@vltpkg/cli-js 1.0.4 → 1.0.5

package/{chunk-2CLRMD5A.js → chunk-R32BJAKT.js}

@@ -29,7 +29,7 @@ import {
 } from "./chunk-BJBFEQRR.js";
 import {
   asError
-} from "./chunk-IITIX4ID.js";
+} from "./chunk-VFBCWAOC.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";
@@ -15797,18 +15797,18 @@ var require_cache = __commonJS({
         }
       }
     }
-    function makeDeduplicationKey(cacheKey, excludeHeaders) {
+    function makeDeduplicationKey(cacheKey2, excludeHeaders) {
       const headers = {};
-      if (cacheKey.headers) {
-        const sortedHeaders = Object.keys(cacheKey.headers).sort();
+      if (cacheKey2.headers) {
+        const sortedHeaders = Object.keys(cacheKey2.headers).sort();
         for (const header of sortedHeaders) {
           if (excludeHeaders?.has(header.toLowerCase())) {
             continue;
           }
-          headers[header] = cacheKey.headers[header];
+          headers[header] = cacheKey2.headers[header];
         }
       }
-      return JSON.stringify([cacheKey.origin, cacheKey.method, cacheKey.path, headers]);
+      return JSON.stringify([cacheKey2.origin, cacheKey2.method, cacheKey2.path, headers]);
     }
     module3.exports = {
       makeCacheKey,
@@ -16382,7 +16382,7 @@ var require_cache_handler = __commonJS({
         }
       }
     }
-    function getSameOriginPath(cacheKey, location) {
+    function getSameOriginPath(cacheKey2, location) {
       if (typeof location !== "string") {
         return void 0;
       }
@@ -16390,8 +16390,8 @@ var require_cache_handler = __commonJS({
       let requestUrl;
       let locationUrl;
       try {
-        originUrl = new URL(cacheKey.origin);
-        requestUrl = new URL(cacheKey.path, originUrl);
+        originUrl = new URL(cacheKey2.origin);
+        requestUrl = new URL(cacheKey2.path, originUrl);
         locationUrl = new URL(location, requestUrl);
       } catch {
         return void 0;
@@ -16401,38 +16401,38 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path) {
+    function deleteCachedUri(store, cacheKey2, path) {
       deleteCachedValue(store, {
-        ...cacheKey,
+        ...cacheKey2,
         path
       });
       for (let i = 0; i < util.safeHTTPMethods.length; i++) {
         const method = util.safeHTTPMethods[i];
-        if (method !== cacheKey.method) {
+        if (method !== cacheKey2.method) {
           deleteCachedValue(store, {
-            ...cacheKey,
+            ...cacheKey2,
             method,
             path
           });
         }
       }
     }
-    function deleteLocationTargets(store, cacheKey, headerValue) {
+    function deleteLocationTargets(store, cacheKey2, headerValue) {
       if (headerValue === void 0) {
         return;
       }
       const values = Array.isArray(headerValue) ? headerValue : [headerValue];
       for (let i = 0; i < values.length; i++) {
-        const path = getSameOriginPath(cacheKey, values[i]);
+        const path = getSameOriginPath(cacheKey2, values[i]);
         if (path !== void 0) {
-          deleteCachedUri(store, cacheKey, path);
+          deleteCachedUri(store, cacheKey2, path);
         }
       }
     }
-    function invalidateUnsafeRequest(store, cacheKey, resHeaders) {
-      deleteCachedUri(store, cacheKey, cacheKey.path);
-      deleteLocationTargets(store, cacheKey, resHeaders.location);
-      deleteLocationTargets(store, cacheKey, resHeaders["content-location"]);
+    function invalidateUnsafeRequest(store, cacheKey2, resHeaders) {
+      deleteCachedUri(store, cacheKey2, cacheKey2.path);
+      deleteLocationTargets(store, cacheKey2, resHeaders.location);
+      deleteLocationTargets(store, cacheKey2, resHeaders["content-location"]);
     }
     var CacheHandler = class {
       /**
@@ -16464,11 +16464,11 @@ var require_cache_handler = __commonJS({
        * @param {import('../../types/cache-interceptor.d.ts').default.CacheKey} cacheKey
        * @param {import('../../types/dispatcher.d.ts').default.DispatchHandler} handler
        */
-      constructor({ store, type, cacheByDefault }, cacheKey, handler) {
+      constructor({ store, type, cacheByDefault }, cacheKey2, handler) {
         this.#store = store;
         this.#cacheType = type;
         this.#cacheByDefault = cacheByDefault;
-        this.#cacheKey = cacheKey;
+        this.#cacheKey = cacheKey2;
         this.#handler = handler;
       }
