else {
+        return this.parse(`${specOrBareSpec}@`, options);
+      }
+    }
+  }
+  static nodejsDependencies;
+  type;
+  spec;
+  options;
+  name;
+  scope;
+  scopeRegistry;
+  bareSpec;
+  gitRemote;
+  gitSelector;
+  gitSelectorParsed;
+  gitCommittish;
+  namedGitHost;
+  namedGitHostPath;
+  workspaceSpec;
+  workspace;
+  namedRegistry;
+  namedJsrRegistry;
+  registry;
+  registrySpec;
+  conventionalRegistryTarball;
+  semver;
+  range;
+  distTag;
+  remoteURL;
+  file;
+  catalog;
+  subspec;
+  overridden = false;
+  #final;
+  #toString;
+  /**
+   * Return the final entry in the chain of subspecs
+   * When deciding which thing to actually fetch, spec.final is the thing
+   * to look at.
+   */
+  get final() {
+    if (this.#final) return this.#final;
+    const final = this.subspec ? this.subspec.final : this;
+    if (final.type === "catalog") {
+      throw error('invalid Spec.final value, type is "catalog"');
+    }
+    return this.#final = final;
+  }
+  /**
+   * Normally, the string value of a Spec is just the string passed in to
+   * be parsed. However, in the case of a chain of subspecs, like
+   * `foo@npm:bar@npm:baz@npm:quux@latest`, this simplifies out the middle
+   * parts of the chain, returning just `foo@npm:quux@latest`
+   */
+  toString() {
+    if (this.#toString !== void 0) return this.#toString;
+    let sub = this;
+    while (sub.subspec?.subspec) sub = sub.subspec;
+    if (sub.subspec && sub.subspec.type !== "registry")
+      sub = sub.subspec;
+    return this.#toString = this.name + "@" + sub.bareSpec;
+  }
+  constructor(spec, bareOrOptions, options = {}) {
+    if (bareOrOptions && typeof bareOrOptions === "object") {
+      options = bareOrOptions;
+      bareOrOptions = void 0;
+    }
+    this.options = getOptions(options);
+    if (typeof bareOrOptions === "string") {
+      this.name = spec;
+      this.#parseScope(spec);
+      this.bareSpec = bareOrOptions;
+      this.spec = `${this.name}@${bareOrOptions}`;
+    } else {
+      this.spec = spec;
+      if (!spec.startsWith("git@") && startsWithSpecIdentifier(spec, this.options) && spec.includes(":") && [
+        ...Object.keys(this.options.registries),
+        ...Object.keys(defaultRegistries)
+      ].some((key) => spec.startsWith(`${key}:`))) {
+        this.name = spec;
+        this.bareSpec = spec;
+      } else {
+        const hasScope = spec.startsWith("@");
+        let at = findFirstAt(spec, hasScope);
+        if (at === -1) {
+          at = spec.length;
+          spec += "@";
+        }
+        this.name = spec.substring(0, at);
+        if (hasScope) this.#parseScope(this.name);
+        this.bareSpec = spec.substring(at + 1);
+      }
+    }
+    if (this.bareSpec.startsWith("catalog:")) {
+      this.catalog = this.bareSpec.substring("catalog:".length);
+      const catalog = this.catalog ? this.options.catalogs?.[this.catalog] : this.options.catalog;
+      if (!catalog) {
+        throw this.#error("Named catalog not found", {
+          name: this.catalog,
+          validOptions: this.options.catalogs && Object.keys(this.options.catalogs)
+        });
+      }
+      const sub = catalog[this.name];
+      if (!sub) {
+        throw this.#error("Name not found in catalog", {
+          name: this.name,
+          validOptions: Object.keys(catalog)
+        });
+      }
+      this.subspec = _Spec.parse(this.name, sub);
+      this.type = "catalog";
+      return;
+    }
+    if (this.bareSpec.startsWith("https://")) {
+      for (const [name, origin] of Object.entries(gitHostWebsites)) {
