@kungfu-tech/buildchain 4.0.2-alpha.30 → 4.0.2-alpha.32

package/packages/core/v4-stable-publication-fence.js

@@ -1,9 +1,5 @@
-import {
-  V4ContractFault,
-  v4ContentRoot,
-  validateV4Clock,
-  validateV4Root,
-} from "./v4-canonical-contracts.js";
+import { V4ContractFault } from "./v4-canonical-contracts.js";
+import { V4DomainWasmFault, invokeV4DomainWasm } from "./v4-domain-wasm.js";
 
 export const V4_STABLE_PUBLICATION_REQUEST_CONTRACT =
   "buildchain-v4-stable-publication-request/v1";
@@ -12,346 +8,21 @@ export const V4_STABLE_PUBLICATION_PLAN_CONTRACT =
 export const V4_STABLE_PUBLICATION_FENCE_CONTRACT =
   "buildchain-v4-stable-publication-fence/v1";
 
-const TOKEN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u;
-const COMMIT = /^[0-9a-f]{40}$/u;
-const TARGET_KINDS = new Set([
-  "stable-ref",
-  "npm-tag",
-  "oci-tag",
-  "github-release",
-]);
-
-function fault(code, path, message) {
-  throw new V4ContractFault(code, path, message);
-}
-
-function exactKeys(value, expected, path) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    fault(
-      "invalid-stable-publication-shape",
-      path,
-      `${path} must be an object`,
-    );
-  const actual = Object.keys(value).sort();
-  const canonical = [...expected].sort();
-  if (
-    actual.length !== canonical.length ||
-    actual.some((key, index) => key !== canonical[index])
-  )
-    fault(
-      "invalid-stable-publication-shape",
-      path,
-      `${path} keys do not match the closed publication fence contract`,
-    );
-}
-
-function asciiCompare(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
-
-function validateToken(value, path) {
-  if (typeof value !== "string" || !TOKEN.test(value))
-    fault(
-      "invalid-stable-publication-token",
-      path,
-      `${path} must be an ASCII token`,
-    );
-}
-
-function validateGeneration(value, path) {
-  if (!Number.isSafeInteger(value) || value < 1)
-    fault(
-      "invalid-stable-publication-generation",
-      path,
-      `${path} must be a positive safe integer`,
-    );
-}
-
-function normalizeRoots(values, path) {
-  if (!Array.isArray(values) || values.length === 0)
-    fault(
-      "stable-publication-provider-confirmation-mismatch",
-      path,
-      `${path} must contain rooted provider confirmations`,
-    );
-  for (const [index, value] of values.entries())
-    validateV4Root(value, `${path}/${index}`);
-  const sorted = [...values].sort(asciiCompare);
-  if (new Set(sorted).size !== sorted.length)
-    fault(
-      "stable-publication-provider-confirmation-mismatch",
-      path,
-      `${path} must not contain duplicate roots`,
-    );
-  return sorted;
-}
-
-function validateCandidate(candidate) {
-  exactKeys(
-    candidate,
-    [
-      "generation",
-      "commit",
-      "sourceRoot",
-      "metadataRoot",
-      "journalRoot",
-      "protectedAncestryRoot",
-    ],
-    "$/candidate",
-  );
-  validateGeneration(candidate.generation, "$/candidate/generation");
-  if (typeof candidate.commit !== "string" || !COMMIT.test(candidate.commit))
-    fault(
-      "invalid-stable-publication-commit",
-      "$/candidate/commit",
-      "candidate commit must be a lowercase 40-byte Git object id",
-    );
-  for (const field of [
-    "sourceRoot",
-    "metadataRoot",
-    "journalRoot",
-    "protectedAncestryRoot",
-  ])
-    validateV4Root(candidate[field], `$/candidate/${field}`);
-  return structuredClone(candidate);
-}
-
-function normalizeTargets(targets) {
-  if (!Array.isArray(targets) || targets.length === 0)
-    fault(
-      "invalid-stable-publication-target",
-      "$/targets",
-      "at least one shadow publication target is required",
-    );
-  const normalized = targets.map((target, index) => {
-    const path = `$/targets/${index}`;
-    exactKeys(
-      target,
-      ["id", "kind", "desired", "providerConfirmationRoot"],
-      path,
-    );
-    validateToken(target.id, `${path}/id`);
-    if (!TARGET_KINDS.has(target.kind))
-      fault(
-        "invalid-stable-publication-target",
-        `${path}/kind`,
-        "publication target kind is unsupported",
-      );
-    if (
-      typeof target.desired !== "string" ||
-      target.desired.length === 0 ||
-      target.desired.length > 200 ||
-      [...target.desired].some((character) => {
-        const code = character.codePointAt(0);
-        return code < 0x21 || code > 0x7e;
-      })
-    )
-      fault(
-        "invalid-stable-publication-target",
-        `${path}/desired`,
-        "desired target must be non-empty printable ASCII without whitespace",
-      );
-    validateV4Root(
