@vltpkg/cli-js 1.0.1 → 1.0.2

package/{chunk-2PLIV3N3.js → chunk-Q46JRSZU.js}

@@ -920,7 +920,685 @@ var comparatorNone = {
   test: (_) => false
 };
 
+// ../../src/spec/src/valid-name.ts
+var pathSafeName = /^(?!(?:node_modules|\.vlt)$)(?![A-Za-z]:)(?:@(?!\.\.?\/)[^/\\\x00-\x1f\x7f]+\/)?(?!\.\.?$)[^/\\\x00-\x1f\x7f]+$/i;
+var isPathSafeName = (name) => typeof name === "string" && pathSafeName.test(name);
+var assertPathSafeName = (name, from) => {
+  if (isPathSafeName(name)) return;
+  throw error(
+    "Invalid package name: not usable as a path segment",
+    {
+      code: "EINVALIDNAME",
+      found: name,
+      from,
+      wanted: "a single path segment, or a well-formed @scope/name"
+    },
+    assertPathSafeName
+  );
+};
+
+// ../../src/spec/src/browser.ts
+var kCustomInspect = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
+var defaultRegistryName = "npm";
+var defaultRegistries = {
+  gh: "https://npm.pkg.github.com/"
+};
+var defaultJsrRegistries = { jsr: "https://npm.jsr.io/" };
+var defaultGitHosts = {
+  github: "git+ssh://git@github.com:$1/$2.git",
+  bitbucket: "git+ssh://git@bitbucket.org:$1/$2.git",
+  gitlab: "git+ssh://git@gitlab.com:$1/$2.git",
+  gist: "git+ssh://git@gist.github.com/$1.git"
+};
+var defaultGitHostArchives = {
+  github: "https://api.github.com/repos/$1/$2/tarball/$committish",
+  bitbucket: "https://bitbucket.org/$1/$2/get/$committish.tar.gz",
+  gist: "https://codeload.github.com/gist/$1/tar.gz/$committish",
+  gitlab: "https://gitlab.com/$1/$2/repository/archive.tar.gz?ref=$committish"
+};
+var gitHostWebsites = {
+  github: "https://github.com/",
+  bitbucket: "https://bitbucket.org/",
+  gist: "https://gist.github.com/",
+  gitlab: "https://gitlab.com/"
+};
+var defaultScopeRegistries = {
+  "@jsr": "https://npm.jsr.io/"
+};
+var getOptions = (options) => ({
+  catalog: {},
+  catalogs: {},
+  ...options,
+  // built-in aliases are user/service-overridable: user config wins
+  "jsr-registries": {
+    ...defaultJsrRegistries,
+    ...options?.["jsr-registries"] ?? {}
+  },
+  registry: options?.registry,
+  "default-registry-alias": options?.["default-registry-alias"] ?? defaultRegistryName,
+  "scoped-registries": options?.["scoped-registries"] ?? {},
+  "git-hosts": options?.["git-hosts"] ? {
+    ...defaultGitHosts,
+    ...options["git-hosts"]
+  } : defaultGitHosts,
+  registries: {
+    ...defaultRegistries,
+    ...options?.registries ?? {}
+  },
+  "git-host-archives": options?.["git-host-archives"] ? {
+    ...defaultGitHostArchives,
+    ...options["git-host-archives"]
+  } : defaultGitHostArchives
+});
+var startsWithSpecIdentifier = (spec, options) => spec.startsWith("/") || spec.startsWith("./") || spec.startsWith("../") || spec.startsWith("file:") || spec.startsWith("http:") || spec.startsWith("https:") || spec.startsWith("workspace:") || spec.startsWith("catalog:") || spec.startsWith("git@") || spec.startsWith("git://") || spec.startsWith("git+ssh://") || spec.startsWith("git+http://") || spec.startsWith("git+https://") || spec.startsWith("git+file://") || spec.startsWith("git@github.com") || spec.startsWith("registry:") || spec.startsWith("npm:") || spec.startsWith("jsr:") || spec.startsWith("gh:") || // anything that starts with a known git host key, or a
