@vltpkg/security-archive 1.0.7 → 1.0.9

package/dist/browser.d.ts

@@ -1,6 +1,14 @@
+import type { NodeLike } from '@vltpkg/types';
 import type { PackageReportData, SecurityArchiveLike } from './types.ts';
 import type { DepID } from '@vltpkg/dep-id';
 export * from './types.ts';
+export declare const npmRegistryURL = "https://registry.npmjs.org/";
+/**
+ * Socket.dev only has reports for the public npm ecosystem. Eligible
+ * when the node's origin is `https://registry.npmjs.org/` or the URL
+ * configured as `registries.npm`.
+ */
+export declare const usesNpmRegistry: (node: NodeLike) => boolean;
 /**
  * A database of security information for given packages in a graph.
  */
@@ -9,6 +17,23 @@ export declare class SecurityArchive extends Map<DepID, PackageReportData> imple
      * Whether the security archive is valid.
      */
     ok: boolean;
+    /**
+     * Get the report data for a node, keyed by its base {@link DepID}.
+     */
+    get(depId: DepID): PackageReportData | undefined;
+    /**
+     * Check for report data, keyed by the base {@link DepID}.
+     */
+    has(depId: DepID): boolean;
+    /**
+     * Store report data for a node, keyed by its base {@link DepID} so
+     * peer-suffixed copies of the same package share one entry.
+     */
+    set(depId: DepID, data: PackageReportData): this;
+    /**
+     * Delete the report data stored under the base {@link DepID}.
+     */
+    delete(depId: DepID): boolean;
     /**
      * Loads a security archive from a valid JSON dump.
      */

package/dist/browser.js

@@ -1,7 +1,31 @@
-import { asDepID } from '@vltpkg/dep-id/browser';
+import { asDepID, baseDepID, splitDepID, } from '@vltpkg/dep-id/browser';
 import { error } from '@vltpkg/error-cause';
+import { defaultRegistryName } from '@vltpkg/spec/browser';
 import { asPackageReportData } from "./types.js";
 export * from "./types.js";
+export const npmRegistryURL = 'https://registry.npmjs.org/';
+const normalizeRegistryURL = (url) => url.endsWith('/') ? url : `${url}/`;
+const nodeRegistryURL = (node) => {
+    const [type, reg] = splitDepID(node.id);
+    if (type !== 'registry')
+        return;
+    const url = /^https?:\/\//.test(reg) ? reg : node.options.registries?.[reg];
+    return url ? normalizeRegistryURL(url) : undefined;
+};
+/**
+ * Socket.dev only has reports for the public npm ecosystem. Eligible
+ * when the node's origin is `https://registry.npmjs.org/` or the URL
+ * configured as `registries.npm`.
+ */
+export const usesNpmRegistry = (node) => {
+    const origin = nodeRegistryURL(node);
+    if (!origin)
+        return false;
+    if (origin === npmRegistryURL)
+        return true;
+    const npmAlias = node.options.registries?.[defaultRegistryName];
+    return !!npmAlias && normalizeRegistryURL(npmAlias) === origin;
+};
 const isObj = (o) => !!o && typeof o === 'object';
 const isSecurityArchiveJSON = (json) => isObj(json) &&
     Object.entries(json).every(([key, value]) => typeof key === 'string' && isObj(value));
@@ -19,6 +43,31 @@ export class SecurityArchive extends Map {
      * Whether the security archive is valid.
      */
     ok = false;
+    /**
+     * Get the report data for a node, keyed by its base {@link DepID}.
+     */
+    get(depId) {
+        return super.get(baseDepID(depId));
+    }
+    /**
+     * Check for report data, keyed by the base {@link DepID}.
+     */
+    has(depId) {
+        return super.has(baseDepID(depId));
+    }
+    /**
+     * Store report data for a node, keyed by its base {@link DepID} so
+     * peer-suffixed copies of the same package share one entry.
+     */
+    set(depId, data) {
+        return super.set(baseDepID(depId), data);
+    }
+    /**
+     * Delete the report data stored under the base {@link DepID}.
+     */
+    delete(depId) {
+        return super.delete(baseDepID(depId));
+    }
     /**
      * Loads a security archive from a valid JSON dump.
      */