+        if (this.bareSpec.startsWith(origin)) {
+          const parsed = new URL(this.bareSpec);
+          const [user, project] = parsed.pathname.replace(/\.git$/, "").replace(/\/+/g, " ").trim().split(" ");
+          if (user && project) {
+            this.bareSpec = `${name}:${user}/${project}${parsed.hash}`;
+            this.spec = `${this.name}@${this.bareSpec}`;
+            break;
+          }
+        }
+      }
+    }
+    if (this.bareSpec.startsWith("workspace:")) {
+      this.type = "workspace";
+      const ws = this.bareSpec.substring("workspace:".length).trim();
+      const w = ws.lastIndexOf("@");
+      if (w === -1) {
+        this.workspace = this.name;
+      } else {
+        const wsName = ws.substring(0, w);
+        if (!wsName || wsName === "*" || wsName === "~" || wsName === "^" || (wsName.startsWith("@") ? wsName.split("/").length !== 2 || wsName.substring(1).includes("@") : wsName.includes("@"))) {
+          throw this.#error(
+            "workspace: name must be a path or valid package name",
+            { found: wsName }
+          );
+        }
+        this.workspace = wsName;
+      }
+      const wss = w === -1 ? ws : ws.substring(w + 1) || "*";
+      const range2 = wss === "*" ? void 0 : parseRange(wss);
+      if (wss !== "*" && wss !== "~" && wss !== "^" && !range2) {
+        throw this.#error(
+          "workspace: spec must be one of *, ~, or ^, or a valid semver range",
+          {
+            found: wss,
+            wanted: `'*'|'~'|'^'|SemverRange`
+          }
+        );
+      }
+      this.workspaceSpec = wss;
+      if (range2) {
+        this.semver = wss;
+        this.range = range2;
+      }
+      return;
+    }
+    if (this.bareSpec.startsWith("git://") || this.bareSpec.startsWith("git+ssh://") || this.bareSpec.startsWith("git+http://") || this.bareSpec.startsWith("git+https://") || this.bareSpec.startsWith("git+file://") || // legacy affordance
+    this.bareSpec.startsWith("git@github.com")) {
+      if (this.bareSpec.startsWith("git@")) {
+        this.bareSpec = `git+ssh://${this.bareSpec}`;
+        this.spec = `${this.name}@${this.bareSpec}`;
+      }
+      this.type = "git";
+      for (const [name, host] of Object.entries(
+        this.options["git-hosts"]
+      )) {
+        const s = host.indexOf("$");
+        if (s > 0 && this.bareSpec.startsWith(host.substring(0, s))) {
+          const p = this.bareSpec.substring(s).replace(/\.git(#.*)?$/, "$1");
+          this.bareSpec = `${name}:${p}`;
+          this.spec = `${this.name}@${this.bareSpec}`;
+          this.#parseHostedGit(name, host);
+          this.type = "git";
+          return;
+        }
+      }
+      this.#parseGitSelector(this.bareSpec);
+      return;
+    }
+    const regs = Object.entries(this.options.registries);
+    if (this.bareSpec.startsWith("registry:")) {
+      const reg = this.bareSpec.substring("registry:".length);
+      const h = reg.indexOf("#");
+      if (h === -1) {
+        throw this.#error("registry: must include name/version");
+      }
+      this.type = "registry";
+      let url = reg.substring(0, h);
+      if (!url.endsWith("/")) url += "/";
+      const regSpec = reg.substring(h + 1);
+      for (let [name, u] of regs) {
+        if (!u.endsWith("/")) {
+          u += "/";
+          this.options.registries[name] = u;
+        }
+        if (u === url) this.namedRegistry = name;
+      }
+      this.#parseRegistrySpec(regSpec, url);
+      this.#guessRegistryTarball();
+      return;
+    }
+    for (const [host, url] of regs) {
+      const h = `${host}:`;