+// custom registered registry protocol e.g: `github:`, `custom:`
+[
+  ...Object.keys(options["git-hosts"]),
+  ...Object.keys(options.registries),
+  ...Object.keys(options["jsr-registries"])
+].some((key) => spec.startsWith(`${key}:`));
+var findFirstAt = (spec, hasScope) => spec.indexOf("@", hasScope ? 1 : 0);
+var findGitIdentifier = (spec) => spec.indexOf("#") > 2;
+var findFileIdentifier = (spec) => spec.includes("/");
+var isSpec = (spec) => typeof spec === "object" && spec !== null && "spec" in spec && "bareSpec" in spec && "name" in spec && "type" in spec && "options" in spec && typeof spec.spec === "string" && typeof spec.bareSpec === "string" && typeof spec.name === "string";
+var currentDefaultRegistryName = (registry, options) => {
+  for (const [name, url] of Object.entries(
+    options.registries ?? {}
+  )) {
+    const specRegURL = registry.endsWith("/") ? registry : registry + "/";
+    const knownRegURL = url.endsWith("/") ? url : url + "/";
+    if (specRegURL === knownRegURL) {
+      return name;
+    }
+  }
+};
+var Spec = class _Spec {
+  static parse(spec, bareOrOptions, options) {
+    return typeof spec === "object" ? spec : new this(spec, bareOrOptions, options);
+  }
+  static parseArgs(specOrBareSpec, opts) {
+    const options = getOptions(opts ?? {});
+    if (startsWithSpecIdentifier(specOrBareSpec, options)) {
+      const parsed = this.parse("(unknown)", specOrBareSpec, options);
+      if (parsed.subspec) {
+        const { namedJsrRegistry: jsrHost } = parsed;
+        if (!jsrHost) {
+          parsed.name = parsed.subspec.name;
+        }
+        parsed.spec = `${parsed.name}@${parsed.bareSpec}`;
+        assertPathSafeName(parsed.name, parsed.spec);
+      }
+      return parsed;
+    } else {
+      const hasScope = specOrBareSpec.startsWith("@");
+      const at = findFirstAt(specOrBareSpec, hasScope);
+      if (at > -1) {
+        return this.parse(
+          specOrBareSpec.substring(0, at),
+          specOrBareSpec.substring(at + 1),
+          options
+        );
+      } else if (findGitIdentifier(specOrBareSpec) || !hasScope && findFileIdentifier(specOrBareSpec)) {
+        return this.parse("(unknown)", specOrBareSpec, options);
+      } else {
+        return this.parse(`${specOrBareSpec}@`, options);
+      }
+    }
+  }
+  static nodejsDependencies;
+  type;
+  spec;
+  options;
+  name;
+  scope;
+  scopeRegistry;
+  bareSpec;
+  gitRemote;
+  gitSelector;
+  gitSelectorParsed;
+  gitCommittish;
+  namedGitHost;
+  namedGitHostPath;
+  workspaceSpec;
+  workspace;
+  namedRegistry;
+  namedJsrRegistry;
+  registry;
+  registrySpec;
+  conventionalRegistryTarball;
+  semver;
+  range;
+  distTag;
+  remoteURL;
+  file;
+  catalog;
+  subspec;
+  overridden = false;
+  #final;
+  #toString;
+  /**
+   * Return the final entry in the chain of subspecs
+   * When deciding which thing to actually fetch, spec.final is the thing
+   * to look at.
