@celilo/e2e 0.9.2 → 0.10.0

package/scripts/pack-celilo-packages.ts

@@ -6,21 +6,21 @@
  * install.sh runs:
  *   bun add -g @celilo/cli @celilo/event-bus @celilo/e2e
  *
- * Their transitive @celilo/* dependency closure is:
- *   @celilo/cli         → @celilo/capabilities, @celilo/cli-display, @celilo/event-bus
- *   @celilo/event-bus   → (none)
- *   @celilo/e2e         → @celilo/cli-display, @celilo/event-bus
- *   @celilo/capabilities → (none)
- *   @celilo/cli-display → (none)
+ * Which packages must land in the simulator is the transitive runtime closure
+ * of those roots — DERIVED from the live workspace by `installClosure()`, never
+ * hand-listed here. A hand-maintained list is exactly what turned this red for
+ * days when `@celilo/core` was added as a cli dep and forgotten
+ * (apps/celilo/designs/WORKSPACE_PACKAGE_GRAPH.md).
  *
- * So 5 workspace packages need to land in the simulator. We rewrite each
- * package's `workspace:^` deps to concrete `^<workspace-version>` ranges
- * OURSELVES before `bun pm pack` — we do NOT rely on bun's lock-based
- * expansion, which goes stale after a cross-caret version bump and pins
- * dependents to an unresolvable old range (ISS-0103: a `0.3→0.4`
+ * We rewrite each packed package's `workspace:^` deps to concrete
+ * `^<workspace-version>` ranges OURSELVES before `bun pm pack` — we do NOT rely
+ * on bun's lock-based expansion, which goes stale after a cross-caret version
+ * bump and pins dependents to an unresolvable old range (ISS-0103: a `0.3→0.4`
  * capabilities bump left the lock at 0.3, so packed cli pinned
- * `^0.3.0-alpha.0`, excluding the 0.4.x the sim served). package.json is
- * restored after packing so `workspace:^` stays in source.
+ * `^0.3.0-alpha.0`, excluding the 0.4.x the sim served). The rewrite map is the
+ * FULL workspace version map (every @celilo/* package), so any `workspace:` dep
+ * that can't be resolved is a genuine error and throws (see rewriteWorkspacePins).
+ * package.json is restored after packing so `workspace:^` stays in source.
  *
  * Output directory is typically `packages/e2e/.npm-registry-cache/` —
  * staged into the npm-registry-sim Docker image at build time.
@@ -30,11 +30,53 @@
  */
 
 import { execSync } from 'node:child_process';
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import {
+  installClosure,
+  readWorkspace,
+  workspaceVersionMap,
+} from '../../../scripts/workspace-graph';
 import { ensureRegistryServerBundle } from '../src/registry-bundle';
 
-const REPO_ROOT = join(import.meta.dir, '..', '..', '..');
+/**
+ * Resolve the celilo monorepo root by walking up from `startDir` (the caller's
+ * cwd by default) looking for `apps/celilo/package.json`.
+ *
+ * This replaces a hardcoded `join(import.meta.dir, '..', '..', '..')`. That
+ * derivation assumed the script always lives at `<repo>/packages/e2e/scripts/`,
+ * which holds in a checkout and nowhere else: the script ships inside the
+ * published `@celilo/e2e` tarball, where `../../..` resolves to the consumer's
+ * `node_modules/` and every path built from it points at
+ * `node_modules/apps/celilo/...` → ENOENT (ce-dae). `build.ts` already spawns
+ * this script with `cwd: <repoRoot>`, so the caller is the single source of
+ * truth for where the workspace is — take it from there, don't re-derive it.
+ * Walking up (rather than requiring cwd to BE the root exactly) also lets it run
+ * from a subdir of the checkout, e.g. `bun test` from `packages/e2e`.
+ */
+export function resolveRepoRoot(startDir: string = process.cwd()): string {
+  let dir = startDir;
+  for (let i = 0; i < 10; i++) {
+    if (existsSync(join(dir, 'apps', 'celilo', 'package.json'))) return dir;
+    const parent = resolve(dir, '..');
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error(
+    `pack-celilo-packages: no celilo checkout found from '${startDir}' (looked for apps/celilo/package.json walking up). This is a monorepo-internal dev script — run it from a checkout via 'cele2e build-infra'.`,
+  );
+}
+
+// Lazily memoized so importing this module (e.g. the rewriteWorkspacePins unit
+// test) never triggers resolution — only the packing path, which runs inside a
+// checkout, resolves the root.
+let _repoRoot: string | undefined;
+function repoRoot(): string {
+  if (_repoRoot === undefined) {
+    _repoRoot = resolveRepoRoot();
+  }
+  return _repoRoot;
+}
 