-      target.providerConfirmationRoot,
-      `${path}/providerConfirmationRoot`,
-    );
-    const payload = structuredClone(target);
-    return {
-      ...payload,
-      targetRoot: v4ContentRoot("stable-publication-target", payload),
-    };
-  });
-  normalized.sort((left, right) => asciiCompare(left.id, right.id));
-  if (
-    new Set(normalized.map(({ id }) => id)).size !== normalized.length ||
-    new Set(normalized.map(({ kind }) => kind)).size !== normalized.length
-  )
-    fault(
-      "conflicting-stable-publication-target",
-      "$/targets",
-      "publication target ids and kinds must be unique",
-    );
-  return normalized;
-}
-
-function validateQualification(request, candidate, candidateRoot, targets) {
-  const qualification = request.qualification;
-  exactKeys(
-    qualification,
-    [
-      "mode",
-      "authorityGeneration",
-      "qualifiedCandidateRoot",
-      "qualifierAuthorityRoot",
-      "sealRoot",
-      "sourceRoot",
-      "metadataRoot",
-      "journalRoot",
-      "protectedAncestryRoot",
-      "providerConfirmationRoots",
-    ],
-    "$/qualification",
-  );
-  if (!new Set(["n-minus-one", "independent-seal"]).has(qualification.mode))
-    fault(
-      "invalid-stable-publication-qualification",
-      "$/qualification/mode",
-      "qualification mode is unsupported",
-    );
-  validateGeneration(
-    qualification.authorityGeneration,
-    "$/qualification/authorityGeneration",
-  );
-  for (const field of [
-    "qualifiedCandidateRoot",
-    "qualifierAuthorityRoot",
-    "sealRoot",
-    "sourceRoot",
-    "metadataRoot",
-    "journalRoot",
-    "protectedAncestryRoot",
-  ])
-    validateV4Root(qualification[field], `$/qualification/${field}`);
-  if (qualification.qualifiedCandidateRoot !== candidateRoot)
-    fault(
-      "stable-publication-candidate-root-mismatch",
-      "$/qualification/qualifiedCandidateRoot",
-      "qualification must bind the exact candidate root",
-    );
-  if (
-    qualification.mode === "n-minus-one" &&
-    qualification.authorityGeneration + 1 !== candidate.generation
-  )
-    fault(
-      "stable-publication-self-qualification",
-      "$/qualification/authorityGeneration",
-      "N-1 qualification must come from the immediately preceding generation",
-    );
-  if (
-    qualification.mode === "independent-seal" &&
-    qualification.authorityGeneration > candidate.generation
-  )
-    fault(
-      "stable-publication-self-qualification",
-      "$/qualification/authorityGeneration",
-      "independent sealed authority cannot come from a future generation",
-    );
-  if (qualification.qualifierAuthorityRoot === request.publisherAuthorityRoot)
-    fault(
-      "stable-publication-authority-mismatch",
-      "$/qualification/qualifierAuthorityRoot",
-      "qualification and publication authorities must be independent",
-    );
-  const coordinateFaults = [
-    ["sourceRoot", "stable-publication-source-mismatch"],
-    ["metadataRoot", "stable-publication-metadata-mismatch"],
-    ["journalRoot", "stable-publication-journal-mismatch"],
-    ["protectedAncestryRoot", "stable-publication-ancestry-mismatch"],
-  ];
-  for (const [field, code] of coordinateFaults)
-    if (qualification[field] !== candidate[field])
-      fault(
-        code,
-        `$/qualification/${field}`,
-        `qualification ${field} must match the exact candidate coordinate`,
-      );
-  const qualifiedConfirmations = normalizeRoots(
-    qualification.providerConfirmationRoots,
-    "$/qualification/providerConfirmationRoots",
-  );
-  const targetConfirmations = targets
-    .map(({ providerConfirmationRoot }) => providerConfirmationRoot)
-    .sort(asciiCompare);
-  if (
-    qualifiedConfirmations.length !== targetConfirmations.length ||
-    qualifiedConfirmations.some(
-      (root, index) => root !== targetConfirmations[index],
-    )
-  )
-    fault(
-      "stable-publication-provider-confirmation-mismatch",
-      "$/qualification/providerConfirmationRoots",
-      "qualification must bind every exact provider confirmation and no others",
-    );
-  const payload = {
-    ...structuredClone(qualification),
-    providerConfirmationRoots: qualifiedConfirmations,
-  };
-  return {
-    ...payload,
-    qualificationRoot: v4ContentRoot(
-      "stable-publication-qualification",
-      payload,
-    ),
-  };
+function project(request) {
+  try {
+    return invokeV4DomainWasm("stable-publication", request);
+  } catch (error) {
+    if (error instanceof V4DomainWasmFault) {
+      throw new V4ContractFault(error.code, error.path, error.message);
+    }
+    throw error;
+  }
 }
 
