npm

Address it

await fetchPackageFromPURL("pkg:npm/lodash");
await fetchPackageFromPURL("pkg:npm/%40vue/core"); // scoped, encoded
await fetchPackageFromPURL("pkg:npm/@vue/core"); // scoped, as typed

The scope is the PURL namespace, @ included. fullName joins it back to @vue/core, which the adapter encodes as %40vue%2Fcore on the way to the registry.

Or construct the class yourself:

import { Client } from "@agntn/registries";
import { NpmRegistry } from "@agntn/registries/registries/npm";

const npm = new NpmRegistry("https://registry.npmjs.org", new Client());
const pkg = await npm.fetchPackage("@vue/core");

What it reads

latestVersion is dist-tags.latest. The license comes from the package document, or the latest version when the document has none, and can be a string or an object with a type.

Versions

publishedAt comes from the time map. integrity is the version's dist.integrity (sha512-…), falling back to sha1- plus the shasum. A version with a deprecated message has status: "deprecated".

Dependencies

A name listed under both dependencies and optionalDependencies appears once, as optional.

Maintainers

Maintainers come first with an empty role, then the latest version's author with role: "author" and its contributors with role: "contributor", deduplicated by name and email. A maintainer is an npm account, so login and name are both its username. The author and the contributors are the people named in package.json, with whatever name, email and url npm has and no login, because npm knows no account for them.

URLs

urls.registry("lodash"); // https://www.npmjs.com/package/lodash
urls.registry("lodash", "4.18.1"); // https://www.npmjs.com/package/lodash/v/4.18.1
urls.download("@vue/core", "3.5.0"); // https://registry.npmjs.org/@vue%2Fcore/-/core-3.5.0.tgz
urls.readme("lodash", "4.18.1"); // https://cdn.jsdelivr.net/npm/lodash@4.18.1/README.md

Gotchas

• The full package document for a package with thousands of versions is megabytes. fetchVersions and fetchMaintainers both read it; put a cache in front if you call them repeatedly.
• documentation is always empty; npm has no separate docs field. resolveDocsUrl falls back to the homepage, then to the npmjs.com page.
• A mirror such as registry.npmmirror.com works through the repository_url qualifier, as long as it serves the same document shape.

Where it lives

src/registries/npm.ts, the largest adapter and the template for new ones.