 interface PackageJson {
   name?: string;
@@ -83,7 +125,14 @@ export function rewriteWorkspacePins(
     for (const [name, spec] of Object.entries(deps)) {
       if (!spec.startsWith('workspace:')) continue;
       const version = versions.get(name);
-      if (!version) continue;
+      if (!version) {
+        throw new Error(
+          `Cannot rewrite ${bucket} "${name}": "${spec}" — ${name} is not a known ` +
+            `@celilo/* workspace package. Add it to the workspace, or fix the dep name. ` +
+            `(This is the loud failure the old hardcoded pack list lacked — ` +
+            `see apps/celilo/designs/WORKSPACE_PACKAGE_GRAPH.md.)`,
+        );
+      }
       const range = spec.slice('workspace:'.length);
       let newSpec: string;
       if (range === '*' || range === '') newSpec = '*';
@@ -98,27 +147,12 @@ export function rewriteWorkspacePins(
   return rewrites;
 }
 
-/**
- * Workspace packages that install.sh's transitive @celilo/* closure depends
- * on. Hardcoded by name → relative path so a typo in package.json or a future
- * rename gets caught at build time rather than at test time. If a new
- * @celilo/* workspace package becomes a runtime dep of cli/event-bus/e2e,
- * add it here.
- */
-const PACKAGES_TO_PACK = [
-  { name: '@celilo/cli', path: 'apps/celilo' },
-  { name: '@celilo/capabilities', path: 'packages/capabilities' },
-  { name: '@celilo/cli-display', path: 'packages/cli-display' },
-  { name: '@celilo/e2e', path: 'packages/e2e' },
-  { name: '@celilo/event-bus', path: 'packages/event-bus' },
-] as const;
-
 interface CliArgs {
   destination: string;
 }
 
 function parseArgs(): CliArgs {
-  const defaultDest = join(REPO_ROOT, 'packages', 'e2e', '.npm-registry-cache');
+  const defaultDest = join(repoRoot(), 'packages', 'e2e', '.npm-registry-cache');
   let destination = defaultDest;
   for (const arg of process.argv.slice(2)) {
     if (arg.startsWith('--dest=')) {
@@ -132,7 +166,7 @@ function parseArgs(): CliArgs {
 }
 
 function pack(pkgPath: string, destination: string, versions: Map<string, string>): string {
-  const fullPath = join(REPO_ROOT, pkgPath);
+  const fullPath = join(repoRoot(), pkgPath);
   const pkgJsonPath = join(fullPath, 'package.json');
   if (!existsSync(pkgJsonPath)) {
     throw new Error(`No package.json in ${fullPath}`);
@@ -173,13 +207,6 @@ function pack(pkgPath: string, destination: string, versions: Map<string, string
   }
 }
 
-function workspaceVersion(pkgPath: string): string {
-  const json = JSON.parse(readFileSync(join(REPO_ROOT, pkgPath, 'package.json'), 'utf-8')) as {
-    version: string;
-  };
-  return json.version;
-}
-
 function main(): void {
   const { destination } = parseArgs();
 
@@ -195,22 +222,23 @@ function main(): void {
   // "published without its registry-server bundle"). Regenerate it from the
   // sibling packages/registry-server before packing, exactly as buildDockerImages
   // does in-monorepo. (This is why npm-consumer-smoke was red — ce-3rs.)
-  ensureRegistryServerBundle(join(REPO_ROOT, 'packages', 'e2e'));
+  ensureRegistryServerBundle(join(repoRoot(), 'packages', 'e2e'));
 
   console.log(`Packing @celilo/* packages → ${destination}`);
   console.log('');
 
