fix: cover every tracked release input

tests/unit/release-artifacts.test.ts

@@ -130,6 +130,20 @@ describe("release artifact contracts", () => {
     },
   );
 
+  it("requires the canonical Vite manifest declared by the build writer", async () => {
+    const mismatches = await verifyBuildManifestOutputs(
+      {
+        ...buildManifest,
+        outputs: {
+          ...buildManifest.outputs,
+          viteManifest: "dist/.vite/tampered-manifest.json",
+        },
+      },
+      { repositoryRoot: process.cwd() },
+    );
+    expect(mismatches).toContain("buildManifest:viteManifest:path");
+  });
+
   it("rejects a realpath escape from a declared build output", async () => {
     const mismatches = await verifyBuildManifestOutputs(buildManifest, {
       repositoryRoot: "/repo",
@@ -167,6 +181,39 @@ describe("release artifact contracts", () => {
     expect(mismatches).toContain("buildManifest:routeChunk:route-home:path");
   });
 
+  it("allows a legal dist child whose name begins with two dots", async () => {
+    const moduleInventoryBytes = Buffer.from(
+      '{"schemaVersion":1,"chunks":[]}\n',
+    );
+    const files = new Map<string, Buffer>([
+      ["/repo/dist/.vite/manifest.json", Buffer.from("{}\n")],
+      ["/repo/artifacts/quality/vite-module-inventory.json", moduleInventoryBytes],
+      ["/repo/dist/runtime-config.schema.json", Buffer.from("{}\n")],
+      ["/repo/dist/..assets/home.js", Buffer.from("chunk\n")],
+    ]);
+    const mismatches = await verifyBuildManifestOutputs(
+      {
+        ...buildManifest,
+        moduleInventoryHash: createHash("sha256")
+          .update(moduleInventoryBytes)
+          .digest("hex"),
+        outputs: {
+          ...buildManifest.outputs,
+          routeChunks: { "route-home": "..assets/home.js" },
+        },
+      },
+      {
+        repositoryRoot: "/repo",
+        readBytes: async (target) =>
+          files.get(target) ?? Promise.reject(new Error("missing")),
+        realpathPath: async (target) => target,
+        assertRegularFile: async () => undefined,
+        assertDirectory: async () => undefined,
+      },
+    );
+    expect(mismatches).toEqual([]);
+  });
+
   it.each([
     ["viteManifest", "package.json"],
     ["runtimeConfigSchema", "schemas/artifacts/build-manifest.schema.json"],