@kungfu-tech/buildchain 4.1.3-alpha.0 → 4.1.3-alpha.10

package/packages/core/providers/github/pipeline-version-artifacts.js

@@ -0,0 +1,91 @@
+import fs from "node:fs";
+import path from "node:path";
+import artifact from "@actions/artifact";
+import { recordDigest } from "../../release/discussion/envelope.js";
+import {
+  publicationPath,
+  writeImmutablePublicationFile,
+} from "../../publication/pipeline/files.js";
+import { pipelineVersionRegenerationResult } from "../../publication/pipeline/version-regeneration.js";
+import {
+  pipelineVersionArtifactName,
+  readPipelineVersionBuild,
+} from "./pipeline-version-readback.js";
+
+function verifyResult(context, result, platform) {
+  const expected = pipelineVersionRegenerationResult(
+    context.preparation,
+    platform,
+    result.files,
+  );
+  if (recordDigest(result) !== recordDigest(expected))
+    throw new Error(
+      "Version artifact changed its exact preparation, platform or bytes",
+    );
+  return result;
+}
+
+export function githubPipelineVersionArtifacts(host, client = artifact) {
+  async function upload(context, result, directory) {
+    verifyResult(context, result, result.platform);
+    const file = writeImmutablePublicationFile(
+      path.join(directory, "version.json"),
+      JSON.stringify(result),
+    );
+    const uploaded = await client.uploadArtifact(
+      pipelineVersionArtifactName(context, result.platform),
+      [file],
+      directory,
+      {
+        retentionDays: 30,
+        compressionLevel: 0,
+      },
+    );
+    if (!uploaded.id || !uploaded.digest)
+      throw new Error("Version upload omitted immutable provider coordinates");
+    return uploaded;
+  }
+  async function download(context, directory) {
+    const { build, assets } = await readPipelineVersionBuild(context, host);
+    const [repositoryOwner, repositoryName] = host.repository.split("/");
+    const results = [];
+    for (const [index, asset] of assets.entries()) {
+      const target = path.join(directory, String(asset.id));
+      fs.mkdirSync(target, { recursive: true });
+      const downloaded = await client.downloadArtifact(asset.id, {
+        path: target,
+        expectedHash: asset.digest,
+        findBy: {
+          repositoryOwner,
+          repositoryName,
+          workflowRunId: context.runId,
+          token: host.token,
+        },
+      });
+      if (downloaded.digestMismatch)
+        throw new Error(
+          "Version download digest differs from its provider archive",
+        );
+      if (
+        recordDigest(fs.readdirSync(target)) !== recordDigest(["version.json"])
+      )
+        throw new Error("Version artifact contains undeclared files");
+      const file = publicationPath(target, "version.json");
+      // JSON escaping can expand the bounded UTF-8 document inventory sixfold.
+      if (fs.statSync(file).size > 384 * 1024 * 1024)
+        throw new Error("Version artifact exceeds its encoded material limit");
+      const bytes = fs.readFileSync(file);
+      if (!Buffer.from(bytes.toString("utf8")).equals(bytes))
+        throw new Error("Version artifact is not canonical UTF-8 text");
+      results.push(
+        verifyResult(
+          context,
+          JSON.parse(bytes.toString("utf8")),
+          context.preparation.platforms[index],
+        ),
+      );
+    }
+    return { build, results };
+  }
+  return { upload, download };
+}