+   */
+  get final() {
+    if (this.#final) return this.#final;
+    const final = this.subspec ? this.subspec.final : this;
+    if (final.type === "catalog") {
+      throw error('invalid Spec.final value, type is "catalog"');
+    }
+    return this.#final = final;
+  }
+  /**
+   * Normally, the string value of a Spec is just the string passed in to
+   * be parsed. However, in the case of a chain of subspecs, like
+   * `foo@npm:bar@npm:baz@npm:quux@latest`, this simplifies out the middle
+   * parts of the chain, returning just `foo@npm:quux@latest`
+   */
+  toString() {
+    if (this.#toString !== void 0) return this.#toString;
+    let sub = this;
+    while (sub.subspec?.subspec) sub = sub.subspec;
+    if (sub.subspec && sub.subspec.type !== "registry")
+      sub = sub.subspec;
+    return this.#toString = this.name + "@" + sub.bareSpec;
+  }
+  constructor(spec, bareOrOptions, options = {}) {
+    if (bareOrOptions && typeof bareOrOptions === "object") {
+      options = bareOrOptions;
+      bareOrOptions = void 0;
+    }
+    this.options = getOptions(options);
+    if (typeof bareOrOptions === "string") {
+      this.name = spec;
+      this.#parseScope(spec);
+      this.bareSpec = bareOrOptions;
+      this.spec = `${this.name}@${bareOrOptions}`;
+      assertPathSafeName(this.name, this.spec);
+    } else {
+      this.spec = spec;
+      if (!spec.startsWith("git@") && startsWithSpecIdentifier(spec, this.options) && spec.includes(":") && [
+        ...Object.keys(this.options.registries),
+        ...Object.keys(defaultRegistries)
+      ].some((key) => spec.startsWith(`${key}:`))) {
+        this.name = spec;
+        this.bareSpec = spec;
+      } else {
+        const hasScope = spec.startsWith("@");
+        let at = findFirstAt(spec, hasScope);
+        if (at === -1) {
+          at = spec.length;
+          spec += "@";
+        }
+        this.name = spec.substring(0, at);
+        assertPathSafeName(this.name, spec);
+        if (hasScope) this.#parseScope(this.name);
+        this.bareSpec = spec.substring(at + 1);
+      }
+    }
+    if (this.bareSpec.startsWith("catalog:")) {
+      this.catalog = this.bareSpec.substring("catalog:".length);
+      const catalog = this.catalog ? this.options.catalogs?.[this.catalog] : this.options.catalog;
+      if (!catalog) {
+        throw this.#error("Named catalog not found", {
+          name: this.catalog,
+          validOptions: this.options.catalogs && Object.keys(this.options.catalogs)
+        });
+      }
+      const sub = catalog[this.name];
+      if (!sub) {
+        throw this.#error("Name not found in catalog", {
+          name: this.name,
+          validOptions: Object.keys(catalog)
+        });
+      }
+      this.subspec = _Spec.parse(this.name, sub, this.options);
+      this.type = "catalog";
+      this.registry = this.subspec.final.registry;
+      return;
+    }
+    if (this.bareSpec.startsWith("https://")) {
+      for (const [name, origin] of Object.entries(gitHostWebsites)) {
+        if (this.bareSpec.startsWith(origin)) {
+          const parsed = new URL(this.bareSpec);
+          const [user, project] = parsed.pathname.replace(/\.git$/, "").replace(/\/+/g, " ").trim().split(" ");
+          if (user && project) {
+            this.bareSpec = `${name}:${user}/${project}${parsed.hash}`;
+            this.spec = `${this.name}@${this.bareSpec}`;
+            break;
+          }
+        }
+      }
+    }
+    if (this.bareSpec.startsWith("workspace:")) {
+      this.type = "workspace";
+      const ws = this.bareSpec.substring("workspace:".length).trim();
+      const w = ws.lastIndexOf("@");
+      if (w === -1) {
+        this.workspace = this.name;
+      } else {
+        const wsName = ws.substring(0, w);
+        if (!wsName || wsName === "*" || wsName === "~" || wsName === "^" || (wsName.startsWith("@") ? wsName.split("/").length !== 2 || wsName.substring(1).includes("@") : wsName.includes("@"))) {
+          throw this.#error(
