@capybara-hq/plugin-tools 0.1.0-rc.0 → 0.1.0-rc.2

package/README.md

@@ -14,8 +14,6 @@ npm install --save-dev @capybara-hq/plugin-tools
 
 ```bash
 capybara-plugin pack [<dir>...] [--all <root>] [--out <dir>]
-capybara-plugin pack --bootstrap <manifest> [--root <dir>] [--out <dir>] [--registry <url>]
-                     [--npm-token <token>]
 capybara-plugin check [--root <dir>] [--plugins <glob>] [--base <ref>]
 capybara-plugin sync-versions [--root <dir>] [--plugins <glob>]
 capybara-plugin marketplace --write|--check [--base <rev>] [--root <dir>] [--file <path>]
@@ -30,12 +28,8 @@ capybara-plugin release [--dry-run] [--provenance] [--out <dir>] [--auto] [--roo
   manifest written into `plugin.json`, LICENSE / NOTICE and the bundled dependencies' notices
   included. A plugin with an extension gets `"main"` and `"exports": { ".": "./dist/index.mjs" }`,
   so once installed it resolves by package name (a test loads `@capybara-hq/plugin-model-fake`
-  from npm). `--all <root>` packs every plugin of a repository; `--bootstrap` packs the entries of
-  a bootstrap manifest (workspace entries from the repository, npm entries downloaded from
-  `--registry`, default `CAPYBARA_PACKAGES__NPM_REGISTRY` or the public registry, with
-  `--npm-token` / `CAPYBARA_PACKAGES__NPM_TOKEN` sent to the registry origin only, tarballs capped
-  at 50 MiB) and checks them against their pinned sha512 and their `package.json` name and version.
-  Output: `artifacts/plugins`.
+  from npm). `--all <root>` packs every plugin of a repository. Output: `artifacts/plugins`. (The
+  bootstrap plugins a kernel pins are no longer packed here: a starting kernel downloads them.)
 - **check**: every plugin check, on the plugins under `<root>/plugins/*` (or `--plugins <glob>`, or
   the root itself when it is a plugin): the dependency boundary (a plugin depends only on
   `@capybara-hq/plugin-sdk` and third-party packages), extension state under multiple replicas (no
@@ -93,9 +87,15 @@ export default defineConfig({
 });
 ```
 
+Dual-replica tests (`createDualReplicaHarness`) need nothing more: each replica is a child
+process outside vitest, and `@capybara-hq/testing` runs it under its own tsx when an extension
+entry is a TypeScript file (the plugin under test by path, `fakeExtensionEntry(...)`). Do not set
+`NODE_OPTIONS: "--import tsx"` in the vitest config: it reaches every worker and child process
+and hides packaging bugs.
+
 ## Library
 
-The same code as functions: `packPlugin`, `packBootstrap`, `pluginChecks` / `runChecks` and each
+The same code as functions: `packPlugin`, `downloadPinnedNpmPackage`, `pluginChecks` / `runChecks` and each
 check (`checkDeps`, `checkPluginState`, `checkPluginPermissions`, `checkPluginPack`,
 `checkToolDesign`, `checkMigrations`, `checkAppliedMigrations`, `checkPluginTestImports`,
 `checkPluginReleaseMetadata`), `syncPluginVersions` (after `changeset version`),

package/bin/capybara-plugin.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // The `capybara-plugin` bin: runs the compiled CLI (dist/cli.js, built by `tsc -b`). In this
-// repository, the root scripts (pnpm pack-plugin, pack-plugins, pack-bootstrap, release) run the
+// repository, the root scripts (pnpm pack-plugin, pack-plugins, release) run the
 // TypeScript sources through tsx instead.
 import { existsSync } from "node:fs";
 

package/dist/cli.js

@@ -2,8 +2,6 @@
  * `capybara-plugin`: pack, check, sync the versions of and release Capybara plugins.
  *
  *   capybara-plugin pack [<dir>...] [--all <root>] [--out <dir>]
- *   capybara-plugin pack --bootstrap <manifest> [--root <dir>] [--out <dir>] [--registry <url>]
- *                        [--npm-token <token>]
  *   capybara-plugin check [--root <dir>] [--plugins <glob>] [--base <ref>]
  *   capybara-plugin sync-versions [--root <dir>] [--plugins <glob>]
  *   capybara-plugin marketplace --write|--check [--base <rev>] [--root <dir>] [--file <path>]