       onRequestStart(controller, context) {
@@ -16657,15 +16657,15 @@ var require_cache_handler = __commonJS({
         this.#handler.onResponseError?.(controller, err);
       }
     };
-    function deleteCachedValue(store, cacheKey) {
+    function deleteCachedValue(store, cacheKey2) {
       try {
-        store.delete(cacheKey)?.catch?.(noop);
+        store.delete(cacheKey2)?.catch?.(noop);
       } catch {
       }
     }
-    function deleteCachedValueIfNotModified(statusCode, store, cacheKey) {
+    function deleteCachedValueIfNotModified(statusCode, store, cacheKey2) {
       if (statusCode === 304) {
-        deleteCachedValue(store, cacheKey);
+        deleteCachedValue(store, cacheKey2);
       }
     }
     function revalidationResponseDisallowsCachedReuse(cacheType, resHeaders, cacheControlDirectives) {
@@ -17228,9 +17228,9 @@ var require_cache2 = __commonJS({
     function revalidationResponseUpdatesCacheControl(headers) {
       return headers["cache-control"] !== void 0;
     }
-    function deleteCachedValue(store, cacheKey) {
+    function deleteCachedValue(store, cacheKey2) {
       try {
-        store.delete(cacheKey)?.catch?.(nop);
+        store.delete(cacheKey2)?.catch?.(nop);
       } catch {
       }
     }
@@ -17282,7 +17282,7 @@ var require_cache2 = __commonJS({
       const staleWhileRevalidateExpiry = result.staleAt + staleWhileRevalidate * 1e3;
       return now <= staleWhileRevalidateExpiry;
     }
-    function handleUncachedResponse(dispatch, globalOpts, cacheKey, handler, opts, reqCacheControl) {
+    function handleUncachedResponse(dispatch, globalOpts, cacheKey2, handler, opts, reqCacheControl) {
       if (reqCacheControl?.["only-if-cached"]) {
         let aborted = false;
         try {
@@ -17310,7 +17310,7 @@ var require_cache2 = __commonJS({
         }
         return true;
       }
-      return dispatch(opts, new CacheHandler(globalOpts, cacheKey, handler));
+      return dispatch(opts, new CacheHandler(globalOpts, cacheKey2, handler));
     }
     function sendCachedValue(handler, opts, result, age, context, isStale2) {
       const stream = util.isStream(result.body) ? result.body : Readable.from(result.body ?? []);
@@ -17366,13 +17366,13 @@ var require_cache2 = __commonJS({
         });
       }
     }
-    function handleResult(dispatch, globalOpts, cacheKey, handler, opts, reqCacheControl, result) {
+    function handleResult(dispatch, globalOpts, cacheKey2, handler, opts, reqCacheControl, result) {
       if (!result) {
-        return handleUncachedResponse(dispatch, globalOpts, cacheKey, handler, opts, reqCacheControl);
+        return handleUncachedResponse(dispatch, globalOpts, cacheKey2, handler, opts, reqCacheControl);
       }
       const now = Date.now();
       if (now > result.deleteAt) {
-        return dispatch(opts, new CacheHandler(globalOpts, cacheKey, handler));
+        return dispatch(opts, new CacheHandler(globalOpts, cacheKey2, handler));
       }
       const age = Math.round((now - result.cachedAt) / 1e3);
       const requestMaxAgeExpired = reqCacheControl?.["max-age"] !== void 0 && age >= reqCacheControl["max-age"];
@@ -17380,7 +17380,7 @@ var require_cache2 = __commonJS({
       const revalidate = requestMaxAgeExpired || needsRevalidation(result, reqCacheControl, opts);
       if (stale || revalidate) {
         if (util.isStream(opts.body) && util.bodyLength(opts.body) !== 0) {
-          return dispatch(opts, new CacheHandler(globalOpts, cacheKey, handler));
+          return dispatch(opts, new CacheHandler(globalOpts, cacheKey2, handler));
         }
         if (!revalidate && withinStaleWhileRevalidateWindow(result, globalOpts.type)) {
           sendCachedValue(handler, opts, result, age, null, true);
@@ -17391,7 +17391,7 @@ var require_cache2 = __commonJS({
                 ...opts,
                 headers: headers2
               },
-              new CacheHandler(globalOpts, cacheKey, {
+              new CacheHandler(globalOpts, cacheKey2, {
                 // Silent handler that just updates the cache
                 onRequestStart() {
                 },
@@ -17431,11 +17431,11 @@ var require_cache2 = __commonJS({
                     if (util.isStream(result.body)) {
                       result.body.on("error", nop).destroy();
                     }
-                    deleteCachedValue(globalOpts.store, cacheKey);