+            "workspace: name must be a path or valid package name",
+            { found: wsName }
+          );
+        }
+        this.workspace = wsName;
+      }
+      const wss = w === -1 ? ws : ws.substring(w + 1) || "*";
+      const range2 = wss === "*" ? void 0 : parseRange(wss);
+      if (wss !== "*" && wss !== "~" && wss !== "^" && !range2) {
+        throw this.#error(
+          "workspace: spec must be one of *, ~, or ^, or a valid semver range",
+          {
+            found: wss,
+            wanted: `'*'|'~'|'^'|SemverRange`
+          }
+        );
+      }
+      this.workspaceSpec = wss;
+      if (range2) {
+        this.semver = wss;
+        this.range = range2;
+      }
+      return;
+    }
+    if (this.bareSpec.startsWith("git://") || this.bareSpec.startsWith("git+ssh://") || this.bareSpec.startsWith("git+http://") || this.bareSpec.startsWith("git+https://") || this.bareSpec.startsWith("git+file://") || // legacy affordance
+    this.bareSpec.startsWith("git@github.com")) {
+      if (this.bareSpec.startsWith("git@")) {
+        this.bareSpec = `git+ssh://${this.bareSpec}`;
+        this.spec = `${this.name}@${this.bareSpec}`;
+      }
+      this.type = "git";
+      for (const [name, host] of Object.entries(
+        this.options["git-hosts"]
+      )) {
+        const s = host.indexOf("$");
+        if (s > 0 && this.bareSpec.startsWith(host.substring(0, s))) {
+          const p = this.bareSpec.substring(s).replace(/\.git(#.*)?$/, "$1");
+          this.bareSpec = `${name}:${p}`;
+          this.spec = `${this.name}@${this.bareSpec}`;
+          this.#parseHostedGit(name, host);
+          this.type = "git";
+          return;
+        }
+      }
+      this.#parseGitSelector(this.bareSpec);
+      return;
+    }
+    const regs = Object.entries(this.options.registries);
+    if (this.bareSpec.startsWith("registry:")) {
+      const reg = this.bareSpec.substring("registry:".length);
+      const h = reg.indexOf("#");
+      if (h === -1) {
+        throw this.#error("registry: must include name/version");
+      }
+      this.type = "registry";
+      let url = reg.substring(0, h);
+      if (!url.endsWith("/")) url += "/";
+      const regSpec = reg.substring(h + 1);
+      for (let [name, u] of regs) {
+        if (!u.endsWith("/")) {
+          u += "/";
+          this.options.registries[name] = u;
+        }
+        if (u === url) this.namedRegistry = name;
+      }
+      this.#parseRegistrySpec(regSpec, url);
+      this.#guessRegistryTarball();
+      return;
+    }
+    for (const [host, url] of regs) {
+      const h = `${host}:`;
+      if (this.bareSpec.startsWith(h)) {
+        this.type = "registry";
+        this.namedRegistry = host;
+        this.#parseRegistrySpec(
+          this.bareSpec.substring(h.length),
+          url
+        ).namedRegistry ??= host;
+        if (this.subspec && this.name === this.bareSpec) {
+          this.name = this.subspec.name;
+          this.spec = `${this.name}@${this.bareSpec}`;
+          assertPathSafeName(this.name, this.spec);
+        }
+        this.#guessRegistryTarball();
+        return;
+      }
+    }
+    const ghosts = Object.entries(this.options["git-hosts"]);
+    for (const [name, template] of ghosts) {
+      if (this.#parseHostedGit(name, template)) {
+        this.type = "git";
+        return;
+      }
+    }
+    const jsrs = Object.entries(this.options["jsr-registries"]);
+    for (const [host, url] of jsrs) {
+      const h = `${host}:`;
+      if (this.bareSpec.startsWith(h)) {
+        this.type = "registry";
+        this.namedJsrRegistry = host;
+        this.#parseJsrRegistrySpec(
+          this.bareSpec.substring(h.length),
+          url
+        ).namedJsrRegistry ??= host;
+        return;
+      }
+    }
+    if (this.bareSpec.startsWith("https://") || this.bareSpec.startsWith("http://")) {
+      this.remoteURL = this.bareSpec;
+      this.type = "remote";
+      return;
+    }
+    if (this.bareSpec.startsWith("file:")) {
