npm-normalize-package-bin 4.0.0: normalize

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:npm/npm-normalize-package-bin@4.0.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/npm-normalize-package-bin@4.0.0

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:e6ca15fe496711b7db9b16ba8247caca73aba153a49279876597421dd66e2c75","contract":["Normalizing a manifest with a string bin and scoped package name strips the scope and leading './' into a bin object entry","Normalizing a manifest with a string bin and no name deletes the bin property","Normalizing a manifest with an array bin maps each path's basename to its normalized relative target path","Normalizing a manifest with an object bin strips path traversal from keys and targets and omits non-string or empty targets"],"goal":"verify pkg:npm/npm-normalize-package-bin@4.0.0","kind":"HOW","packages":["pkg:npm/npm-normalize-package-bin@4.0.0"],"schemaVersion":1,"symbols":["normalize"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"npm","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/npm-normalize-package-bin@4.0.0"],"schemaVersion":1,"subject":"pkg:npm/npm-normalize-package-bin@4.0.0","symbols":["normalize"],"verifierAdapter":"node-typescript@1"}

{
  "name": "sample-npm-normalize-package-bin",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-npm-normalize-package-bin",
      "version": "1.0.0",
      "dependencies": {
        "npm-normalize-package-bin": "4.0.0"
      }
    },
    "node_modules/npm-normalize-package-bin": {
      "version": "4.0.0",
      "resolved": "https://registry.npmjs.org/npm-normalize-package-bin/-/npm-normalize-package-bin-4.0.0.tgz",
      "integrity": "sha512-TZKxPvItzai9kN9H/TkmCtx/ZN/hvr3vUycjlfmH0ootY9yFBzNOpiXAdIn1Iteqsvk4lQn6B5PTrt+n6h8k/w==",
      "license": "ISC",
      "engines": {
        "node": "^18.17.0 || >=20.5.0"
      }
    }
  }
}

{
  "name": "sample-npm-normalize-package-bin",
  "version": "1.0.0",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node test/contract.mjs"
  },
  "dependencies": {
    "npm-normalize-package-bin": "4.0.0"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:npm/npm-normalize-package-bin@4.0.0",
  "kind": "HOW",
  "packages": [
    "pkg:npm/npm-normalize-package-bin@4.0.0"
  ]
}

import normalize from 'npm-normalize-package-bin';

export function normalizeManifestBin(manifest) {
  return normalize({ ...manifest });
}

import assert from 'node:assert/strict';
import normalize from 'npm-normalize-package-bin';
import { normalizeManifestBin } from '../src/index.mjs';

// 1. String bin with scoped package name strips scope and leading ./ from target
const scopedPkg = normalizeManifestBin({
  name: '@scope/cli-tool',
  bin: './bin/run.js',
});
assert.deepEqual(scopedPkg.bin, {
  'cli-tool': 'bin/run.js',
});

// 2. String bin without package name removes the bin field
const namelessPkg = normalize({
  bin: './bin/run.js',
});
assert.equal('bin' in namelessPkg, false);

// 3. Array bin maps basenames to normalized relative target paths
const arrayPkg = normalize({
  name: 'multi-bin',
  bin: ['./bin/first.js', 'scripts\\second.js'],
});
assert.deepEqual(arrayPkg.bin, {
  'first.js': 'bin/first.js',
  'second.js': 'scripts/second.js',
});

// 4. Object bin sanitizes traversal in keys/targets and drops non-string or empty targets
const objectPkg = normalize({
  name: 'sanitized-bin',
  bin: {
    '../escaped-cmd': '../../bin/cmd.js',
    invalidNumber: 42,
    emptyTarget: '.',
  },
});
assert.deepEqual(objectPkg.bin, {
  'escaped-cmd': 'bin/cmd.js',
});

// 5. Object bin where all entries are invalid removes the bin property entirely
const allInvalidPkg = normalize({
  name: 'empty-bin',
  bin: {
    bad: null,
    rootOnly: '/',
  },
});
assert.equal('bin' in allInvalidPkg, false);