-  // The name→version map used to rewrite each package's workspace:^ deps to
-  // concrete ranges that resolve against the co-packed versions (ISS-0103).
-  const versions = new Map<string, string>(
-    PACKAGES_TO_PACK.map(({ name, path }) => [name, workspaceVersion(path)]),
-  );
+  // Derive the package set + version map from the live workspace (never a
+  // hardcoded list). The rewrite map is the FULL workspace (every @celilo/*
+  // package) so any workspace: dep resolves or throws; the pack set is the
+  // runtime install closure of install.sh's roots.
+  const workspace = readWorkspace(repoRoot());
+  const versions = workspaceVersionMap(workspace);
+  const toPack = installClosure(workspace);
 
   const results: Array<{ name: string; version: string; tarball: string }> = [];
-  for (const { name, path } of PACKAGES_TO_PACK) {
-    const version = workspaceVersion(path);
-    console.log(`▸ ${name}@${version}  (${path})`);
-    const tarball = pack(path, destination, versions);
+  for (const { name, dir, version } of toPack) {
+    console.log(`▸ ${name}@${version}  (${dir})`);
+    const tarball = pack(dir, destination, versions);
     results.push({ name, version, tarball });
     console.log(`  → ${tarball}`);
     console.log('');

package/scripts/stage-libsignal.ts

@@ -0,0 +1,116 @@
+/**
+ * stage-libsignal.ts — put the libsignal JNI native (linux-aarch64) into the
+ * apt-repo staging pool, building it if we don't already have it.
+ *
+ * WHY THIS IS BUILT ON THE DEV MACHINE AND NOT IN THE E2E NETWORK
+ *
+ * The signal module needs a native that upstream does not publish for
+ * linux-aarch64 (see modules/signal/build/). Compiling it takes minutes,
+ * pulls hundreds of crates and a BoringSSL submodule, and needs crates.io and
+ * GitHub — none of which exist inside the sealed e2e network, and all of which
+ * would blow a 5-minute test budget.
+ *
+ * So the compile happens HERE, at `cele2e build-infra` time, on the host's own
+ * network, using the module's own recipe. The deploy then just installs a
+ * .deb, which is exactly what it does in production. The e2e network stays
+ * sealed and the deploy test stays fast, while the recipe is still exercised
+ * for real on every rebuild rather than rotting untested.
+ *
+ * Cached by version: the compile only re-runs when the version changes or the
+ * cached .deb is deleted.
+ *
+ * Graceful no-op when Docker is unavailable or the build fails — build-infra
+ * still completes, and the signal deploy test is what fails loudly (with an
+ * empty repo) rather than breaking the build for everyone. Mirrors how
+ * stageAptRepo treats a missing nfpm.
+ */
+
+import { spawnSync } from 'node:child_process';
+import { copyFileSync, existsSync, mkdirSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+
+const green = '\x1b[32m';
+const yellow = '\x1b[33m';
+const dim = '\x1b[2m';
+const reset = '\x1b[0m';
+
+/**
+ * Must match `modules/signal/manifest.yml`'s `libsignal_deb_url` default and
+ * `modules/signal/build/build.sh`. The build script verifies the pairing
+ * against the real signal-cli release, so a mismatch here fails the build
+ * loudly rather than producing a native that silently will not load.
+ */
+const LIBSIGNAL_VERSION = '0.96.3';
+const DEB_NAME = `libsignal-jni_${LIBSIGNAL_VERSION}_arm64.deb`;
+
+export function stageLibsignal(repoRoot: string, pkgDir: string): boolean {
+  const buildDir = join(repoRoot, 'modules', 'signal', 'build');
+  if (!existsSync(buildDir)) return false;
+
+  // Only aarch64 needs this native at all — an x86_64 host uses the one already
+  // bundled in the libsignal-client JAR. Building it there would mean an
+  // emulated compile of something nothing would install.
+  if (process.arch !== 'arm64') {
+    console.log(
+      `  ${'libsignal-jni'.padEnd(28)} ${dim}skip (host is ${process.arch}; JAR ships that native)${reset}`,
+    );
+    return true;
+  }
+
+  const pool = join(pkgDir, '.apt-repo-cache', 'pool');
+  const cache = join(pkgDir, '.libsignal-cache');
+  mkdirSync(pool, { recursive: true });
+  mkdirSync(cache, { recursive: true });
+
+  const cached = join(cache, DEB_NAME);
+
+  if (!existsSync(cached)) {
+    process.stdout.write(`  ${'libsignal-jni (build)'.padEnd(28)} `);
+    const t0 = Date.now();
+
+    const image = 'celilo-e2e/libsignal-builder';
+    const build = spawnSync(
+      'docker',
+      ['build', '--platform', 'linux/arm64', '-q', '-t', image, buildDir],
+      { stdio: 'pipe' },
+    );
+    if (build.status !== 0) {
+      console.log(`${yellow}skip${reset}  ${dim}(docker build failed)${reset}`);
+      return false;
+    }
+
+    // Named volumes keep the cargo registry and the checkout across runs, so a
+    // version bump is a few minutes rather than a fresh fetch of everything.
+    const run = spawnSync(
+      'docker',
+      [
+        'run',
+        '--rm',
+        '--platform',
+        'linux/arm64',
+        '-v',
+        `${cache}:/out`,
+        '-v',
+        'celilo-libsignal-work:/work',
+        '-v',
+        'celilo-libsignal-cargo:/root/.cargo/registry',
+        image,
+      ],
+      { stdio: 'pipe' },
+    );
+    if (run.status !== 0 || !existsSync(cached)) {
+      console.log(`${yellow}skip${reset}  ${dim}(build failed)${reset}`);
+      return false;
+    }
+    console.log(
+      `${green}✔${reset}  ${dim}${Math.round((Date.now() - t0) / 1000)}s${reset}`,
+    );
+  }
+
+  process.stdout.write(`  ${'libsignal-jni (stage)'.padEnd(28)} `);
+  for (const file of readdirSync(cache).filter((f) => f.endsWith('.deb'))) {
+    copyFileSync(join(cache, file), join(pool, file));
+  }
+  console.log(`${green}✔${reset}  ${dim}${DEB_NAME}${reset}`);
+  return true;
+}