+      if (this.bareSpec.startsWith(h)) {
+        this.type = "registry";
+        this.namedRegistry = host;
+        this.#parseRegistrySpec(
+          this.bareSpec.substring(h.length),
+          url
+        ).namedRegistry ??= host;
+        if (this.subspec && this.name === this.bareSpec) {
+          this.name = this.subspec.name;
+          this.spec = `${this.name}@${this.bareSpec}`;
+        }
+        this.#guessRegistryTarball();
+        return;
+      }
+    }
+    const ghosts = Object.entries(this.options["git-hosts"]);
+    for (const [name, template] of ghosts) {
+      if (this.#parseHostedGit(name, template)) {
+        this.type = "git";
+        return;
+      }
+    }
+    const jsrs = Object.entries(this.options["jsr-registries"]);
+    for (const [host, url] of jsrs) {
+      const h = `${host}:`;
+      if (this.bareSpec.startsWith(h)) {
+        this.type = "registry";
+        this.namedJsrRegistry = host;
+        this.#parseJsrRegistrySpec(
+          this.bareSpec.substring(h.length),
+          url
+        ).namedJsrRegistry ??= host;
+        return;
+      }
+    }
+    if (this.bareSpec.startsWith("https://") || this.bareSpec.startsWith("http://")) {
+      this.remoteURL = this.bareSpec;
+      this.type = "remote";
+      return;
+    }
+    if (this.bareSpec.startsWith("file:")) {
+      this.type = "file";
+      const [path, uri] = getNormalizeFile(
+        this.constructor.nodejsDependencies
+      )(this.bareSpec, this);
+      this.file = path;
+      this.bareSpec = uri.replace(/\/+$/, "");
+      this.spec = `${this.name}@${this.bareSpec}`;
+      return;
+    }
+    if (!this.bareSpec.startsWith("./") && !this.bareSpec.startsWith("../") && this.options["git-hosts"].github) {
+      const hash = this.bareSpec.indexOf("#");
+      const up = hash === -1 ? this.bareSpec : this.bareSpec.substring(0, hash);
+      if (up.split("/").length === 2) {
+        this.bareSpec = `github:${this.bareSpec}`;
+        this.spec = `${this.name}@${this.bareSpec}`;
+        this.#parseHostedGit(
+          "github",
+          this.options["git-hosts"].github
+        );
+        this.type = "git";
+        return;
+      }
+    }
+    if (this.bareSpec.includes("/") || this.bareSpec === "." || this.bareSpec === "..") {
+      this.type = "file";
+      const [file, uri] = getNormalizeFile(
+        this.constructor.nodejsDependencies
+      )(`file:${this.bareSpec}`, this);
+      this.bareSpec = uri;
+      this.spec = `${this.name}@${this.bareSpec}`;
+      this.file = file;
+      return;
+    }
+    this.type = "registry";
+    const range = parseRange(this.bareSpec);
+    if (range) {
+      this.semver = this.bareSpec.trim();
+      this.range = range;
+    } else {
+      this.distTag = this.bareSpec;
+    }
+    this.registrySpec = this.bareSpec;
+    const { "scope-registries": scopeRegs, registry } = this.options;
+    const scopeReg = this.scope && scopeRegs[this.scope];
+    this.registry = scopeReg ?? registry;
+    for (const r of Object.values(this.options["jsr-registries"])) {
+      if (this.registry === r) return;
+    }
+    this.#guessRegistryTarball();
+  }
+  #parseScope(name) {
+    if (!name.startsWith("@")) return;
+    const s = name.indexOf("/");
+    if (s > 1 && s < name.length - 1) {
+      const scope = name.substring(0, s);
+      this.registry = this.scopeRegistry = this.options["scope-registries"][scope];
+      this.scope = scope;
+    }
+  }
+  #parseHostedGit(name, template) {
+    if (this.bareSpec.startsWith(`${name}:`)) {
+      const h = this.bareSpec.indexOf("#");
