Composer Repository Extractor

Point at any Composer / Satis / Packagist-style PHP package repository and get one clean, structured row per package — version, license, authors, keywords, require / require-dev, and source/dist locations — straight from the repository's own metadata feed. No HTML scraping, no browser.

The Composer repository protocol is self-describing: a repo's root packages.json advertises exactly how per-package metadata is reached, so one actor works against every repository — the huge public mirrors, a vendor's plugin feed, or your own private Satis / Toran / Repman / Private Packagist behind a token.

Why this one

Most Composer/Packagist tools on the market only ever hit packagist.org central. This actor speaks the underlying repository protocol, so it runs against any self-hosted or specialised feed the same way it runs against Packagist:

• wPackagist (https://wpackagist.org) — every WordPress plugin & theme as a Composer package
• Roundcube plugins (https://plugins.roundcube.net)
• Packagist itself (https://repo.packagist.org/packages.json)
• Your private Satis / Toran / Repman / Private Packagist — pass a bearer token or custom header

It automatically handles both metadata schemes — the modern Composer v2 metadata-url (/p2/<vendor>/<name>.json, delta-encoded) and the older v1 providers-url + provider-includes chain (content-hash resolution) — so you never have to know which one a given repo speaks.

Input

Field	Type	Description
repoUrl	string (required)	Repository base URL or its packages.json URL. e.g. https://wpackagist.org
packages	array	Packages mode. Explicit vendor/name list to fetch directly (works on any repo). Leave empty to enumerate.
vendorFilter	string	Enumerate mode: keep only packages whose name starts with <vendor>/.
packageFilter	string	Enumerate mode: case-insensitive substring on the full vendor/name.
maxPackages	integer	Global cap on emitted rows (default 100). Enumeration stops at the cap.
discoveryOnly	boolean	Discovery mode. Emit one row describing the repo (protocol, templates, provider-include count) without fetching packages.
bearer	string (secret)	Optional bearer token for a private repo. Never logged.
extraHeaders	object	Optional extra HTTP headers (e.g. Basic auth for a gated Satis). Never logged.

The run mode is auto-selected: set packages → packages mode; set discoveryOnly → discovery mode; otherwise enumerate the repo with your filters.

Output

One flat, fully-nullable row per package:

name, vendor, packageName, type, description, latestVersion, versionCount, versions[], license[], authors[], keywords[], homepage, time, require, requireDev, suggest, provide, sourceType/sourceUrl/sourceReference, distType/distUrl/distReference, abandoned, plus a lossless _raw copy of the latest version object and _protocol / _repoUrl provenance.

Example

{
  "name": "monolog/monolog",
  "vendor": "monolog",
  "type": "library",
  "latestVersion": "3.10.0",
  "versionCount": 87,
  "license": ["MIT"],
  "keywords": ["log", "logging", "psr-3"],
  "require": { "php": ">=8.1", "psr/log": "^2.0 || ^3.0" },
  "sourceUrl": "https://github.com/Seldaek/monolog.git",
  "distUrl": "https://api.github.com/repos/Seldaek/monolog/zipball/...",
  "_protocol": "v2-metadata"
}

Pricing

Pay-per-event: one package event per package row returned. Discovery mode emits a single row.

Notes

• Reads only public metadata over HTTPS; no login-walled scraping.
• Every field is read defensively by key presence, so a repo that omits optional fields yields null for those columns rather than failing.
• If the URL isn't a Composer repository (an HTML page, a 404), the run fails fast with a clear message instead of emitting empty rows.