 export function planV4StablePublication(request) {
-  exactKeys(
-    request,
-    [
-      "schema",
-      "declaredAt",
-      "candidate",
-      "qualification",
-      "publisherAuthorityRoot",
-      "targets",
-    ],
-    "$",
-  );
-  if (request.schema !== V4_STABLE_PUBLICATION_REQUEST_CONTRACT)
-    fault(
-      "unsupported-stable-publication-version",
-      "$/schema",
-      "stable publication request version is unsupported",
-    );
-  validateV4Clock(request.declaredAt, "$/declaredAt");
-  validateV4Root(request.publisherAuthorityRoot, "$/publisherAuthorityRoot");
-  const candidate = validateCandidate(request.candidate);
-  const candidateRoot = v4ContentRoot(
-    "stable-publication-candidate",
-    candidate,
-  );
-  const targets = normalizeTargets(request.targets);
-  const qualification = validateQualification(
-    request,
-    candidate,
-    candidateRoot,
-    targets,
-  );
-  const payload = {
-    schema: V4_STABLE_PUBLICATION_PLAN_CONTRACT,
-    mode: "production",
-    productionAuthority: "v4",
-    declaredAt: request.declaredAt,
-    candidate,
-    candidateRoot,
-    qualification,
-    publisherAuthorityRoot: request.publisherAuthorityRoot,
-    targets,
-  };
-  return {
-    ...payload,
-    planRoot: v4ContentRoot("stable-publication-plan", payload),
-  };
+  return project(request).plan;
 }
 
 export function projectV4StablePublication(request) {
-  const plan = planV4StablePublication(request);
-  const payload = {
-    schema: V4_STABLE_PUBLICATION_FENCE_CONTRACT,
-    decision: "allow-publication",
-    effectCount: plan.targets.length,
-    candidateRoot: plan.candidateRoot,
-    qualificationMode: plan.qualification.mode,
-    qualificationRoot: plan.qualification.qualificationRoot,
-    planRoot: plan.planRoot,
-  };
-  return {
-    plan,
-    fence: {
-      ...payload,
-      fenceRoot: v4ContentRoot("stable-publication-fence", payload),
-    },
-  };
+  return project(request);
 }

