feat: publish Regex Tools 0.1.0

scripts/package-release.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, it } from "vitest";
+import {
+  createDeterministicZip,
+  parseReleaseArguments,
+  safeArchivePath,
+} from "./package-release.mjs";
+import { sha256 } from "./checksum-release.mjs";
+
+describe("release packaging", () => {
+  it("creates a deterministic archive independent of input order", () => {
+    const entries = [
+      { name: "index.html", data: Buffer.from("<p>ok</p>") },
+      { name: "assets/app.js", data: Buffer.from("export {};") },
+    ];
+    expect(sha256(createDeterministicZip(entries))).toBe(
+      sha256(createDeterministicZip([...entries].reverse())),
+    );
+  });
+
+  it.each(["../secret", "/absolute", "C:/absolute", "a\\b", "a/./b", ""])(
+    "rejects unsafe path %j",
+    (candidate) => {
+      expect(() => safeArchivePath(candidate)).toThrow();
+    },
+  );
+
+  it("rejects duplicate paths, source maps and credential-like entries", () => {
+    expect(() =>
+      createDeterministicZip([
+        { name: "index.html", data: Buffer.from("one") },
+        { name: "index.html", data: Buffer.from("two") },
+      ]),
+    ).toThrow("Duplicate release path");
+    expect(() =>
+      createDeterministicZip([
+        { name: "assets/app.js.map", data: Buffer.from("{}") },
+      ]),
+    ).toThrow("Source map");
+    expect(() =>
+      createDeterministicZip([{ name: ".env", data: Buffer.from("TOKEN=x") }]),
+    ).toThrow("Credential-like");
+  });
+
+  it("requires an explicit force flag for exact-version replacement", () => {
+    expect(parseReleaseArguments([])).toEqual({ force: false });
+    expect(parseReleaseArguments(["--force"])).toEqual({ force: true });
+    expect(() => parseReleaseArguments(["--unknown"])).toThrow(
+      "Unknown release argument",
+    );
+  });
+});