package/dist/index.d.ts

@@ -1,9 +1,8 @@
 import { LRUCache } from 'lru-cache';
 import type { DepID } from '@vltpkg/dep-id';
-import type { NodeLike } from '@vltpkg/types';
 import type { PackageReportData, SecurityArchiveLike, SecurityArchiveRefreshOptions } from './types.ts';
 export * from './types.ts';
-export declare const npmRegistryURL = "https://registry.npmjs.org/";
+export { npmRegistryURL, usesNpmRegistry } from './browser.ts';
 export type JSONItemResponse = {
     namespace?: `@{string}`;
     name: string;
@@ -39,12 +38,6 @@ export type SecurityArchiveOptions = LRUCache.OptionsBase<DepID, PackageReportDa
      */
     retries?: number;
 };
-/**
- * Socket.dev only has reports for the public npm ecosystem. Eligible
- * when the node's origin is `https://registry.npmjs.org/` or the URL
- * configured as `registries.npm`.
- */
-export declare const usesNpmRegistry: (node: NodeLike) => boolean;
 export declare const version: string;
 /**
  * A database of security information for given packages from a list of nodes.
@@ -74,6 +67,23 @@ export declare class SecurityArchive extends LRUCache<DepID, PackageReportData>
      */
     static get defaultTtl(): number;
     constructor(options?: SecurityArchiveOptions);
+    /**
+     * Get the report data for a node, keyed by its base {@link DepID}.
+     */
+    get(k: DepID, options?: Parameters<LRUCache<DepID, PackageReportData>['get']>[1]): PackageReportData | undefined;
+    /**
+     * Check for report data, keyed by the base {@link DepID}.
+     */
+    has(k: DepID): boolean;
+    /**
+     * Store report data for a node, keyed by its base {@link DepID} so
+     * peer-suffixed copies of the same package share one entry.
+     */
+    set(k: DepID, v: PackageReportData, setOptions?: Parameters<LRUCache<DepID, PackageReportData>['set']>[2]): this;
+    /**
+     * Delete the report data stored under the base {@link DepID}.
+     */
+    delete(k: DepID): boolean;
     /**
      * Starts the security archive by providing an array of {@link NodeLike} instances,
      * its registry-based nodes are going to be used as valid potential entries.

package/dist/index.js

@@ -6,38 +6,16 @@ import { dirname } from 'node:path';
 import { LRUCache } from 'lru-cache';
 import pRetry, { AbortError } from 'p-retry';
 import { loadPackageJson } from 'package-json-from-dist';
-import { asDepID, splitDepID, baseDepID } from '@vltpkg/dep-id';
+import { asDepID, baseDepID } from '@vltpkg/dep-id';
 import { error } from '@vltpkg/error-cause';
-import { defaultRegistryName } from '@vltpkg/spec';
 import { XDG } from '@vltpkg/xdg';
 import { asPackageReportData } from "./types.js";
 import { __CODE_SPLIT_SCRIPT_NAME } from "./update-expired.js";
+import { usesNpmRegistry } from "./browser.js";
 export * from "./types.js";
+export { npmRegistryURL, usesNpmRegistry } from "./browser.js";
 const SOCKET_API_V0_URL = 'https://api.socket.dev/v0/purl?alerts=true';
 const SOCKET_PUBLIC_API_TOKEN = 'sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api';
-export const npmRegistryURL = 'https://registry.npmjs.org/';
-const normalizeRegistryURL = (url) => url.endsWith('/') ? url : `${url}/`;
-const nodeRegistryURL = (node) => {
-    const [type, reg] = splitDepID(node.id);
-    if (type !== 'registry')
-        return;
-    const url = /^https?:\/\//.test(reg) ? reg : node.options.registries?.[reg];
-    return url ? normalizeRegistryURL(url) : undefined;
-};
-/**
- * Socket.dev only has reports for the public npm ecosystem. Eligible
- * when the node's origin is `https://registry.npmjs.org/` or the URL
- * configured as `registries.npm`.
- */
-export const usesNpmRegistry = (node) => {
-    const origin = nodeRegistryURL(node);
-    if (!origin)
-        return false;
-    if (origin === npmRegistryURL)
-        return true;
-    const npmAlias = node.options.registries?.[defaultRegistryName];
-    return !!npmAlias && normalizeRegistryURL(npmAlias) === origin;
-};
 // Loads the version number to be used in the User-Agent header
 export const { version } = loadPackageJson(import.meta.filename, process.env.__VLT_INTERNAL_CLI_PACKAGE_JSON);
 /**
@@ -90,6 +68,31 @@ export class SecurityArchive extends LRUCache {
             options.path ?? new XDG('vlt').cache('security-archive.db');
         this.#retries = options.retries ?? 3;
     }
+    /**
+     * Get the report data for a node, keyed by its base {@link DepID}.
+     */
+    get(k, options) {
+        return super.get(baseDepID(k), options);
+    }
+    /**
+     * Check for report data, keyed by the base {@link DepID}.
+     */
+    has(k) {
+        return super.has(baseDepID(k));
+    }
+    /**
+     * Store report data for a node, keyed by its base {@link DepID} so
+     * peer-suffixed copies of the same package share one entry.
+     */
+    set(k, v, setOptions) {
+        return super.set(baseDepID(k), v, setOptions);
+    }
+    /**
+     * Delete the report data stored under the base {@link DepID}.
+     */
+    delete(k) {
+        return super.delete(baseDepID(k));
+    }
     /**
      * Retrieves a node using its name and version.
      */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/security-archive",
   "description": "A database of security information of packages",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,11 +13,11 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/dep-id": "1.0.7",
-    "@vltpkg/error-cause": "1.0.7",
-    "@vltpkg/spec": "1.0.7",
-    "@vltpkg/types": "1.0.7",
-    "@vltpkg/xdg": "1.0.7",
+    "@vltpkg/dep-id": "1.0.9",
+    "@vltpkg/error-cause": "1.0.9",
+    "@vltpkg/spec": "1.0.9",
+    "@vltpkg/types": "1.0.9",
+    "@vltpkg/xdg": "1.0.9",
     "lru-cache": "^11.2.4",
     "p-retry": "^7.1.1",
     "package-json-from-dist": "^1.0.1"