test(mask): [PKG-MASK-05] checkpoint native model and historical-core coverage

refactor/scripts/releases.mjs

@@ -1,8 +1,10 @@
 import assert from 'node:assert/strict'
-import { createHash } from 'node:crypto'
+import { Buffer } from 'node:buffer'
 import { execFileSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
 import fs from 'node:fs'
 import path from 'node:path'
+import process from 'node:process'
 import { fileURLToPath } from 'node:url'
 
 export const refactorDir = fileURLToPath(new URL('../', import.meta.url))
@@ -30,7 +32,7 @@ export function readMember(archive, member) {
 }
 
 export async function ensureArchive(release) {
-  assert(/^(?:@[a-z0-9]+(?:[.-][a-z0-9]+)*\/)?[a-z0-9]+(?:[.-][a-z0-9]+)*$/.test(release.name) && /^\d+\.\d+\.\d+$/.test(release.version), 'Invalid release identifier')
+  assert(/^(?:@[a-z0-9]+(?:[.-][a-z0-9]+)*\/)?[a-z0-9]+(?:[.-][a-z0-9]+)*$/.test(release.name) && /^\d+\.\d+\.\d+(?:-[a-z0-9]+(?:[.-][a-z0-9]+)*)?$/i.test(release.version), 'Invalid release identifier')
   const archive = path.join(cacheDir, `${release.name.replace('/', '+')}-${release.version}.tgz`)
   if (!fs.existsSync(archive)) {
     const url = new URL(release.tarball)
@@ -59,7 +61,8 @@ export async function verifyReleases() {
     assert.equal(manifest.name, release.name)
     assert.equal(manifest.version, release.version)
     for (const field of ['main', 'module', 'types', 'legacy']) {
-      if (manifest[field]) assert(names.includes(`package/${manifest[field].replace(/^\.\//, '')}`), `Missing ${field}: ${release.name}`)
+      if (manifest[field])
+        assert(names.includes(`package/${manifest[field].replace(/^\.\//, '')}`), `Missing ${field}: ${release.name}`)
     }
     console.log(`Verified ${release.name}@${release.version}: SHA-512, SHA-256, ${names.length} files and manifest entrypoints`)
   }

refactor/scripts/releases.test.mjs

@@ -1,4 +1,7 @@
 import assert from 'node:assert/strict'
+import { Buffer } from 'node:buffer'
+import fs from 'node:fs'
+// eslint-disable-next-line test/no-import-node-test -- Archive verification uses the repository Node baseline runner.
 import { test } from 'node:test'
 import { ensureArchive, hash, verifyIntegrity } from './releases.mjs'
 
@@ -13,6 +16,15 @@ test('release integrity rejects corrupted bytes and inconsistent frozen digests'
 test('release cache rejects unsafe package and version path identifiers before I/O', async () => {
   for (const name of ['../hls.js', '.hls', 'hls..js', 'hls/js', 'hls\\js', 'hls.js/evil', '-hls', '@svta/../outside', '@../outside', '@svta/cml/request', '@svta\\cml-request', '@svta+cml-request', '@svta/', '@svta/.hidden'])
     await assert.rejects(ensureArchive({ name, version: '1.5.17' }), /Invalid release identifier/)
-  for (const version of ['../1.5.17', '1.5.17/evil', 'latest'])
+  for (const version of ['../1.5.17', '1.5.17/evil', 'latest', '5.3.1-beta/1', '5.3.1-beta\\1', '5.3.1-beta..1', '5.3.1-../outside'])
     await assert.rejects(ensureArchive({ name: 'hls.js', version }), /Invalid release identifier/)
 })
+
+test('release cache accepts the fixed historical prerelease without replacing its identity', async () => {
+  const baseline = JSON.parse(fs.readFileSync(new URL('../baselines/danmuku-mask-historical-cores.json', import.meta.url), 'utf8'))
+  const { release } = baseline.entries.find(entry => entry.requestedVersion === '5.3.1-beta.1')
+  assert.equal(release.version, '5.3.1-beta.1')
+  const archive = await ensureArchive(release)
+  assert(archive.endsWith('artplayer-5.3.1-beta.1.tgz'))
+  verifyIntegrity(fs.readFileSync(archive), release)
+})