fix(release): verify root consumers from packed tarball

[seonghobae]

Closes #291.

Exact TDD lineage

This Draft started from protected main@e8109ec2a17de8bd6594487aa12c8c8a93cb2c03 and owns only tests/package/verify-package.mjs plus src/packedRootConsumerIsolation.test.ts.

The first test-only head 1e6705ed39b18161cf874bffec5e0d3bd88710c9 failed during test setup because the regression used import.meta.url; that attempt is rejected as product evidence. Corrected test-only head 065346eb01a7ee4740ce4086c6cc15e8d91a7114 produced qualifying hosted RED in CI 31653280023, build job 94302080690: exact checkout, immutable installation, typecheck, and the pre-existing suite completed before the dedicated contract failed exactly because the protected verifier used npm pack --dry-run and repository self-reference instead of one extracted tarball and isolated consumer tree.

The first implementation head e9cf52a92ec14acd1f9330de04503fbd3d4f9dd3 made a real tarball and extracted it beneath a temporary node_modules, but CI 31654244618 failed at the explicit ESM resolution assertion after 144 test files / 828 tests, exact 100% owned-production coverage, builds, browser, and Office evidence had passed. RCA: because the temporary consumer was still nested beneath the repository package scope, Node package self-reference resolved the Inkspan package name back to the checkout. Security Scan 31654244629 and SAST 31654244643 were successful; the failed package assertion was retained as new evidence.

Current narrow repair

Current exact head is e0da9e3fa6a3f8dca13fa929532ba4dd6afa1ffa against live base main@e8109ec2a17de8bd6594487aa12c8c8a93cb2c03.

The verifier now:

• creates one real npm pack --json --ignore-scripts --pack-destination archive;
• validates package name, version, filename, required files, export targets, and development-file exclusions from that exact archive's metadata;
• extracts those exact bytes under an isolated consumer node_modules/@contextualwisdomlab/cwl-editor tree;
• writes a distinct nearest consumer package.json so Node package self-reference cannot inherit the repository package scope;
• executes ESM and CommonJS root/subpath consumers from that consumer directory and asserts their resolved entrypoints are beneath the isolated package tree;
• compiles a strict NodeNext TypeScript consumer against the extracted public declarations;
• uses no registry installation, workspace link, lifecycle script, second package build, network, credential, database, model, or host-owned deployment authority; and
• removes the temporary archive and consumer tree deterministically.

Exact-head proof

For unchanged head e0da9e3fa6a3f8dca13fa929532ba4dd6afa1ffa:

• CI 31655236773: success. Build job 94308194295 checked out the exact head, completed immutable setup/typecheck, passed 144 test files / 828 tests and exact 100% owned-production statement/branch/function/line coverage, built every library, verified the exact npm tarball with isolated ESM/CommonJS/strict-TypeScript consumers, passed the remaining package verifiers, and built the standalone demo.
• Browser job 94308194250: Chromium, Firefox, and WebKit success.
• Office jobs 94308194318, 94308194332, 94308194273, and 94308194282: Python 3.11–3.14 success with the applicable branch/docstring gates.
• Security Scan 31655236736: success.
• SAST Semgrep 31655236761: success.
• CodeRabbit commit status: success/status-only and not treated as independent approval.
• Formal reviews: 0. Valid unresolved review threads: 0.
• GitHub reports the Draft mergeable. No predecessor evidence transfers and it remains intentionally unmerged.

Integration boundary

Keep Draft/unmerged while #118 owns exact v0.6.0 publication from unchanged protected main. This next-release release-evidence repair is not represented as protected-main behavior or shipped evidence.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ae28b4e7-46a3-4168-b9ac-f65bc97d590d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}