Package names that end with a semver2-compliant version string

[mmraff]

I'd like to know if your team has worked out a solution to this, because it seems to me that even the new rules for package naming (so helpfully implemented in package validate-npm-package-name) are loose enough to allow some major ambiguity, in particular when it comes to naming files in the npm registry.

1. A package name can include dashes, dots, and digits, with no restriction on the arrangement (except no name-initial dot);
2. So a package name can end with something that has the form [number].[number].[number];
3. In fact there can be a hyphen-chained series of such strings on the end of the name;
4. The Semantic Versioning 2.0 spec also allows a pre-release string to be of the form [number].[number].[number];
5. Pre-release versions of packages can be published to the registry;
6. There can be a package in the registry with the name "name", and simultaneously there can be a package in the registry with the name "name-1.2.3"

So how do you resolve the registry URL for "name@1.2.3-4.5.6" versus "name-1.2.3@4.5.6"?
And that's just one of the simplest examples of what's bugging me...

[ljharb]

You can't have an "@" in a package name except at the beginning of a scope - so the first one would be "name" at v1.2.3-4.5.6, and the second "name-1.2.3" at v4.5.6.

[mmraff]

Now THERE'S the question then. It would bring me relief to find out that the npm registry restricts the publishable range of pre-release strings even further than the semver2 specification, because then there's light at the end of the tunnel for my quest.
But I'll believe it when I see it documented...

[ethomson]

Consider a registry URL that ends with
/name-1.2.3-4.5.6.tgz
Does that correspond to name v1.2.3 pre-release 4.5.6, or name-1.2.3 v4.5.6?

You do not have enough information from the filename alone to answer that question. You would need to look at the packument, or even the full URL (which would have the package name in it).

Consider the @ethomson/version-test-1.2.3 package at version 4.5.6-7.8.9: http://registry.npmjs.com/@ethomson/version-test-1.2.3. You can see that its full tarball URL is https://registry.npmjs.org/@ethomson/version-test-1.2.3/-/version-test-1.2.3-4.5.6-7.8.9.tgz.

You'd need the full registry URL to understand whether this is package version-test-1.2.3 at version 4.5.6-7.8.9 or version-test-1.2.3-4.5.6 at version 7.8.9 http://registry.npmjs.com/@ethomson/version-test-1.2.3-4.5.6. (Or to read the packument - but you cannot tell by filename alone.)

[ljharb]

@ethomson what happens if both package/version combos exist though? wouldn't the same URL end up referencing two package/version combos?

[ethomson]

No (if I'm understanding the question correctly) because the URL has the package in it. (You can see in the above example.)

@ethomson/version-test-1.2.3 version 4.5.6-7.8.9 is URL: https://registry.npmjs.org/@ethomson/version-test-1.2.3/-/version-test-1.2.3-4.5.6-7.8.9.tgz
@ethomson/version-test-1.2.3-4.5.6 version 7.8.9 is URL: https://registry.npmjs.org/@ethomson/version-test-1.2.3-4.5.6/-/version-test-1.2.3-4.5.6-7.8.9.tgz

[ljharb]

In that case, you can indeed parse the package name out of the URL, and thus in the tarball name, figure out which part is the version and which is the package name - it's only if you have just the tarball that you have to extract it to determine all that?

[mmraff]

You do not have enough information from the filename alone to answer that

question. You would need to look at the packument, or even the full URL... Thanks, that, with the registry examples you gave, is a perfectly satisfying answer. :-) (Also a letdown. Oh well.)

…

On Tue, Jul 27, 2021 at 3:41 PM Edward Thomson ***@***.***> wrote: No (if I'm understanding the question correctly) because the URL has the package in it. (You can see in the above example.) @ethomson/version-test-1.2.3 version 4.5.6-7.8.9 is URL: ***@***.***/version-test-1.2.3/-/version-test-1.2.3-4.5.6-7.8.9.tgz @ethomson/version-test-1.2.3-4.5.6 version 7.8.9 is URL: ***@***.***/version-test-1.2.3-4.5.6/-/version-test-1.2.3-4.5.6-7.8.9.tgz — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#507 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACANFJH6JUR45S65XXP2KDTTZ4RZJANCNFSM5BC5AMAA> .