-                    return dispatch(opts, new CacheHandler(globalOpts, cacheKey, handler));
+                    deleteCachedValue(globalOpts.store, cacheKey2);
+                    return dispatch(opts, new CacheHandler(globalOpts, cacheKey2, handler));
                   }
                   if (revalidationResponseUpdatesCacheControl(headers2)) {
-                    deleteCachedValue(globalOpts.store, cacheKey);
+                    deleteCachedValue(globalOpts.store, cacheKey2);
                   }
                 }
                 sendCachedValue(handler, opts, result, age, context, stale);
@@ -17443,7 +17443,7 @@ var require_cache2 = __commonJS({
                 result.body.on("error", nop).destroy();
               }
             },
-            new CacheHandler(globalOpts, cacheKey, handler),
+            new CacheHandler(globalOpts, cacheKey2, handler),
             withinStaleIfErrorThreshold
           )
         );
@@ -17518,13 +17518,13 @@ var require_cache2 = __commonJS({
           if (reqCacheControl?.["no-store"]) {
             return dispatch(opts2, handler);
           }
-          const cacheKey = makeCacheKey(opts2);
-          const result = store.get(cacheKey);
+          const cacheKey2 = makeCacheKey(opts2);
+          const result = store.get(cacheKey2);
           if (result && typeof result.then === "function") {
             return result.then((result2) => handleResult(
               dispatch,
               globalOpts,
-              cacheKey,
+              cacheKey2,
               handler,
               opts2,
               reqCacheControl,
@@ -17534,7 +17534,7 @@ var require_cache2 = __commonJS({
             return handleResult(
               dispatch,
               globalOpts,
-              cacheKey,
+              cacheKey2,
               handler,
               opts2,
               reqCacheControl,
@@ -18175,8 +18175,8 @@ var require_deduplicate = __commonJS({
               }
             }
           }
-          const cacheKey = makeCacheKey(opts2);
-          const dedupeKey = makeDeduplicationKey(cacheKey, excludeHeaderNamesSet);
+          const cacheKey2 = makeCacheKey(opts2);
+          const dedupeKey = makeDeduplicationKey(cacheKey2, excludeHeaderNamesSet);
           const pendingHandler = pendingRequests.get(dedupeKey);
           if (pendingHandler) {
             if (pendingHandler.addWaitingHandler(handler)) {
@@ -25836,7 +25836,9 @@ var Cache = class _Cache extends I {
         return this.#diskRead(k, v, opts.context?.integrity);
       },
       allowStaleOnFetchRejection: true,
-      allowStaleOnFetchAbort: true,
+      // Eviction aborts in-flight fetch() placeholders. Resolving those
+      // as undefined is treated as a cache miss and re-downloads tarballs.
+      ignoreFetchAbort: true,
       allowStale: true,
       noDeleteOnStaleGet: true
     });
@@ -26444,6 +26446,7 @@ var CacheEntry = class _CacheEntry {
   #trustIntegrity;
   #staleWhileRevalidateFactor;
   #fromCache = false;
+  #headSize;
   constructor(statusCode, headers, {
     body,
     integrity,
@@ -26586,6 +26589,13 @@ var CacheEntry = class _CacheEntry {
   get fromCache() {
     return this.#fromCache;
   }
+  /**
+   * Byte length of the encoded head (4-byte length prefix + status +
+   * headers). Set when decoded from cache or after `encodeHead()`.
+   */
+  get headSize() {
+    return this.#headSize;
+  }
   get statusCode() {
     return this.#statusCode;
   }
@@ -26770,19 +26780,10 @@ var CacheEntry = class _CacheEntry {
     this.#json = obj;
     return obj;
   }
-  /**
-   * Pass the contents of a @vltpkg/cache.Cache object as a buffer,
-   * and this static method will decode it into a CacheEntry representing
-   * the cached response.
-   */
-  static decode(buffer) {
-    if (buffer.length < 4) {
-      return emptyCacheEntry;
-    }
+  static #parseHead(buffer) {
+    if (buffer.length < 4) return void 0;
     const headSize = readSize(buffer, 0);
-    if (buffer.length < headSize) {
-      return emptyCacheEntry;
-    }
+    if (buffer.length < headSize) return void 0;
     const statusCode = Number(getDecodedValue(buffer.subarray(4, 7)));
     const headersBuffer = buffer.subarray(7, headSize);
     const headers = [];
@@ -26801,22 +26802,50 @@ var CacheEntry = class _CacheEntry {
       headers.push(val);
       i += size;
     }
-    const body = buffer.subarray(headSize);
+    return { statusCode, headers, integrity, headSize };