package/simulators/signal-cli/server.ts

@@ -0,0 +1,272 @@
+/**
+ * signal-cli JSON-RPC daemon simulator.
+ *
+ * Mimics `signal-cli daemon --http <addr>`: JSON-RPC 2.0 over POST, with the
+ * behaviours that make the real thing awkward, because those are the ones
+ * celilo has to survive:
+ *
+ *   - errors arrive as a JSON-RPC `error` member with HTTP **200**, so code
+ *     that checks `response.ok` believes a rejected send succeeded;
+ *   - an unlinked/revoked account answers HTTP perfectly and can send nothing;
+ *   - `receive` returns receipts and typing indicators alongside real
+ *     messages, and those are not replies.
+ *
+ * It pushes back rather than saying yes. Sending to a number that has not been
+ * registered with the simulator fails the way Signal fails.
+ *
+ * ── FIDELITY ───────────────────────────────────────────────────────────────
+ * Every shape below is verified against signal-cli 0.14.6 running in a
+ * container, plus its published JSON schemas — not against recollection. The
+ * contract test in e2e re-checks the real daemon so this file cannot silently
+ * drift from it. See design.md D16 for the verified table.
+ *
+ * Still true: this cannot prove that a LINKED account delivers to a phone.
+ * That needs Signal's real network, and CDSI/SVR2 attestation makes a local
+ * substitute impossible. Everything short of delivery is verified.
+ * ───────────────────────────────────────────────────────────────────────────
+ *
+ * Control surface (simulator-only, not part of signal-cli):
+ *   POST /_control/inbound   {from, body}  queue a reply as if a human sent it
+ *   POST /_control/soft-fail {recipient}   make a recipient fail INSIDE a success
+ *   POST /_control/unlink                  revoke the device link
+ *   POST /_control/relink                  restore it
+ *   GET  /_control/sent                    every message sent, for assertions
+ */
+
+const ACCOUNT = process.env.SIGNAL_ACCOUNT ?? '+15551234567';
+const PORT = Number(process.env.SIGNAL_RPC_PORT ?? 8080);
+
+/** Numbers the simulator will accept as recipients. Anything else is rejected. */
+const KNOWN_RECIPIENTS = new Set(
+  (process.env.SIGNAL_KNOWN_RECIPIENTS ?? '')
+    .split(',')
+    .map((n) => n.trim())
+    .filter(Boolean),
+);
+
+interface SentMessage {
+  recipient: string;
+  message: string;
+  timestamp: number;
+}
+
+interface QueuedInbound {
+  from: string;
+  body: string;
+  timestamp: number;
+}
+
+const sent: SentMessage[] = [];
+/**
+ * Recipients that fail INSIDE a successful response, with a non-SUCCESS
+ * `type`. signal-cli only raises a JSON-RPC error when nothing succeeded, so
+ * this is how a partial failure looks — and how a client that checks only
+ * `error` ends up recording an undelivered page as sent.
+ */
+const unregisteredRecipients = new Set<string>();
+const inboundQueue: QueuedInbound[] = [];
+let linked = true;
+let clock = 1_722_200_000_000;
+
+const nextTimestamp = () => ++clock;
+
+function rpcResult(id: unknown, result: unknown): Response {
+  return Response.json({ jsonrpc: '2.0', id, result });
+}
+
+/**
+ * A JSON-RPC error, returned with HTTP 200 exactly as signal-cli does. This is
+ * the single most important fidelity detail in the simulator.
+ */
+function rpcError(id: unknown, code: number, message: string): Response {