package/scripts/build-v4-domain-wasm.mjs

@@ -0,0 +1,189 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { spawnSyncCommand } from "../packages/core/spawn-command.js";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const crate = path.join(root, "crates", "buildchain-v4-contracts");
+const artifact = path.join(
+  root,
+  "packages",
+  "core",
+  "buildchain-v4-domain.wasm",
+);
+const metadata = path.join(
+  root,
+  "packages",
+  "core",
+  "v4-domain-wasm-artifact.js",
+);
+const check = process.argv.includes("--check");
+const toolchain = process.env.BUILDCHAIN_RUST_WASM_TOOLCHAIN || "1.96.0";
+const expectedRustc = "rustc 1.96.0 (ac68faa20 2026-05-25)";
+const canonicalBuildHost =
+  process.platform === "linux" && process.arch === "x64";
+
+const sha256 = (bytes) =>
+  crypto.createHash("sha256").update(bytes).digest("hex");
+const normalize = (value) => value.split(path.sep).join("/");
+
+function rustBuildEnvironment() {
+  const environment = {
+    ...process.env,
+    RUSTUP_TOOLCHAIN: toolchain,
+    CARGO_INCREMENTAL: "0",
+    SOURCE_DATE_EPOCH: "0",
+  };
+  delete environment.RUSTFLAGS;
+  delete environment.CARGO_ENCODED_RUSTFLAGS;
+
+  const metadata = spawnSyncCommand(
+    "cargo",
+    [
+      "metadata",
+      "--format-version",
+      "1",
+      "--locked",
+      "--manifest-path",
+      path.join(crate, "Cargo.toml"),
+    ],
+    { cwd: root, encoding: "utf8", env: environment },
+  );
+  if (metadata.error) throw metadata.error;
+  if (metadata.status !== 0) process.exit(metadata.status ?? 1);
+  const dependencyRemaps = JSON.parse(metadata.stdout)
+    .packages.filter((entry) => entry.source)
+    .map((entry) => [
+      path.dirname(entry.manifest_path),
+      `/buildchain/dependencies/${entry.name}-${entry.version}`,
+    ])
+    .sort(([left], [right]) => right.length - left.length);
+  const remaps = [[root, "/buildchain/source"], ...dependencyRemaps].map(
+    ([from, to]) => `--remap-path-prefix=${from}=${to}`,
+  );
+  environment.CARGO_ENCODED_RUSTFLAGS = remaps.join("\x1f");
+  return environment;
+}
+
+function sourceFiles(directory) {
+  return fs.readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const absolute = path.join(directory, entry.name);
+    return entry.isDirectory() ? sourceFiles(absolute) : [absolute];
+  });
+}
+
+const rustc = spawnSyncCommand("rustc", ["--version"], {
+  cwd: root,
+  encoding: "utf8",
+  env: { ...process.env, RUSTUP_TOOLCHAIN: toolchain },
+});
+if (rustc.error) throw rustc.error;
+if (rustc.status !== 0) process.exit(rustc.status ?? 1);
+if (rustc.stdout.trim() !== expectedRustc) {
+  throw new Error(
+    `Rust/WASM authority requires ${expectedRustc}; observed ${rustc.stdout.trim()}`,
+  );
+}
+
+const sourceInputs = [
+  path.join(crate, "Cargo.toml"),
+  path.join(crate, "Cargo.lock"),
+  path.join(crate, "rust-toolchain.toml"),
+  ...sourceFiles(path.join(crate, "src")),
+].sort();
+const sourceHash = crypto.createHash("sha256");
+for (const file of sourceInputs) {