+  }
+  /**
+   * Decode only the status/headers from an encoded cache buffer.
+   * The body is not read; `headSize` records how many bytes the head
+   * occupies so a later `encodeHead()` can be patched in place.
+   */
+  static decodeHead(buffer) {
+    const parsed = _CacheEntry.#parseHead(buffer);
+    if (!parsed) return emptyCacheEntry;
+    const c = new _CacheEntry(parsed.statusCode, parsed.headers, {
+      body: new Uint8Array(0),
+      integrity: parsed.integrity,
+      trustIntegrity: true
+    });
+    c.#fromCache = true;
+    c.#headSize = parsed.headSize;
+    return c;
+  }
+  /**
+   * Pass the contents of a @vltpkg/cache.Cache object as a buffer,
+   * and this static method will decode it into a CacheEntry representing
+   * the cached response.
+   */
+  static decode(buffer) {
+    const parsed = _CacheEntry.#parseHead(buffer);
+    if (!parsed) return emptyCacheEntry;
+    const body = buffer.subarray(parsed.headSize);
     const c = new _CacheEntry(
-      statusCode,
+      parsed.statusCode,
       setRawHeader(
-        headers,
+        parsed.headers,
         "content-length",
         String(body.byteLength)
       ),
       {
         body,
-        integrity,
+        integrity: parsed.integrity,
         trustIntegrity: true,
         contentLength: body.byteLength
       }
     );
     c.#fromCache = true;
+    c.#headSize = parsed.headSize;
     try {
       if (c.isJSON) {
         c.unzip();
@@ -26834,42 +26863,49 @@ var CacheEntry = class _CacheEntry {
     return gzipBytes[0] === 31 && gzipBytes[1] === 139;
   }
   /**
-   * Encode the entry as a single Buffer for writing to the cache
+   * Encode status + headers (no body) as they appear at the start of
+   * an on-disk cache file.
    */
-  encode() {
-    if (this.isJSON) this.json();
+  encodeHead() {
     const statusStr = String(this.#statusCode);
     const statusBytes = getEncondedValue(statusStr);
     let headLength = 4 + statusBytes.byteLength;
     for (const h of this.#headers) headLength += 4 + h.byteLength;
-    const headLenBytes = new Uint8Array(4);
-    headLenBytes[0] = headLength >> 24 & 255;
-    headLenBytes[1] = headLength >> 16 & 255;
-    headLenBytes[2] = headLength >> 8 & 255;
-    headLenBytes[3] = headLength & 255;
-    const headerChunks = [];
-    for (const h of this.#headers) {
-      const l = headLenBytes.byteLength + h.byteLength;
-      const lb = new Uint8Array(4);
-      lb[0] = l >> 24 & 255;
-      lb[1] = l >> 16 & 255;
-      lb[2] = l >> 8 & 255;
-      lb[3] = l & 255;
-      headerChunks.push(lb, h);
-    }
-    const total = headLenBytes.byteLength + statusBytes.byteLength + headerChunks.reduce((n, b) => n + b.byteLength, 0) + this._body.byteLength;
-    const outBuffer = new ArrayBuffer(total);
-    const out = Buffer.from(outBuffer, 0, total);
+    const out = Buffer.from(
+      new ArrayBuffer(headLength),
+      0,
+      headLength
+    );
     let off = 0;
-    out.set(headLenBytes, off);
-    off += headLenBytes.byteLength;
+    out[off++] = headLength >> 24 & 255;
+    out[off++] = headLength >> 16 & 255;
+    out[off++] = headLength >> 8 & 255;
+    out[off++] = headLength & 255;
     out.set(statusBytes, off);
     off += statusBytes.byteLength;
-    for (const chunk of headerChunks) {
-      out.set(chunk, off);
-      off += chunk.byteLength;
-    }
-    out.set(this._body, off);
+    for (const h of this.#headers) {
+      const l = 4 + h.byteLength;
+      out[off++] = l >> 24 & 255;
+      out[off++] = l >> 16 & 255;
+      out[off++] = l >> 8 & 255;
+      out[off++] = l & 255;
+      out.set(h, off);
+      off += h.byteLength;
+    }
+    this.#headSize = headLength;
+    return out;
+  }
+  /**
+   * Encode the entry as a single Buffer for writing to the cache
+   */
+  encode() {
+    if (this.isJSON) this.json();
+    const head = this.encodeHead();
+    const body = this._body;
+    const total = head.byteLength + body.byteLength;
+    const out = Buffer.from(new ArrayBuffer(total), 0, total);
+    out.set(head, 0);
+    out.set(body, head.byteLength);
     return out;
   }
 };
@@ -27144,6 +27180,32 @@ var setCacheHeaders = (options, entry) => {
 // ../../src/registry-client/src/token-response.ts
 var getTokenResponse = (b) => !!b && typeof b === "object" && "token" in b && typeof b.token === "string" && b.token ? { token: b.token } : void 0;
 
