@pnpm/resolving.jsr-specifier-parser 1100.0.1 → 1100.0.2

package/lib/index.js

@@ -1,4 +1,5 @@
 import { PnpmError } from '@pnpm/error';
+import validateNpmPackageName from 'validate-npm-package-name';
 export function parseJsrSpecifier(rawSpecifier, alias) {
     if (!rawSpecifier.startsWith('jsr:'))
         return null;
@@ -39,12 +40,14 @@ function jsrToNpmPackageName(jsrPkgName) {
     if (jsrPkgName[0] !== '@') {
         throw new PnpmError('MISSING_JSR_PACKAGE_SCOPE', 'Package names from JSR must have a scope');
     }
-    const sepIndex = jsrPkgName.indexOf('/');
-    if (sepIndex === -1) {
+    // The returned name is used in registry URLs and metadata cache file paths,
+    // so anything that is not a valid npm package name must never make it through.
+    if (!validateNpmPackageName(jsrPkgName).validForOldPackages) {
         throw new PnpmError('INVALID_JSR_PACKAGE_NAME', `The package name '${jsrPkgName}' is invalid`);
     }
-    const scope = jsrPkgName.substring(0, sepIndex);
+    const sepIndex = jsrPkgName.indexOf('/');
+    const scope = jsrPkgName.substring('@'.length, sepIndex);
     const name = jsrPkgName.substring(sepIndex + '/'.length);
-    return `@jsr/${scope.substring(1)}__${name}`;
+    return `@jsr/${scope}__${name}`;
 }
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.jsr-specifier-parser",
-  "version": "1100.0.1",
+  "version": "1100.0.2",
   "description": "Parser of jsr specifiers",
   "keywords": [
     "pnpm",
@@ -28,11 +28,13 @@
     "!*.map"
   ],
   "dependencies": {
+    "validate-npm-package-name": "7.0.2",
     "@pnpm/error": "1100.0.1"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/resolving.jsr-specifier-parser": "1100.0.1"
+    "@types/validate-npm-package-name": "^4.0.2",
+    "@pnpm/resolving.jsr-specifier-parser": "1100.0.2"
   },
   "engines": {
     "node": ">=22.13"