npq 3.7.1 → 3.8.1

package/__tests__/marshalls.provenance.test.js

@@ -196,7 +196,7 @@ describe('Provenance test suites', () => {
     // We assert that the validate method didn't throw an error,
     // because the keys match the signature
     await expect(testMarshall.validate(pkg)).rejects.toThrow(
-      'the package was published without any attestations.'
+      'Unable to verify provenance: the package was published without any attestations.'
     )
 
     // Assert that the fetch method is called with the correct URL

package/__tests__/marshalls.repo.test.js

@@ -37,7 +37,7 @@ describe('Repo test suites', () => {
 
   test('throws the right error when there is no pkg data available', async () => {
     await expect(testMarshall.validate({ packageName: {} })).rejects.toThrow(
-      'the package has no associated repository or homepage.'
+      'The package has no associated repository or homepage.'
     )
   })
 
@@ -54,7 +54,7 @@ describe('Repo test suites', () => {
     }
 
     await expect(testMarshall.validate(pkgData)).rejects.toThrow(
-      'the package has no associated repository or homepage.'
+      'The package has no associated repository or homepage.'
     )
   })
 
@@ -73,7 +73,7 @@ describe('Repo test suites', () => {
     }
 
     await expect(testMarshall.validate(pkgData)).rejects.toThrow(
-      'the package has no associated repository or homepage.'
+      'The package has no associated repository or homepage.'
     )
   })
 
@@ -81,7 +81,7 @@ describe('Repo test suites', () => {
     global.fetch = jest.fn().mockImplementationOnce(() => Promise.reject(new Error('error')))
 
     await expect(testMarshall.validate(fullPkgData)).rejects.toThrow(
-      'no valid repository is associated with the package'
+      'No valid repository is associated with the package'
     )
   })
 
@@ -91,7 +91,7 @@ describe('Repo test suites', () => {
     fullPkgData.packageName.versions['1.0.0'].repository.url =
       'https://dsfsdfsdfs.abcdeugwecwekjasda.com/'
     await expect(testMarshall.validate(fullPkgData)).rejects.toThrow(
-      'the repository associated with the package (https://dsfsdfsdfs.abcdeugwecwekjasda.com/) does not exist or is unreachable at the moment.'
+      'The repository associated with the package (https://dsfsdfsdfs.abcdeugwecwekjasda.com/) does not exist or is unreachable at the moment.'
     )
   })
 
@@ -113,7 +113,7 @@ describe('Repo test suites', () => {
     }
 
     await expect(testMarshall.validate(pkgData)).rejects.toThrow(
-      'the homepage associated with the package (homepage-url) does not exist or is unreachable at the moment.'
+      'The homepage associated with the package (homepage-url) does not exist or is unreachable at the moment.'
     )
   })
 

package/__tests__/marshalls.version-maturity.test.js

@@ -34,7 +34,7 @@ describe('Version Maturity Marshall', () => {
         packageVersion: '1.0.0'
       })
     ).rejects.toThrow(
-      'detected a recently published version (published 2 hours ago) - consider waiting for community review'
+      'Detected a recently published version (published 2 hours ago) - consider waiting for community review'
     )
   })
 
@@ -61,7 +61,7 @@ describe('Version Maturity Marshall', () => {
         packageVersion: '1.0.0'
       })
     ).rejects.toThrow(
-      'detected a recently published version (published 3 days ago) - consider waiting for community review'
+      'Detected a recently published version (published 3 days ago) - consider waiting for community review'
     )
   })
 
@@ -88,7 +88,7 @@ describe('Version Maturity Marshall', () => {
         packageVersion: '1.0.0'
       })
     ).rejects.toThrow(
-      'detected a recently published version (published 1 day ago) - consider waiting for community review'
+      'Detected a recently published version (published 1 day ago) - consider waiting for community review'
     )
   })
 
@@ -135,7 +135,7 @@ describe('Version Maturity Marshall', () => {
         packageName: 'test-package',
         packageVersion: '1.0.0'
       })
-    ).rejects.toThrow('could not determine package version information')
+    ).rejects.toThrow('Could not determine package version information')
   })
 
   test('should throw error when version release date is missing', async () => {
@@ -157,7 +157,7 @@ describe('Version Maturity Marshall', () => {
         packageName: 'test-package',
         packageVersion: '1.0.0'
       })
-    ).rejects.toThrow('could not determine release date for version 1.0.0')
+    ).rejects.toThrow('Could not determine release date for version 1.0.0')
   })
 
