API endpoint to analyse remote packages

[lachlancollins]

For the sveltesociety.dev website, I've taken the worker from this repo to create this script and generate this data on if svelte packages pass publint. However, this is pretty similar to what I imagine happens to generate https://publint.dev/analysis.json.

It would be nice if we didn't have to re-implement the VFS/unzipping/etc logic from your own repo. Would it be possible to share an endpoint to check if packages pass publint? Thanks!

[bluwy]

That's a good idea. The main concern I had was server costs as this means downloading arbitrary packages on the server-side, which instead I opt-ed to run publint on the client-side to avoid it. And I think the scope will also increase for implementing caching to save on the cost too.

Maybe tackling the issue in a different way, we could expose a package that simplifies downloading npm packages instead? There is https://www.npmjs.com/package/pacote but I didn't use it because it's bulky and I like re-implementing things 😄

And also publint could re-export createTarballVfs() from publint/utils to help with this.

[lachlancollins]

That's a good idea. The main concern I had was server costs as this means downloading arbitrary packages on the server-side, which instead I opt-ed to run publint on the client-side to avoid it. And I think the scope will also increase for implementing caching to save on the cost too.

Maybe tackling the issue in a different way, we could expose a package that simplifies downloading npm packages instead? There is npmjs.com/package/pacote but I didn't use it because it's bulky and I like re-implementing things 😄

And also publint could re-export createTarballVfs() from publint/utils to help with this.

Yeah I can imagine it would get expensive easily. Some sort of exported util would be amazing!