package/dist/pack/cli.d.ts

@@ -1,19 +1,12 @@
-export declare const PACK_USAGE: string;
+export declare const PACK_USAGE = "capybara-plugin pack [<dir>...] [--all <root>] [--out <dir>]";
 /**
  * `capybara-plugin pack`: packs plugin directories into plugin tgz files.
  *
  * - `<dir>...`: the plugin directories to pack;
  * - `--all <root>`: also every plugin of the repository at `<root>` (`<root>/plugins/*`, or `<root>`
  *   itself when it is a plugin);
- * - `--bootstrap <manifest>`: the bootstrap directory an image bakes: every entry of the bootstrap
- *   manifest as `<name>-<version>.tgz`, checked against its pins (workspace entries' `path` is
- *   relative to `--root`, default the current directory; npm entries are downloaded from
- *   `--registry`, default `CAPYBARA_PACKAGES__NPM_REGISTRY` (the kernel's `packages.npmRegistry`)
- *   or else the public npm registry, and must match their pinned sha512; `--npm-token`, default
- *   `CAPYBARA_PACKAGES__NPM_TOKEN` (the kernel's `packages.npmToken`), is sent as a Bearer token to
- *   the registry origin only);
- * - `--out <dir>`: output directory, default `artifacts/plugins` (`artifacts/bootstrap` with
- *   `--bootstrap`) under the current directory. The last `--out` wins.
+ * - `--out <dir>`: output directory, default `artifacts/plugins` under the current directory. The
+ *   last `--out` wins.
  *
  * Relative paths resolve against `cwd` (the current directory). Returns the exit code.
  */

package/dist/pack/cli.js

@@ -1,27 +1,16 @@
 import { relative, resolve } from "node:path";
 import { parseArgs } from "node:util";
 import { discoverPlugins } from "../discover.js";
-import { packBootstrap } from "./bootstrap.js";
-import { DEFAULT_NPM_REGISTRY } from "./npm.js";
 import { packPlugin } from "./pack.js";
-export const PACK_USAGE = "capybara-plugin pack [<dir>...] [--all <root>] [--out <dir>]\n" +
-    "       capybara-plugin pack --bootstrap <manifest> [--root <dir>] [--out <dir>] [--registry <url>]\n" +
-    "                                [--npm-token <token>]";
+export const PACK_USAGE = "capybara-plugin pack [<dir>...] [--all <root>] [--out <dir>]";
 /**
  * `capybara-plugin pack`: packs plugin directories into plugin tgz files.
  *
  * - `<dir>...`: the plugin directories to pack;
  * - `--all <root>`: also every plugin of the repository at `<root>` (`<root>/plugins/*`, or `<root>`
  *   itself when it is a plugin);
- * - `--bootstrap <manifest>`: the bootstrap directory an image bakes: every entry of the bootstrap
- *   manifest as `<name>-<version>.tgz`, checked against its pins (workspace entries' `path` is
- *   relative to `--root`, default the current directory; npm entries are downloaded from
- *   `--registry`, default `CAPYBARA_PACKAGES__NPM_REGISTRY` (the kernel's `packages.npmRegistry`)
- *   or else the public npm registry, and must match their pinned sha512; `--npm-token`, default
- *   `CAPYBARA_PACKAGES__NPM_TOKEN` (the kernel's `packages.npmToken`), is sent as a Bearer token to
- *   the registry origin only);
- * - `--out <dir>`: output directory, default `artifacts/plugins` (`artifacts/bootstrap` with
- *   `--bootstrap`) under the current directory. The last `--out` wins.
+ * - `--out <dir>`: output directory, default `artifacts/plugins` under the current directory. The
+ *   last `--out` wins.
  *
  * Relative paths resolve against `cwd` (the current directory). Returns the exit code.
  */
@@ -33,10 +22,6 @@ export async function packCommand(args, cwd) {
             help: { type: "boolean", short: "h", default: false },
             all: { type: "string" },
             out: { type: "string" },
-            bootstrap: { type: "string" },
-            root: { type: "string" },
-            registry: { type: "string" },
-            "npm-token": { type: "string" },
         },
     });
     if (values.help) {
@@ -48,28 +33,6 @@ export async function packCommand(args, cwd) {
         const rel = relative(cwd, p);
         return rel === "" ? "." : rel.startsWith("..") ? p : rel;
     };
-    if (values.bootstrap !== undefined) {
-        if (values.all !== undefined || positionals.length > 0) {
-            return usage("--bootstrap takes no plugin directory");
-        }
-        try {
-            const root = values.root === undefined ? cwd : resolve(cwd, values.root);
-            const manifest = resolve(cwd, values.bootstrap);
-            const registry = values.registry ?? (process.env.CAPYBARA_PACKAGES__NPM_REGISTRY || DEFAULT_NPM_REGISTRY);
-            const token = values["npm-token"] ?? process.env.CAPYBARA_PACKAGES__NPM_TOKEN;
-            for (const p of await packBootstrap(manifest, root, outOf("artifacts/bootstrap"), {
-                registry,
-                ...(token !== undefined && token !== "" && { token }),
-            })) {
-                console.log(`${shown(p.file)}  ${p.integrity}`);
-            }
-            return 0;
-        }
-        catch (e) {
-            console.error(e instanceof Error ? e.message : String(e));
-            return 1;
-        }
-    }
     const plugins = positionals.map((d) => resolve(cwd, d));
     if (values.all !== undefined) {
         const root = resolve(cwd, values.all);