+      const bare = h === -1 ? this.bareSpec : this.bareSpec.substring(0, h);
+      const hash = h === -1 ? "" : this.bareSpec.substring(h);
+      const hostPath = bare.substring(name.length + 1);
+      if (!hostPath) {
+        throw this.#error("invalid named git host specifier");
+      }
+      const split = hostPath.split("/");
+      let t = template;
+      for (let i = 0; i < split.length; i++) {
+        t = t.split(`$${i + 1}`).join(split[i]);
+      }
+      t += hash;
+      this.namedGitHost = name;
+      this.namedGitHostPath = hostPath;
+      this.#parseGitSelector(t);
+      if (this.gitCommittish && !this.gitSelectorParsed?.path) {
+        const archiveHost = this.options["git-host-archives"][name];
+        if (name === "github" && this.gitCommittish.startsWith("pull/") && this.gitCommittish.match(/\//g)?.length === 1) {
+          this.gitCommittish += "/head";
+        }
+        if (archiveHost) {
+          this.type = "remote";
+          let t2 = archiveHost;
+          t2 = t2.split("$committish").join(this.gitCommittish);
+          for (let i = 0; i < split.length; i++) {
+            t2 = t2.split(`$${i + 1}`).join(split[i]);
+          }
+          this.remoteURL = t2;
+        }
+      }
+      return true;
+    }
+    return false;
+  }
+  /* c8 ignore start */
+  [kCustomInspect]() {
+    return `@vltpkg/spec.Spec ${String(this)}`;
+  }
+  /* c8 ignore stop */
+  #guessRegistryTarball() {
+    const { name, registry, range } = this.final;
+    if (!registry || !range?.isSingle) return;
+    const stripScope = /^@[^/]+\//;
+    this.conventionalRegistryTarball = String(
+      new URL(
+        `/${name}/-/${name.replace(stripScope, "")}-${range}.tgz`,
+        registry
+      )
+    );
+  }
+  #parseRegistrySpec(s, url) {
+    this.registry = url;
+    this.subspec = this.constructor.parse(s, {
+      ...this.options,
+      registry: url
+    });
+    return this.subspec;
+  }
+  #parseJsrRegistrySpec(s, url) {
+    this.registry = url;
+    if (!s.startsWith("@")) s = `${this.name}@${s}`;
+    const name = s.startsWith("@jsr/") ? s : `@jsr/${s.replace(/^@/, "").replace(/\//, "__")}`;
+    this.subspec = this.constructor.parse(name, {
+      ...this.options,
+      "scope-registries": {
+        ...this.options["scope-registries"],
+        "@jsr": url
+      }
+    });
+    if (this.name === "(unknown)") {
+      const nextAt = s.indexOf("@", 1);
+      if (nextAt === -1) {
+        this.name = s;
+      } else {
+        this.name = s.substring(0, s.indexOf("@", 1));
+      }
+    }
+    const reg = `${this.namedJsrRegistry}:`;
+    const n = `${reg}${this.name}`;
+    if (this.bareSpec.startsWith(n + "@")) {
+      this.bareSpec = reg + this.bareSpec.substring(n.length + 1);
+    } else if (this.bareSpec === n) {
+      this.bareSpec = reg;
+    }
+    this.spec = this.name + "@" + this.bareSpec;
+    return this.subspec;
+  }
+  #error(message, extra = {}) {
+    return error(message, { spec: this.spec, ...extra }, this.#error);
+  }
+  #parseGitSelector(s) {
+    const h = s.indexOf("#");
+    if (h === -1) {
+      this.gitRemote = s;
+      return;
+    }
+    this.gitRemote = s.substring(0, h);
+    this.gitSelector = s.substring(h + 1);
+    const [selectorParsed, committish, range] = this.constructor.parseGitSelector(this.gitSelector, this);
+    this.range = range;
+    this.gitCommittish = committish;
+    this.gitSelectorParsed = selectorParsed;
+  }
+  /**
+   * Should only ever be called with the bit that comes AFTER the #
+   * in the git remote url.