+      this.type = "file";
+      const [path, uri] = getNormalizeFile(
+        this.constructor.nodejsDependencies
+      )(this.bareSpec, this);
+      this.file = path;
+      this.bareSpec = uri.replace(/\/+$/, "");
+      this.spec = `${this.name}@${this.bareSpec}`;
+      return;
+    }
+    if (!this.bareSpec.startsWith("./") && !this.bareSpec.startsWith("../") && this.options["git-hosts"].github) {
+      const hash = this.bareSpec.indexOf("#");
+      const up = hash === -1 ? this.bareSpec : this.bareSpec.substring(0, hash);
+      if (up.split("/").length === 2) {
+        this.bareSpec = `github:${this.bareSpec}`;
+        this.spec = `${this.name}@${this.bareSpec}`;
+        this.#parseHostedGit(
+          "github",
+          this.options["git-hosts"].github
+        );
+        this.type = "git";
+        return;
+      }
+    }
+    if (this.bareSpec.includes("/") || this.bareSpec === "." || this.bareSpec === "..") {
+      this.type = "file";
+      const [file, uri] = getNormalizeFile(
+        this.constructor.nodejsDependencies
+      )(`file:${this.bareSpec}`, this);
+      this.bareSpec = uri;
+      this.spec = `${this.name}@${this.bareSpec}`;
+      this.file = file;
+      return;
+    }
+    this.type = "registry";
+    const range = parseRange(this.bareSpec);
+    if (range) {
+      this.semver = this.bareSpec.trim();
+      this.range = range;
+    } else {
+      this.distTag = this.bareSpec;
+    }
+    this.registrySpec = this.bareSpec;
+    const {
+      "scoped-registries": scopeRegs,
+      registry,
+      registries,
+      "default-registry-alias": defaultAlias
+    } = this.options;
+    const scopeReg = this.scope && scopeRegs[this.scope];
+    this.registry = scopeReg ?? registry ?? registries[defaultAlias];
+    for (const r of Object.values(this.options["jsr-registries"])) {
+      if (this.registry === r) return;
+    }
+    this.#guessRegistryTarball();
+  }
+  #parseScope(name) {
+    if (!name.startsWith("@")) return;
+    const s = name.indexOf("/");
+    if (s > 1 && s < name.length - 1) {
+      const scope = name.substring(0, s);
+      this.registry = this.scopeRegistry = this.options["scoped-registries"][scope];
+      this.scope = scope;
+    }
+  }
+  #parseHostedGit(name, template) {
+    if (this.bareSpec.startsWith(`${name}:`)) {
+      const h = this.bareSpec.indexOf("#");
+      const bare = h === -1 ? this.bareSpec : this.bareSpec.substring(0, h);
+      const hash = h === -1 ? "" : this.bareSpec.substring(h);
+      const hostPath = bare.substring(name.length + 1);
+      if (!hostPath) {
+        throw this.#error("invalid named git host specifier");
+      }
+      const split = hostPath.split("/");
+      let t = template;
+      for (let i = 0; i < split.length; i++) {
+        t = t.split(`$${i + 1}`).join(split[i]);
+      }
+      t += hash;
+      this.namedGitHost = name;
+      this.namedGitHostPath = hostPath;
+      this.#parseGitSelector(t);
+      if (this.gitCommittish && !this.gitSelectorParsed?.path) {
+        const archiveHost = this.options["git-host-archives"][name];
+        if (name === "github" && this.gitCommittish.startsWith("pull/") && this.gitCommittish.match(/\//g)?.length === 1) {
+          this.gitCommittish += "/head";
+        }
+        if (archiveHost) {
+          this.type = "remote";
+          let t2 = archiveHost;
+          t2 = t2.split("$committish").join(this.gitCommittish);
+          for (let i = 0; i < split.length; i++) {
+            t2 = t2.split(`$${i + 1}`).join(split[i]);
+          }
+          this.remoteURL = t2;
+        }
+      }
+      return true;
+    }
+    return false;
+  }
+  /* c8 ignore start */
+  [kCustomInspect]() {
+    return `@vltpkg/spec.Spec ${String(this)}`;
+  }
+  /* c8 ignore stop */
+  #guessRegistryTarball() {
+    const { name, registry, range } = this.final;
+    if (!registry || !range?.isSingle) return;
+    const stripScope = /^@[^/]+\//;
+    const base = registry.endsWith("/") ? registry : registry + "/";