package/dist/pack/index.d.ts

@@ -1,4 +1,3 @@
-export { type BootstrapPack, packBootstrap } from "./bootstrap.js";
 export { PACK_USAGE, packCommand } from "./cli.js";
 export { assertNpmTarballLabel, DEFAULT_NPM_REGISTRY, downloadPinnedNpmPackage, fetchNpmTarball, NPM_TARBALL_MAX_BYTES, type NpmFetchOptions, NpmPackageError, type NpmPackageErrorKind, } from "./npm.js";
 export { METADATA_FIELDS, NOTICES_FILE, type PackResult, packPlugin, STAGING_PREFIX, } from "./pack.js";

package/dist/pack/index.js

@@ -1,4 +1,3 @@
-export { packBootstrap } from "./bootstrap.js";
 export { PACK_USAGE, packCommand } from "./cli.js";
 export { assertNpmTarballLabel, DEFAULT_NPM_REGISTRY, downloadPinnedNpmPackage, fetchNpmTarball, NPM_TARBALL_MAX_BYTES, NpmPackageError, } from "./npm.js";
 export { METADATA_FIELDS, NOTICES_FILE, packPlugin, STAGING_PREFIX, } from "./pack.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/plugin-tools",
-  "version": "0.1.0-rc.0",
+  "version": "0.1.0-rc.2",
   "description": "Capybara plugin toolchain: the capybara-plugin CLI to pack, check and release Capybara plugins",
   "license": "Apache-2.0",
   "repository": {
@@ -51,12 +51,12 @@
     "esbuild": "0.28.2",
     "oxc-parser": "^0.154.0",
     "tar-stream": "3.2.2",
-    "@capybara-hq/kernel": "^0.1.0-rc.0",
+    "@capybara-hq/kernel": "^0.1.0-rc.1",
     "@capybara-hq/plugin-sdk": "^0.1.0-rc.0"
   },
   "devDependencies": {
     "zod": "^4.6.7",
-    "@capybara-hq/testing": "0.1.0-rc.0"
+    "@capybara-hq/testing": "0.1.0-rc.2"
   },
   "scripts": {
     "build": "tsc -b"

package/dist/pack/bootstrap.d.ts

@@ -1,25 +0,0 @@
-import { type NpmFetchOptions } from "./npm.js";
-/** One package {@link packBootstrap} wrote. */
-export interface BootstrapPack {
-    name: string;
-    version: string;
-    file: string;
-    integrity: string;
-}
-/**
- * Produces the bootstrap directory the image bakes (package ecosystem spec §7): every entry of the
- * bootstrap manifest (`packages/kernel/bootstrap.json`) as `<outDir>/<name>-<version>.tgz`. A
- * `source: "workspace"` entry is packed from `<repoRoot>/<path>` with {@link packPlugin}
- * (byte-reproducible) and must equal the entry: the plugin name, the version and the pinned sha512,
- * otherwise this throws naming the plugin and writes nothing for it (the image build fails rather
- * than baking a package `capybara bootstrap` would refuse). A `source: "npm"` entry is downloaded
- * from `opts.registry` (default the public npm registry, the kernel's `packages.npmRegistry`
- * default; `opts.token` goes to the registry origin only) and written only when its bytes match
- * the pinned sha512 and its package.json names the entry's package and version; a tampered,
- * mislabelled or oversized (`bootstrap.too_large`) tarball or an unpublished package or version
- * throws naming the plugin. So npm entries need the network at
- * build time only: init installs from the baked directory and never downloads.
- */
-export declare function packBootstrap(manifestFile: string, repoRoot: string, outDir: string, opts?: {
-    registry?: string;
-} & NpmFetchOptions): Promise<BootstrapPack[]>;