+   */
+  static parseGitSelector(selector, spec) {
+    if (!selector) return [{}];
+    const split = selector.split("::");
+    const first = split[0];
+    let committish = void 0;
+    let range = void 0;
+    const parsed = {};
+    if (typeof first !== "string") {
+      throw typeError("impossible", {
+        found: first,
+        wanted: String
+      });
+    }
+    if (!first.includes(":")) {
+      committish = first;
+      split.shift();
+    }
+    for (const kv of split) {
+      const c = kv.indexOf(":");
+      if (c === -1) continue;
+      const k = kv.substring(0, c);
+      const v = kv.substring(c + 1);
+      if (k === "semver") {
+        if (committish) {
+          throw error(
+            "Cannot specify a semver range and committish value",
+            { spec }
+          );
+        }
+        range = parseRange(v);
+        if (!range) {
+          throw error(`Invalid git tag semver range: ${v}`, { spec });
+        }
+      }
+      if (k === "semver" || k === "path") {
+        if (k === "path") {
+          if (
+            /* c8 ignore next */
+            this.nodejsDependencies?.isAbsolute(
+              v
+            ) || /(^|\/|\\)\.\.($|\\|\/)/.test(v)
+          ) {
+            throw error("Invalid path in git selector", { spec });
+          }
+          parsed.path = (this.nodejsDependencies ? this.nodejsDependencies.join("/", v).substring(1) : v).replace(/\\/g, "/");
+        } else {
+          parsed[k] = v;
+        }
+      }
+    }
+    return [parsed, committish, range];
+  }
+};
+var getNormalizeFile = (opts) => (bareSpec, spec) => {
+  const slashes = bareSpec.substring(
+    "file:".length,
+    "file://".length
+  );
+  const pref = `file:${slashes === "//" ? slashes : ""}`;
+  const rest = bareSpec.substring(pref.length);
+  const [a = "", b = "/", c = "/", d = "/"] = rest.split("", 4);
+  if (!a) {
+    return [".", "file:."];
+  }
+  if (a === "/" && b === "~" && c !== "/" || a === "~" && b !== "/") {
+    throw error(
+      `invalid file: specifier. '~username' not supported`,
+      { spec }
+    );
+  }
+  if (a === "~") {
+    return (
+      /* c8 ignore start */
+      opts ? [
+        opts.resolve(opts.homedir(), rest.substring(2)),
+        `file:${rest}`
+      ] : [rest, `file:${rest}`]
+    );
+  }
+  if (a === "/" && b === "~") {
+    return opts ? [
+      opts.resolve(opts.homedir(), rest.substring(3)),
+      `file:${rest.substring(1)}`
+    ] : (
+      /* c8 ignore stop */
+      [rest.substring(1), `file:${rest.substring(1)}`]
+    );
+  }
+  if (a === "/" && b === "." && (c === "/" || c === "." && d === "/")) {
+    return [rest.substring(1), `file:${rest.substring(1)}`];
+  }
+  if (a === "." && (b === "/" || b === "." && c === "/")) {
+    return [rest, `file:${rest}`];
+  }
+  if (slashes === "//") {
+    try {
+      const parsed = new URL(bareSpec);
+      if (parsed.host) {
+        if (parsed.host !== "localhost") {
+          throw error(
+            `invalid file:// specifier. host must be empty or 'localhost'`,
+            {
+              spec,
+              found: parsed.host,
+              validOptions: ["", "localhost"]
+            }
+          );
+        }
+      }
+      return [
+        parsed.pathname.replace(/^\/([a-zA-Z]:\/)/, "$1"),
+        `file://${parsed.pathname}`
+      ];
+    } catch (er) {
+      throw error("invalid file:// specifier", {
+        spec,
+        cause: er
+      });
+    }
+  }
+  if (opts?.winPath.isAbsolute(rest)) {
+    return [rest, `file://${rest}`];
+  }
+  return [`./${rest}`, `file:./${rest}`];
+};
+
+// ../../src/spec/src/index.ts
