Fix OpenTUI native integrity lockfile lookup

bun.lock nests native package version pins under @opentui/core
optionalDependencies on the same line as core's sha512. Matching the
package name alone selected that wrong hash and broke cross-compile
fetches. Require the packages-array entry shape so integrity checks
the native tarball hash.

Fixes CL-7117

Author: TheGreatAxios

CHANGELOG.md

@@ -18,7 +18,9 @@ parallel copies under `docs/` or `scripts/notes/`. At cut time: rename
 - Direct macOS release binaries are now signed with hardened-runtime Bun
   entitlements and notarized for both architectures. Publication fails closed
   unless the final tarballs pass signature, signer, Team ID, entitlement,
-  architecture, and Gatekeeper validation.
+  architecture, and Gatekeeper validation, the release Mac completes a
+  host-native signed OpenTUI smoke, and cross-compiled OpenTUI native packages
+  match their bun.lock packages-array integrity before unpack.
 
 ## [0.3.7] - 2026-08-27
 

docs/RELEASING.md

@@ -6,7 +6,9 @@ update the Homebrew tap unless both macOS binaries are freshly built, signed,
 host-native OpenTUI-smoked on the release Mac, notarized, and validated from their
 final tarballs. Cross-compiled opposite-arch macOS binaries still require signature,
 notarization, and final-tarball verification, but they are never counted as
-host-native smoke.
+host-native smoke. Cross-compile OpenTUI native package fetches must match the
+bun.lock packages-array integrity hash before unpack; nested optionalDependencies
+pins are ignored for that check.
 
 ## Apple provisioning
 

scripts/fetch-opentui-native.sh

@@ -28,7 +28,10 @@ for tool in curl openssl tar awk mkdir rm; do
   command -v "$tool" >/dev/null 2>&1 || fail "missing tool: $tool"
 done
 
-integrity=$(awk -v key="\"@opentui/${pkg}\":" '
+# Match the packages-array entry ("@opentui/pkg": [ ... "sha512-..." ]), not a
+# nested optionalDependencies version pin that shares the same package name on
+# @opentui/core's line and would otherwise yield core's integrity hash.
+integrity=$(awk -v key="\"@opentui/${pkg}\": [" '
   index($0, key) && match($0, /"sha512-[^"]+"/) {
     print substr($0, RSTART + 1, RLENGTH - 2)
     exit

tests/unit/release-native-validation.test.ts

@@ -151,4 +151,101 @@ cp "${tarball}" "$out"
     expect(result.stderr.toString()).toMatch(/integrity|checksum|sha512/i);
     expect(await Bun.file(join(dest, "package.json")).exists()).toBe(false);
   });
+
+  test("packages-array hash wins over nested optionalDependencies false match", async () => {
+    const { directory, binDirectory } = await createStubBinDirectory();
+    const lockfile = join(directory, "bun.lock");
+    const dest = join(directory, "node_modules/@opentui/core-darwin-arm64");
+    const packageRoot = join(directory, "package");
+    const tarball = join(directory, "core-darwin-arm64-0.5.1.tgz");
+    await mkdir(packageRoot);
+    await writeFile(
+      join(packageRoot, "package.json"),
+      JSON.stringify({ name: "@opentui/core-darwin-arm64", version: "0.5.1" }),
+    );
+    const packed = Bun.spawnSync({
+      cmd: ["tar", "-czf", tarball, "-C", directory, "package"],
+      cwd: directory,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    expect(packed.exitCode).toBe(0);
+
+    const digest = Bun.spawnSync({
+      cmd: ["openssl", "dgst", "-sha512", "-binary", tarball],
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    expect(digest.exitCode).toBe(0);
+    const packagesHash = `sha512-${Buffer.from(digest.stdout).toString("base64")}`;
+    const coreFalseMatchHash =
+      "sha512-mIBFyqIP4rkhQ35uldLXWawWQ6S9tvNWvmxGmDJ7W9cLXjegG6gKEfZ/4NyIMma755ERs/sqO/pIh3Ytf3DDFg==";
+    expect(packagesHash).not.toBe(coreFalseMatchHash);
+
+    await writeFile(
+      lockfile,
+      `{
+  "packages": {
+    "@opentui/core": ["@opentui/core@0.5.1", "", { "optionalDependencies": { "@opentui/core-darwin-arm64": "0.5.1", "@opentui/core-darwin-x64": "0.5.1" } }, "${coreFalseMatchHash}"],
+    "@opentui/core-darwin-arm64": ["@opentui/core-darwin-arm64@0.5.1", "", { "os": "darwin", "cpu": "arm64" }, "${packagesHash}"],
+  }
+}
+`,
+    );
+    await writeFile(
+      join(binDirectory, "curl"),
+      `#!/bin/sh
+set -eu
+out=""
+prev=""
+for arg in "$@"; do
+  if [ "$prev" = "-o" ]; then out="$arg"; fi
+  prev="$arg"
+done
+[ -n "$out" ]
+cp "${tarball}" "$out"
+`,
+    );
+    await chmod(join(binDirectory, "curl"), 0o755);
+
+    const accept = Bun.spawnSync({
+      cmd: ["bash", fetchOpentui, "core-darwin-arm64", "0.5.1", dest, lockfile],
+      cwd: root,
+      env: {
+        ...process.env,
+        PATH: `${binDirectory}:${process.env.PATH ?? ""}`,
+      },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    expect(accept.exitCode).toBe(0);
+    expect(await Bun.file(join(dest, "package.json")).exists()).toBe(true);
+
+    await rm(dest, { recursive: true, force: true });
+    const wrongPackagesHash =
+      "sha512-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==";
+    await writeFile(
+      lockfile,
+      `{
+  "packages": {
+    "@opentui/core": ["@opentui/core@0.5.1", "", { "optionalDependencies": { "@opentui/core-darwin-arm64": "0.5.1" } }, "${packagesHash}"],
+    "@opentui/core-darwin-arm64": ["@opentui/core-darwin-arm64@0.5.1", "", { "os": "darwin", "cpu": "arm64" }, "${wrongPackagesHash}"],
+  }
+}
+`,
+    );
+    const reject = Bun.spawnSync({
+      cmd: ["bash", fetchOpentui, "core-darwin-arm64", "0.5.1", dest, lockfile],
+      cwd: root,
+      env: {
+        ...process.env,
+        PATH: `${binDirectory}:${process.env.PATH ?? ""}`,
+      },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    expect(reject.exitCode).not.toBe(0);
+    expect(reject.stderr.toString()).toMatch(/integrity|checksum|sha512/i);
+    expect(await Bun.file(join(dest, "package.json")).exists()).toBe(false);
+  });
 });