   test('should handle version aliases correctly', async () => {
@@ -188,7 +188,7 @@ describe('Version Maturity Marshall', () => {
         packageVersion: 'latest'
       })
     ).rejects.toThrow(
-      'detected a recently published version (published 2 days ago) - consider waiting for community review'
+      'Detected a recently published version (published 2 days ago) - consider waiting for community review'
     )
   })
 })

package/__tests__/packageRepoUtils.test.js

@@ -157,6 +157,95 @@ test('repo utils returns valid semver for different cases of version asked', asy
   expect(result).toEqual('3.1.0')
 
   await expect(packageRepoUtils.getSemVer(packageName, 'next')).rejects.toThrow(
-    'could not find dist-tag next for package testPackage'
+    'Could not find dist-tag next for package testPackage'
+  )
+})
+
+test('repo utils resolves semver ranges by finding the highest satisfying version', async () => {
+  const PackageRepoUtils = require('../lib/helpers/packageRepoUtils')
+  global.fetch = jest.fn().mockImplementation(() =>
+    Promise.resolve({
+      json: () => require('./mocks/registryPackageOk.mock.json')
+    })
+  )
+
+  const packageRepoUtils = new PackageRepoUtils()
+  const packageName = 'testPackage'
+
+  // Test major version range - should find highest 3.x version (3.1.0)
+  let result = await packageRepoUtils.getSemVer(packageName, '^3.0.0')
+  expect(result).toEqual('3.1.0')
+
+  // Test simple major version - should find highest 3.x version (3.1.0)
+  result = await packageRepoUtils.getSemVer(packageName, '3')
+  expect(result).toEqual('3.1.0')
+
+  // Test tilde range - should find 3.1.x version (3.1.0)
+  result = await packageRepoUtils.getSemVer(packageName, '~3.1.0')
+  expect(result).toEqual('3.1.0')
+
+  // Test invalid semver range that doesn't match any version
+  await expect(packageRepoUtils.getSemVer(packageName, '^10.0.0')).rejects.toThrow(
+    'Could not find dist-tag ^10.0.0 for package testPackage'
+  )
+
+  // Test invalid semver range with version 2 (no 2.x versions in mock)
+  await expect(packageRepoUtils.getSemVer(packageName, '2')).rejects.toThrow(
+    'Could not find dist-tag 2 for package testPackage'
+  )
+})
+
+test('repo utils resolves semver ranges with multiple versions', async () => {
+  const PackageRepoUtils = require('../lib/helpers/packageRepoUtils')
+
+  // Create a more comprehensive mock that includes multiple versions
+  const comprehensiveMock = {
+    name: '@astrojs/vue',
+    'dist-tags': {
+      latest: '4.5.0'
+    },
+    versions: {
+      '1.2.0': { name: '@astrojs/vue', version: '1.2.0' },
+      '2.0.0': { name: '@astrojs/vue', version: '2.0.0' },
+      '2.1.0': { name: '@astrojs/vue', version: '2.1.0' },
+      '2.2.1': { name: '@astrojs/vue', version: '2.2.1' },
+      '3.0.0': { name: '@astrojs/vue', version: '3.0.0' },
+      '3.1.0': { name: '@astrojs/vue', version: '3.1.0' },
+      '3.2.2': { name: '@astrojs/vue', version: '3.2.2' },
+      '4.0.0': { name: '@astrojs/vue', version: '4.0.0' },
+      '4.5.0': { name: '@astrojs/vue', version: '4.5.0' }
+    }
+  }
+
+  global.fetch = jest.fn().mockImplementation(() =>
+    Promise.resolve({
+      json: () => comprehensiveMock
+    })
+  )
+
+  const packageRepoUtils = new PackageRepoUtils()
+  const packageName = '@astrojs/vue'
+
+  // Test the problematic case mentioned in the issue: "@astrojs/vue@3"
+  let result = await packageRepoUtils.getSemVer(packageName, '3')
+  expect(result).toEqual('3.2.2') // Should find highest 3.x version
+
+  // Test other major versions
+  result = await packageRepoUtils.getSemVer(packageName, '2')
+  expect(result).toEqual('2.2.1') // Should find highest 2.x version
+
+  result = await packageRepoUtils.getSemVer(packageName, '4')
+  expect(result).toEqual('4.5.0') // Should find highest 4.x version
+
+  // Test caret ranges
+  result = await packageRepoUtils.getSemVer(packageName, '^3.0.0')
+  expect(result).toEqual('3.2.2')
+
+  result = await packageRepoUtils.getSemVer(packageName, '^2.1.0')
+  expect(result).toEqual('2.2.1')
+
+  // Test that non-existent major versions still fail appropriately
+  await expect(packageRepoUtils.getSemVer(packageName, '10')).rejects.toThrow(
+    'Could not find dist-tag 10 for package @astrojs/vue'
   )
 })

package/lib/helpers/packageRepoUtils.js

@@ -61,16 +61,31 @@ class PackageRepoUtils {
       const packageInfo = await this.getPackageInfo(packageName)
 
       if (packageInfo['dist-tags'] === undefined) {
-        throw new Error(`could not find dist-tags for package ${packageName}`)
+        throw new Error(`Could not find dist-tags for package ${packageName}`)
       }
 