+  sourceHash.update(normalize(path.relative(root, file)));
+  sourceHash.update("\0");
+  sourceHash.update(fs.readFileSync(file));
+  sourceHash.update("\0");
+}
+const sourceSha256 = sourceHash.digest("hex");
+const generatedMetadata = (artifactSha256) =>
+  `// Generated by scripts/build-v4-domain-wasm.mjs.\nexport const V4_DOMAIN_WASM_ABI_VERSION = 1;\nexport const V4_DOMAIN_WASM_RUSTC = ${JSON.stringify(expectedRustc)};\nexport const V4_DOMAIN_WASM_SOURCE_SHA256 =\n  ${JSON.stringify(sourceSha256)};\nexport const V4_DOMAIN_WASM_SHA256 =\n  ${JSON.stringify(artifactSha256)};\n`;
+
+if (!canonicalBuildHost && !check) {
+  throw new Error(
+    "Buildchain v4 Rust/WASM generation requires the canonical linux-x64 host",
+  );
+}
+
+if (!canonicalBuildHost) {
+  if (!fs.existsSync(artifact)) {
+    throw new Error("tracked Buildchain v4 Rust/WASM artifact is missing");
+  }
+  const artifactSha256 = sha256(fs.readFileSync(artifact));
+  if (
+    !fs.existsSync(metadata) ||
+    fs.readFileSync(metadata, "utf8") !== generatedMetadata(artifactSha256)
+  ) {
+    throw new Error("tracked Buildchain v4 Rust/WASM metadata is stale");
+  }
+  console.log(
+    `Buildchain v4 Rust/WASM portable artifact verified: sha256:${artifactSha256}`,
+  );
+} else {
+  const buildEnvironment = rustBuildEnvironment();
+
+  const temporary = fs.mkdtempSync(
+    path.join(os.tmpdir(), "buildchain-v4-wasm-"),
+  );
+  try {
+    const build = spawnSyncCommand(
+      "cargo",
+      [
+        "build",
+        "--locked",
+        "--release",
+        "--manifest-path",
+        path.join(crate, "Cargo.toml"),
+        "--target",
+        "wasm32-unknown-unknown",
+        "--target-dir",
+        temporary,
+        "--lib",
+      ],
+      {
+        cwd: root,
+        stdio: "inherit",
+        env: buildEnvironment,
+      },
+    );
+    if (build.error) throw build.error;
+    if (build.status !== 0) process.exit(build.status ?? 1);
+    const builtPath = path.join(
+      temporary,
+      "wasm32-unknown-unknown",
+      "release",
+      "buildchain_v4_contracts.wasm",
+    );
+    const built = fs.readFileSync(builtPath);
+    const artifactSha256 = sha256(built);
+    const generated = generatedMetadata(artifactSha256);
+    if (check) {
+      if (
+        !fs.existsSync(artifact) ||
+        !fs.readFileSync(artifact).equals(built)
+      ) {
+        throw new Error("tracked Buildchain v4 Rust/WASM artifact is stale");
+      }
+      if (
+        !fs.existsSync(metadata) ||
+        fs.readFileSync(metadata, "utf8") !== generated
+      ) {
+        throw new Error("tracked Buildchain v4 Rust/WASM metadata is stale");
+      }
+    } else {
+      fs.copyFileSync(builtPath, artifact);
+      fs.writeFileSync(metadata, generated);
+    }
+    console.log(
+      `Buildchain v4 Rust/WASM ${check ? "verified" : "built"}: sha256:${artifactSha256}`,
+    );
+  } finally {
+    fs.rmSync(temporary, { recursive: true, force: true });
+  }
+}