package/packages/core/providers/github/pipeline-version-readback.js

@@ -0,0 +1,117 @@
+import { recordDigest } from "../../release/discussion/envelope.js";
+import { readPipelineCaller } from "./pipeline-run-entry.js";
+
+export const pipelineVersionArtifactName = (context, platform) =>
+  `buildchain-version-${context.preparation.root.slice(7)}-${context.runId}-${context.runAttempt}-${platform}`;
+
+export const pipelineVersionJobName = (preparation, platform) =>
+  `Prepare version (${preparation.purpose}, ${platform})`;
+
+export async function readPipelineVersionBuild(context, host) {
+  const { preparation, runId, runAttempt, definitionSha } = context;
+  const { repository, request, runs } = host;
+  if (preparation.source.repository !== repository)
+    throw new Error("Version preparation crossed its repository boundary");
+  const { run, jobs } = await runs.read(runId, runAttempt);
+  await readPipelineCaller(
+    run,
+    preparation.source.configPath,
+    request,
+    repository,
+  );
+  const definitions = (run.referenced_workflows || []).filter((entry) =>
+    entry.path?.startsWith(
+      "kungfu-systems/buildchain/.github/workflows/.release-pipeline-products.yml@",
+    ),
+  );
+  const versionDefinitions = (run.referenced_workflows || []).filter((entry) =>
+    entry.path?.startsWith(
+      "kungfu-systems/buildchain/.github/workflows/.release-pipeline-version.yml@",
+    ),
+  );
+  if (
+    definitions.length !== 1 ||
+    definitions[0].sha !== definitionSha ||
+    versionDefinitions.length !== 1 ||
+    versionDefinitions[0].sha !== definitionSha ||
+    !/^[0-9a-f]{40}$/u.test(definitionSha || "")
+  )
+    throw new Error("Version preparation changed its exact hosted definition");
+  const selected = preparation.platforms.map((platform) => {
+    const name = pipelineVersionJobName(preparation, platform);
+    const matches = jobs.filter(
+      (job) => job.name === name || job.name.endsWith(` / ${name}`),
+    );
+    if (
+      matches.length !== 1 ||
+      matches[0].run_id !== runId ||
+      matches[0].run_attempt !== runAttempt ||
+      matches[0].status !== "completed" ||
+      matches[0].conclusion !== "success"
+    )
+      throw new Error(
+        "Version preparation requires every exact successful product job",
+      );
+    return matches[0];
+  });
+  if (
+    !selected.length ||
+    new Set(preparation.platforms).size !== selected.length
+  )
+    throw new Error(
+      "Version preparation platform inventory is empty or duplicated",
+    );
+  const inventory = await request(
+    `/repos/${repository}/actions/runs/${runId}/artifacts?per_page=100`,
+  );
+  if (
+    !Array.isArray(inventory.artifacts) ||
+    inventory.total_count !== inventory.artifacts.length ||
+    inventory.total_count > 100
+  )
+    throw new Error("Version preparation artifact inventory is incomplete");
+  const assets = preparation.platforms.map((platform) => {
+    const matches = inventory.artifacts.filter(
+      (asset) => asset.name === pipelineVersionArtifactName(context, platform),
+    );
+    if (
+      matches.length !== 1 ||
+      !Number.isSafeInteger(matches[0].id) ||
+      matches[0].id < 1 ||
+      matches[0].expired ||
+      matches[0].workflow_run?.id !== runId ||
+      matches[0].workflow_run?.head_sha !== run.head_sha ||
+      !/^sha256:[0-9a-f]{64}$/u.test(matches[0].digest || "")
+    )
+      throw new Error(
+        "Version preparation has no unique immutable platform artifact",
+      );
+    return matches[0];
+  });
+  const again = await runs.read(runId, runAttempt);
+  if (
+    again.run.head_sha !== run.head_sha ||
+    recordDigest(again.run.referenced_workflows) !==
+      recordDigest(run.referenced_workflows) ||
+    selected.some(
+      (job) =>
+        !again.jobs.some((value) => recordDigest(value) === recordDigest(job)),
+    )
+  )
+    throw new Error(
+      "Version preparation producer changed during independent readback",
+    );
+  const body = {
+    schema: "buildchain.pipeline-version-build-readback/v1",
+    preparationRoot: preparation.root,
+    source: preparation.source,
+    runtime: preparation.runtime,
+    runId,
+    runAttempt,
+    definitionSha,
+    providerSource: run.head_sha,
+    jobs: selected,
+    artifacts: assets.map(({ id, digest }) => ({ id, digest })),
+  };
+  return { build: { ...body, root: recordDigest(body) }, assets };
+}