+// ../../src/registry-client/src/response.ts
+var collectHeaders = (response) => {
+  const h = [];
+  for (const [key, value] of Object.entries(response.headers)) {
+    if (Array.isArray(value)) {
+      h.push(
+        getEncondedValue(key),
+        getEncondedValue(value.join(", "))
+      );
+    } else if (typeof value === "string") {
+      h.push(getEncondedValue(key), getEncondedValue(value));
+    }
+  }
+  return h;
+};
+var readBody = async (response, entry) => {
+  response.body.on(
+    "data",
+    (chunk) => entry.addBody(chunk)
+  );
+  return await new Promise((res, rej) => {
+    response.body.on("error", rej);
+    response.body.on("end", () => res(entry));
+  });
+};
+
 // ../../src/registry-client/src/oidc.ts
 var import_undici2 = __toESM(require_undici(), 1);
 var log2 = (...args) => (
@@ -27294,6 +27356,7 @@ var exchangeToken = async (idToken, packageName, registry) => {
 
 // ../../src/registry-client/src/index.ts
 var isCacheableMethod = (m) => m === "GET" || m === "HEAD";
+var cacheKey = (method, url) => `${method !== "GET" ? method + " " : ""}${url}`;
 var { version } = loadPackageJson(
   import.meta.filename,
   "registry-client-package.json"
@@ -27512,7 +27575,7 @@ var RegistryClient = class {
     const m = isCacheableMethod(method) ? method : void 0;
     const { useCache = !!m } = options;
     signal?.throwIfAborted();
-    const key = `${method !== "GET" ? method + " " : ""}${u}`;
+    const key = cacheKey(method, u);
     const buffer = useCache ? await this.cache.fetch(key, { context: { integrity } }) : void 0;
     const entry = buffer ? this.#decodeCached(buffer) : void 0;
     if (entry?.valid) {
@@ -27621,17 +27684,7 @@ var RegistryClient = class {
         consumedBody = otpResult.bodyConsumed;
       }
     }
-    const h = [];
-    for (const [key, value] of Object.entries(response.headers)) {
-      if (Array.isArray(value)) {
-        h.push(
-          getEncondedValue(key),
-          getEncondedValue(value.join(", "))
-        );
-      } else if (typeof value === "string") {
-        h.push(getEncondedValue(key), getEncondedValue(value));
-      }
-    }
+    const h = collectHeaders(response);
     const { integrity, trustIntegrity } = options;
     const contentLength = consumedBody !== void 0 ? consumedBody.length : response.headers["content-length"] ? Number(response.headers["content-length"]) : (
       /* c8 ignore next */
@@ -27662,14 +27715,7 @@ var RegistryClient = class {
       }
       return result;
     }
-    response.body.on(
-      "data",
-      (chunk) => result.addBody(chunk)
-    );
-    return await new Promise((res, rej) => {
-      response.body.on("error", rej);
-      response.body.on("end", () => res(result));
-    });
+    return await readBody(response, result);
   }
 };
 