package/scripts/check-action-bundles.mjs

@@ -5,7 +5,7 @@ import { spawnSyncCommand } from "../packages/core/spawn-command.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const actionsRoot = path.join(root, "actions");
-const bundlePaths = readdirSync(actionsRoot, { withFileTypes: true })
+const javascriptBundlePaths = readdirSync(actionsRoot, { withFileTypes: true })
   .filter((entry) => entry.isDirectory())
   .map((entry) => path.join(actionsRoot, entry.name, "dist", "index.js"))
   .filter((bundlePath) => {
@@ -17,6 +17,14 @@ const bundlePaths = readdirSync(actionsRoot, { withFileTypes: true })
     }
   })
   .sort();
+const wasmBundlePaths = [
+  "promote-buildchain-ref",
+  "release-tail",
+  "v4-release-candidate-promote",
+].map((name) =>
+  path.join(actionsRoot, name, "dist", "buildchain-v4-domain.wasm"),
+);
+const bundlePaths = [...javascriptBundlePaths, ...wasmBundlePaths];
 
 const before = new Map(
   bundlePaths.map((bundlePath) => [bundlePath, readFileSync(bundlePath)]),
@@ -46,4 +54,6 @@ if (changed.length > 0) {
   process.exit(1);
 }
 
-console.log(`action bundle integrity check passed (${bundlePaths.length} bundles)`);
+console.log(
+  `action bundle integrity check passed (${bundlePaths.length} bundles)`,
+);

package/scripts/check-v4-release-topology.mjs

@@ -83,6 +83,13 @@ function rootedPathSet(paths) {
     .digest("hex")}`;
 }
 
+function fileSha256(relative) {
+  return `sha256:${crypto
+    .createHash("sha256")
+    .update(fs.readFileSync(path.join(root, relative)))
+    .digest("hex")}`;
+}
+
 function productionFiles(relative, extensions) {
   const absolute = path.join(root, relative);
   if (!fs.existsSync(absolute)) return [];
@@ -128,6 +135,12 @@ export function discoverV4ReleaseAuthorityClosure() {
     /(?:createV4ReleaseReceipt|release-receipt\.json|V4_RELEASE_RECEIPT_CONTRACT)/u,
   );
   const privilegedModules = discoverStaticModuleClosure(PRIVILEGED_ENTRYPOINTS);
+  const rustWasmArtifact = "packages/core/buildchain-v4-domain.wasm";
+  const rustWasmDistributions = [
+    "actions/promote-buildchain-ref/dist/buildchain-v4-domain.wasm",
+    "actions/release-tail/dist/buildchain-v4-domain.wasm",
+    "actions/v4-release-candidate-promote/dist/buildchain-v4-domain.wasm",
+  ];
   const legacyEngineModules = productionFiles(
     "actions/promote-buildchain-ref",
     [".js", ".mjs", ".cjs"],
@@ -153,6 +166,17 @@ export function discoverV4ReleaseAuthorityClosure() {
       modules: privilegedModules,
       root: rootedPathSet(privilegedModules),
     },
+    rustWasmAuthority: {
+      loader: "packages/core/v4-domain-wasm.js",
+      metadata: "packages/core/v4-domain-wasm-artifact.js",
+      artifact: rustWasmArtifact,
+      artifactRoot: fileSha256(rustWasmArtifact),
+      distributedArtifacts: rustWasmDistributions,
+      byteIdenticalDistributions: rustWasmDistributions.every(
+        (relative) => fileSha256(relative) === fileSha256(rustWasmArtifact),
+      ),
+      fallbackWriterCount: 0,
+    },
     legacyEngineModules,
   };
 }
@@ -183,31 +207,32 @@ function workflowSnapshot(relative) {
   const jobs = document.jobs
     .filter((job) => job.id !== "universal-bootstrap")
     .map((job) => {
-    const block = jobBlock(source, job.id);
-    const uses = job.uses || null;
-    return {
-      id: job.id,
-      kind: uses ? "reusable-call" : "runner",
-      uses,
-      permissions: {
-        contents: permission(block, "contents"),
-        idToken: permission(block, "id-token"),
-      },
-      carriers: {
-        artifactDownload: /uses:\s+actions\/download-artifact@/u.test(block),
-        artifactUpload: /uses:\s+actions\/upload-artifact@/u.test(block),
-        jobOutput: /GITHUB_OUTPUT/u.test(block),
-      },
-      mutationSignals: [
-        /contents:\s*write/u.test(block) && "contents-write",
-        /id-token:\s*write/u.test(block) && "oidc-write",
-        /(?:promote-buildchain-ref|v4-release-candidate-promote)/u.test(
-          block,
-        ) && "promotion-runtime",
-        /(?:git push|npm publish|gh release (?:create|upload))/u.test(block) &&
-          "direct-publication-command",
-      ].filter(Boolean),
-    };
+      const block = jobBlock(source, job.id);
+      const uses = job.uses || null;
+      return {
+        id: job.id,
+        kind: uses ? "reusable-call" : "runner",
+        uses,
+        permissions: {
+          contents: permission(block, "contents"),
+          idToken: permission(block, "id-token"),
+        },
+        carriers: {
+          artifactDownload: /uses:\s+actions\/download-artifact@/u.test(block),
+          artifactUpload: /uses:\s+actions\/upload-artifact@/u.test(block),
+          jobOutput: /GITHUB_OUTPUT/u.test(block),
+        },
+        mutationSignals: [
+          /contents:\s*write/u.test(block) && "contents-write",
+          /id-token:\s*write/u.test(block) && "oidc-write",
+          /(?:promote-buildchain-ref|v4-release-candidate-promote)/u.test(
+            block,
+          ) && "promotion-runtime",
+          /(?:git push|npm publish|gh release (?:create|upload))/u.test(
+            block,
+          ) && "direct-publication-command",
+        ].filter(Boolean),
+      };
     });
   return {
     path: relative,