package/packages/core/providers/github/pipeline-version.js

@@ -0,0 +1,199 @@
+import { createHash } from "node:crypto";
+import { recordDigest } from "../../release/discussion/envelope.js";
+import { readPipelineVersion } from "../../publication/pipeline/version.js";
+import { preparedPipelineVersionMaterial } from "../../publication/pipeline/version-material.js";
+import { verifyPipelinePublicationPlan } from "../../publication/pipeline/plan.js";
+
+function blobBytes(value, sha) {
+  if (
+    value.encoding !== "base64" ||
+    value.size > 4 * 1024 * 1024 ||
+    typeof value.content !== "string"
+  )
+    throw new Error("Version material requires a bounded Git blob");
+  const bytes = Buffer.from(value.content, "base64");
+  const digest = createHash("sha1")
+    .update(`blob ${bytes.length}\0`)
+    .update(bytes)
+    .digest("hex");
+  if (bytes.length !== value.size || digest !== sha || value.sha !== sha)
+    throw new Error("Version material blob identity drift");
+  return bytes.toString("utf8");
+}
+
+export function githubPipelineVersion(request, repository) {
+  const base = `/repos/${repository}`;
+  const post = (url, body) => request(url, { method: "POST", body });
+  async function inspect(source, policy) {
+    if (source.repository !== repository)
+      throw new Error("Version material repository mismatch");
+    const commit = await request(`${base}/git/commits/${source.commit}`);
+    if (commit.sha !== source.commit || commit.tree?.sha !== source.tree)
+      throw new Error("Version material source tree drift");
+    const tree = await request(`${base}/git/trees/${source.tree}?recursive=1`);
+    if (tree.truncated || tree.sha !== source.tree || !Array.isArray(tree.tree))
+      throw new Error("Version material requires a complete source tree");
+    const files = {},
+      entries = {};
+    for (const file of [
+      ...policy.files,
+      ...(policy.derived_files || []).map((path) => ({ path })),
+    ]) {
+      if (Object.hasOwn(files, file.path)) continue;
+      const found = tree.tree.filter((entry) => entry.path === file.path);
+      if (
+        found.length !== 1 ||
+        found[0].type !== "blob" ||
+        !["100644", "100755"].includes(found[0].mode)
+      )
+        throw new Error("Version material must be a tracked regular file");
+      const entry = found[0];
+      entries[file.path] = entry;
+      files[file.path] = blobBytes(
+        await request(`${base}/git/blobs/${entry.sha}`),
+        entry.sha,
+      );
+    }
+    return {
+      commit,
+      files,
+      entries,
+      version: readPipelineVersion(policy, files),
+      sourceTimestamp: commit.committer.date,
+    };
+  }
+  async function materialize(plan, regeneration) {
+    verifyPipelinePublicationPlan(plan);
+    const input = await inspect(plan.source, plan.versionPolicy);
+    if (input.version !== plan.candidateVersion)
+      throw new Error("Version material changed after planning");
+    const material = preparedPipelineVersionMaterial(
+      plan,
+      input.files,
+      regeneration,
+    );
+    let source = plan.source;
+    if (material.changes.length)
+      source = await createMaterializedSource(plan, input, material);
+    const body = {
+      schema: "buildchain.pipeline-version-materialization/v1",
+      planRoot: plan.root,
+      protectedSource: plan.source,
+      source,
+      material,
+    };
+    return { ...body, root: recordDigest(body) };
+  }
+  async function materializeDevelopment(plan, regeneration) {
+    const input = await inspect(plan.source, plan.versionPolicy);
+    const material = preparedPipelineVersionMaterial(
+      plan,
+      input.files,
+      regeneration,
+    );
+    const branch = `feature/buildchain-next/${plan.root.slice(7)}`;
+    const source = material.changes.length
+      ? await createMaterializedSource(plan, input, material, `heads/${branch}`)
+      : plan.source;
+    const body = {
+      schema: "buildchain.pipeline-development-materialization/v1",