+    this.conventionalRegistryTarball = String(
+      new URL(
+        `${name}/-/${name.replace(stripScope, "")}-${range}.tgz`,
+        base
+      )
+    );
+  }
+  #parseRegistrySpec(s, url) {
+    this.registry = url;
+    this.subspec = this.constructor.parse(s, {
+      ...this.options,
+      registry: url
+    });
+    return this.subspec;
+  }
+  #parseJsrRegistrySpec(s, url) {
+    this.registry = url;
+    if (!s.startsWith("@")) s = `${this.name}@${s}`;
+    const name = s.startsWith("@jsr/") ? s : `@jsr/${s.replace(/^@/, "").replace(/\//, "__")}`;
+    this.subspec = this.constructor.parse(name, {
+      ...this.options,
+      "scoped-registries": {
+        ...this.options["scoped-registries"],
+        "@jsr": url
+      }
+    });
+    if (this.name === "(unknown)") {
+      const nextAt = s.indexOf("@", 1);
+      if (nextAt === -1) {
+        this.name = s;
+      } else {
+        this.name = s.substring(0, s.indexOf("@", 1));
+      }
+      assertPathSafeName(this.name, s);
+    }
+    const reg = `${this.namedJsrRegistry}:`;
+    const n = `${reg}${this.name}`;
+    if (this.bareSpec.startsWith(n + "@")) {
+      this.bareSpec = reg + this.bareSpec.substring(n.length + 1);
+    } else if (this.bareSpec === n) {
+      this.bareSpec = reg;
+    }
+    this.spec = this.name + "@" + this.bareSpec;
+    return this.subspec;
+  }
+  #error(message, extra = {}) {
+    return error(message, { spec: this.spec, ...extra }, this.#error);
+  }
+  #parseGitSelector(s) {
+    const h = s.indexOf("#");
+    if (h === -1) {
+      this.gitRemote = s;
+      return;
+    }
+    this.gitRemote = s.substring(0, h);
+    this.gitSelector = s.substring(h + 1);
+    const [selectorParsed, committish, range] = this.constructor.parseGitSelector(this.gitSelector, this);
+    this.range = range;
+    this.gitCommittish = committish;
+    this.gitSelectorParsed = selectorParsed;
+  }
+  /**
+   * Should only ever be called with the bit that comes AFTER the #
+   * in the git remote url.
+   */
+  static parseGitSelector(selector, spec) {
+    if (!selector) return [{}];
+    const split = selector.split("::");
+    const first = split[0];
+    let committish = void 0;
+    let range = void 0;
+    const parsed = {};
+    if (typeof first !== "string") {
+      throw typeError("impossible", {
+        found: first,
+        wanted: String
+      });
+    }
+    if (!first.includes(":")) {
+      committish = first;
+      split.shift();
+    }
+    for (const kv of split) {
+      const c = kv.indexOf(":");
+      if (c === -1) continue;
+      const k = kv.substring(0, c);
+      const v = kv.substring(c + 1);
+      if (k === "semver") {
+        if (committish) {
+          throw error(
+            "Cannot specify a semver range and committish value",
+            { spec }
+          );
+        }
+        range = parseRange(v);
+        if (!range) {
+          throw error(`Invalid git tag semver range: ${v}`, { spec });
+        }
+      }
+      if (k === "semver" || k === "path") {
+        if (k === "path") {
+          if (
+            /* c8 ignore next */
+            this.nodejsDependencies?.isAbsolute(
+              v
+            ) || /(^|\/|\\)\.\.($|\\|\/)/.test(v)
+          ) {
+            throw error("Invalid path in git selector", { spec });
+          }
+          parsed.path = (this.nodejsDependencies ? this.nodejsDependencies.join("/", v).substring(1) : v).replace(/\\/g, "/");
+        } else {
+          parsed[k] = v;
+        }
+      }
+    }
+    return [parsed, committish, range];
+  }
+};
+var getNormalizeFile = (opts) => (bareSpec, spec) => {
+  const slashes = bareSpec.substring(
+    "file:".length,
+    "file://".length
+  );
+  const pref = `file:${slashes === "//" ? slashes : ""}`;
+  const rest = bareSpec.substring(pref.length);
+  const [a = "", b = "/", c = "/", d = "/"] = rest.split("", 4);
+  if (!a) {
+    return [".", "file:."];
+  }
