fix(pypi): apply full PEP 503 normalization to package names

src/core/purl.ts

@@ -97,7 +97,7 @@ export function parsePURL(purlStr: string): ParsedPURL {
 
   // Ecosystem-specific normalization per PURL spec
   if (type === "pypi") {
-    name = name.toLowerCase().replace(/_/g, "-");
+    name = name.toLowerCase().replace(/[-_.]+/g, "-");
   }
 
   if (type === "alpm") {

src/registries/pypi.ts

@@ -225,7 +225,7 @@ class PyPIRegistry implements Registry {
 
   /** Normalize package name per PEP 503. */
   private normalizeName(name: string): string {
-    return name.toLowerCase().replace(/_/g, "-");
+    return name.toLowerCase().replace(/[-_.]+/g, "-");
   }
 
   /** Extract repository URL from project_urls. */
@@ -289,7 +289,7 @@ class PyPIRegistry implements Registry {
     }
 
     return {
-      name: depName,
+      name: this.normalizeName(depName),
       requirements: versionSpec,
       scope,
       optional,

test/unit/purl.test.ts

@@ -105,6 +105,14 @@ describe("purl", () => {
       expect(result.version).toBe("3.14.0");
     });
 
+    it("normalizes PyPI dots and separator runs per PEP 503", () => {
+      expect(parsePURL("pkg:pypi/my.package").name).toBe("my-package");
+      expect(parsePURL("pkg:pypi/my..package").name).toBe("my-package");
+      expect(parsePURL("pkg:pypi/my--package").name).toBe("my-package");
+      expect(parsePURL("pkg:pypi/my_-_package").name).toBe("my-package");
+      expect(parsePURL("pkg:pypi/Babel.js").name).toBe("babel-js");
+    });
+
     it("throws on missing pkg: prefix", () => {
       expect(() => parsePURL("npm/lodash")).toThrow(InvalidPURLError);
       expect(() => parsePURL("npm/lodash")).toThrow('must start with "pkg:"');