package/dist/pack/bootstrap.js

@@ -1,70 +0,0 @@
-import { copyFile, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { bootstrapFileName, parseBootstrapManifest } from "@capybara-hq/plugin-sdk";
-import { integrityOf } from "../integrity.js";
-import { DEFAULT_NPM_REGISTRY, downloadPinnedNpmPackage } from "./npm.js";
-import { packPlugin } from "./pack.js";
-/**
- * Produces the bootstrap directory the image bakes (package ecosystem spec §7): every entry of the
- * bootstrap manifest (`packages/kernel/bootstrap.json`) as `<outDir>/<name>-<version>.tgz`. A
- * `source: "workspace"` entry is packed from `<repoRoot>/<path>` with {@link packPlugin}
- * (byte-reproducible) and must equal the entry: the plugin name, the version and the pinned sha512,
- * otherwise this throws naming the plugin and writes nothing for it (the image build fails rather
- * than baking a package `capybara bootstrap` would refuse). A `source: "npm"` entry is downloaded
- * from `opts.registry` (default the public npm registry, the kernel's `packages.npmRegistry`
- * default; `opts.token` goes to the registry origin only) and written only when its bytes match
- * the pinned sha512 and its package.json names the entry's package and version; a tampered,
- * mislabelled or oversized (`bootstrap.too_large`) tarball or an unpublished package or version
- * throws naming the plugin. So npm entries need the network at
- * build time only: init installs from the baked directory and never downloads.
- */
-export async function packBootstrap(manifestFile, repoRoot, outDir, opts = {}) {
-    const parsed = parseBootstrapManifest(JSON.parse(await readFile(manifestFile, "utf8")));
-    if ("errors" in parsed) {
-        throw new Error(`invalid bootstrap manifest ${manifestFile}: ${parsed.errors.join("; ")}`);
-    }
-    await mkdir(outDir, { recursive: true });
-    const staging = await mkdtemp(join(tmpdir(), "pack-bootstrap-"));
-    const out = [];
-    try {
-        for (const e of parsed.plugins) {
-            if (e.source === "npm") {
-                let bytes;
-                try {
-                    bytes = await downloadPinnedNpmPackage(e, opts.registry ?? DEFAULT_NPM_REGISTRY, {
-                        ...(opts.token !== undefined && { token: opts.token }),
-                        ...(opts.maxBytes !== undefined && { maxBytes: opts.maxBytes }),
-                    });
-                }
-                catch (err) {
-                    throw new Error(`${e.name}: ${err instanceof Error ? err.message : String(err)}`, {
-                        cause: err,
-                    });
-                }
-                const file = join(outDir, bootstrapFileName(e));
-                await writeFile(file, bytes);
-                out.push({ name: e.name, version: e.version, file, integrity: e.integrity });
-                continue;
-            }
-            const r = await packPlugin(join(repoRoot, e.path), staging);
-            const integrity = integrityOf(new Uint8Array(await readFile(r.file)));
-            const problems = [
-                r.manifest.name !== e.name && `${e.path} packs the plugin "${r.manifest.name}"`,
-                r.manifest.version !== e.version &&
-                    `version is ${e.version} but ${e.path} packs ${r.manifest.version}`,
-                integrity !== e.integrity && `integrity is ${e.integrity} but ${e.path} packs ${integrity}`,
-            ].filter((p) => typeof p === "string");
-            if (problems.length > 0) {
-                throw new Error(`${e.name}: ${problems.join("; ")}; the bootstrap manifest is stale (pnpm check:bootstrap --write)`);
-            }
-            const file = join(outDir, bootstrapFileName(e));
-            await copyFile(r.file, file);
-            out.push({ name: e.name, version: e.version, file, integrity });
-        }
-    }
-    finally {
-        await rm(staging, { recursive: true, force: true });
-    }
-    return out;
-}