test(hls): [PKG-HLS-02] cover released contracts and real SDK playback

refactor/scripts/releases.mjs

@@ -30,7 +30,7 @@ export function readMember(archive, member) {
 }
 
 export async function ensureArchive(release) {
-  assert(/^[a-z0-9-]+$/.test(release.name) && /^\d+\.\d+\.\d+$/.test(release.version), 'Invalid release identifier')
+  assert(/^[a-z0-9]+(?:[.-][a-z0-9]+)*$/.test(release.name) && /^\d+\.\d+\.\d+$/.test(release.version), 'Invalid release identifier')
   const archive = path.join(cacheDir, `${release.name}-${release.version}.tgz`)
   if (!fs.existsSync(archive)) {
     const url = new URL(release.tarball)

refactor/scripts/releases.test.mjs

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict'
 import { test } from 'node:test'
-import { hash, verifyIntegrity } from './releases.mjs'
+import { ensureArchive, hash, verifyIntegrity } from './releases.mjs'
 
 test('release integrity rejects corrupted bytes and inconsistent frozen digests', () => {
   const bytes = Buffer.from('known release artifact')
@@ -9,3 +9,10 @@ test('release integrity rejects corrupted bytes and inconsistent frozen digests'
   assert.throws(() => verifyIntegrity(Buffer.from('replaced artifact'), release), /Integrity mismatch/)
   assert.throws(() => verifyIntegrity(bytes, { ...release, sha256: '0'.repeat(64) }), /Archive hash mismatch/)
 })
+
+test('release cache rejects unsafe package and version path identifiers before I/O', async () => {
+  for (const name of ['../hls.js', '.hls', 'hls..js', 'hls/js', 'hls\\js', 'hls.js/evil', '-hls'])
+    await assert.rejects(ensureArchive({ name, version: '1.5.17' }), /Invalid release identifier/)
+  for (const version of ['../1.5.17', '1.5.17/evil', 'latest'])
+    await assert.rejects(ensureArchive({ name: 'hls.js', version }), /Invalid release identifier/)
+})