25c738883d
The jsr: specifier parser accepted scoped names with an empty scope or name and with path separators inside the name; the malformed name was folded into the @jsr/... npm name and flowed into registry URLs and metadata cache file paths. It now throws INVALID_JSR_PACKAGE_NAME for any name rejected by npm's package-name rules. The named-registry specifier parser (e.g. gh:) had the same gap: the scoped branch only rejected a missing '/' or trailing slash, and the unscoped branch validated nothing, while the downstream pick-package validator only rejects '/' in unscoped names. The parser now validates the final package name in every branch (including alias-derived names) and throws INVALID_NAMED_REGISTRY_PACKAGE_NAME for the same shapes. Rather than hand-rolling the shape checks, both parsers delegate to the validator the repo already ships: validate-npm-package-name (validForOldPackages) in TypeScript and its existing pacquet port is_valid_old_npm_package_name. Both fixes land in the TypeScript CLI and pacquet, with matching tests. --------- Co-authored-by: JSap0914 <JSap0914@users.noreply.github.com> Co-authored-by: Zoltan Kochan <z@kochan.io>