+  return Response.json({ jsonrpc: '2.0', id, error: { code, message } }, { status: 200 });
+}
+
+function handleSend(id: unknown, params: Record<string, unknown>): Response {
+  if (!linked) {
+    return rpcError(id, -32000, 'Account is not registered or the device link was removed');
+  }
+
+  const recipients = Array.isArray(params.recipient) ? (params.recipient as string[]) : [];
+  const message = typeof params.message === 'string' ? params.message : '';
+
+  if (recipients.length === 0) return rpcError(id, -32602, 'No recipient given');
+
+  for (const recipient of recipients) {
+    // Push back like Signal: an unregistered number is a hard failure, not a
+    // silent no-op.
+    if (KNOWN_RECIPIENTS.size > 0 && !KNOWN_RECIPIENTS.has(recipient)) {
+      return rpcError(id, -32000, `Unregistered user: ${recipient}`);
+    }
+  }
+
+  const timestamp = nextTimestamp();
+  for (const recipient of recipients) {
+    sent.push({ recipient, message, timestamp });
+    console.log(`[signal-sim] -> ${recipient}: ${message.split('\n')[0]}`);
+  }
+
+  // Verified shape: { timestamp, results: [ { type, recipientAddress } ] }.
+  // The per-recipient `type` is the THIRD failure mode — a call can succeed
+  // at the JSON-RPC level and still not have delivered.
+  return rpcResult(id, {
+    timestamp,
+    results: recipients.map((recipient) => ({
+      type: unregisteredRecipients.has(recipient) ? 'UNREGISTERED_FAILURE' : 'SUCCESS',
+      recipientAddress: { number: recipient },
+    })),
+  });
+}
+
+/**
+ * Drain the inbound queue.
+ *
+ * Interleaves a delivery receipt and a typing indicator with real messages —
+ * the real daemon does, and a consumer that treats every envelope as a reply
+ * will misbehave on them.
+ */
+function handleReceive(id: unknown): Response {
+  if (!linked) {
+    return rpcError(id, -32000, 'Account is not registered or the device link was removed');
+  }
+
+  const envelopes: unknown[] = [
+    {
+      envelope: {
+        sourceNumber: ACCOUNT,
+        timestamp: nextTimestamp(),
+        receiptMessage: { isDelivery: true },
+      },
+    },
+  ];
+
+  while (inboundQueue.length > 0) {
+    const item = inboundQueue.shift() as QueuedInbound;
+    envelopes.push({
+      envelope: {
+        sourceNumber: item.from,
+        timestamp: item.timestamp,
+        dataMessage: { message: item.body },
+      },
+    });
+    console.log(`[signal-sim] <- ${item.from}: ${item.body}`);
+  }
+
+  envelopes.push({
+    envelope: {
+      sourceNumber: ACCOUNT,
+      timestamp: nextTimestamp(),
+      typingMessage: { action: 'STARTED' },
+    },
+  });
+
+  return rpcResult(id, envelopes);
+}
+
+function handleListAccounts(id: unknown): Response {
+  // A revoked link answers happily with an empty account list — reachability
+  // is not health.
+  return rpcResult(id, linked ? [{ number: ACCOUNT }] : []);
+}
+
+async function handleControl(url: URL, req: Request): Promise<Response> {
+  switch (url.pathname) {
+    case '/_control/inbound': {
+      const body = (await req.json()) as { from?: string; body?: string };
+      if (!body.from || !body.body) {
+        return Response.json({ error: 'from and body required' }, { status: 400 });
+      }