+      transitionRoot: plan.root,
+      protectedSource: plan.source,
+      source,
+      branch,
+      material,
+    };
+    return { ...body, root: recordDigest(body) };
+  }
+  async function createMaterializedSource(plan, input, material, targetRef) {
+    const changes = material.changes.map(({ path, content }) => ({
+      path,
+      content,
+      mode: input.entries[path].mode,
+      type: "blob",
+    }));
+    const tree = await post(`${base}/git/trees`, {
+      base_tree: plan.source.tree,
+      tree: changes,
+    });
+    const identity = {
+      name: "Buildchain automation",
+      email: "noreply@github.com",
+      date: plan.sourceTimestamp,
+    };
+    const parents = [plan.source.commit];
+    // Preserve the prior published version overlay as real Git ancestry. The
+    // resulting tree still changes only the current protected version fields;
+    // no provider force-update is needed for the next stable floating channel.
+    if (
+      plan.previousChannelCommit &&
+      plan.previousChannelCommit !== plan.source.commit
+    ) {
+      if (!/^[0-9a-f]{40}$/u.test(plan.previousChannelCommit))
+        throw new Error(
+          "Version overlay parent must be an exact prior channel commit",
+        );
+      const previous = await request(
+        `${base}/git/commits/${plan.previousChannelCommit}`,
+      );
+      if (previous.sha !== plan.previousChannelCommit)
+        throw new Error("Prior version overlay commit changed");
+      parents.push(previous.sha);
+    }
+    const created = await post(`${base}/git/commits`, {
+      message: `chore(release): materialize ${plan.version}\n\nBuildchain-Plan: ${plan.root}\nSigned-off-by: Buildchain automation <noreply@github.com>`,
+      tree: tree.sha,
+      parents,
+      author: identity,
+      committer: identity,
+    });
+    const commit = await request(`${base}/git/commits/${created.sha}`);
+    if (
+      commit.tree?.sha !== tree.sha ||
+      recordDigest(commit.parents?.map(({ sha }) => sha)) !==
+        recordDigest(parents)
+    )
+      throw new Error("Materialized version commit readback mismatch");
+    const source = { ...plan.source, commit: commit.sha, tree: tree.sha };
+    const verified = await inspect(source, plan.versionPolicy);
+    if (verified.version !== plan.version)
+      throw new Error("Version material did not retain the planned version");
+    const expectedFiles = {
+      ...input.files,
+      ...Object.fromEntries(
+        material.changes.map(({ path, content }) => [path, content]),
+      ),
+    };
+    if (recordDigest(verified.files) !== recordDigest(expectedFiles))
+      throw new Error(
+        "Version material changed document bytes beyond the planned fields",
+      );
+    const comparison = await request(
+      `${base}/compare/${plan.source.commit}...${commit.sha}`,
+    );
+    const paths = comparison.files?.map((file) => file.filename).sort();
+    if (
+      comparison.status !== "ahead" ||
+      (parents.length === 1 && comparison.total_commits !== 1) ||
+      recordDigest(paths) !==
+        recordDigest(material.changes.map(({ path }) => path).sort()) ||
+      comparison.files.some((file) => file.status !== "modified")
+    )
+      throw new Error(
+        "Version material changed paths outside the declared version fields",
+      );
+    const ref =
+      targetRef || `heads/buildchain/publication-source/${plan.root.slice(7)}`;
+    try {
+      await post(`${base}/git/refs`, { ref: `refs/${ref}`, sha: commit.sha });
+    } catch (error) {
+      const observed = await request(`${base}/git/ref/${ref}`);
+      if (observed.object?.sha !== commit.sha) throw error;
+    }
+    const observed = await request(`${base}/git/ref/${ref}`);
+    if (observed.object?.sha !== commit.sha)
+      throw new Error("Version material ref readback mismatch");
+    return source;
+  }
+  return { inspect, materialize, materializeDevelopment };
+}