+  if (a === "/" && b === "~" && c !== "/" || a === "~" && b !== "/") {
+    throw error(
+      `invalid file: specifier. '~username' not supported`,
+      { spec }
+    );
+  }
+  if (a === "~") {
+    return (
+      /* c8 ignore start */
+      opts ? [
+        opts.resolve(opts.homedir(), rest.substring(2)),
+        `file:${rest}`
+      ] : [rest, `file:${rest}`]
+    );
+  }
+  if (a === "/" && b === "~") {
+    return opts ? [
+      opts.resolve(opts.homedir(), rest.substring(3)),
+      `file:${rest.substring(1)}`
+    ] : (
+      /* c8 ignore stop */
+      [rest.substring(1), `file:${rest.substring(1)}`]
+    );
+  }
+  if (a === "/" && b === "." && (c === "/" || c === "." && d === "/")) {
+    return [rest.substring(1), `file:${rest.substring(1)}`];
+  }
+  if (a === "." && (b === "/" || b === "." && c === "/")) {
+    return [rest, `file:${rest}`];
+  }
+  if (slashes === "//") {
+    try {
+      const parsed = new URL(bareSpec);
+      if (parsed.host) {
+        if (parsed.host !== "localhost") {
+          throw error(
+            `invalid file:// specifier. host must be empty or 'localhost'`,
+            {
+              spec,
+              found: parsed.host,
+              validOptions: ["", "localhost"]
+            }
+          );
+        }
+      }
+      return [
+        parsed.pathname.replace(/^\/([a-zA-Z]:\/)/, "$1"),
+        `file://${parsed.pathname}`
+      ];
+    } catch (er) {
+      throw error("invalid file:// specifier", {
+        spec,
+        cause: er
+      });
+    }
+  }
+  if (opts?.winPath.isAbsolute(rest)) {
+    return [rest, `file://${rest}`];
+  }
+  return [`./${rest}`, `file:./${rest}`];
+};
+
 // ../../src/types/src/index.ts
+import { posix } from "node:path";
+import { debuglog } from "node:util";
+var debug = debuglog("vlt");
 var normalizeFundingEntry = (item) => {
   const getTypeFromUrl = (url) => {
     try {
@@ -1199,14 +1877,35 @@ var isNormalizedLibc = (o) => {
     (item) => typeof item === "string" && !!item && !item.startsWith(" ") && !item.endsWith(" ")
   );
 };
+var unixify = (ref) => ref.replace(/[\\:]/g, "/");
+var secure = (ref) => {
+  const s = unixify(posix.join(".", posix.join("/", unixify(ref))));
+  return s === "./" ? "" : s;
+};
+var secureBinPaths = (bin) => {
+  const res = {};
+  for (const [key, val] of Object.entries(bin)) {
+    const v = typeof val === "string" ? secure(val) : "";
+    const k = posix.basename(secure(key));
+    if (!k || !v) {
+      debug("dropped unusable bin entry", key, val);
+      continue;
+    }
+    if (k !== key || v !== val) {
+      debug("rewrote unsafe bin entry", key, val, "->", k, v);
+    }
+    res[k] = v;
+  }
+  return res;
+};
 var normalizeBinPaths = (manifest) => {
   const { name, bin } = manifest;
   if (bin) {
     if (name && typeof bin === "string") {
       const [_scope, pkg] = parseScope(name);
-      return { [pkg]: bin };
+      return secureBinPaths({ [pkg]: bin });
     } else if (typeof bin === "object") {
-      return bin;
+      return secureBinPaths(bin);
     }
   }
 };
@@ -1250,11 +1949,14 @@ var asManifest = (m, from) => {
   return m;
 };
 var normalizeManifestCache = /* @__PURE__ */ new WeakMap();
-var normalizeManifest = (manifest) => {
+var normalizeManifest = (manifest, from) => {
   const cached = normalizeManifestCache.get(manifest);
   if (cached) {
     return cached;
   }
+  if (manifest.name !== void 0) {
+    assertPathSafeName(manifest.name, from);
+  }
   manifest = fixManifestVersion(manifest);
   const normalizedAuthor = parsePerson(manifest.author);
   const normalizedFunding = normalizeFunding(manifest.funding);
@@ -1738,6 +2440,19 @@ export {
   patch,
   intersects,
   subset,
+  assertPathSafeName,
+  kCustomInspect,
+  defaultRegistryName,
+  defaultRegistries,
+  defaultJsrRegistries,
+  defaultGitHosts,
+  defaultGitHostArchives,
+  gitHostWebsites,
+  defaultScopeRegistries,
+  getOptions,
+  isSpec,
+  currentDefaultRegistryName,
+  Spec,
   asError,
   isError,
   isErrorWithCause,