+      inboundQueue.push({ from: body.from, body: body.body, timestamp: nextTimestamp() });
+      return Response.json({ queued: inboundQueue.length });
+    }
+    case '/_control/soft-fail': {
+      const body = (await req.json()) as { recipient?: string };
+      if (!body.recipient) {
+        return Response.json({ error: 'recipient required' }, { status: 400 });
+      }
+      unregisteredRecipients.add(body.recipient);
+      return Response.json({ softFailing: [...unregisteredRecipients] });
+    }
+    case '/_control/unlink':
+      linked = false;
+      console.log('[signal-sim] device link revoked');
+      return Response.json({ linked });
+    case '/_control/relink':
+      linked = true;
+      console.log('[signal-sim] device link restored');
+      return Response.json({ linked });
+    case '/_control/sent':
+      return Response.json({ sent });
+    case '/_control/reset':
+      sent.length = 0;
+      inboundQueue.length = 0;
+      unregisteredRecipients.clear();
+      linked = true;
+      return Response.json({ ok: true });
+    default:
+      return new Response('Not found', { status: 404 });
+  }
+}
+
+Bun.serve({
+  port: PORT,
+  hostname: '0.0.0.0',
+  async fetch(req) {
+    const url = new URL(req.url);
+
+    if (url.pathname.startsWith('/_control/')) return handleControl(url, req);
+
+    // Verified endpoints on the real daemon.
+    if (url.pathname === '/api/v1/check') {
+      return req.method === 'GET' ? new Response(null, { status: 200 }) : new Response(null, { status: 405 });
+    }
+    if (url.pathname === '/api/v1/events') {
+      return new Response('', { status: 200, headers: { 'content-type': 'text/event-stream' } });
+    }
+    if (url.pathname !== '/api/v1/rpc') return new Response('Not found', { status: 404 });
+
+    // Verified: the real daemon returns 415 when Content-Type is not JSON.
+    const contentType = req.headers.get('content-type');
+    if (!contentType?.startsWith('application/json')) {
+      return new Response(null, { status: 415 });
+    }
+
+    if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+
+    let payload: { id?: unknown; method?: string; params?: Record<string, unknown> };
+    try {
+      payload = (await req.json()) as typeof payload;
+    } catch {
+      return Response.json(
+        { jsonrpc: '2.0', id: null, error: { code: -32700, message: 'Parse error' } },
+        { status: 200 },
+      );
+    }
+
+    const { id = null, method, params = {} } = payload;
+
+    switch (method) {
+      case 'send':
+        return handleSend(id, params);
+      case 'receive':
+        return handleReceive(id);
+      case 'listAccounts':
+        return handleListAccounts(id);
+      case 'version':
+        // Verified: { "version": "0.14.6" }
+        return rpcResult(id, { version: '0.14.6' });
+      default:
+        return rpcError(id, -32601, `Method not found: ${method}`);
+    }
+  },
+});
+
+console.log(`[signal-sim] signal-cli JSON-RPC simulator on :${PORT} as ${ACCOUNT}`);
+if (KNOWN_RECIPIENTS.size > 0) {
+  console.log(`[signal-sim] known recipients: ${[...KNOWN_RECIPIENTS].join(', ')}`);
+}
+
+// Marks this file a module so its top-level constants get their own scope.
+// Without it, `PORT` here collides with the same name in the isitup simulator,
+// which shares a tsconfig.
+export {};