-      if (packageInfo['dist-tags'][packageVersion] === undefined) {
-        throw new Error(`could not find dist-tag ${packageVersion} for package ${packageName}`)
+      if (packageInfo['dist-tags'][packageVersion] !== undefined) {
+        const semverVersion = packageInfo['dist-tags'][packageVersion]
+        return semverVersion
       }
 
-      const semverVersion = packageInfo['dist-tags'][packageVersion]
+      // If not found in dist-tags, try to find the highest version that satisfies
+      // the semver range from the versions object
+      if (packageInfo.versions) {
+        const availableVersions = Object.keys(packageInfo.versions).filter((v) => semver.valid(v))
 
-      return semverVersion
+        try {
+          const satisfyingVersion = semver.maxSatisfying(availableVersions, packageVersion)
+
+          if (satisfyingVersion) {
+            return satisfyingVersion
+          }
+        } catch (error) {
+          // semver.maxSatisfying throws if the range is invalid, continue to error below
+        }
+      }
+
+      throw new Error(`Could not find dist-tag ${packageVersion} for package ${packageName}`)
     }
   }
 }

package/lib/marshalls/age.marshall.js

@@ -32,13 +32,13 @@ class Marshall extends BaseMarshall {
           ageDateDiff = dateDiff
           if (dateDiff < PACKAGE_AGE_THRESHOLD) {
             throw new Error(
-              `detected a newly published package (created < ${PACKAGE_AGE_THRESHOLD} days) act carefully`
+              `Detected a newly published package (created < ${PACKAGE_AGE_THRESHOLD} days) act carefully`
             )
           }
 
           return pkg
         } else {
-          throw new Error('could not determine package age')
+          throw new Error('Could not determine package age')
         }
       })
       .then((pkg) => {
@@ -59,7 +59,7 @@ class Marshall extends BaseMarshall {
         }
 
         if (versionDateDiffInDays >= PACKAGE_AGE_UNMAINTAINED_RISK) {
-          throw new Error(`detected an old package (created ${timeAgoNumber} ${timeAgoText} ago)`)
+          throw new Error(`Detected an old package (created ${timeAgoNumber} ${timeAgoText} ago)`)
         }
       })
   }

package/lib/marshalls/author.marshall.js

@@ -43,11 +43,11 @@ class Marshall extends BaseMarshall {
     // for dis-tags (latest)
     const npmUser = pakument.versions[packageVersion]._npmUser
     if (!npmUser || !npmUser.email) {
-      throw new Error('could not determine publishing user for this package version')
+      throw new Error('Could not determine publishing user for this package version')
     }
 
     if (!validator.isEmail(npmUser.email)) {
-      throw new Error('the publishing user has no valid email address')
+      throw new Error('The publishing user has no valid email address')
     }
 
     let firstVersionForUser = null

package/lib/marshalls/downloads.marshall.js

@@ -23,13 +23,13 @@ class Marshall extends BaseMarshall {
     return this.packageRepoUtils.getDownloadInfo(pkg.packageName).then((downloadCount) => {
       if (downloadCount < DOWNLOAD_COUNT_THRESHOLD) {
         throw new Error(
-          `detected a low download-count package (downloads last month < ${DOWNLOAD_COUNT_THRESHOLD})`
+          `Detected a low download-count package (downloads last month < ${DOWNLOAD_COUNT_THRESHOLD})`
         )
       }
 
       if (downloadCount < DOWNLOAD_COUNT_UPPER_THRESHOLD) {
         throw new Warning(
-          `detected a low relatively low download-count package (${downloadCount} downloads last month)`
+          `Detected a low relatively low download-count package (${downloadCount} downloads last month)`
         )
       }
 

package/lib/marshalls/license.marshall.js

@@ -19,11 +19,11 @@ class Marshall extends BaseMarshall {
   validate(pkg) {
     return this.packageRepoUtils.getLicenseInfo(pkg.packageName).then((licenseContents) => {
       if (!licenseContents || licenseContents === 'ERROR: No LICENSE data found!') {
-        throw new Error('package has no LICENSE file available')
+        throw new Error('Package has no LICENSE file available')
       }
 