@@ -27689,6 +27735,7 @@ export {
   CacheEntry,
   oidc,
   isCacheableMethod,
+  cacheKey,
   userAgent,
   RegistryClient
 };

package/{chunk-PDLEQEZ3.js → chunk-SVBEF5PK.js}

@@ -13,10 +13,10 @@ import {
   graphRun,
   graphRunSync,
   joinDepIDTuple
-} from "./chunk-OCJDISSI.js";
+} from "./chunk-3OPNZI6G.js";
 import {
   Spec
-} from "./chunk-XU5SMHXP.js";
+} from "./chunk-XKVU23NC.js";
 import {
   load,
   parse as parse2,
@@ -41,7 +41,7 @@ import {
   normalizeManifest,
   parse,
   satisfies
-} from "./chunk-IITIX4ID.js";
+} from "./chunk-VFBCWAOC.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{chunk-R55OHZ2R.js → chunk-UCYLZSZ7.js}

@@ -14,12 +14,12 @@ import {
 } from "./chunk-RIYFGX27.js";
 import {
   createHostContextsMap
-} from "./chunk-MZIM7X37.js";
+} from "./chunk-YRLO236S.js";
 import {
   stderr,
   stdout,
   styleTextStdout
-} from "./chunk-E737X73P.js";
+} from "./chunk-AL42Z2D3.js";
 import {
   require_emoji_regex
 } from "./chunk-VTEFO2FT.js";
@@ -27,13 +27,13 @@ import {
   Query,
   actual,
   isRunResult
-} from "./chunk-OR5LSCSK.js";
+} from "./chunk-3NGV7EC6.js";
 import {
   Monorepo
-} from "./chunk-PDLEQEZ3.js";
+} from "./chunk-SVBEF5PK.js";
 import {
   isErrorWithCause
-} from "./chunk-IITIX4ID.js";
+} from "./chunk-VFBCWAOC.js";
 import {
   error
 } from "./chunk-WZWDS3W4.js";