+var Spec2 = class extends Spec {
+  [kCustomInspect](_depth, options) {
+    const str = inspect(
+      Object.fromEntries(
+        Object.entries(this).filter(([k, v]) => {
+          return k !== "options" && v !== void 0;
+        })
+      ),
+      options
+    );
+    return `@vltpkg/spec.Spec ${str}`;
+  }
+};
+Spec2.nodejsDependencies = {
+  homedir,
+  isAbsolute,
+  join,
+  resolve,
+  winPath
+};
+
+// ../../src/dep-id/src/browser.ts
+var delimiter = "~";
+var depIDRegExp = new RegExp(
+  `^((git)?${delimiter}[^${delimiter}]*${delimiter}[^${delimiter}]*(${delimiter}[^${delimiter}]*)?$|^(file|remote|workspace)${delimiter}[^${delimiter}]*)(${delimiter}[^${delimiter}]*)?$`
+);
+var isDepID = (str) => typeof str === "string" && depIDRegExp.test(str);
+var asDepID = (str) => {
+  if (!isDepID(str)) {
+    throw error("Expected dep id", {
+      found: str
+    });
+  }
+  return str;
+};
+var joinDepIDTuple = (list) => {
+  const [type, first, second, extra] = list;
+  const f = encode(first);
+  switch (type) {
+    case "registry":
+      return `${delimiter}${f || defaultRegistryName}${delimiter}${encode(second)}${extra ? `${delimiter}${encode(extra)}` : ""}`;
+    case "git":
+      return `${type}${delimiter}${f}${delimiter}${encode(second)}${extra ? `${delimiter}${encode(extra)}` : ""}`;
+    default:
+      return `${type}${delimiter}${f}${second ? `${delimiter}${encode(second)}` : ""}`;
+  }
+};
+var ESCAPE = {
+  _: "__",
+  "+": "_p",
+  "\\": "_b",
+  ":": "_c",
+  "~": "_t",
+  "<": "_l",
+  ">": "_g",
+  '"': "_q",
+  "|": "_i",
+  "?": "_m",
+  "*": "_a",
+  " ": "_s"
+};
+var UNESCAPE = {
+  __: "_",
+  _p: "+",
+  _b: "\\",
+  _c: ":",
+  _t: "~",
+  _l: "<",
+  _g: ">",
+  _q: '"',
+  _i: "|",
+  _m: "?",
+  _a: "*",
+  _d: ".",
+  _s: " "
+};
+var isControl = (code) => code >= 0 && code <= 31;
+var toHex2Upper = (code) => code.toString(16).toUpperCase().padStart(2, "0");
+var isHexDigit = (c) => c >= "0" && c <= "9" || c >= "A" && c <= "F" || c >= "a" && c <= "f";
+var encode = (s) => {
+  if (!s) return s;
+  let out = "";
+  for (const ch of s) {
+    if (!ch) continue;
+    if (ch === "/") {
+      out += "+";
+      continue;
+    }
+    const mapped = ESCAPE[ch];
+    if (mapped) {
+      out += mapped;
+      continue;
+    }
+    const code = ch.charCodeAt(0);
+    if (isControl(code)) {
+      out += "_" + toHex2Upper(code);
+      continue;
+    }
+    out += ch;
+  }
+  if (out.endsWith(".")) out = out.slice(0, -1) + "_d";
+  return out;
+};
+var decode = (s) => {
+  if (!s) return s;
+  let out = "";
+  for (let i = 0; i < s.length; i++) {
+    const ch = s[i];
+    if (!ch) continue;
+    if (ch === "+") {
+      out += "/";
+      continue;
+    }
+    if (ch !== "_") {
+      out += ch;
+      continue;
+    }
+    const next = s[i + 1];
+    if (next === void 0) {
+      out += "_";
+      continue;
+    }
+    if (next === "_") {
+      out += "_";
+      i += 1;
+      continue;
+    }
+    const two = s.slice(i, i + 2);
+    const mapped = UNESCAPE[two];
+    if (mapped) {
+      out += mapped;
+      i += 1;
+      continue;
+    }
+    const h1 = s[i + 1];
+    const h2 = s[i + 2];
+    if ((h1 === "0" || h1 === "1") && h2 !== void 0 && isHexDigit(h2)) {
+      const hex = s.slice(i + 1, i + 3);
+      out += String.fromCharCode(parseInt(hex, 16));
+      i += 2;
+      continue;
+    }
+    out += "_";
+  }
+  return out;
+};
+var seenSplitDepIDs = /* @__PURE__ */ new Map();
+var splitDepID = (id) => {
+  const seen = seenSplitDepIDs.get(id);
+  if (seen) return seen;
+  let res;
+  const [type, first = "", second, extra] = id.split(delimiter, 4);
