UPM Export Integrity Guard

A UPM package can look correct in its source folder while the exact tarball

you plan to publish contains different bytes, excludes an important file,

keeps a stale identity, or introduces ownership conflicts. Pack-ignore rules,

generated output, duplicated metadata, and last-minute version changes make

manual review easy to miss.

UPM Export Integrity Guard compares the authored package root with the exact

exported `.tgz` in one read-only Unity Editor window.

### Compare the exact artifact

- Inventory source and tarball paths.

- Compare file sizes and SHA-256 hashes.

- Report source-only, artifact-only, and changed files separately.

- Normalize archive paths and reject traversal, rooted, network, drive, and

  invalid path forms instead of trusting unsafe entries.

### Check package identity

- Compare the technical package name and version from both `package.json`

  files.

- Verify declared sample paths exist and contain files.

- Find duplicate assembly names, duplicate `.meta` GUID ownership, and

  duplicate archive paths.

### Export repeatable evidence

- Save deterministic JSON and Markdown reports.

- Run the same scan in batch mode for CI or release scripts.

- Distinguish clean, warning, error, and invalid-invocation outcomes with

  stable exit codes.

### Read-only by design

The tool does not repair, delete, upload, publish, modify a registry, resolve

dependencies, or change the selected source folder or archive. It has no

Player component, network service, account requirement, telemetry, or runtime

dependency.

### Tested compatibility

The exact version 1.0.0 traditional package was imported and compiled on

Windows with Unity `2022.3.62f1c1`. Its clean-host import, 13 integration

checks, batch results, documentation, package contents, and official Unity

Asset Store validator result were independently reviewed.

Other Unity versions, macOS, Linux, Package Manager installation of this

store-delivered package, and formal store-delivered installation are not

claimed as tested.

### Important scope

This product is an integrity preflight, not a complete UPM release

certification. It does not compile or run the inspected `.tgz`, validate its

dependencies, judge licensing, prove registry behavior, or guarantee Asset

Store or package-registry approval. Finish with a clean tarball import,

declared tests, and the official tools required by your target registry or

marketplace.