add function to return pacakge purl

[bdehamer]

Adds a new toPurl function which translates a package name/version into a its purl (Package URL) form.

> npa.toPurl('foo', '0.1.0')
'pkg:npm/foo@0.1.0'

> npa.toPurl('@foo/bar', '1.0.0-alpha.1')
'pkg:npm/%40foo/bar@1.0.0-alpha.1'

> npa.toPurl('foo:bar', 'a.b.c')
Uncaught:
Error: Invalid package name "foo:bar" of package "foo:bar@a.b.c": name can only contain URL-friendly characters.
    at invalidPackageName (/Users/bdehamer/dev/npm-package-arg/lib/npa.js:110:15)
    at Function.toPurl (/Users/bdehamer/dev/npm-package-arg/lib/npa.js:96:11) {
  code: 'EINVALIDPACKAGENAME'
}

[ljharb]

How can this work (purls, i mean) without indicating the registry? A package’s name and version isn’t sufficient to identify a package; you also need to know what registry it comes from.

[ljharb]

@bdehamer can you help me understand how a purl for an npm package can possibly be valid without a registry address?

[bdehamer]

How can this work (purls, i mean) without indicating the registry? A package’s name and version isn’t sufficient to identify a package; you also need to know what registry it comes from.

There is a notion of a default repository for each package type. However, that doesn't address the case where a different registry is used. I added support for an optional reg parameter that can be used specify a non-default registry:

> npa.toPurl('@foo/bar@v1.0.0', 'npm.pkg.github.com')
'pkg:npm/%40foo/bar@v1.0.0?repository_url=npm.pkg.github.com'

[ljharb]

Thanks, that addresses my feedback, assuming that the registry is omitted from the purl by the implementation whenever it equals the default (not just when it's absent)