+  const f = decode(first) || "";
+  switch (type) {
+    case "git":
+    case "": {
+      if (second === void 0) {
+        throw error(`invalid ${type} id`, { found: id });
+      }
+      const decodedSecond = decode(second) || "";
+      res = [
+        type || "registry",
+        f || defaultRegistryName,
+        decodedSecond,
+        decode(extra)
+      ];
+      break;
+    }
+    case "file":
+    case "remote":
+    case "workspace": {
+      res = [type, f, decode(second)];
+      break;
+    }
+    default: {
+      throw error("invalid DepID type", {
+        found: type,
+        validOptions: ["git", "file", "workspace", "remote", ""]
+      });
+    }
+  }
+  seenSplitDepIDs.set(id, res);
+  return res;
+};
+var baseDepID = (id) => {
+  const [type, first, second] = splitDepID(id);
+  switch (type) {
+    case "git":
+    case "registry":
+      return joinDepIDTuple([type, first, second]);
+    default:
+      return joinDepIDTuple([type, first]);
+  }
+};
+
+// ../../node_modules/.vlt/~npm~package-json-from-dist@1.0.1/node_modules/package-json-from-dist/dist/esm/index.js
+import { readFileSync } from "node:fs";
+import { dirname, resolve as resolve2, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+var NM = `${sep}node_modules${sep}`;
+var STORE = `.store${sep}`;
+var PKG = `${sep}package${sep}`;
+var DIST = `${sep}dist${sep}`;
+var findPackageJson = (from, pathFromSrc = "../package.json") => {
+  const f = typeof from === "object" || from.startsWith("file://") ? fileURLToPath(from) : from;
+  const __dirname = dirname(f);
+  const nms = __dirname.lastIndexOf(NM);
+  if (nms !== -1) {
+    const nm = __dirname.substring(0, nms + NM.length);
+    const pkgDir = __dirname.substring(nms + NM.length);
+    if (pkgDir.startsWith(STORE)) {
+      const pkg = pkgDir.indexOf(PKG, STORE.length);
+      if (pkg) {
+        return resolve2(nm, pkgDir.substring(0, pkg + PKG.length), "package.json");
+      }
+    }
+    const pkgName = pkgDir.startsWith("@") ? pkgDir.split(sep, 2).join(sep) : String(pkgDir.split(sep)[0]);
+    return resolve2(nm, pkgName, "package.json");
+  } else {
+    const d = __dirname.lastIndexOf(DIST);
+    if (d !== -1) {
+      return resolve2(__dirname.substring(0, d), "package.json");
+    } else {
+      return resolve2(__dirname, pathFromSrc);
+    }
+  }
+};
+var loadPackageJson = (from, pathFromSrc = "../package.json") => JSON.parse(readFileSync(findPackageJson(from, pathFromSrc), "utf8"));
+
+// ../../src/security-archive/src/types.ts
+var isPackageReportData = (o) => typeof o === "object" && o != null && "id" in o && "type" in o && "name" in o && "version" in o && "alerts" in o && "score" in o && o.type === "npm";
+var asPackageReportData = (o) => {
+  if (!isPackageReportData(o)) {
+    throw error("Invalid package report data", { found: o });
+  }
+  return o;
+};
+
+// ../../src/security-archive/src/update-expired.ts
+var __CODE_SPLIT_SCRIPT_NAME = import.meta.filename;
+var SOCKET_API_V0_URL = "https://api.socket.dev/v0/purl?alerts=true";
+var SOCKET_PUBLIC_API_TOKEN = "sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api";
+var { version } = loadPackageJson(
+  import.meta.filename,
+  "cli-package.json"
+);
+var isMain = (path) => path === __CODE_SPLIT_SCRIPT_NAME || path === pathToFileURL(__CODE_SPLIT_SCRIPT_NAME).toString();
+var retrieveRemoteData = async (queue, retries) => {
+  return pRetry(
+    async () => {
+      const req = await fetch(SOCKET_API_V0_URL, {
+        method: "POST",
+        headers: {
+          Authorization: `Basic ${Buffer.from(`${SOCKET_PUBLIC_API_TOKEN}:`).toString("base64url")}`,
