Function nameKeyFor

deps/npm/lib/utils/allow-scripts-writer.js:72–96

(node)

// entry. Same trust rules as versionedKeyFor — returns `null` rather than
// falling back to tarball-controlled fields.
const nameKeyFor = (node) => {
  if (!node) {
    return null
  }
  const resolved = primaryResolvedSource(node)
  if (resolved.startsWith('git')) {
    try {
      const parsed = npa(resolved)
      if (parsed.hosted) {
        return parsed.hosted.shortcut({ noCommittish: true })
      }
    } catch {
      /* istanbul ignore next: npa already parsed this string in keyTargetsNode */
      return null
    }
    return null
  }
  if (resolved.startsWith('file:') || resolved.startsWith('/')) {
    return resolved
  }
  // Registry deps: only the URL-derived (or edges-derived, in the
  // omit-lockfile case) trusted name is acceptable.
  const trusted = getTrustedRegistryIdentity(node)
  return trusted ? trusted.name : null
}

const isSingleVersionPin = (key) => {
  try {