package/{chunk-IITIX4ID.js → chunk-VFBCWAOC.js}

@@ -990,13 +990,31 @@ var getOptions = (options) => ({
     ...options["git-host-archives"]
   } : defaultGitHostArchives
 });
+var protocolRE = /^([a-zA-Z][a-zA-Z0-9+-]+):/;
+var builtinProtocols = /* @__PURE__ */ new Set([
+  "catalog",
+  "workspace",
+  "registry",
+  "file",
+  "http",
+  "https",
+  "git",
+  "git+ssh",
+  "git+http",
+  "git+https",
+  "git+file"
+]);
+var unknownProtocol = (str, options) => {
+  const p = protocolRE.exec(str)?.[1];
+  return p === void 0 || builtinProtocols.has(p) || p === options["default-registry-alias"] || options.registries[p] !== void 0 || options["git-hosts"][p] !== void 0 || options["jsr-registries"][p] !== void 0 ? void 0 : p;
+};
 var startsWithSpecIdentifier = (spec, options) => spec.startsWith("/") || spec.startsWith("./") || spec.startsWith("../") || spec.startsWith("file:") || spec.startsWith("http:") || spec.startsWith("https:") || spec.startsWith("workspace:") || spec.startsWith("catalog:") || spec.startsWith("git@") || spec.startsWith("git://") || spec.startsWith("git+ssh://") || spec.startsWith("git+http://") || spec.startsWith("git+https://") || spec.startsWith("git+file://") || spec.startsWith("git@github.com") || spec.startsWith("registry:") || spec.startsWith("npm:") || spec.startsWith("jsr:") || spec.startsWith("gh:") || // anything that starts with a known git host key, or a
 // custom registered registry protocol e.g: `github:`, `custom:`
 [
   ...Object.keys(options["git-hosts"]),
   ...Object.keys(options.registries),
   ...Object.keys(options["jsr-registries"])
-].some((key) => spec.startsWith(`${key}:`));
+].some((key) => spec.startsWith(`${key}:`)) || unknownProtocol(spec, options) !== void 0;
 var findFirstAt = (spec, hasScope) => spec.indexOf("@", hasScope ? 1 : 0);
 var findGitIdentifier = (spec) => spec.indexOf("#") > 2;
 var findFileIdentifier = (spec) => spec.includes("/");
@@ -1117,6 +1135,7 @@ var Spec = class _Spec {
       assertPathSafeName(this.name, this.spec);
     } else {
       this.spec = spec;
+      this.#assertKnownProtocol(spec);
       if (!spec.startsWith("git@") && startsWithSpecIdentifier(spec, this.options) && spec.includes(":") && [
         ...Object.keys(this.options.registries),
         ...Object.keys(defaultRegistries)
@@ -1302,6 +1321,7 @@ var Spec = class _Spec {
       this.spec = `${this.name}@${this.bareSpec}`;
       return;
     }
+    this.#assertKnownProtocol(this.bareSpec);
     if (!this.bareSpec.startsWith("./") && !this.bareSpec.startsWith("../") && this.options["git-hosts"].github) {
       const hash = this.bareSpec.indexOf("#");
       const up = hash === -1 ? this.bareSpec : this.bareSpec.substring(0, hash);
@@ -1449,6 +1469,22 @@ var Spec = class _Spec {
     this.spec = this.name + "@" + this.bareSpec;
     return this.subspec;
   }
+  #assertKnownProtocol(str) {
+    const proto = unknownProtocol(str, this.options);
+    if (proto === void 0) return;
+    throw this.#error(`Protocol ${proto}: is not defined`, {
+      found: `${proto}:`,
+      validOptions: [
+        .../* @__PURE__ */ new Set([
+          ...builtinProtocols,
+          this.options["default-registry-alias"],
+          ...Object.keys(this.options.registries),
+          ...Object.keys(this.options["git-hosts"]),
+          ...Object.keys(this.options["jsr-registries"])
+        ])
+      ].map((p) => `${p}:`)
+    });
+  }
   #error(message, extra = {}) {
     return error(message, { spec: this.spec, ...extra }, this.#error);
   }

package/{chunk-XU5SMHXP.js → chunk-XKVU23NC.js}

@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   Spec,
   kCustomInspect
-} from "./chunk-IITIX4ID.js";
+} from "./chunk-VFBCWAOC.js";
 
 // ../../src/spec/src/index.ts
 import { homedir } from "node:os";