+          "User-Agent": `@vltpkg/security-archive/${version}`
+        },
+        body: JSON.stringify({
+          components: Array.from(queue)
+        })
+      });
+      if (req.status === 404) {
+        throw new AbortError("Missing API");
+      }
+      if (!req.ok || !(req.status >= 200 && req.status <= 299)) {
+        throw error("Failed to fetch security data", {
+          response: req
+        });
+      }
+      const str = await req.text();
+      return str.trim() + "\n";
+    },
+    { retries }
+  );
+};
+var main = async (input = process.stdin) => {
+  const payload = await new Promise(
+    (resolve3, reject) => {
+      const chunks = [];
+      let chunkLen = 0;
+      input.on("data", (chunk) => {
+        chunks.push(chunk);
+        chunkLen += chunk.length;
+      });
+      input.on("end", () => {
+        try {
+          const raw = Buffer.concat(chunks, chunkLen).toString();
+          resolve3(JSON.parse(raw));
+        } catch (err) {
+          reject(err);
+        }
+      });
+      input.on("error", reject);
+    }
+  );
+  const { dbPath, retries, ttl, expired } = payload;
+  if (!expired.length) {
+    return false;
+  }
+  const expiredQueue = /* @__PURE__ */ new Set();
+  const entryByNameVersion = /* @__PURE__ */ new Map();
+  for (const entry of expired) {
+    const purl = `pkg:npm/${entry.name}@${entry.version}`;
+    expiredQueue.add({ purl });
+    entryByNameVersion.set(`${entry.name}@${entry.version}`, entry);
+  }
+  const res = await retrieveRemoteData(expiredQueue, retries);
+  const now = Date.now();
+  const results = [];
+  const json = res.split("}\n");
+  for (const line of json) {
+    if (!line.trim()) continue;
+    const data = JSON.parse(line + "}");
+    const scope = data.namespace ? `${data.namespace}/` : "";
+    const name = `${scope}${data.name}`;
+    const key = `${name}@${data.version}`;
+    const entry = entryByNameVersion.get(key);
+    if (!entry) {
+      console.warn(
+        `security-archive: failed to find entry for ${key} found in the response.`
+      );
+      continue;
+    }
+    const scoreComponents = [
+      data.score.license,
+      data.score.maintenance,
+      data.score.quality,
+      data.score.supplyChain,
+      data.score.vulnerability
+    ];
+    const newAverageScore = Number(
+      (scoreComponents.reduce((sum, score) => sum + score, 0) / scoreComponents.length).toFixed(2)
+    );
+    const reportData = asPackageReportData({
+      ...data,
+      score: { ...data.score, overall: newAverageScore }
+    });
+    results.push({
+      depID: baseDepID(asDepID(entry.depID)),
+      report: JSON.stringify(reportData),
+      start: now,
+      ttl
+    });
+  }
+  if (!results.length) {
+    return false;
+  }
+  mkdirSync(dirname2(dbPath), { recursive: true });
+  const db = new DatabaseSync(dbPath);
+  db.exec(
+    "CREATE TABLE IF NOT EXISTS cache (depID TEXT PRIMARY KEY, report TEXT, ttl INTEGER, start INTEGER) WITHOUT ROWID"
+  );
+  db.exec("PRAGMA journal_mode = WAL");
+  db.exec("PRAGMA synchronous = NORMAL");
+  const dbWrite = db.prepare(
+    "INSERT OR REPLACE INTO cache (depID, report, start, ttl) VALUES (?, ?, ?, ?)"
+  );
+  for (const { depID, report, start, ttl: entryTtl } of results) {
+    dbWrite.run(depID, report, start, entryTtl);
+  }
+  db.exec("PRAGMA optimize");
+  db.close();
+  return true;
+};
+if (isMain(process.argv[1])) {
+  process.title = "vlt-security-archive-update";
+  const res = await main(process.stdin);
+  if (!res) {
+    process.exit(1);
+  }
+}
+export {
+  __CODE_SPLIT_SCRIPT_NAME,
+  main,
+  version
+};