package/packages/core/providers/github/pipeline-worker.js

@@ -0,0 +1,108 @@
+import { object } from "../../consumer/contract/shape.js";
+import { recordDigest } from "../../release/discussion/envelope.js";
+
+export const PIPELINE_WORKER = "buildchain.pipeline-worker/v1";
+
+export function validatePipelineWorker(binding, current, warrant) {
+  object(binding, [
+    "schema",
+    "repository",
+    "attempt",
+    "generation",
+    "sourceHead",
+    "candidateId",
+    "fencingToken",
+    "leaseGeneration",
+    "runId",
+    "runAttempt",
+    "nativeJobId",
+    "sealJobId",
+  ]);
+  if (
+    binding.schema !== PIPELINE_WORKER ||
+    binding.repository !== current.intent.repository ||
+    binding.attempt !== current.identity.id ||
+    binding.generation !== current.generation.id ||
+    binding.sourceHead !== current.generation.source.commit ||
+    binding.candidateId !== warrant.candidateId ||
+    binding.fencingToken !== warrant.fencingToken ||
+    binding.leaseGeneration !== warrant.generation
+  )
+    throw new Error("Native worker does not bind the active pipeline Warrant");
+  for (const key of [
+    "runId",
+    "runAttempt",
+    "nativeJobId",
+    "sealJobId",
+    "leaseGeneration",
+  ])
+    if (!Number.isSafeInteger(binding[key]) || binding[key] < 1)
+      throw new Error("Native worker provider identity is invalid");
+  if (binding.nativeJobId === binding.sealJobId)
+    throw new Error("Native execution and evidence seal must be separate jobs");
+  return binding;
+}
+
+export function githubPipelineWorker(request) {
+  async function jobs(base, binding) {
+    const result = [];
+    for (let page = 1; page <= 100; page++) {
+      const response = await request(
+        `${base}/actions/runs/${binding.runId}/attempts/${binding.runAttempt}/jobs?per_page=100&page=${page}`,
+      );
+      if (!Array.isArray(response.jobs))
+        throw new Error("Missing provider jobs readback");
+      result.push(...response.jobs);
+      if (response.jobs.length < 100) return result;
+    }
+    throw new Error("Pipeline worker jobs exceed the readback bound");
+  }
+  async function observe(binding, current, warrant) {
+    validatePipelineWorker(binding, current, warrant);
+    const base = `/repos/${binding.repository}`;
+    const run = await request(`${base}/actions/runs/${binding.runId}`);
+    if (
+      run.id !== binding.runId ||
+      run.run_attempt !== binding.runAttempt ||
+      run.repository?.full_name !== binding.repository
+    )
+      throw new Error(
+        "Native worker provider run changed; terminality is unproved",
+      );
+    const entries = await jobs(base, binding);
+    const selected = [binding.nativeJobId, binding.sealJobId].map((id) => {
+      const matches = entries.filter((job) => job.id === id);
+      if (
+        matches.length !== 1 ||
+        matches[0].run_id !== binding.runId ||
+        matches[0].run_attempt !== binding.runAttempt
+      )
+        throw new Error("Native worker exact job identity drift");
+      return matches[0];
+    });
+    const again = await request(`${base}/actions/runs/${binding.runId}`);
+    if (
+      again.id !== run.id ||
+      again.run_attempt !== run.run_attempt ||
+      again.status !== run.status ||
+      again.conclusion !== run.conclusion
+    )
+      throw new Error("Native worker changed during terminal readback");
+    const terminal =
+      run.status === "completed" &&
+      Boolean(run.conclusion) &&
+      selected.every(
+        (job) =>
+          job.status === "completed" && job.conclusion && job.completed_at,
+      );
+    const body = {
+      schema: "buildchain.pipeline-worker-readback/v1",
+      binding,
+      status: terminal ? "completed" : "in_progress",
+      run,
+      jobs: selected,
+    };
+    return { ...body, root: recordDigest(body) };
+  }
+  return { observe };
+}

