/** * Pure string-parsing validators for npm package names, semver versions, * and registry/repository domains. * * This module contains no network calls and no side effects — every * function is a pure transformation of its string input into a typed * validation result. Inputs are treated as untrusted: empty strings, * non-string values (rejected by the type system at compile time, but * defended against at runtime via narrowing), and Unicode homograph * attacks are all handled explicitly. * * @module registry/validator */ import type { ValidationResult } from './types.js'; /** * Validate an npm package name according to the public registry's naming * rules. Accepts both unscoped (`lodash`) and scoped (`@babel/core`) * names. * * Rules enforced: * - Must be a non-empty string. * - Maximum length of 214 characters. * - Must be entirely lowercase (no uppercase letters). * - Must not contain spaces. * - Must not begin with a dot (`.`) or underscore (`_`). * - Scoped names use the `@scope/name` syntax; both `scope` and `name` * segments must independently satisfy the segment naming rules. * - Rejects Unicode homograph look-alikes by restricting to ASCII * lowercase letters, digits, hyphen, underscore, and dot. * * @param name - Candidate package name to validate. * @returns A {@link ValidationResult} indicating validity and, when * invalid, a human-readable reason. */ export declare function validatePackageName(name: string): ValidationResult; /** * Validate that a string is a compliant semantic version (semver 2.0.0). * * Accepts strings of the form `MAJOR.MINOR.PATCH` with optional pre-release * (`-prerelease`) and build metadata (`+build`) identifiers. Numeric * components with leading zeros (e.g. `01.2.3`) are rejected, matching the * semver specification. * * @param version - Candidate version string to validate. * @returns `true` when the string is a valid semver version, `false` * otherwise. */ export declare function validateVersion(version: string): boolean; /** * Result of {@link validateDomain}. The `domain` field is always present * (empty string when parsing fails) so callers can destructure safely. */ export interface DomainValidationResult { /** `true` when the input parsed into a URL with a usable hostname. */ readonly valid: boolean; /** Lowercased hostname extracted from the URL, or empty string on failure. */ readonly domain: string; } /** * Validate a URL string and extract its hostname. * * Handles edge cases including: * - Missing protocol (defaults to `https://`). * - Relative URLs (rejected — no hostname). * - Invalid URL syntax (rejected). * - Unicode hostnames (returned as-is, lowercased; punycode conversion is * the caller's responsibility). * * @param url - Candidate URL string to parse. * @returns A {@link DomainValidationResult} with the parsed hostname * (lowercased) when valid, or an empty domain when parsing fails. */ export declare function validateDomain(url: string): DomainValidationResult; /** * Check whether a domain is a known npm registry or source-control host. * * The whitelist includes `npmjs.com`, `registry.npmjs.org`, `github.com`, * `bitbucket.org`, and `gitlab.com`. Comparison is case-insensitive and * exact — subdomains are not automatically trusted (callers must normalise * or extend the check if wildcard matching is desired). * * @param domain - Hostname to check against the known-domain whitelist. * @returns `true` when the domain (case-insensitively) matches a known * registry/repository host, `false` otherwise. */ export declare function isKnownRegistryDomain(domain: string): boolean; //# sourceMappingURL=validator.d.ts.map