package/src/cli/build.ts

@@ -23,13 +23,25 @@ import { cpSync, existsSync, mkdirSync, readdirSync, rmSync, writeFileSync } fro
 import { basename, join, resolve } from 'node:path';
 import { gunzipSync } from 'node:zlib';
 import { stageAptRepo } from '../../scripts/stage-apt-repo';
+import { stageLibsignal } from '../../scripts/stage-libsignal';
 import { ensureRegistryServerBundle } from '../registry-bundle';
 
-/** Walk up from pkgDir to find the monorepo root (contains a `modules/` dir). */
-function findMonorepoRoot(pkgDir: string): string | null {
+/**
+ * Walk up from pkgDir to find the celilo monorepo root.
+ *
+ * The marker is `apps/celilo/package.json` — a file that only a real celilo
+ * checkout has — NOT the presence of a `modules/` directory. A bare `modules/`
+ * is too weak a signal: a stray empty `node_modules/modules` (left by a botched
+ * `bun add -g`) made this return the global node_modules as "the monorepo root",
+ * which skipped `stageFromPublic()` and crashed the npm-consumer path in the
+ * workspace packer (ce-dbc). Matches the marker `container-manager.ts`'s
+ * findCeliloRoot already uses. Returns null in any consumer install, so callers
+ * correctly fall through to the published-source path.
+ */
+export function findMonorepoRoot(pkgDir: string): string | null {
   let dir = pkgDir;
   for (let i = 0; i < 10; i++) {
-    if (existsSync(join(dir, 'modules'))) return dir;
+    if (existsSync(join(dir, 'apps', 'celilo', 'package.json'))) return dir;
     const parent = resolve(dir, '..');
     if (parent === dir) break;
     dir = parent;
@@ -165,22 +177,36 @@ async function stageSimulatorInputs(pkgDir: string): Promise<void> {
   // time, so this must run before buildDockerImages().
   stageAptRepo(repoRoot, pkgDir);
 
+  // (d) Build + stage the libsignal aarch64 native as a .deb, into the SAME
+  // pool stageAptRepo just populated (so it must run after it — that function
+  // recreates the pool empty). Compiled here on the host's own network rather
+  // than inside the sealed e2e network; see stage-libsignal.ts.
+  stageLibsignal(repoRoot, pkgDir);
+
   console.log('');
 }
 
 /**
  * The published @celilo/* packages the npm-registry-sim must serve so
  * install.sh's `bun add -g @celilo/cli @celilo/event-bus @celilo/e2e`
- * resolves its full transitive closure against the sim. Mirrors
- * PACKAGES_TO_PACK in scripts/pack-celilo-packages.ts (the monorepo
- * equivalent that packs from workspace source instead of fetching).
+ * resolves its full transitive closure against the sim.
+ *
+ * This is the ONE place the install closure is a literal rather than derived:
+ * build.ts runs consumer-side (inside the published @celilo/e2e tarball, with
+ * NO monorepo present), so it cannot read the workspace package.json set at
+ * runtime the way the monorepo packer does. `installClosure(readWorkspace())`
+ * is the source of truth; this literal must match it, and
+ * published-packages-in-sync.test.ts fails the instant they drift (that test is
+ * why forgetting a package here can't recur — see WORKSPACE_PACKAGE_GRAPH.md).
+ * Keep this sorted the same as installClosure()'s topo output for easy diffing.
  */
-const PUBLISHED_CELILO_PACKAGES = [
-  '@celilo/cli',
+export const PUBLISHED_CELILO_PACKAGES = [
   '@celilo/capabilities',
   '@celilo/cli-display',
-  '@celilo/e2e',
+  '@celilo/core',
   '@celilo/event-bus',
+  '@celilo/e2e',
+  '@celilo/cli',
 ] as const;
 
 /**