package/packages/core/providers/github/release-evidence-assets.js

@@ -0,0 +1,97 @@
+import { createHash } from "node:crypto";
+import { recordDigest } from "../../release/discussion/envelope.js";
+
+const LIMIT = 8 * 1024 * 1024;
+
+async function inventory(request, prefix) {
+  const assets = [],
+    ids = new Set(),
+    names = new Set();
+  for (let page = 1; page <= 20; page++) {
+    const values = await request(`${prefix}/assets?per_page=100&page=${page}`);
+    if (!Array.isArray(values) || values.length > 100)
+      throw new Error("Published evidence asset inventory is incomplete");
+    for (const value of values) {
+      if (
+        !Number.isSafeInteger(value.id) ||
+        value.id < 1 ||
+        typeof value.name !== "string" ||
+        !value.name ||
+        ids.has(value.id) ||
+        names.has(value.name)
+      )
+        throw new Error("Published evidence asset inventory is ambiguous");
+      ids.add(value.id);
+      names.add(value.name);
+      assets.push(value);
+    }
+    if (values.length < 100) return assets;
+  }
+  throw new Error(
+    "Published evidence inventory exceeds its complete-read bound",
+  );
+}
+
+function selectedAssets(assets, names) {
+  return names.map((name) => {
+    const asset = assets.find((value) => value.name === name);
+    if (!asset) return { name, missing: true };
+    if (
+      asset.state !== "uploaded" ||
+      !Number.isSafeInteger(asset.size) ||
+      asset.size < 1 ||
+      asset.size > LIMIT ||
+      !/^sha256:[0-9a-f]{64}$/u.test(asset.digest || "")
+    )
+      throw new Error("Published evidence asset lacks bounded immutable bytes");
+    return { id: asset.id, name, size: asset.size, digest: asset.digest };
+  });
+}
+
+// Download only fixed evidence names from the exact already-observed release.
+// There is no caller-supplied URL, artifact selector or provider write here.
+export async function readReleaseEvidenceAssets(host, candidate, names) {
+  const repository = host.repository;
+  if (
+    !/^[\w.-]+\/[\w.-]+$/u.test(repository || "") ||
+    !Number.isSafeInteger(candidate.id) ||
+    candidate.id < 1
+  )
+    throw new Error("Published evidence requires exact release coordinates");
+  const prefix = `/repos/${repository}/releases/${candidate.id}`;
+  const selected = selectedAssets(await inventory(host.request, prefix), names);
+  const missing = selected
+    .filter((value) => value.missing)
+    .map(({ name }) => name);
+  if (missing.length) return { status: "missing", missing };
+  const [owner, repo] = repository.split("/");
+  const values = {};
+  for (const asset of selected) {
+    const result = await host.github.rest.repos.getReleaseAsset({
+      owner,
+      repo,
+      asset_id: asset.id,
+      headers: { accept: "application/octet-stream" },
+    });
+    const bytes = Buffer.from(result.data);
+    if (
+      bytes.length !== asset.size ||
+      bytes.length > LIMIT ||
+      `sha256:${createHash("sha256").update(bytes).digest("hex")}` !==
+        asset.digest
+    )
+      throw new Error(
+        "Published evidence download differs from provider bytes",
+      );
+    values[asset.name] = bytes;
+  }
+  if (
+    recordDigest(
+      selectedAssets(await inventory(host.request, prefix), names),
+    ) !== recordDigest(selected)
+  )
+    throw new Error(
+      "Published evidence assets changed during provider readback",
+    );
+  return { status: "present", values, assets: selected };
+}

package/packages/core/publication/candidate/registry-hydration.js

@@ -1,3 +1,4 @@
+import { readNpmPackResult } from "../npm/pack-result.js";
 import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
@@ -117,7 +118,7 @@ export function hydratePublishedPublicationRegistry({
   for (const version of publishedVersions) {
     const packageDir = path.join(resolvedOutputDir, `.package-${version}`);
     fs.mkdirSync(packageDir, { recursive: true });
-    const packed = JSON.parse(
+    const pack = readNpmPackResult(
       commandRunner(
         "npm",
         [
@@ -132,7 +133,6 @@ export function hydratePublishedPublicationRegistry({
         { cwd: resolvedCwd },
       ),
     );
-    const pack = Array.isArray(packed) ? packed[0] : packed;
     if (!pack?.filename || !pack?.integrity) {
       throw new Error(
         `npm pack did not report filename and integrity for ${packageName}@${version}`,

package/packages/core/publication/npm/pack-preview.js

@@ -1,6 +1,6 @@
+import { readNpmPackResult } from "./pack-result.js";
 export function summarizePackPreview(stdout) {
-  const parsed = JSON.parse(stdout);
-  const pack = Array.isArray(parsed) ? parsed[0] : parsed;
+  const pack = readNpmPackResult(stdout);
   const files = Array.isArray(pack?.files) ? pack.files : [];
   const bin = files.find((file) => file.path === "bin/buildchain.mjs");
   const fileEntries = files.map((file) => ({

package/packages/core/publication/npm/pack-result.js

@@ -0,0 +1,31 @@
+import path from "node:path";
+
+export function readNpmPackResult(stdout) {
+  const parsed = JSON.parse(stdout);
+  const entries = Array.isArray(parsed)
+    ? parsed
+    : typeof parsed?.name === "string"
+      ? [parsed]
+      : parsed && typeof parsed === "object"
+        ? Object.values(parsed)
+        : [];
+  if (entries.length !== 1)
+    throw new Error("npm pack must return exactly one package");
+  const pack = entries[0];
+  if (
+    typeof pack?.name !== "string" ||
+    !pack.name ||
+    typeof pack?.version !== "string" ||
+    !pack.version
+  ) {
+    throw new Error("npm pack did not return package name and version");
+  }
+  if (
+    typeof pack.filename !== "string" ||
+    !pack.filename.endsWith(".tgz") ||
+    /[/\\]/u.test(pack.filename) ||
+    path.basename(pack.filename) !== pack.filename
+  )
+    throw new Error("npm pack must return a local tarball filename");
+  return pack;
+}