       if (licenseContents && licenseContents.indexOf('# Security holding package') === 0) {
-        throw new Error('package flagged for security issues and served as place-holder')
+        throw new Error('Package flagged for security issues and served as place-holder')
       }
 
       return licenseContents

package/lib/marshalls/provenance.marshall.js

@@ -86,7 +86,7 @@ class Marshall extends BaseMarshall {
         return keys
       })
       .catch((error) => {
-        throw new Error(`error fetching registry keys: ${error.message}`)
+        throw new Error(`Error fetching registry keys: ${error.message}`)
       })
   }
 }

package/lib/marshalls/repo.marshall.js

@@ -30,21 +30,21 @@ class Marshall extends BaseMarshall {
           urlStructure = new URL(lastVersionData.repository.url)
           urlOfGitRepository = new URL(`https://${urlStructure.host}${urlStructure.pathname}`)
         } catch (error) {
-          throw new Error('no valid repository is associated with the package')
+          throw new Error('No valid repository is associated with the package')
         }
         return fetch(urlOfGitRepository.href).catch(() => {
           throw new Error(
-            `the repository associated with the package (${urlOfGitRepository.href}) does not exist or is unreachable at the moment.`
+            `The repository associated with the package (${urlOfGitRepository.href}) does not exist or is unreachable at the moment.`
           )
         })
       } else if (lastVersionData && lastVersionData.homepage) {
         return fetch(lastVersionData.homepage).catch(() => {
           throw new Error(
-            `the homepage associated with the package (${lastVersionData.homepage}) does not exist or is unreachable at the moment.`
+            `The homepage associated with the package (${lastVersionData.homepage}) does not exist or is unreachable at the moment.`
           )
         })
       } else {
-        throw new Error('the package has no associated repository or homepage.')
+        throw new Error('The package has no associated repository or homepage.')
       }
     })
   }

package/lib/marshalls/scripts.marshall.js

@@ -43,7 +43,7 @@ class Marshall extends BaseMarshall {
           packageScripts[scriptName].length > 0
         ) {
           throw new Error(
-            `detected a possible malicious intent script, act carefully: ${scriptName}: ${packageScripts[scriptName]}`
+            `Detected a possible malicious intent script, act carefully: ${scriptName}: ${packageScripts[scriptName]}`
           )
         }
       })

package/lib/marshalls/signatures.marshall.js

@@ -59,7 +59,7 @@ class Marshall extends BaseMarshall {
         return keys
       })
       .catch((error) => {
-        throw new Error(`error fetching registry keys: ${error.message}`)
+        throw new Error(`Error fetching registry keys: ${error.message}`)
       })
   }
 }

package/lib/marshalls/version-maturity.marshall.js

@@ -26,7 +26,7 @@ class Marshall extends BaseMarshall {
           packageData = data
           return pkg
         } else {
-          throw new Error('could not determine package version information')
+          throw new Error('Could not determine package version information')
         }
       })
       .then((pkg) => {
@@ -36,7 +36,7 @@ class Marshall extends BaseMarshall {
         const versionReleaseDate = packageData.time[versionResolved]
 
         if (!versionReleaseDate) {
-          throw new Error(`could not determine release date for version ${versionResolved}`)
+          throw new Error(`Could not determine release date for version ${versionResolved}`)
         }
 
         const versionDateDiff = new Date() - new Date(versionReleaseDate)
@@ -55,7 +55,7 @@ class Marshall extends BaseMarshall {
           }
 
           throw new Error(
-            `detected a recently published version (published ${timeAgoNumber} ${timeAgoText} ago) - consider waiting for community review`
+            `Detected a recently published version (published ${timeAgoNumber} ${timeAgoText} ago) - consider waiting for community review`
           )
         }
 

package/lib/marshallsDecomissioned/readme.marshall.js

@@ -19,11 +19,11 @@ class Marshall extends BaseMarshall {
   validate(pkg) {
     return this.packageRepoUtils.getReadmeInfo(pkg.packageName).then((readmeContents) => {
       if (!readmeContents || readmeContents === 'ERROR: No README data found!') {
-        throw new Error('package has no README file available')
+        throw new Error('Package has no README file available')
       }
 
       if (readmeContents && readmeContents.indexOf('# Security holding package') === 0) {
-        throw new Error('package flagged for security issues and served as place-holder')
+        throw new Error('Package flagged for security issues and served as place-holder')
       }
 
       return readmeContents

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.7.1",
+  "version": "3.8.1",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",