ci: the packed-manifest check pins stand-in Lambda assets, like the publish job

The publish job adds prebuilt/handler-zip.json and prebuilt/video-image.json before verify:packed-manifests; the PR check did not, so a package could pass on the PR and fail at publish. The verifier now runs the same pin script on sparse stand-ins of release size when no pins exist, and removes them afterwards. It lives in the verifier, not a Build step, so the edit-accuracy input closure stays unchanged.

Author: miguel-heygen

scripts/verify-packed-manifests.mjs

@@ -12,6 +12,7 @@ import {
   readFileSync,
   rmSync,
   statSync,
+  truncateSync,
   writeFileSync,
 } from "node:fs";
 import { extname, join, posix } from "node:path";
@@ -605,15 +606,46 @@ function packAndVerifyWorkspace(workspace, packDir) {
   return { workspace, filename, packedPackage };
 }
 
+const LAMBDA_PIN_ASSETS = [
+  { asset: "hyperframes-lambda-handler.zip", flags: [] },
+  { asset: "hyperframes-lambda-video-arm64.oci.tar", flags: ["--video-image"] },
+];
+
+// The publish job pins the Lambda release assets before this check. Anywhere else, sparse stand-ins of release
+// size go through the same pin script, so the size check packs the file list a release publishes. Returns the cleanup.
+function pinStandInLambdaAssets() {
+  const lambda = join(PACKAGES_DIR, "aws-lambda");
+  if (existsSync(join(lambda, "prebuilt", "handler-zip.json"))) return () => {};
+  mkdirSync(join(ROOT, "dist"), { recursive: true });
+  const written = [];
+  for (const { asset, flags } of LAMBDA_PIN_ASSETS) {
+    const path = join(ROOT, "dist", asset);
+    writeFileSync(path, "");
+    truncateSync(path, 150_000_000);
+    execFileSync("bun", [join(lambda, "scripts", "pin-handler-zip.ts"), ...flags], {
+      cwd: ROOT,
+      stdio: "ignore",
+    });
+    written.push(path, path.replace(/\.[^/]*$/, ".sha256"));
+  }
+  written.push(
+    join(lambda, "prebuilt", "handler-zip.json"),
+    join(lambda, "prebuilt", "video-image.json"),
+  );
+  return () => written.forEach((path) => rmSync(path, { force: true }));
+}
+
 function main() {
   const packDir = mkdtempSync(join(tmpdir(), "hyperframes-pack-"));
+  const unpinLambda = pinStandInLambdaAssets();
   try {
     const packedWorkspaces = listWorkspacePackageDirs()
       .map((workspace) => packAndVerifyWorkspace(workspace, packDir))
       .filter(Boolean);
     verifyPackedConsumer(packDir, packedWorkspaces);
     verifyPackageSizes(packedWorkspaces);
   } finally {
+    unpinLambda();
     rmSync(packDir, { force: true, recursive: true });
   }
 }